From 385d8d832b41e91f8a3f1cf838ca5a542f8d6a7b Mon Sep 17 00:00:00 2001
From: Ruofei Ma <ruofeim@codeaurora.org>
Date: Mon, 9 Dec 2019 17:44:21 -0800
Subject: [PATCH] msm: cvp: Fence path for Lahaina

Camera requires new features supported in cvp driver but the existing
camera fence path framework in cvp driver is not scable.Redesign fench
path to enhance its scability by adding worker thread pool.

Change-Id: If8b31ddb082089463aca1f3d600a9fed1ed05996
Signed-off-by: Ruofei Ma <ruofeim@codeaurora.org>
---
 drivers/media/platform/msm/cvp/cvp_hfi.c      |  72 +-
 drivers/media/platform/msm/cvp/cvp_hfi_api.h  |   7 -
 .../media/platform/msm/cvp/cvp_hfi_helper.h   |  27 +-
 .../platform/msm/cvp/hfi_response_handler.c   | 154 +--
 drivers/media/platform/msm/cvp/msm_cvp.c      | 980 ++++++++----------
 .../media/platform/msm/cvp/msm_cvp_common.c   |  58 --
 .../media/platform/msm/cvp/msm_cvp_common.h   |   2 -
 drivers/media/platform/msm/cvp/msm_cvp_core.c |  25 +-
 .../media/platform/msm/cvp/msm_cvp_internal.h |  38 +-
 .../media/platform/msm/cvp/msm_cvp_ioctl.c    |  86 --
 include/uapi/media/msm_cvp_private.h          |  40 +-
 11 files changed, 571 insertions(+), 918 deletions(-)

diff --git a/drivers/media/platform/msm/cvp/cvp_hfi.c b/drivers/media/platform/msm/cvp/cvp_hfi.c
index 1c85dff8959e..40b061089f5f 100644
--- a/drivers/media/platform/msm/cvp/cvp_hfi.c
+++ b/drivers/media/platform/msm/cvp/cvp_hfi.c
@@ -34,6 +34,7 @@
 #define FIRMWARE_SIZE			0X00A00000
 #define REG_ADDR_OFFSET_BITMASK	0x000FFFFF
 #define QDSS_IOVA_START 0x80001000
+#define MIN_PAYLOAD_SIZE 3
 
 const struct msm_cvp_hfi_defs cvp_hfi_defs[] = {
 	{
@@ -346,32 +347,6 @@ int get_pkt_index(struct cvp_hal_session_cmd_pkt *hdr)
 	return -EINVAL;
 }
 
-int set_feature_bitmask(int pkt_idx, unsigned long *bitmask)
-{
-	if (!bitmask) {
-		dprintk(CVP_ERR, "%s: invalid bitmask\n", __func__);
-		return -EINVAL;
-	}
-
-	if (cvp_hfi_defs[pkt_idx].type == HFI_CMD_SESSION_CVP_DME_FRAME) {
-		set_bit(DME_BIT_OFFSET, bitmask);
-		return 0;
-	}
-
-	if (cvp_hfi_defs[pkt_idx].type == HFI_CMD_SESSION_CVP_ICA_FRAME) {
-		set_bit(ICA_BIT_OFFSET, bitmask);
-		return 0;
-	}
-
-	if (cvp_hfi_defs[pkt_idx].type == HFI_CMD_SESSION_CVP_FD_FRAME) {
-		set_bit(FD_BIT_OFFSET, bitmask);
-		return 0;
-	}
-
-	dprintk(CVP_ERR, "%s: invalid pkt_idx %d\n", __func__, pkt_idx);
-	return -EINVAL;
-}
-
 int get_hfi_version(void)
 {
 	struct msm_cvp_core *core;
@@ -1201,20 +1176,13 @@ static int __tzbsp_set_cvp_state(enum tzbsp_subsys_state state)
 	int rc = 0;
 
 	rc = qcom_scm_set_remote_state(state, TZBSP_CVP_PAS_ID);
+	dprintk(CVP_DBG, "Set state %d, resp %d\n", state, rc);
 
-	if (rc < 0) {
+	if (rc) {
 		dprintk(CVP_ERR, "Failed qcom_scm_set_remote_state %d\n", rc);
 		return rc;
 	}
 
-	dprintk(CVP_DBG, "Set state %d, resp %d\n", state, rc);
-	if (rc) {
-		dprintk(CVP_ERR,
-			"Failed to set cvp core state to suspend: %d\n",
-			rc);
-		return -EINVAL;
-	}
-
 	return 0;
 }
 
@@ -2896,15 +2864,35 @@ static void __flush_debug_queue(struct iris_hfi_device *device, u8 *packet)
 		log_level = CVP_ERR;
 	}
 
-	while (!__iface_dbgq_read(device, packet)) {
-		struct cvp_hfi_msg_sys_coverage_packet *pkt =
-			(struct cvp_hfi_msg_sys_coverage_packet *) packet;
+#define SKIP_INVALID_PKT(pkt_size, payload_size, pkt_hdr_size) ({ \
+		if (pkt_size < pkt_hdr_size || \
+			payload_size < MIN_PAYLOAD_SIZE || \
+			payload_size > \
+			(pkt_size - pkt_hdr_size + sizeof(u8))) { \
+			dprintk(CVP_ERR, \
+				"%s: invalid msg size - %d\n", \
+				__func__, pkt->msg_size); \
+			continue; \
+		} \
+	})
 
-		if (pkt->packet_type == HFI_MSG_SYS_COV) {
-			dprintk(CVP_ERR, "STM_LOG not supported\n");
-		} else {
+	while (!__iface_dbgq_read(device, packet)) {
+		struct cvp_hfi_packet_header *pkt =
+			(struct cvp_hfi_packet_header *) packet;
+
+		if (pkt->size < sizeof(struct cvp_hfi_packet_header)) {
+			dprintk(CVP_ERR, "Invalid pkt size - %s\n",
+				__func__);
+			continue;
+		}
+
+		if (pkt->packet_type == HFI_MSG_SYS_DEBUG) {
 			struct cvp_hfi_msg_sys_debug_packet *pkt =
 				(struct cvp_hfi_msg_sys_debug_packet *) packet;
+
+			SKIP_INVALID_PKT(pkt->size,
+				pkt->msg_size, sizeof(*pkt));
+
 			/*
 			 * All fw messages starts with new line character. This
 			 * causes dprintk to print this message in two lines
@@ -2912,9 +2900,11 @@ static void __flush_debug_queue(struct iris_hfi_device *device, u8 *packet)
 			 * from the message fixes this to print it in a single
 			 * line.
 			 */
+			pkt->rg_msg_data[pkt->msg_size-1] = '\0';
 			dprintk(log_level, "%s", &pkt->rg_msg_data[1]);
 		}
 	}
+#undef SKIP_INVALID_PKT
 
 	if (local_packet)
 		kfree(packet);
diff --git a/drivers/media/platform/msm/cvp/cvp_hfi_api.h b/drivers/media/platform/msm/cvp/cvp_hfi_api.h
index 736038efe40e..85186eca80d5 100644
--- a/drivers/media/platform/msm/cvp/cvp_hfi_api.h
+++ b/drivers/media/platform/msm/cvp/cvp_hfi_api.h
@@ -98,12 +98,6 @@
 #define HFI_MODEL_BUFFERS_OFFSET 7
 #define HFI_MODEL_BUF_NUM 1
 
-#define DFS_BIT_OFFSET (CVP_KMD_HFI_DFS_FRAME_CMD - CVP_KMD_CMD_START)
-#define DME_BIT_OFFSET (CVP_KMD_HFI_DME_FRAME_CMD - CVP_KMD_CMD_START)
-#define PERSIST_BIT_OFFSET (CVP_KMD_HFI_PERSIST_CMD - CVP_KMD_CMD_START)
-#define ICA_BIT_OFFSET (CVP_KMD_HFI_ICA_FRAME_CMD - CVP_KMD_CMD_START)
-#define FD_BIT_OFFSET (CVP_KMD_HFI_FD_FRAME_CMD - CVP_KMD_CMD_START)
-
 #define HFI_VERSION_MAJOR_MASK 0xFF000000
 #define HFI_VERSION_MAJOR_SHFIT 24
 #define HFI_VERSION_MINOR_MASK 0x00FFFFE0
@@ -428,7 +422,6 @@ void cvp_hfi_deinitialize(enum msm_cvp_hfi_type hfi_type,
 
 int get_pkt_index(struct cvp_hal_session_cmd_pkt *hdr);
 int get_signal_from_pkt_type(unsigned int type);
-int set_feature_bitmask(int pkt_index, unsigned long *bitmask);
 int get_hfi_version(void);
 unsigned int get_msg_size(void);
 unsigned int get_msg_session_id(void *msg);
diff --git a/drivers/media/platform/msm/cvp/cvp_hfi_helper.h b/drivers/media/platform/msm/cvp/cvp_hfi_helper.h
index b341fdd8cf1f..e8978cd1bc2c 100644
--- a/drivers/media/platform/msm/cvp/cvp_hfi_helper.h
+++ b/drivers/media/platform/msm/cvp/cvp_hfi_helper.h
@@ -285,11 +285,16 @@ struct cvp_hfi_client {
 	u32 transaction_id;
 	u32 data1;
 	u32 data2;
-	u32 kdata1;
-	u32 kdata2;
+	union {
+		u64 kdata;
+		struct {
+			u32 kdata1;
+			u32 kdata2;
+		};
+	};
 	u32 reserved1;
 	u32 reserved2;
-};
+} __packed;
 
 struct cvp_hfi_client_d {
 	u32 transaction_id;
@@ -317,7 +322,7 @@ struct cvp_hfi_cmd_session_set_buffers_packet {
 	u32 session_id;
 	struct cvp_hfi_client client_data;
 	struct cvp_hfi_buf_type buf_type;
-};
+} __packed;
 
 struct cvp_hfi_cmd_session_set_buffers_packet_d {
 	u32 size;
@@ -337,7 +342,7 @@ struct cvp_session_release_buffers_packet {
 	u32 buffer_type;
 	u32 num_buffers;
 	u32 buffer_idx;
-};
+} __packed;
 
 struct cvp_session_release_buffers_packet_d {
 	u32 size;
@@ -355,7 +360,7 @@ struct cvp_hfi_cmd_session_hdr {
 	u32 session_id;
 	struct cvp_hfi_client client_data;
 	u32 stream_idx;
-};
+} __packed;
 
 struct cvp_hfi_msg_session_hdr {
 	u32 size;
@@ -364,7 +369,7 @@ struct cvp_hfi_msg_session_hdr {
 	u32 error_type;
 	struct cvp_hfi_client client_data;
 	u32 stream_idx;
-};
+} __packed;
 
 struct cvp_hfi_msg_session_hdr_d {
 	u32 size;
@@ -415,7 +420,7 @@ struct cvp_hfi_msg_session_op_cfg_packet {
 	struct cvp_hfi_client client_data;
 	u32 stream_idx;
 	u32 op_conf_id;
-};
+} __packed;
 
 struct cvp_hfi_msg_release_buffer_ref_event_packet {
 	u32 packet_buffer;
@@ -479,13 +484,9 @@ struct cvp_hfi_msg_sys_debug_packet {
 	u8 rg_msg_data[1];
 };
 
