diff --git a/.dockerignore b/.dockerignore
index 50df2e6..2636a41 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,6 @@
-*.pyc
-*.pyo
+**/*.pyc
+**/*.pyo
+**/__pycache__
 .*.swp
 .*.swo
 **/.DS_Store
@@ -10,5 +11,10 @@ output/
 output/*
 !output/linux-headers/
 !output/linux-headers/**
+!output/kernel-modules/
+!output/kernel-modules/**
 edk2_tici/
-agnos-kernel-sdm845/
+kernel/linux/
+kernel/spectra/
+.ccache/
+.git
diff --git a/.gitattributes b/.gitattributes
index a683ee9..96be0d5 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,13 @@
 *.deb filter=lfs diff=lfs merge=lfs -text
 *.ko filter=lfs diff=lfs merge=lfs -text
 userspace/root/usr/share/fonts/NotoSans??-Regular.woff2 filter=lfs diff=lfs merge=lfs -text
+
+userspace/root/usr/lib/firmware/ath10k/** filter=lfs diff=lfs merge=lfs -text
+userspace/root/usr/lib/firmware/qca/* filter=lfs diff=lfs merge=lfs -text
+userspace/root/usr/lib/firmware/qcom/**/*.mbn filter=lfs diff=lfs merge=lfs -text
+userspace/root/usr/lib/firmware/qcom/*.fw filter=lfs diff=lfs merge=lfs -text
+
+# Preserve patch context and mail trailers; builds check the added source.
+*.patch -whitespace
+# Keep this copied upstream license byte-for-byte.
+userspace/root/usr/share/doc/mainline-firmware/licenses/wireless-regdb-LICENSE whitespace=-blank-at-eof
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 9217ee3..e1c5ca5 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -39,7 +39,7 @@ jobs:
 
     - name: Get kernel submodule ref
       id: kernel-submodule
-      run: echo "ref=$(git ls-tree HEAD | awk '$4 == "agnos-kernel-sdm845"' | awk '{print $3}')" | tee -a $GITHUB_OUTPUT
+      run: echo "ref=$(git -C kernel/linux rev-parse HEAD)" | tee -a $GITHUB_OUTPUT
 
     - name: Restore ccache
       uses: actions/cache@v4
diff --git a/.gitmodules b/.gitmodules
index c8520a8..7aff2cf 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,6 @@
-[submodule "agnos-kernel-sdm845"]
-  path = agnos-kernel-sdm845
-  url = ../../commaai/agnos-kernel-sdm845.git
+[submodule "kernel/linux"]
+  path = kernel/linux
+  url = https://github.com/torvalds/linux.git
+[submodule "kernel/spectra"]
+  path = kernel/spectra
+  url = https://github.com/commaai/vamos.git
diff --git a/Dockerfile.agnos b/Dockerfile.agnos
index c11f9e4..3e5fdfa 100644
--- a/Dockerfile.agnos
+++ b/Dockerfile.agnos
@@ -17,26 +17,22 @@ RUN apt-get update && apt-get install -yq --no-install-recommends \
 COPY ./userspace/build_adbd.sh ./userspace/adbd-linux.patch /tmp/agnos/
 RUN /tmp/agnos/build_adbd.sh
 
