diff --git a/msm/dp/dp_audio.c b/msm/dp/dp_audio.c
index 61d13ca730cc..67f3741f9ddf 100644
--- a/msm/dp/dp_audio.c
+++ b/msm/dp/dp_audio.c
@@ -414,6 +414,9 @@ static int dp_audio_info_setup(struct platform_device *pdev,
 	dp_audio_enable(audio, true);
 
 	mutex_unlock(&audio->ops_lock);
+
+	DP_DEBUG("audio stream configured\n");
+
 	return rc;
 }
 
@@ -671,8 +674,11 @@ static int dp_audio_notify(struct dp_audio_private *audio, u32 state)
 	if (atomic_read(&audio->acked))
 		goto end;
 
-        if (state == EXT_DISPLAY_CABLE_CONNECT)
-                goto end;
+	if (state == EXT_DISPLAY_CABLE_DISCONNECT && !audio->engine_on)
+		goto end;
+
+	if (state == EXT_DISPLAY_CABLE_CONNECT)
+		goto end;
 
 	rc = wait_for_completion_timeout(&audio->hpd_comp, HZ * 4);
 	if (!rc) {
diff --git a/msm/dp/dp_ctrl.c b/msm/dp/dp_ctrl.c
index d12ba536810f..e4248297fd92 100644
--- a/msm/dp/dp_ctrl.c
+++ b/msm/dp/dp_ctrl.c
@@ -1280,11 +1280,14 @@ static int dp_ctrl_on(struct dp_ctrl *dp_ctrl, bool mst_mode,
 
 	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
 
-	atomic_set(&ctrl->aborted, 0);
-
 	if (ctrl->power_on)
 		goto end;
 
+	if (atomic_read(&ctrl->aborted)) {
+		rc = -EPERM;
+		goto end;
+	}
+
 	ctrl->mst_mode = mst_mode;
 	if (fec_mode) {
 		ctrl->fec_mode = fec_mode;
diff --git a/msm/dp/dp_display.c b/msm/dp/dp_display.c
index 45b1a689ca2e..2e158b396f08 100644
--- a/msm/dp/dp_display.c
+++ b/msm/dp/dp_display.c
@@ -859,7 +859,7 @@ static int dp_display_process_hpd_high(struct dp_display_private *dp)
 
 	dp->dp_display.max_pclk_khz = min(dp->parser->max_pclk_khz,
 					dp->debug->max_pclk_khz);
-
+	dp_display_host_init(dp);
 	dp_display_host_ready(dp);
 
 	dp->link->psm_config(dp->link, &dp->panel->link_info, false);
@@ -1084,6 +1084,7 @@ static int dp_display_handle_disconnect(struct dp_display_private *dp)
 		dp_display_clean(dp);
 
 	dp_display_host_unready(dp);
+	dp_display_host_deinit(dp);
 
 	mutex_unlock(&dp->session_lock);
 
@@ -1131,10 +1132,6 @@ static int dp_display_usbpd_disconnect_cb(struct device *dev)
 
 	dp_display_disconnect_sync(dp);
 
-	mutex_lock(&dp->session_lock);
-	dp_display_host_deinit(dp);
-	mutex_unlock(&dp->session_lock);
-
 	if (!dp->debug->sim_mode && !dp->parser->no_aux_switch
 	    && !dp->parser->gpio_aux_switch)
 		dp->aux->aux_switch(dp->aux, false, ORIENTATION_NONE);
diff --git a/msm/dsi/dsi_ctrl.c b/msm/dsi/dsi_ctrl.c
index c12685ae91f0..554bc52a8926 100644
--- a/msm/dsi/dsi_ctrl.c
+++ b/msm/dsi/dsi_ctrl.c
@@ -116,6 +116,9 @@ static ssize_t debugfs_state_info_read(struct file *file,
 			dsi_ctrl->clk_freq.pix_clk_rate,
 			dsi_ctrl->clk_freq.esc_clk_rate);
 
+	if (len > count)
+		len = count;
+
 	len = min_t(size_t, len, SZ_4K);
 	if (copy_to_user(buff, buf, len)) {
 		kfree(buf);
@@ -171,6 +174,8 @@ static ssize_t debugfs_reg_dump_read(struct file *file,
 		return rc;
 	}
 