-struct cvp_hfi_msg_sys_coverage_packet {
+struct cvp_hfi_packet_header {
 	u32 size;
 	u32 packet_type;
-	u32 msg_size;
-	u32 time_stamp_hi;
-	u32 time_stamp_lo;
-	u8 rg_msg_data[1];
 };
 
 struct cvp_hfi_sfr_struct {
diff --git a/drivers/media/platform/msm/cvp/hfi_response_handler.c b/drivers/media/platform/msm/cvp/hfi_response_handler.c
index 96b1d793188e..ce302cb2adc2 100644
--- a/drivers/media/platform/msm/cvp/hfi_response_handler.c
+++ b/drivers/media/platform/msm/cvp/hfi_response_handler.c
@@ -17,11 +17,6 @@
 
 extern struct msm_cvp_drv *cvp_driver;
 
-static int _deprecated_hfi_msg_process(u32 device_id,
-	struct cvp_hfi_msg_session_hdr *pkt,
-	struct msm_cvp_cb_info *info,
-	struct msm_cvp_inst *inst);
-
 static enum cvp_status hfi_map_err_status(u32 hfi_err)
 {
 	enum cvp_status cvp_err;
@@ -450,6 +445,7 @@ static int hfi_process_session_cvp_msg(u32 device_id,
 	struct msm_cvp_inst *inst = NULL;
 	struct msm_cvp_core *core;
 	void *session_id;
+	struct cvp_session_queue *sq;
 
 	if (!pkt) {
 		dprintk(CVP_ERR, "%s: invalid param\n", __func__);
@@ -467,24 +463,10 @@ static int hfi_process_session_cvp_msg(u32 device_id,
 		return -EINVAL;
 	}
 
-	if (inst->deprecate_bitmask) {
-		if (pkt->packet_type == HFI_MSG_SESSION_CVP_DME
-			|| pkt->packet_type == HFI_MSG_SESSION_CVP_ICA
-			|| pkt->packet_type == HFI_MSG_SESSION_CVP_FD) {
-			u64 ktid;
-			u32 kdata1, kdata2;
-
-			kdata1 = pkt->client_data.kdata1;
-			kdata2 = pkt->client_data.kdata2;
-			ktid = ((u64)kdata2 << 32) | kdata1;
-			msm_cvp_unmap_buf_cpu(inst, ktid);
-
-			return _deprecated_hfi_msg_process(device_id,
-				pkt, info, inst);
-		}
-		dprintk(CVP_ERR, "Invalid deprecate_bitmask %#x\n",
-					inst->deprecate_bitmask);
-	}
+	if (pkt->client_data.kdata & FENCE_BIT)
+		sq = &inst->session_queue_fence;
+	else
+		sq = &inst->session_queue;
 
 	sess_msg = kmem_cache_alloc(cvp_driver->msg_cache, GFP_KERNEL);
 	if (sess_msg == NULL) {
@@ -499,139 +481,27 @@ static int hfi_process_session_cvp_msg(u32 device_id,
 		__func__, pkt->packet_type,
 		hfi_map_err_status(get_msg_errorcode(pkt)), session_id);
 
-	spin_lock(&inst->session_queue.lock);
-	if (inst->session_queue.msg_count >= MAX_NUM_MSGS_PER_SESSION) {
+	spin_lock(&sq->lock);
+	if (sq->msg_count >= MAX_NUM_MSGS_PER_SESSION) {
 		dprintk(CVP_ERR, "Reached session queue size limit\n");
 		goto error_handle_msg;
 	}
-	list_add_tail(&sess_msg->node, &inst->session_queue.msgs);
-	inst->session_queue.msg_count++;
-	spin_unlock(&inst->session_queue.lock);
+	list_add_tail(&sess_msg->node, &sq->msgs);
+	sq->msg_count++;
+	spin_unlock(&sq->lock);
 
-	wake_up_all(&inst->session_queue.wq);
+	wake_up_all(&sq->wq);
 
 	info->response_type = HAL_NO_RESP;
 
 	return 0;
 
 error_handle_msg:
-	spin_unlock(&inst->session_queue.lock);
+	spin_unlock(&sq->lock);
 	kmem_cache_free(cvp_driver->msg_cache, sess_msg);
 	return -ENOMEM;
 }
 
-static int hfi_process_session_cvp_dme(u32 device_id,
-	struct cvp_hfi_msg_session_hdr *pkt,
-	struct msm_cvp_cb_info *info)
-{
-	struct msm_cvp_cb_cmd_done cmd_done = {0};
-
-	if (!pkt) {
-		dprintk(CVP_ERR, "%s: invalid param\n", __func__);
-		return -EINVAL;
-	} else if (pkt->size < get_msg_size()) {
-		dprintk(CVP_ERR, "%s: bad_pkt_size %d\n", __func__, pkt->size);
-		return -E2BIG;
-	}
-
-	cmd_done.device_id = device_id;
-	cmd_done.session_id = (void *)(uintptr_t)get_msg_session_id(pkt);
-	cmd_done.status = hfi_map_err_status(get_msg_errorcode(pkt));
-	cmd_done.size = 0;
-
-	dprintk(CVP_DBG,
-		"%s: device_id=%d cmd_done.status=%d sessionid=%#x\n",
-		__func__, device_id, cmd_done.status, cmd_done.session_id);
-	info->response_type = HAL_SESSION_DME_FRAME_CMD_DONE;
-	info->response.cmd = cmd_done;
-
-	return 0;
-}
-
-static int hfi_process_session_cvp_ica(u32 device_id,
-	struct cvp_hfi_msg_session_hdr *pkt,
-	struct msm_cvp_cb_info *info)
-{
-	struct msm_cvp_cb_cmd_done cmd_done = {0};
-
-	if (!pkt) {
-		dprintk(CVP_ERR, "%s: invalid param\n", __func__);
-		return -EINVAL;
-	} else if (pkt->size < get_msg_size()) {
-		dprintk(CVP_ERR, "%s: bad_pkt_size %d\n", __func__, pkt->size);
-		return -E2BIG;
-	}
-
-	cmd_done.device_id = device_id;
-	cmd_done.session_id = (void *)(uintptr_t)get_msg_session_id(pkt);
-	cmd_done.status = hfi_map_err_status(get_msg_errorcode(pkt));
-	cmd_done.size = 0;
-
-	dprintk(CVP_DBG,
-		"%s: device_id=%d cmd_done.status=%d sessionid=%#x\n",
-		__func__, device_id, cmd_done.status, cmd_done.session_id);
-	info->response_type = HAL_SESSION_ICA_FRAME_CMD_DONE;
-	info->response.cmd = cmd_done;
-
-	return 0;
-}
-
-static int hfi_process_session_cvp_fd(u32 device_id,
-	struct cvp_hfi_msg_session_hdr *pkt,
-	struct msm_cvp_cb_info *info)
-{
-	struct msm_cvp_cb_cmd_done cmd_done = {0};
-
-	if (!pkt) {
-		dprintk(CVP_ERR, "%s: invalid param\n", __func__);
-		return -EINVAL;
-	} else if (pkt->size < get_msg_size()) {
-		dprintk(CVP_ERR, "%s: bad_pkt_size %d\n", __func__, pkt->size);
-		return -E2BIG;
-	}
-
-	cmd_done.device_id = device_id;
-	cmd_done.session_id = (void *)(uintptr_t)get_msg_session_id(pkt);
-	cmd_done.status = hfi_map_err_status(get_msg_errorcode(pkt));
-	cmd_done.size = 0;
-
-	dprintk(CVP_DBG,
-		"%s: device_id=%d cmd_done.status=%d sessionid=%#x\n",
-		__func__, device_id, cmd_done.status, cmd_done.session_id);
-	info->response_type = HAL_SESSION_FD_FRAME_CMD_DONE;
-	info->response.cmd = cmd_done;
-
-	return 0;
-}
-
-static int _deprecated_hfi_msg_process(u32 device_id,
-	struct cvp_hfi_msg_session_hdr *pkt,
-	struct msm_cvp_cb_info *info,
-	struct msm_cvp_inst *inst)
-{
-	if (pkt->packet_type == HFI_MSG_SESSION_CVP_DME)
-		if (test_bit(DME_BIT_OFFSET,
-				&inst->deprecate_bitmask))
-			return hfi_process_session_cvp_dme(
-					device_id, (void *)pkt, info);
-
-	if (pkt->packet_type == HFI_MSG_SESSION_CVP_ICA)
-		if (test_bit(ICA_BIT_OFFSET,
-				&inst->deprecate_bitmask))
-			return hfi_process_session_cvp_ica(
-				device_id, (void *)pkt, info);
-
-	if (pkt->packet_type == HFI_MSG_SESSION_CVP_FD)
-		if (test_bit(FD_BIT_OFFSET,
-				&inst->deprecate_bitmask))
-			return hfi_process_session_cvp_fd(
-				device_id, (void *)pkt, info);
-
-	dprintk(CVP_ERR, "Deprecatd MSG doesn't match bitmask %x %lx\n",
-			pkt->packet_type, inst->deprecate_bitmask);
-	return -EINVAL;
-}
-
 static void hfi_process_sys_get_prop_image_version(
 		struct cvp_hfi_msg_sys_property_info_packet *pkt)
 {
diff --git a/drivers/media/platform/msm/cvp/msm_cvp.c b/drivers/media/platform/msm/cvp/msm_cvp.c
index 00e152fc585d..3b9e084657cd 100644
--- a/drivers/media/platform/msm/cvp/msm_cvp.c
+++ b/drivers/media/platform/msm/cvp/msm_cvp.c
@@ -5,7 +5,6 @@
 
 #include "msm_cvp.h"
 #include "cvp_hfi.h"
-#include <synx_api.h>
 #include "cvp_core_hfi.h"
 
 struct cvp_power_level {
@@ -605,13 +604,13 @@ void msm_cvp_unmap_buf_cpu(struct msm_cvp_inst *inst, u64 ktid)
 	}
 }
 
-static bool _cvp_msg_pending(struct msm_cvp_inst *inst,
-			struct cvp_session_queue *sq,
-			struct cvp_session_msg **msg)
+static bool cvp_msg_pending(struct cvp_session_queue *sq,
+				struct cvp_session_msg **msg, u64 *ktid)
 {
-	struct cvp_session_msg *mptr = NULL;
+	struct cvp_session_msg *mptr, *dummy;
 	bool result = false;
 
+	mptr = NULL;
 	spin_lock(&sq->lock);
 	if (sq->state != QUEUE_ACTIVE) {
 		/* The session is being deleted */
@@ -621,27 +620,77 @@ static bool _cvp_msg_pending(struct msm_cvp_inst *inst,
 	}
 	result = list_empty(&sq->msgs);
 	if (!result) {
-		mptr =
-		list_first_entry(&sq->msgs, struct cvp_session_msg, node);
-		list_del_init(&mptr->node);
-		sq->msg_count--;
+		if (!ktid) {
+			mptr =
+			list_first_entry(&sq->msgs, struct cvp_session_msg,
+					node);
+			list_del_init(&mptr->node);
+			sq->msg_count--;
+		} else {
+			result = true;
+			list_for_each_entry_safe(mptr, dummy, &sq->msgs, node) {
+				if (*ktid == mptr->pkt.client_data.kdata) {
+					list_del_init(&mptr->node);
+					sq->msg_count--;
+					result = false;
+					break;
+				}
+			}
+			if (result)
+				mptr = NULL;
+		}
 	}
 	spin_unlock(&sq->lock);
 	*msg = mptr;
 	return !result;
 }
 
+static int cvp_wait_process_message(struct msm_cvp_inst *inst,
+				struct cvp_session_queue *sq, u64 *ktid,
+				unsigned long timeout,
+				struct cvp_kmd_hfi_packet *out)
+{
+	struct cvp_session_msg *msg = NULL;
+	int rc = 0;
+
+	if (wait_event_timeout(sq->wq,
+		cvp_msg_pending(sq, &msg, ktid), timeout) == 0) {
+		dprintk(CVP_WARN, "session queue wait timeout\n");
+		rc = -ETIMEDOUT;
+		goto exit;
+	}
+
+	if (msg == NULL) {
+		dprintk(CVP_WARN, "%s: queue state %d, msg cnt %d\n", __func__,
+					sq->state, sq->msg_count);
+
+		if (inst->state >= MSM_CVP_CLOSE_DONE ||
+				sq->state != QUEUE_ACTIVE) {
+			rc = -ECONNRESET;
+			goto exit;
+		}
+
+		msm_cvp_comm_kill_session(inst);
+		goto exit;
+	}
+
+	msm_cvp_unmap_buf_cpu(inst, msg->pkt.client_data.kdata);
+	if (out)
+		memcpy(out, &msg->pkt, sizeof(struct cvp_hfi_msg_session_hdr));
+
+	kmem_cache_free(cvp_driver->msg_cache, msg);
+
+exit:
+	return rc;
+}
 
 static int msm_cvp_session_receive_hfi(struct msm_cvp_inst *inst,
 			struct cvp_kmd_hfi_packet *out_pkt)
 {
 	unsigned long wait_time;
-	struct cvp_session_msg *msg = NULL;
 	struct cvp_session_queue *sq;
-	struct cvp_kmd_session_control *sc;
 	struct msm_cvp_inst *s;
 	int rc = 0;
-	u32 version;
 
 	if (!inst) {
 		dprintk(CVP_ERR, "%s invalid session\n", __func__);
@@ -653,51 +702,11 @@ static int msm_cvp_session_receive_hfi(struct msm_cvp_inst *inst,
 		return -ECONNRESET;
 
 	s->cur_cmd_type = CVP_KMD_RECEIVE_MSG_PKT;
-	sq = &inst->session_queue;
-	sc = (struct cvp_kmd_session_control *)out_pkt;
-
 	wait_time = msecs_to_jiffies(CVP_MAX_WAIT_TIME);
+	sq = &inst->session_queue;
 
-	if (wait_event_timeout(sq->wq,
-		_cvp_msg_pending(inst, sq, &msg), wait_time) == 0) {
-		dprintk(CVP_WARN, "session queue wait timeout\n");
-		rc = -ETIMEDOUT;
-		goto exit;
-	}
+	rc = cvp_wait_process_message(inst, sq, NULL, wait_time, out_pkt);
 
-	version = (get_hfi_version() & HFI_VERSION_MINOR_MASK)
-				>> HFI_VERSION_MINOR_SHIFT;
-
-	if (msg == NULL) {
-		dprintk(CVP_WARN,
-			"%s: session deleted, queue state %d, msg cnt %d\n",
-			__func__, inst->session_queue.state,
-			inst->session_queue.msg_count);
-
-		if (inst->state >= MSM_CVP_CLOSE_DONE ||
-				sq->state != QUEUE_ACTIVE) {
-			rc = -ECONNRESET;
-			goto exit;
-		}
-
-		msm_cvp_comm_kill_session(inst);
-	} else {
-		if (version >= 1) {
-			u64 ktid;
-			u32 kdata1, kdata2;
-
-			kdata1 = msg->pkt.client_data.kdata1;
-			kdata2 = msg->pkt.client_data.kdata2;
-			ktid = ((u64)kdata2 << 32) | kdata1;
-			msm_cvp_unmap_buf_cpu(inst, ktid);
-		}
-
-		memcpy(out_pkt, &msg->pkt,
-			sizeof(struct cvp_hfi_msg_session_hdr));
-		kmem_cache_free(cvp_driver->msg_cache, msg);
-	}
-
-exit:
 	s->cur_cmd_type = 0;
 	cvp_put_inst(inst);
 	return rc;
@@ -774,8 +783,8 @@ static int msm_cvp_map_buf(struct msm_cvp_inst *inst,
 
 		cmd_hdr = (struct cvp_hfi_cmd_session_hdr *)in_pkt;
 		ktid = atomic64_inc_return(&inst->core->kernel_trans_id);
-		cmd_hdr->client_data.kdata1 = (u32)ktid;
-		cmd_hdr->client_data.kdata2 = (u32)(ktid >> 32);
+		ktid &= (FENCE_BIT - 1);
+		cmd_hdr->client_data.kdata = ktid;
 
 		frame = kmem_cache_zalloc(cvp_driver->frame_cache, GFP_KERNEL);
 		if (!frame)
@@ -980,382 +989,280 @@ exit:
 	return rc;
 }
 
-#define CVP_FENCE_RUN	0x100
-static int msm_cvp_thread_fence_run(void *data)
+static bool cvp_fence_wait(struct cvp_fence_queue *q,
+			struct cvp_fence_command **fence,
+			enum queue_state *state)
 {
-	int i, rc = 0;
-	unsigned long timeout_ms = 100;
-	int synx_obj;
-	struct cvp_hfi_device *hdev;
-	struct msm_cvp_fence_thread_data *fence_thread_data;
-	struct cvp_kmd_hfi_fence_packet *in_fence_pkt;
-	struct cvp_kmd_hfi_packet *in_pkt;
-	struct msm_cvp_inst *inst;
-	int *fence;
-	int ica_enabled = 0;
-	int pkt_idx;
+	struct cvp_fence_command *f;
+
+	*fence = NULL;
+	spin_lock(&q->lock);
+	*state = q->state;
+	if (*state != QUEUE_ACTIVE) {
+		spin_unlock(&q->lock);
+		return true;
+	}
+
+	if (list_empty(&q->wait_list)) {
+		spin_unlock(&q->lock);
+		return false;
+	}
+
+	f = list_first_entry(&q->wait_list, struct cvp_fence_command, list);
+	list_del_init(&f->list);
+	list_add_tail(&q->sched_list, &f->list);
+
+	spin_unlock(&q->lock);
+	*fence = f;
+
+	return true;
+}
+
+static int cvp_fence_dme(struct msm_cvp_inst *inst, u32 *synx,
+			struct cvp_hfi_cmd_session_hdr *pkt)
+{
+	int i;
+	int rc = 0;
+	unsigned long timeout;
+	int h_synx;
+	u64 ktid;
+	unsigned long timeout_ms = 1000;
 	int synx_state = SYNX_STATE_SIGNALED_SUCCESS;
-	struct synx_session synx_session_id;
-	struct synx_import_params import_params;
+	struct cvp_hfi_device *hdev;
+	struct cvp_session_queue *sq;
+	struct synx_session ssid;
 
-	if (!data) {
-		dprintk(CVP_ERR, "%s Wrong input data %pK\n", __func__, data);
-		do_exit(-EINVAL);
-	}
+	dprintk(CVP_DBG, "Enter %s\n", __func__);
 
-	rc = synx_initialize(&synx_session_id, NULL);
-	if (rc) {
-		dprintk(CVP_ERR, "%s: synx_initialize failed\n", __func__);
-		do_exit(-EINVAL);
-	}
-
-	fence_thread_data = data;
-	inst = fence_thread_data->inst;
-	if (!inst) {
-		dprintk(CVP_ERR, "%s Wrong inst %pK\n", __func__, inst);
-		rc = -EINVAL;
-		return rc;
-	}
-	inst->cur_cmd_type = CVP_FENCE_RUN;
-	in_fence_pkt = (struct cvp_kmd_hfi_fence_packet *)
-					&fence_thread_data->in_fence_pkt;
-	in_pkt = (struct cvp_kmd_hfi_packet *)(in_fence_pkt);
-	pkt_idx = get_pkt_index((struct cvp_hal_session_cmd_pkt *)in_pkt);
-
-	if (pkt_idx < 0) {
-		dprintk(CVP_ERR, "%s incorrect packet %d, %x\n", __func__,
-			in_pkt->pkt_data[0],
-			in_pkt->pkt_data[1]);
-		rc = pkt_idx;
-		goto exit;
-	}
-
-	fence = (int *)(in_fence_pkt->fence_data);
 	hdev = inst->core->device;
+	sq = &inst->session_queue_fence;
+	ssid = inst->synx_session_id;
+	ktid = pkt->client_data.kdata;
 
