Merge "sched/walt: Fix invalid access of CPU cycle counter callback"
diff --git a/Documentation/devicetree/bindings/arm/msm/msm.txt b/Documentation/devicetree/bindings/arm/msm/msm.txt
index 4f8e4f5..67060d3 100644
--- a/Documentation/devicetree/bindings/arm/msm/msm.txt
+++ b/Documentation/devicetree/bindings/arm/msm/msm.txt
@@ -410,6 +410,6 @@
 compatible = "qcom,sdxpoorwills-atp"
 compatible = "qcom,sdxpoorwills-mtp"
 compatible = "qcom,sdxpoorwills-cdp"
-compatible = "qcom,sdxpoorwills-ttp"
-compatible = "qcom,sdxpoorwills-ccard"
+compatible = "qcom,sa415m-ttp"
+compatible = "qcom,sa415m-ccard"
 compatible = "qcom,mdm9607-ttp"
diff --git a/Documentation/devicetree/bindings/mhi/msm_mhi_dev.txt b/Documentation/devicetree/bindings/mhi/msm_mhi_dev.txt
index 3017468..ece30e4 100644
--- a/Documentation/devicetree/bindings/mhi/msm_mhi_dev.txt
+++ b/Documentation/devicetree/bindings/mhi/msm_mhi_dev.txt
@@ -31,6 +31,18 @@
 		MHI driver on the host. This property is required if iatu
 		property qcom,mhi-config-iatu is present.
 
+MSM MHI DEV NET
+
+MSM MHI DEV enables communication with the host over a PCIe link using the
+Network Interface.
+
+Required properties:
+  - compatible: should be "qcom,msm-mhi-dev-net" for MHI net device driver.
+
+Optional property:
+  - qcom,mhi-ethernet-interface;: If property is present use ethernet packet
+	parsing support.
+
 Example:
 
 	mhi: qcom,msm-mhi-dev {
@@ -44,3 +56,8 @@
 		qcom,mhi-ep-msi = <1>;
 		qcom,mhi-version = <0x1000000>;
 	};
+
+	qcom,mhi_net_dev {
+		compatible = "qcom,msm-mhi-dev-net";
+		qcom,mhi-ethernet-interface;
+	};
diff --git a/Documentation/devicetree/bindings/pil/subsys-pil-tz.txt b/Documentation/devicetree/bindings/pil/subsys-pil-tz.txt
index f8329a9..31c5660 100644
--- a/Documentation/devicetree/bindings/pil/subsys-pil-tz.txt
+++ b/Documentation/devicetree/bindings/pil/subsys-pil-tz.txt
@@ -70,6 +70,12 @@
 - qcom,ignore-ssr-failure: Boolean. If set, SSR failures are not considered fatal.
 - qcom,mas-crypto: Reference to the bus master of crypto core.
 
+- qcom,sequential-fw-load: Boolean. If set, PIL loads the firmware image blobs in a
+				serial fashion. Else, they are loaded in
+				parallel. The property is specially useful for
+				low-end (single core) systems to prevent it from
+				degrading the performance.
+
 Example:
 	qcom,venus@fdce0000 {
 		compatible = "qcom,pil-tz-generic";
diff --git a/Documentation/devicetree/bindings/sound/aw8896.txt b/Documentation/devicetree/bindings/sound/aw8896.txt
index e74ce67..c96b367 100644
--- a/Documentation/devicetree/bindings/sound/aw8896.txt
+++ b/Documentation/devicetree/bindings/sound/aw8896.txt
@@ -6,7 +6,13 @@
 
   - reg : I2C address of the device
 
-  - reset-gpio: gpio used for HW reset
+  - reset-gpio : gpio used for HW reset
+
+  - dvdd-supply : Power supply for PA's dvdd
+
+  - dvdd-voltage : Minimum and maximum voltage in uV to set for power supply
+
+  - dvdd-current : dvdd's max current in uA
 
 Optional properties:
 
@@ -18,4 +24,7 @@
 		compatible = "awinic,i2c_smartpa";
 		reg = <0x34>;
 		reset-gpio = <&tlmm 68 0>;
+		dvdd-supply = <&pm660_l9>;
+		dvdd-voltage = <1800000 1800000>;
+		dvdd-current = <15000>;
 	};
diff --git a/Documentation/devicetree/bindings/usb/dwc3.txt b/Documentation/devicetree/bindings/usb/dwc3.txt
index 83ecdc7..20abd3d 100644
--- a/Documentation/devicetree/bindings/usb/dwc3.txt
+++ b/Documentation/devicetree/bindings/usb/dwc3.txt
@@ -63,6 +63,7 @@
 	during bus suspend.
  - snps,usb3-u1u2-disable: If present, disable U1U2 low power modes in Superspeed mode
  - snps,usb2-l1-disable: If present, disable L1 low power modes in Highspeed mode
+ - normal-eps-in-gsi-mode: If present, two normal EPS (1 In, 1 Out) can be used in GSI mode
 
 This is usually a subnode to DWC3 glue to which it is connected.
 
diff --git a/arch/arm/boot/dts/qcom/Makefile b/arch/arm/boot/dts/qcom/Makefile
index 17524cf..ff0ae9a 100644
--- a/arch/arm/boot/dts/qcom/Makefile
+++ b/arch/arm/boot/dts/qcom/Makefile
@@ -3,7 +3,7 @@
 	sdxpoorwills-cdp.dtb \
 	sdxpoorwills-mtp.dtb \
 	sdxpoorwills-atp.dtb \
-	sdxpoorwills-v2-ttp.dtb \
+	sa415m-ttp.dtb \
 	sdxpoorwills-cdp-256.dtb \
 	sdxpoorwills-mtp-256.dtb \
 	sdxpoorwills-dualwifi-cdp.dtb \
@@ -16,9 +16,10 @@
 	sdxpoorwills-v2-cdp.dtb \
 	sdxpoorwills-v2-dualwifi-mtp.dtb \
 	sdxpoorwills-v2-dualwifi-cdp.dtb \
-	sdxpoorwills-ccard.dtb \
-	sdxpoorwills-ccard-pcie-ep.dtb \
-	sdxpoorwills-ccard-usb-ep.dtb \
+	sa415m-ccard.dtb \
+	sa415m-ccard-pcie-ep.dtb \
+	sa415m-ccard-usb-ep.dtb \
+	sa415m-ttp-usb-ep.dtb \
 	sdxpoorwills-v2-pcie-ep-mtp-256.dtb \
 	sdxpoorwills-v2-pcie-ep-mtp.dtb
 
diff --git a/arch/arm/boot/dts/qcom/pmxpoorwills.dtsi b/arch/arm/boot/dts/qcom/pmxpoorwills.dtsi
index 08e306d..fb88e76 100644
--- a/arch/arm/boot/dts/qcom/pmxpoorwills.dtsi
+++ b/arch/arm/boot/dts/qcom/pmxpoorwills.dtsi
@@ -60,16 +60,18 @@
 					<0x0 0xc2 0 IRQ_TYPE_NONE>,
 					<0x0 0xc3 0 IRQ_TYPE_NONE>,
 					<0x0 0xc4 0 IRQ_TYPE_NONE>,
-					<0x0 0xc5 0 IRQ_TYPE_NONE>;
+					<0x0 0xc5 0 IRQ_TYPE_NONE>,
+					<0x0 0xc8 0 IRQ_TYPE_NONE>;
 			interrupt-names = "pmxpoorwills_gpio1",
 					  "pmxpoorwills_gpio2",
 					  "pmxpoorwills_gpio3",
 					  "pmxpoorwills_gpio4",
 					  "pmxpoorwills_gpio5",
-					  "pmxpoorwills_gpio6";
+					  "pmxpoorwills_gpio6",
+					  "pmxpoorwills_gpio9";
 			gpio-controller;
 			#gpio-cells = <2>;
-			qcom,gpios-disallowed = <7 8 9>;
+			qcom,gpios-disallowed = <7 8>;
 		};
 
 		pmxpoorwills_rtc: qcom,pmxpoorwills_rtc {
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-ccard-pcie-ep.dts b/arch/arm/boot/dts/qcom/sa415m-ccard-pcie-ep.dts
similarity index 90%
rename from arch/arm/boot/dts/qcom/sdxpoorwills-ccard-pcie-ep.dts
rename to arch/arm/boot/dts/qcom/sa415m-ccard-pcie-ep.dts
index c7bf2bd..c2a447b 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-ccard-pcie-ep.dts
+++ b/arch/arm/boot/dts/qcom/sa415m-ccard-pcie-ep.dts
@@ -12,11 +12,11 @@
 
 /dts-v1/;
 
-#include "sdxpoorwills-ccard.dtsi"
+#include "sa415m-ccard.dtsi"
 
 / {
 	model = "Qualcomm Technologies, Inc. SA415M CCARD PCIE-EP";
-	compatible = "qcom,sdxpoorwills-ccard",
+	compatible = "qcom,sa415m-ccard",
 		"qcom,sdxpoorwills", "qcom,ccard";
 	qcom,board-id = <25 1>, <25 0x101>;
 };
@@ -52,3 +52,7 @@
 &ipc_router_mhi_dev_xprt {
 	status = "okay";
 };
+
+&mhi_net_device {
+	status = "okay";
+};
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-ccard-usb-ep.dts b/arch/arm/boot/dts/qcom/sa415m-ccard-usb-ep.dts
similarity index 89%
rename from arch/arm/boot/dts/qcom/sdxpoorwills-ccard-usb-ep.dts
rename to arch/arm/boot/dts/qcom/sa415m-ccard-usb-ep.dts
index 9f0764e..1cf3a55 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-ccard-usb-ep.dts
+++ b/arch/arm/boot/dts/qcom/sa415m-ccard-usb-ep.dts
@@ -12,11 +12,11 @@
 
 /dts-v1/;
 
-#include "sdxpoorwills-ccard.dtsi"
+#include "sa415m-ccard.dtsi"
 
 / {
 	model = "Qualcomm Technologies, Inc. SA415M CCARD USB-EP";
-	compatible = "qcom,sdxpoorwills-ccard",
+	compatible = "qcom,sa415m-ccard",
 		"qcom,sdxpoorwills", "qcom,ccard";
 	qcom,board-id = <25 2>, <25 0x102>;
 };
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-ccard.dts b/arch/arm/boot/dts/qcom/sa415m-ccard.dts
similarity index 89%
rename from arch/arm/boot/dts/qcom/sdxpoorwills-ccard.dts
rename to arch/arm/boot/dts/qcom/sa415m-ccard.dts
index b9acf1c..a0212fc 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-ccard.dts
+++ b/arch/arm/boot/dts/qcom/sa415m-ccard.dts
@@ -12,11 +12,11 @@
 
 /dts-v1/;
 
-#include "sdxpoorwills-ccard.dtsi"
+#include "sa415m-ccard.dtsi"
 
 / {
 	model = "Qualcomm Technologies, Inc. SA415M CCARD";
-	compatible = "qcom,sdxpoorwills-ccard",
+	compatible = "qcom,sa415m-ccard",
 		"qcom,sdxpoorwills", "qcom,ccard";
 	qcom,board-id = <25 0>, <25 0x100>;
 };
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-ccard.dtsi b/arch/arm/boot/dts/qcom/sa415m-ccard.dtsi
similarity index 91%
rename from arch/arm/boot/dts/qcom/sdxpoorwills-ccard.dtsi
rename to arch/arm/boot/dts/qcom/sa415m-ccard.dtsi
index d327aa3..d2e597d 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-ccard.dtsi
+++ b/arch/arm/boot/dts/qcom/sa415m-ccard.dtsi
@@ -10,7 +10,7 @@
  * GNU General Public License for more details.
  */
 
-#include "sdxpoorwills-ttp.dtsi"
+#include "sa415m-ttp.dtsi"
 #include "sdxpoorwills-v2.dtsi"
 
 &blsp1_uart2b_hs {
@@ -54,6 +54,12 @@
 	};
 };
 
+&spi_2 {
+	can-controller@0 {
+		qcom,max-can-channels = <2>;
+	};
+};
+
 &wcd934x_cdc {
 	status = "disabled";
 };
@@ -141,12 +147,13 @@
 	};
 };
 
-&pmxpoorwills_gpios {
-	a2b_cdc_sel {
-		a2b_cdc_sel_default: a2b_cdc_sel_default {
-			pins = "gpio1";
-			power-source = <1>;
-			output-high;
-		};
-	};
+&emac_hw {
+	/delete-property/ vreg_rgmii-supply;
+	pinctrl-names = "default";
+	pinctrl-0 = <&vreg_rgmii_off_default>;
+};
+
+&vreg_rgmii_io_pads {
+	regulator-min-microvolt = <1800000>;
+	regulator-max-microvolt = <1800000>;
 };
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-v2-ttp.dts b/arch/arm/boot/dts/qcom/sa415m-ttp-usb-ep.dts
similarity index 81%
copy from arch/arm/boot/dts/qcom/sdxpoorwills-v2-ttp.dts
copy to arch/arm/boot/dts/qcom/sa415m-ttp-usb-ep.dts
index a686c4b..802e8319 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-v2-ttp.dts
+++ b/arch/arm/boot/dts/qcom/sa415m-ttp-usb-ep.dts
@@ -12,14 +12,14 @@
 
 /dts-v1/;
 
-#include "sdxpoorwills-ttp.dtsi"
+#include "sa415m-ttp.dtsi"
 #include "sdxpoorwills-v2.dtsi"
 
 / {
-	model = "Qualcomm Technologies, Inc. SDXPOORWILLS TTP V2";
-	compatible = "qcom,sdxpoorwills-ttp",
+	model = "Qualcomm Technologies, Inc. SA415M TTP USB-EP";
+	compatible = "qcom,sa415m-ttp",
 		"qcom,sdxpoorwills", "qcom,ttp";
-	qcom,board-id = <30 0x100>;
+	qcom,board-id = <30 0x102>;
 };
 
 &blsp1_uart2b_hs {
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-v2-ttp.dts b/arch/arm/boot/dts/qcom/sa415m-ttp.dts
similarity index 84%
rename from arch/arm/boot/dts/qcom/sdxpoorwills-v2-ttp.dts
rename to arch/arm/boot/dts/qcom/sa415m-ttp.dts
index a686c4b..d83eb68 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-v2-ttp.dts
+++ b/arch/arm/boot/dts/qcom/sa415m-ttp.dts
@@ -12,12 +12,12 @@
 
 /dts-v1/;
 
-#include "sdxpoorwills-ttp.dtsi"
+#include "sa415m-ttp.dtsi"
 #include "sdxpoorwills-v2.dtsi"
 
 / {
-	model = "Qualcomm Technologies, Inc. SDXPOORWILLS TTP V2";
-	compatible = "qcom,sdxpoorwills-ttp",
+	model = "Qualcomm Technologies, Inc. SA415M TTP V2";
+	compatible = "qcom,sa415m-ttp",
 		"qcom,sdxpoorwills", "qcom,ttp";
 	qcom,board-id = <30 0x100>;
 };
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-ttp.dtsi b/arch/arm/boot/dts/qcom/sa415m-ttp.dtsi
similarity index 73%
rename from arch/arm/boot/dts/qcom/sdxpoorwills-ttp.dtsi
rename to arch/arm/boot/dts/qcom/sa415m-ttp.dtsi
index c8fe492..27d4437 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-ttp.dtsi
+++ b/arch/arm/boot/dts/qcom/sa415m-ttp.dtsi
@@ -44,6 +44,44 @@
 		enable-active-high;
 		gpio = <&tlmm 71 GPIO_ACTIVE_HIGH>;
 	};
+	cnss_pcie: qcom,cnss {
+		compatible = "qcom,cnss";
+		reg = <0x10000000 0x10000000>,
+		      <0x20000000 0x10000>;
+		reg-names = "smmu_iova_base", "smmu_iova_ipa";
+
+		wlan-en-gpio = <&tlmm 52 0>;
+		vdd-wlan-supply = <&vreg_wlan>;
+		vdd-wlan-xtal-supply = <&pmxpoorwills_l6>;
+		vdd-wlan-io-supply = <&pmxpoorwills_l6>;
+		qcom,notify-modem-status;
+		pinctrl-names = "wlan_en_active", "wlan_en_sleep";
+		pinctrl-0 = <&cnss_wlan_en_active>;
+		pinctrl-1 = <&cnss_wlan_en_sleep>;
+		qcom,wlan-rc-num = <0>;
+		qcom,wlan-ramdump-dynamic = <0x200000>;
+		qcom,smmu-s1-enable;
+		qcom,msm-bus,name = "msm-cnss";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+				<45 512 0 0>, <1 512 0 0>,
+				/* Upto 200 Mbps */
+				<45 512 41421 655360>, <1 512 41421 655360>,
+				/* Upto 400 Mbps */
+				<45 512 98572 655360>, <1 512 98572 1600000>,
+				/* Upto 800 Mbps */
+				<45 512 207108 1146880>, <1 512 207108 3124992>;
+
+	};
+};
+
+&i2c_3 {
+	eeprom@52 {
+		compatible = "atmel,24c128";
+		reg = <0x52>;
+		pagesize = <32>;
+	};
 };
 
 &i2c_4 {
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-cdp-256.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-cdp-256.dtsi
index ba29301..1f07825 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-cdp-256.dtsi
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-cdp-256.dtsi
@@ -39,6 +39,10 @@
 	status = "okay";
 };
 
+&mhi_net_device {
+	status = "okay";
+};
+
 &restart_pshold {
 	qcom,force-warm-reboot;
 };
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-cdp.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-cdp.dtsi
index 43490bf..f139ba9 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-cdp.dtsi
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-cdp.dtsi
@@ -36,6 +36,10 @@
 	status = "okay";
 };
 
+&mhi_net_device {
+	status = "okay";
+};
+
 &restart_pshold {
 	qcom,force-warm-reboot;
 };
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-mtp-256.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-mtp-256.dtsi
index d2fe3be..14e70bc 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-mtp-256.dtsi
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-pcie-ep-mtp-256.dtsi
@@ -39,6 +39,10 @@
 	status = "okay";
 };
 
+&mhi_net_device {
+	status = "okay";
+};
+
 &restart_pshold {
 	qcom,force-warm-reboot;
 };
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-pcie.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills-pcie.dtsi
index 1907209..e0ecfaa 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-pcie.dtsi
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-pcie.dtsi
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -130,7 +130,6 @@
 		qcom,vreg-cx-voltage-level = <RPMH_REGULATOR_LEVEL_MAX
 						RPMH_REGULATOR_LEVEL_SVS 0>;
 
-		qcom,l0s-supported;
 		qcom,l1-supported;
 		qcom,l1ss-supported;
 		qcom,aux-clk-sync;
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-pinctrl.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills-pinctrl.dtsi
index 8c11e09..09a6219 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-pinctrl.dtsi
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-pinctrl.dtsi
@@ -1755,6 +1755,14 @@
 };
 
 &pmxpoorwills_gpios {
+	a2b_cdc_sel {
+		a2b_cdc_sel_default: a2b_cdc_sel_default {
+			pins = "gpio1";
+			power-source = <1>;
+			output-high;
+		};
+	};
+
 	ambient_therm {
 		ambient_therm_default: ambient_therm_default {
 			pins = "gpio2";
@@ -1768,4 +1776,13 @@
 			bias-high-impedance;
 		};
 	};
+
+	vreg_rgmii_off {
+		vreg_rgmii_off_default: vreg_rgmii_off_default {
+			pins = "gpio9";
+			bias-pull-down;
+			output-disable;
+			input-enable;
+		};
+	};
 };
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-regulator.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills-regulator.dtsi
index 7543f7c..70dc3ae 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-regulator.dtsi
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-regulator.dtsi
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -398,8 +398,8 @@
 	vreg_rgmii_io_pads: rgmii_io_pads_regulator {
 		compatible = "regulator-fixed";
 		regulator-name = "rgmii_io_pads";
-		regulator-min-microvolt = <1800000>;
-		regulator-max-microvolt = <1800000>;
+		regulator-min-microvolt = <2500000>;
+		regulator-max-microvolt = <2500000>;
 		regulator-enable-ramp-delay = <100>;
 		gpio = <&tlmm 83 GPIO_ACTIVE_HIGH>;
 		enable-active-high;
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills.dtsi
index 02a1bf9..abbc8b5 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills.dtsi
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills.dtsi
@@ -520,6 +520,12 @@
 		status = "disabled";
 	};
 
+	mhi_net_device: qcom,mhi_net_dev {
+		compatible = "qcom,msm-mhi-dev-net";
+		qcom,mhi-ethernet-interface;
+		status = "disabled";
+	};
+
 	gdsc_emac: qcom,gdsc@147004 {
 		compatible = "qcom,gdsc";
 		regulator-name = "gdsc_emac";
diff --git a/arch/arm/configs/sdxpoorwills-auto-perf_defconfig b/arch/arm/configs/sdxpoorwills-auto-perf_defconfig
index f292555..b04fd97 100644
--- a/arch/arm/configs/sdxpoorwills-auto-perf_defconfig
+++ b/arch/arm/configs/sdxpoorwills-auto-perf_defconfig
@@ -65,7 +65,6 @@
 CONFIG_IPV6_MROUTE=y
 CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IPV6_PIMSM_V2=y
-# CONFIG_ANDROID_PARANOID_NETWORK is not set
 CONFIG_NETFILTER=y
 CONFIG_NETFILTER_DEBUG=y
 CONFIG_NF_CONNTRACK=y
@@ -181,6 +180,7 @@
 CONFIG_RFKILL=y
 CONFIG_IPC_ROUTER=y
 CONFIG_IPC_ROUTER_SECURITY=y
+CONFIG_IPC_ROUTER_NODE_ID=2
 CONFIG_REGMAP_ALLOW_WRITE_DEBUGFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=12
@@ -193,6 +193,7 @@
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_QSEECOM=y
+CONFIG_EEPROM_AT24=y
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_SG=y
diff --git a/arch/arm/configs/sdxpoorwills-auto_defconfig b/arch/arm/configs/sdxpoorwills-auto_defconfig
index d5544bd..3d0cca3 100644
--- a/arch/arm/configs/sdxpoorwills-auto_defconfig
+++ b/arch/arm/configs/sdxpoorwills-auto_defconfig
@@ -66,7 +66,6 @@
 CONFIG_IPV6_MROUTE=y
 CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IPV6_PIMSM_V2=y
-# CONFIG_ANDROID_PARANOID_NETWORK is not set
 CONFIG_NETFILTER=y
 CONFIG_NETFILTER_DEBUG=y
 CONFIG_NF_CONNTRACK=y
@@ -182,6 +181,7 @@
 CONFIG_RFKILL=y
 CONFIG_IPC_ROUTER=y
 CONFIG_IPC_ROUTER_SECURITY=y
+CONFIG_IPC_ROUTER_NODE_ID=2
 CONFIG_REGMAP_ALLOW_WRITE_DEBUGFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=12
@@ -194,6 +194,7 @@
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_QSEECOM=y
+CONFIG_EEPROM_AT24=y
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_SG=y
diff --git a/arch/arm/configs/sdxpoorwills-perf_defconfig b/arch/arm/configs/sdxpoorwills-perf_defconfig
index 4c48a1f..44eb38b 100644
--- a/arch/arm/configs/sdxpoorwills-perf_defconfig
+++ b/arch/arm/configs/sdxpoorwills-perf_defconfig
@@ -66,7 +66,6 @@
 CONFIG_IPV6_MROUTE=y
 CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IPV6_PIMSM_V2=y
-# CONFIG_ANDROID_PARANOID_NETWORK is not set
 CONFIG_NETFILTER=y
 CONFIG_NETFILTER_DEBUG=y
 CONFIG_NF_CONNTRACK=y
diff --git a/arch/arm/configs/sdxpoorwills_defconfig b/arch/arm/configs/sdxpoorwills_defconfig
index f892b1a..2b02a48 100644
--- a/arch/arm/configs/sdxpoorwills_defconfig
+++ b/arch/arm/configs/sdxpoorwills_defconfig
@@ -68,7 +68,6 @@
 CONFIG_IPV6_MROUTE=y
 CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IPV6_PIMSM_V2=y
-# CONFIG_ANDROID_PARANOID_NETWORK is not set
 CONFIG_NETFILTER=y
 CONFIG_NETFILTER_DEBUG=y
 CONFIG_NF_CONNTRACK=y
diff --git a/arch/arm/configs/spyro-perf_defconfig b/arch/arm/configs/spyro-perf_defconfig
index d0c6b05..70a0646 100644
--- a/arch/arm/configs/spyro-perf_defconfig
+++ b/arch/arm/configs/spyro-perf_defconfig
@@ -303,7 +303,6 @@
 CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_v26=y
 CONFIG_SECURE_TOUCH_SYNAPTICS_DSX_V26=y
 CONFIG_INPUT_MISC=y
-CONFIG_INPUT_HBTP_INPUT=y
 CONFIG_INPUT_QPNP_POWER_ON=y
 CONFIG_INPUT_QTI_HAPTICS=y
 CONFIG_INPUT_UINPUT=y
diff --git a/arch/arm/configs/spyro_defconfig b/arch/arm/configs/spyro_defconfig
index 0e10212..a971fa1 100644
--- a/arch/arm/configs/spyro_defconfig
+++ b/arch/arm/configs/spyro_defconfig
@@ -310,7 +310,6 @@
 CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_v26=y
 CONFIG_SECURE_TOUCH_SYNAPTICS_DSX_V26=y
 CONFIG_INPUT_MISC=y
-CONFIG_INPUT_HBTP_INPUT=y
 CONFIG_INPUT_QPNP_POWER_ON=y
 CONFIG_INPUT_QTI_HAPTICS=y
 CONFIG_INPUT_UINPUT=y
diff --git a/arch/arm/mach-qcom/board-sdm429.c b/arch/arm/mach-qcom/board-sdm429.c
index 6bdf0f4..3638c37 100644
--- a/arch/arm/mach-qcom/board-sdm429.c
+++ b/arch/arm/mach-qcom/board-sdm429.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -18,6 +18,7 @@
 static const char *sdm429_dt_match[] __initconst = {
 	"qcom,sdm429",
 	"qcom,sda429",
+	"qcom,sdm429w",
 	NULL
 };
 
diff --git a/arch/arm64/boot/dts/qcom/msm8937-smp2p.dtsi b/arch/arm64/boot/dts/qcom/msm8937-smp2p.dtsi
index d5537e9..7b6d4d1 100644
--- a/arch/arm64/boot/dts/qcom/msm8937-smp2p.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8937-smp2p.dtsi
@@ -158,6 +158,21 @@
 		gpios = <&smp2pgpio_smp2p_2_out 0 0>;
 	};
 
+	smp2pgpio_sleepstate_2_out: qcom,smp2pgpio-sleepstate-gpio-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "sleepstate";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio-sleepstate-2-out {
+		compatible = "qcom,smp2pgpio-sleepstate-out";
+		gpios = <&smp2pgpio_sleepstate_2_out 0 0>;
+	};
+
 	/* ssr - inbound entry from mss. */
 	smp2pgpio_ssr_smp2p_1_in: qcom,smp2pgpio-ssr-smp2p-1-in {
 		compatible = "qcom,smp2pgpio";
diff --git a/arch/arm64/boot/dts/qcom/sdm429-qrd-spyro-evt.dtsi b/arch/arm64/boot/dts/qcom/sdm429-qrd-spyro-evt.dtsi
index 78cd72f..eaa844b 100644
--- a/arch/arm64/boot/dts/qcom/sdm429-qrd-spyro-evt.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm429-qrd-spyro-evt.dtsi
@@ -592,8 +592,8 @@
 	/delete-property/qcom,cdc-us-eu-gpios;
 
 
-	asoc-codec = <&stub_codec>, <&msm_dig_codec>;
-	asoc-codec-names = "msm-stub-codec.1", "msm-dig-codec";
+	asoc-codec = <&stub_codec>, <&msm_dig_codec>, <&ext_smart_pa>;
+	asoc-codec-names = "msm-stub-codec.1", "msm-dig-codec", "ext-smart-pa";
 };
 
 &soc {
@@ -655,7 +655,7 @@
 };
 
 &i2c_2 {
-	aw8896_smartpa@34 {
+	ext_smart_pa: aw8896_smartpa@34 {
 		compatible = "awinic,aw8896_smartpa";
 		reg = <0x34>;
 		reset-gpio = <&tlmm 68 0>;
diff --git a/arch/arm64/boot/dts/qcom/sdm429.dtsi b/arch/arm64/boot/dts/qcom/sdm429.dtsi
index 06c54a1..b261860 100644
--- a/arch/arm64/boot/dts/qcom/sdm429.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm429.dtsi
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -220,6 +220,18 @@
 			<  400000000 1>,
 			<  533333333 3>;
 
+		qcom,speed5-bin-v0-c1 =
+			<          0 0>,
+			<  960000000 1>,
+			< 1305600000 1>,
+			< 1497600000 2>,
+			< 1708800000 3>;
+
+		qcom,speed5-bin-v0-cci =
+			<          0 0>,
+			<  400000000 1>,
+			<  533333333 3>;
+
 		#clock-cells = <1>;
 	};
 
diff --git a/arch/arm64/boot/dts/qcom/sdm429w-pm660.dtsi b/arch/arm64/boot/dts/qcom/sdm429w-pm660.dtsi
index 50e6018..450691b 100644
--- a/arch/arm64/boot/dts/qcom/sdm429w-pm660.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm429w-pm660.dtsi
@@ -687,7 +687,7 @@
 	hsusb_vdd_dig-supply = <&L6A>;
 	HSUSB_1p8-supply = <&L12A>;
 	HSUSB_3p3-supply = <&L16A>;
-	qcom,vdd-voltage-level = <0 928000 928000>;
+	qcom,vdd-voltage-level = <0 800000 800000>;
 	vbus_otg-supply = <&smb2_vbus>;
 	status = "okay";
 };
@@ -732,7 +732,7 @@
 			reg = <0>;
 			qcom,supply-name = "vdda";
 			qcom,supply-min-voltage = <800000>;
-			qcom,supply-max-voltage = <930000>;
+			qcom,supply-max-voltage = <800000>;
 			qcom,supply-enable-load = <100000>;
 			qcom,supply-disable-load = <100>;
 			qcom,supply-post-on-sleep = <20>;
diff --git a/arch/arm64/boot/dts/qcom/sdm429w-regulator.dtsi b/arch/arm64/boot/dts/qcom/sdm429w-regulator.dtsi
index 3d05d56..b4dd41e 100644
--- a/arch/arm64/boot/dts/qcom/sdm429w-regulator.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm429w-regulator.dtsi
@@ -111,7 +111,7 @@
 		status = "okay";
 		S5A: pm660_s5: regulator-s5 {
 			regulator-min-microvolt = <1040000>;
-			regulator-max-microvolt = <1350000>;
+			regulator-max-microvolt = <1420000>;
 			qcom,init-voltage = <1040000>;
 			status = "okay";
 		};
@@ -177,7 +177,7 @@
 		L6A: pm660_l6: regulator-l6 {
 			regulator-min-microvolt = <670000>;
 			regulator-max-microvolt = <930000>;
-			qcom,init-voltage = <670000>;
+			qcom,init-voltage = <800000>;
 			status = "okay";
 		};
 	};
diff --git a/arch/arm64/boot/dts/qcom/sdm439.dtsi b/arch/arm64/boot/dts/qcom/sdm439.dtsi
index e4e74cb..b42d18e 100644
--- a/arch/arm64/boot/dts/qcom/sdm439.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm439.dtsi
@@ -356,6 +356,26 @@
 		<          0 0>,
 		<  400000000 1>,
 		<  533333333 3>;
+
+	qcom,speed5-bin-v0-c0 =
+		<          0 0>,
+		<  768000000 1>,
+		<  998400000 1>,
+		< 1171200000 2>,
+		< 1305600000 3>,
+		< 1459200000 5>;
+
+	qcom,speed5-bin-v0-c1=
+		<          0 0>,
+		<  960000000 1>,
+		< 1305600000 1>,
+		< 1497600000 2>,
+		< 1708800000 3>;
+
+	qcom,speed5-bin-v0-cci =
+		<          0 0>,
+		<  400000000 1>,
+		<  533333333 3>;
 };
 
 &clock_gcc {
diff --git a/arch/arm64/boot/dts/qcom/sdm845-camera-sensor-rb3.dtsi b/arch/arm64/boot/dts/qcom/sdm845-camera-sensor-rb3.dtsi
index 8aac76e..8f25cb0 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-camera-sensor-rb3.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-camera-sensor-rb3.dtsi
@@ -139,30 +139,30 @@
 		cam_clk-supply = <&titan_top_gdsc>;
 		regulator-names = "cam_vio", "cam_clk";
 		rgltr-cntrl-support;
-		rgltr-min-voltage = <1800000 0>;
-		rgltr-max-voltage = <1800000 0>;
-		rgltr-load-current = <80000  0>;
+		rgltr-min-voltage = <0 0>;
+		rgltr-max-voltage = <0 0>;
+		rgltr-load-current = <0 0>;
 		gpio-no-mux = <0>;
 		pinctrl-names = "cam_default", "cam_suspend";
-		pinctrl-0 = <&cam_sensor_mclk0_active
+		pinctrl-0 = <&cam_sensor_mclk2_active
 				&cam_sensor_rear4_active>;
-		pinctrl-1 = <&cam_sensor_mclk0_suspend
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
 				&cam_sensor_rear4_suspend>;
-		gpios = <&tlmm 13 0>,
+		gpios = <&tlmm 15 0>,
 			<&tlmm 12 0>,
 			<&tlmm 69 0>;
 		gpio-reset = <1>;
 		gpio-custom1 = <2>;
 		gpio-req-tbl-num = <0 1 2>;
 		gpio-req-tbl-flags = <1 0 0>;
-		gpio-req-tbl-label = "CAMIF_MCLK0",
+		gpio-req-tbl-label = "CAMIF_MCLK4",
 					"CAM_RESET4",
 					"CAM_CUSTOM4";
 		sensor-position = <0>;
 		sensor-mode = <0>;
 		cci-master = <1>;
 		status = "ok";
-		clocks = <&clock_camcc CAM_CC_MCLK0_CLK>;
+		clocks = <&clock_camcc CAM_CC_MCLK2_CLK>;
 		clock-names = "cam_clk";
 		clock-cntl-level = "turbo";
 		clock-rates = <24000000>;
@@ -261,9 +261,9 @@
 		cam_clk-supply = <&titan_top_gdsc>;
 		regulator-names = "cam_vio", "cam_clk";
 		rgltr-cntrl-support;
-		rgltr-min-voltage = <1800000 0>;
-		rgltr-max-voltage = <1800000 0>;
-		rgltr-load-current = <100000 0>;
+		rgltr-min-voltage = <0 0>;
+		rgltr-max-voltage = <0 0>;
+		rgltr-load-current = <0 0>;
 		gpio-no-mux = <0>;
 		pinctrl-names = "cam_default", "cam_suspend";
 		pinctrl-0 = <&cam_sensor_mclk3_active
@@ -286,10 +286,10 @@
 		clock-rates = <24000000>;
 	};
 
-	qcom,cam-sensor@4 {
-		cell-index = <4>;
+	qcom,cam-sensor@6 {
+		cell-index = <6>;
 		compatible = "qcom,cam-sensor";
-		reg = <0x4>;
+		reg = <0x6>;
 		csiphy-sd-index = <2>;
 		sensor-position-roll = <270>;
 		sensor-position-pitch = <0>;
@@ -303,29 +303,29 @@
 		cam_clk-supply = <&titan_top_gdsc>;
 		regulator-names = "cam_vio", "cam_clk";
 		rgltr-cntrl-support;
-		rgltr-min-voltage = <1800000 0>;
-		rgltr-max-voltage = <1800000 0>;
-		rgltr-load-current = <80000  0>;
+		rgltr-min-voltage = <0 0>;
+		rgltr-max-voltage = <0 0>;
+		rgltr-load-current = <0 0>;
 		gpio-no-mux = <0>;
 		pinctrl-names = "cam_default", "cam_suspend";
-		pinctrl-0 = <&cam_sensor_mclk0_active
+		pinctrl-0 = <&cam_sensor_mclk2_active
 				&cam_sensor_rear4_active>;
-		pinctrl-1 = <&cam_sensor_mclk0_suspend
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
 				&cam_sensor_rear4_suspend>;
-		gpios = <&tlmm 13 0>,
+		gpios = <&tlmm 15 0>,
 			<&tlmm 12 0>,
 			<&tlmm 69 0>;
 		gpio-reset = <1>;
 		gpio-custom1 = <2>;
 		gpio-req-tbl-num = <0 1 2>;
 		gpio-req-tbl-flags = <1 0 0>;
-		gpio-req-tbl-label = "CAMIF_MCLK0",
+		gpio-req-tbl-label = "CAMIF_MCLK4",
 					"CAM_RESET4",
 					"CAM_CUSTOM4";
 		sensor-mode = <0>;
 		cci-master = <1>;
 		status = "ok";
-		clocks = <&clock_camcc CAM_CC_MCLK0_CLK>;
+		clocks = <&clock_camcc CAM_CC_MCLK2_CLK>;
 		clock-names = "cam_clk";
 		clock-cntl-level = "turbo";
 		clock-rates = <24000000>;
diff --git a/arch/arm64/boot/dts/qcom/sdm845-v2.1-rb3.dtsi b/arch/arm64/boot/dts/qcom/sdm845-v2.1-rb3.dtsi
index 1391080..e1159d3 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-v2.1-rb3.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-v2.1-rb3.dtsi
@@ -21,12 +21,16 @@
 #include "sdm845-rb3.dtsi"
 #include "sdm845-audio-overlay.dtsi"
 
-&labibb {
-	status = "disabled";
+&usb1 {
+	status = "ok";
 };
 
-&pmi8998_wled {
-	status = "disabled";
+&qusb_phy1 {
+	status = "ok";
+};
+
+&usb_qmp_phy {
+	status = "ok";
 };
 
 &qupv3_se3_i2c {
@@ -41,10 +45,6 @@
 	status = "ok";
 };
 
-&ext_5v_boost {
-	status = "disabled";
-};
-
 &wil6210 {
 	status = "disabled";
 };
@@ -70,6 +70,18 @@
 	};
 };
 
+&pcie0 {
+	pinctrl-names = "default", "slot_power_on";
+	pinctrl-1 = <&pcie0_3v3_on &pcie0_1v5_on>;
+	3v3_gpio = <&tlmm 90 0>;
+	1v5_gpio = <&tlmm 90 0>;
+	status = "ok";
+};
+
+&pcie1 {
+	/delete-property/ wake-gpio;
+};
+
 &max_rst_suspend {
 	mux {
 		pins = "gpio31","gpio77","gpio32";
@@ -83,14 +95,6 @@
 	pins = "gpio11";
 };
 
-&sde_dp {
-	status = "disabled";
-};
-
-&mdss_mdp {
-	status = "disabled";
-};
-
 &soc {
 	qcom,qbt1000 {
 		compatible = "qcom,qbt1000";
@@ -99,6 +103,10 @@
 		qcom,ipc-gpio = <&tlmm 121 0>;
 		qcom,finger-detect-gpio = <&pm8998_gpios 4 0>;
 	};
+
+	qcom,rmnet-ipa {
+		 status="disabled";
+	};
 };
 