+	if (len > count)
+		len = count;
 
 	len = min_t(size_t, len, SZ_4K);
 	if (copy_to_user(buff, buf, len)) {
diff --git a/msm/dsi/dsi_display.c b/msm/dsi/dsi_display.c
index 8c799f00836c..f2435fee1876 100644
--- a/msm/dsi/dsi_display.c
+++ b/msm/dsi/dsi_display.c
@@ -4520,7 +4520,7 @@ static int dsi_display_set_mode_sub(struct dsi_display *display,
 		commit_phy_timing = true;
 
 		/* No need to set clkrate pending flag if clocks are same */
-		if (cur_bitclk != to_bitclk)
+		if ((!cur_bitclk && !to_bitclk) || (cur_bitclk != to_bitclk))
 			atomic_set(&display->clkrate_change_pending, 1);
 
 		dsi_display_validate_dms_fps(display->panel->cur_mode, mode);
diff --git a/msm/msm_prop.c b/msm/msm_prop.c
index eb17f5f72eb7..d7c9eb0f8475 100644
--- a/msm/msm_prop.c
+++ b/msm/msm_prop.c
@@ -77,7 +77,8 @@ int msm_property_pop_dirty(struct msm_property_info *info,
 		return -EINVAL;
 	}
 
-	mutex_lock(&info->property_lock);
+	WARN_ON(!mutex_is_locked(&info->property_lock));
+
 	if (list_empty(&property_state->dirty_list)) {
 		rc = -EAGAIN;
 	} else {
@@ -87,7 +88,6 @@ int msm_property_pop_dirty(struct msm_property_info *info,
 			- property_state->values;
 		DRM_DEBUG_KMS("property %d dirty\n", rc);
 	}
-	mutex_unlock(&info->property_lock);
 
 	return rc;
 }
diff --git a/msm/msm_prop.h b/msm/msm_prop.h
index db2ad988d0c0..6069aaaa5003 100644
--- a/msm/msm_prop.h
+++ b/msm/msm_prop.h
@@ -162,7 +162,9 @@ bool msm_property_get_is_active(struct msm_property_info *info)
 
 /**
  * msm_property_pop_dirty - determine next dirty property and clear
- *                          its dirty flag
+ *                          its dirty flag. Caller needs to acquire property
+ *			  lock before calling this function and release
+ *			  the lock when finished.
  * @info: Pointer to property info container struct
  * @property_state: Pointer to property state container struct
  * Returns: Valid msm property index on success,
diff --git a/msm/sde/sde_connector.c b/msm/sde/sde_connector.c
index 321ffdfb9531..b0b710658354 100644
--- a/msm/sde/sde_connector.c
+++ b/msm/sde/sde_connector.c
@@ -701,6 +701,7 @@ static int _sde_connector_update_dirty_properties(
 	c_conn = to_sde_connector(connector);
 	c_state = to_sde_connector_state(connector->state);
 
+	mutex_lock(&c_conn->property_info.property_lock);
 	while ((idx = msm_property_pop_dirty(&c_conn->property_info,
 					&c_state->property_state)) >= 0) {
 		switch (idx) {
@@ -723,6 +724,7 @@ static int _sde_connector_update_dirty_properties(
 			break;
 		}
 	}
+	mutex_unlock(&c_conn->property_info.property_lock);
 
 	/* if colorspace needs to be updated do it first */
 	if (c_conn->colorspace_updated) {
@@ -1807,7 +1809,10 @@ static ssize_t _sde_debugfs_conn_cmd_tx_sts_read(struct file *file,
 		return 0;
 	}
 
-	blen = min_t(size_t, MAX_CMD_PAYLOAD_SIZE, count);
+	if (blen > count)
+		blen = count;
+
+	blen = min_t(size_t, blen, MAX_CMD_PAYLOAD_SIZE);
 	if (copy_to_user(buf, buffer, blen)) {
 		SDE_ERROR("copy to user buffer failed\n");
 		return -EFAULT;
diff --git a/msm/sde/sde_core_perf.c b/msm/sde/sde_core_perf.c
index 3efd37746cce..eefe21aab692 100644
--- a/msm/sde/sde_core_perf.c
+++ b/msm/sde/sde_core_perf.c
@@ -26,6 +26,9 @@
 #define SDE_PERF_MODE_STRING_SIZE	128
 #define SDE_PERF_THRESHOLD_HIGH_MIN     12800000
 
+#define GET_H32(val) (val >> 32)
+#define GET_L32(val) (val & 0xffffffff)
+
 static DEFINE_MUTEX(sde_core_perf_lock);
 