-	//wait on synx before signaling HFI
-	switch (cvp_hfi_defs[pkt_idx].type) {
-	case HFI_CMD_SESSION_CVP_DME_FRAME:
-	{
-		for (i = 0; i < HFI_DME_BUF_NUM-1; i++) {
-			if (fence[(i<<1)]) {
-				import_params.h_synx = fence[(i<<1)];
-				import_params.secure_key = fence[((i<<1)+1)];
-				import_params.new_h_synx = &synx_obj;
-				rc = synx_import(synx_session_id,
-						&import_params);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_import failed\n",
-						__func__);
-					synx_state = SYNX_STATE_SIGNALED_ERROR;
-				}
-				rc = synx_wait(synx_session_id, synx_obj,
-						timeout_ms);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_wait failed\n",
-						__func__);
-					synx_state = SYNX_STATE_SIGNALED_ERROR;
-				}
-				rc = synx_release(synx_session_id, synx_obj);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_release failed\n",
-						__func__);
-					synx_state = SYNX_STATE_SIGNALED_ERROR;
-				}
-				if (i == 0) {
-					ica_enabled = 1;
-					/*
-					 * Increase loop count to skip fence
-					 * waiting on downscale image.
-					 */
-					i = i+1;
-				}
-			}
-		}
-
-		if (synx_state != SYNX_STATE_SIGNALED_ERROR) {
-			mutex_lock(&inst->fence_lock);
-			rc = call_hfi_op(hdev, session_send,
-					(void *)inst->session, in_pkt);
+	i = 0;
+	while (i < HFI_DME_BUF_NUM - 1) {
+		h_synx = synx[i];
+		if (h_synx) {
+			rc = synx_wait(ssid, h_synx, timeout_ms);
 			if (rc) {
-				dprintk(CVP_ERR,
-					"%s: Failed in call_hfi_op %d, %x\n",
-					__func__, in_pkt->pkt_data[0],
-					in_pkt->pkt_data[1]);
-
+				dprintk(CVP_ERR, "%s: synx_wait %d failed\n",
+					__func__, i);
 				synx_state = SYNX_STATE_SIGNALED_ERROR;
-			} else {
-
-				rc = wait_for_sess_signal_receipt_fence(inst,
-					HAL_SESSION_DME_FRAME_CMD_DONE);
-				if (rc) {
-					dprintk(CVP_ERR,
-					"%s: wait for signal failed, rc %d\n",
-					__func__, rc);
-
-					if (rc == -ECONNRESET)
-						goto exit;
-
-					synx_state = SYNX_STATE_SIGNALED_ERROR;
-				}
+				goto exit;
 			}
-			mutex_unlock(&inst->fence_lock);
+			/*
+			 * Increase loop count to skip fence
+			 * waiting on downscale image where i == 1.
+			 */
+			if (i == FENCE_DME_ICA_ENABLED_IDX)
+				++i;
 		}
-
-		if (ica_enabled) {
-			import_params.h_synx = fence[2];
-			import_params.secure_key = fence[3];
-			import_params.new_h_synx = &synx_obj;
-			rc = synx_import(synx_session_id, &import_params);
-			if (rc) {
-				dprintk(CVP_ERR, "%s: synx_import failed\n",
-					__func__);
-				synx_state = SYNX_STATE_SIGNALED_ERROR;
-			}
-			rc = synx_signal(synx_session_id, synx_obj, synx_state);
-			if (rc) {
-				dprintk(CVP_ERR, "%s: synx_signal failed\n",
-					__func__);
-				synx_state = SYNX_STATE_SIGNALED_ERROR;
-			}
-
-			rc = synx_release(synx_session_id, synx_obj);
-			if (rc) {
-				dprintk(CVP_ERR, "%s: synx_release failed\n",
-					__func__);
-				synx_state = SYNX_STATE_SIGNALED_ERROR;
-			}
-		}
-
-		import_params.h_synx = fence[((HFI_DME_BUF_NUM-1)<<1)];
-		import_params.secure_key = fence[((HFI_DME_BUF_NUM-1)<<1)+1];
-		import_params.new_h_synx = &synx_obj;
-		rc = synx_import(synx_session_id, &import_params);
-		if (rc) {
-			dprintk(CVP_ERR, "%s: synx_import failed\n", __func__);
-			synx_state = SYNX_STATE_SIGNALED_ERROR;
-		}
-		rc = synx_signal(synx_session_id, synx_obj, synx_state);
-		if (rc) {
-			dprintk(CVP_ERR, "%s: synx_signal failed\n", __func__);
-			synx_state = SYNX_STATE_SIGNALED_ERROR;
-		}
-		rc = synx_release(synx_session_id, synx_obj);
-		if (rc) {
-			dprintk(CVP_ERR, "%s: synx_release failed\n",
-				__func__);
-			synx_state = SYNX_STATE_SIGNALED_ERROR;
-		}
-		break;
+		++i;
 	}
-	case HFI_CMD_SESSION_CVP_ICA_FRAME:
-	{
-		for (i = 0; i < cvp_hfi_defs[pkt_idx].buf_num-1; i++) {
-			if (fence[(i<<1)]) {
-				import_params.h_synx = fence[(i<<1)];
-				import_params.secure_key = fence[((i<<1)+1)];
-				import_params.new_h_synx = &synx_obj;
-				rc = synx_import(synx_session_id,
-						&import_params);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_import failed\n",
-						__func__);
-					goto exit;
-				}
-				rc = synx_wait(synx_session_id, synx_obj,
-						timeout_ms);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_wait failed\n",
-						__func__);
-					goto exit;
-				}
-				rc = synx_release(synx_session_id, synx_obj);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_release failed\n",
-						__func__);
-					goto exit;
-				}
-				if (i == 0) {
-					/*
-					 * Increase loop count to skip fence
-					 * waiting on output corrected image.
-					 */
-					i = i+1;
-				}
-			}
-		}
 
-		mutex_lock(&inst->fence_lock);
-		rc = call_hfi_op(hdev, session_send,
-				(void *)inst->session, in_pkt);
-		if (rc) {
-			dprintk(CVP_ERR,
-				"%s: Failed in call_hfi_op %d, %x\n",
-				__func__, in_pkt->pkt_data[0],
-				in_pkt->pkt_data[1]);
-			synx_state = SYNX_STATE_SIGNALED_ERROR;
-		}
-
-		if (synx_state != SYNX_STATE_SIGNALED_ERROR) {
-			rc = wait_for_sess_signal_receipt_fence(inst,
-					HAL_SESSION_ICA_FRAME_CMD_DONE);
-			if (rc) {
-				dprintk(CVP_ERR,
-				"%s: wait for signal failed, rc %d\n",
-				__func__, rc);
-				synx_state = SYNX_STATE_SIGNALED_ERROR;
-			}
-		}
-		mutex_unlock(&inst->fence_lock);
-
-		import_params.h_synx = fence[2];
-		import_params.secure_key = fence[3];
-		import_params.new_h_synx = &synx_obj;
-		rc = synx_import(synx_session_id, &import_params);
-		if (rc) {
-			dprintk(CVP_ERR, "%s: synx_import failed\n", __func__);
-			goto exit;
-		}
-		rc = synx_signal(synx_session_id, synx_obj, synx_state);
-		if (rc) {
-			dprintk(CVP_ERR, "%s: synx_signal failed\n", __func__);
-			goto exit;
-		}
-		rc = synx_release(synx_session_id, synx_obj);
-		if (rc) {
-			dprintk(CVP_ERR, "%s: synx_release failed\n", __func__);
-			goto exit;
-		}
-		break;
+	rc = call_hfi_op(hdev, session_send, (void *)inst->session,
+			(struct cvp_kmd_hfi_packet *)pkt);
+	if (rc) {
+		dprintk(CVP_ERR, "%s: Failed in call_hfi_op %d, %x\n", __func__,
+				pkt->size, pkt->packet_type);
+		synx_state = SYNX_STATE_SIGNALED_ERROR;
 	}
-	case HFI_CMD_SESSION_CVP_FD_FRAME:
-	{
-		int in_fence_num = fence[0];
-		int out_fence_num = fence[1];
-		int start_out = in_fence_num + 1;
 
-		for (i = 1; i < in_fence_num + 1; i++) {
-			if (fence[(i<<1)]) {
-				import_params.h_synx = fence[(i<<1)];
-				import_params.secure_key = fence[((i<<1)+1)];
-				import_params.new_h_synx = &synx_obj;
-				rc = synx_import(synx_session_id,
-						&import_params);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_import %d failed\n",
-						__func__, i<<1);
-					goto exit;
-				}
-				rc = synx_wait(synx_session_id, synx_obj,
-						timeout_ms);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_wait %d failed\n",
-						__func__, i<<1);
-					goto exit;
-				}
-				rc = synx_release(synx_session_id, synx_obj);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_release %d failed\n",
-						__func__, i<<1);
-					goto exit;
-				}
-			}
-		}
-
-		mutex_lock(&inst->fence_lock);
-		rc = call_hfi_op(hdev, session_send,
-				(void *)inst->session, in_pkt);
-		if (rc) {
-			dprintk(CVP_ERR,
-				"%s: Failed in call_hfi_op %d, %x\n",
-				__func__, in_pkt->pkt_data[0],
-				in_pkt->pkt_data[1]);
-			synx_state = SYNX_STATE_SIGNALED_ERROR;
-		}
-
-		if (synx_state != SYNX_STATE_SIGNALED_ERROR) {
-			rc = wait_for_sess_signal_receipt_fence(inst,
-					HAL_SESSION_FD_FRAME_CMD_DONE);
-			if (rc) {
-				dprintk(CVP_ERR,
-				"%s: wait for signal failed, rc %d\n",
-				__func__, rc);
-				synx_state = SYNX_STATE_SIGNALED_ERROR;
-			}
-		}
-		mutex_unlock(&inst->fence_lock);
-
-		for (i = start_out; i <  start_out + out_fence_num; i++) {
-			if (fence[(i<<1)]) {
-				import_params.h_synx = fence[(i<<1)];
-				import_params.secure_key = fence[((i<<1)+1)];
-				import_params.new_h_synx = &synx_obj;
-				rc = synx_import(synx_session_id,
-						&import_params);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_import %d failed\n",
-						__func__, i<<1);
-					goto exit;
-				}
-				rc = synx_signal(synx_session_id,
-					synx_obj, synx_state);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_signal %d failed\n",
-						__func__, i<<1);
-					goto exit;
-				}
-				rc = synx_release(synx_session_id, synx_obj);
-				if (rc) {
-					dprintk(CVP_ERR,
-						"%s: synx_release %d failed\n",
-						__func__, i<<1);
-					goto exit;
-				}
-			}
-		}
-		break;
-	}
-	default:
-		dprintk(CVP_ERR, "%s: unknown hfi cmd type 0x%x\n",
-			__func__, fence_thread_data->arg_type);
-		rc = -EINVAL;
+	if (synx_state == SYNX_STATE_SIGNALED_ERROR)
 		goto exit;
-	}
+
+	timeout = msecs_to_jiffies(CVP_MAX_WAIT_TIME);
+	rc = cvp_wait_process_message(inst, sq, &ktid, timeout, NULL);
 