 &ssc_sensors {
@@ -187,9 +195,12 @@
 
 		config {
 			pins = "gpio12","gpio69";
-			bias-pull-down; /* PULL DOWN */
+			bias-disable; /* No PULL */
 			drive-strength = <2>; /* 2 MA */
-			output-low;
 		};
 	};
 };
+
+&ipa_hw {
+	status="disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
index 2d36265..9bf544d 100644
--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
@@ -1549,6 +1549,7 @@
 		vdd_mss-supply = <&pm8005_s2_level>;
 		vdd_mss-uV = <RPMH_REGULATOR_LEVEL_TURBO>;
 		qcom,firmware-name = "modem";
+		qcom,sequential-fw-load;
 		qcom,pil-self-auth;
 		qcom,sysmon-id = <0>;
 		qcom,minidump-id = <3>;
diff --git a/arch/arm64/configs/sdm670-perf_defconfig b/arch/arm64/configs/sdm670-perf_defconfig
index 386de91..d75479e 100755
--- a/arch/arm64/configs/sdm670-perf_defconfig
+++ b/arch/arm64/configs/sdm670-perf_defconfig
@@ -37,7 +37,6 @@
 # CONFIG_RD_LZ4 is not set
 CONFIG_KALLSYMS_ALL=y
 CONFIG_BPF_SYSCALL=y
-# CONFIG_MEMBARRIER is not set
 CONFIG_EMBEDDED=y
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
@@ -72,13 +71,12 @@
 CONFIG_SWP_EMULATION=y
 CONFIG_CP15_BARRIER_EMULATION=y
 CONFIG_SETEND_EMULATION=y
+CONFIG_ARM64_SW_TTBR0_PAN=y
 # CONFIG_ARM64_VHE is not set
 CONFIG_RANDOMIZE_BASE=y
 # CONFIG_EFI is not set
-CONFIG_BUILD_ARM64_APPENDED_DTB_IMAGE=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_COMPAT=y
-CONFIG_PM_AUTOSLEEP=y
 CONFIG_PM_WAKELOCKS=y
 CONFIG_PM_WAKELOCKS_LIMIT=0
 # CONFIG_PM_WAKELOCKS_GC is not set
@@ -95,6 +93,7 @@
 CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_XFRM_USER=y
+CONFIG_XFRM_INTERFACE=y
 CONFIG_XFRM_STATISTICS=y
 CONFIG_NET_KEY=y
 CONFIG_INET=y
@@ -277,6 +276,7 @@
 CONFIG_DM_UEVENT=y
 CONFIG_DM_VERITY=y
 CONFIG_DM_VERITY_FEC=y
+CONFIG_DM_BOW=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=y
 CONFIG_DUMMY=y
@@ -296,6 +296,7 @@
 CONFIG_PPPOPNS=y
 CONFIG_PPP_ASYNC=y
 CONFIG_PPP_SYNC_TTY=y
+CONFIG_USB_RTL8152=y
 CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
 CONFIG_WCNSS_MEM_PRE_ALLOC=y
diff --git a/arch/arm64/configs/sdm670_defconfig b/arch/arm64/configs/sdm670_defconfig
index 1558f6a..1eea891 100755
--- a/arch/arm64/configs/sdm670_defconfig
+++ b/arch/arm64/configs/sdm670_defconfig
@@ -39,7 +39,6 @@
 # CONFIG_RD_LZ4 is not set
 CONFIG_KALLSYMS_ALL=y
 CONFIG_BPF_SYSCALL=y
-# CONFIG_MEMBARRIER is not set
 CONFIG_EMBEDDED=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_PROFILING=y
@@ -77,12 +76,11 @@
 CONFIG_SWP_EMULATION=y
 CONFIG_CP15_BARRIER_EMULATION=y
 CONFIG_SETEND_EMULATION=y
+CONFIG_ARM64_SW_TTBR0_PAN=y
 # CONFIG_ARM64_VHE is not set
 CONFIG_RANDOMIZE_BASE=y
-CONFIG_BUILD_ARM64_APPENDED_DTB_IMAGE=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_COMPAT=y
-CONFIG_PM_AUTOSLEEP=y
 CONFIG_PM_WAKELOCKS=y
 CONFIG_PM_WAKELOCKS_LIMIT=0
 # CONFIG_PM_WAKELOCKS_GC is not set
@@ -100,6 +98,7 @@
 CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_XFRM_USER=y
+CONFIG_XFRM_INTERFACE=y
 CONFIG_XFRM_STATISTICS=y
 CONFIG_NET_KEY=y
 CONFIG_INET=y
@@ -285,6 +284,7 @@
 CONFIG_DM_UEVENT=y
 CONFIG_DM_VERITY=y
 CONFIG_DM_VERITY_FEC=y
+CONFIG_DM_BOW=y
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=y
 CONFIG_DUMMY=y
@@ -302,6 +302,7 @@
 CONFIG_PPPOPNS=y
 CONFIG_PPP_ASYNC=y
 CONFIG_PPP_SYNC_TTY=y
+CONFIG_USB_RTL8152=y
 CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
 CONFIG_WCNSS_MEM_PRE_ALLOC=y
diff --git a/arch/arm64/configs/sdm845-perf_defconfig b/arch/arm64/configs/sdm845-perf_defconfig
index 9e0c7a8..4529bfb 100755
--- a/arch/arm64/configs/sdm845-perf_defconfig
+++ b/arch/arm64/configs/sdm845-perf_defconfig
@@ -419,6 +419,7 @@
 CONFIG_USB_EHCI_HCD_PLATFORM=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_ACM=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC3=y
 CONFIG_USB_DWC3_MSM=y
diff --git a/arch/arm64/configs/sdm845_defconfig b/arch/arm64/configs/sdm845_defconfig
index 99b464a..c063564 100755
--- a/arch/arm64/configs/sdm845_defconfig
+++ b/arch/arm64/configs/sdm845_defconfig
@@ -423,6 +423,7 @@
 CONFIG_USB_EHCI_HCD_PLATFORM=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_ACM=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC3=y
 CONFIG_USB_DWC3_MSM=y
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 01d5f5d..6107c03 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -70,12 +70,6 @@
 #include <linux/pid_namespace.h>
 #include <linux/security.h>
 #include <linux/spinlock.h>
-
-#ifdef CONFIG_ANDROID_BINDER_IPC_32BIT
-#define BINDER_IPC_32BIT 1
-#endif
-
-#include <uapi/linux/android/binder.h>
 #include "binder_alloc.h"
 #include "binder_trace.h"
 
diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
index b60d161..8db0962 100644
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -22,6 +22,11 @@
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
 #include <linux/list_lru.h>
+
+#ifdef CONFIG_ANDROID_BINDER_IPC_32BIT
+#define BINDER_IPC_32BIT 1
+#endif
+
 #include <uapi/linux/android/binder.h>
 
 extern struct list_lru binder_alloc_lru;
diff --git a/drivers/char/diag/diagfwd_socket.c b/drivers/char/diag/diagfwd_socket.c
index 401dbb0..d7d7366 100644
--- a/drivers/char/diag/diagfwd_socket.c
+++ b/drivers/char/diag/diagfwd_socket.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -496,7 +496,8 @@ static void __socket_close_channel(struct diag_socket_info *info)
 	if (!atomic_read(&info->opened))
 		return;
 
-	if (bootup_req[info->peripheral] == PEPIPHERAL_SSR_UP) {
+	if ((bootup_req[info->peripheral] == PEPIPHERAL_SSR_UP) &&
+		(info->port_type == PORT_TYPE_SERVER)) {
 		DIAG_LOG(DIAG_DEBUG_PERIPHERALS,
 		"diag: %s is up, stopping cleanup: bootup_req = %d\n",
 		info->name, (int)bootup_req[info->peripheral]);
diff --git a/drivers/clk/msm/mdss/mdss-dsi-pll-12nm-util.c b/drivers/clk/msm/mdss/mdss-dsi-pll-12nm-util.c
index e502826..1baf534 100644
--- a/drivers/clk/msm/mdss/mdss-dsi-pll-12nm-util.c
+++ b/drivers/clk/msm/mdss/mdss-dsi-pll-12nm-util.c
@@ -900,7 +900,7 @@ int pll_vco_prepare_12nm(struct clk *c)
 		rc = c->ops->set_rate(c, pll->vco_cached_rate);
 		if (rc) {
 			pr_err("index=%d vco_set_rate failed. rc=%d\n",
-					rc, pll->index);
+					pll->index, rc);
 			goto error;
 		}
 	}
diff --git a/drivers/hwmon/qpnp-adc-voltage.c b/drivers/hwmon/qpnp-adc-voltage.c
index 35d33de..086e706 100644
--- a/drivers/hwmon/qpnp-adc-voltage.c
+++ b/drivers/hwmon/qpnp-adc-voltage.c
@@ -107,8 +107,8 @@
 #define QPNP_VADC_CONV_TIMEOUT_ERR				2
 #define QPNP_VADC_CONV_TIME_MIN					1000
 #define QPNP_VADC_CONV_TIME_MAX					1100
-#define QPNP_ADC_COMPLETION_TIMEOUT				HZ
-#define QPNP_VADC_ERR_COUNT					20
+#define QPNP_ADC_COMPLETION_TIMEOUT		msecs_to_jiffies(100)
+#define QPNP_VADC_ERR_COUNT					150
 #define QPNP_OP_MODE_SHIFT					3
 
 #define QPNP_VADC_THR_LSB_MASK(val)				(val & 0xff)
@@ -161,7 +161,8 @@
  */
 #define QPNP_VADC_HC1_CONV_TIME_MIN_US				213
 #define QPNP_VADC_HC1_CONV_TIME_MAX_US				214
-#define QPNP_VADC_HC1_ERR_COUNT					1600
+#define QPNP_VADC_HC1_ERR_COUNT_POLL				705
+#define QPNP_VADC_HC1_ERR_COUNT					235
 
 #define QPNP_VADC_CAL_DELAY_CTL_1					0x3744
 #define QPNP_VADC_CAL_DELAY_MEAS_SLOW					0x73
@@ -363,11 +364,17 @@ static int32_t qpnp_vadc_status_debug(struct qpnp_vadc_chip *vadc)
 	return 0;
 }
 
-static int qpnp_vadc_hc_check_conversion_status(struct qpnp_vadc_chip *vadc)
+static int qpnp_vadc_hc_check_conversion_status(struct qpnp_vadc_chip *vadc,
+		bool poll)
 {
-	int rc = 0, count = 0;
+	int rc = 0, count = 0, retry;
 	u8 status1 = 0;
 
+	if (poll)
+		retry = QPNP_VADC_HC1_ERR_COUNT_POLL;
+	else
+		retry = QPNP_VADC_HC1_ERR_COUNT;
+
 	while (status1 != QPNP_VADC_STATUS1_EOC) {
 		rc = qpnp_vadc_read_reg(vadc, QPNP_VADC_STATUS1, &status1, 1);
 		if (rc < 0)
@@ -378,7 +385,7 @@ static int qpnp_vadc_hc_check_conversion_status(struct qpnp_vadc_chip *vadc)
 		usleep_range(QPNP_VADC_HC1_CONV_TIME_MIN_US,
 				QPNP_VADC_HC1_CONV_TIME_MAX_US);
 		count++;
-		if (count > QPNP_VADC_HC1_ERR_COUNT) {
+		if (count > retry) {
 			pr_err("retry error exceeded\n");
 			rc = qpnp_vadc_status_debug(vadc);
 			if (rc < 0)
@@ -429,7 +436,7 @@ static int qpnp_vadc_wait_for_eoc(struct qpnp_vadc_chip *vadc)
 	int ret;
 
 	if (vadc->vadc_poll_eoc) {
-		ret = qpnp_vadc_hc_check_conversion_status(vadc);
+		ret = qpnp_vadc_hc_check_conversion_status(vadc, true);
 		if (ret < 0) {
 			pr_err("polling mode conversion failed\n");
 			return ret;
@@ -439,7 +446,7 @@ static int qpnp_vadc_wait_for_eoc(struct qpnp_vadc_chip *vadc)
 			&vadc->adc->adc_rslt_completion,
 			QPNP_ADC_COMPLETION_TIMEOUT);
 		if (!ret) {
-			ret = qpnp_vadc_hc_check_conversion_status(vadc);
+			ret = qpnp_vadc_hc_check_conversion_status(vadc, false);
 			if (ret < 0) {
 				pr_err("interrupt mode conversion failed\n");
 				return ret;
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
index 0228770..6797ba4 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
@@ -439,8 +439,9 @@ static int32_t cam_eeprom_parse_memory_map(
 	else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT)
 		validate_size = sizeof(struct cam_cmd_unconditional_wait);
 
-	if (remain_buf_len < validate_size || *num_map >=
-		(MSM_EEPROM_MEMORY_MAP_MAX_SIZE * MSM_EEPROM_MAX_MEM_MAP_CNT)) {
+	if (remain_buf_len < validate_size ||
+	    *num_map >= (MSM_EEPROM_MAX_MEM_MAP_CNT *
+		MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) {
 		CAM_ERR(CAM_EEPROM, "not enough buffer");
 		return -EINVAL;
 	}
@@ -449,10 +450,10 @@ static int32_t cam_eeprom_parse_memory_map(
 		i2c_random_wr = (struct cam_cmd_i2c_random_wr *)cmd_buf;
 
 		if (i2c_random_wr->header.count == 0 ||
-			i2c_random_wr->header.count >=
-			(MSM_EEPROM_MEMORY_MAP_MAX_SIZE *
-			MSM_EEPROM_MAX_MEM_MAP_CNT) ||
-		    (size_t)*num_map > U16_MAX - i2c_random_wr->header.count) {
+		    i2c_random_wr->header.count >= MSM_EEPROM_MAX_MEM_MAP_CNT ||
+		    (size_t)*num_map >= ((MSM_EEPROM_MAX_MEM_MAP_CNT *
+				MSM_EEPROM_MEMORY_MAP_MAX_SIZE) -
+				i2c_random_wr->header.count)) {
 			CAM_ERR(CAM_EEPROM, "OOB Error");
 			return -EINVAL;
 		}
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util_32.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util_32.c
index b5a6f44..c237ad2 100644
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util_32.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util_32.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -1215,7 +1215,7 @@ static void msm_isp_update_rdi_output_count(
 
 	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
 		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])
-			> MAX_NUM_STREAM)
+			>= MAX_NUM_STREAM)
 			return;
 		stream_info =
 			&axi_data->stream_info[
diff --git a/drivers/media/platform/msm/camera_v3/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c b/drivers/media/platform/msm/camera_v3/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
index 2b764d1..cfc474a 100644
--- a/drivers/media/platform/msm/camera_v3/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
+++ b/drivers/media/platform/msm/camera_v3/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
@@ -4686,6 +4686,13 @@ static int cam_icp_get_acquire_info(struct cam_icp_hw_mgr *hw_mgr,
 		return -EFAULT;
 	}
 
+	/* To make sure num_out_res is same as allocated */
+	if (ctx_data->icp_dev_acquire_info->num_out_res !=
+		icp_dev_acquire_info.num_out_res) {
+		CAM_ERR(CAM_ICP, "num_out_res got changed");
+		return -EFAULT;
+	}
+
 	CAM_DBG(CAM_ICP, "%x %x %x %x %x %x %x",
 		ctx_data->icp_dev_acquire_info->dev_type,
 		ctx_data->icp_dev_acquire_info->in_res.format,
diff --git a/drivers/media/platform/msm/camera_v3/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/media/platform/msm/camera_v3/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
index 8f59ca3..06d6bd4 100644
--- a/drivers/media/platform/msm/camera_v3/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
+++ b/drivers/media/platform/msm/camera_v3/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
@@ -439,17 +439,32 @@ static int32_t cam_eeprom_parse_memory_map(
 	else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT)
 		validate_size = sizeof(struct cam_cmd_unconditional_wait);
 
-	if (remain_buf_len < validate_size) {
+	if (remain_buf_len < validate_size ||
+	    *num_map >= (MSM_EEPROM_MAX_MEM_MAP_CNT *
+		MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) {
 		CAM_ERR(CAM_EEPROM, "not enough buffer");
 		return -EINVAL;
 	}
 	switch (cmm_hdr->cmd_type) {
 	case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR:
 		i2c_random_wr = (struct cam_cmd_i2c_random_wr *)cmd_buf;
+
+		if (i2c_random_wr->header.count == 0 ||
+		    i2c_random_wr->header.count >= MSM_EEPROM_MAX_MEM_MAP_CNT ||
+		    (size_t)*num_map >= ((MSM_EEPROM_MAX_MEM_MAP_CNT *
+				MSM_EEPROM_MEMORY_MAP_MAX_SIZE) -
+				i2c_random_wr->header.count)) {
+			CAM_ERR(CAM_EEPROM, "OOB Error");
+			return -EINVAL;
+		}
 		cmd_length_in_bytes   = sizeof(struct cam_cmd_i2c_random_wr) +
 			((i2c_random_wr->header.count - 1) *
 			sizeof(struct i2c_random_wr_payload));
 
+		if (cmd_length_in_bytes > remain_buf_len) {
+			CAM_ERR(CAM_EEPROM, "Not enough buffer remaining");
+			return -EINVAL;
+		}
 		for (cnt = 0; cnt < (i2c_random_wr->header.count);
 			cnt++) {
 			map[*num_map + cnt].page.addr =
@@ -472,6 +487,11 @@ static int32_t cam_eeprom_parse_memory_map(
 		i2c_cont_rd = (struct cam_cmd_i2c_continuous_rd *)cmd_buf;
 		cmd_length_in_bytes = sizeof(struct cam_cmd_i2c_continuous_rd);
 
+		if (i2c_cont_rd->header.count >= U32_MAX - data->num_data) {
+			CAM_ERR(CAM_EEPROM,
+				"int overflow on eeprom memory block");
+			return -EINVAL;
+		}
 		map[*num_map].mem.addr = i2c_cont_rd->reg_addr;
 		map[*num_map].mem.addr_type = i2c_cont_rd->header.addr_type;
 		map[*num_map].mem.data_type = i2c_cont_rd->header.data_type;
diff --git a/drivers/media/platform/msm/vidc/hfi_response_handler.c b/drivers/media/platform/msm/vidc/hfi_response_handler.c
index 1e82d32..bde3110 100644
--- a/drivers/media/platform/msm/vidc/hfi_response_handler.c
+++ b/drivers/media/platform/msm/vidc/hfi_response_handler.c
@@ -103,12 +103,22 @@ static enum msm_vidc_pixel_depth get_hal_pixel_depth(u32 hfi_bit_depth)
 	return MSM_VIDC_BIT_DEPTH_UNSUPPORTED;
 }
 
+static inline int validate_pkt_size(u32 rem_size, u32 msg_size)
+{
+	if (rem_size < msg_size) {
+		dprintk(VIDC_ERR, "%s: bad_pkt_size: %d\n",
+			__func__, rem_size);
+		return false;
+	}
+	return true;
+}
+
 static int hfi_process_sess_evt_seq_changed(u32 device_id,
 		struct hfi_msg_event_notify_packet *pkt,
 		struct msm_vidc_cb_info *info)
 {
 	struct msm_vidc_cb_event event_notify = {0};
-	int num_properties_changed;
+	u32 num_properties_changed;
 	struct hfi_frame_size *frame_sz;
 	struct hfi_profile_level *profile_level;
 	struct hfi_bit_depth *pixel_depth;
@@ -116,17 +126,15 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 	struct hfi_buffer_requirements *buf_req;
 	struct hfi_index_extradata_input_crop_payload *crop_info;
 	struct hfi_dpb_counts *dpb_counts;
-	u32 entropy_mode = 0;
+	u32 rem_size, entropy_mode = 0;
 	u8 *data_ptr;
 	int prop_id;
 	enum msm_vidc_pixel_depth luma_bit_depth, chroma_bit_depth;
 	struct hfi_colour_space *colour_info;
 
-	if (sizeof(struct hfi_msg_event_notify_packet) > pkt->size) {
-		dprintk(VIDC_ERR,
-				"hal_process_session_init_done: bad_pkt_size\n");
+	if (!validate_pkt_size(pkt->size,
+			       sizeof(struct hfi_msg_event_notify_packet)))
 		return -E2BIG;
-	}
 
 	event_notify.device_id = device_id;
 	event_notify.session_id = (void *)(uintptr_t)pkt->session_id;
@@ -147,10 +155,18 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 
 	if (num_properties_changed) {
 		data_ptr = (u8 *) &pkt->rg_ext_event_data[0];
+		rem_size = pkt->size - sizeof(struct
+				hfi_msg_event_notify_packet) + sizeof(u32);
 		do {
+			if (!validate_pkt_size(rem_size, sizeof(u32)))
+				return -E2BIG;
 			prop_id = (int) *((u32 *)data_ptr);
+			rem_size -= sizeof(u32);
 			switch (prop_id) {
 			case HFI_PROPERTY_PARAM_FRAME_SIZE:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_frame_size)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				frame_sz =
 					(struct hfi_frame_size *) data_ptr;
@@ -160,8 +176,12 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 					frame_sz->height, frame_sz->width);
 				data_ptr +=
 					sizeof(struct hfi_frame_size);
+				rem_size -= sizeof(struct hfi_frame_size);
 				break;
 			case HFI_PROPERTY_PARAM_PROFILE_LEVEL_CURRENT:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_profile_level)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				profile_level =
 					(struct hfi_profile_level *) data_ptr;
@@ -172,8 +192,12 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 					profile_level->level);
 				data_ptr +=
 					sizeof(struct hfi_profile_level);
+				rem_size -= sizeof(struct hfi_profile_level);
 				break;
 			case HFI_PROPERTY_PARAM_VDEC_PIXEL_BITDEPTH:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_bit_depth)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				pixel_depth = (struct hfi_bit_depth *) data_ptr;
 				/*
@@ -204,8 +228,12 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 					event_notify.bit_depth, luma_bit_depth,
 					chroma_bit_depth);
 				data_ptr += sizeof(struct hfi_bit_depth);
+				rem_size -= sizeof(struct hfi_bit_depth);
 				break;
 			case HFI_PROPERTY_PARAM_VDEC_PIC_STRUCT:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_pic_struct)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				pic_struct = (struct hfi_pic_struct *) data_ptr;
 				event_notify.pic_struct =
@@ -215,8 +243,12 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 						pic_struct->progressive_only);
 				data_ptr +=
 					sizeof(struct hfi_pic_struct);
+				rem_size -= sizeof(struct hfi_pic_struct);
 				break;
 			case HFI_PROPERTY_PARAM_VDEC_DPB_COUNTS:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_dpb_counts)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				dpb_counts = (struct hfi_dpb_counts *) data_ptr;
 				event_notify.max_dpb_count =
@@ -231,9 +263,13 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 						dpb_counts->max_ref_count,
 						dpb_counts->max_dec_buffering);
 				data_ptr +=
-					sizeof(struct hfi_pic_struct);
+					sizeof(struct hfi_dpb_counts);
+				rem_size -= sizeof(struct hfi_dpb_counts);
 				break;
 			case HFI_PROPERTY_PARAM_VDEC_COLOUR_SPACE:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_colour_space)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				colour_info =
 					(struct hfi_colour_space *) data_ptr;
@@ -244,8 +280,11 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 						colour_info->colour_space);
 				data_ptr +=
 					sizeof(struct hfi_colour_space);
+				rem_size -= sizeof(struct hfi_colour_space);
 				break;
 			case HFI_PROPERTY_CONFIG_VDEC_ENTROPY:
+				if (!validate_pkt_size(rem_size, sizeof(u32)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				entropy_mode = *(u32 *)data_ptr;
 				event_notify.entropy_mode = entropy_mode;
@@ -253,8 +292,12 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 					"Entropy Mode: 0x%x\n", entropy_mode);
 				data_ptr +=
 					sizeof(u32);
+				rem_size -= sizeof(u32);
 				break;
 			case HFI_PROPERTY_CONFIG_BUFFER_REQUIREMENTS:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_buffer_requirements)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				buf_req =
 					(struct hfi_buffer_requirements *)
@@ -266,8 +309,13 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 						event_notify.capture_buf_count);
 				data_ptr +=
 					sizeof(struct hfi_buffer_requirements);
+				rem_size -=
+					sizeof(struct hfi_buffer_requirements);
 				break;
 			case HFI_INDEX_EXTRADATA_INPUT_CROP:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+				     hfi_index_extradata_input_crop_payload)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				crop_info = (struct
 				hfi_index_extradata_input_crop_payload *)
@@ -288,6 +336,8 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 				data_ptr +=
 					sizeof(struct
 					hfi_index_extradata_input_crop_payload);
+				rem_size -= sizeof(struct
+					hfi_index_extradata_input_crop_payload);
 				break;
 			default:
 				dprintk(VIDC_ERR,
@@ -747,7 +797,7 @@ static inline void copy_cap_prop(
 }
 
 static int hfi_fill_codec_info(u8 *data_ptr,
-		struct vidc_hal_sys_init_done *sys_init_done) {
+		struct vidc_hal_sys_init_done *sys_init_done, u32 rem_size) {
 	u32 i;
 	u32 codecs = 0, codec_count = 0, size = 0;
 	struct msm_vidc_capability *capability;
@@ -757,6 +807,9 @@ static int hfi_fill_codec_info(u8 *data_ptr,
 	if (prop_id ==  HFI_PROPERTY_PARAM_CODEC_SUPPORTED) {
 		struct hfi_codec_supported *prop;
 
+		if (!validate_pkt_size(rem_size - sizeof(u32),
+				       sizeof(struct hfi_codec_supported)))
+			return -E2BIG;
 		data_ptr = data_ptr + sizeof(u32);
 		prop = (struct hfi_codec_supported *) data_ptr;
 		sys_init_done->dec_codec_supported =
@@ -764,6 +817,8 @@ static int hfi_fill_codec_info(u8 *data_ptr,
 		sys_init_done->enc_codec_supported =
 			prop->encoder_codec_supported;
 		size = sizeof(struct hfi_codec_supported) + sizeof(u32);
+		rem_size -=
+			sizeof(struct hfi_codec_supported) + sizeof(u32);
 	} else {
 		dprintk(VIDC_WARN,
 			"%s: prop_id %#x, expected codec_supported property\n",
@@ -804,14 +859,22 @@ static int hfi_fill_codec_info(u8 *data_ptr,
 	}
 	sys_init_done->codec_count = codec_count;
 
+	if (!validate_pkt_size(rem_size, sizeof(u32)))
+		return -E2BIG;
 	prop_id = *((u32 *)(orig_data_ptr + size));
 	if (prop_id == HFI_PROPERTY_PARAM_MAX_SESSIONS_SUPPORTED) {
-		struct hfi_max_sessions_supported *prop =
-			(struct hfi_max_sessions_supported *)
+		struct hfi_max_sessions_supported *prop;
+
+		if (!validate_pkt_size(rem_size - sizeof(u32), sizeof(struct
+				hfi_max_sessions_supported)))
+			return -E2BIG;
+		prop = (struct hfi_max_sessions_supported *)
 			(orig_data_ptr + size + sizeof(u32));
 
 		sys_init_done->max_sessions_supported = prop->max_sessions;
 		size += sizeof(struct hfi_max_sessions_supported) + sizeof(u32);
+		rem_size -=
+			sizeof(struct hfi_max_sessions_supported) + sizeof(u32);
 		dprintk(VIDC_DBG, "max_sessions_supported %d\n",
 				prop->max_sessions);
 	}
@@ -1167,7 +1230,8 @@ enum vidc_status hfi_process_sys_init_done_prop_read(
 	struct vidc_hal_sys_init_done *sys_init_done)
 {
 	enum vidc_status status = VIDC_ERR_NONE;
-	u32 rem_bytes, bytes_read, num_properties;
+	int bytes_read;
+	u32 rem_bytes, num_properties;
 	u8 *data_ptr;
 
 	if (!pkt || !sys_init_done) {
@@ -1175,6 +1239,11 @@ enum vidc_status hfi_process_sys_init_done_prop_read(
 			"hfi_msg_sys_init_done: Invalid input\n");
 		return VIDC_ERR_FAIL;
 	}
+	if (pkt->size < sizeof(struct hfi_msg_sys_init_done_packet)) {
+		dprintk(VIDC_ERR, "%s: bad_packet_size: %d\n",
+			__func__, pkt->size);
+		return VIDC_ERR_FAIL;
+	}
 
 	rem_bytes = pkt->size - sizeof(struct
 			hfi_msg_sys_init_done_packet) + sizeof(u32);
@@ -1202,7 +1271,9 @@ enum vidc_status hfi_process_sys_init_done_prop_read(
 			"Venus didn't set any properties in SYS_INIT_DONE");
 		return status;
 	}
-	bytes_read = hfi_fill_codec_info(data_ptr, sys_init_done);
+	bytes_read = hfi_fill_codec_info(data_ptr, sys_init_done, rem_bytes);
+	if (bytes_read < 0)
+		return VIDC_ERR_FAIL;
 	data_ptr += bytes_read;
 	rem_bytes -= bytes_read;
 	num_properties--;
diff --git a/drivers/media/platform/msm/vidc_3x/hfi_response_handler.c b/drivers/media/platform/msm/vidc_3x/hfi_response_handler.c
index 9f85f5d..5dfb442 100644
--- a/drivers/media/platform/msm/vidc_3x/hfi_response_handler.c
+++ b/drivers/media/platform/msm/vidc_3x/hfi_response_handler.c
@@ -100,12 +100,22 @@ static enum msm_vidc_pixel_depth get_hal_pixel_depth(u32 hfi_bit_depth)
 	return MSM_VIDC_BIT_DEPTH_UNSUPPORTED;
 }
 
+static inline int validate_pkt_size(u32 rem_size, u32 msg_size)
+{
+	if (rem_size < msg_size) {
+		dprintk(VIDC_ERR, "%s: bad_pkt_size: %d\n",
+			__func__, rem_size);
+		return false;
+	}
+	return true;
+}
+
 static int hfi_process_sess_evt_seq_changed(u32 device_id,
 		struct hfi_msg_event_notify_packet *pkt,
 		struct msm_vidc_cb_info *info)
 {
 	struct msm_vidc_cb_event event_notify = {0};
-	int num_properties_changed;
+	u32 num_properties_changed, rem_size;
 	struct hfi_frame_size *frame_sz;
 	struct hfi_profile_level *profile_level;
 	struct hfi_bit_depth *pixel_depth;
@@ -114,15 +124,11 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 	int prop_id;
 	enum msm_vidc_pixel_depth luma_bit_depth, chroma_bit_depth;
 	struct hfi_colour_space *colour_info;
-
 	 /* Initialize pic_struct to unknown as default */
 	event_notify.pic_struct = MSM_VIDC_PIC_STRUCT_UNKNOWN;
-
-	if (sizeof(struct hfi_msg_event_notify_packet) > pkt->size) {
-		dprintk(VIDC_ERR,
-				"hal_process_session_init_done: bad_pkt_size\n");
+	if (!validate_pkt_size(pkt->size,
+			       sizeof(struct hfi_msg_event_notify_packet)))
 		return -E2BIG;
-	}
 
 	event_notify.device_id = device_id;
 	event_notify.session_id = (void *)(uintptr_t)pkt->session_id;
@@ -143,10 +149,18 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 
 	if (num_properties_changed) {
 		data_ptr = (u8 *) &pkt->rg_ext_event_data[0];
+		rem_size = pkt->size - sizeof(struct
+				hfi_msg_event_notify_packet) + sizeof(u32);
 		do {
+			if (!validate_pkt_size(rem_size, sizeof(u32)))
+				return -E2BIG;
 			prop_id = (int) *((u32 *)data_ptr);
+			rem_size -= sizeof(u32);
 			switch (prop_id) {
 			case HFI_PROPERTY_PARAM_FRAME_SIZE:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_frame_size)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				frame_sz =
 					(struct hfi_frame_size *) data_ptr;
@@ -156,8 +170,12 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 					frame_sz->height, frame_sz->width);
 				data_ptr +=
 					sizeof(struct hfi_frame_size);
+				rem_size -= sizeof(struct hfi_frame_size);
 				break;
 			case HFI_PROPERTY_PARAM_PROFILE_LEVEL_CURRENT:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_profile_level)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				profile_level =
 					(struct hfi_profile_level *) data_ptr;
@@ -166,8 +184,12 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 					profile_level->level);
 				data_ptr +=
 					sizeof(struct hfi_profile_level);
+				rem_size -= sizeof(struct hfi_profile_level);
 				break;
 			case HFI_PROPERTY_PARAM_VDEC_PIXEL_BITDEPTH:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_bit_depth)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				pixel_depth = (struct hfi_bit_depth *) data_ptr;
 				/*
@@ -198,8 +220,12 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 					event_notify.bit_depth, luma_bit_depth,
 					chroma_bit_depth);
 				data_ptr += sizeof(struct hfi_bit_depth);
+				rem_size -= sizeof(struct hfi_bit_depth);
 				break;
 			case HFI_PROPERTY_PARAM_VDEC_PIC_STRUCT:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_pic_struct)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				pic_struct = (struct hfi_pic_struct *) data_ptr;
 				event_notify.pic_struct =
@@ -209,8 +235,12 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 						pic_struct->progressive_only);
 				data_ptr +=
 					sizeof(struct hfi_pic_struct);
+				rem_size -= sizeof(struct hfi_pic_struct);
 				break;
 			case HFI_PROPERTY_PARAM_VDEC_COLOUR_SPACE:
+				if (!validate_pkt_size(rem_size, sizeof(struct
+					hfi_colour_space)))
+					return -E2BIG;
 				data_ptr = data_ptr + sizeof(u32);
 				colour_info =
 					(struct hfi_colour_space *) data_ptr;
@@ -221,6 +251,8 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id,
 						colour_info->colour_space);
 				data_ptr +=
 					sizeof(struct hfi_colour_space);
+				rem_size -= sizeof(struct hfi_colour_space);
+				break;
 				break;
 			default:
 				dprintk(VIDC_ERR,
@@ -579,7 +611,7 @@ static inline void copy_cap_prop(
 }
 
 static int hfi_fill_codec_info(u8 *data_ptr,
-		struct vidc_hal_sys_init_done *sys_init_done) {
+		struct vidc_hal_sys_init_done *sys_init_done, u32 rem_size) {
 	u32 i;
 	u32 codecs = 0, codec_count = 0, size = 0;
 	struct msm_vidc_capability *capability;
@@ -589,6 +621,9 @@ static int hfi_fill_codec_info(u8 *data_ptr,
 	if (prop_id ==  HFI_PROPERTY_PARAM_CODEC_SUPPORTED) {
 		struct hfi_codec_supported *prop;
 
+		if (!validate_pkt_size(rem_size - sizeof(u32),
+				       sizeof(struct hfi_codec_supported)))
+			return -E2BIG;
 		data_ptr = data_ptr + sizeof(u32);
 		prop = (struct hfi_codec_supported *) data_ptr;
 		sys_init_done->dec_codec_supported =
@@ -596,6 +631,8 @@ static int hfi_fill_codec_info(u8 *data_ptr,
 		sys_init_done->enc_codec_supported =
 			prop->encoder_codec_supported;
 		size = sizeof(struct hfi_codec_supported) + sizeof(u32);
+		rem_size -=
+			sizeof(struct hfi_codec_supported) + sizeof(u32);
 	} else {
 		dprintk(VIDC_WARN,
 			"%s: prop_id %#x, expected codec_supported property\n",
@@ -636,14 +673,22 @@ static int hfi_fill_codec_info(u8 *data_ptr,
 	}
 	sys_init_done->codec_count = codec_count;
 
+	if (!validate_pkt_size(rem_size, sizeof(u32)))
+		return -E2BIG;
 	prop_id = *((u32 *)(orig_data_ptr + size));
 	if (prop_id == HFI_PROPERTY_PARAM_MAX_SESSIONS_SUPPORTED) {
-		struct hfi_max_sessions_supported *prop =
-			(struct hfi_max_sessions_supported *)
+		struct hfi_max_sessions_supported *prop;
+
+		if (!validate_pkt_size(rem_size - sizeof(u32), sizeof(struct
+				hfi_max_sessions_supported)))
+			return -E2BIG;
+		prop = (struct hfi_max_sessions_supported *)
 			(orig_data_ptr + size + sizeof(u32));
 
 		sys_init_done->max_sessions_supported = prop->max_sessions;
 		size += sizeof(struct hfi_max_sessions_supported) + sizeof(u32);
+		rem_size -=
+			sizeof(struct hfi_max_sessions_supported) + sizeof(u32);
 		dprintk(VIDC_DBG, "max_sessions_supported %d\n",
 				prop->max_sessions);
 	}
@@ -1003,7 +1048,8 @@ enum vidc_status hfi_process_sys_init_done_prop_read(
 	struct vidc_hal_sys_init_done *sys_init_done)
 {
 	enum vidc_status status = VIDC_ERR_NONE;
-	u32 rem_bytes, bytes_read, num_properties;
+	int bytes_read;
+	u32 rem_bytes, num_properties;
 	u8 *data_ptr;
 	u32 codecs = 0, domain = 0;
 
@@ -1012,6 +1058,11 @@ enum vidc_status hfi_process_sys_init_done_prop_read(
 			"hfi_msg_sys_init_done: Invalid input\n");
 		return VIDC_ERR_FAIL;
 	}
+	if (pkt->size < sizeof(struct hfi_msg_sys_init_done_packet)) {
+		dprintk(VIDC_ERR, "%s: bad packet size: %d\n",
+			__func__, pkt->size);
+		return VIDC_ERR_FAIL;
+	}
 
 	rem_bytes = pkt->size - sizeof(struct
 			hfi_msg_sys_init_done_packet) + sizeof(u32);
@@ -1039,7 +1090,9 @@ enum vidc_status hfi_process_sys_init_done_prop_read(
 			"Venus didn't set any properties in SYS_INIT_DONE");
 		return status;
 	}
-	bytes_read = hfi_fill_codec_info(data_ptr, sys_init_done);
+	bytes_read = hfi_fill_codec_info(data_ptr, sys_init_done, rem_bytes);
+	if (bytes_read < 0)
+		return VIDC_ERR_FAIL;
 	data_ptr += bytes_read;
 	rem_bytes -= bytes_read;
 	num_properties--;
diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c
index 72e5031..1fcafc1 100644
--- a/drivers/misc/qseecom.c
+++ b/drivers/misc/qseecom.c
@@ -535,7 +535,7 @@ static int qseecom_scm_call2(uint32_t svc_id, uint32_t tz_cmd_id,
 			smc_id = TZ_OS_APP_SHUTDOWN_ID;
 			desc.arginfo = TZ_OS_APP_SHUTDOWN_ID_PARAM_ID;
 			desc.args[0] = req->app_id;
-			ret = __qseecom_scm_call2_locked(smc_id, &desc);
+			ret = scm_call2(smc_id, &desc);
 			break;
 		}
 		case QSEOS_APP_LOOKUP_COMMAND: {
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 531536a..cb46d96 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1660,6 +1660,19 @@ static const struct driver_info ax88178a_info = {
 	.tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info ax88178b_info = {
+	.description = "ASIX AX88178B USB 2.0 Gigabit Ethernet",
+	.bind = ax88179_bind,
+	.unbind = ax88179_unbind,
+	.status = ax88179_status,
+	.link_reset = ax88179_link_reset,
+	.reset = ax88179_reset,
+	.stop = ax88179_stop,
+	.flags = FLAG_ETHER | FLAG_FRAMING_AX,
+	.rx_fixup = ax88179_rx_fixup,
+	.tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct driver_info cypress_GX3_info = {
 	.description = "Cypress GX3 SuperSpeed to Gigabit Ethernet Controller",
 	.bind = ax88179_bind,
@@ -1735,6 +1748,10 @@ static const struct usb_device_id products[] = {
 	USB_DEVICE(0x0b95, 0x178a),
 	.driver_info = (unsigned long)&ax88178a_info,
 }, {
+	/* ASIX AX88178A 10/100/1000 */
+	USB_DEVICE(0x0b95, 0x178b),
+	.driver_info = (unsigned long)&ax88178b_info,
+}, {
 	/* Cypress GX3 SuperSpeed to Gigabit Ethernet Bridge Controller */
 	USB_DEVICE(0x04b4, 0x3610),
 	.driver_info = (unsigned long)&cypress_GX3_info,
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa.c b/drivers/platform/msm/ipa/ipa_v3/ipa.c
index f8fdefd..6de07dc 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa.c
@@ -5130,6 +5130,7 @@ static int ipa3_pre_init(const struct ipa3_plat_drv_res *resource_p,
 	ipa3_ctx->use_ipa_teth_bridge = resource_p->use_ipa_teth_bridge;
 	ipa3_ctx->modem_cfg_emb_pipe_flt = resource_p->modem_cfg_emb_pipe_flt;
 	ipa3_ctx->ipa_wdi2 = resource_p->ipa_wdi2;
+	ipa3_ctx->ipa_config_is_auto = resource_p->ipa_config_is_auto;
 	ipa3_ctx->use_64_bit_dma_mask = resource_p->use_64_bit_dma_mask;
 	ipa3_ctx->wan_rx_ring_size = resource_p->wan_rx_ring_size;
 	ipa3_ctx->lan_rx_ring_size = resource_p->lan_rx_ring_size;
@@ -5701,6 +5702,7 @@ static int get_ipa_dts_configuration(struct platform_device *pdev,
 	ipa_drv_res->ipa3_hw_mode = 0;
 	ipa_drv_res->modem_cfg_emb_pipe_flt = false;
 	ipa_drv_res->ipa_wdi2 = false;
+	ipa_drv_res->ipa_config_is_auto = false;
 	ipa_drv_res->ipa_mhi_dynamic_config = false;
 	ipa_drv_res->use_64_bit_dma_mask = false;
 	ipa_drv_res->use_bw_vote = false;
@@ -5785,6 +5787,13 @@ static int get_ipa_dts_configuration(struct platform_device *pdev,
 			ipa_drv_res->ipa_wdi2
 			? "True" : "False");
 
+	ipa_drv_res->ipa_config_is_auto =
+			of_property_read_bool(pdev->dev.of_node,
+			"qcom,ipa-config-is-auto");
+	IPADBG(": ipa-config-is-auto = %s\n",
+			ipa_drv_res->ipa_config_is_auto
+			? "True" : "False");
+
 	ipa_drv_res->use_64_bit_dma_mask =
 			of_property_read_bool(pdev->dev.of_node,
 			"qcom,use-64-bit-dma-mask");
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h
index d145a4b..2caa54e 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h
@@ -1446,6 +1446,7 @@ struct ipa3_char_device_context {
  * @logbuf: ipc log buffer for high priority messages
  * @logbuf_low: ipc log buffer for low priority messages
  * @ipa_wdi2: using wdi-2.0
+ * @ipa_config_is_auto: is this AUTO use case
  * @use_64_bit_dma_mask: using 64bits dma mask
  * @ipa_bus_hdl: msm driver handle for the data path bus
  * @ctrl: holds the core specific operations based on
@@ -1547,6 +1548,7 @@ struct ipa3_context {
 	bool use_ipa_teth_bridge;
 	bool modem_cfg_emb_pipe_flt;
 	bool ipa_wdi2;
+	bool ipa_config_is_auto;
 	bool use_64_bit_dma_mask;
 	/* featurize if memory footprint becomes a concern */
 	struct ipa3_stats stats;
@@ -1628,6 +1630,7 @@ struct ipa3_plat_drv_res {
 	u32 ee;
 	bool modem_cfg_emb_pipe_flt;
 	bool ipa_wdi2;
+	bool ipa_config_is_auto;
 	bool use_64_bit_dma_mask;
 	bool use_bw_vote;
 	u32 wan_rx_ring_size;
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c
index 3e6b365..03b0c72 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c
@@ -144,6 +144,7 @@
 #define IPA_v4_0_GROUP_UL_DL		(1)
 #define IPA_v4_0_MHI_GROUP_DDR		(1)
 #define IPA_v4_0_MHI_GROUP_DMA		(2)
+#define IPA_v4_0_GROUP_CV2X			(2)
 #define IPA_v4_0_GROUP_UC_RX_Q		(3)
 #define IPA_v4_0_SRC_GROUP_MAX		(4)
 #define IPA_v4_0_DST_GROUP_MAX		(4)
@@ -216,6 +217,8 @@ enum ipa_ver {
 	IPA_3_5_1,
 	IPA_4_0,
 	IPA_4_0_MHI,
+	IPA_4_0_AUTO,
+	IPA_4_0_AUTO_MHI,
 	IPA_VER_MAX,
 };
 
@@ -305,6 +308,32 @@ static const struct rsrc_min_max ipa3_rsrc_src_grp_config
 		[IPA_v4_0_RSRC_GRP_TYPE_SRC_ACK_ENTRIES] = {
 		{14, 14}, {14, 14}, {14, 14}, {0, 0}, {0, 0}, {0, 0} },
 	},
+	[IPA_4_0_AUTO] = {
+		/*not-used  UL_DL    CV2X  not-used, other are invalid */
+		[IPA_v4_0_RSRC_GRP_TYPE_SRC_PKT_CONTEXTS] = {
+		{0, 0}, {1, 255}, {1, 1}, {0, 0}, {0, 0}, {0, 0} },
+		[IPA_v4_0_RSRC_GRP_TYPE_SRS_DESCRIPTOR_LISTS] = {
+		{0, 0}, {10, 10}, {8, 8}, {0, 0}, {0, 0}, {0, 0} },
+		[IPA_v4_0_RSRC_GRP_TYPE_SRC_DESCRIPTOR_BUFF] = {
+		{0, 0}, {14, 14}, {8, 8}, {0, 0}, {0, 0}, {0, 0} },
+		[IPA_v4_0_RSRC_GRP_TYPE_SRC_HPS_DMARS] = {
+		{0, 255}, {0, 255}, {0, 255}, {0, 255},  {0, 0}, {0, 0} },
+		[IPA_v4_0_RSRC_GRP_TYPE_SRC_ACK_ENTRIES] = {
+		{0, 0}, {20, 20}, {14, 14}, {0, 0}, {0, 0}, {0, 0} },
+	},
+	[IPA_4_0_AUTO_MHI] = {
+		/* PCIE  DDR   DMA/CV2X not used, other are invalid */
+		[IPA_v4_0_RSRC_GRP_TYPE_SRC_PKT_CONTEXTS] = {
+		{4, 4}, {5, 5}, {1, 1}, {0, 0}, {0, 0}, {0, 0} },
+		[IPA_v4_0_RSRC_GRP_TYPE_SRS_DESCRIPTOR_LISTS] = {
+		{10, 10}, {10, 10}, {8, 8}, {0, 0}, {0, 0}, {0, 0} },
+		[IPA_v4_0_RSRC_GRP_TYPE_SRC_DESCRIPTOR_BUFF] = {
+		{12, 12}, {12, 12}, {8, 8}, {0, 0}, {0, 0}, {0, 0} },
+		[IPA_v4_0_RSRC_GRP_TYPE_SRC_HPS_DMARS] = {
+		{0, 255}, {0, 255}, {0, 255}, {0, 255},  {0, 0}, {0, 0} },
+		[IPA_v4_0_RSRC_GRP_TYPE_SRC_ACK_ENTRIES] = {
+		{14, 14}, {14, 14}, {14, 14}, {0, 0}, {0, 0}, {0, 0} },
+	},
 };
 
 static const struct rsrc_min_max ipa3_rsrc_dst_grp_config
@@ -353,6 +382,20 @@ static const struct rsrc_min_max ipa3_rsrc_dst_grp_config
 		[IPA_v4_0_RSRC_GRP_TYPE_DST_DPS_DMARS] = {
 		{2, 255}, {1, 255}, {1, 2}, {0, 2}, {0, 0}, {0, 0} },
 	},
+	[IPA_4_0_AUTO] = {
+		/*PCIE UL/DL/DPL DMA/CV2X, other are invalid */
+		[IPA_v4_0_RSRC_GRP_TYPE_DST_DATA_SECTORS] = {
+		{4, 4}, {4, 4}, {3, 3}, {2, 2}, {0, 0}, {0, 0} },
+		[IPA_v4_0_RSRC_GRP_TYPE_DST_DPS_DMARS] = {
+		{2, 255}, {1, 255}, {1, 2}, {0, 2}, {0, 0}, {0, 0} },
+	},
+	[IPA_4_0_AUTO_MHI] = {
+		/*PCIE    DDR  DMA/CV2X, other are invalid */
+		[IPA_v4_0_RSRC_GRP_TYPE_DST_DATA_SECTORS] = {
+		{4, 4}, {4, 4}, {3, 3}, {2, 2}, {0, 0}, {0, 0} },
+		[IPA_v4_0_RSRC_GRP_TYPE_DST_DPS_DMARS] = {
+		{2, 255}, {1, 255}, {1, 2}, {0, 2}, {0, 0}, {0, 0} },
+	},
 };
 
 static const struct rsrc_min_max ipa3_rsrc_rx_grp_config
@@ -387,6 +430,16 @@ static const struct rsrc_min_max ipa3_rsrc_rx_grp_config
 		[IPA_RSRC_GRP_TYPE_RX_HPS_CMDQ] = {
 		{ 3, 3 }, { 7, 7 }, { 2, 2 }, { 0, 0 }, { 0, 0 }, { 0, 0 } },
 	},
+	[IPA_4_0_AUTO] = {
+		/*not-used  UL_DL CV2X  not-used, other are invalid */
+		[IPA_RSRC_GRP_TYPE_RX_HPS_CMDQ] = {
+		{0, 0}, {7, 7}, {2, 2}, {0, 0}, {0, 0}, {0, 0} },
+	},
+	[IPA_4_0_AUTO_MHI] = {
+		/* PCIE  DDR   DMA/CV2X not used, other are invalid */
+		[IPA_RSRC_GRP_TYPE_RX_HPS_CMDQ] = {
+		{ 3, 3 }, { 7, 7 }, { 2, 2 }, { 0, 0 }, { 0, 0 }, { 0, 0 } },
+	},
 };
 
 static const u32 ipa3_rsrc_rx_grp_hps_weight_config
@@ -415,6 +468,14 @@ static const u32 ipa3_rsrc_rx_grp_hps_weight_config
 		/* PCIE   DDR	     DMA       unused   N/A        N/A */
 		[IPA_RSRC_GRP_TYPE_RX_HPS_WEIGHT_CONFIG] = { 3, 5, 1, 1, 0, 0 },
 	},
+	[IPA_4_0_AUTO] = {
+		/*not-used  UL_DL CV2X  not-used, other are invalid */
+		[IPA_RSRC_GRP_TYPE_RX_HPS_WEIGHT_CONFIG] = { 0, 1, 1, 0, 0, 0 },
+	},
+	[IPA_4_0_AUTO_MHI] = {
+		/* PCIE  DDR   DMA/CV2X not used, other are invalid */
+		[IPA_RSRC_GRP_TYPE_RX_HPS_WEIGHT_CONFIG] = { 3, 5, 1, 0, 0, 0 },
+	},
 };
 
 enum ipa_ees {
@@ -1494,6 +1555,417 @@ static const struct ipa_ep_configuration ipa3_ep_mapping
 			IPA_DPS_HPS_SEQ_TYPE_INVALID,
 			QMB_MASTER_SELECT_DDR,
 			{ 31, 31, 8, 8, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
+
+	/* IPA_4_0_AUTO */
+	[IPA_4_0_AUTO][IPA_CLIENT_WLAN1_PROD]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_REP_SEQ_TYPE_2PKT_PROC_PASS_NO_DEC_UCP_DMAP,
+			QMB_MASTER_SELECT_DDR,
+			{ 6, 2, 8, 16, IPA_EE_UC, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO][IPA_CLIENT_USB_PROD]            = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_REP_SEQ_TYPE_2PKT_PROC_PASS_NO_DEC_UCP_DMAP,
+			QMB_MASTER_SELECT_DDR,
+			{ 0, 0, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_USB2_PROD]            = {
+			true, IPA_v4_0_GROUP_CV2X,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_DMA_ONLY,
+			QMB_MASTER_SELECT_DDR,
+			{ 7, 3, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_APPS_LAN_PROD]   = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{ 8, 11, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_APPS_WAN_PROD] = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_REP_SEQ_TYPE_2PKT_PROC_PASS_NO_DEC_UCP_DMAP,
+			QMB_MASTER_SELECT_DDR,
+			{ 2, 4, 16, 32, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_APPS_CMD_PROD]	  = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_DMA_ONLY,
+			QMB_MASTER_SELECT_DDR,
+			{ 5, 7, 20, 24, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO][IPA_CLIENT_ODU_PROD]            = {
+			false, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_REP_SEQ_TYPE_2PKT_PROC_PASS_NO_DEC_UCP_DMAP,
+			QMB_MASTER_SELECT_DDR,
+			{ 1, 0, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_ETHERNET_PROD]	  = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_REP_SEQ_TYPE_2PKT_PROC_PASS_NO_DEC_UCP_DMAP,
+			QMB_MASTER_SELECT_DDR,
+			{ 9, 0, 8, 16, IPA_EE_UC, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO][IPA_CLIENT_Q6_WAN_PROD]         = {
+			false, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{ 3, 0, 16, 32, IPA_EE_Q6, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO][IPA_CLIENT_Q6_CMD_PROD]	  = {
+			false, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_PKT_PROCESS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{ 4, 1, 20, 24, IPA_EE_Q6, GSI_USE_PREFETCH_BUFS } },
+	/* Only for test purpose */
+	[IPA_4_0_AUTO][IPA_CLIENT_TEST_PROD]           = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{0, 8, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_TEST1_PROD]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{0, 8, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_TEST2_PROD]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{ 1, 0, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_TEST3_PROD]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{ 7, 9, 8, 16, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO][IPA_CLIENT_TEST4_PROD]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{8, 10, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+
+
+	[IPA_4_0_AUTO][IPA_CLIENT_WLAN1_CONS]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 18, 3, 6, 9, IPA_EE_UC, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO][IPA_CLIENT_WLAN2_CONS]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 20, 12, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_WLAN3_CONS]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 21, 13, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_USB_CONS]            = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 19, 6, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_USB_DPL_CONS]        = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 15, 10, 5, 5, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_MHI_DPL_CONS]        = {
+			false, IPA_v4_0_MHI_GROUP_PCIE,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_PCIE,
+			{ 12, 2, 5, 5, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_APPS_LAN_CONS]       = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 10, 8, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_APPS_WAN_CONS]       = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 11, 9, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_USB2_CONS]        = {
+			true, IPA_v4_0_GROUP_CV2X,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 17, 1, 9, 9, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO][IPA_CLIENT_ETHERNET_CONS]	  = {
+			true, IPA_v4_0_ETHERNET,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 22, 1, 9, 9, IPA_EE_UC, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO][IPA_CLIENT_Q6_LAN_CONS]         = {
+			false, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 14, 4, 9, 9, IPA_EE_Q6, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO][IPA_CLIENT_Q6_WAN_CONS]         = {
+			false, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 13, 3, 9, 9, IPA_EE_Q6, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO][IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS] = {
+			false, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 16, 5, 9, 9, IPA_EE_Q6, GSI_USE_PREFETCH_BUFS } },
+	/* Only for test purpose */
+	/* MBIM aggregation test pipes should have the same QMB as USB_CONS */
+	[IPA_4_0_AUTO][IPA_CLIENT_TEST_CONS]           = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 11, 6, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_TEST1_CONS]           = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 11, 6, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_TEST2_CONS]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 12, 2, 5, 5, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_TEST3_CONS]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 19, 12, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO][IPA_CLIENT_TEST4_CONS]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 21, 14, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	/* Dummy consumer (pipe 31) is used in L2TP rt rule */
+	[IPA_4_0_AUTO][IPA_CLIENT_DUMMY_CONS]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 31, 31, 8, 8, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
+
+	/* IPA_4_0_AUTO_MHI */
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_APPS_WAN_PROD]   = {
+			true, IPA_v4_0_MHI_GROUP_DDR,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{ 2, 4, 16, 32, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_APPS_CMD_PROD]	  = {
+			true, IPA_v4_0_MHI_GROUP_DDR,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_DMA_ONLY,
+			QMB_MASTER_SELECT_DDR,
+			{ 5, 7, 20, 24, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_MHI_PROD]            = {
+			true, IPA_v4_0_MHI_GROUP_PCIE,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_PCIE,
+			{ 0, 0, 8, 16, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_MHI2_PROD]            = {
+			true, IPA_v4_0_GROUP_CV2X,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_PCIE,
+			{ 6, 5, 8, 16, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_ETHERNET_PROD]	  = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_REP_SEQ_TYPE_2PKT_PROC_PASS_NO_DEC_UCP_DMAP,
+			QMB_MASTER_SELECT_DDR,
+			{ 9, 0, 8, 16, IPA_EE_UC, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_Q6_WAN_PROD]         = {
+			false, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_PKT_PROCESS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{ 3, 0, 16, 32, IPA_EE_Q6, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_Q6_CMD_PROD]	  = {
+			false, IPA_v4_0_MHI_GROUP_PCIE,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_PKT_PROCESS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{ 4, 1, 20, 24, IPA_EE_Q6, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_MEMCPY_DMA_SYNC_PROD] = {
+			true, IPA_v4_0_MHI_GROUP_DMA,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_DMA_ONLY,
+			QMB_MASTER_SELECT_DDR,
+			{ 7, 3, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_MEMCPY_DMA_ASYNC_PROD] = {
+			true, IPA_v4_0_MHI_GROUP_DMA,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_DMA_ONLY,
+			QMB_MASTER_SELECT_DDR,
+			{ 8, 11, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	/* Only for test purpose */
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_TEST_PROD]           = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{0, 8, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_TEST1_PROD]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{0, 8, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_TEST2_PROD]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{ 1, 0, 8, 16, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_TEST3_PROD]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{7, 9, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_TEST4_PROD]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			true,
+			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
+			QMB_MASTER_SELECT_DDR,
+			{ 8, 10, 8, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+
+
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_APPS_LAN_CONS]       = {
+			true, IPA_v4_0_MHI_GROUP_DDR,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 10, 8, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_APPS_WAN_CONS]       = {
+			true, IPA_v4_0_MHI_GROUP_DDR,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 11, 9, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_MHI_CONS]            = {
+			true, IPA_v4_0_MHI_GROUP_PCIE,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_PCIE,
+			{ 17, 1, 17, 17, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_MHI2_CONS]            = {
+			true, IPA_v4_0_GROUP_CV2X,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_PCIE,
+			{ 19, 6, 9, 9, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_ETHERNET_CONS]	  = {
+			true, IPA_v4_0_ETHERNET,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 22, 1, 9, 9, IPA_EE_UC, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_Q6_LAN_CONS]         = {
+			false, IPA_v4_0_MHI_GROUP_DDR,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 14, 4, 9, 9, IPA_EE_Q6, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_Q6_WAN_CONS]         = {
+			false, IPA_v4_0_MHI_GROUP_DDR,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 13, 3, 9, 9, IPA_EE_Q6, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_MEMCPY_DMA_SYNC_CONS] = {
+			true, IPA_v4_0_MHI_GROUP_DMA,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_PCIE,
+			{ 20, 12, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS] = {
+			true, IPA_v4_0_MHI_GROUP_DMA,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_PCIE,
+			{ 21, 13, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS] = {
+			false, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 16, 5, 9, 9, IPA_EE_Q6, GSI_USE_PREFETCH_BUFS } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_USB_DPL_CONS]        = {
+			false, IPA_v4_0_MHI_GROUP_DDR,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 15, 10, 5, 5, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_MHI_DPL_CONS]        = {
+			true, IPA_v4_0_MHI_GROUP_PCIE,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_PCIE,
+			{ 12, 2, 5, 5, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	/* Only for test purpose */
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_TEST_CONS]           = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_PCIE,
+			{ 11, 6, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_TEST1_CONS]           = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_PCIE,
+			{ 11, 6, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_TEST2_CONS]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 12, 2, 5, 5, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_TEST3_CONS]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_PCIE,
+			{ 19, 12, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_TEST4_CONS]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_PCIE,
+			{ 21, 14, 9, 9, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY } },
+	/* Dummy consumer (pipe 31) is used in L2TP rt rule */
+	[IPA_4_0_AUTO_MHI][IPA_CLIENT_DUMMY_CONS]          = {
+			true, IPA_v4_0_GROUP_UL_DL,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_INVALID,
+			QMB_MASTER_SELECT_DDR,
+			{ 31, 31, 8, 8, IPA_EE_AP, GSI_USE_PREFETCH_BUFS } },
 };
 
 /**
@@ -2131,6 +2603,14 @@ u8 ipa3_get_hw_type_index(void)
 		 */
 		if (ipa3_ctx->ipa_config_is_mhi)
 			hw_type_index = IPA_4_0_MHI;
+
+		if (ipa3_ctx->ipa_config_is_auto)
+			hw_type_index = IPA_4_0_AUTO;
+
+		if (ipa3_ctx->ipa_config_is_auto &&
+			ipa3_ctx->ipa_config_is_mhi)
+			hw_type_index = IPA_4_0_AUTO_MHI;
+
 		break;
 	default:
 		IPAERR("Incorrect IPA version %d\n", ipa3_ctx->ipa_hw_type);
@@ -4777,6 +5257,8 @@ static void ipa3_write_rsrc_grp_type_reg(int group_index,
 		break;
 	case IPA_4_0:
 	case IPA_4_0_MHI:
+	case IPA_4_0_AUTO:
+	case IPA_4_0_AUTO_MHI:
 		if (src) {
 			switch (group_index) {
 			case IPA_v4_0_GROUP_LWA_DL:
@@ -4926,6 +5408,13 @@ void ipa3_set_resorce_groups_min_max_limits(void)
 		src_grp_idx_max = IPA_v4_0_SRC_GROUP_MAX;
 		dst_grp_idx_max = IPA_v4_0_DST_GROUP_MAX;
 		break;
+	case IPA_4_0_AUTO:
+	case IPA_4_0_AUTO_MHI:
+		src_rsrc_type_max = IPA_v4_0_RSRC_GRP_TYPE_SRC_MAX;
+		dst_rsrc_type_max = IPA_v4_0_RSRC_GRP_TYPE_DST_MAX;
+		src_grp_idx_max = IPA_v4_0_GROUP_CV2X;
+		dst_grp_idx_max = IPA_v4_0_GROUP_CV2X;
+		break;
 	default:
 		IPAERR("invalid hw type index\n");
 		WARN_ON(1);
diff --git a/drivers/platform/msm/mhi_dev/mhi_dev_net.c b/drivers/platform/msm/mhi_dev/mhi_dev_net.c
index d1f86a4..c78f20c 100644
--- a/drivers/platform/msm/mhi_dev/mhi_dev_net.c
+++ b/drivers/platform/msm/mhi_dev/mhi_dev_net.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -27,11 +27,13 @@
 #include <linux/spinlock.h>
 #include <linux/errno.h>
 #include <linux/ktime.h>
+#include <linux/platform_device.h>
+#include <linux/etherdevice.h>
 
 #include "mhi.h"
 
 #define MHI_NET_DRIVER_NAME  "mhi_dev_net_drv"
-#define MHI_NET_DEV_NAME     "mhi_dev_net%d"
+#define MHI_NET_DEV_NAME     "mhi_swip%d"
 #define MHI_NET_DEFAULT_MTU   8192
 #define MHI_NET_IPC_PAGES     (100)
 #define MHI_MAX_RX_REQ        (128)
@@ -90,6 +92,7 @@ struct mhi_dev_net_client {
 	u32 out_chan;
 	/* read channel - always odd */
 	u32 in_chan;
+	bool eth_iface;
 	struct mhi_dev_client *out_handle;
 	struct mhi_dev_client *in_handle;
 	/*process pendig packets */
@@ -113,6 +116,7 @@ struct mhi_dev_net_client {
 struct mhi_dev_net_ctxt {
 	struct mhi_dev_net_chan_attr chan_attr[MHI_MAX_SOFTWARE_CHANNELS];
 	struct mhi_dev_net_client *client_handle;
+	struct platform_device		*pdev;
 	void (*net_event_notifier)(struct mhi_dev_client_cb_reason *cb);
 };
 
@@ -247,8 +251,12 @@ static void mhi_dev_net_read_completion_cb(void *req)
 	unsigned long   flags;
 
 	skb->len = mreq->transfer_len;
-	skb->protocol =
-		mhi_dev_net_eth_type_trans(skb);
+
+	if (net_handle->eth_iface)
+		skb->protocol = eth_type_trans(skb, net_handle->dev);
+	else
+		skb->protocol = mhi_dev_net_eth_type_trans(skb);
+
 	skb_put(skb, mreq->transfer_len);
 	net_handle->dev->stats.rx_packets++;
 	skb->dev = net_handle->dev;
@@ -433,12 +441,15 @@ static const struct net_device_ops mhi_dev_net_ops_ip = {
 	.ndo_change_mtu = mhi_dev_net_change_mtu,
 };
 
-static void mhi_dev_net_setup(struct net_device *dev)
+static void mhi_dev_net_rawip_setup(struct net_device *dev)
 {
 	dev->netdev_ops = &mhi_dev_net_ops_ip;
 	ether_setup(dev);
+	mhi_dev_net_log(MHI_INFO,
+			"mhi_dev_net Raw IP setup\n");
 
 	/* set this after calling ether_setup */
+	dev->header_ops = NULL;
 	dev->type = ARPHRD_RAWIP;
 	dev->hard_header_len = 0;
 	dev->mtu = MHI_NET_DEFAULT_MTU;
@@ -446,6 +457,14 @@ static void mhi_dev_net_setup(struct net_device *dev)
 	dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST);
 }
 
+static void mhi_dev_net_ether_setup(struct net_device *dev)
+{
+	dev->netdev_ops = &mhi_dev_net_ops_ip;
+	ether_setup(dev);
+	mhi_dev_net_log(MHI_INFO,
+			"mhi_dev_net Ethernet setup\n");
+}
+
 static int mhi_dev_net_enable_iface(struct mhi_dev_net_client *mhi_dev_net_ptr)
 {
 	int ret = 0;
@@ -462,12 +481,20 @@ static int mhi_dev_net_enable_iface(struct mhi_dev_net_client *mhi_dev_net_ptr)
 			"mhi_dev_net interface registration\n");
 	netdev = alloc_netdev(sizeof(struct mhi_dev_net_client),
 			MHI_NET_DEV_NAME, NET_NAME_PREDICTABLE,
-			mhi_dev_net_setup);
+			mhi_net_ctxt.client_handle->eth_iface ?
+			mhi_dev_net_ether_setup :
+			mhi_dev_net_rawip_setup);
 	if (!netdev) {
 		pr_err("Failed to allocate netdev for mhi_dev_net\n");
 		goto net_dev_alloc_fail;
 	}
 
+	if (mhi_net_ctxt.client_handle->eth_iface) {
+		eth_random_addr(netdev->dev_addr);
+		if (!is_valid_ether_addr(netdev->dev_addr))
+			return -EADDRNOTAVAIL;
+	}
+
 	mhi_dev_net_ctxt = netdev_priv(netdev);
 	mhi_dev_net_ptr->dev = netdev;
 	*mhi_dev_net_ctxt = mhi_dev_net_ptr;
@@ -621,6 +648,12 @@ int mhi_dev_net_interface_init(void)
 				"Failed to create IPC logging for mhi_dev_net\n");
 	mhi_net_ctxt.client_handle = mhi_net_client;
 
+	if (mhi_net_ctxt.pdev)
+		mhi_net_ctxt.client_handle->eth_iface =
+			of_property_read_bool
+			((&mhi_net_ctxt.pdev->dev)->of_node,
+				"qcom,mhi-ethernet-interface");
+
 	/*Process pending packet work queue*/
 	mhi_net_client->pending_pckt_wq =
 		create_singlethread_workqueue("pending_xmit_pckt_wq");
@@ -665,3 +698,47 @@ void __exit mhi_dev_net_exit(void)
 	mhi_dev_net_close();
 }
 EXPORT_SYMBOL(mhi_dev_net_exit);
+
+static int mhi_dev_net_probe(struct platform_device *pdev)
+{
+	if (pdev->dev.of_node) {
+		mhi_net_ctxt.pdev = pdev;
+		mhi_dev_net_log(MHI_INFO,
+				"MHI Network probe success");
+	}
+
+	return 0;
+}
+
+static int mhi_dev_net_remove(struct platform_device *pdev)
+{
+	platform_set_drvdata(pdev, NULL);
+
+	return 0;
+}
+
+static const struct of_device_id mhi_dev_net_match_table[] = {
+	{	.compatible = "qcom,msm-mhi-dev-net" },
+	{}
+};
+
+static struct platform_driver mhi_dev_net_driver = {
+	.driver		= {
+		.name	= "qcom,msm-mhi-dev-net",
+		.of_match_table = mhi_dev_net_match_table,
+	},
+	.probe		= mhi_dev_net_probe,
+	.remove		= mhi_dev_net_remove,
+};
+
+static int __init mhi_dev_net_init(void)
+{
+	return platform_driver_register(&mhi_dev_net_driver);
+}
+subsys_initcall(mhi_dev_net_init);
+
+static void __exit mhi_dev_exit(void)
+{
+	platform_driver_unregister(&mhi_dev_net_driver);
+}
+module_exit(mhi_dev_net_exit);
diff --git a/drivers/soc/qcom/peripheral-loader.c b/drivers/soc/qcom/peripheral-loader.c
index 384ac58..1d5284e 100644
--- a/drivers/soc/qcom/peripheral-loader.c
+++ b/drivers/soc/qcom/peripheral-loader.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2010-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2010-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -36,6 +36,7 @@
 #include <soc/qcom/subsystem_restart.h>
 #include <soc/qcom/secure_buffer.h>
 #include <soc/qcom/smem.h>
+#include <linux/kthread.h>
 
 #include <linux/uaccess.h>
 #include <asm/setup.h>
@@ -70,6 +71,9 @@ static int proxy_timeout_ms = -1;
 module_param(proxy_timeout_ms, int, 0644);
 
 static bool disable_timeouts;
+
+static struct workqueue_struct *pil_wq;
+
 /**
  * struct pil_mdt - Representation of <name>.mdt file in memory
  * @hdr: ELF32 header
@@ -127,6 +131,7 @@ struct pil_priv {
 	struct wakeup_source ws;
 	char wname[32];
 	struct pil_desc *desc;
+	int num_segs;
 	struct list_head segs;
 	phys_addr_t entry_addr;
 	phys_addr_t base_addr;
@@ -723,6 +728,7 @@ static int pil_init_mmap(struct pil_desc *desc, const struct pil_mdt *mdt,
 	pil_info(desc, "loading from %pa to %pa\n", &priv->region_start,
 							&priv->region_end);
 
+	priv->num_segs = 0;
 	for (i = 0; i < mdt->hdr.e_phnum; i++) {
 		phdr = &mdt->phdr[i];
 		if (!segment_is_loadable(phdr))
@@ -733,6 +739,7 @@ static int pil_init_mmap(struct pil_desc *desc, const struct pil_mdt *mdt,
 			return PTR_ERR(seg);
 
 		list_add_tail(&seg->list, &priv->segs);
+		priv->num_segs++;
 	}
 	list_sort(NULL, &priv->segs, pil_cmp_seg);
 
@@ -922,6 +929,9 @@ static int pil_parse_devicetree(struct pil_desc *desc)
 		}
 	}
 	desc->proxy_unvote_irq = clk_ready;
+
+	desc->sequential_load = of_property_read_bool(ofnode,
+						"qcom,sequential-fw-load");
 	return 0;
 }
 
@@ -945,6 +955,89 @@ static int pil_notify_aop(struct pil_desc *desc, char *status)
 /* Synchronize request_firmware() with suspend */
 static DECLARE_RWSEM(pil_pm_rwsem);
 
+struct pil_seg_data {
+	struct pil_desc *desc;
+	struct pil_seg *seg;
+	struct work_struct load_seg_work;
+	int retval;
+};
+
+static void pil_load_seg_work_fn(struct work_struct *work)
+{
+	struct pil_seg_data *pil_seg_data = container_of(work,
+							struct pil_seg_data,
+							load_seg_work);
+	struct pil_desc *desc = pil_seg_data->desc;
+	struct pil_seg *seg = pil_seg_data->seg;
+
+	pil_seg_data->retval = pil_load_seg(desc, seg);
+}
+
+static int pil_load_segs(struct pil_desc *desc)
+{
+	int ret = 0;
+	int seg_id = 0;
+	struct pil_priv *priv = desc->priv;
+	struct pil_seg_data *pil_seg_data;
+	struct pil_seg *seg;
+	unsigned long *err_map;
+
+	err_map = kcalloc(BITS_TO_LONGS(priv->num_segs), sizeof(unsigned long),
+				GFP_KERNEL);
+	if (!err_map)
+		return -ENOMEM;
+
+	pil_seg_data = kcalloc(priv->num_segs, sizeof(*pil_seg_data),
+				GFP_KERNEL);
+	if (!pil_seg_data) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	/* Initialize and spawn a thread for each segment */
+	list_for_each_entry(seg, &desc->priv->segs, list) {
+		pil_seg_data[seg_id].desc = desc;
+		pil_seg_data[seg_id].seg = seg;
+
+		INIT_WORK(&pil_seg_data[seg_id].load_seg_work,
+				pil_load_seg_work_fn);
+		queue_work(pil_wq, &pil_seg_data[seg_id].load_seg_work);
+
+		seg_id++;
+	}
+
+	bitmap_zero(err_map, priv->num_segs);
+
+	/* Wait for the parallel loads to finish */
+	seg_id = 0;
+	list_for_each_entry(seg, &desc->priv->segs, list) {
+		flush_work(&pil_seg_data[seg_id].load_seg_work);
+
+		/*
+		 * Don't exit if one of the thread fails. Wait for others to
+		 * complete. Bitmap the return codes we get from the threads.
+		 */
+		if (pil_seg_data[seg_id].retval) {
+			pil_err(desc,
+				"Failed to load the segment[%d]. ret = %d\n",
+				seg_id, pil_seg_data[seg_id].retval);
+			__set_bit(seg_id, err_map);
+		}
+
+		seg_id++;
+	}
+
+	kfree(pil_seg_data);
+
+	/* Each segment can fail due to different reason. Send a generic err */
+	if (!bitmap_empty(err_map, priv->num_segs))
+		ret = -EFAULT;
+
+out:
+	kfree(err_map);
+	return ret;
+}
+
 /**
  * pil_boot() - Load a peripheral image into memory and boot it
  * @desc: descriptor from pil_desc_init()
@@ -955,9 +1048,9 @@ int pil_boot(struct pil_desc *desc)
 {
 	int ret;
 	char fw_name[30];
+	struct pil_seg *seg;
 	const struct pil_mdt *mdt;
 	const struct elf32_hdr *ehdr;
-	struct pil_seg *seg;
 	const struct firmware *fw;
 	struct pil_priv *priv = desc->priv;
 	bool mem_protect = false;
@@ -1066,8 +1159,15 @@ int pil_boot(struct pil_desc *desc)
 	}
 
 	trace_pil_event("before_load_seg", desc);
-	list_for_each_entry(seg, &desc->priv->segs, list) {
-		ret = pil_load_seg(desc, seg);
+
+	if (desc->sequential_load) {
+		list_for_each_entry(seg, &desc->priv->segs, list) {
+			ret = pil_load_seg(desc, seg);
+			if (ret)
+				goto err_deinit_image;
+		}
+	} else {
+		ret = pil_load_segs(desc);
 		if (ret)
 			goto err_deinit_image;
 	}
@@ -1364,6 +1464,11 @@ static int __init msm_pil_init(void)
 		pr_err("SMEM is not initialized.\n");
 		return -EPROBE_DEFER;
 	}
+
+	pil_wq = alloc_workqueue("pil_workqueue", WQ_HIGHPRI | WQ_UNBOUND, 0);
+	if (!pil_wq)
+		pr_warn("pil: Defaulting to sequential firmware loading.\n");
+
 out:
 	return register_pm_notifier(&pil_pm_notifier);
 }
@@ -1371,6 +1476,8 @@ device_initcall(msm_pil_init);
 
 static void __exit msm_pil_exit(void)
 {
+	if (pil_wq)
+		destroy_workqueue(pil_wq);
 	unregister_pm_notifier(&pil_pm_notifier);
 	if (pil_info_base)
 		iounmap(pil_info_base);
diff --git a/drivers/soc/qcom/peripheral-loader.h b/drivers/soc/qcom/peripheral-loader.h
index 6ea6b2a..9f3e006 100644
--- a/drivers/soc/qcom/peripheral-loader.h
+++ b/drivers/soc/qcom/peripheral-loader.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2010-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2010-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -41,6 +41,8 @@ struct pil_priv;
  * @modem_ssr: true if modem is restarting, false if booting for first time.
  * @clear_fw_region: Clear fw region on failure in loading.
  * @subsys_vmid: memprot id for the subsystem.
+ * @sequential_load: Load the firmware blobs sequentially if set. Else, load
+ * them in parallel.
  */
 struct pil_desc {
 	const char *name;
@@ -67,6 +69,7 @@ struct pil_desc {
 	struct md_ss_toc *minidump_ss;
 	struct md_ss_toc *minidump_pdr;
 	int minidump_id;
+	bool sequential_load;
 };
 
 /**
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 02839e2..146fe3e 100755
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1284,6 +1284,8 @@ static int dwc3_probe(struct platform_device *pdev)
 					"snps,usb3-u1u2-disable");
 	dwc->usb2_l1_disable = device_property_read_bool(dev,
 					"snps,usb2-l1-disable");
+	dwc->normal_eps_in_gsi_mode = device_property_read_bool(dev,
+					"normal-eps-in-gsi-mode");
 	if (dwc->enable_bus_suspend) {
 		pm_runtime_set_autosuspend_delay(dev, 500);
 		pm_runtime_use_autosuspend(dev);
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 89d7ee0..80386d2 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -620,6 +620,7 @@ struct dwc3_ep_events {
  * @dbg_ep_events_ts: timestamp for previous event counters
  * @fifo_depth: allocated TXFIFO depth
  * @ep_cfg_init_params: Used by GSI EP to save EP_CFG init_cmd params
+ * @gsi_db_reg_addr: Address of GSI DB register mapped to this EP
  */
 struct dwc3_ep {
 	struct usb_ep		endpoint;
@@ -676,6 +677,7 @@ struct dwc3_ep {
 	struct timespec		dbg_ep_events_ts;
 	int			fifo_depth;
 	struct dwc3_gadget_ep_cmd_params ep_cfg_init_params;
+	void __iomem		*gsi_db_reg_addr;
 };
 
 enum dwc3_phy {
@@ -989,6 +991,8 @@ struct dwc3_scratchpad_array {
  * @create_reg_debugfs: create debugfs entry to allow dwc3 register dump
  * @xhci_imod_value: imod value to use with xhci
  * @core_id: usb core id to differentiate different controller
+ * @normal_eps_in_gsi_mode: if true, two normal EPS (1 In, 1 Out) can be used in
+ *			    GSI mode
  */
 struct dwc3 {
 	struct usb_ctrlrequest	*ctrl_req;
@@ -1191,6 +1195,7 @@ struct dwc3 {
 	u32			xhci_imod_value;
 	int			core_id;
 	int			retries_on_error;
+	bool			normal_eps_in_gsi_mode;
 };
 
 /* -------------------------------------------------------------------------- */
diff --git a/drivers/usb/dwc3/dwc3-msm.c b/drivers/usb/dwc3/dwc3-msm.c
index af704b7..37c4e7e 100644
--- a/drivers/usb/dwc3/dwc3-msm.c
+++ b/drivers/usb/dwc3/dwc3-msm.c
@@ -203,7 +203,7 @@ static const char * const gsi_op_strings[] = {
 	"ENABLE_GSI", "UPDATE_XFER", "RING_DB",
 	"END_XFER", "GET_CH_INFO", "GET_XFER_IDX", "PREPARE_TRBS",
 	"FREE_TRBS", "SET_CLR_BLOCK_DBL", "CHECK_FOR_SUSP",
-	"EP_DISABLE" };
+	"EP_DISABLE", "EP_UPDATE_DB" };
 
 /* Input bits to state machine (mdwc->inputs) */
 
@@ -312,6 +312,8 @@ struct dwc3_msm {
 
 	u64			dummy_gsi_db;
 	dma_addr_t		dummy_gsi_db_dma;
+	u64			dummy_gevntcnt;
+	dma_addr_t		dummy_gevntcnt_dma;
 };
 
 #define USB_HSPHY_3P3_VOL_MIN		3050000 /* uV */
@@ -864,6 +866,7 @@ static void gsi_get_channel_info(struct usb_ep *ep,
 	int last_trb_index = 0;
 	struct dwc3	*dwc = dep->dwc;
 	struct usb_gsi_request *request = ch_info->ch_req;
+	struct dwc3_msm *mdwc = dev_get_drvdata(dwc->dev->parent);
 
 	/* Provide physical USB addresses for DEPCMD and GEVENTCNT registers */
 	ch_info->depcmd_low_addr = (u32)(dwc->reg_phys +
@@ -898,14 +901,28 @@ static void gsi_get_channel_info(struct usb_ep *ep,
 	/* Store last 16 bits of LINK TRB address as per GSI hw requirement */
 	ch_info->last_trb_addr = (dwc3_trb_dma_offset(dep,
 			&dep->trb_pool[last_trb_index - 1]) & 0x0000FFFF);
-	ch_info->gevntcount_low_addr = (u32)(dwc->reg_phys +
-			DWC3_GEVNTCOUNT(ep->ep_intr_num));
-	ch_info->gevntcount_hi_addr = 0;
+	dev_dbg(dwc->dev, "depcmd_laddr=%x last_trb_addr=%x\n",
+		ch_info->depcmd_low_addr, ch_info->last_trb_addr);
 
-	dev_dbg(dwc->dev,
-	"depcmd_laddr=%x last_trb_addr=%x gevtcnt_laddr=%x gevtcnt_haddr=%x",
-		ch_info->depcmd_low_addr, ch_info->last_trb_addr,
-		ch_info->gevntcount_low_addr, ch_info->gevntcount_hi_addr);
+	/*
+	 * Check if NORMAL EP is used with GSI. In that case USB driver
+	 * processes events and GSI shouldn't access GEVNTCOUNT(0) register.
+	 */
+	if (ep->ep_intr_num) {
+		ch_info->gevntcount_low_addr = (u32)(dwc->reg_phys +
+			DWC3_GEVNTCOUNT(ep->ep_intr_num));
+		ch_info->gevntcount_hi_addr = 0;
+		dev_dbg(dwc->dev, "gevtcnt_laddr=%x gevtcnt_haddr=%x\n",
+		     ch_info->gevntcount_low_addr, ch_info->gevntcount_hi_addr);
+	} else {
+		ch_info->gevntcount_low_addr = (u32)mdwc->dummy_gevntcnt_dma;
+		ch_info->gevntcount_hi_addr =
+				(u32)((u64)mdwc->dummy_gevntcnt_dma >> 32);
+		dev_dbg(dwc->dev, "Dummy GEVNTCNT Addr %pK: %llx %x (LSB)\n",
+			&mdwc->dummy_gevntcnt,
+			(unsigned long long)mdwc->dummy_gevntcnt_dma,
+			(u32)mdwc->dummy_gevntcnt_dma);
+	}
 }
 
 /*
@@ -929,8 +946,15 @@ static int gsi_startxfer_for_ep(struct usb_ep *ep)
 	}
 
 	memset(&params, 0, sizeof(params));
-	params.param0 = GSI_TRB_ADDR_BIT_53_MASK | GSI_TRB_ADDR_BIT_55_MASK;
-	params.param0 |= (ep->ep_intr_num << 16);
+	/*
+	 * Check if NORMAL EP is used with GSI. In that case USB driver
+	 * updates GSI doorbell and USB GSI wrapper h/w isn't involved.
+	 */
+	if (ep->ep_intr_num) {
+		params.param0 = GSI_TRB_ADDR_BIT_53_MASK |
+				GSI_TRB_ADDR_BIT_55_MASK;
+		params.param0 |= (ep->ep_intr_num << 16);
+	}
 	params.param1 = lower_32_bits(dwc3_trb_dma_offset(dep,
 						&dep->trb_pool[0]));
 	cmd = DWC3_DEPCMD_STARTTRANSFER;
@@ -957,7 +981,18 @@ static void gsi_store_ringbase_dbl_info(struct usb_ep *ep,
 	struct dwc3_ep *dep = to_dwc3_ep(ep);
 	struct dwc3	*dwc = dep->dwc;
 	struct dwc3_msm *mdwc = dev_get_drvdata(dwc->dev->parent);
-	int n = ep->ep_intr_num - 1;
+	int n;
+
+	/*
+	 * Check if NORMAL EP is used with GSI. In that case USB driver
+	 * updates GSI doorbell and USB GSI wrapper h/w isn't involved.
+	 */
+	if (!ep->ep_intr_num) {
+		dev_dbg(mdwc->dev, "%s: is no-op for normal EP\n", __func__);
+		return;
+	}
+
+	n = ep->ep_intr_num - 1;
 
 	dwc3_msm_write_reg(mdwc->base, GSI_RING_BASE_ADDR_L(n),
 			dwc3_trb_dma_offset(dep, &dep->trb_pool[0]));
@@ -991,6 +1026,21 @@ static void gsi_store_ringbase_dbl_info(struct usb_ep *ep,
 			dwc3_msm_read_reg(mdwc->base, GSI_DBL_ADDR_L(n)));
 }
 
+static void dwc3_msm_gsi_db_update(struct dwc3_ep *dep, dma_addr_t offset)
+{
+	struct dwc3 *dwc = dep->dwc;
+	struct dwc3_msm *mdwc = dev_get_drvdata(dwc->dev->parent);
+
+	if (!dep->gsi_db_reg_addr) {
+		dev_err(mdwc->dev, "Failed to update GSI DBL\n");
+		return;
+	}
+
+	writel_relaxed(offset, dep->gsi_db_reg_addr);
+	dev_dbg(mdwc->dev, "Writing TRB addr: %pa to %pK\n",
+		&offset, dep->gsi_db_reg_addr);
+}
+
 /*
 * Rings Doorbell for GSI Channel
 *
@@ -1016,6 +1066,8 @@ static void gsi_ring_db(struct usb_ep *ep, struct usb_gsi_request *request)
 		return;
 	}
 
+	dep->gsi_db_reg_addr = gsi_dbl_address_lsb;
+
 	gsi_dbl_address_msb = devm_ioremap_nocache(mdwc->dev,
 			request->db_reg_phs_addr_msb, sizeof(u32));
 	if (!gsi_dbl_address_msb) {
@@ -1399,6 +1451,15 @@ static void gsi_enable(struct usb_ep *ep)
 	struct dwc3 *dwc = dep->dwc;
 	struct dwc3_msm *mdwc = dev_get_drvdata(dwc->dev->parent);
 
+	/*
+	 * Check if NORMAL EP is used with GSI. In that case USB driver
+	 * updates GSI doorbell and USB GSI wrapper h/w isn't involved.
+	 */
+	if (!ep->ep_intr_num) {
+		dev_dbg(mdwc->dev, "%s: is no-op for normal EP\n", __func__);
+		return;
+	}
+
 	dwc3_msm_write_reg_field(mdwc->base,
 			GSI_GENERAL_CFG_REG, GSI_CLK_EN_MASK, 1);
 	dwc3_msm_write_reg_field(mdwc->base,
@@ -1435,6 +1496,12 @@ static void gsi_set_clear_dbell(struct usb_ep *ep,
 	else
 		gsi_enable_ep_events(ep);
 