-# Qualcomm graphics without Wayland or OpenCL runtime dependencies
-FROM agnos-compiler AS agnos-compiler-graphics
-RUN apt-get update && apt-get install -yq --no-install-recommends patchelf
-COPY ./userspace/graphics/ /tmp/agnos/graphics-src/
-RUN mkdir -p /tmp/agnos/graphics && \
-    cp /tmp/agnos/graphics-src/libgbm.so /tmp/agnos/graphics/ && \
-    cp /tmp/agnos/graphics-src/libeglSubDriverWayland.so.patched /tmp/agnos/graphics/libeglSubDriverWayland.so && \
-    cd /tmp/agnos/graphics && \
-    gcc -shared -fPIC -Os -s -Wall -Wextra -Werror -Wl,-z,defs -Wl,-z,relro,-z,now \
-      -Wl,-soname,libagnos-wayland-stubs.so -o libagnos-wayland-stubs.so /tmp/agnos/graphics-src/stubs.c && \
-    gcc -shared -fPIC -Os -s -Wall -Wextra -Werror -Wl,-z,defs -Wl,-z,relro,-z,now \
-      -Wl,-soname,libCB.so -o libCB.so /tmp/agnos/graphics-src/opencl_stubs.c && \
-    nm -D --defined-only libagnos-wayland-stubs.so | \
-      awk '$3 ~ /^agnos_/ { name = $3; sub(/^agnos_/, "", name); print name, $3 }' > /tmp/agnos/graphics-symbols.map && \
-    for lib in libgbm.so libeglSubDriverWayland.so; do \
-      patchelf --rename-dynamic-symbols /tmp/agnos/graphics-symbols.map \
-        --remove-needed libwayland-client.so.0 --remove-needed libwayland-server.so.0 \
-        --remove-needed libwayland-egl.so.1 --remove-needed libffi.so.6 \
-        --add-needed libagnos-wayland-stubs.so "$lib" || exit 1; \
-    done
+FROM agnos-compiler AS agnos-compiler-msm
+RUN apt-get update && apt-get install -yq --no-install-recommends \
+    ca-certificates git meson ninja-build pkg-config libudev-dev libzstd-dev
+COPY ./userspace/build_msm_daemons.sh /tmp/agnos/
+RUN /tmp/agnos/build_msm_daemons.sh
+
+FROM agnos-compiler AS agnos-compiler-raylib
+RUN apt-get update && apt-get install -yq --no-install-recommends \
+    ca-certificates git python3-dev python3-venv pkg-config libdrm-dev libgbm-dev libegl-dev libgles2-mesa-dev
+COPY ./userspace/build_raylib.sh ./userspace/raylib-python.patch ./userspace/raylib.patch /tmp/agnos/
+RUN /tmp/agnos/build_raylib.sh
+
+FROM agnos-compiler AS agnos-compiler-ffmpeg-headers
+RUN apt-get update && apt-get install -yq --no-install-recommends ca-certificates curl
+COPY ./userspace/build_ffmpeg_headers.sh /tmp/agnos/
+RUN /tmp/agnos/build_ffmpeg_headers.sh
 
 # ################## #
 # ###### Base ###### #
@@ -70,7 +66,7 @@ FROM agnos-base AS agnos
 
 COPY --from=agnos-compiler-adbd /tmp/agnos/adbd /usr/comma/adbd
 COPY --from=agnos-compiler-adbd /tmp/adbd-build/packages/modules/adb/NOTICE /usr/share/doc/adbd/NOTICE
-COPY --from=agnos-compiler-graphics /tmp/agnos/graphics/ /usr/lib/aarch64-linux-gnu/
+COPY --from=agnos-compiler-msm /tmp/agnos/msm-daemons/ /
 
 # modem.service runs the packaged modem.py (AT + IPv4 PPP).
 # NetworkManager still requires libmm-glib0 for Wi-Fi/Ethernet operation.
@@ -100,7 +96,19 @@ RUN source $XDG_DATA_HOME/venv/bin/activate && \
       --no-install-package pandacan \
       --no-install-package rednose \
       --no-install-package teleoprtc \
-      --no-install-package tinygrad
+      --no-install-package tinygrad \
+      --no-install-package comma-deps-raylib
+
+# The COMMA platform uses Mesa GBM/DRM instead of the vendor KGSL runtime.
+COPY --from=agnos-compiler-raylib /tmp/agnos/raylib/ /tmp/agnos/raylib/
+RUN uv pip install --python $XDG_DATA_HOME/venv/bin/python --no-deps /tmp/agnos/raylib/*.whl && \
+    mkdir -p /usr/share/doc/comma-deps-raylib && \
+    cp /tmp/agnos/raylib/*LICENSE* /tmp/agnos/raylib/*.patch /tmp/agnos/raylib/SOURCES /usr/share/doc/comma-deps-raylib/ && \
+    rm -r /tmp/agnos/raylib
+
+# The pinned FFmpeg wheel includes libswscale but omits its public headers.
+COPY --from=agnos-compiler-ffmpeg-headers /tmp/agnos/ffmpeg-headers/include/ /usr/local/venv/lib/python3.12/site-packages/ffmpeg/install/include/
+COPY --from=agnos-compiler-ffmpeg-headers /tmp/agnos/ffmpeg-headers/share/doc/ /usr/share/doc/
 