 exit:
-	synx_uninitialize(synx_session_id);
-	kmem_cache_free(cvp_driver->fence_data_cache, fence_thread_data);
-	inst->cur_cmd_type = 0;
+	if (synx[FENCE_DME_ICA_ENABLED_IDX]) {
+		h_synx = synx[FENCE_DME_DS_IDX];
+
+		rc = synx_signal(ssid, h_synx, synx_state);
+		if (rc) {
+			dprintk(CVP_ERR, "%s: synx_signal %d failed\n",
+				__func__, FENCE_DME_DS_IDX);
+			synx_state = SYNX_STATE_SIGNALED_ERROR;
+		}
+	}
+
+	h_synx = synx[FENCE_DME_OUTPUT_IDX];
+	rc = synx_signal(ssid, h_synx, synx_state);
+	if (rc)
+		dprintk(CVP_ERR, "%s: synx_signal %d failed\n",
+			__func__, FENCE_DME_OUTPUT_IDX);
+
+	return rc;
+}
+
+static int cvp_alloc_fence_data(struct cvp_fence_command **f, u32 size)
+{
+	struct cvp_fence_command *fcmd;
+
+	fcmd = kzalloc(sizeof(struct cvp_fence_command), GFP_KERNEL);
+	if (!fcmd)
+		return -ENOMEM;
+
+	fcmd->pkt = kzalloc(size, GFP_KERNEL);
+	if (!fcmd->pkt) {
+		kfree(fcmd);
+		return -ENOMEM;
+	}
+
+	*f = fcmd;
+	return 0;
+}
+
+static void cvp_free_fence_data(struct cvp_fence_command *f)
+{
+	kfree(f->pkt);
+	f->pkt = NULL;
+	kfree(f);
+	f = NULL;
+}
+
+static int cvp_import_synx(struct msm_cvp_inst *inst, u32 type, u32 *fence,
+				u32 *synx)
+{
+	int rc = 0;
+	int i;
+	struct cvp_fence_type *f;
+	struct synx_import_params params;
+	s32 h_synx;
+	struct synx_session ssid;
+
+	f = (struct cvp_fence_type *)fence;
+	ssid = inst->synx_session_id;
+
+	switch (type) {
+	case HFI_CMD_SESSION_CVP_DME_FRAME:
+		for (i = 0; i < HFI_DME_BUF_NUM; ++i) {
+			h_synx = f[i].h_synx;
+
+			if (h_synx) {
+				params.h_synx = h_synx;
+				params.secure_key = f[i].secure_key;
+				params.new_h_synx = &synx[i];
+
+				rc = synx_import(ssid, &params);
+				if (rc) {
+					dprintk(CVP_ERR,
+						"%s: synx_import failed\n",
+						__func__);
+					return rc;
+				}
+			}
+		}
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+static int cvp_release_synx(struct msm_cvp_inst *inst, u32 type, u32 *synx)
+{
+	int rc = 0;
+	int i;
+	s32 h_synx;
+	struct synx_session ssid;
+
+	ssid = inst->synx_session_id;
+
+	switch (type) {
+	case HFI_CMD_SESSION_CVP_DME_FRAME:
+		for (i = 0; i < HFI_DME_BUF_NUM; ++i) {
+			h_synx = synx[i];
+			if (h_synx) {
+				rc = synx_release(ssid, h_synx);
+				if (rc)
+					dprintk(CVP_ERR,
+					"%s: synx_release %d failed\n",
+					__func__, i);
+			}
+		}
+		break;
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+static int cvp_fence_thread(void *data)
+{
+	int rc = 0;
+	struct msm_cvp_inst *inst;
+	struct cvp_fence_queue *q;
+	enum queue_state state;
+	struct cvp_fence_command *fence_data;
+	struct cvp_hfi_cmd_session_hdr *pkt;
+	u32 *synx;
+
+	dprintk(CVP_DBG, "Enter %s\n", current->comm);
+
+	inst = (struct msm_cvp_inst *)data;
+	if (!inst || !inst->core || !inst->core->device) {
+		dprintk(CVP_ERR, "%s invalid inst %pK\n", current->comm, inst);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	q = &inst->fence_cmd_queue;
+
+wait:
+	dprintk(CVP_DBG, "%s starts wait\n", current->comm);
+
+	fence_data = NULL;
+	wait_event_interruptible(q->wq, cvp_fence_wait(q, &fence_data, &state));
+	if (state != QUEUE_ACTIVE)
+		goto exit;
+
+	if (!fence_data)
+		goto wait;
+
+	pkt = fence_data->pkt;
+	synx = (u32 *)fence_data->synx;
+
+	dprintk(CVP_DBG, "%s starts work\n", current->comm);
+
+	switch (fence_data->type) {
+	case HFI_CMD_SESSION_CVP_DME_FRAME:
+		rc = cvp_fence_dme(inst, synx, pkt);
+		break;
+	default:
+		dprintk(CVP_ERR, "%s: unknown hfi cmd type 0x%x\n",
+			__func__, fence_data->type);
+		rc = -EINVAL;
+		goto exit;
+		break;
+	}
+
+	cvp_release_synx(inst, fence_data->type, synx);
+	spin_lock(&q->lock);
+	list_del_init(&fence_data->list);
+	spin_unlock(&q->lock);
+	cvp_free_fence_data(fence_data);
+	goto wait;
+exit:
+	dprintk(CVP_DBG, "%s exit\n", current->comm);
 	cvp_put_inst(inst);
 	do_exit(rc);
 }
 
-static int msm_cvp_session_process_hfi_fence(
-	struct msm_cvp_inst *inst,
-	struct cvp_kmd_arg *arg)
+static int msm_cvp_session_process_hfi_fence(struct msm_cvp_inst *inst,
+					struct cvp_kmd_arg *arg)
 {
-	static int thread_num;
-	struct task_struct *thread;
 	int rc = 0;
-	char thread_fence_name[32];
-	int pkt_idx;
-	struct cvp_kmd_hfi_packet *in_pkt;
-	unsigned int signal, offset, buf_num, in_offset, in_buf_num;
+	int idx;
+	struct cvp_kmd_hfi_fence_packet *fence_pkt;
+	struct cvp_hfi_cmd_session_hdr *pkt;
+	unsigned int offset, buf_num, in_offset, in_buf_num;
 	struct msm_cvp_inst *s;
-	struct msm_cvp_fence_thread_data *fence_thread_data;
-
-	dprintk(CVP_DBG, "%s: Enter inst = %#x", __func__, inst);
+	struct cvp_fence_command *fcmd;
+	struct cvp_fence_queue *q;
+	u32 *fence;
 
 	if (!inst || !inst->core || !arg || !inst->core->device) {
 		dprintk(CVP_ERR, "%s: invalid params\n", __func__);
@@ -1366,100 +1273,59 @@ static int msm_cvp_session_process_hfi_fence(
 	if (!s)
 		return -ECONNRESET;
 
-	inst->cur_cmd_type = CVP_KMD_SEND_FENCE_CMD_PKT;
-	fence_thread_data = kmem_cache_alloc(cvp_driver->fence_data_cache,
-			GFP_KERNEL);
-	if (!fence_thread_data) {
-		dprintk(CVP_ERR, "%s: fence_thread_data alloc failed\n",
-				__func__);
-		rc = -ENOMEM;
-		goto exit;
-	}
-
 	in_offset = arg->buf_offset;
 	in_buf_num = arg->buf_num;
-	in_pkt = (struct cvp_kmd_hfi_packet *)&arg->data.hfi_pkt;
-	pkt_idx = get_pkt_index((struct cvp_hal_session_cmd_pkt *)in_pkt);
-	if (pkt_idx < 0) {
-		dprintk(CVP_ERR, "%s incorrect packet %d, %x\n", __func__,
-				in_pkt->pkt_data[0],
-				in_pkt->pkt_data[1]);
-		offset = in_offset;
-		buf_num = in_buf_num;
-		signal = HAL_NO_RESP;
-	} else {
-		offset = cvp_hfi_defs[pkt_idx].buf_offset;
-		buf_num = cvp_hfi_defs[pkt_idx].buf_num;
-		signal = cvp_hfi_defs[pkt_idx].resp;
+
+	fence_pkt = &arg->data.hfi_fence_pkt;
+	pkt = (struct cvp_hfi_cmd_session_hdr *)&fence_pkt->pkt_data;
+	fence = (u32 *)&fence_pkt->fence_data;
+	idx = get_pkt_index((struct cvp_hal_session_cmd_pkt *)pkt);
+
+	if (idx < 0 || pkt->size > MAX_HFI_FENCE_OFFSET) {
+		dprintk(CVP_ERR, "%s incorrect packet %d %#x\n", __func__,
+				pkt->size, pkt->packet_type);
+		goto exit;
 	}
 
 	if (in_offset && in_buf_num) {
 		offset = in_offset;
 		buf_num = in_buf_num;
+	} else {
+		offset = cvp_hfi_defs[idx].buf_offset;
+		buf_num = cvp_hfi_defs[idx].buf_num;
 	}
 
-	rc = msm_cvp_map_buf(inst, in_pkt, offset, buf_num);
+	rc = msm_cvp_map_buf(inst, (struct cvp_kmd_hfi_packet *)pkt, offset,
+				buf_num);
 	if (rc)
-		goto free_and_exit;
+		goto exit;
 
-	thread_num = thread_num + 1;
-	fence_thread_data->inst = inst;
-	fence_thread_data->device_id = (unsigned int)inst->core->id;
-	memcpy(&fence_thread_data->in_fence_pkt, &arg->data.hfi_fence_pkt,
-				sizeof(struct cvp_kmd_hfi_fence_packet));
-	fence_thread_data->arg_type = arg->type;
-	snprintf(thread_fence_name, sizeof(thread_fence_name),
-				"thread_fence_%d", thread_num);
-	thread = kthread_run(msm_cvp_thread_fence_run,
-			fence_thread_data, thread_fence_name);
-	if (!thread) {
-		dprintk(CVP_ERR, "%s fail to create kthread\n", __func__);
-		rc = -ECHILD;
-		goto free_and_exit;
+	rc = cvp_alloc_fence_data(&fcmd, pkt->size);
+	if (rc)
+		goto exit;
+
+	fcmd->type = cvp_hfi_defs[idx].type;
+	memcpy(fcmd->pkt, pkt, pkt->size);
+
+	fcmd->pkt->client_data.kdata |= FENCE_BIT;
+
+	rc = cvp_import_synx(inst, fcmd->type, fence, fcmd->synx);
+	if (rc) {
+		kfree(fcmd);
+		goto exit;
 	}
+	q = &inst->fence_cmd_queue;
+	spin_lock(&q->lock);
+	list_add_tail(&fcmd->list, &inst->fence_cmd_queue.wait_list);
+	spin_unlock(&q->lock);
 
-	return 0;
+	wake_up(&inst->fence_cmd_queue.wq);
 
-free_and_exit:
-	kmem_cache_free(cvp_driver->fence_data_cache, fence_thread_data);
 exit:
-	inst->cur_cmd_type = 0;
 	cvp_put_inst(s);
 	return rc;
 }
 
-static int msm_cvp_session_cvp_dfs_frame_response(
-	struct msm_cvp_inst *inst,
-	struct cvp_kmd_hfi_packet *dfs_frame)
-{
-	dprintk(CVP_ERR, "Deprecated system call: DFS_CMD_RESPONSE\n");
-		return -EINVAL;
-}
-
-static int msm_cvp_session_cvp_dme_frame_response(
-	struct msm_cvp_inst *inst,
-	struct cvp_kmd_hfi_packet *dme_frame)
-{
-	dprintk(CVP_ERR, "Deprecated system call: DME_CMD_RESPONSE\n");
-		return -EINVAL;
-}
-
-static int msm_cvp_session_cvp_persist_response(
-	struct msm_cvp_inst *inst,
-	struct cvp_kmd_hfi_packet *pbuf_cmd)
-{
-	dprintk(CVP_ERR, "Deprecated system call: PERSIST_CMD_RESPONSE\n");
-		return -EINVAL;
-}
-
-static int msm_cvp_send_cmd(struct msm_cvp_inst *inst,
-		struct cvp_kmd_send_cmd *send_cmd)
-{
-	dprintk(CVP_ERR, "Deprecated system call: cvp_send_cmd\n");
-
-	return 0;
-}
-
 static inline int div_by_1dot5(unsigned int a)
 {
 	unsigned long i = a << 1;
@@ -1942,6 +1808,87 @@ static int session_state_check_init(struct msm_cvp_inst *inst)
 	return msm_cvp_session_create(inst);
 }
 
+static int cvp_fence_thread_start(struct msm_cvp_inst *inst)
+{
+	u32 tnum = 0;
+	u32 i = 0;
+	int rc = 0;
+	char tname[16];
+	struct task_struct *thread;
+	struct cvp_fence_queue *q;
+	struct cvp_session_queue *sq;
+	struct synx_initialization_params params;
+
+	if (!inst->prop.fthread_nr)
+		return 0;
+
+	params.name = "cvp-kernel-client";
+	if (synx_initialize(&inst->synx_session_id, &params)) {
+		dprintk(CVP_ERR, "%s synx_initialize failed\n", __func__);
+		return -EFAULT;
+	}
+
+	q = &inst->fence_cmd_queue;
+	spin_lock(&q->lock);
+	q->state = QUEUE_ACTIVE;
+	spin_unlock(&q->lock);
+
+	for (i = 0; i < inst->prop.fthread_nr; ++i) {
+		if (!cvp_get_inst_validate(inst->core, inst))
+			rc = -ECONNRESET;
+			goto exit;
+
+		snprintf(tname, sizeof(tname), "fthread_%d", tnum++);
+		thread = kthread_run(cvp_fence_thread, inst, tname);
+		if (!thread) {
+			dprintk(CVP_ERR, "%s create %s fail", __func__, tname);
+			rc = -ECHILD;
+			goto exit;
+		}
+	}
+
+	sq = &inst->session_queue_fence;
+	spin_lock(&sq->lock);
+	sq->state = QUEUE_ACTIVE;
+	spin_unlock(&sq->lock);
+
+exit:
+	if (rc) {
+		spin_lock(&q->lock);
+		q->state = QUEUE_STOP;
+		spin_unlock(&q->lock);
+		wake_up_all(&q->wq);
+	}
+	return rc;
+}
+
+static int cvp_fence_thread_stop(struct msm_cvp_inst *inst)
+{
+	struct cvp_fence_queue *q;
+	struct cvp_session_queue *sq;
+
+	if (!inst->prop.fthread_nr)
+		return 0;
+
+	q = &inst->fence_cmd_queue;
+
+	spin_lock(&q->lock);
+	q->state = QUEUE_STOP;
+	spin_unlock(&q->lock);
+
+	sq = &inst->session_queue_fence;
+	spin_lock(&sq->lock);
+	sq->state = QUEUE_STOP;
+	spin_unlock(&sq->lock);
+
+	wake_up_all(&q->wq);
+	wake_up_all(&sq->wq);
+
+	synx_uninitialize(inst->synx_session_id);
+
+	return 0;
+}
+
 static int msm_cvp_session_start(struct msm_cvp_inst *inst,
 		struct cvp_kmd_arg *arg)
 {
@@ -1958,6 +1905,8 @@ static int msm_cvp_session_start(struct msm_cvp_inst *inst,
 	sq->state = QUEUE_ACTIVE;
 	spin_unlock(&sq->lock);
 
+	cvp_fence_thread_start(inst);
+
 	return 0;
 }
 
@@ -1983,6 +1932,8 @@ static int msm_cvp_session_stop(struct msm_cvp_inst *inst,
 
 	wake_up_all(&inst->session_queue.wq);
 
+	cvp_fence_thread_stop(inst);
+
 	return 0;
 }
 
@@ -2145,6 +2096,23 @@ static int msm_cvp_set_sysprop(struct msm_cvp_inst *inst,
 	return rc;
 }
 
+static int msm_cvp_flush_all(struct msm_cvp_inst *inst)
+{
+	int rc = 0;
+	struct msm_cvp_inst *s;
+
+	if (!inst || !inst->core) {
+		dprintk(CVP_ERR, "%s: invalid params\n", __func__);
+		return -EINVAL;
+	}
+
+	s = cvp_get_inst_validate(inst->core, inst);
+	if (!s)
+		return -ECONNRESET;
+
+	return rc;
+}
+
 int msm_cvp_handle_syscall(struct msm_cvp_inst *inst, struct cvp_kmd_arg *arg)
 {
 	int rc = 0;
@@ -2206,14 +2174,6 @@ int msm_cvp_handle_syscall(struct msm_cvp_inst *inst, struct cvp_kmd_arg *arg)
 		rc = msm_cvp_unregister_buffer(inst, buf);
 		break;
 	}
-	case CVP_KMD_HFI_SEND_CMD:
-	{
-		struct cvp_kmd_send_cmd *send_cmd =
-			(struct cvp_kmd_send_cmd *)&arg->data.send_cmd;
-
-		rc = msm_cvp_send_cmd(inst, send_cmd);
-		break;
-	}
 	case CVP_KMD_RECEIVE_MSG_PKT:
 	{
 		struct cvp_kmd_hfi_packet *out_pkt =
@@ -2222,12 +2182,6 @@ int msm_cvp_handle_syscall(struct msm_cvp_inst *inst, struct cvp_kmd_arg *arg)
 		break;
 	}
 	case CVP_KMD_SEND_CMD_PKT:
-	case CVP_KMD_HFI_DFS_CONFIG_CMD:
-	case CVP_KMD_HFI_DFS_FRAME_CMD:
-	case CVP_KMD_HFI_DME_CONFIG_CMD:
-	case CVP_KMD_HFI_DME_FRAME_CMD:
-	case CVP_KMD_HFI_FD_FRAME_CMD:
-	case CVP_KMD_HFI_PERSIST_CMD:
 	{
 		struct cvp_kmd_hfi_packet *in_pkt =
 			(struct cvp_kmd_hfi_packet *)&arg->data.hfi_pkt;
@@ -2236,31 +2190,6 @@ int msm_cvp_handle_syscall(struct msm_cvp_inst *inst, struct cvp_kmd_arg *arg)
 				arg->buf_offset, arg->buf_num);
 		break;
 	}
-	case CVP_KMD_HFI_DFS_FRAME_CMD_RESPONSE:
-	{
-		struct cvp_kmd_hfi_packet *dfs_frame =
-			(struct cvp_kmd_hfi_packet *)&arg->data.hfi_pkt;
-
-		rc = msm_cvp_session_cvp_dfs_frame_response(inst, dfs_frame);
-		break;
-	}
-	case CVP_KMD_HFI_DME_FRAME_CMD_RESPONSE:
-	{
-		struct cvp_kmd_hfi_packet *dme_frame =
-			(struct cvp_kmd_hfi_packet *)&arg->data.hfi_pkt;
-
-		rc = msm_cvp_session_cvp_dme_frame_response(inst, dme_frame);
-		break;
-	}
-	case CVP_KMD_HFI_PERSIST_CMD_RESPONSE:
-	{
-		struct cvp_kmd_hfi_packet *pbuf_cmd =
-			(struct cvp_kmd_hfi_packet *)&arg->data.hfi_pkt;
-
-		rc = msm_cvp_session_cvp_persist_response(inst, pbuf_cmd);
-		break;
-	}
-	case CVP_KMD_HFI_DME_FRAME_FENCE_CMD:
 	case CVP_KMD_SEND_FENCE_CMD_PKT:
 	{
 		rc = msm_cvp_session_process_hfi_fence(inst, arg);
@@ -2275,6 +2204,12 @@ int msm_cvp_handle_syscall(struct msm_cvp_inst *inst, struct cvp_kmd_arg *arg)
 	case CVP_KMD_SET_SYS_PROPERTY:
 		rc = msm_cvp_set_sysprop(inst, arg);
 		break;
+	case CVP_KMD_FLUSH_ALL:
+		rc = msm_cvp_flush_all(inst);
+		break;
+	case CVP_KMD_FLUSH_FRAME:
+		dprintk(CVP_DBG, "CVP_KMD_FLUSH_FRAME is not implemented\n");
+		break;
 	default:
 		dprintk(CVP_DBG, "%s: unknown arg type %#x\n",
 				__func__, arg->type);
@@ -2393,6 +2328,7 @@ int msm_cvp_session_init(struct msm_cvp_inst *inst)
 	inst->prop.priority = 0;
 	inst->prop.is_secure = 0;
 	inst->prop.dsp_mask = 0;
+	inst->prop.fthread_nr = 2;
 
 	return rc;
 }
diff --git a/drivers/media/platform/msm/cvp/msm_cvp_common.c b/drivers/media/platform/msm/cvp/msm_cvp_common.c
index 5974c1e61dd5..71ea4d785e31 100644
--- a/drivers/media/platform/msm/cvp/msm_cvp_common.c
+++ b/drivers/media/platform/msm/cvp/msm_cvp_common.c
@@ -406,54 +406,6 @@ int wait_for_sess_signal_receipt(struct msm_cvp_inst *inst,
 	return rc;
 }
 
-int wait_for_sess_signal_receipt_fence(struct msm_cvp_inst *inst,
-	enum hal_command_response cmd)
-{
-	int rc = 0;
-	struct cvp_hfi_device *hdev;
-	int retry = FENCE_WAIT_SIGNAL_RETRY_TIMES;
-
-	if (!IS_HAL_SESSION_CMD(cmd)) {
-		dprintk(CVP_ERR, "Invalid inst cmd response: %d\n", cmd);
-		return -EINVAL;
-	}
-	hdev = (struct cvp_hfi_device *)(inst->core->device);
-
-	while (retry) {
-		rc = wait_for_completion_timeout(
-			&inst->completions[SESSION_MSG_INDEX(cmd)],
-			msecs_to_jiffies(FENCE_WAIT_SIGNAL_TIMEOUT));
-		if (!rc) {
-			enum cvp_event_t event;
-			unsigned long flags = 0;
-
-			spin_lock_irqsave(&inst->event_handler.lock, flags);
-			event = inst->event_handler.event;
-			spin_unlock_irqrestore(
-			&inst->event_handler.lock, flags);
-			if (event == CVP_SSR_EVENT) {
-				dprintk(CVP_WARN, "%s: SSR triggered\n",
-					__func__);
-				return -ECONNRESET;
-			}
-			--retry;
-		} else {
-			rc = 0;
-			break;
-		}
-	}
-
-	if (!retry) {
-		dprintk(CVP_WARN, "Wait interrupted or timed out: %d\n",
-				SESSION_MSG_INDEX(cmd));
-		call_hfi_op(hdev, flush_debug_queue, hdev->hfi_device_data);
-		dump_hfi_queue(hdev->hfi_device_data);
-		rc = -EIO;
-	}
-
-	return rc;
-}
-
 static int wait_for_state(struct msm_cvp_inst *inst,
 	enum instance_state flipped_state,
 	enum instance_state desired_state,
@@ -774,13 +726,6 @@ static void handle_session_close(enum hal_command_response cmd, void *data)
 	cvp_put_inst(inst);
 }
 
-static void handle_operation_config(enum hal_command_response cmd, void *data)
-{
-	dprintk(CVP_ERR,
-			"%s: is called\n",
-			__func__);
-}
-
 void cvp_handle_cmd_response(enum hal_command_response cmd, void *data)
 {
 	dprintk(CVP_DBG, "Command response = %d\n", cmd);
@@ -794,9 +739,6 @@ void cvp_handle_cmd_response(enum hal_command_response cmd, void *data)
 	case HAL_SESSION_INIT_DONE:
 		handle_session_init_done(cmd, data);
 		break;
-	case HAL_SESSION_CVP_OPERATION_CONFIG:
-		handle_operation_config(cmd, data);
-		break;
 	case HAL_SESSION_RELEASE_RESOURCE_DONE:
 		handle_release_res_done(cmd, data);
 		break;
diff --git a/drivers/media/platform/msm/cvp/msm_cvp_common.h b/drivers/media/platform/msm/cvp/msm_cvp_common.h
index 2322a98985d0..99dd3fdc90ae 100644
--- a/drivers/media/platform/msm/cvp/msm_cvp_common.h
+++ b/drivers/media/platform/msm/cvp/msm_cvp_common.h
@@ -41,8 +41,6 @@ void print_cvp_buffer(u32 tag, const char *str,
 		struct msm_cvp_internal_buffer *cbuf);
 int wait_for_sess_signal_receipt(struct msm_cvp_inst *inst,
 	enum hal_command_response cmd);
-int wait_for_sess_signal_receipt_fence(struct msm_cvp_inst *inst,
-	enum hal_command_response cmd);
 int cvp_comm_set_arp_buffers(struct msm_cvp_inst *inst);
 int cvp_comm_release_persist_buffers(struct msm_cvp_inst *inst);
 void print_client_buffer(u32 tag, const char *str,
diff --git a/drivers/media/platform/msm/cvp/msm_cvp_core.c b/drivers/media/platform/msm/cvp/msm_cvp_core.c
index c53c4dda6f6c..0baec9f617ee 100644
--- a/drivers/media/platform/msm/cvp/msm_cvp_core.c
+++ b/drivers/media/platform/msm/cvp/msm_cvp_core.c
@@ -220,7 +220,7 @@ static bool msm_cvp_check_for_inst_overload(struct msm_cvp_core *core)
 	return overload;
 }
 
-static int _init_session_queue(struct msm_cvp_inst *inst)
+static int __init_session_queue(struct msm_cvp_inst *inst)
 {
 	spin_lock_init(&inst->session_queue.lock);
 	INIT_LIST_HEAD(&inst->session_queue.msgs);
@@ -230,6 +230,21 @@ static int _init_session_queue(struct msm_cvp_inst *inst)
 	return 0;
 }
 
+static void __init_fence_queue(struct msm_cvp_inst *inst)
+{
+	spin_lock_init(&inst->fence_cmd_queue.lock);
+	INIT_LIST_HEAD(&inst->fence_cmd_queue.wait_list);
+	INIT_LIST_HEAD(&inst->fence_cmd_queue.sched_list);
+	init_waitqueue_head(&inst->fence_cmd_queue.wq);
+	inst->fence_cmd_queue.state = QUEUE_ACTIVE;
+
+	spin_lock_init(&inst->session_queue_fence.lock);
+	INIT_LIST_HEAD(&inst->session_queue_fence.msgs);
+	inst->session_queue_fence.msg_count = 0;
+	init_waitqueue_head(&inst->session_queue_fence.wq);
+	inst->session_queue_fence.state = QUEUE_ACTIVE;
+}
+
 static void _deinit_session_queue(struct msm_cvp_inst *inst)
 {
 	struct cvp_session_msg *msg, *tmpmsg;
@@ -295,7 +310,6 @@ void *msm_cvp_open(int core_id, int session_type)
 	pr_info(CVP_DBG_TAG "Opening cvp instance: %pK\n", "info", inst);
 	mutex_init(&inst->sync_lock);
 	mutex_init(&inst->lock);
-	mutex_init(&inst->fence_lock);
 	spin_lock_init(&inst->event_handler.lock);
 
 	INIT_MSM_CVP_LIST(&inst->persistbufs);
@@ -316,7 +330,6 @@ void *msm_cvp_open(int core_id, int session_type)
 	inst->clk_data.sys_cache_bw = 0;
 	inst->clk_data.bitrate = 0;
 	inst->clk_data.core_id = 0;
-	inst->deprecate_bitmask = 0;
 
 	for (i = SESSION_MSG_INDEX(SESSION_MSG_START);
 		i <= SESSION_MSG_INDEX(SESSION_MSG_END); i++) {
@@ -329,7 +342,9 @@ void *msm_cvp_open(int core_id, int session_type)
 	list_add_tail(&inst->list, &core->instances);
 	mutex_unlock(&core->lock);
 
-	rc = _init_session_queue(inst);
+	__init_fence_queue(inst);
+
+	rc = __init_session_queue(inst);
 	if (rc)
 		goto fail_init;
 
@@ -351,7 +366,6 @@ fail_init:
 	mutex_unlock(&core->lock);
 	mutex_destroy(&inst->sync_lock);
 	mutex_destroy(&inst->lock);
-	mutex_destroy(&inst->fence_lock);
 
 	DEINIT_MSM_CVP_LIST(&inst->persistbufs);
 	DEINIT_MSM_CVP_LIST(&inst->cvpcpubufs);
@@ -400,7 +414,6 @@ int msm_cvp_destroy(struct msm_cvp_inst *inst)
 
 	mutex_destroy(&inst->sync_lock);
 	mutex_destroy(&inst->lock);
-	mutex_destroy(&inst->fence_lock);
 
 	msm_cvp_debugfs_deinit_inst(inst);
 	_deinit_session_queue(inst);
diff --git a/drivers/media/platform/msm/cvp/msm_cvp_internal.h b/drivers/media/platform/msm/cvp/msm_cvp_internal.h
index efdd8b9ed0cb..969cda81e888 100644
--- a/drivers/media/platform/msm/cvp/msm_cvp_internal.h
+++ b/drivers/media/platform/msm/cvp/msm_cvp_internal.h
@@ -23,6 +23,7 @@
 #include <media/msm_media_info.h>
 #include <media/msm_cvp_private.h>
 #include "cvp_hfi_api.h"
+#include <synx_api.h>
 
 #define MAX_SUPPORTED_INSTANCES 16
 #define MAX_NAME_LENGTH 64
@@ -30,6 +31,11 @@
 #define MAX_DSP_INIT_ATTEMPTS 16
 #define FENCE_WAIT_SIGNAL_TIMEOUT 100
 #define FENCE_WAIT_SIGNAL_RETRY_TIMES 20
+#define FENCE_BIT (1ULL << 63)
+
+#define FENCE_DME_ICA_ENABLED_IDX 0
+#define FENCE_DME_DS_IDX 1
+#define FENCE_DME_OUTPUT_IDX 7
 
 #define SYS_MSG_START HAL_SYS_INIT_DONE
 #define SYS_MSG_END HAL_SYS_ERROR
@@ -265,6 +271,7 @@ struct cvp_session_prop {
 	u32 priority;
 	u32 is_secure;
 	u32 dsp_mask;
+	u32 fthread_nr;
 	u32 fdu_cycles;
 	u32 od_cycles;
 	u32 mpu_cycles;
@@ -281,6 +288,14 @@ struct cvp_session_prop {
 	u32 ddr_op_cache;
 };
 
+struct cvp_fence_queue {
+	spinlock_t lock;
+	enum queue_state state;
+	struct list_head wait_list;
+	wait_queue_head_t wq;
+	struct list_head sched_list;
+};
+
 enum cvp_event_t {
 	CVP_NO_EVENT,
 	CVP_SSR_EVENT = 1,
@@ -331,6 +346,7 @@ struct msm_cvp_inst {
 	struct msm_cvp_core *core;
 	enum session_type session_type;
 	struct cvp_session_queue session_queue;
+	struct cvp_session_queue session_queue_fence;
 	struct cvp_session_event event_handler;
 	void *session;
 	enum instance_state state;
@@ -346,11 +362,11 @@ struct msm_cvp_inst {
 	enum msm_cvp_modes flags;
 	struct msm_cvp_capability capability;
 	struct kref kref;
-	unsigned long deprecate_bitmask;
 	struct cvp_kmd_request_power power;
 	struct cvp_session_prop prop;
 	u32 cur_cmd_type;
-	struct mutex fence_lock;
+	struct synx_session synx_session_id;
+	struct cvp_fence_queue fence_cmd_queue;
 };
 
 struct msm_cvp_fence_thread_data {
@@ -360,6 +376,18 @@ struct msm_cvp_fence_thread_data {
 	unsigned int arg_type;
 };
 
+struct cvp_fence_type {
+	s32 h_synx;
+	u32 secure_key;
+};
+
+struct cvp_fence_command {
+	struct list_head list;
+	u32 type;
+	u32 synx[MAX_HFI_FENCE_SIZE/2];
+	struct cvp_hfi_cmd_session_hdr *pkt;
+};
+
 extern struct msm_cvp_drv *cvp_driver;
 
 void cvp_handle_cmd_response(enum hal_command_response cmd, void *data);
@@ -367,12 +395,6 @@ int msm_cvp_trigger_ssr(struct msm_cvp_core *core,
 	enum hal_ssr_trigger_type type);
 int msm_cvp_noc_error_info(struct msm_cvp_core *core);
 
-enum msm_cvp_flags {
-	MSM_CVP_FLAG_DEFERRED            = BIT(0),
-	MSM_CVP_FLAG_RBR_PENDING         = BIT(1),
-	MSM_CVP_FLAG_QUEUED              = BIT(2),
-};
-
 struct msm_cvp_internal_buffer {
 	struct list_head list;
 	struct msm_cvp_smem smem;
diff --git a/drivers/media/platform/msm/cvp/msm_cvp_ioctl.c b/drivers/media/platform/msm/cvp/msm_cvp_ioctl.c
index cc7ab010aa9e..ab2103f52d6e 100644
--- a/drivers/media/platform/msm/cvp/msm_cvp_ioctl.c
+++ b/drivers/media/platform/msm/cvp/msm_cvp_ioctl.c
@@ -165,37 +165,6 @@ static int _copy_sysprop_to_user(struct cvp_kmd_arg *kp,
 
 }
 
-static void _set_deprecate_bitmask(struct cvp_kmd_arg *kp,
-			struct msm_cvp_inst *inst)
-{
-	dprintk(CVP_INFO, "%s: kp->type = %#x\n", __func__, kp->type);
-
-	switch (kp->type) {
-	case CVP_KMD_HFI_DFS_FRAME_CMD:
-	{
-		set_bit(DFS_BIT_OFFSET, &inst->deprecate_bitmask);
-		break;
-	}
-	case CVP_KMD_HFI_DME_FRAME_CMD:
-	{
-		set_bit(DME_BIT_OFFSET, &inst->deprecate_bitmask);
-		break;
-	}
-	case CVP_KMD_HFI_DME_FRAME_FENCE_CMD:
-	{
-		set_bit(DME_BIT_OFFSET, &inst->deprecate_bitmask);
-		break;
-	}
-	case CVP_KMD_HFI_FD_FRAME_CMD:
-	{
-		set_bit(FD_BIT_OFFSET, &inst->deprecate_bitmask);
-		break;
-	}
-	default:
-		break;
-	}
-}
-
 static void print_hfi_short(struct cvp_kmd_arg __user *up)
 {
 	struct cvp_kmd_hfi_packet *pkt;
@@ -262,8 +231,6 @@ static int convert_from_user(struct cvp_kmd_arg *kp,
 	if (get_user(kp->type, &up->type))
 		return -EFAULT;
 
-	_set_deprecate_bitmask(kp, inst);
-
 	if (get_user(kp->buf_offset, &up->buf_offset) ||
 		get_user(kp->buf_num, &up->buf_num))
 		return -EFAULT;
@@ -336,27 +303,7 @@ static int convert_from_user(struct cvp_kmd_arg *kp,
 				return -EFAULT;
 		break;
 	}
-	case CVP_KMD_HFI_SEND_CMD:
-	{
-		struct cvp_kmd_send_cmd *k, *u;
-
-		k = &kp->data.send_cmd;
-		u = &up->data.send_cmd;
-		if (get_user(k->cmd_address_fd, &u->cmd_address_fd) ||
-			get_user(k->cmd_size, &u->cmd_size))
-			return -EFAULT;
-		for (i = 0; i < 10; i++)
-			if (get_user(k->reserved[i], &u->reserved[i]))
-				return -EFAULT;
-		break;
-	}
 	case CVP_KMD_SEND_CMD_PKT:
-	case CVP_KMD_HFI_DFS_CONFIG_CMD:
-	case CVP_KMD_HFI_DFS_FRAME_CMD:
-	case CVP_KMD_HFI_DME_CONFIG_CMD:
-	case CVP_KMD_HFI_DME_FRAME_CMD:
-	case CVP_KMD_HFI_PERSIST_CMD:
-	case CVP_KMD_HFI_FD_FRAME_CMD:
 	{
 		if (_get_pkt_hdr_from_user(up, &pkt_hdr)) {
 			dprintk(CVP_ERR, "Invalid syscall: %x, %x, %x\n",
@@ -368,7 +315,6 @@ static int convert_from_user(struct cvp_kmd_arg *kp,
 		break;
 	}
 	case CVP_KMD_SEND_FENCE_CMD_PKT:
-	case CVP_KMD_HFI_DME_FRAME_FENCE_CMD:
 	{
 		if (_get_fence_pkt_hdr_from_user(up, &pkt_hdr)) {
 			dprintk(CVP_ERR, "Invalid syscall: %x, %x, %x\n",
@@ -387,14 +333,9 @@ static int convert_from_user(struct cvp_kmd_arg *kp,
 			return -EFAULT;
 		}
 
-		set_feature_bitmask(pkt_idx, &inst->deprecate_bitmask);
-
 		rc = _copy_fence_pkt_from_user(kp, up, (pkt_hdr.size >> 2));
 		break;
 	}
-	case CVP_KMD_HFI_DFS_FRAME_CMD_RESPONSE:
-	case CVP_KMD_HFI_DME_FRAME_CMD_RESPONSE:
-	case CVP_KMD_HFI_PERSIST_CMD_RESPONSE:
 	case CVP_KMD_RECEIVE_MSG_PKT:
 		break;
 	case CVP_KMD_SESSION_CONTROL:
@@ -529,33 +470,7 @@ static int convert_to_user(struct cvp_kmd_arg *kp, unsigned long arg)
 				return -EFAULT;
 		break;
 	}
-	case CVP_KMD_HFI_SEND_CMD:
-	{
-		struct cvp_kmd_send_cmd *k, *u;
-
-		dprintk(CVP_DBG, "%s: CVP_KMD_HFI_SEND_CMD\n",
-					__func__);
-
-		k = &kp->data.send_cmd;
-		u = &up->data.send_cmd;
-		if (put_user(k->cmd_address_fd, &u->cmd_address_fd) ||
-			put_user(k->cmd_size, &u->cmd_size))
-			return -EFAULT;
-		for (i = 0; i < 10; i++)
-			if (put_user(k->reserved[i], &u->reserved[i]))
-				return -EFAULT;
-		break;
-	}
 	case CVP_KMD_SEND_CMD_PKT:
-	case CVP_KMD_HFI_DFS_CONFIG_CMD:
-	case CVP_KMD_HFI_DFS_FRAME_CMD:
-	case CVP_KMD_HFI_DFS_FRAME_CMD_RESPONSE:
-	case CVP_KMD_HFI_DME_CONFIG_CMD:
-	case CVP_KMD_HFI_DME_FRAME_CMD:
-	case CVP_KMD_HFI_DME_FRAME_CMD_RESPONSE:
-	case CVP_KMD_HFI_PERSIST_CMD:
-	case CVP_KMD_HFI_PERSIST_CMD_RESPONSE:
-	case CVP_KMD_HFI_FD_FRAME_CMD:
 	{
 		if (_get_pkt_hdr_from_user(up, &pkt_hdr))
 			return -EFAULT;
@@ -566,7 +481,6 @@ static int convert_to_user(struct cvp_kmd_arg *kp, unsigned long arg)
 		break;
 	}
 	case CVP_KMD_SEND_FENCE_CMD_PKT:
-	case CVP_KMD_HFI_DME_FRAME_FENCE_CMD:
 	{
 		if (_get_fence_pkt_hdr_from_user(up, &pkt_hdr))
 			return -EFAULT;
diff --git a/include/uapi/media/msm_cvp_private.h b/include/uapi/media/msm_cvp_private.h
index 556f658e5440..22cf3c156bba 100644
--- a/include/uapi/media/msm_cvp_private.h
+++ b/include/uapi/media/msm_cvp_private.h
@@ -8,12 +8,6 @@
 #define MAX_DFS_HFI_PARAMS 20
 #define HFI_MAX_PLANES 4
 
-#define BASE_PRIVATE_CVP	36
-
-/* VIDIOC private cvp command */
-#define VIDIOC_CVP_CMD \
-		_IOWR('V', BASE_PRIVATE_CVP, struct cvp_kmd_arg)
-
 /* Commands type */
 #define CVP_KMD_CMD_BASE		0x10000000
 #define CVP_KMD_CMD_START		(CVP_KMD_CMD_BASE + 0x1000)
@@ -51,30 +45,6 @@
  */
 #define CVP_KMD_UNREGISTER_BUFFER	(CVP_KMD_CMD_START + 4)
 
-#define CVP_KMD_HFI_SEND_CMD        (CVP_KMD_CMD_START + 5)
-
-#define CVP_KMD_HFI_DFS_CONFIG_CMD  (CVP_KMD_CMD_START + 6)
-
-#define CVP_KMD_HFI_DFS_FRAME_CMD  (CVP_KMD_CMD_START + 7)
-
-#define CVP_KMD_HFI_DFS_FRAME_CMD_RESPONSE  (CVP_KMD_CMD_START + 8)
-
-#define CVP_KMD_HFI_DME_CONFIG_CMD  (CVP_KMD_CMD_START + 9)
-
-#define CVP_KMD_HFI_DME_FRAME_CMD  (CVP_KMD_CMD_START + 10)
-
-#define CVP_KMD_HFI_DME_FRAME_CMD_RESPONSE  (CVP_KMD_CMD_START + 11)
-
-#define CVP_KMD_HFI_PERSIST_CMD  (CVP_KMD_CMD_START + 12)
-
-#define CVP_KMD_HFI_PERSIST_CMD_RESPONSE  (CVP_KMD_CMD_START + 13)
-
-#define CVP_KMD_HFI_DME_FRAME_FENCE_CMD  (CVP_KMD_CMD_START + 14)
-
-#define CVP_KMD_HFI_ICA_FRAME_CMD  (CVP_KMD_CMD_START + 15)
-
-#define CVP_KMD_HFI_FD_FRAME_CMD  (CVP_KMD_CMD_START + 16)
-
 #define CVP_KMD_UPDATE_POWER	(CVP_KMD_CMD_START + 17)
 
 #define CVP_KMD_SEND_CMD_PKT	(CVP_KMD_CMD_START + 64)
@@ -87,7 +57,11 @@
 
 #define CVP_KMD_SESSION_CONTROL		(CVP_KMD_CMD_START + 68)
 
-#define CVP_KMD_SEND_FENCE_CMD_PKT   (0x10001000 + 69)
+#define CVP_KMD_SEND_FENCE_CMD_PKT	(CVP_KMD_CMD_START + 69)
+
+#define CVP_KMD_FLUSH_ALL	(CVP_KMD_CMD_START + 70)
+
+#define CVP_KMD_FLUSH_FRAME	(CVP_KMD_CMD_START + 71)
 
 /* flags */
 #define CVP_KMD_FLAG_UNSECURE			0x00000000
@@ -275,8 +249,8 @@ struct cvp_kmd_hfi_fence_packet {
 
 
 /**
- * struct cvp_kmd_arg - argument passed with VIDIOC_CVP_CMD
- * To be deprecated
+ * struct cvp_kmd_arg
+ *
  * @type:          command type
  * @buf_offset:    offset to buffer list in the command
  * @buf_num:       number of buffers in the command