 /**
@@ -150,7 +153,20 @@ static void _sde_core_perf_calc_crtc(struct sde_kms *kms,
 						perf->core_clk_rate);
 	}
 
-	SDE_EVT32(crtc->base.id, perf->core_clk_rate);
+	SDE_EVT32(DRMID(crtc), perf->core_clk_rate,
+		GET_H32(perf->bw_ctl[SDE_POWER_HANDLE_DBUS_ID_MNOC]),
+		GET_L32(perf->bw_ctl[SDE_POWER_HANDLE_DBUS_ID_MNOC]),
+		GET_H32(perf->bw_ctl[SDE_POWER_HANDLE_DBUS_ID_LLCC]),
+		GET_L32(perf->bw_ctl[SDE_POWER_HANDLE_DBUS_ID_LLCC]),
+		GET_H32(perf->bw_ctl[SDE_POWER_HANDLE_DBUS_ID_EBI]),
+		GET_L32(perf->bw_ctl[SDE_POWER_HANDLE_DBUS_ID_EBI]));
+	SDE_EVT32(DRMID(crtc),
+		GET_H32(perf->max_per_pipe_ib[SDE_POWER_HANDLE_DBUS_ID_MNOC]),
+		GET_L32(perf->max_per_pipe_ib[SDE_POWER_HANDLE_DBUS_ID_MNOC]),
+		GET_H32(perf->max_per_pipe_ib[SDE_POWER_HANDLE_DBUS_ID_LLCC]),
+		GET_L32(perf->max_per_pipe_ib[SDE_POWER_HANDLE_DBUS_ID_LLCC]),
+		GET_H32(perf->max_per_pipe_ib[SDE_POWER_HANDLE_DBUS_ID_EBI]),
+		GET_L32(perf->max_per_pipe_ib[SDE_POWER_HANDLE_DBUS_ID_EBI]));
 	trace_sde_perf_calc_crtc(crtc->base.id,
 			perf->bw_ctl[SDE_POWER_HANDLE_DBUS_ID_MNOC],
 			perf->bw_ctl[SDE_POWER_HANDLE_DBUS_ID_LLCC],
@@ -992,6 +1008,7 @@ static ssize_t _sde_core_perf_mode_write(struct file *file,
 	struct sde_perf_cfg *cfg = &perf->catalog->perf;
 	u32 perf_mode = 0;
 	char buf[10];
+	int ret = 0;
 
 	if (!perf)
 		return -ENODEV;
@@ -1017,6 +1034,13 @@ static ssize_t _sde_core_perf_mode_write(struct file *file,
 		perf->perf_tune.min_core_clk = perf->max_core_clk_rate;
 		perf->perf_tune.min_bus_vote =
 				(u64) cfg->max_bw_high * 1000;
+
+		ret = sde_power_clk_set_rate(perf->phandle,
+				perf->clk_name, perf->max_core_clk_rate);
+		if (ret)
+			SDE_ERROR("failed to set %s clock rate %llu\n",
+					perf->clk_name,
+					perf->max_core_clk_rate);
 		DRM_INFO("minimum performance mode\n");
 	} else if (perf_mode == SDE_PERF_MODE_NORMAL) {
 		/* reset the perf tune params to 0 */
diff --git a/msm/sde/sde_encoder.c b/msm/sde/sde_encoder.c
index 6dba660106e0..1e5acfdf7da7 100644
--- a/msm/sde/sde_encoder.c
+++ b/msm/sde/sde_encoder.c
@@ -1928,11 +1928,13 @@ static int _sde_encoder_update_rsc_client(
 	struct drm_crtc *crtc;
 	enum sde_rsc_state rsc_state = SDE_RSC_IDLE_STATE;
 	struct sde_rsc_cmd_config *rsc_config;
-	int ret, prefill_lines;
+	int ret;
 	struct msm_display_info *disp_info;
 	struct msm_mode_info *mode_info;
 	int wait_vblank_crtc_id = SDE_RSC_INVALID_CRTC_ID;
-	u32 qsync_mode = 0;
+	u32 qsync_mode = 0, v_front_porch;
+	struct drm_display_mode *mode;
+	bool is_vid_mode;
 
 	if (!drm_enc || !drm_enc->dev) {
 		SDE_ERROR("invalid encoder arguments\n");
@@ -1977,17 +1979,31 @@ static int _sde_encoder_update_rsc_client(
 
 	SDE_EVT32(rsc_state, qsync_mode);
 
-	prefill_lines = mode_info->prefill_lines;
+	is_vid_mode = sde_encoder_check_curr_mode(&sde_enc->base,
+				MSM_DISPLAY_VIDEO_MODE);
+	mode = &sde_enc->crtc->state->mode;
+	v_front_porch = mode->vsync_start - mode->vdisplay;
 
 	/* compare specific items and reconfigure the rsc */
 	if ((rsc_config->fps != mode_info->frame_rate) ||
 	    (rsc_config->vtotal != mode_info->vtotal) ||
-	    (rsc_config->prefill_lines != prefill_lines) ||
+	    (rsc_config->prefill_lines != mode_info->prefill_lines) ||
 	    (rsc_config->jitter_numer != mode_info->jitter_numer) ||
 	    (rsc_config->jitter_denom != mode_info->jitter_denom)) {
+
 		rsc_config->fps = mode_info->frame_rate;
 		rsc_config->vtotal = mode_info->vtotal;
-		rsc_config->prefill_lines = prefill_lines;
+		/*
+		 * for video mode, prefill lines should not go beyond vertical
+		 * front porch for RSCC configuration. This will ensure bw
+		 * downvotes are not sent within the active region. Additional
+		 * -1 is to give one line time for rscc mode min_threshold.
+		 */
+		if (is_vid_mode && (mode_info->prefill_lines >= v_front_porch))
+			rsc_config->prefill_lines = v_front_porch - 1;
+		else
+			rsc_config->prefill_lines = mode_info->prefill_lines;
+
 		rsc_config->jitter_numer = mode_info->jitter_numer;
 		rsc_config->jitter_denom = mode_info->jitter_denom;
 		sde_enc->rsc_state_init = false;
@@ -5726,8 +5742,9 @@ void sde_encoder_helper_get_jitter_bounds_ns(struct drm_encoder *drm_enc,
 	info = &sde_enc->mode_info;
 
 	frametime_ns = (1 * 1000000000) / info->frame_rate;
-	jitter_ns =  (info->jitter_numer * frametime_ns) /
-				(info->jitter_denom * 100);
+	jitter_ns =  info->jitter_numer * frametime_ns;
+	do_div(jitter_ns, info->jitter_denom * 100);
+
 	*l_bound = frametime_ns - jitter_ns;
 	*u_bound = frametime_ns + jitter_ns;
 }
diff --git a/msm/sde/sde_encoder_phys_cmd.c b/msm/sde/sde_encoder_phys_cmd.c
index 7e9b3fb01d25..5ebee7bb24bd 100644
--- a/msm/sde/sde_encoder_phys_cmd.c
+++ b/msm/sde/sde_encoder_phys_cmd.c
@@ -1345,10 +1345,11 @@ static int sde_encoder_phys_cmd_prepare_for_kickoff(
 	}
 	SDE_DEBUG_CMDENC(cmd_enc, "pp %d\n", phys_enc->hw_pp->idx - PINGPONG_0);
 
+	phys_enc->frame_trigger_mode = params->frame_trigger_mode;
 	SDE_EVT32(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0,
 			atomic_read(&phys_enc->pending_kickoff_cnt),
-			atomic_read(&cmd_enc->autorefresh.kickoff_cnt));
-	phys_enc->frame_trigger_mode = params->frame_trigger_mode;
+			atomic_read(&cmd_enc->autorefresh.kickoff_cnt),
+			phys_enc->frame_trigger_mode);
 
 	if (phys_enc->frame_trigger_mode == FRAME_DONE_WAIT_DEFAULT) {
 		/*
@@ -1422,9 +1423,12 @@ static bool _sde_encoder_phys_cmd_needs_vsync_change(
 		    "time_diff:%llu, prev:%llu, cur:%llu, jitter:%llu/%llu\n",
 			time_diff, prev->timestamp, cur->timestamp,
 			l_bound, u_bound);
+		time_diff = div_s64(time_diff, 1000);
+
 		SDE_EVT32(DRMID(phys_enc->parent),
-			(u32) (l_bound / 1000), (u32) (u_bound / 1000),
-			(u32) (time_diff / 1000), SDE_EVTLOG_ERROR);
+			(u32) (do_div(l_bound, 1000)),
+			(u32) (do_div(u_bound, 1000)),
+			(u32) (time_diff), SDE_EVTLOG_ERROR);
 	}
 
 	return ret;
@@ -1557,6 +1561,8 @@ static int sde_encoder_phys_cmd_wait_for_commit_done(
 	int rc = 0, i, pending_cnt;
 	struct sde_encoder_phys_cmd *cmd_enc;
 	ktime_t profile_timestamp = ktime_get();
+	u32 scheduler_status = INVALID_CTL_STATUS;
+	struct sde_hw_ctl *ctl;
 
 	if (!phys_enc)
 		return -EINVAL;
@@ -1582,11 +1588,17 @@ static int sde_encoder_phys_cmd_wait_for_commit_done(
 		if (cmd_enc->autorefresh.cfg.enable)
 			rc = _sde_encoder_phys_cmd_wait_for_autorefresh_done(
 								phys_enc);
+
+		ctl = phys_enc->hw_ctl;
+		if (ctl && ctl->ops.get_scheduler_status)
+			scheduler_status = ctl->ops.get_scheduler_status(ctl);
 	}
 
 	/* wait for posted start or serialize trigger */
-	if ((atomic_read(&phys_enc->pending_kickoff_cnt) > 1) ||
-	  (!rc && phys_enc->frame_trigger_mode == FRAME_DONE_WAIT_SERIALIZE))
+	pending_cnt = atomic_read(&phys_enc->pending_kickoff_cnt);
+	if ((pending_cnt > 1) ||
+	    (pending_cnt && (scheduler_status & BIT(0))) ||
+	    (!rc && phys_enc->frame_trigger_mode == FRAME_DONE_WAIT_SERIALIZE))
 		goto wait_for_idle;
 
 	return rc;
@@ -1601,7 +1613,8 @@ wait_for_idle:
 			phys_enc->hw_pp->idx - PINGPONG_0,
 			phys_enc->frame_trigger_mode,
 			atomic_read(&phys_enc->pending_kickoff_cnt),
-			phys_enc->enable_state, rc);
+			phys_enc->enable_state,
+			cmd_enc->wr_ptr_wait_success, scheduler_status, rc);
 		SDE_ERROR("pp:%d failed wait_for_idle: %d\n",
 				phys_enc->hw_pp->idx - PINGPONG_0, rc);
 		if (phys_enc->enable_state == SDE_ENC_ERR_NEEDS_HW_RESET)
diff --git a/msm/sde/sde_hw_catalog.c b/msm/sde/sde_hw_catalog.c
index eccd9efbaa72..6bb3bc0059cf 100644
--- a/msm/sde/sde_hw_catalog.c
+++ b/msm/sde/sde_hw_catalog.c
@@ -4235,6 +4235,19 @@ static int _sde_hardware_pre_caps(struct sde_mdss_cfg *sde_cfg, uint32_t hw_rev)
 		sde_cfg->sui_block_xin_mask = 0xC61;
 		sde_cfg->has_hdr = false;
 		sde_cfg->has_sui_blendstage = true;
+	} else if (IS_BENGAL_TARGET(hw_rev)) {
+		sde_cfg->has_cwb_support = false;
+		sde_cfg->has_qsync = true;
+		sde_cfg->perf.min_prefill_lines = 24;
+		sde_cfg->vbif_qos_nlvl = 8;
+		sde_cfg->ts_prefill_rev = 2;
+		sde_cfg->ctl_rev = SDE_CTL_CFG_VERSION_1_0_0;
+		sde_cfg->delay_prg_fetch_start = true;
+		sde_cfg->sui_ns_allowed = true;
+		sde_cfg->sui_misr_supported = true;
+		sde_cfg->sui_block_xin_mask = 0xC01;
+		sde_cfg->has_hdr = false;
+		sde_cfg->has_sui_blendstage = true;
 	} else {
 		SDE_ERROR("unsupported chipset id:%X\n", hw_rev);
 		sde_cfg->perf.min_prefill_lines = 0xffff;
diff --git a/msm/sde/sde_hw_catalog.h b/msm/sde/sde_hw_catalog.h
index b37fb5ae7647..22d634250e7b 100644
--- a/msm/sde/sde_hw_catalog.h
+++ b/msm/sde/sde_hw_catalog.h
@@ -53,6 +53,7 @@
 #define SDE_HW_VER_540	SDE_HW_VER(5, 4, 0) /* sdmtrinket v1.0 */
 #define SDE_HW_VER_600	SDE_HW_VER(6, 0, 0) /* kona */
 #define SDE_HW_VER_610	SDE_HW_VER(6, 1, 0) /* sm7250 */
+#define SDE_HW_VER_630	SDE_HW_VER(6, 3, 0) /* bengal */
 
 #define IS_MSM8996_TARGET(rev) IS_SDE_MAJOR_MINOR_SAME((rev), SDE_HW_VER_170)
 #define IS_MSM8998_TARGET(rev) IS_SDE_MAJOR_MINOR_SAME((rev), SDE_HW_VER_300)
@@ -65,6 +66,7 @@
 #define IS_SDMTRINKET_TARGET(rev) IS_SDE_MAJOR_MINOR_SAME((rev), SDE_HW_VER_540)
 #define IS_KONA_TARGET(rev) IS_SDE_MAJOR_MINOR_SAME((rev), SDE_HW_VER_600)
 #define IS_SAIPAN_TARGET(rev) IS_SDE_MAJOR_MINOR_SAME((rev), SDE_HW_VER_610)
+#define IS_BENGAL_TARGET(rev) IS_SDE_MAJOR_MINOR_SAME((rev), SDE_HW_VER_630)
 
 #define SDE_HW_BLK_NAME_LEN	16
 
diff --git a/msm/sde/sde_hw_lm.c b/msm/sde/sde_hw_lm.c
index 8c78fe768497..49974820feee 100644
--- a/msm/sde/sde_hw_lm.c
+++ b/msm/sde/sde_hw_lm.c
@@ -287,7 +287,8 @@ static void _setup_mixer_ops(struct sde_mdss_cfg *m,
 			IS_SDMMAGPIE_TARGET(m->hwversion) ||
 			IS_KONA_TARGET(m->hwversion) ||
 			IS_SAIPAN_TARGET(m->hwversion) ||
-			IS_SDMTRINKET_TARGET(m->hwversion))
+			IS_SDMTRINKET_TARGET(m->hwversion) ||
+			IS_BENGAL_TARGET(m->hwversion))
 		ops->setup_blend_config = sde_hw_lm_setup_blend_config_sdm845;
 	else
 		ops->setup_blend_config = sde_hw_lm_setup_blend_config;
diff --git a/msm/sde/sde_hw_vbif.c b/msm/sde/sde_hw_vbif.c
index d8b6462fb68b..f4c7846493c4 100644
--- a/msm/sde/sde_hw_vbif.c
+++ b/msm/sde/sde_hw_vbif.c
@@ -236,7 +236,8 @@ static void _setup_vbif_ops(const struct sde_mdss_cfg *m,
 		ops->set_qos_remap = sde_hw_set_qos_remap;
 	if (IS_SM8150_TARGET(m->hwversion) || IS_SM6150_TARGET(m->hwversion) ||
 			IS_SDMMAGPIE_TARGET(m->hwversion) ||
-			IS_SDMTRINKET_TARGET(m->hwversion))
+			IS_SDMTRINKET_TARGET(m->hwversion) ||
+			IS_BENGAL_TARGET(m->hwversion))
 		ops->set_mem_type = sde_hw_set_mem_type_v1;
 	else
 		ops->set_mem_type = sde_hw_set_mem_type;
diff --git a/msm/sde/sde_kms.c b/msm/sde/sde_kms.c
index 21526db01f54..4ef852de478d 100644
--- a/msm/sde/sde_kms.c
+++ b/msm/sde/sde_kms.c
@@ -2934,6 +2934,9 @@ static int _sde_kms_mmu_init(struct sde_kms *sde_kms)
 	int i, ret;
 	int early_map = 0;
 
+	if (!sde_kms || !sde_kms->dev || !sde_kms->dev->dev)
+		return -EINVAL;
+
 	for (i = 0; i < MSM_SMMU_DOMAIN_MAX; i++) {
 		struct msm_gem_address_space *aspace;
 
diff --git a/msm/sde/sde_plane.c b/msm/sde/sde_plane.c
index e9c3a0cf8c8b..c07831702623 100644
--- a/msm/sde/sde_plane.c
+++ b/msm/sde/sde_plane.c
@@ -3182,14 +3182,13 @@ static int sde_plane_sspp_atomic_update(struct drm_plane *plane,
 	}
 
 	/* determine what needs to be refreshed */
+	mutex_lock(&psde->property_info.property_lock);
 	while ((idx = msm_property_pop_dirty(&psde->property_info,
 				&pstate->property_state)) >= 0) {
 		dirty_prop_flag = plane_prop_array[idx];
 		pstate->dirty |= dirty_prop_flag;
-
-		if (dirty_prop_flag == SDE_PLANE_DIRTY_ALL)
-			break;
 	}
+	mutex_unlock(&psde->property_info.property_lock);
 
 	/**
 	 * since plane_atomic_check is invoked before crtc_atomic_check
diff --git a/msm/sde/sde_rm.c b/msm/sde/sde_rm.c
index 4edb09f62f01..2b9d51bd3470 100644
--- a/msm/sde/sde_rm.c
+++ b/msm/sde/sde_rm.c
@@ -1735,8 +1735,8 @@ int sde_rm_cont_splash_res_init(struct msm_drm_private *priv,
 			splash_display->cont_splash_enabled = true;
 			splash_display->ctl_ids[splash_display->ctl_cnt++] =
 				iter_c.blk->id;
-			index++;
 		}
+		index++;
 	}
 
 	return 0;
diff --git a/msm/sde/sde_trace.h b/msm/sde/sde_trace.h
index 9a8f414aa019..df6bd1507373 100644
--- a/msm/sde/sde_trace.h
+++ b/msm/sde/sde_trace.h
@@ -35,7 +35,7 @@ TRACE_EVENT(sde_perf_set_qos_luts,
 			__entry->lut = lut;
 			__entry->lut_usage = lut_usage;
 	),
-	TP_printk("pnum=%d fmt=%x rt=%d fl=%d lut=0x%llx lut_usage=%d",
+	TP_printk("pnum=%d fmt=0x%x rt=%d fl=%d lut=0x%llx lut_usage=%d",
 			__entry->pnum, __entry->fmt,
 			__entry->rt, __entry->fl,
 			__entry->lut, __entry->lut_usage)
@@ -59,7 +59,7 @@ TRACE_EVENT(sde_perf_set_danger_luts,
 			__entry->danger_lut = danger_lut;
 			__entry->safe_lut = safe_lut;
 	),
-	TP_printk("pnum=%d fmt=%x mode=%d luts[0x%x, 0x%x]",
+	TP_printk("pnum=%d fmt=0x%x mode=%d luts[0x%x, 0x%x]",
 			__entry->pnum, __entry->fmt,
 			__entry->mode, __entry->danger_lut,
 			__entry->safe_lut)
@@ -174,7 +174,7 @@ TRACE_EVENT(sde_evtlog,
 			memset(&__entry->data[cnt], 0,
 				(SDE_TRACE_EVTLOG_SIZE - cnt) * sizeof(u32));
 	),
-	TP_printk("%d|%s:%d|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x",
+	TP_printk("%d|%s:%d|0x%x|0x%x|0x%x|0x%x|0x%x|0x%x|0x%x|0x%x|0x%x|0x%x|0x%x|0x%x|0x%x|0x%x|0x%x",
 			__entry->pid, __get_str(evtlog_tag),
 			__entry->tag_id,
 			__entry->data[0], __entry->data[1],
@@ -336,7 +336,7 @@ TRACE_EVENT(sde_perf_uidle_cntr,
 			__entry->max_gate_cntr = max_gate_cntr;
 	),
 	 TP_printk(
-		"crtc:%d gate:fal1=%d fal10=%d wait=%d min=%d max=%d trns:fal1=%d fal10=%d",
+		"crtc:%d gate:fal1=0x%x fal10=0x%x wait=0x%x min=0x%x max=0x%x trns:fal1=0x%x fal10=0x%x",
 			__entry->crtc,
 			__entry->fal1_gate_cntr,
 			__entry->fal10_gate_cntr,
@@ -396,7 +396,7 @@ TRACE_EVENT(sde_perf_uidle_status,
 			__entry->uidle_status = uidle_status;
 			__entry->uidle_en_fal10 = uidle_en_fal10;),
 	 TP_printk(
-		"crtc:%d danger[%d, %d] safe[%d, %d] idle[%d, %d] fal[%d, %d] status:%d en_fal10:%d",
+		"crtc:%d danger[0x%x, 0x%x] safe[0x%x, 0x%x] idle[0x%x, 0x%x] fal[0x%x, 0x%x] status:0x%x en_fal10:0x%x",
 			__entry->crtc,
 			__entry->uidle_danger_status_0,
 			__entry->uidle_danger_status_1,
diff --git a/msm/sde_rsc.c b/msm/sde_rsc.c
index f60b7e4fe4e8..d361bcade0a6 100644
--- a/msm/sde_rsc.c
+++ b/msm/sde_rsc.c
@@ -311,8 +311,7 @@ static u32 sde_rsc_timer_calculate(struct sde_rsc_priv *rsc,
 
 	default_prefill_lines = (rsc->cmd_config.fps *
 		DEFAULT_PANEL_MIN_V_PREFILL) / DEFAULT_PANEL_FPS;
-	if ((state == SDE_RSC_CMD_STATE) ||
-	    (rsc->cmd_config.prefill_lines < default_prefill_lines))
+	if ((state == SDE_RSC_CMD_STATE) || !rsc->cmd_config.prefill_lines)
 		rsc->cmd_config.prefill_lines = default_prefill_lines;
 
 	pr_debug("frame fps:%d jitter_numer:%d jitter_denom:%d vtotal:%d prefill lines:%d\n",
@@ -1184,7 +1183,10 @@ end:
 	if (blen <= 0)
 		return 0;
 
-	blen = min_t(size_t, MAX_BUFFER_SIZE, count);
+	if (blen > count)
+		blen = count;
+
+	blen = min_t(size_t, blen, MAX_BUFFER_SIZE);
 	if (copy_to_user(buf, buffer, blen))
 		return -EFAULT;
 
@@ -1278,7 +1280,10 @@ end:
 	if (blen <= 0)
 		return 0;
 
-	blen = min_t(size_t, MAX_BUFFER_SIZE, count);
+	if (blen > count)
+		blen = count;
+
+	blen = min_t(size_t, blen, MAX_BUFFER_SIZE);
 	if (copy_to_user(buf, buffer, blen))
 		return -EFAULT;
 
diff --git a/rotator/sde_rotator_base.h b/rotator/sde_rotator_base.h
index df490f318a26..bdb319dc28a9 100644
--- a/rotator/sde_rotator_base.h
+++ b/rotator/sde_rotator_base.h
@@ -45,6 +45,7 @@
 #define SDE_MDP_HW_REV_530	SDE_MDP_REV(5, 3, 0)	/* sm6150 v1.0 */
 #define SDE_MDP_HW_REV_540	SDE_MDP_REV(5, 4, 0)	/* sdmtrinket v1.0 */
 #define SDE_MDP_HW_REV_600	SDE_MDP_REV(6, 0, 0)    /* msmnile+ v1.0 */
+#define SDE_MDP_HW_REV_630	SDE_MDP_REV(6, 3, 0)	/* bengal v1.0 */
 
 #define SDE_MDP_VBIF_4_LEVEL_REMAPPER	4
 #define SDE_MDP_VBIF_8_LEVEL_REMAPPER	8
diff --git a/rotator/sde_rotator_r3.c b/rotator/sde_rotator_r3.c
index a667b5b5e049..45f151f63284 100644
--- a/rotator/sde_rotator_r3.c
+++ b/rotator/sde_rotator_r3.c
@@ -3271,6 +3271,21 @@ static int sde_rotator_hw_rev_init(struct sde_hw_rotator *rot)
 				ARRAY_SIZE(sde_hw_rotator_v4_outpixfmts_sbuf);
 		rot->downscale_caps =
 			"LINEAR/1.5/2/4/8/16/32/64 TILE/1.5/2/4 TP10/1.5/2";
+	} else if (IS_SDE_MAJOR_MINOR_SAME(mdata->mdss_version,
+				SDE_MDP_HW_REV_630)) {
+		SDEROT_DBG("Sys cache inline rotation not supported\n");
+		set_bit(SDE_CAPS_PARTIALWR,  mdata->sde_caps_map);
+		set_bit(SDE_CAPS_HW_TIMESTAMP, mdata->sde_caps_map);
+		rot->inpixfmts[SDE_ROTATOR_MODE_OFFLINE] =
+				sde_hw_rotator_v4_inpixfmts;
+		rot->num_inpixfmt[SDE_ROTATOR_MODE_OFFLINE] =
+				ARRAY_SIZE(sde_hw_rotator_v4_inpixfmts);
+		rot->outpixfmts[SDE_ROTATOR_MODE_OFFLINE] =
+				sde_hw_rotator_v4_outpixfmts;
+		rot->num_outpixfmt[SDE_ROTATOR_MODE_OFFLINE] =
+				ARRAY_SIZE(sde_hw_rotator_v4_outpixfmts);
+		rot->downscale_caps =
+			"LINEAR/1.5/2/4/8/16/32/64 TILE/1.5/2/4 TP10/1.5/2";
 	} else {
 		rot->inpixfmts[SDE_ROTATOR_MODE_OFFLINE] =
 				sde_hw_rotator_v3_inpixfmts;