 # Install nice to haves
 COPY ./userspace/install_extras.sh /tmp/agnos/
@@ -119,6 +127,7 @@ RUN chown -R $USERNAME: /home/$USERNAME
 RUN touch -r /lib/systemd/systemd /etc/fstab
 
 COPY ./output/linux-headers/include/ /usr/include/
+COPY ./output/kernel-modules/lib/modules/ /usr/lib/modules/
 
 COPY ./userspace/irsc_util.c /tmp/agnos/
 RUN clang -O2 -Wall -Wextra -Werror -o /usr/bin/irsc_util /tmp/agnos/irsc_util.c && rm /tmp/agnos/irsc_util.c
@@ -136,7 +145,7 @@ RUN /tmp/agnos/services.sh
 RUN echo "precedence ::ffff:0:0/96 100" >> /etc/gai.conf
 
 # Block incoming cellular traffic, including modem.py's PPP interface.
-# The SDM845 kernel supports xtables, not Ubuntu's default nftables backend.
+# Keep the firewall backend used by modem.py.
 RUN update-alternatives --set iptables /usr/sbin/iptables-legacy && \
     update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
 
@@ -145,16 +154,6 @@ RUN sed -i 's/hosts:          files dns myhostname/hosts:          files myhostn
 
 # keep this last
 RUN ldconfig
-# ldconfig rewrites these SONAME links back to Mesa; raylib COMMA needs Adreno.
-RUN cd /usr/lib/aarch64-linux-gnu && \
-    test -f libEGL_adreno.so && \
-    test -f libGLESv2_adreno.so && \
-    install -m 755 libgbm.so /tmp/libgbm_adreno.so && \
-    ln -sf libEGL_adreno.so libEGL.so.1 && \
-    ln -sf libGLESv2_adreno.so libGLESv2.so.2 && \
-    rm -f libgbm.so.1 && \
-    mv /tmp/libgbm_adreno.so libgbm.so.1
-
 COPY ./userspace/trim.sh /tmp/agnos/
 RUN /tmp/agnos/trim.sh
 
diff --git a/Dockerfile.builder b/Dockerfile.builder
index e32c9be..9379d67 100644
--- a/Dockerfile.builder
+++ b/Dockerfile.builder
@@ -1,6 +1,6 @@
 # check=error=true
 
-FROM ubuntu:20.04
+FROM ubuntu:24.04
 
 ARG UNAME
 ARG UID
@@ -10,11 +10,18 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-    python2 \
+    python3 \
     build-essential \
+    gcc-aarch64-linux-gnu \
+    bison \
+    flex \
+    git \
+    kmod \
+    zstd \
+    rsync \
+    libelf-dev \
     libssl-dev \
     bc \
-    python-is-python2 \
     openssl \
     ccache \
     libcap2-bin \
diff --git a/README.md b/README.md
index d6933c9..fe1978b 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@ Run once to set things up:
 git clone https://github.com/commaai/agnos-builder.git
 
 cd agnos-builder
-git submodule update --init agnos-kernel-sdm845
+git submodule update --init kernel/linux kernel/spectra
 ./tools/extract_tools.sh
 ```
 
@@ -51,9 +51,14 @@ git submodule update --init agnos-kernel-sdm845
     NS=1 ./build_system.sh
     ```
 
+The mainline kernel build targets mici and retains the current Ubuntu userspace.
+Its boot payload uses the stock `UNCOMPRESSED_IMG` format: 16-byte magic, little-endian
+32-bit raw Image length, raw arm64 Image, and a single mici DTB. Boot image addresses
+and the signature format remain unchanged.
+
 ### Flashing
 
-Flashing to a comma 3/3X (Be sure to set your device in QDL mode before flashing. