Merge 192e37037bb487063c3e9456ad75e43ee2e8529e on remote branchLA.UM.7.8.r1-03000-SDM710.0

Change-Id: Ibf6a2ffd875a229c9415ba99713c006b67d051bf

55 files changed, 682 insertions, 451 deletions

diff --git a/Documentation/devicetree/bindings/input/qti-haptics.txt b/Documentation/devicetree/bindings/input/qti-haptics.txt
index 2c4f4f02ae34..b3daa49fe443 100644
--- a/Documentation/devicetree/bindings/input/qti-haptics.txt
+++ b/Documentation/devicetree/bindings/input/qti-haptics.txt
@@ -130,6 +130,15 @@ waveforms/effects:
 		 [5:1]: waveform amplitude
 		 [0]: reserved.
 
+- qcom,wf-vmax-mv
+  Usage:      optional
+  Value type: <u32>
+  Definition: Specifies the maximum allowed output voltage in millivolts
+		for this effect. Value specified here will be rounded
+		off to the closest multiple of 116 mV. Allowed values:
+		0 to 3596. If this is not specified, the value defined in
+		"qcom,vmax-mv" will be applied.
+
 - qcom,wf-play-rate-us
   Usage:      optional
   Value type: <u32>
diff --git a/arch/arm/configs/msm8909w-perf_defconfig b/arch/arm/configs/msm8909w-perf_defconfig
index cb12130fd2a2..b17a802dff52 100644
--- a/arch/arm/configs/msm8909w-perf_defconfig
+++ b/arch/arm/configs/msm8909w-perf_defconfig
@@ -262,6 +262,7 @@ CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_v26=y
 CONFIG_TOUCHSCREEN_FTS=y
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_QPNP_POWER_ON=y
+CONFIG_INPUT_QTI_HAPTICS=y
 CONFIG_INPUT_UINPUT=y
 # CONFIG_DEVMEM is not set
 # CONFIG_DEVKMEM is not set
@@ -372,7 +373,6 @@ CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_MSM=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
-CONFIG_LEDS_QPNP_HAPTICS=y
 CONFIG_LEDS_TRIGGERS=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_QPNP=y
diff --git a/arch/arm/configs/msm8909w_defconfig b/arch/arm/configs/msm8909w_defconfig
index a15ab9c708bb..04c8ff1979f4 100644
--- a/arch/arm/configs/msm8909w_defconfig
+++ b/arch/arm/configs/msm8909w_defconfig
@@ -251,6 +251,7 @@ CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_v26=y
 CONFIG_TOUCHSCREEN_FTS=y
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_QPNP_POWER_ON=y
+CONFIG_INPUT_QTI_HAPTICS=y
 CONFIG_INPUT_UINPUT=y
 # CONFIG_DEVMEM is not set
 # CONFIG_DEVKMEM is not set
@@ -364,7 +365,6 @@ CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_MSM=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
-CONFIG_LEDS_QPNP_HAPTICS=y
 CONFIG_LEDS_TRIGGERS=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_QPNP=y
diff --git a/arch/arm64/boot/dts/qcom/apq8053-lite-dragon.dtsi b/arch/arm64/boot/dts/qcom/apq8053-lite-dragon.dtsi
index 6638aac9188e..41152d201a6e 100644
--- a/arch/arm64/boot/dts/qcom/apq8053-lite-dragon.dtsi
+++ b/arch/arm64/boot/dts/qcom/apq8053-lite-dragon.dtsi
@@ -466,7 +466,6 @@
 
 &pmi_haptic{
 	status = "disabled";
-	qcom,actuator-type = "lra";
 	qcom,lra-auto-res-mode="qwd";
 	qcom,lra-high-z="opt1";
 	qcom,lra-res-cal-period = <0>;
diff --git a/arch/arm64/boot/dts/qcom/apq8053-lite-som.dts b/arch/arm64/boot/dts/qcom/apq8053-lite-som.dts
index eae111832cb2..fa51fd288c6a 100644
--- a/arch/arm64/boot/dts/qcom/apq8053-lite-som.dts
+++ b/arch/arm64/boot/dts/qcom/apq8053-lite-som.dts
@@ -370,7 +370,6 @@
 
 &pmi_haptic{
 	status = "disabled";
-	qcom,actuator-type = "lra";
 	qcom,lra-auto-res-mode="qwd";
 	qcom,lra-high-z="opt1";
 	qcom,lra-res-cal-period = <0>;
diff --git a/arch/arm64/boot/dts/qcom/msm8917-cdp-mirror-lake-touch.dtsi b/arch/arm64/boot/dts/qcom/msm8917-cdp-mirror-lake-touch.dtsi
index 178af9d23831..f1138c006e13 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-cdp-mirror-lake-touch.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8917-cdp-mirror-lake-touch.dtsi
@@ -100,7 +100,6 @@
 };
 
 &pmi_haptic{
-	qcom,actuator-type = "lra";
 	qcom,wave-play-rate-us = <4165>;
 	qcom,lra-auto-res-mode = "qwd";
 	qcom,lra-high-z = "opt1";
diff --git a/arch/arm64/boot/dts/qcom/msm8917.dtsi b/arch/arm64/boot/dts/qcom/msm8917.dtsi
index 8494aef64455..005189438a6d 100644
--- a/arch/arm64/boot/dts/qcom/msm8917.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8917.dtsi
@@ -1073,6 +1073,12 @@
 			qcom,smdpkt-dev-name = "smdcntl8";
 		};
 
+		qcom,smdpkt-data2 {
+			qcom,smdpkt-remote = "modem";
+			qcom,smdpkt-port-name = "DATA2";
+			qcom,smdpkt-dev-name = "at_mdm0";
+		};
+
 		qcom,smdpkt-apr-apps2 {
 			qcom,smdpkt-remote = "adsp";
 			qcom,smdpkt-port-name = "apr_apps2";
diff --git a/arch/arm64/boot/dts/qcom/msm8937.dtsi b/arch/arm64/boot/dts/qcom/msm8937.dtsi
index e328b4bb0701..1c13051a7897 100644
--- a/arch/arm64/boot/dts/qcom/msm8937.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8937.dtsi
@@ -1458,6 +1458,7 @@
 		qcom,qsee-ce-hw-instance = <0>;
 		qcom,disk-encrypt-pipe-pair = <2>;
 		qcom,support-fde;
+		qcom,commonlib64-loaded-by-uefi;
 		qcom,msm-bus,name = "qseecom-noc";
 		qcom,msm-bus,num-cases = <4>;
 		qcom,msm-bus,num-paths = <1>;
diff --git a/arch/arm64/boot/dts/qcom/msm8953.dtsi b/arch/arm64/boot/dts/qcom/msm8953.dtsi
index efe01f710ccd..cee178fbe352 100644
--- a/arch/arm64/boot/dts/qcom/msm8953.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8953.dtsi
@@ -424,6 +424,7 @@
 		qcom,qsee-ce-hw-instance = <0>;
 		qcom,disk-encrypt-pipe-pair = <2>;
 		qcom,support-fde;
+		qcom,commonlib64-loaded-by-uefi;
 		qcom,msm-bus,name = "qseecom-noc";
 		qcom,msm-bus,num-cases = <4>;
 		qcom,msm-bus,num-paths = <1>;
diff --git a/arch/arm64/boot/dts/qcom/pmi8940.dtsi b/arch/arm64/boot/dts/qcom/pmi8940.dtsi
index d83145cdea5c..2f39fc59d2e3 100644
--- a/arch/arm64/boot/dts/qcom/pmi8940.dtsi
+++ b/arch/arm64/boot/dts/qcom/pmi8940.dtsi
@@ -571,7 +571,7 @@
 			vcc_pon-supply = <&pon_perph_reg>;
 			qcom,play-mode = "direct";
 			qcom,wave-play-rate-us = <5263>;
-			qcom,actuator-type = "lra";
+			qcom,actuator-type = <0>;
 			qcom,wave-shape = "square";
 			qcom,vmax-mv = <2000>;
 			qcom,ilim-ma = <800>;
diff --git a/arch/arm64/boot/dts/qcom/qcs605-360camera.dtsi b/arch/arm64/boot/dts/qcom/qcs605-360camera.dtsi
index f5f3b3c4305f..0d47ba61fb99 100644
--- a/arch/arm64/boot/dts/qcom/qcs605-360camera.dtsi
+++ b/arch/arm64/boot/dts/qcom/qcs605-360camera.dtsi
@@ -138,15 +138,13 @@
 	};
 };
 
-&soc {
-	qcom,dsi-display@17 {
-		qcom,dsi-display-active;
+&ext_dsi_bridge_display {
+	qcom,dsi-display-active;
 
-		ports {
-			port@0 {
-				endpoint {
-					remote-endpoint = <&lt9611_in>;
-				};
+	ports {
+		port@0 {
+			endpoint {
+				remote-endpoint = <&lt9611_in>;
 			};
 		};
 	};
diff --git a/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dtsi b/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dtsi
index d6d9a1797f98..51e9e1b29e17 100644
--- a/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dtsi
+++ b/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dtsi
@@ -194,3 +194,7 @@
 &wcd9335 {
 	/delete-property/ cdc-vdd-mic-bias-supply;
 };
+
+&int_codec {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm670.dtsi b/arch/arm64/boot/dts/qcom/sdm670.dtsi
index bb07c045906b..5c40ecc92e38 100644
--- a/arch/arm64/boot/dts/qcom/sdm670.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm670.dtsi
@@ -1875,7 +1875,7 @@
 		ufs-qcom-crypto = <&ufs_ice>;
 
 		lanes-per-direction = <1>;
-		spm-level = <5>;
+
 		dev-ref-clk-freq = <0>; /* 19.2 MHz */
 
 		clock-names =
diff --git a/drivers/char/diag/diag_masks.c b/drivers/char/diag/diag_masks.c
index a3c19c4a6e5c..41ab3386f138 100644
--- a/drivers/char/diag/diag_masks.c
+++ b/drivers/char/diag/diag_masks.c
@@ -336,12 +336,13 @@ static void diag_send_msg_mask_update(uint8_t peripheral, int first, int last)
 	int header_len = sizeof(struct diag_ctrl_msg_mask);
 	uint8_t *buf = NULL, *temp = NULL;
 	uint8_t upd = 0;
-	uint8_t msg_mask_tbl_count_local;
+	uint8_t msg_mask_tbl_count_local = 0;
 	uint32_t mask_size = 0, pd_mask = 0;
 	struct diag_mask_info *mask_info = NULL;
 	struct diag_msg_mask_t *mask = NULL;
 	struct diag_ctrl_msg_mask header;
 	struct diagfwd_info *fwd_info = NULL;
+	struct diag_md_session_t *md_session_info = NULL;
 
 	if (peripheral >= NUM_PERIPHERALS)
 		return;
@@ -357,14 +358,19 @@ static void diag_send_msg_mask_update(uint8_t peripheral, int first, int last)
 
 	if (driver->md_session_mask != 0) {
 		if (driver->md_session_mask & MD_PERIPHERAL_MASK(peripheral)) {
-			if (driver->md_session_map[peripheral])
+			if (driver->md_session_map[peripheral]) {
 				mask_info =
 				driver->md_session_map[peripheral]->msg_mask;
+				md_session_info =
+					driver->md_session_map[peripheral];
+			}
 		} else if (driver->md_session_mask & pd_mask) {
 			upd = diag_mask_to_pd_value(driver->md_session_mask);
-			if (upd && driver->md_session_map[upd])
+			if (upd && driver->md_session_map[upd]) {
 				mask_info =
 				driver->md_session_map[upd]->msg_mask;
+				md_session_info = driver->md_session_map[upd];
+			}
 		} else {
 			DIAG_LOG(DIAG_DEBUG_MASKS,
 			"asking for mask update with unknown session mask\n");
@@ -383,7 +389,10 @@ static void diag_send_msg_mask_update(uint8_t peripheral, int first, int last)
 		return;
 	}
 	buf = mask_info->update_buf;
-	msg_mask_tbl_count_local = driver->msg_mask_tbl_count;
+	if (md_session_info)
+		msg_mask_tbl_count_local = md_session_info->msg_mask_tbl_count;
+	else
+		msg_mask_tbl_count_local = driver->msg_mask_tbl_count;
 	mutex_unlock(&driver->msg_mask_lock);
 	mutex_lock(&mask_info->lock);
 	switch (mask_info->status) {
@@ -565,6 +574,7 @@ static int diag_cmd_get_ssid_range(unsigned char *src_buf, int src_len,
 {
 	int i;
 	int write_len = 0;
+	uint8_t msg_mask_tbl_count = 0;
 	struct diag_msg_mask_t *mask_ptr = NULL;
 	struct diag_msg_ssid_query_t rsp;
 	struct diag_ssid_range_t ssid_range;
@@ -594,15 +604,17 @@ static int diag_cmd_get_ssid_range(unsigned char *src_buf, int src_len,
 		return 0;
 	}
 	mutex_lock(&driver->msg_mask_lock);
+	msg_mask_tbl_count = (info) ? info->msg_mask_tbl_count :
+		driver->msg_mask_tbl_count;
 	rsp.cmd_code = DIAG_CMD_MSG_CONFIG;
 	rsp.sub_cmd = DIAG_CMD_OP_GET_SSID_RANGE;
 	rsp.status = MSG_STATUS_SUCCESS;
 	rsp.padding = 0;
-	rsp.count = driver->msg_mask_tbl_count;
+	rsp.count = msg_mask_tbl_count;
 	memcpy(dest_buf, &rsp, sizeof(rsp));
 	write_len += sizeof(rsp);
 	mask_ptr = (struct diag_msg_mask_t *)mask_info->ptr;
-	for (i = 0; i <  driver->msg_mask_tbl_count; i++, mask_ptr++) {
+	for (i = 0; i < msg_mask_tbl_count; i++, mask_ptr++) {
 		if (write_len + sizeof(ssid_range) > dest_len) {
 			pr_err("diag: In %s, Truncating response due to size limitations of rsp buffer\n",
 			       __func__);
@@ -679,6 +691,7 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len,
 	int i;
 	int write_len = 0;
 	uint32_t mask_size = 0;
+	uint8_t msg_mask_tbl_count = 0;
 	struct diag_msg_mask_t *mask = NULL;
 	struct diag_build_mask_req_t *req = NULL;
 	struct diag_msg_build_mask_t rsp;
@@ -709,6 +722,8 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len,
 	}
 
 	mutex_lock(&driver->msg_mask_lock);
+	msg_mask_tbl_count = (info) ? info->msg_mask_tbl_count :
+			driver->msg_mask_tbl_count;
 	req = (struct diag_build_mask_req_t *)src_buf;
 	rsp.cmd_code = DIAG_CMD_MSG_CONFIG;
 	rsp.sub_cmd = DIAG_CMD_OP_GET_MSG_MASK;
@@ -724,7 +739,7 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len,
 		mutex_unlock(&driver->md_session_lock);
 		return -EINVAL;
 	}
-	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {
+	for (i = 0; i < msg_mask_tbl_count; i++, mask++) {
 		if (!mask->ptr)
 			continue;
 		if ((req->ssid_first < mask->ssid_first) ||
@@ -760,6 +775,7 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len,
 	struct diag_mask_info *mask_info = NULL;
 	struct diag_msg_mask_t *mask_next = NULL;
 	struct diag_md_session_t *info = NULL;
+	uint8_t msg_mask_tbl_count = 0;
 
 	mutex_lock(&driver->md_session_lock);
 	info = diag_md_session_get_pid(pid);
@@ -792,10 +808,13 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len,
 		mutex_unlock(&driver->md_session_lock);
 		return -EINVAL;
 	}
-	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {
+
+	msg_mask_tbl_count = (info) ? info->msg_mask_tbl_count :
+			driver->msg_mask_tbl_count;
+	for (i = 0; i < msg_mask_tbl_count; i++, mask++) {
 		if (!mask->ptr)
 			continue;
-		if (i < (driver->msg_mask_tbl_count - 1)) {
+		if (i < (msg_mask_tbl_count - 1)) {
 			mask_next = mask;
 			mask_next++;
 		} else
@@ -905,6 +924,7 @@ static int diag_cmd_set_all_msg_mask(unsigned char *src_buf, int src_len,
 	struct diag_msg_mask_t *mask = NULL;
 	struct diag_mask_info *mask_info = NULL;
 	struct diag_md_session_t *info = NULL;
+	uint8_t msg_mask_tbl_count = 0;
 
 	mutex_lock(&driver->md_session_lock);
 	info = diag_md_session_get_pid(pid);
@@ -939,9 +959,11 @@ static int diag_cmd_set_all_msg_mask(unsigned char *src_buf, int src_len,
 		mutex_unlock(&driver->md_session_lock);
 		return -EINVAL;
 	}
+	msg_mask_tbl_count = (info) ? info->msg_mask_tbl_count :
+			driver->msg_mask_tbl_count;
 	mask_info->status = (req->rt_mask) ? DIAG_CTRL_MASK_ALL_ENABLED :
 					   DIAG_CTRL_MASK_ALL_DISABLED;
-	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {
+	for (i = 0; i < msg_mask_tbl_count; i++, mask++) {
 		if (mask && mask->ptr) {
 			mutex_lock(&mask->lock);
 			memset(mask->ptr, req->rt_mask,
@@ -1755,7 +1777,6 @@ static int __diag_mask_init(struct diag_mask_info *mask_info, int mask_len,
 		}
 		kmemleak_not_leak(mask_info->update_buf);
 	}
-	mutex_init(&mask_info->lock);
 	return 0;
 }
 
@@ -1778,9 +1799,10 @@ int diag_log_mask_copy(struct diag_mask_info *dest, struct diag_mask_info *src)
 	struct diag_log_mask_t *src_mask = NULL;
 	struct diag_log_mask_t *dest_mask = NULL;
 
-	if (!src)
+	if (!src || !dest)
 		return -EINVAL;
 
+	mutex_init(&dest->lock);
 	err = __diag_mask_init(dest, LOG_MASK_SIZE, APPS_BUF_SIZE);
 	if (err)
 		return err;
@@ -1842,9 +1864,11 @@ static int diag_msg_mask_init(void)
 {
 	int err = 0, i;
 
+	mutex_init(&msg_mask.lock);
 	err = __diag_mask_init(&msg_mask, MSG_MASK_SIZE, APPS_BUF_SIZE);
 	if (err)
 		return err;
+
 	err = diag_create_msg_mask_table();
 	if (err) {
 		pr_err("diag: Unable to create msg masks, err: %d\n", err);
@@ -1859,7 +1883,8 @@ static int diag_msg_mask_init(void)
 	return 0;
 }
 
-int diag_msg_mask_copy(struct diag_mask_info *dest, struct diag_mask_info *src)
+int diag_msg_mask_copy(struct diag_md_session_t *new_session,
+	struct diag_mask_info *dest, struct diag_mask_info *src)
 {
 	int i, err = 0, mask_size = 0;
 	struct diag_msg_mask_t *src_mask = NULL;
@@ -1869,17 +1894,25 @@ int diag_msg_mask_copy(struct diag_mask_info *dest, struct diag_mask_info *src)
 	if (!src || !dest)
 		return -EINVAL;
 
-	err = __diag_mask_init(dest, MSG_MASK_SIZE, APPS_BUF_SIZE);
-	if (err)
-		return err;
+	mutex_init(&dest->lock);
 	mutex_lock(&dest->lock);
 	mutex_lock(&driver->msg_mask_lock);
+	new_session->msg_mask_tbl_count =
+		driver->msg_mask_tbl_count;
+	err = __diag_mask_init(dest,
+		(new_session->msg_mask_tbl_count *
+		sizeof(struct diag_msg_mask_t)), APPS_BUF_SIZE);
+	if (err) {
+		mutex_unlock(&driver->msg_mask_lock);
+		mutex_unlock(&dest->lock);
+		return err;
+	}
 	src_mask = (struct diag_msg_mask_t *)src->ptr;
 	dest_mask = (struct diag_msg_mask_t *)dest->ptr;
 
 	dest->mask_len = src->mask_len;
 	dest->status = src->status;
-	for (i = 0; i < driver->msg_mask_tbl_count; i++) {
+	for (i = 0; i < new_session->msg_mask_tbl_count; i++) {
 		range.ssid_first = src_mask->ssid_first;
 		range.ssid_last = src_mask->ssid_last;
 		err = diag_create_msg_mask_table_entry(dest_mask, &range);
@@ -1898,10 +1931,12 @@ int diag_msg_mask_copy(struct diag_mask_info *dest, struct diag_mask_info *src)
 	return err;
 }
 
-void diag_msg_mask_free(struct diag_mask_info *mask_info)
+void diag_msg_mask_free(struct diag_mask_info *mask_info,
+	struct diag_md_session_t *session_info)
 {
 	int i;
 	struct diag_msg_mask_t *mask = NULL;
+	uint8_t msg_mask_tbl_count = 0;
 
 	if (!mask_info || !mask_info->ptr)
 		return;
@@ -1915,7 +1950,10 @@ void diag_msg_mask_free(struct diag_mask_info *mask_info)
 		mutex_unlock(&mask_info->lock);
 		return;
 	}
-	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {
+	msg_mask_tbl_count = (session_info) ?
+		session_info->msg_mask_tbl_count :
+		driver->msg_mask_tbl_count;
+	for (i = 0; i < msg_mask_tbl_count; i++, mask++) {
 		kfree(mask->ptr);
 		mask->ptr = NULL;
 	}
@@ -1946,6 +1984,7 @@ static int diag_build_time_mask_init(void)
 	int err = 0;
 
 	/* There is no need for update buffer for Build Time masks */
+	mutex_init(&msg_bt_mask.lock);
 	err = __diag_mask_init(&msg_bt_mask, MSG_MASK_SIZE, 0);
 	if (err)
 		return err;
@@ -1978,6 +2017,7 @@ static int diag_log_mask_init(void)
 {
 	int err = 0, i;
 
+	mutex_init(&log_mask.lock);
 	err = __diag_mask_init(&log_mask, LOG_MASK_SIZE, APPS_BUF_SIZE);
 	if (err)
 		return err;
@@ -2011,6 +2051,7 @@ static int diag_event_mask_init(void)
 {
 	int err = 0, i;
 
+	mutex_init(&event_mask.lock);
 	err = __diag_mask_init(&event_mask, EVENT_MASK_SIZE, APPS_BUF_SIZE);
 	if (err)
 		return err;
@@ -2032,6 +2073,7 @@ int diag_event_mask_copy(struct diag_mask_info *dest,
 	if (!src || !dest)
 		return -EINVAL;
 
+	mutex_init(&dest->lock);
 	err = __diag_mask_init(dest, EVENT_MASK_SIZE, APPS_BUF_SIZE);
 	if (err)
 		return err;
@@ -2068,6 +2110,7 @@ int diag_copy_to_user_msg_mask(char __user *buf, size_t count,
 	struct diag_mask_info *mask_info = NULL;
 	struct diag_msg_mask_t *mask = NULL;
 	unsigned char *ptr = NULL;
+	uint8_t msg_mask_tbl_count = 0;
 
 	if (!buf || count == 0)
 		return -EINVAL;
@@ -2092,7 +2135,10 @@ int diag_copy_to_user_msg_mask(char __user *buf, size_t count,
 		mutex_unlock(&mask_info->lock);
 		return -EINVAL;
 	}
-	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {
+
+	msg_mask_tbl_count = (info) ? info->msg_mask_tbl_count :
+			driver->msg_mask_tbl_count;
+	for (i = 0; i < msg_mask_tbl_count; i++, mask++) {
 		if (!mask->ptr)
 			continue;
 		ptr = mask_info->update_buf;
diff --git a/drivers/char/diag/diag_masks.h b/drivers/char/diag/diag_masks.h
index 6edeee954d74..a736ff269e8d 100644
--- a/drivers/char/diag/diag_masks.h
+++ b/drivers/char/diag/diag_masks.h
@@ -160,12 +160,13 @@ int diag_masks_init(void);
 void diag_masks_exit(void);
 int diag_log_mask_copy(struct diag_mask_info *dest,
 		       struct diag_mask_info *src);
-int diag_msg_mask_copy(struct diag_mask_info *dest,
-		       struct diag_mask_info *src);
+int diag_msg_mask_copy(struct diag_md_session_t *new_session,
+	struct diag_mask_info *dest, struct diag_mask_info *src);
 int diag_event_mask_copy(struct diag_mask_info *dest,
 			 struct diag_mask_info *src);
 void diag_log_mask_free(struct diag_mask_info *mask_info);
-void diag_msg_mask_free(struct diag_mask_info *mask_info);
+void diag_msg_mask_free(struct diag_mask_info *mask_info,
+	struct diag_md_session_t *session_info);
 void diag_event_mask_free(struct diag_mask_info *mask_info);
 int diag_process_apps_masks(unsigned char *buf, int len, int pid);
 void diag_send_updates_peripheral(uint8_t peripheral);
diff --git a/drivers/char/diag/diagchar.h b/drivers/char/diag/diagchar.h
index 9bbfb82fec13..f63d78c32b6e 100644
--- a/drivers/char/diag/diagchar.h
+++ b/drivers/char/diag/diagchar.h
@@ -483,6 +483,7 @@ struct diag_md_session_t {
 	int pid;
 	int peripheral_mask;
 	uint8_t hdlc_disabled;
+	uint8_t msg_mask_tbl_count;
 	struct timer_list hdlc_reset_timer;
 	struct diag_mask_info *msg_mask;
 	struct diag_mask_info *log_mask;
diff --git a/drivers/char/diag/diagchar_core.c b/drivers/char/diag/diagchar_core.c
index 8b089eb6c850..131a050c7f1a 100644
--- a/drivers/char/diag/diagchar_core.c
+++ b/drivers/char/diag/diagchar_core.c
@@ -1264,7 +1264,8 @@ static void diag_md_session_exit(void)
 			diag_log_mask_free(session_info->log_mask);
 			kfree(session_info->log_mask);
 			session_info->log_mask = NULL;
-			diag_msg_mask_free(session_info->msg_mask);
+			diag_msg_mask_free(session_info->msg_mask,
+				session_info);
 			kfree(session_info->msg_mask);
 			session_info->msg_mask = NULL;
 			diag_event_mask_free(session_info->event_mask);
@@ -1335,7 +1336,9 @@ int diag_md_session_create(int mode, int peripheral_mask, int proc)
 			 "return value of event copy. err %d\n", err);
 		goto fail_peripheral;
 	}
-	err = diag_msg_mask_copy(new_session->msg_mask, &msg_mask);
+	new_session->msg_mask_tbl_count = 0;
+	err = diag_msg_mask_copy(new_session, new_session->msg_mask,
+		&msg_mask);
 	if (err) {
 		DIAG_LOG(DIAG_DEBUG_USERSPACE,
 			 "return value of msg copy. err %d\n", err);
@@ -1371,7 +1374,8 @@ fail_peripheral:
 	diag_event_mask_free(new_session->event_mask);
 	kfree(new_session->event_mask);
 	new_session->event_mask = NULL;
-	diag_msg_mask_free(new_session->msg_mask);
+	diag_msg_mask_free(new_session->msg_mask,
+		new_session);
 	kfree(new_session->msg_mask);
 	new_session->msg_mask = NULL;
 	kfree(new_session);
@@ -1399,7 +1403,8 @@ static void diag_md_session_close(int pid)
 	diag_log_mask_free(session_info->log_mask);
 	kfree(session_info->log_mask);
 	session_info->log_mask = NULL;
-	diag_msg_mask_free(session_info->msg_mask);
+	diag_msg_mask_free(session_info->msg_mask,
+		session_info);
 	kfree(session_info->msg_mask);
 	session_info->msg_mask = NULL;
 	diag_event_mask_free(session_info->event_mask);
diff --git a/drivers/input/misc/qti-haptics.c b/drivers/input/misc/qti-haptics.c
index 310eb4162af0..f60e835af89c 100644
--- a/drivers/input/misc/qti-haptics.c
+++ b/drivers/input/misc/qti-haptics.c
@@ -175,6 +175,7 @@ struct qti_hap_effect {
 	u8			*pattern;
 	int			pattern_length;
 	u16			play_rate_us;
+	u16			vmax_mv;
 	u8			wf_repeat_n;
 	u8			wf_s_repeat_n;
 	u8			brake[HAP_BRAKE_PATTERN_MAX];
@@ -527,7 +528,6 @@ static int qti_haptics_config_brake(struct qti_hap_chip *chip, u8 *brake)
 {
 	u8 addr, mask, val;
 	int i, rc;
-	bool en = true;
 
 	addr = REG_HAP_BRAKE;
 	for (val = 0, i = 0; i < HAP_BRAKE_PATTERN_MAX; i++)
@@ -539,14 +539,12 @@ static int qti_haptics_config_brake(struct qti_hap_chip *chip, u8 *brake)
 		dev_err(chip->dev, "write brake pattern failed, rc=%d\n", rc);
 		return rc;
 	}
-
-	if (val == 0)
-		en = false;
-
-	/* Set BRAKE_EN only if brake pattern is non-zero */
+	/*
+	 * Set BRAKE_EN regardless of the brake pattern, this helps to stop
+	 * playing immediately once the valid values in WF_Sx are played.
+	 */
 	addr = REG_HAP_EN_CTL2;
-	mask = HAP_BRAKE_EN_BIT;
-	val = en;
+	val = mask = HAP_BRAKE_EN_BIT;
 	rc = qti_haptics_masked_write(chip, addr, mask, val);
 	if (rc < 0)
 		dev_err(chip->dev, "set EN_CTL2 failed, rc=%d\n", rc);
@@ -579,6 +577,9 @@ static int qti_haptics_load_constant_waveform(struct qti_hap_chip *chip)
 	if (rc < 0)
 		return rc;
 
+	rc = qti_haptics_config_play_rate_us(chip, config->play_rate_us);
+	if (rc < 0)
+		return rc;
 	/*
 	 * Using VMAX waveform source if playing length is >= 20ms,
 	 * otherwise using buffer waveform source and calculate the
@@ -696,7 +697,6 @@ static irqreturn_t qti_haptics_play_irq_handler(int irq, void *data)
 	dev_dbg(chip->dev, "play_irq triggered\n");
 	if (play->playing_pos == effect->pattern_length) {
 		dev_dbg(chip->dev, "waveform playing done\n");
-		qti_haptics_play(chip, false);
 		if (chip->play_irq_en) {
 			disable_irq_nosync(chip->play_irq);
 			chip->play_irq_en = false;
@@ -830,10 +830,6 @@ static int qti_haptics_upload_effect(struct input_dev *dev,
 			goto disable_vdd;
 		}
 
-		level = effect->u.periodic.magnitude;
-		tmp = level * config->vmax_mv;
-		play->vmax_mv = tmp / 0x7fff;
-
 		if (copy_from_user(data, effect->u.periodic.custom_data,
 					sizeof(s16) * CUSTOM_DATA_LEN)) {
 			rc = -EFAULT;
@@ -852,6 +848,10 @@ static int qti_haptics_upload_effect(struct input_dev *dev,
 			goto disable_vdd;
 		}
 
+		level = effect->u.periodic.magnitude;
+		tmp = level * chip->predefined[i].vmax_mv;
+		play->vmax_mv = tmp / 0x7fff;
+
 		dev_dbg(chip->dev, "upload effect %d, vmax_mv=%d\n",
 				chip->predefined[i].id, play->vmax_mv);
 		rc = qti_haptics_load_predefined_effect(chip, i);
@@ -918,6 +918,10 @@ static int qti_haptics_playback(struct input_dev *dev, int effect_id, int val)
 				enable_irq(chip->play_irq);
 				chip->play_irq_en = true;
 			}
+			/* Toggle PLAY when playing pattern */
+			rc = qti_haptics_play(chip, false);
+			if (rc < 0)
+				return rc;
 		} else {
 			if (chip->play_irq_en) {
 				disable_irq_nosync(chip->play_irq);
@@ -966,6 +970,22 @@ static int qti_haptics_erase(struct input_dev *dev, int effect_id)
 	return rc;
 }
 
+static void qti_haptics_set_gain(struct input_dev *dev, u16 gain)
+{
+	struct qti_hap_chip *chip = input_get_drvdata(dev);
+	struct qti_hap_config *config = &chip->config;
+	struct qti_hap_play_info *play = &chip->play;
+
+	if (gain == 0)
+		return;
+
+	if (gain > 0x7fff)
+		gain = 0x7fff;
+
+	play->vmax_mv = ((u32)(gain * config->vmax_mv)) / 0x7fff;
+	qti_haptics_config_vmax(chip, play->vmax_mv);
+}
+
 static int qti_haptics_hw_init(struct qti_hap_chip *chip)
 {
 	struct qti_hap_config *config = &chip->config;
@@ -1092,7 +1112,7 @@ static int qti_haptics_parse_dt(struct qti_hap_chip *chip)
 	struct device_node *child_node;
 	struct qti_hap_effect *effect;
 	const char *str;
-	int rc = 0, tmp, i = 0, j;
+	int rc = 0, tmp, i = 0, j, m;
 	u8 val;
 
 	rc = of_property_read_u32(node, "reg", &tmp);
@@ -1234,6 +1254,15 @@ static int qti_haptics_parse_dt(struct qti_hap_chip *chip)
 			return rc;
 		}
 
+		effect->vmax_mv = config->vmax_mv;
+		rc = of_property_read_u32(child_node, "qcom,wf-vmax-mv", &tmp);
+		if (rc < 0)
+			dev_dbg(chip->dev, "Read qcom,wf-vmax-mv failed, rc=%d\n",
+					rc);
+		else
+			effect->vmax_mv = (tmp > HAP_VMAX_MV_MAX) ?
+				HAP_VMAX_MV_MAX : tmp;
+
 		rc = of_property_count_elems_of_size(child_node,
 				"qcom,wf-pattern", sizeof(u8));
 		if (rc < 0) {
@@ -1301,7 +1330,7 @@ static int qti_haptics_parse_dt(struct qti_hap_chip *chip)
 			effect->wf_s_repeat_n = j;
 		}
 
-		effect->lra_auto_res_disable = of_property_read_bool(node,
+		effect->lra_auto_res_disable = of_property_read_bool(child_node,
 				"qcom,lra-auto-resonance-disable");
 
 		tmp = of_property_count_elems_of_size(child_node,
@@ -1337,6 +1366,28 @@ static int qti_haptics_parse_dt(struct qti_hap_chip *chip)
 		effect->brake_en = (val != 0);
 	}
 
+	for (j = 0; j < i; j++) {
+		dev_dbg(chip->dev, "effect: %d\n", chip->predefined[j].id);
+		dev_dbg(chip->dev, "        vmax: %d mv\n",
+				chip->predefined[j].vmax_mv);
+		dev_dbg(chip->dev, "        play_rate: %d us\n",
+				chip->predefined[j].play_rate_us);
+		for (m = 0; m < chip->predefined[j].pattern_length; m++)
+			dev_dbg(chip->dev, "        pattern[%d]: 0x%x\n",
+					m, chip->predefined[j].pattern[m]);
+		for (m = 0; m < chip->predefined[j].brake_pattern_length; m++)
+			dev_dbg(chip->dev, "        brake_pattern[%d]: 0x%x\n",
+					m, chip->predefined[j].brake[m]);
+		dev_dbg(chip->dev, "    brake_en: %d\n",
+				chip->predefined[j].brake_en);
+		dev_dbg(chip->dev, "    wf_repeat_n: %d\n",
+				chip->predefined[j].wf_repeat_n);
+		dev_dbg(chip->dev, "    wf_s_repeat_n: %d\n",
+				chip->predefined[j].wf_s_repeat_n);
+		dev_dbg(chip->dev, "    lra_auto_res_disable: %d\n",
+				chip->predefined[j].lra_auto_res_disable);
+	}
+
 	return 0;
 }
 
@@ -1404,6 +1455,7 @@ static int qti_haptics_probe(struct platform_device *pdev)
 	chip->input_dev = input_dev;
 
 	input_set_capability(input_dev, EV_FF, FF_CONSTANT);
+	input_set_capability(input_dev, EV_FF, FF_GAIN);
 	if (chip->effects_count != 0) {
 		input_set_capability(input_dev, EV_FF, FF_PERIODIC);
 		input_set_capability(input_dev, EV_FF, FF_CUSTOM);
@@ -1424,6 +1476,7 @@ static int qti_haptics_probe(struct platform_device *pdev)
 	ff->upload = qti_haptics_upload_effect;
 	ff->playback = qti_haptics_playback;
 	ff->erase = qti_haptics_erase;
+	ff->set_gain = qti_haptics_set_gain;
 
 	rc = input_register_device(input_dev);
 	if (rc < 0) {
diff --git a/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c b/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c
index cddbd8309ece..f2796be6d682 100644
--- a/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c
+++ b/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c
@@ -422,7 +422,7 @@ int cam_hw_cdm_submit_bl(struct cam_hw_info *cdm_hw,
 	}
 
 	for (i = 0; i < req->data->cmd_arrary_count ; i++) {
-		uint64_t hw_vaddr_ptr = 0;
+		dma_addr_t hw_vaddr_ptr = 0;
 		size_t len = 0;
 
 		if ((!cdm_cmd->cmd[i].len) &&
@@ -470,7 +470,7 @@ int cam_hw_cdm_submit_bl(struct cam_hw_info *cdm_hw,
 			}
 			rc = 0;
 			hw_vaddr_ptr =
-				(uint64_t)cdm_cmd->cmd[i].bl_addr.hw_iova;
+				(dma_addr_t) cdm_cmd->cmd[i].bl_addr.hw_iova;
 			len = cdm_cmd->cmd[i].len + cdm_cmd->cmd[i].offset;
 		} else {
 			CAM_ERR(CAM_CDM,
diff --git a/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c b/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c
index 212065050d81..053447e331a8 100644
--- a/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c
+++ b/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c
@@ -581,15 +581,16 @@ static int cam_cpas_util_set_camnoc_axi_clk_rate(
 				required_camnoc_bw);
 		}
 
-		required_camnoc_bw += (required_camnoc_bw *
-			soc_private->camnoc_axi_clk_bw_margin) / 100;
+		required_camnoc_bw += div64_u64((required_camnoc_bw *
+			soc_private->camnoc_axi_clk_bw_margin), 100);
 
 		if ((required_camnoc_bw > 0) &&
 			(required_camnoc_bw <
 			soc_private->camnoc_axi_min_ib_bw))
 			required_camnoc_bw = soc_private->camnoc_axi_min_ib_bw;
 
-		clk_rate = required_camnoc_bw / soc_private->camnoc_bus_width;
+		clk_rate = div64_u64(required_camnoc_bw,
+			soc_private->camnoc_bus_width);
 
 		CAM_DBG(CAM_CPAS, "Setting camnoc axi clk rate : %llu %d",
 			required_camnoc_bw, clk_rate);
diff --git a/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c b/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
index d3c39f940f05..09388fe40c70 100644
--- a/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
@@ -536,7 +536,7 @@ static int cam_fd_mgr_util_prepare_io_buf_info(int32_t iommu_hdl,
 	int rc = -EINVAL;
 	uint32_t i, j, plane, num_out_buf, num_in_buf;
 	struct cam_buf_io_cfg *io_cfg;
-	uint64_t io_addr[CAM_PACKET_MAX_PLANES];
+	dma_addr_t io_addr[CAM_PACKET_MAX_PLANES];
 	uint64_t cpu_addr[CAM_PACKET_MAX_PLANES];
 	size_t size;
 	bool need_io_map, need_cpu_map;
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
index 1733017a3106..4aa2b61104b8 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
@@ -599,7 +599,7 @@ static uint32_t cam_icp_mgr_calc_base_clk(uint32_t frame_cycles,
 	uint64_t base_clk;
 	uint64_t mul = 1000000000;
 
-	base_clk = (frame_cycles * mul) / budget;
+	base_clk = div64_u64((frame_cycles * mul), budget);
 
 	CAM_DBG(CAM_ICP, "budget = %lld fc = %d ib = %lld base_clk = %lld",
 		budget, frame_cycles,
@@ -3099,7 +3099,7 @@ static int cam_icp_mgr_send_config_io(struct cam_icp_hw_ctx_data *ctx_data,
 	task_data->type = ICP_WORKQ_TASK_MSG_TYPE;
 	task->process_cb = cam_icp_mgr_process_cmd;
 	size_in_words = (*(uint32_t *)task_data->data) >> 2;
-	CAM_INFO(CAM_ICP, "size_in_words %u", size_in_words);
+	CAM_DBG(CAM_ICP, "size_in_words %u", size_in_words);
 	rc = cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
 		CRM_TASK_PRIORITY_0);
 	if (rc)
@@ -3175,8 +3175,8 @@ static int cam_icp_mgr_config_hw(void *hw_mgr_priv, void *config_hw_args)
 	frame_info = (struct icp_frame_info *)config_args->priv;
 	req_id = frame_info->request_id;
 	idx = cam_icp_clk_idx_from_req_id(ctx_data, req_id);
-	ctx_data->hfi_frame_process.fw_process_flag[idx] = true;
 	cam_icp_mgr_ipe_bps_clk_update(hw_mgr, ctx_data, idx);
+	ctx_data->hfi_frame_process.fw_process_flag[idx] = true;
 
 	CAM_DBG(CAM_ICP, "req_id %llu, io config %llu", req_id,
 		frame_info->io_config);
@@ -3268,7 +3268,7 @@ static int cam_icp_mgr_process_cmd_desc(struct cam_icp_hw_mgr *hw_mgr,
 {
 	int rc = 0;
 	int i, j, k;
-	uint64_t addr;
+	dma_addr_t addr;
 	size_t len;
 	struct cam_cmd_buf_desc *cmd_desc = NULL;
 	uint64_t cpu_addr = 0;
@@ -3490,7 +3490,7 @@ static int cam_icp_process_generic_cmd_buffer(
 	struct cam_packet *packet,
 	struct cam_icp_hw_ctx_data *ctx_data,
 	int32_t index,
-	uint64_t *io_buf_addr)
+	dma_addr_t *io_buf_addr)
 {
 	int i, rc = 0;
 	struct cam_cmd_buf_desc *cmd_desc = NULL;
@@ -4132,7 +4132,7 @@ static int cam_icp_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args)
 {
 	int rc = 0, bitmap_size = 0;
 	uint32_t ctx_id = 0;
-	uint64_t io_buf_addr;
+	dma_addr_t io_buf_addr;
 	size_t io_buf_size;
 	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
 	struct cam_icp_hw_ctx_data *ctx_data = NULL;
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h
index 0b931f3c7636..8c132c52739d 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h
@@ -135,7 +135,7 @@ struct clk_work_data {
   */
 struct icp_frame_info {
 	uint64_t request_id;
-	uint64_t io_config;
+	dma_addr_t io_config;
 	struct hfi_cmd_ipebps_async hfi_cfg_io_cmd;
 };
 
@@ -238,7 +238,7 @@ struct cam_icp_hw_ctx_data {
 struct icp_cmd_generic_blob {
 	struct cam_icp_hw_ctx_data *ctx;
 	uint32_t frame_info_idx;
-	uint64_t *io_buf_addr;
+	dma_addr_t *io_buf_addr;
 };
 
 /**
diff --git a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
index 08ef0e9dcf19..bd1e6b1dffbd 100755
--- a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
+++ b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
@@ -25,19 +25,15 @@
 #include "cam_debug_util.h"
 
 static const char isp_dev_name[] = "isp";
-
-#define INC_STATE_MONITOR_HEAD(head) \
-	(atomic64_add_return(1, head) % \
-	CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES)
-
 static void __cam_isp_ctx_update_state_monitor_array(
 	struct cam_isp_context *ctx_isp,
 	enum cam_isp_state_change_trigger trigger_type,
 	uint32_t req_id)
 {
-	int iterator = 0;
+	uint64_t iterator = 0;
 
-	iterator = INC_STATE_MONITOR_HEAD(&ctx_isp->state_monitor_head);
+	div64_u64_rem(atomic64_add_return(1, &ctx_isp->state_monitor_head),
+		CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES, &iterator);
 	ctx_isp->cam_isp_ctx_state_monitor[iterator].curr_state =
 		ctx_isp->substate_activated;
 	ctx_isp->cam_isp_ctx_state_monitor[iterator].trigger =
@@ -96,6 +92,7 @@ static void __cam_isp_ctx_dump_state_monitor_array(
 	int i = 0;
 	uint64_t state_head = 0;
 	uint64_t index;
+	struct cam_isp_context_state_monitor *cam_isp_ctx_state_monitor;
 
 	state_head = atomic64_read(&ctx_isp->state_monitor_head);
 	CAM_ERR_RATE_LIMIT(CAM_ISP,
@@ -103,17 +100,20 @@ static void __cam_isp_ctx_dump_state_monitor_array(
 
 	for (i = CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES - 1; i >= 0;
 		i--) {
-		index = (((state_head - i) +
-			CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES) %
-			CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES);
+		div64_u64_rem(((state_head - i) +
+			CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES),
+			CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES, &index);
+		cam_isp_ctx_state_monitor =
+			&ctx_isp->cam_isp_ctx_state_monitor[index];
+
 		CAM_ERR_RATE_LIMIT(CAM_ISP,
-		"time[0x%llx] req_id[%u] state[%s] evt_type[%s]",
-		ctx_isp->cam_isp_ctx_state_monitor[index].evt_time_stamp,
-		ctx_isp->cam_isp_ctx_state_monitor[index].req_id,
-		__cam_isp_ctx_substate_val_to_type(
-		ctx_isp->cam_isp_ctx_state_monitor[index].curr_state),
-		__cam_isp_hw_evt_val_to_type(
-		ctx_isp->cam_isp_ctx_state_monitor[index].trigger));
+			"time[0x%llx] req_id[%u] state[%s] evt_type[%s]",
+			cam_isp_ctx_state_monitor->evt_time_stamp,
+			cam_isp_ctx_state_monitor->req_id,
+			__cam_isp_ctx_substate_val_to_type(
+			cam_isp_ctx_state_monitor->curr_state),
+			__cam_isp_hw_evt_val_to_type(
+			cam_isp_ctx_state_monitor->trigger));
 	}
 }
 
@@ -524,11 +524,11 @@ static int __cam_isp_ctx_reg_upd_in_activated_state(
 	struct cam_context      *ctx = ctx_isp->base;
 	struct cam_isp_ctx_req  *req_isp;
 
-	if (list_empty(&ctx->pending_req_list)) {
-		CAM_ERR(CAM_ISP, "Reg upd ack with no pending request");
+	if (list_empty(&ctx->wait_req_list)) {
+		CAM_ERR(CAM_ISP, "Reg upd ack with no waiting request");
 		goto end;
 	}
-	req = list_first_entry(&ctx->pending_req_list,
+	req = list_first_entry(&ctx->wait_req_list,
 			struct cam_ctx_request, list);
 	list_del_init(&req->list);
 
@@ -686,24 +686,16 @@ static int __cam_isp_ctx_reg_upd_in_sof(struct cam_isp_context *ctx_isp,
 	 * This is for the first update. The initial setting will
 	 * cause the reg_upd in the first frame.
 	 */
-	if (!list_empty(&ctx->pending_req_list)) {
-		req = list_first_entry(&ctx->pending_req_list,
+	if (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
 			struct cam_ctx_request, list);
 		list_del_init(&req->list);
 		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
-		if (req_isp->num_fence_map_out == req_isp->num_acked) {
+		if (req_isp->num_fence_map_out == req_isp->num_acked)
 			list_add_tail(&req->list, &ctx->free_req_list);
-		} else {
-			/* need to handle the buf done */
-			list_add_tail(&req->list, &ctx->active_req_list);
-			ctx_isp->active_req_cnt++;
-			CAM_DBG(CAM_REQ,
-				"move request %lld to active list(cnt = %d)",
-				 req->request_id,
-				ctx_isp->active_req_cnt);
-			ctx_isp->substate_activated =
-				CAM_ISP_CTX_ACTIVATED_EPOCH;
-		}
+		else
+			CAM_ERR(CAM_ISP,
+				"receive rup in unexpected state");
 	}
 	if (req != NULL) {
 		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
@@ -722,12 +714,12 @@ static int __cam_isp_ctx_epoch_in_applied(struct cam_isp_context *ctx_isp,
 	struct cam_context        *ctx = ctx_isp->base;
 	uint64_t  request_id = 0;
 
-	if (list_empty(&ctx->pending_req_list)) {
+	if (list_empty(&ctx->wait_req_list)) {
 		/*
-		 * If no pending req in epoch, this is an error case.
+		 * If no wait req in epoch, this is an error case.
 		 * The recovery is to go back to sof state
 		 */
-		CAM_ERR(CAM_ISP, "No pending request");
+		CAM_ERR(CAM_ISP, "No wait request");
 		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
 
 		/* Send SOF event as empty frame*/
@@ -737,7 +729,7 @@ static int __cam_isp_ctx_epoch_in_applied(struct cam_isp_context *ctx_isp,
 		goto end;
 	}
 
-	req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
+	req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request,
 		list);
 	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
 
@@ -746,6 +738,9 @@ static int __cam_isp_ctx_epoch_in_applied(struct cam_isp_context *ctx_isp,
 		ctx->ctx_crm_intf->notify_err) {
 		struct cam_req_mgr_error_notify notify;
 
+		list_del_init(&req->list);
+		list_add(&req->list, &ctx->pending_req_list);
+
 		notify.link_hdl = ctx->link_hdl;
 		notify.dev_hdl = ctx->dev_hdl;
 		notify.req_id = req->request_id;
@@ -826,8 +821,10 @@ static int __cam_isp_ctx_sof_in_epoch(struct cam_isp_context *ctx_isp,
 
 	req = list_last_entry(&ctx->active_req_list,
 		struct cam_ctx_request, list);
-	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
-		CAM_ISP_STATE_CHANGE_TRIGGER_SOF, ctx->req_list->request_id);
+	if (req)
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_SOF,
+			ctx->req_list->request_id);
 	CAM_DBG(CAM_ISP, "next substate %d",
 		ctx_isp->substate_activated);
 
@@ -869,7 +866,7 @@ static int __cam_isp_ctx_epoch_in_bubble_applied(
 	 * transition to BUBBLE state again.
 	 */
 
-	if (list_empty(&ctx->pending_req_list)) {
+	if (list_empty(&ctx->wait_req_list)) {
 		/*
 		 * If no pending req in epoch, this is an error case.
 		 * Just go back to the bubble state.
@@ -882,14 +879,16 @@ static int __cam_isp_ctx_epoch_in_bubble_applied(
 		goto end;
 	}
 
-	req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
+	req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request,
 		list);
 	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	list_del_init(&req->list);
 
 	if (req_isp->bubble_report && ctx->ctx_crm_intf &&
 		ctx->ctx_crm_intf->notify_err) {
 		struct cam_req_mgr_error_notify notify;
 
+		list_add(&req->list, &ctx->pending_req_list);
 		notify.link_hdl = ctx->link_hdl;
 		notify.dev_hdl = ctx->dev_hdl;
 		notify.req_id = req->request_id;
@@ -903,7 +902,6 @@ static int __cam_isp_ctx_epoch_in_bubble_applied(
 		 * If we can not report bubble, then treat it as if no bubble
 		 * report. Just move the req to active list.
 		 */
-		list_del_init(&req->list);
 		list_add_tail(&req->list, &ctx->active_req_list);
 		ctx_isp->active_req_cnt++;
 		CAM_DBG(CAM_ISP, "move request %lld to active list(cnt = %d)",
@@ -929,8 +927,9 @@ static int __cam_isp_ctx_epoch_in_bubble_applied(
 end:
 	req = list_last_entry(&ctx->active_req_list, struct cam_ctx_request,
 		list);
-	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
-		CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH, req->request_id);
+	if (req)
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH, req->request_id);
 	return 0;
 }
 
@@ -1079,30 +1078,6 @@ static int __cam_isp_ctx_handle_error(struct cam_isp_context *ctx_isp,
 	return rc;
 }
 
-static int __cam_isp_ctx_sof_in_flush(
-	struct cam_isp_context *ctx_isp, void *evt_data)
-{
-	int rc = 0;
-	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
-
-	if (!evt_data) {
-		CAM_ERR(CAM_ISP, "in valid sof event data");
-		return -EINVAL;
-	}
-	ctx_isp->frame_id++;
-	ctx_isp->sof_timestamp_val = sof_event_data->timestamp;
-	ctx_isp->boot_timestamp = sof_event_data->boot_time;
-	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx",
-		ctx_isp->frame_id, ctx_isp->sof_timestamp_val);
-
-	if (--ctx_isp->frame_skip_count == 0)
-		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
-	else
-		CAM_ERR(CAM_ISP, "Skip currect SOF");
-
-	return rc;
-}
-
 static struct cam_isp_ctx_irq_ops
 	cam_isp_ctx_activated_state_machine_irq[CAM_ISP_CTX_ACTIVATED_MAX] = {
 	/* SOF */
@@ -1174,17 +1149,6 @@ static struct cam_isp_ctx_irq_ops
 	/* HALT */
 	{
 	},
-	/* FLUSH */
-	{
-		.irq_ops = {
-			NULL,
-			__cam_isp_ctx_sof_in_flush,
-			NULL,
-			NULL,
-			NULL,
-			__cam_isp_ctx_buf_done_in_applied,
-		},
-	},
 };
 
 static int __cam_isp_ctx_apply_req_in_activated_state(
@@ -1267,6 +1231,8 @@ static int __cam_isp_ctx_apply_req_in_activated_state(
 		spin_lock_bh(&ctx->lock);
 		ctx_isp->substate_activated = next_state;
 		ctx_isp->last_applied_req_id = apply->request_id;
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->wait_req_list);
 		CAM_DBG(CAM_ISP, "new substate state %d, applied req %lld",
 			next_state, ctx_isp->last_applied_req_id);
 		spin_unlock_bh(&ctx->lock);
@@ -1341,7 +1307,11 @@ static int __cam_isp_ctx_flush_req(struct cam_context *ctx,
 	INIT_LIST_HEAD(&flush_list);
 	if (list_empty(req_list)) {
 		CAM_DBG(CAM_ISP, "request list is empty");
-		return 0;
+		if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+			CAM_ERR(CAM_ISP, "no request to cancel");
+			return -EINVAL;
+		} else
+			return 0;
 	}
 
 	CAM_DBG(CAM_REQ, "Flush [%u] in progress for req_id %llu",
@@ -1450,28 +1420,6 @@ end:
 	return rc;
 }
 
-static int __cam_isp_ctx_flush_req_in_activated(
-	struct cam_context *ctx,
-	struct cam_req_mgr_flush_request *flush_req)
-{
-	int rc = 0;
-	struct cam_isp_context *ctx_isp;
-
-	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
-
-	CAM_DBG(CAM_ISP, "Flush request in state %d", ctx->state);
-	rc = __cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, flush_req);
-
-	/* only if request is found in pending queue, move to flush state*/
-	if (!rc) {
-		spin_lock_bh(&ctx->lock);
-		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_FLUSH;
-		ctx_isp->frame_skip_count = 2;
-		spin_unlock_bh(&ctx->lock);
-	}
-	return rc;
-}
-
 static int __cam_isp_ctx_flush_req_in_ready(
 	struct cam_context *ctx,
 	struct cam_req_mgr_flush_request *flush_req)
@@ -1544,12 +1492,6 @@ static struct cam_ctx_ops
 		.crm_ops = {},
 		.irq_ops = NULL,
 	},
-	/* FLUSH */
-	{
-		.ioctl_ops = {},
-		.crm_ops = {},
-		.irq_ops = NULL,
-	},
 };
 
 static int __cam_isp_ctx_rdi_only_sof_in_top_state(
@@ -1807,11 +1749,11 @@ static int __cam_isp_ctx_rdi_only_reg_upd_in_bubble_applied_state(
 	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_EPOCH;
 	/* notify reqmgr with sof signal*/
 	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger) {
-		if (list_empty(&ctx->pending_req_list)) {
-			CAM_ERR(CAM_ISP, "Reg upd ack with no pending request");
+		if (list_empty(&ctx->wait_req_list)) {
+			CAM_ERR(CAM_ISP, "Reg upd ack with no waiting request");
 			goto error;
 		}
-		req = list_first_entry(&ctx->pending_req_list,
+		req = list_first_entry(&ctx->wait_req_list,
 				struct cam_ctx_request, list);
 		list_del_init(&req->list);
 
@@ -1934,17 +1876,6 @@ static struct cam_isp_ctx_irq_ops
 	/* HALT */
 	{
 	},
-	/* FLUSH */
-	{
-		.irq_ops = {
-			NULL,
-			__cam_isp_ctx_sof_in_flush,
-			NULL,
-			NULL,
-			NULL,
-			__cam_isp_ctx_buf_done_in_applied,
-		},
-	},
 };
 
 static int __cam_isp_ctx_rdi_only_apply_req_top_state(
@@ -2012,12 +1943,6 @@ static struct cam_ctx_ops
 		.crm_ops = {},
 		.irq_ops = NULL,
 	},
-	/* FLUSHED */
-	{
-		.ioctl_ops = {},
-		.crm_ops = {},
-		.irq_ops = NULL,
-	},
 };
 
 /* top level state machine */
@@ -2473,9 +2398,13 @@ static int __cam_isp_ctx_start_dev_in_ready(struct cam_context *ctx,
 	}
 	CAM_DBG(CAM_ISP, "start device success ctx %u", ctx->ctx_id);
 
+	list_del_init(&req->list);
+
 	if (req_isp->num_fence_map_out) {
-		list_del_init(&req->list);
 		list_add_tail(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+	} else {
+		list_add_tail(&req->list, &ctx->wait_req_list);
 	}
 end:
 	return rc;
@@ -2817,7 +2746,7 @@ static struct cam_ctx_ops
 		.crm_ops = {
 			.unlink = __cam_isp_ctx_unlink_in_activated,
 			.apply_req = __cam_isp_ctx_apply_req,
-			.flush_req = __cam_isp_ctx_flush_req_in_activated,
+			.flush_req = __cam_isp_ctx_flush_req_in_top_state,
 			.process_evt = __cam_isp_ctx_process_evt,
 		},
 		.irq_ops = __cam_isp_ctx_handle_irq_in_activated,
diff --git a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h
index a939f2d80b34..4592e42932d8 100755
--- a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h
+++ b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h
@@ -57,7 +57,6 @@ enum cam_isp_ctx_activated_substate {
 	CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED,
 	CAM_ISP_CTX_ACTIVATED_HW_ERROR,
 	CAM_ISP_CTX_ACTIVATED_HALT,
-	CAM_ISP_CTX_ACTIVATED_FLUSH,
 	CAM_ISP_CTX_ACTIVATED_MAX,
 };
 
@@ -155,7 +154,6 @@ struct cam_isp_context_state_monitor {
  * @subscribe_event:           The irq event mask that CRM subscribes to, IFE
  *                             will invoke CRM cb at those event.
  * @last_applied_req_id:       Last applied request id
- * @frame_skip_count:          Number of frame to skip before change state
  * @state_monitor_head:        Write index to the state monitoring array
  * @cam_isp_ctx_state_monitor: State monitoring array
  * @rdi_only_context:          Get context type information.
@@ -180,7 +178,6 @@ struct cam_isp_context {
 	int64_t                          reported_req_id;
 	uint32_t                         subscribe_event;
 	int64_t                          last_applied_req_id;
-	uint32_t                         frame_skip_count;
 	atomic64_t                       state_monitor_head;
 	struct cam_isp_context_state_monitor cam_isp_ctx_state_monitor[
 		CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES];
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
index abc6bb0a6db8..eaa7325fbca8 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
@@ -434,7 +434,7 @@ int cam_isp_add_io_buffers(
 	bool                                  fill_fence)
 {
 	int rc = 0;
-	uint64_t                            io_addr[CAM_PACKET_MAX_PLANES];
+	dma_addr_t                          io_addr[CAM_PACKET_MAX_PLANES];
 	struct cam_buf_io_cfg              *io_cfg;
 	struct cam_isp_resource_node       *res;
 	struct cam_ife_hw_mgr_res          *hw_mgr_res;
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
index 70e04677282d..28cfcc8bea74 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
@@ -177,7 +177,7 @@ struct cam_isp_hw_cmd_buf_update {
  *
  */
 struct cam_isp_hw_get_wm_update {
-	uint64_t                       *image_buf;
+	dma_addr_t                     *image_buf;
 	uint32_t                        num_buf;
 	struct cam_buf_io_cfg          *io_cfg;
 };
diff --git a/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c b/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
index 0f34c9f15b56..fa8984ca2300 100644
--- a/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
@@ -150,7 +150,7 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl,
 	int rc = -EINVAL;
 	uint32_t num_in_buf, num_out_buf, i, j, plane;
 	struct cam_buf_io_cfg *io_cfg;
-	uint64_t io_addr[CAM_PACKET_MAX_PLANES];
+	dma_addr_t io_addr[CAM_PACKET_MAX_PLANES];
 	size_t size;
 
 	num_in_buf = 0;
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
index d192018bf2f2..0e77a4c01fb4 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
@@ -147,7 +147,7 @@ static void cam_mem_put_slot(int32_t idx)
 }
 
 int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle,
-	uint64_t *iova_ptr, size_t *len_ptr)
+	dma_addr_t *iova_ptr, size_t *len_ptr)
 {
 	int rc = 0, idx;
 
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h
index 7588c179f4a5..14b1a678e010 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -82,7 +82,7 @@ int cam_mem_mgr_release_mem(struct cam_mem_mgr_memory_desc *inp);
  * @return Status of operation. Negative in case of error. Zero otherwise.
  */
 int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle,
-	uint64_t *iova_ptr, size_t *len_ptr);
+	dma_addr_t *iova_ptr, size_t *len_ptr);
 /**
  * @brief: Returns CPU address information about buffer
  *
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
index 61fd7a85290d..460b3dfe59a2 100755
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
@@ -1283,7 +1283,8 @@ static int __cam_req_mgr_destroy_link_info(struct cam_req_mgr_core_link *link)
 				rc = dev->ops->link_setup(&link_data);
 				if (rc)
 					CAM_ERR(CAM_CRM,
-						"Unlink failed dev_hdl %d",
+						"Unlink failed dev name %s hdl %x",
+						dev->dev_info.name,
 						dev->dev_hdl);
 			}
 			dev->dev_hdl = 0;
@@ -2350,8 +2351,8 @@ static int __cam_req_mgr_unlink(struct cam_req_mgr_core_link *link)
 	/* Destroy the link handle */
 	rc = cam_destroy_device_hdl(link->link_hdl);
 	if (rc < 0) {
-		CAM_ERR(CAM_CRM, "error while destroying dev handle %d %x",
-			rc, link->link_hdl);
+		CAM_ERR(CAM_CRM, "error destroying link hdl %x rc %d",
+			link->link_hdl, rc);
 	}
 
 	mutex_unlock(&link->lock);
@@ -2552,8 +2553,7 @@ int cam_req_mgr_unlink(struct cam_req_mgr_unlink_info *unlink_info)
 	rc = __cam_req_mgr_unlink(link);
 
 	/* Free curent link and put back into session's free pool of links */
-	if (!rc)
-		__cam_req_mgr_unreserve_link(cam_session, link);
+	__cam_req_mgr_unreserve_link(cam_session, link);
 
 done:
 	mutex_unlock(&g_crm_core_dev->crm_lock);
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_core.c
index 058e3528e248..f859484b178f 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_core.c
@@ -870,8 +870,8 @@ static int32_t cam_cci_burst_read(struct v4l2_subdev *sd,
 	struct cam_cci_ctrl *c_ctrl)
 {
 	int32_t rc = 0;
-	uint32_t val = 0, i = 0;
-	unsigned long rem_jiffies;
+	uint32_t val = 0, i = 0, j = 0;
+	unsigned long rem_jiffies, flags;
 	int32_t read_words = 0, exp_words = 0;
 	int32_t index = 0, first_byte = 0, total_read_words = 0;
 	enum cci_i2c_master_t master;
@@ -990,11 +990,13 @@ static int32_t cam_cci_burst_read(struct v4l2_subdev *sd,
 
 	val = 1 << ((master * 2) + queue);
 	cam_io_w_mb(val, base + CCI_QUEUE_START_ADDR);
+
 	exp_words = ((read_cfg->num_byte / 4) + 1);
+	CAM_DBG(CAM_CCI, "waiting for threshold [exp_words %d]", exp_words);
 
-	while (exp_words != total_read_words) {
+	while (total_read_words != exp_words) {
 		rem_jiffies = wait_for_completion_timeout(
-			&cci_dev->cci_master_info[master].reset_complete,
+			&cci_dev->cci_master_info[master].th_complete,
 			CCI_TIMEOUT);
 		if (!rem_jiffies) {
 			rc = -ETIMEDOUT;
@@ -1013,8 +1015,16 @@ static int32_t cam_cci_burst_read(struct v4l2_subdev *sd,
 
 		read_words = cam_io_r_mb(base +
 			CCI_I2C_M0_READ_BUF_LEVEL_ADDR + master * 0x100);
+		if (read_words <= 0) {
+			CAM_DBG(CAM_CCI, "FIFO Buffer lvl is 0");
+			continue;
+		}
+
+		j++;
+		CAM_DBG(CAM_CCI, "Iteration: %u read_words %d", j, read_words);
+
 		total_read_words += read_words;
-		do {
+		while (read_words > 0) {
 			val = cam_io_r_mb(base +
 				CCI_I2C_M0_READ_DATA_ADDR + master * 0x100);
 			for (i = 0; (i < 4) &&
@@ -1032,9 +1042,57 @@ static int32_t cam_cci_burst_read(struct v4l2_subdev *sd,
 					index++;
 				}
 			}
-		} while (--read_words > 0);
+			read_words--;
+		}
+
+		CAM_DBG(CAM_CCI, "Iteraion:%u total_read_words %d",
+			j, total_read_words);
+
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		if (cci_dev->irq_status1) {
+			CAM_DBG(CAM_CCI, "clear irq_status1:%x",
+				cci_dev->irq_status1);
+			cam_io_w_mb(cci_dev->irq_status1,
+				base + CCI_IRQ_CLEAR_1_ADDR);
+			cam_io_w_mb(0x1, base + CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR);
+			cci_dev->irq_status1 = 0;
+		}
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+
+		if (total_read_words == exp_words) {
+		   /*
+		    * This wait is for RD_DONE irq, if RD_DONE is
+		    * triggered we will call complete on both threshold
+		    * & read done waits. As part of the threshold wait
+		    * we will be draining the entire buffer out. This
+		    * wait is to compensate for the complete invoked for
+		    * RD_DONE exclusively.
+		    */
+			rem_jiffies = wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].reset_complete,
+			CCI_TIMEOUT);
+			if (!rem_jiffies) {
+				rc = -ETIMEDOUT;
+				val = cam_io_r_mb(base +
+					CCI_I2C_M0_READ_BUF_LEVEL_ADDR +
+					master * 0x100);
+				CAM_ERR(CAM_CCI,
+					"Failed to receive RD_DONE irq rc = %d FIFO buf_lvl:0x%x",
+					rc, val);
+				#ifdef DUMP_CCI_REGISTERS
+					cam_cci_dump_registers(cci_dev,
+						master, queue);
+				#endif
+					cam_cci_flush_queue(cci_dev, master);
+				goto rel_mutex;
+			}
+			break;
+		}
 	}
 
+	CAM_DBG(CAM_CCI, "Burst read successful words_read %d",
+		total_read_words);
+
 rel_mutex:
 	mutex_unlock(&cci_dev->cci_master_info[master].mutex_q[queue]);
 	return rc;
@@ -1166,7 +1224,8 @@ static int32_t cam_cci_read(struct v4l2_subdev *sd,
 
 	val = 1 << ((master * 2) + queue);
 	cam_io_w_mb(val, base + CCI_QUEUE_START_ADDR);
-	CAM_DBG(CAM_CCI, "wait_for_completion_timeout");
+	CAM_DBG(CAM_CCI,
+		"waiting_for_rd_done [exp_words: %d]", exp_words);
 
 	rc = wait_for_completion_timeout(
 		&cci_dev->cci_master_info[master].reset_complete, CCI_TIMEOUT);
@@ -1200,7 +1259,7 @@ static int32_t cam_cci_read(struct v4l2_subdev *sd,
 	index = 0;
 	CAM_DBG(CAM_CCI, "index %d num_type %d", index, read_cfg->num_byte);
 	first_byte = 0;
-	do {
+	while (read_words > 0) {
 		val = cam_io_r_mb(base +
 			CCI_I2C_M0_READ_DATA_ADDR + master * 0x100);
 		CAM_DBG(CAM_CCI, "read val 0x%x", val);
@@ -1217,10 +1276,10 @@ static int32_t cam_cci_read(struct v4l2_subdev *sd,
 				index++;
 			}
 		}
-	} while (--read_words > 0);
+		read_words--;
+	}
 rel_mutex:
 	mutex_unlock(&cci_dev->cci_master_info[master].mutex_q[queue]);
-
 	return rc;
 }
 
@@ -1399,23 +1458,34 @@ static int32_t cam_cci_read_bytes(struct v4l2_subdev *sd,
 	}
 
 	read_bytes = read_cfg->num_byte;
+
+	/*
+	 * To avoid any conflicts due to back to back trigger of
+	 * THRESHOLD irq's, we reinit the threshold wait before
+	 * we load the burst read cmd.
+	 */
+	reinit_completion(&cci_dev->cci_master_info[master].th_complete);
+
+	CAM_DBG(CAM_CCI, "Bytes to read %u", read_bytes);
 	do {
-		if (read_bytes > CCI_I2C_MAX_BYTE_COUNT)
+		if (read_bytes >= CCI_I2C_MAX_BYTE_COUNT)
 			read_cfg->num_byte = CCI_I2C_MAX_BYTE_COUNT;
 		else
 			read_cfg->num_byte = read_bytes;
 
-		if (read_cfg->num_byte > CCI_READ_MAX)
+		if (read_cfg->num_byte >= CCI_READ_MAX) {
+			cci_dev->is_burst_read = true;
 			rc = cam_cci_burst_read(sd, c_ctrl);
-		else
+		} else {
+			cci_dev->is_burst_read = false;
 			rc = cam_cci_read(sd, c_ctrl);
-
+		}
 		if (rc) {
 			CAM_ERR(CAM_CCI, "failed to read rc:%d", rc);
 			goto ERROR;
 		}
 
-		if (read_bytes > CCI_I2C_MAX_BYTE_COUNT) {
+		if (read_bytes >= CCI_I2C_MAX_BYTE_COUNT) {
 			read_cfg->addr += (CCI_I2C_MAX_BYTE_COUNT /
 				read_cfg->data_type);
 			read_cfg->data += CCI_I2C_MAX_BYTE_COUNT;
@@ -1426,6 +1496,7 @@ static int32_t cam_cci_read_bytes(struct v4l2_subdev *sd,
 	} while (read_bytes);
 
 ERROR:
+	cci_dev->is_burst_read = false;
 	return rc;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c
index ce7ac3f0b820..958737f1a879 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c
@@ -65,15 +65,12 @@ irqreturn_t cam_cci_irq(int irq_num, void *data)
 		&cci_dev->soc_info;
 	void __iomem *base = soc_info->reg_map[0].mem_base;
 	unsigned long flags;
-	bool burst_read_assert = false;
+	bool rd_done_th_assert = false;
 
 	irq_status0 = cam_io_r_mb(base + CCI_IRQ_STATUS_0_ADDR);
 	irq_status1 = cam_io_r_mb(base + CCI_IRQ_STATUS_1_ADDR);
-	cam_io_w_mb(irq_status0, base + CCI_IRQ_CLEAR_0_ADDR);
-	cam_io_w_mb(irq_status1, base + CCI_IRQ_CLEAR_1_ADDR);
-	cam_io_w_mb(0x1, base + CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR);
-
 	CAM_DBG(CAM_CCI, "irq0:%x irq1:%x", irq_status0, irq_status1);
+
 	if (irq_status0 & CCI_IRQ_STATUS_0_RST_DONE_ACK_BMSK) {
 		if (cci_dev->cci_master_info[MASTER_0].reset_pending == TRUE) {
 			cci_dev->cci_master_info[MASTER_0].reset_pending =
@@ -92,18 +89,23 @@ irqreturn_t cam_cci_irq(int irq_num, void *data)
 	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK) &&
 		(irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD)) {
 		cci_dev->cci_master_info[MASTER_0].status = 0;
+		rd_done_th_assert = true;
+		complete(&cci_dev->cci_master_info[MASTER_0].th_complete);
 		complete(&cci_dev->cci_master_info[MASTER_0].reset_complete);
-		burst_read_assert = true;
 	}
 	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK) &&
-		(!burst_read_assert)) {
+		(!rd_done_th_assert)) {
 		cci_dev->cci_master_info[MASTER_0].status = 0;
+		rd_done_th_assert = true;
+		if (cci_dev->is_burst_read)
+			complete(
+			&cci_dev->cci_master_info[MASTER_0].th_complete);
 		complete(&cci_dev->cci_master_info[MASTER_0].reset_complete);
 	}
 	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD) &&
-		(!burst_read_assert)) {
+		(!rd_done_th_assert)) {
 		cci_dev->cci_master_info[MASTER_0].status = 0;
-		complete(&cci_dev->cci_master_info[MASTER_0].reset_complete);
+		complete(&cci_dev->cci_master_info[MASTER_0].th_complete);
 	}
 	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0_REPORT_BMSK) {
 		struct cam_cci_master_info *cci_master_info;
@@ -142,18 +144,23 @@ irqreturn_t cam_cci_irq(int irq_num, void *data)
 	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) &&
 		(irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD)) {
 		cci_dev->cci_master_info[MASTER_1].status = 0;
+		rd_done_th_assert = true;
+		complete(&cci_dev->cci_master_info[MASTER_1].th_complete);
 		complete(&cci_dev->cci_master_info[MASTER_1].reset_complete);
-		burst_read_assert = true;
 	}
 	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) &&
-		(!burst_read_assert)) {
+		(!rd_done_th_assert)) {
 		cci_dev->cci_master_info[MASTER_1].status = 0;
+		rd_done_th_assert = true;
+		if (cci_dev->is_burst_read)
+			complete(
+			&cci_dev->cci_master_info[MASTER_1].th_complete);
 		complete(&cci_dev->cci_master_info[MASTER_1].reset_complete);
 	}
 	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD) &&
-		(!burst_read_assert)) {
+		(!rd_done_th_assert)) {
 		cci_dev->cci_master_info[MASTER_1].status = 0;
-		complete(&cci_dev->cci_master_info[MASTER_1].reset_complete);
+		complete(&cci_dev->cci_master_info[MASTER_1].th_complete);
 	}
 	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q0_REPORT_BMSK) {
 		struct cam_cci_master_info *cci_master_info;
@@ -189,6 +196,12 @@ irqreturn_t cam_cci_irq(int irq_num, void *data)
 			&cci_dev->cci_master_info[MASTER_1].lock_q[QUEUE_1],
 			flags);
 	}
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_PAUSE)
+		CAM_DBG(CAM_CCI, "RD_PAUSE ON MASTER_0");
+
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_PAUSE)
+		CAM_DBG(CAM_CCI, "RD_PAUSE ON MASTER_1");
+
 	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0Q1_HALT_ACK_BMSK) {
 		cci_dev->cci_master_info[MASTER_0].reset_pending = TRUE;
 		cam_io_w_mb(CCI_M0_RESET_RMSK,
@@ -211,6 +224,19 @@ irqreturn_t cam_cci_irq(int irq_num, void *data)
 			base + CCI_HALT_REQ_ADDR);
 		CAM_DBG(CAM_CCI, "MASTER_1 error 0x%x", irq_status0);
 	}
+
+	if ((rd_done_th_assert) || (!cci_dev->is_burst_read)) {
+		cam_io_w_mb(irq_status1, base + CCI_IRQ_CLEAR_1_ADDR);
+		CAM_DBG(CAM_CCI, "clear irq_status0:%x irq_status1:%x",
+			irq_status0, irq_status1);
+	} else {
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		cci_dev->irq_status1 |= irq_status1;
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+	}
+
+	cam_io_w_mb(irq_status0, base + CCI_IRQ_CLEAR_0_ADDR);
+	cam_io_w_mb(0x1, base + CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR);
 	return IRQ_HANDLED;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.h b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.h
index d48ffd15b4f9..aec86baf89aa 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.h
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.h
@@ -137,6 +137,7 @@ struct cam_cci_master_info {
 	uint8_t reset_pending;
 	struct mutex mutex;
 	struct completion reset_complete;
+	struct completion th_complete;
 	struct mutex mutex_q[NUM_QUEUES];
 	struct completion report_q[NUM_QUEUES];
 	atomic_t done_pending[NUM_QUEUES];
@@ -192,6 +193,11 @@ enum cam_cci_state_t {
  * @cci_wait_sync_cfg: CCI sync config
  * @cycles_per_us: Cycles per micro sec
  * @payload_size: CCI packet payload size
+ * @irq_status1: Store irq_status1 to be cleared after
+ *               draining FIFO buffer for burst read
+ * @lock_status: to protect changes to irq_status1
+ * @is_burst_read: Flag to determine if we are performing
+ *                 a burst read operation or not
  */
 struct cci_device {
 	struct v4l2_subdev subdev;
@@ -216,6 +222,9 @@ struct cci_device {
 	uint8_t payload_size;
 	char device_name[20];
 	uint32_t cpas_handle;
+	uint32_t irq_status1;
+	spinlock_t lock_status;
+	bool is_burst_read;
 };
 
 enum cam_cci_i2c_cmd_type {
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_hwreg.h b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_hwreg.h
index 31c8e26f3f90..65a48e11fbd7 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_hwreg.h
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_hwreg.h
@@ -56,15 +56,17 @@
 #define CCI_IRQ_STATUS_0_I2C_M1_Q0_REPORT_BMSK                         0x10000
 #define CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK                            0x1000
 #define CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD                          0x100000
+#define CCI_IRQ_STATUS_1_I2C_M1_RD_PAUSE                              0x200000
 #define CCI_IRQ_STATUS_0_I2C_M0_Q1_REPORT_BMSK                           0x100
 #define CCI_IRQ_STATUS_0_I2C_M0_Q0_REPORT_BMSK                            0x10
 #define CCI_IRQ_STATUS_0_I2C_M0_ERROR_BMSK                          0x18000EE6
 #define CCI_IRQ_STATUS_0_I2C_M1_ERROR_BMSK                          0x60EE6000
 #define CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK                               0x1
 #define CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD                           0x10000
+#define CCI_IRQ_STATUS_1_I2C_M0_RD_PAUSE                               0x20000
 #define CCI_I2C_M0_RD_THRESHOLD_ADDR                                0x00000120
 #define CCI_I2C_M1_RD_THRESHOLD_ADDR                                0x00000220
-#define CCI_I2C_RD_THRESHOLD_VALUE                                        0x38
+#define CCI_I2C_RD_THRESHOLD_VALUE                                        0x30
 #define CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR                               0x00000c00
 
 #define DEBUG_TOP_REG_START                                                0x0
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_soc.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_soc.c
index e0b27ca1e92a..8c2853b5cc62 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_soc.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_soc.c
@@ -199,6 +199,8 @@ static void cam_cci_init_cci_params(struct cci_device *new_cci_dev)
 		mutex_init(&new_cci_dev->cci_master_info[i].mutex);
 		init_completion(
 			&new_cci_dev->cci_master_info[i].reset_complete);
+		init_completion(
+			&new_cci_dev->cci_master_info[i].th_complete);
 
 		for (j = 0; j < NUM_QUEUES; j++) {
 			mutex_init(&new_cci_dev->cci_master_info[i].mutex_q[j]);
@@ -208,6 +210,7 @@ static void cam_cci_init_cci_params(struct cci_device *new_cci_dev)
 				&new_cci_dev->cci_master_info[i].lock_q[j]);
 		}
 	}
+	spin_lock_init(&new_cci_dev->lock_status);
 }
 
 static void cam_cci_init_default_clk_params(struct cci_device *cci_dev,
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
index bc61df42bb94..2e9aa6cbb1db 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
@@ -296,12 +296,14 @@ int32_t cam_csiphy_config_dev(struct csiphy_device *csiphy_dev)
 			continue;
 		}
 
-		settle_cnt = (csiphy_dev->csiphy_info.settle_time / 200000000);
+		settle_cnt = div64_u64(csiphy_dev->csiphy_info.settle_time,
+			200000000);
 		if (csiphy_dev->csiphy_info.combo_mode == 1 &&
 			(lane_pos >= 3))
 			settle_cnt =
-			(csiphy_dev->csiphy_info.settle_time_combo_sensor /
-				200000000);
+				div64_u64(csiphy_dev->csiphy_info.
+					settle_time_combo_sensor,
+					200000000);
 		for (i = 0; i < cfg_size; i++) {
 			switch (reg_array[lane_pos][i].csiphy_param_type) {
 			case CSIPHY_LANE_ENABLE:
diff --git a/drivers/media/platform/msm/camera/cam_sync/cam_sync.c b/drivers/media/platform/msm/camera/cam_sync/cam_sync.c
index e5df874b52ae..c5438c917bc0 100644
--- a/drivers/media/platform/msm/camera/cam_sync/cam_sync.c
+++ b/drivers/media/platform/msm/camera/cam_sync/cam_sync.c
@@ -21,6 +21,13 @@
 
 struct sync_device *sync_dev;
 
+/*
+ * Flag to determine whether to enqueue cb of a
+ * signaled fence onto the workq or invoke it
+ * directly in the same context
+ */
+static bool trigger_cb_without_switch;
+
 int cam_sync_create(int32_t *sync_obj, const char *name)
 {
 	int rc;
@@ -59,6 +66,7 @@ int cam_sync_register_callback(sync_callback cb_func,
 	struct sync_callback_info *sync_cb;
 	struct sync_callback_info *cb_info;
 	struct sync_table_row *row = NULL;
+	int status = 0;
 
 	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0 || !cb_func)
 		return -EINVAL;
@@ -95,18 +103,27 @@ int cam_sync_register_callback(sync_callback cb_func,
 	if ((row->state == CAM_SYNC_STATE_SIGNALED_SUCCESS ||
 		row->state == CAM_SYNC_STATE_SIGNALED_ERROR) &&
 		(!row->remaining)) {
-		sync_cb->callback_func = cb_func;
-		sync_cb->cb_data = userdata;
-		sync_cb->sync_obj = sync_obj;
-		INIT_WORK(&sync_cb->cb_dispatch_work,
-			cam_sync_util_cb_dispatch);
-		sync_cb->status = row->state;
-		CAM_DBG(CAM_SYNC, "Callback trigger for sync object:%d",
-			sync_cb->sync_obj);
-		queue_work(sync_dev->work_queue,
-			&sync_cb->cb_dispatch_work);
+		if (trigger_cb_without_switch) {
+			CAM_DBG(CAM_SYNC, "Invoke callback for sync object:%d",
+				sync_obj);
+			status = row->state;
+			kfree(sync_cb);
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+			cb_func(sync_obj, status, userdata);
+		} else {
+			sync_cb->callback_func = cb_func;
+			sync_cb->cb_data = userdata;
+			sync_cb->sync_obj = sync_obj;
+			INIT_WORK(&sync_cb->cb_dispatch_work,
+				cam_sync_util_cb_dispatch);
+			sync_cb->status = row->state;
+			CAM_DBG(CAM_SYNC, "Enqueue callback for sync object:%d",
+				sync_cb->sync_obj);
+			queue_work(sync_dev->work_queue,
+				&sync_cb->cb_dispatch_work);
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		}
 
-		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
 		return 0;
 	}
 
@@ -158,19 +175,11 @@ int cam_sync_deregister_callback(sync_callback cb_func,
 
 int cam_sync_signal(int32_t sync_obj, uint32_t status)
 {
-	int rc;
 	struct sync_table_row *row = NULL;
 	struct sync_table_row *parent_row = NULL;
-	struct sync_callback_info *sync_cb;
-	struct sync_user_payload *payload_info;
-	struct sync_parent_info *parent_info;
-	struct list_head sync_list;
-	struct cam_signalable_info *list_info = NULL;
-	struct cam_signalable_info *temp_list_info = NULL;
+	struct sync_parent_info *parent_info, *temp_parent_info;
 	struct list_head parents_list;
-
-	/* Objects to be signaled will be added into this list */
-	INIT_LIST_HEAD(&sync_list);
+	int rc = 0;
 
 	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0) {
 		CAM_ERR(CAM_SYNC, "Error: Out of range sync obj (0 <= %d < %d)",
@@ -213,14 +222,7 @@ int cam_sync_signal(int32_t sync_obj, uint32_t status)
 	}
 
 	row->state = status;
-	rc = cam_sync_util_add_to_signalable_list(sync_obj, status, &sync_list);
-	if (rc < 0) {
-		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
-		CAM_ERR(CAM_SYNC,
-			"Error: Unable to add sync object :%d to signalable list",
-			sync_obj);
-		return rc;
-	}
+	cam_sync_util_dispatch_signaled_cb(sync_obj, status);
 
 	/* copy parent list to local and release child lock */
 	INIT_LIST_HEAD(&parents_list);
@@ -228,13 +230,14 @@ int cam_sync_signal(int32_t sync_obj, uint32_t status)
 	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
 
 	if (list_empty(&parents_list))
-		goto dispatch_cb;
+		return 0;
 
 	/*
 	 * Now iterate over all parents of this object and if they too need to
-	 * be signaled add them to the list
+	 * be signaled dispatch cb's
 	 */
-	list_for_each_entry(parent_info,
+	list_for_each_entry_safe(parent_info,
+		temp_parent_info,
 		&parents_list,
 		list) {
 		parent_row = sync_dev->sync_table + parent_info->sync_id;
@@ -253,93 +256,16 @@ int cam_sync_signal(int32_t sync_obj, uint32_t status)
 			continue;
 		}
 
-		if (!parent_row->remaining) {
-			rc = cam_sync_util_add_to_signalable_list
-				(parent_info->sync_id,
-					parent_row->state,
-					&sync_list);
-			if (rc < 0) {
-				spin_unlock_bh(
-					&sync_dev->row_spinlocks[
-						parent_info->sync_id]);
-				continue;
-			}
-		}
-		spin_unlock_bh(&sync_dev->row_spinlocks[parent_info->sync_id]);
-	}
-
-dispatch_cb:
-
-	/*
-	 * Now dispatch the various sync objects collected so far, in our
-	 * list
-	 */
-	list_for_each_entry_safe(list_info,
-		temp_list_info,
-		&sync_list,
-		list) {
-		struct sync_table_row *signalable_row = NULL;
-		struct sync_callback_info *temp_sync_cb;
-		struct sync_user_payload *temp_payload_info;
-
-		signalable_row = sync_dev->sync_table + list_info->sync_obj;
-
-		spin_lock_bh(&sync_dev->row_spinlocks[list_info->sync_obj]);
-		if (signalable_row->state == CAM_SYNC_STATE_INVALID) {
-			spin_unlock_bh(
-				&sync_dev->row_spinlocks[list_info->sync_obj]);
-			continue;
-		}
-
-		/* Dispatch kernel callbacks if any were registered earlier */
-
-		list_for_each_entry_safe(sync_cb,
-			temp_sync_cb, &signalable_row->callback_list, list) {
-			sync_cb->status = list_info->status;
-			list_del_init(&sync_cb->list);
-			queue_work(sync_dev->work_queue,
-				&sync_cb->cb_dispatch_work);
-		}
-
-		/* Dispatch user payloads if any were registered earlier */
-		list_for_each_entry_safe(payload_info, temp_payload_info,
-			&signalable_row->user_payload_list, list) {
-			spin_lock_bh(&sync_dev->cam_sync_eventq_lock);
-			if (!sync_dev->cam_sync_eventq) {
-				spin_unlock_bh(
-				&sync_dev->cam_sync_eventq_lock);
-				break;
-			}
-			spin_unlock_bh(&sync_dev->cam_sync_eventq_lock);
-			cam_sync_util_send_v4l2_event(
-				CAM_SYNC_V4L_EVENT_ID_CB_TRIG,
-				list_info->sync_obj,
-				list_info->status,
-				payload_info->payload_data,
-				CAM_SYNC_PAYLOAD_WORDS * sizeof(__u64));
-
-			list_del_init(&payload_info->list);
-			/*
-			 * We can free the list node here because
-			 * sending V4L event will make a deep copy
-			 * anyway
-			 */
-			kfree(payload_info);
-		}
-
-		/*
-		 * This needs to be done because we want to unblock anyone
-		 * who might be blocked and waiting on this sync object
-		 */
-		complete_all(&signalable_row->signaled);
-
-		spin_unlock_bh(&sync_dev->row_spinlocks[list_info->sync_obj]);
+		if (!parent_row->remaining)
+			cam_sync_util_dispatch_signaled_cb(
+				parent_info->sync_id, parent_row->state);
 
-		list_del_init(&list_info->list);
-		kfree(list_info);
+		spin_unlock_bh(&sync_dev->row_spinlocks[parent_info->sync_id]);
+		list_del_init(&parent_info->list);
+		kfree(parent_info);
 	}
 
-	return rc;
+	return 0;
 }
 
 int cam_sync_merge(int32_t *sync_obj, uint32_t num_objs, int32_t *merged_obj)
@@ -965,6 +891,26 @@ static void cam_sync_init_entity(struct sync_device *sync_dev)
 }
 #endif
 
+static int cam_sync_create_debugfs(void)
+{
+	sync_dev->dentry = debugfs_create_dir("camera_sync", NULL);
+
+	if (!sync_dev->dentry) {
+		CAM_ERR(CAM_SYNC, "Failed to create sync dir");
+		return -ENOMEM;
+	}
+
+	if (!debugfs_create_bool("trigger_cb_without_switch",
+		0644, sync_dev->dentry,
+		&trigger_cb_without_switch)) {
+		CAM_ERR(CAM_SYNC,
+			"failed to create trigger_cb_without_switch entry");
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
 static int cam_sync_probe(struct platform_device *pdev)
 {
 	int rc;
@@ -1030,6 +976,9 @@ static int cam_sync_probe(struct platform_device *pdev)
 		goto v4l2_fail;
 	}
 
+	trigger_cb_without_switch = false;
+	cam_sync_create_debugfs();
+
 	return rc;
 
 v4l2_fail:
@@ -1049,6 +998,8 @@ static int cam_sync_remove(struct platform_device *pdev)
 	v4l2_device_unregister(sync_dev->vdev->v4l2_dev);
 	cam_sync_media_controller_cleanup(sync_dev);
 	video_device_release(sync_dev->vdev);
+	debugfs_remove_recursive(sync_dev->dentry);
+	sync_dev->dentry = NULL;
 	kfree(sync_dev);
 	sync_dev = NULL;
 
diff --git a/drivers/media/platform/msm/camera/cam_sync/cam_sync_private.h b/drivers/media/platform/msm/camera/cam_sync/cam_sync_private.h
index 5ae707a2b6e7..38dab42a56cc 100644
--- a/drivers/media/platform/msm/camera/cam_sync/cam_sync_private.h
+++ b/drivers/media/platform/msm/camera/cam_sync/cam_sync_private.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -17,6 +17,7 @@
 #include <linux/videodev2.h>
 #include <linux/workqueue.h>
 #include <linux/interrupt.h>
+#include <linux/debugfs.h>
 #include <media/v4l2-fh.h>
 #include <media/v4l2-device.h>
 #include <media/v4l2-subdev.h>
@@ -177,6 +178,7 @@ struct cam_signalable_info {
  * @row_spinlocks   : Spinlock array, one for each row in the table
  * @table_lock      : Mutex used to lock the table
  * @open_cnt        : Count of file open calls made on the sync driver
+ * @dentry          : Debugfs entry
  * @work_queue      : Work queue used for dispatching kernel callbacks
  * @cam_sync_eventq : Event queue used to dispatch user payloads to user space
  * @bitmap          : Bitmap representation of all sync objects
@@ -188,6 +190,7 @@ struct sync_device {
 	spinlock_t row_spinlocks[CAM_SYNC_MAX_OBJS];
 	struct mutex table_lock;
 	int open_cnt;
+	struct dentry *dentry;
 	struct workqueue_struct *work_queue;
 	struct v4l2_fh *cam_sync_eventq;
 	spinlock_t cam_sync_eventq_lock;
diff --git a/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.c b/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.c
index f391c8c8d51d..49a9d2f39974 100644
--- a/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.c
+++ b/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.c
@@ -287,6 +287,64 @@ void cam_sync_util_cb_dispatch(struct work_struct *cb_dispatch_work)
 	kfree(cb_info);
 }
 
+void cam_sync_util_dispatch_signaled_cb(int32_t sync_obj,
+	uint32_t status)
+{
+	struct sync_callback_info  *sync_cb;
+	struct sync_user_payload   *payload_info;
+	struct sync_callback_info  *temp_sync_cb;
+	struct sync_table_row      *signalable_row;
+	struct sync_user_payload   *temp_payload_info;
+
+	signalable_row = sync_dev->sync_table + sync_obj;
+	if (signalable_row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_DBG(CAM_SYNC,
+			"Accessing invalid sync object:%i", sync_obj);
+		return;
+	}
+
+	/* Dispatch kernel callbacks if any were registered earlier */
+	list_for_each_entry_safe(sync_cb,
+		temp_sync_cb, &signalable_row->callback_list, list) {
+		sync_cb->status = status;
+		list_del_init(&sync_cb->list);
+		queue_work(sync_dev->work_queue,
+			&sync_cb->cb_dispatch_work);
+	}
+
+	/* Dispatch user payloads if any were registered earlier */
+	list_for_each_entry_safe(payload_info, temp_payload_info,
+		&signalable_row->user_payload_list, list) {
+		spin_lock_bh(&sync_dev->cam_sync_eventq_lock);
+		if (!sync_dev->cam_sync_eventq) {
+			spin_unlock_bh(
+				&sync_dev->cam_sync_eventq_lock);
+			break;
+		}
+		spin_unlock_bh(&sync_dev->cam_sync_eventq_lock);
+		cam_sync_util_send_v4l2_event(
+			CAM_SYNC_V4L_EVENT_ID_CB_TRIG,
+			sync_obj,
+			status,
+			payload_info->payload_data,
+			CAM_SYNC_PAYLOAD_WORDS * sizeof(__u64));
+
+		list_del_init(&payload_info->list);
+		/*
+		 * We can free the list node here because
+		 * sending V4L event will make a deep copy
+		 * anyway
+		 */
+		 kfree(payload_info);
+	}
+
+	/*
+	 * This needs to be done because we want to unblock anyone
+	 * who might be blocked and waiting on this sync object
+	 */
+	complete_all(&signalable_row->signaled);
+}
+
 void cam_sync_util_send_v4l2_event(uint32_t id,
 	uint32_t sync_obj,
 	int status,
@@ -312,26 +370,6 @@ void cam_sync_util_send_v4l2_event(uint32_t id,
 		sync_obj);
 }
 
-int cam_sync_util_add_to_signalable_list(int32_t sync_obj,
-	uint32_t status,
-	struct list_head *sync_list)
-{
-	struct cam_signalable_info *signalable_info = NULL;
-
-	signalable_info = kzalloc(sizeof(*signalable_info), GFP_ATOMIC);
-	if (!signalable_info)
-		return -ENOMEM;
-
-	signalable_info->sync_obj = sync_obj;
-	signalable_info->status = status;
-
-	list_add_tail(&signalable_info->list, sync_list);
-	CAM_DBG(CAM_SYNC, "Add sync_obj :%d with status :%d to signalable list",
-		sync_obj, status);
-
-	return 0;
-}
-
 int cam_sync_util_update_parent_state(struct sync_table_row *parent_row,
 	int new_state)
 {
diff --git a/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.h b/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.h
index a9d6f86c1709..cfa450c0e744 100644
--- a/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.h
+++ b/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.h
@@ -87,6 +87,17 @@ int cam_sync_deinit_object(struct sync_table_row *table, uint32_t idx);
 void cam_sync_util_cb_dispatch(struct work_struct *cb_dispatch_work);
 
 /**
+ * @brief: Function to dispatch callbacks for a signaled sync object
+ *
+ * @sync_obj : Sync object that is signaled
+ * @status   : Status of the signaled object
+ *
+ * @return None
+ */
+void cam_sync_util_dispatch_signaled_cb(int32_t sync_obj,
+	uint32_t status);
+
+/**
  * @brief: Function to send V4L event to user space
  * @param id       : V4L event id to send
  * @param sync_obj : Sync obj for which event needs to be sent
@@ -103,19 +114,6 @@ void cam_sync_util_send_v4l2_event(uint32_t id,
 	int len);
 
 /**
- * @brief: Function which adds sync object information to the signalable list
- *
- * @param sync_obj : Sync object to add
- * @param status   : Status of above sync object
- * @param list     : Linked list where the information should be added to
- *
- * @return Status of operation. Negative in case of error. Zero otherwise.
- */
-int cam_sync_util_add_to_signalable_list(int32_t sync_obj,
-	uint32_t status,
-	struct list_head *sync_list);
-
-/**
  * @brief: Function which gets the next state of the sync object based on the
  *         current state and the new state
  *
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
index db2629d2a2f9..a88ccdb93641 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
@@ -127,7 +127,7 @@ int cam_packet_util_process_patches(struct cam_packet *packet,
 	int32_t iommu_hdl, int32_t sec_mmu_hdl)
 {
 	struct cam_patch_desc *patch_desc = NULL;
-	uint64_t   iova_addr;
+	dma_addr_t iova_addr;
 	uint64_t   cpu_addr;
 	uint32_t   temp;
 	uint32_t  *dst_cpu_addr;
diff --git a/drivers/media/platform/msm/camera_v2/sensor/csiphy/include/msm_csiphy_10_0_0_hwreg.h b/drivers/media/platform/msm/camera_v2/sensor/csiphy/include/msm_csiphy_10_0_0_hwreg.h
index 87c759c09f23..4c5ce02cf461 100644
--- a/drivers/media/platform/msm/camera_v2/sensor/csiphy/include/msm_csiphy_10_0_0_hwreg.h
+++ b/drivers/media/platform/msm/camera_v2/sensor/csiphy/include/msm_csiphy_10_0_0_hwreg.h
@@ -72,6 +72,10 @@ static struct csiphy_reg_snps_parms_t csiphy_v10_0_0_snps = {
 	{0x12c, 0x0},    /* mipi_csiphy_rx_lane_0_7_00 */
 	{0x220, 0x0},    /* mipi_csiphy_rx_lane_1_7_00 */
 	{0xCC, 0x0},     /* mipi_csiphy_rx_clk_lane_7_00 */
+	{0x1F8, 0x20},   /* mipi_csiphy_rx_lane0_ddl_2_00 */
+	{0x1FC, 0x10},   /* mipi_csiphy_rx_lane0_ddl_3_00 */
+	{0x22C, 0x80},   /* mipi_csiphy_rx_lane_1_10_00 */
+	{0x230, 0x10},   /* mipi_csiphy_rx_lane_1_11_00 */
 };
 
 static struct snps_freq_value snps_v100_freq_values[] = {
diff --git a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c
index 276c76e1d1a5..162101c5dfa9 100644
--- a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c
+++ b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c
@@ -282,6 +282,27 @@ static int msm_csiphy_snps_2_lane_config(
 		csiphybase + csiphy_dev->ctrl_reg->csiphy_snps_reg.
 		mipi_csiphy_rx_cb_2_00.addr + offset);
 
+	if (local_data_rate <= 1500) {
+		msm_camera_io_w(csiphy_dev->ctrl_reg->csiphy_snps_reg.
+			mipi_csiphy_rx_lane0_ddl_2_00.data,
+			csiphybase + csiphy_dev->ctrl_reg->csiphy_snps_reg.
+			mipi_csiphy_rx_lane0_ddl_2_00.addr + offset);
+
+		msm_camera_io_w(csiphy_dev->ctrl_reg->csiphy_snps_reg.
+			mipi_csiphy_rx_lane0_ddl_3_00.data,
+			csiphybase + csiphy_dev->ctrl_reg->csiphy_snps_reg.
+			mipi_csiphy_rx_lane0_ddl_3_00.addr + offset);
+
+		msm_camera_io_w(csiphy_dev->ctrl_reg->csiphy_snps_reg.
+			mipi_csiphy_rx_lane_1_10_00.data,
+			csiphybase + csiphy_dev->ctrl_reg->csiphy_snps_reg.
+			mipi_csiphy_rx_lane_1_10_00.addr + offset);
+
+		msm_camera_io_w(csiphy_dev->ctrl_reg->csiphy_snps_reg.
+			mipi_csiphy_rx_lane_1_11_00.data,
+			csiphybase + csiphy_dev->ctrl_reg->csiphy_snps_reg.
+			mipi_csiphy_rx_lane_1_11_00.addr + offset);
+	}
 	return 0;
 }
 
diff --git a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.h b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.h
index 41d20347a07d..6fc084c5fde0 100644
--- a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.h
+++ b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.h
@@ -99,6 +99,10 @@ struct csiphy_reg_snps_parms_t {
 	struct csiphy_reg_t mipi_csiphy_rx_lane_0_7_00;
 	struct csiphy_reg_t mipi_csiphy_rx_lane_1_7_00;
 	struct csiphy_reg_t mipi_csiphy_rx_clk_lane_7_00;
+	struct csiphy_reg_t mipi_csiphy_rx_lane0_ddl_2_00;
+	struct csiphy_reg_t mipi_csiphy_rx_lane0_ddl_3_00;
+	struct csiphy_reg_t mipi_csiphy_rx_lane_1_10_00;
+	struct csiphy_reg_t mipi_csiphy_rx_lane_1_11_00;
 };
 
 struct csiphy_reg_3ph_parms_t {
diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c
index d0b5a0e67304..f9f21604e68a 100644
--- a/drivers/misc/qseecom.c
+++ b/drivers/misc/qseecom.c
@@ -1658,8 +1658,9 @@ static int __qseecom_process_incomplete_cmd(struct qseecom_dev_handle *data,
 	int rc = 0;
 	uint32_t lstnr;
 	unsigned long flags;
-	struct qseecom_client_listener_data_irsp send_data_rsp;
-	struct qseecom_client_listener_data_64bit_irsp send_data_rsp_64bit;
+	struct qseecom_client_listener_data_irsp send_data_rsp = {0};
+	struct qseecom_client_listener_data_64bit_irsp send_data_rsp_64bit
+									= {0};
 	struct qseecom_registered_listener_list *ptr_svc = NULL;
 	sigset_t new_sigset;
 	sigset_t old_sigset;
@@ -1757,32 +1758,38 @@ static int __qseecom_process_incomplete_cmd(struct qseecom_dev_handle *data,
 		}
 err_resp:
 		qseecom.send_resp_flag = 0;
-		ptr_svc->send_resp_flag = 0;
-		table = ptr_svc->sglistinfo_ptr;
+		if (ptr_svc) {
+			ptr_svc->send_resp_flag = 0;
+			table = ptr_svc->sglistinfo_ptr;
+		}
 		if (qseecom.qsee_version < QSEE_VERSION_40) {
 			send_data_rsp.listener_id  = lstnr;
 			send_data_rsp.status = status;
-			send_data_rsp.sglistinfo_ptr =
-				(uint32_t)virt_to_phys(table);
-			send_data_rsp.sglistinfo_len =
-				SGLISTINFO_TABLE_SIZE;
-			dmac_flush_range((void *)table,
-				(void *)table + SGLISTINFO_TABLE_SIZE);
+			if (table) {
+				send_data_rsp.sglistinfo_ptr =
+					(uint32_t)virt_to_phys(table);
+				send_data_rsp.sglistinfo_len =
+					SGLISTINFO_TABLE_SIZE;
+				dmac_flush_range((void *)table,
+					(void *)table + SGLISTINFO_TABLE_SIZE);
+			}
 			cmd_buf = (void *)&send_data_rsp;
 			cmd_len = sizeof(send_data_rsp);
 		} else {
 			send_data_rsp_64bit.listener_id  = lstnr;
 			send_data_rsp_64bit.status = status;
-			send_data_rsp_64bit.sglistinfo_ptr =
-				virt_to_phys(table);
-			send_data_rsp_64bit.sglistinfo_len =
-				SGLISTINFO_TABLE_SIZE;
-			dmac_flush_range((void *)table,
-				(void *)table + SGLISTINFO_TABLE_SIZE);
+			if (table) {
+				send_data_rsp_64bit.sglistinfo_ptr =
+					virt_to_phys(table);
+				send_data_rsp_64bit.sglistinfo_len =
+					SGLISTINFO_TABLE_SIZE;
+				dmac_flush_range((void *)table,
+					(void *)table + SGLISTINFO_TABLE_SIZE);
+			}
 			cmd_buf = (void *)&send_data_rsp_64bit;
 			cmd_len = sizeof(send_data_rsp_64bit);
 		}
-		if (qseecom.whitelist_support == false)
+		if (qseecom.whitelist_support == false || table == NULL)
 			*(uint32_t *)cmd_buf = QSEOS_LISTENER_DATA_RSP_COMMAND;
 		else
 			*(uint32_t *)cmd_buf =
@@ -1806,8 +1813,10 @@ err_resp:
 
 		ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1,
 					cmd_buf, cmd_len, resp, sizeof(*resp));
-		ptr_svc->listener_in_use = false;
-		__qseecom_clean_listener_sglistinfo(ptr_svc);
+		if (ptr_svc) {
+			ptr_svc->listener_in_use = false;
+			__qseecom_clean_listener_sglistinfo(ptr_svc);
+		}
 		if (ret) {
 			pr_err("scm_call() failed with err: %d (app_id = %d)\n",
 				ret, data->client.app_id);
@@ -1960,8 +1969,9 @@ static int __qseecom_reentrancy_process_incomplete_cmd(
 	int rc = 0;
 	uint32_t lstnr;
 	unsigned long flags;
-	struct qseecom_client_listener_data_irsp send_data_rsp;
-	struct qseecom_client_listener_data_64bit_irsp send_data_rsp_64bit;
+	struct qseecom_client_listener_data_irsp send_data_rsp = {0};
+	struct qseecom_client_listener_data_64bit_irsp send_data_rsp_64bit
+									= {0};
 	struct qseecom_registered_listener_list *ptr_svc = NULL;
 	sigset_t new_sigset;
 	sigset_t old_sigset;
@@ -2052,30 +2062,36 @@ static int __qseecom_reentrancy_process_incomplete_cmd(
 			status  = QSEOS_RESULT_SUCCESS;
 		}
 err_resp:
-		table = ptr_svc->sglistinfo_ptr;
+		if (ptr_svc)
+			table = ptr_svc->sglistinfo_ptr;
 		if (qseecom.qsee_version < QSEE_VERSION_40) {
 			send_data_rsp.listener_id  = lstnr;
 			send_data_rsp.status = status;
-			send_data_rsp.sglistinfo_ptr =
-				(uint32_t)virt_to_phys(table);
-			send_data_rsp.sglistinfo_len = SGLISTINFO_TABLE_SIZE;
-			dmac_flush_range((void *)table,
-				(void *)table + SGLISTINFO_TABLE_SIZE);
+			if (table) {
+				send_data_rsp.sglistinfo_ptr =
+					(uint32_t)virt_to_phys(table);
+				send_data_rsp.sglistinfo_len =
+						SGLISTINFO_TABLE_SIZE;
+				dmac_flush_range((void *)table,
+					(void *)table + SGLISTINFO_TABLE_SIZE);
+			}
 			cmd_buf = (void *)&send_data_rsp;
 			cmd_len = sizeof(send_data_rsp);
 		} else {
 			send_data_rsp_64bit.listener_id  = lstnr;
 			send_data_rsp_64bit.status = status;
-			send_data_rsp_64bit.sglistinfo_ptr =
-				virt_to_phys(table);
-			send_data_rsp_64bit.sglistinfo_len =
-				SGLISTINFO_TABLE_SIZE;
-			dmac_flush_range((void *)table,
-				(void *)table + SGLISTINFO_TABLE_SIZE);
+			if (table) {
+				send_data_rsp_64bit.sglistinfo_ptr =
+					virt_to_phys(table);
+				send_data_rsp_64bit.sglistinfo_len =
+					SGLISTINFO_TABLE_SIZE;
+				dmac_flush_range((void *)table,
+					(void *)table + SGLISTINFO_TABLE_SIZE);
+			}
 			cmd_buf = (void *)&send_data_rsp_64bit;
 			cmd_len = sizeof(send_data_rsp_64bit);
 		}
-		if (qseecom.whitelist_support == false)
+		if (qseecom.whitelist_support == false || table == NULL)
 			*(uint32_t *)cmd_buf = QSEOS_LISTENER_DATA_RSP_COMMAND;
 		else
 			*(uint32_t *)cmd_buf =
@@ -2098,9 +2114,11 @@ err_resp:
 
 		ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1,
 					cmd_buf, cmd_len, resp, sizeof(*resp));
-		ptr_svc->listener_in_use = false;
-		__qseecom_clean_listener_sglistinfo(ptr_svc);
-		wake_up_interruptible(&ptr_svc->listener_block_app_wq);
+		if (ptr_svc) {
+			ptr_svc->listener_in_use = false;
+			__qseecom_clean_listener_sglistinfo(ptr_svc);
+			wake_up_interruptible(&ptr_svc->listener_block_app_wq);
+		}
 
 		if (ret) {
 			pr_err("scm_call() failed with err: %d (app_id = %d)\n",
@@ -2644,6 +2662,7 @@ static int qseecom_unload_app(struct qseecom_dev_handle *data,
 		}
 	}
 
+unload_exit:
 	if (found_app) {
 		spin_lock_irqsave(&qseecom.registered_app_list_lock, flags1);
 		if (app_crash) {
@@ -2666,7 +2685,6 @@ static int qseecom_unload_app(struct qseecom_dev_handle *data,
 		spin_unlock_irqrestore(&qseecom.registered_app_list_lock,
 								flags1);
 	}
-unload_exit:
 	qseecom_unmap_ion_allocated_memory(data);
 	data->released = true;
 	return ret;
diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index 6909bd16fea7..15f3df9987e9 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -1475,6 +1475,12 @@ static void msm_gpio_setup_dir_connects(struct msm_pinctrl *pctrl)
 static int msm_gpiochip_to_irq(struct gpio_chip *chip, unsigned int offset)
 {
 	struct irq_fwspec fwspec;
+	struct irq_domain *domain = chip->irqdomain;
+	int virq;
+
+	virq = irq_find_mapping(domain, offset);
+	if (virq)
+		return virq;
 
 	fwspec.fwnode = of_node_to_fwnode(chip->of_node);
 	fwspec.param[0] = offset;
diff --git a/drivers/power/supply/qcom/smb-lib.c b/drivers/power/supply/qcom/smb-lib.c
index 6b6bc9c327aa..5546eae92663 100644
--- a/drivers/power/supply/qcom/smb-lib.c
+++ b/drivers/power/supply/qcom/smb-lib.c
@@ -510,6 +510,9 @@ static int smblib_request_dpdm(struct smb_charger *chg, bool enable)
 {
 	int rc = 0;
 
+	if (chg->pr_swap_in_progress)
+		return 0;
+
 	/* fetch the DPDM regulator */
 	if (!chg->dpdm_reg && of_get_property(chg->dev->of_node,
 				"dpdm-supply", NULL)) {
diff --git a/drivers/soc/qcom/bam_dmux.c b/drivers/soc/qcom/bam_dmux.c
index 3b75e744a5ec..84e51931cbac 100644
--- a/drivers/soc/qcom/bam_dmux.c
+++ b/drivers/soc/qcom/bam_dmux.c
@@ -1099,6 +1099,12 @@ int msm_bam_dmux_open(uint32_t id, void *priv,
 		kfree(hdr);
 		return -ENODEV;
 	}
+	if (in_global_reset) {
+		BAM_DMUX_LOG("%s: In SSR... ch_id[%d]\n", __func__, id);
+		spin_unlock_irqrestore(&bam_ch[id].lock, flags);
+		kfree(hdr);
+		return -ENODEV;
+	}
 
 	bam_ch[id].notify = notify;
 	bam_ch[id].priv = priv;
@@ -1177,6 +1183,12 @@ int msm_bam_dmux_close(uint32_t id)
 		return 0;
 	}
 
+	if (in_global_reset) {
+		BAM_DMUX_LOG("%s: In SSR... ch_id[%d]\n", __func__, id);
+		read_unlock(&ul_wakeup_lock);
+		return 0;
+	}
+
 	hdr = kmalloc(sizeof(struct bam_mux_hdr), GFP_ATOMIC);
 	if (hdr == NULL) {
 		read_unlock(&ul_wakeup_lock);
diff --git a/drivers/soc/qcom/big_cluster_min_freq_adjust.c b/drivers/soc/qcom/big_cluster_min_freq_adjust.c
index 979dd81193ba..32feedc0530f 100644
--- a/drivers/soc/qcom/big_cluster_min_freq_adjust.c
+++ b/drivers/soc/qcom/big_cluster_min_freq_adjust.c
@@ -180,6 +180,11 @@ static int enable_big_min_freq_adjust(void)
 	if (!p->min_freq_floor)
 		p->min_freq_floor = POLICY_MIN;
 
+	p->min_freq_state = RESET_MIN_FLOOR;
+	p->min_freq_request = RESET_MIN_FLOOR;
+	spin_lock_init(&p->lock);
+	p->big_min_freq_on = true;
+
 	ret = cpu_pm_register_notifier(&cpu_pm_nb);
 	if (ret) {
 		pr_err("Failed to register for PM notification\n");
@@ -193,11 +198,6 @@ static int enable_big_min_freq_adjust(void)
 		return ret;
 	}
 
-	p->min_freq_state = RESET_MIN_FLOOR;
-	p->min_freq_request = RESET_MIN_FLOOR;
-	spin_lock_init(&p->lock);
-	p->big_min_freq_on = true;
-
 	/* If BIG cluster is active at this time and continue to be active
 	 * forever, in that case min frequency of the cluster will never be
 	 * set to floor value.  This is to trigger the state machine and set
diff --git a/drivers/staging/android/ion/ion_carveout_heap.c b/drivers/staging/android/ion/ion_carveout_heap.c
index 492a93deeb88..09bae0345a26 100644
--- a/drivers/staging/android/ion/ion_carveout_heap.c
+++ b/drivers/staging/android/ion/ion_carveout_heap.c
@@ -160,7 +160,9 @@ static struct ion_heap_ops carveout_heap_ops = {
 	.unmap_kernel = ion_heap_unmap_kernel,
 };
 
-struct ion_heap *ion_carveout_heap_create(struct ion_platform_heap *heap_data)
+static struct ion_heap *__ion_carveout_heap_create(
+					struct ion_platform_heap *heap_data,
+					bool sync)
 {
 	struct ion_carveout_heap *carveout_heap;
 	int ret;
@@ -172,7 +174,8 @@ struct ion_heap *ion_carveout_heap_create(struct ion_platform_heap *heap_data)
 	page = pfn_to_page(PFN_DOWN(heap_data->base));
 	size = heap_data->size;
 
-	ion_pages_sync_for_device(dev, page, size, DMA_BIDIRECTIONAL);
+	if (sync)
+		ion_pages_sync_for_device(dev, page, size, DMA_BIDIRECTIONAL);
 
 	ret = ion_heap_pages_zero(page, size, pgprot_writecombine(PAGE_KERNEL));
 	if (ret)
@@ -197,6 +200,11 @@ struct ion_heap *ion_carveout_heap_create(struct ion_platform_heap *heap_data)
 	return &carveout_heap->heap;
 }
 
+struct ion_heap *ion_carveout_heap_create(struct ion_platform_heap *heap_data)
+{
+	return __ion_carveout_heap_create(heap_data, true);
+}
+
 void ion_carveout_heap_destroy(struct ion_heap *heap)
 {
 	struct ion_carveout_heap *carveout_heap =
@@ -362,7 +370,7 @@ static int ion_sc_add_child(struct ion_sc_heap *manager,
 	heap_data.size = size;
 
 	/* This will zero memory initially */
-	entry->heap = ion_carveout_heap_create(&heap_data);
+	entry->heap = __ion_carveout_heap_create(&heap_data, false);
 	if (IS_ERR(entry->heap))
 		goto out_free;
 
diff --git a/drivers/video/fbdev/msm/mdss_compat_utils.c b/drivers/video/fbdev/msm/mdss_compat_utils.c
index 23d4a27233d1..4ee8e603b8b5 100644
--- a/drivers/video/fbdev/msm/mdss_compat_utils.c
+++ b/drivers/video/fbdev/msm/mdss_compat_utils.c
@@ -1336,10 +1336,10 @@ static int __from_user_pgc_lut_data_legacy(
 		return -EFAULT;
 
 	if (num_r_stages > GC_LUT_SEGMENTS || num_b_stages > GC_LUT_SEGMENTS
-	    || num_r_stages > GC_LUT_SEGMENTS || !num_r_stages || !num_b_stages
+	    || num_g_stages > GC_LUT_SEGMENTS || !num_r_stages || !num_b_stages
 	    || !num_g_stages) {
 		pr_err("invalid number of stages r_stages %d b_stages %d g_stages %d\n",
-		       num_r_stages, num_b_stages, num_r_stages);
+		       num_r_stages, num_b_stages, num_g_stages);
 		return -EFAULT;
 	}
 
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 6b5f0bce0bd2..67ef013ed6f4 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -2761,6 +2761,9 @@ static int s_show(struct seq_file *m, void *p)
 
 	v = va->vm;
 
+	if (v->flags & VM_LOWMEM)
+		return 0;
+
 	seq_printf(m, "0x%pK-0x%pK %7ld",
 		v->addr, v->addr + v->size, v->size);
 
@@ -2788,9 +2791,6 @@ static int s_show(struct seq_file *m, void *p)
 	if (is_vmalloc_addr(v->pages))
 		seq_puts(m, " vpages");
 
-	if (v->flags & VM_LOWMEM)
-		seq_puts(m, " lowmem");
-
 	show_numa_info(m, v);
 	seq_putc(m, '\n');
 	return 0;
diff --git a/net/core/sockev_nlmcast.c b/net/core/sockev_nlmcast.c
index f238edbfb823..6bc3d7a5cdc6 100644
--- a/net/core/sockev_nlmcast.c
+++ b/net/core/sockev_nlmcast.c
@@ -36,7 +36,6 @@ static struct netlink_kernel_cfg nlcfg = {
 
 static void _sockev_event(unsigned long event, __u8 *evstr, int buflen)
 {
-	memset(evstr, 0, buflen);
 
 	switch (event) {
 	case SOCKEV_SOCKET:
@@ -98,6 +97,9 @@ static int sockev_client_cb(struct notifier_block *nb,
 	NETLINK_CB(skb).dst_group = SKNLGRP_SOCKEV;
 
 	smsg = nlmsg_data(nlh);
+
+	memset(smsg, 0, sizeof(struct sknlsockevmsg));
+
 	smsg->pid = current->pid;
 	_sockev_event(event, smsg->event, sizeof(smsg->event));
 	smsg->skfamily = sk->sk_family;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f00e7d339ff4..e0869504e817 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -11438,6 +11438,7 @@ static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
 		return -EOPNOTSUPP;
 
 	if (!info->attrs[NL80211_ATTR_MDID] ||
+	    !info->attrs[NL80211_ATTR_IE] ||
 	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
 		return -EINVAL;