+	/* Nothing to be done if NORMAL EP is used with GSI */
+	if (!ep->ep_intr_num) {
+		dev_dbg(mdwc->dev, "%s: is no-op for normal EP\n", __func__);
+		return;
+	}
+
 	dwc3_msm_write_reg_field(mdwc->base,
 		GSI_GENERAL_CFG_REG, BLOCK_GSI_WR_GO_MASK, block_db);
 }
@@ -1490,6 +1557,7 @@ static int dwc3_msm_gsi_ep_op(struct usb_ep *ep,
 	struct gsi_channel_info *ch_info;
 	bool block_db;
 	unsigned long flags;
+	dma_addr_t offset;
 
 	dbg_log_string("%s(%d):%s", ep->name, ep->ep_num, gsi_op_to_string(op));
 
@@ -1555,6 +1623,10 @@ static int dwc3_msm_gsi_ep_op(struct usb_ep *ep,
 	case GSI_EP_OP_DISABLE:
 		ret = ep->ops->disable(ep);
 		break;
+	case GSI_EP_OP_UPDATE_DB:
+		offset = *(dma_addr_t *)op_data;
+		dwc3_msm_gsi_db_update(dep, offset);
+		break;
 	default:
 		dev_err(mdwc->dev, "%s: Invalid opcode GSI EP\n", __func__);
 	}
@@ -2065,6 +2137,19 @@ static void dwc3_msm_notify_event(struct dwc3 *dwc, unsigned int event,
 			dev_err(dwc->dev, "failed to map dummy doorbell buffer\n");
 			mdwc->dummy_gsi_db_dma = (dma_addr_t)NULL;
 		}
+
+		/*
+		 * Set-up dummy GEVNTCOUNT address to be passed on to GSI for
+		 * normal (non HW-accelerated) EPs.
+		 */
+		mdwc->dummy_gevntcnt_dma = dma_map_single(dwc->sysdev,
+						&mdwc->dummy_gevntcnt,
+						sizeof(mdwc->dummy_gevntcnt),
+						DMA_FROM_DEVICE);
+		if (dma_mapping_error(dwc->sysdev, mdwc->dummy_gevntcnt_dma)) {
+			dev_err(dwc->dev, "failed to map dummy geventcount\n");
+			mdwc->dummy_gevntcnt_dma = (dma_addr_t)NULL;
+		}
 		break;
 	case DWC3_GSI_EVT_BUF_SETUP:
 		dev_dbg(mdwc->dev, "DWC3_GSI_EVT_BUF_SETUP\n");
@@ -2138,6 +2223,12 @@ static void dwc3_msm_notify_event(struct dwc3 *dwc, unsigned int event,
 				dma_free_coherent(dwc->sysdev, evt->length,
 							evt->buf, evt->dma);
 		}
+		if (mdwc->dummy_gevntcnt_dma) {
+			dma_unmap_single(dwc->sysdev, mdwc->dummy_gevntcnt_dma,
+					 sizeof(mdwc->dummy_gevntcnt),
+					 DMA_FROM_DEVICE);
+			mdwc->dummy_gevntcnt_dma = (dma_addr_t)NULL;
+		}
 		if (mdwc->dummy_gsi_db_dma) {
 			dma_unmap_single(dwc->sysdev, mdwc->dummy_gsi_db_dma,
 					 sizeof(mdwc->dummy_gsi_db),
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index e8d270d..d0391b4 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2390,8 +2390,8 @@ static const struct usb_gadget_ops dwc3_gadget_ops = {
 
 /* -------------------------------------------------------------------------- */
 
-#define NUM_GSI_OUT_EPS	1
-#define NUM_GSI_IN_EPS	2
+#define NUM_GSI_OUT_EPS(dwc)	(dwc->normal_eps_in_gsi_mode ? 2 : 1)
+#define NUM_GSI_IN_EPS(dwc)	(dwc->normal_eps_in_gsi_mode ? 3 : 2)
 
 static int dwc3_gadget_init_hw_endpoints(struct dwc3 *dwc,
 		u8 num, u32 direction)
@@ -2399,13 +2399,13 @@ static int dwc3_gadget_init_hw_endpoints(struct dwc3 *dwc,
 	struct dwc3_ep			*dep;
 	u8				i, gsi_ep_count, gsi_ep_index = 0;
 
-	gsi_ep_count = NUM_GSI_OUT_EPS + NUM_GSI_IN_EPS;
+	gsi_ep_count = NUM_GSI_OUT_EPS(dwc) + NUM_GSI_IN_EPS(dwc);
 	/* OUT GSI EPs based on direction field */
 	if (gsi_ep_count && !direction)
-		gsi_ep_count = NUM_GSI_OUT_EPS;
+		gsi_ep_count = NUM_GSI_OUT_EPS(dwc);
 	/* IN GSI EPs */
 	else if (gsi_ep_count && direction)
-		gsi_ep_count = NUM_GSI_IN_EPS;
+		gsi_ep_count = NUM_GSI_IN_EPS(dwc);
 
 	for (i = 0; i < num; i++) {
 		u8 epnum = (i << 1) | (direction ? 1 : 0);
@@ -2710,6 +2710,25 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
 	return 1;
 }
 
+static void dwc3_gsi_ep_transfer_complete(struct dwc3 *dwc, struct dwc3_ep *dep)
+{
+	struct usb_ep *ep = &dep->endpoint;
+	struct dwc3_trb *trb;
+	dma_addr_t offset;
+
+	trb = &dep->trb_pool[dep->trb_dequeue];
+	while (trb->ctrl & DWC3_TRBCTL_LINK_TRB) {
+		dwc3_ep_inc_trb(&dep->trb_dequeue);
+		trb = &dep->trb_pool[dep->trb_dequeue];
+	}
+
+	if (!(trb->ctrl & DWC3_TRB_CTRL_HWO)) {
+		offset = dwc3_trb_dma_offset(dep, trb);
+		usb_gsi_ep_op(ep, (void *)&offset, GSI_EP_OP_UPDATE_DB);
+		dwc3_ep_inc_trb(&dep->trb_dequeue);
+	}
+}
+
 static void dwc3_endpoint_transfer_complete(struct dwc3 *dwc,
 		struct dwc3_ep *dep, const struct dwc3_event_depevt *event)
 {
@@ -2721,6 +2740,15 @@ static void dwc3_endpoint_transfer_complete(struct dwc3 *dwc,
 
 	if (event->status & DEPEVT_STATUS_BUSERR)
 		status = -ECONNRESET;
+	/*
+	 * Check if NORMAL EP is used with GSI.
+	 * In that case dwc3 driver recevies EP events from hardware and
+	 * updates GSI doorbell with completed TRB.
+	 */
+	if (dep->endpoint.ep_type == EP_TYPE_GSI) {
+		dwc3_gsi_ep_transfer_complete(dwc, dep);
+		return;
+	}
 
 	clean_busy = dwc3_cleanup_done_reqs(dwc, dep, event, status);
 	if (clean_busy && (!dep->endpoint.desc || is_xfer_complete ||
diff --git a/drivers/usb/gadget/config.c b/drivers/usb/gadget/config.c
index 17a6077..9b9d31e 100644
--- a/drivers/usb/gadget/config.c
+++ b/drivers/usb/gadget/config.c
@@ -198,9 +198,13 @@ EXPORT_SYMBOL_GPL(usb_assign_descriptors);
 void usb_free_all_descriptors(struct usb_function *f)
 {
 	usb_free_descriptors(f->fs_descriptors);
+	f->fs_descriptors = NULL;
 	usb_free_descriptors(f->hs_descriptors);
+	f->hs_descriptors = NULL;
 	usb_free_descriptors(f->ss_descriptors);
+	f->ss_descriptors = NULL;
 	usb_free_descriptors(f->ssp_descriptors);
+	f->ssp_descriptors = NULL;
 }
 EXPORT_SYMBOL_GPL(usb_free_all_descriptors);
 
diff --git a/drivers/usb/gadget/function/f_gsi.c b/drivers/usb/gadget/function/f_gsi.c
index 97c50d0..d58b20a 100644
--- a/drivers/usb/gadget/function/f_gsi.c
+++ b/drivers/usb/gadget/function/f_gsi.c
@@ -572,9 +572,11 @@ static int ipa_connect_channels(struct gsi_data_port *d_port)
 			GSI_EP_OP_GET_CH_INFO);
 
 	log_event_dbg("%s: USB GSI IN OPS Completed", __func__);
-	in_params->client =
-		(gsi->prot_id != USB_PROT_DIAG_IPA) ? IPA_CLIENT_USB_CONS :
-						IPA_CLIENT_USB_DPL_CONS;
+	if (gsi->prot_id != USB_PROT_DIAG_IPA)
+		in_params->client = (gsi->prot_id != USB_PROT_RMNET_V2X_IPA) ?
+				IPA_CLIENT_USB_CONS : IPA_CLIENT_USB2_CONS;
+	else
+		in_params->client = IPA_CLIENT_USB_DPL_CONS;
 	in_params->ipa_ep_cfg.mode.mode = IPA_BASIC;
 	in_params->teth_prot = (enum ipa_usb_teth_prot)gsi->prot_id;
 	in_params->gevntcount_low_addr =
@@ -627,7 +629,8 @@ static int ipa_connect_channels(struct gsi_data_port *d_port)
 		usb_gsi_ep_op(d_port->out_ep, (void *)&gsi_channel_info,
 				GSI_EP_OP_GET_CH_INFO);
 		log_event_dbg("%s: USB GSI OUT OPS Completed", __func__);
-		out_params->client = IPA_CLIENT_USB_PROD;
+		out_params->client = (gsi->prot_id != USB_PROT_RMNET_V2X_IPA) ?
+				     IPA_CLIENT_USB_PROD : IPA_CLIENT_USB2_PROD;
 		out_params->ipa_ep_cfg.mode.mode = IPA_BASIC;
 		out_params->teth_prot = (enum ipa_usb_teth_prot)gsi->prot_id;
 		out_params->gevntcount_low_addr =
@@ -726,11 +729,13 @@ static int ipa_connect_channels(struct gsi_data_port *d_port)
 	return ret;
 
 end_xfer_ep_out:
-	usb_gsi_ep_op(d_port->out_ep, NULL,
-		GSI_EP_OP_ENDXFER);
+	if (d_port->out_ep)
+		usb_gsi_ep_op(d_port->out_ep, NULL,
+			GSI_EP_OP_ENDXFER);
 free_trb_ep_out:
-	usb_gsi_ep_op(d_port->out_ep, &d_port->out_request,
-		GSI_EP_OP_FREE_TRBS);
+	if (d_port->out_ep)
+		usb_gsi_ep_op(d_port->out_ep, &d_port->out_request,
+			GSI_EP_OP_FREE_TRBS);
 end_xfer_ep_in:
 	usb_gsi_ep_op(d_port->in_ep, NULL,
 		GSI_EP_OP_ENDXFER);
@@ -1519,6 +1524,7 @@ static long gsi_ctrl_dev_ioctl(struct file *fp, unsigned int cmd,
 	case GSI_MBIM_GPS_USB_STATUS:
 		val = atomic_read(&gsi->connected);
 		if (gsi->prot_id == USB_PROT_RMNET_IPA ||
+				gsi->prot_id == USB_PROT_RMNET_V2X_IPA ||
 				gsi->prot_id == USB_PROT_RMNET_ETHER)
 			val = gsi->rmnet_dtr_status;
 
@@ -1699,6 +1705,9 @@ static int gsi_function_ctrl_port_init(struct f_gsi *gsi)
 	case USB_PROT_RMNET_IPA:
 		cdev_name = GSI_RMNET_CTRL_NAME;
 		break;
+	case USB_PROT_RMNET_V2X_IPA:
+		cdev_name = GSI_RMNET_V2X_CTRL_NAME;
+		break;
 	case USB_PROT_RMNET_ETHER:
 		cdev_name = ETHER_RMNET_CTRL_NAME;
 		break;
@@ -2188,6 +2197,7 @@ gsi_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
 			| USB_CDC_REQ_SET_CONTROL_LINE_STATE:
 		line_state = (w_value & GSI_CTRL_DTR ? true : false);
 		if (gsi->prot_id == USB_PROT_RMNET_IPA ||
+				gsi->prot_id == USB_PROT_RMNET_V2X_IPA ||
 				gsi->prot_id == USB_PROT_RMNET_ETHER)
 			gsi->rmnet_dtr_status = line_state;
 		log_event_dbg("%s: USB_CDC_REQ_SET_CONTROL_LINE_STATE DTR:%d\n",
@@ -2291,6 +2301,7 @@ static int gsi_get_alt(struct usb_function *f, unsigned int intf)
 	/* RNDIS, RMNET and DPL only support alt 0*/
 	if (intf == gsi->ctrl_id || gsi->prot_id == USB_PROT_RNDIS_IPA ||
 			gsi->prot_id == USB_PROT_RMNET_IPA ||
+			gsi->prot_id == USB_PROT_RMNET_V2X_IPA ||
 			gsi->prot_id == USB_PROT_DIAG_IPA ||
 			is_ext_prot_ether(gsi->prot_id))
 		return 0;
@@ -2412,6 +2423,7 @@ static int gsi_set_alt(struct usb_function *f, unsigned int intf,
 
 	/* Control interface has only altsetting 0 */
 	if (intf == gsi->ctrl_id || gsi->prot_id == USB_PROT_RMNET_IPA ||
+				gsi->prot_id == USB_PROT_RMNET_V2X_IPA ||
 				gsi->prot_id == USB_PROT_RMNET_ETHER) {
 		if (alt != 0)
 			goto fail;
@@ -2448,6 +2460,7 @@ static int gsi_set_alt(struct usb_function *f, unsigned int intf,
 		/* for rndis and rmnet alt is always 0 update alt accordingly */
 		if (gsi->prot_id == USB_PROT_RNDIS_IPA ||
 				gsi->prot_id == USB_PROT_RMNET_IPA ||
+				gsi->prot_id == USB_PROT_RMNET_V2X_IPA ||
 				gsi->prot_id == USB_PROT_DIAG_IPA ||
 				is_ext_prot_ether(gsi->prot_id))
 			alt = 1;
@@ -2478,9 +2491,11 @@ static int gsi_set_alt(struct usb_function *f, unsigned int intf,
 
 			/* Configure EPs for GSI */
 			if (gsi->d_port.in_ep &&
-				gsi->prot_id <= USB_PROT_DIAG_IPA) {
+				gsi->prot_id <= USB_PROT_RMNET_V2X_IPA) {
 				if (gsi->prot_id == USB_PROT_DIAG_IPA)
 					gsi->d_port.in_ep->ep_intr_num = 3;
+				else if (gsi->prot_id == USB_PROT_RMNET_V2X_IPA)
+					gsi->d_port.in_ep->ep_intr_num = 0;
 				else
 					gsi->d_port.in_ep->ep_intr_num = 2;
 				usb_gsi_ep_op(gsi->d_port.in_ep,
@@ -2489,8 +2504,11 @@ static int gsi_set_alt(struct usb_function *f, unsigned int intf,
 			}
 
 			if (gsi->d_port.out_ep &&
-				gsi->prot_id <= USB_PROT_DIAG_IPA) {
-				gsi->d_port.out_ep->ep_intr_num = 1;
+				gsi->prot_id <= USB_PROT_RMNET_V2X_IPA) {
+				if (gsi->prot_id == USB_PROT_RMNET_V2X_IPA)
+					gsi->d_port.out_ep->ep_intr_num = 0;
+				else
+					gsi->d_port.out_ep->ep_intr_num = 1;
 				usb_gsi_ep_op(gsi->d_port.out_ep,
 					&gsi->d_port.out_request,
 						GSI_EP_OP_CONFIG);
@@ -2585,6 +2603,7 @@ static void gsi_disable(struct usb_function *f)
 		rndis_uninit(gsi->params);
 
 	if (gsi->prot_id == USB_PROT_RMNET_IPA ||
+				gsi->prot_id == USB_PROT_RMNET_V2X_IPA ||
 				gsi->prot_id == USB_PROT_RMNET_ETHER)
 		gsi->rmnet_dtr_status = false;
 
@@ -2815,7 +2834,7 @@ static int gsi_update_function_bind_params(struct f_gsi *gsi,
 		info->data_nop_desc->bInterfaceNumber = gsi->data_id;
 
 	/* allocate instance-specific endpoints */
-	if (info->fs_in_desc && gsi->prot_id <= USB_PROT_DIAG_IPA) {
+	if (info->fs_in_desc && gsi->prot_id <= USB_PROT_RMNET_V2X_IPA) {
 		ep = usb_ep_autoconfig_by_name(cdev->gadget,
 				info->fs_in_desc, info->in_epname);
 		if (!ep)
@@ -2833,7 +2852,7 @@ static int gsi_update_function_bind_params(struct f_gsi *gsi,
 		}
 	}
 
-	if (info->fs_out_desc && gsi->prot_id <= USB_PROT_DIAG_IPA) {
+	if (info->fs_out_desc && gsi->prot_id <= USB_PROT_RMNET_V2X_IPA) {
 		ep = usb_ep_autoconfig_by_name(cdev->gadget,
 				info->fs_out_desc, info->out_epname);
 		if (!ep)
@@ -3009,6 +3028,7 @@ static int gsi_bind(struct usb_configuration *c, struct usb_function *f)
 
 
 	if (gsi->prot_id == USB_PROT_RMNET_IPA ||
+		gsi->prot_id == USB_PROT_RMNET_V2X_IPA ||
 		gsi->prot_id == USB_PROT_DIAG_IPA ||
 		is_ext_prot_ether(gsi->prot_id))
 		gsi->ctrl_id = -ENODEV;
@@ -3220,6 +3240,7 @@ static int gsi_bind(struct usb_configuration *c, struct usb_function *f)
 		}
 		break;
 	case USB_PROT_RMNET_IPA:
+	case USB_PROT_RMNET_V2X_IPA:
 	case USB_PROT_RMNET_ETHER:
 		info.string_defs = rmnet_gsi_string_defs;
 		info.data_desc = &rmnet_gsi_interface_desc;
@@ -3485,6 +3506,7 @@ static int gsi_bind_config(struct f_gsi *gsi)
 		gsi->function.strings = ecm_gsi_strings;
 		break;
 	case USB_PROT_RMNET_IPA:
+	case USB_PROT_RMNET_V2X_IPA:
 	case USB_PROT_RMNET_ETHER:
 		gsi->function.name = "rmnet";
 		gsi->function.strings = rmnet_gsi_strings;
@@ -3883,6 +3905,7 @@ static int usb_gsi_uevent(struct device *dev, struct kobj_uevent_env *env)
 
 	switch (gsi->prot_id) {
 	case USB_PROT_RMNET_IPA:
+	case USB_PROT_RMNET_V2X_IPA:
 	case USB_PROT_RMNET_ETHER:
 		str = gsi->rmnet_dtr_status ? "connected" : "disconnected";
 		break;
diff --git a/drivers/usb/gadget/function/f_gsi.h b/drivers/usb/gadget/function/f_gsi.h
index b7e8fe8..02be58d 100644
--- a/drivers/usb/gadget/function/f_gsi.h
+++ b/drivers/usb/gadget/function/f_gsi.h
@@ -32,6 +32,7 @@
 #include "configfs.h"
 
 #define GSI_RMNET_CTRL_NAME "rmnet_ctrl"
+#define GSI_RMNET_V2X_CTRL_NAME "rmnet_v2x_ctrl"
 #define GSI_MBIM_CTRL_NAME "android_mbim"
 #define GSI_DPL_CTRL_NAME "dpl_ctrl"
 #define ETHER_RMNET_CTRL_NAME "rmnet_ctrl0"
@@ -125,6 +126,7 @@ enum usb_prot_id {
 	USB_PROT_RMNET_IPA,
 	USB_PROT_MBIM_IPA,
 	USB_PROT_DIAG_IPA,
+	USB_PROT_RMNET_V2X_IPA,
 
 	/* non-accelerated */
 	USB_PROT_RMNET_ETHER,
@@ -339,6 +341,8 @@ static int name_to_prot_id(const char *name)
 		return USB_PROT_MBIM_IPA;
 	if (!strncasecmp(name, "dpl", MAX_INST_NAME_LEN))
 		return USB_PROT_DIAG_IPA;
+	if (!strncasecmp(name, "rmnet.v2x", MAX_INST_NAME_LEN))
+		return USB_PROT_RMNET_V2X_IPA;
 	if (!strncasecmp(name, "rmnet.ether", MAX_INST_NAME_LEN))
 		return USB_PROT_RMNET_ETHER;
 	if (!strncasecmp(name, "dpl.ether", MAX_INST_NAME_LEN))
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 0e7cc71..d44905b 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -804,3 +804,9 @@
 	  This option is of interest only to developers who need to validate
 	  their USB hardware designs.  It is not needed for normal use.  If
 	  unsure, say N.
+
+config USB_UPD720X
+	tristate "Support for Renesas UPD720X XHCI USB controller"
+	---help---
+	  Enables support for the USB Host controller present on the
+	  Renesas UPD720X chipsets.
diff --git a/drivers/usb/host/Makefile b/drivers/usb/host/Makefile
index 6ef785b..fc6981a 100644
--- a/drivers/usb/host/Makefile
+++ b/drivers/usb/host/Makefile
@@ -82,3 +82,4 @@
 obj-$(CONFIG_USB_HCD_SSB)	+= ssb-hcd.o
 obj-$(CONFIG_USB_FOTG210_HCD)	+= fotg210-hcd.o
 obj-$(CONFIG_USB_MAX3421_HCD)	+= max3421-hcd.o
+obj-$(CONFIG_USB_UPD720X)	+= xhci-fwdload.o
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index 6463fdb..38a91d8 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -15,6 +15,11 @@ void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev);
 void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev);
 void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
 void sb800_prefetch(struct device *dev, int on);
+#ifdef CONFIG_USB_UPD720X
+void upd720x_finish_download(struct pci_dev *pDev);
+#else
+#define upd720x_finish_download(pDev)
+#endif
 #else
 struct pci_dev;
 static inline void usb_amd_quirk_pll_disable(void) {}
@@ -23,6 +28,7 @@ static inline void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev) {}
 static inline void usb_amd_dev_put(void) {}
 static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {}
 static inline void sb800_prefetch(struct device *dev, int on) {}
+#define upd720x_finish_download(pDev)
 #endif  /* CONFIG_PCI */
 
 #endif  /*  __LINUX_USB_PCI_QUIRKS_H  */
diff --git a/drivers/usb/host/xhci-fwdload.c b/drivers/usb/host/xhci-fwdload.c
new file mode 100644
index 0000000..f214e03
--- /dev/null
+++ b/drivers/usb/host/xhci-fwdload.c
@@ -0,0 +1,228 @@
+/*
+ * Copyright (c) 2019 The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include <linux/errno.h>
+#include <linux/time.h>
+#include <linux/firmware.h>
+#include <linux/pci.h>
+#include <linux/platform_device.h>
+#include <asm/dma-iommu.h>
+#include <linux/msm_dma_iommu_mapping.h>
+
+#define upd720x_firmware  "K2026090.mem"
+
+#define UPD_PCI_F4  0xF4
+
+#define UPD_PCI_F4_FWDOWNLOADENABLE  (0x0001)
+#define UPD_PCI_F4_FWDOWNLOADLOCK    (0x0002)
+#define UPD_PCI_F4_SETDATA0          (0x0100)
+#define UPD_PCI_F4_SETDATA1          (0x0200)
+#define UPD_PCI_F4_RESULT            (0x0070)
+
+#define UPD_PCI_F8  0xF8
+
+#define UPD_PCI_FC  0xFC
+
+enum SET_DATA {
+	SET_DATA_PAGE0,
+	SET_DATA_PAGE1
+};
+
+#define SMMU_BASE 0x10000000
+#define SMMU_SIZE 0x40000000
+
+struct firmware *fw_pointer;
+static struct dma_iommu_mapping *upd720x_smmu_init(struct device *dev)
+{
+	int rc = 0;
+	int atomic_ctx = 1;
+	int bypass_enable = 1;
+	struct dma_iommu_mapping *mapping = NULL;
+
+	mapping = arm_iommu_create_mapping(&platform_bus_type,
+		SMMU_BASE, SMMU_SIZE);
+	if (IS_ERR(mapping)) {
+		rc = PTR_ERR(mapping);
+		dev_err(dev, "create mapping failed, err = %d\n", rc);
+		return NULL;
+	}
+
+	rc = iommu_domain_set_attr(mapping->domain,
+		DOMAIN_ATTR_ATOMIC, &atomic_ctx);
+	if (rc) {
+		dev_err(dev, "Set atomic attribute to SMMU failed (%d)\n", rc);
+		arm_iommu_release_mapping(mapping);
+		return NULL;
+	}
+
+	rc = iommu_domain_set_attr(mapping->domain,
+		DOMAIN_ATTR_S1_BYPASS, &bypass_enable);
+	if (rc) {
+		dev_err(dev, "Set bypass attribute to SMMU failed (%d)\n", rc);
+		arm_iommu_release_mapping(mapping);
+		return NULL;
+	}
+
+	rc = arm_iommu_attach_device(dev, mapping);
+	if (rc) {
+		dev_err(dev, "arm_iommu_attach_device failed (%d)\n", rc);
+		arm_iommu_release_mapping(mapping);
+		return NULL;
+	}
+
+	pr_info("attached to IOMMU\n");
+	return mapping;
+}
+
+static void upd720x_smmu_deinit(struct device *dev)
+{
+	arm_iommu_detach_device(dev);
+	arm_iommu_release_mapping(to_dma_iommu_mapping(dev));
+}
+
+
+static int upd720x_download_enable(struct pci_dev *pDev)
+{
+	unsigned int read_data;
+	int result;
+
+	result = pci_read_config_dword(pDev, UPD_PCI_F4, &read_data);
+	pr_info("Set FW Download enable\n");
+	result = pci_write_config_dword(pDev, UPD_PCI_F4, read_data |
+		UPD_PCI_F4_FWDOWNLOADENABLE);
+	return result;
+}
+
+static int upd720x_download_lock(struct pci_dev *pDev)
+{
+	unsigned int read_data;
+	int result;
+
+	result = pci_read_config_dword(pDev, UPD_PCI_F4, &read_data);
+	pr_info("Set FW Download lock\n");
+	result = pci_write_config_dword(pDev, UPD_PCI_F4, read_data |
+		UPD_PCI_F4_FWDOWNLOADLOCK);
+	return result;
+}
+
+static int upd720x_set_data0(struct pci_dev *pDev)
+{
+	unsigned int read_data;
+	int result;
+
+	result = pci_read_config_dword(pDev, UPD_PCI_F4, &read_data);
+	result = pci_write_config_dword(pDev, UPD_PCI_F4,
+		(read_data & ~UPD_PCI_F4_SETDATA1) |
+		UPD_PCI_F4_SETDATA0);
+
+	return result;
+}
+
+static int upd720x_set_data1(struct pci_dev *pDev)
+{
+	unsigned int read_data;
+	int result;
+
+	result = pci_read_config_dword(pDev, UPD_PCI_F4, &read_data);
+	result = pci_write_config_dword(pDev, UPD_PCI_F4,
+		(read_data & ~UPD_PCI_F4_SETDATA0) |
+		UPD_PCI_F4_SETDATA1);
+
+	return result;
+}
+
+static int upd720x_download_clearcontrol(struct pci_dev *pDev)
+{
+	int read_buf;
+	int rc;
+
+	rc = pci_read_config_dword(pDev, UPD_PCI_F4, &read_buf);
+	if (rc == 0) {
+		rc = pci_write_config_dword(pDev, UPD_PCI_F4, read_buf &
+		~UPD_PCI_F4_FWDOWNLOADENABLE);
+	}
+	return rc;
+}
+int upd720x_firmware_download(struct pci_dev  *pDev,
+	unsigned char *pFWImage, unsigned int firmware_size)
+{
+	enum SET_DATA page = SET_DATA_PAGE0;
+	int offset;
+	unsigned int *image = (unsigned int *)pFWImage;
+	unsigned int fw_dwordsize   = firmware_size /
+		(sizeof(unsigned int) / sizeof(unsigned char));
+
+	if ((firmware_size %
+	(sizeof(unsigned int) / sizeof(unsigned char))) != 0)
+		fw_dwordsize++;
+
+	if (upd720x_download_enable(pDev) == -EFAULT) {
+		pr_info("Set FW Download Enable is timeout");
+		return -EFAULT;
+	}
+
+	for (offset = 0; offset < fw_dwordsize; offset++) {
+		switch (page) {
+		case SET_DATA_PAGE0:
+			pci_write_config_dword(pDev, UPD_PCI_F8, image[offset]);
+
+			if (upd720x_set_data0(pDev) == -EFAULT)
+				return -EFAULT;
+			page = SET_DATA_PAGE1;
+			break;
+
+		case SET_DATA_PAGE1:
+			pci_write_config_dword(pDev, UPD_PCI_FC, image[offset]);
+			if (upd720x_set_data1(pDev) == -EFAULT)
+				return -EFAULT;
+			page = SET_DATA_PAGE0;
+			break;
+		default:
+			break;
+		}
+	}
+
+	if (upd720x_download_clearcontrol(pDev) == -EFAULT)
+		return -EFAULT;
+
+	if (upd720x_download_lock(pDev) == -EFAULT)
+		return -EFAULT;
+
+	return 0;
+}
+
+int upd720x_finish_download(struct pci_dev *pDev)
+{
+	int result = -EFAULT;
+	char *firmwarename = upd720x_firmware;
+	int lc;
+	int ret;
+
+	if (!upd720x_smmu_init(&pDev->dev))
+		return -EFAULT;
+
+	for (lc = 0; (lc < 2) && (fw_pointer == NULL); lc++) {
+		ret = request_firmware((const struct firmware **)&fw_pointer,
+			firmwarename, &pDev->bus->dev);
+		if (ret == 0) {
+			result = upd720x_firmware_download(pDev,
+				(unsigned char *)fw_pointer->data,
+				fw_pointer->size);
+			break;
+		}
+		result = ret;
+	}
+	return result;
+}
+
+
+
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index b514055..3e6c437 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -192,8 +192,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
 		xhci->quirks |= XHCI_BROKEN_STREAMS;
 	}
 	if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
-			pdev->device == 0x0014)
+			pdev->device == 0x0014) {
 		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+		upd720x_finish_download(pdev);
+	}
 	if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
 			pdev->device == 0x0015)
 		xhci->quirks |= XHCI_RESET_ON_RESUME;
diff --git a/include/linux/diagchar.h b/include/linux/diagchar.h
index 8371859..d33071c 100644
--- a/include/linux/diagchar.h
+++ b/include/linux/diagchar.h
@@ -148,7 +148,7 @@
  * a new RANGE of SSIDs to the msg_mask_tbl.
  */
 #define MSG_MASK_TBL_CNT		26
-#define APPS_EVENT_LAST_ID		0xCA7
+#define APPS_EVENT_LAST_ID		0xCAA
 
 #define MSG_SSID_0			0
 #define MSG_SSID_0_LAST			130
@@ -183,7 +183,7 @@
 #define MSG_SSID_15			8000
 #define MSG_SSID_15_LAST		8000
 #define MSG_SSID_16			8500
-#define MSG_SSID_16_LAST		8531
+#define MSG_SSID_16_LAST		8532
 #define MSG_SSID_17			9000
 #define MSG_SSID_17_LAST		9008
 #define MSG_SSID_18			9500
@@ -783,7 +783,8 @@ static const uint32_t msg_bld_masks_16[] = {
 	MSG_LVL_LOW | MSG_LVL_MED | MSG_LVL_HIGH | MSG_LVL_ERROR |
 		MSG_LVL_FATAL,
 	MSG_LVL_MED,
-	MSG_LVL_MED
+	MSG_LVL_MED,
+	MSG_LVL_LOW
 };
 
 static const uint32_t msg_bld_masks_17[] =  {
@@ -921,7 +922,7 @@ static const uint32_t msg_bld_masks_25[] = {
 /* LOG CODES */
 static const uint32_t log_code_last_tbl[] = {
 	0x0,	/* EQUIP ID 0 */
-	0x1C94,	/* EQUIP ID 1 */
+	0x1C9A,	/* EQUIP ID 1 */
 	0x0,	/* EQUIP ID 2 */
 	0x0,	/* EQUIP ID 3 */
 	0x4910,	/* EQUIP ID 4 */
diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h
index 0267bed..418978e 100644
--- a/include/linux/usb/gadget.h
+++ b/include/linux/usb/gadget.h
@@ -67,6 +67,7 @@ enum gsi_ep_op {
 	GSI_EP_OP_SET_CLR_BLOCK_DBL,
 	GSI_EP_OP_CHECK_FOR_SUSPEND,
 	GSI_EP_OP_DISABLE,
+	GSI_EP_OP_UPDATE_DB,
 };
 
 /*
diff --git a/include/uapi/linux/msm_ipa.h b/include/uapi/linux/msm_ipa.h
index 96523b5..e64942a 100644
--- a/include/uapi/linux/msm_ipa.h
+++ b/include/uapi/linux/msm_ipa.h
@@ -152,6 +152,11 @@
 #define QMI_IPA_MAX_CLIENT_DST_PIPES 4
 
 /**
+ * New feature flag for CV2X config
+ */
+#define IPA_CV2X_SUPPORT
+
+/**
  * the attributes of the rule (routing or filtering)
  */
 #define IPA_FLT_TOS			(1ul << 0)
@@ -326,11 +331,14 @@ enum ipa_client_type {
 
 	/* RESERVERD PROD			     = 84, */
 	IPA_CLIENT_WIGIG4_CONS			= 85,
+
+	IPA_CLIENT_MHI2_PROD			= 86,
+	IPA_CLIENT_MHI2_CONS			= 87,
 };
 
 #define IPA_CLIENT_DUMMY_CONS IPA_CLIENT_DUMMY_CONS1
 #define IPA_CLIENT_WIGIG4_CONS IPA_CLIENT_WIGIG4_CONS
-#define IPA_CLIENT_MAX (IPA_CLIENT_WIGIG4_CONS + 1)
+#define IPA_CLIENT_MAX (IPA_CLIENT_MHI2_CONS + 1)
 
 #define IPA_CLIENT_IS_APPS_CONS(client) \
 	((client) == IPA_CLIENT_APPS_LAN_CONS || \
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 6f7d15a..87e674b 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3914,6 +3914,7 @@ pick_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *curr)
 {
 	struct sched_entity *left = __pick_first_entity(cfs_rq);
 	struct sched_entity *se;
+	bool strict_skip = false;
 
 	/*
 	 * If curr is set we have to see if its left of the leftmost entity
@@ -3933,13 +3934,15 @@ pick_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *curr)
 
 		if (se == curr) {
 			second = __pick_first_entity(cfs_rq);
+			if (sched_feat(STRICT_SKIP_BUDDY))
+				strict_skip = true;
 		} else {
 			second = __pick_next_entity(se);
 			if (!second || (curr && entity_before(curr, second)))
 				second = curr;
 		}
 
-		if (second && (sched_feat(STRICT_SKIP_BUDDY) ||
+		if (second && (strict_skip ||
 		    wakeup_preempt_entity(second, left) < 1))
 			se = second;
 	}
diff --git a/sound/soc/codecs/aw8896.c b/sound/soc/codecs/aw8896.c
index dbc7cd8..2592b48 100644
--- a/sound/soc/codecs/aw8896.c
+++ b/sound/soc/codecs/aw8896.c
@@ -43,6 +43,7 @@
 #define AW_READ_CHIPID_RETRIES 5
 #define AW_READ_CHIPID_RETRY_DELAY 5
 #define AW8896_MAX_DSP_START_TRY_COUNT    10
+#define DT_MAX_PROP_SIZE 80
 
 static int aw8896_spk_control;
 static int aw8896_rcv_control;
@@ -1068,6 +1069,14 @@ static irqreturn_t aw8896_irq(int irq, void *data)
 
 static int aw8896_parse_dt(struct device *dev, struct aw8896 *aw8896,
 		struct device_node *np) {
+	int prop_val = 0;
+	int ret = 0;
+	int len = 0;
+	const __be32 *prop = NULL;
+	struct device_node *regnode = NULL;
+	char *dvdd_supply = "dvdd";
+	char prop_name[DT_MAX_PROP_SIZE] = {0};
+
 	aw8896->reset_gpio = of_get_named_gpio(np, "reset-gpio", 0);
 	if (aw8896->reset_gpio < 0) {
 		dev_err(dev,
@@ -1082,7 +1091,47 @@ static int aw8896_parse_dt(struct device *dev, struct aw8896 *aw8896,
 	if (aw8896->irq_gpio < 0)
 		dev_info(dev, "%s: no irq gpio provided.\n", __func__);
 
+	snprintf(prop_name, DT_MAX_PROP_SIZE, "%s-supply", dvdd_supply);
+	regnode = of_parse_phandle(np, prop_name, 0);
+	if (!regnode) {
+		dev_err(dev, "%s: no %s provided\n", __func__, prop_name);
+		goto err_get_regulator;
+	}
+
+	aw8896->supply.regulator = devm_regulator_get(dev, dvdd_supply);
+	if (IS_ERR(aw8896->supply.regulator)) {
+		dev_err(dev, "%s: failed to get supply for %s\n", __func__,
+			dvdd_supply);
+		goto err_get_regulator;
+	}
+
+	snprintf(prop_name, DT_MAX_PROP_SIZE, "%s-voltage", dvdd_supply);
+	prop = of_get_property(np, prop_name, &len);
+	if (!prop || (len != (2 * sizeof(__be32)))) {
+		dev_err(dev, "%s: no %s provided or format invalid\n",
+			__func__, prop_name);
+		goto err_get_voltage;
+	}
+
+	aw8896->supply.min_uv = be32_to_cpup(&prop[0]);
+	aw8896->supply.max_uv = be32_to_cpup(&prop[1]);
+
+	snprintf(prop_name, DT_MAX_PROP_SIZE, "%s-current", dvdd_supply);
+	ret = of_property_read_u32(np, prop_name, &prop_val);
+	if (ret) {
+		dev_err(dev, "%s: no %s provided\n", __func__, prop_name);
+		goto err_get_current;
+	}
+	aw8896->supply.ua = prop_val;
+
 	return 0;
+
+err_get_current:
+err_get_voltage:
+	devm_regulator_put(aw8896->supply.regulator);
+	aw8896->supply.regulator = NULL;
+err_get_regulator:
+	return -EINVAL;
 }
 
 int aw8896_hw_reset(struct aw8896 *aw8896)
@@ -1354,7 +1403,7 @@ static int aw8896_i2c_probe(struct i2c_client *i2c,
 
 	i2c_set_clientdata(i2c, aw8896);
 	mutex_init(&aw8896->lock);
-	/* aw8896 rst & int */
+
 	if (np) {
 		ret = aw8896_parse_dt(&i2c->dev, aw8896, np);
 		if (ret) {
@@ -1388,6 +1437,30 @@ static int aw8896_i2c_probe(struct i2c_client *i2c,
 		}
 	}
 
+	ret = regulator_set_voltage(aw8896->supply.regulator,
+				    aw8896->supply.max_uv,
+				    aw8896->supply.min_uv);
+	if (ret) {
+		dev_err(&i2c->dev, "%s: set voltage %d ~ %d failed\n",
+				__func__,
+				aw8896->supply.min_uv,
+				aw8896->supply.max_uv);
+		goto err_supply_set;
+	}
+
+	ret = regulator_set_load(aw8896->supply.regulator, aw8896->supply.ua);
+	if (ret < 0) {
+		dev_err(&i2c->dev, "%s: set current %d failed\n", __func__,
+				aw8896->supply.ua);
+		goto err_supply_set;
+	}
+
+	ret = regulator_enable(aw8896->supply.regulator);
+	if (ret < 0) {
+		dev_err(&i2c->dev, "%s: regulator enable failed\n", __func__);
+		goto err_supply_set;
+	}
+
 	ret = aw8896_hw_reset(aw8896);
 	if (ret < 0) {
 		dev_err(&i2c->dev, "%s: aw8896_hw_reset failed\n", __func__);
@@ -1461,6 +1534,11 @@ static int aw8896_i2c_probe(struct i2c_client *i2c,
 	if (gpio_is_valid(aw8896->irq_gpio))
 		devm_gpio_free(&i2c->dev, aw8896->irq_gpio);
 err_hw_rst:
+	if (aw8896->supply.regulator)
+		regulator_disable(aw8896->supply.regulator);
+err_supply_set:
+	if (aw8896->supply.regulator)
+		devm_regulator_put(aw8896->supply.regulator);
 err_irq_gpio_request:
 	if (gpio_is_valid(aw8896->reset_gpio))
 		devm_gpio_free(&i2c->dev, aw8896->reset_gpio);
@@ -1486,6 +1564,11 @@ static int aw8896_i2c_remove(struct i2c_client *i2c)
 	if (gpio_is_valid(aw8896->reset_gpio))
 		devm_gpio_free(&i2c->dev, aw8896->reset_gpio);
 
+	if (aw8896->supply.regulator) {
+		regulator_disable(aw8896->supply.regulator);
+		devm_regulator_put(aw8896->supply.regulator);
+	}
+
 	devm_kfree(&i2c->dev, aw8896);
 	aw8896 = NULL;
 
diff --git a/sound/soc/codecs/aw8896.h b/sound/soc/codecs/aw8896.h
index 48e01ca..5663cb2 100644
--- a/sound/soc/codecs/aw8896.h
+++ b/sound/soc/codecs/aw8896.h
@@ -15,6 +15,7 @@
 
 #ifndef _AW8896_H_
 #define _AW8896_H_
+#include <linux/regulator/driver.h>
 
 /*
  * i2c transaction on Linux limited to 64k
@@ -81,10 +82,18 @@ enum aw8896_dsp_cfg_state {
 	AW8896_DSP_CFG_OK,
 };
 
+struct dvdd_supply {
+	struct regulator *regulator;
+	int min_uv;
+	int max_uv;
+	int ua;
+};
+
 struct aw8896 {
 	struct regmap *regmap;
 	struct i2c_client *i2c;
 	struct snd_soc_codec *codec;
+	struct dvdd_supply supply;
 	struct mutex lock;
 	int dsp_init;
 	int dsp_fw_state;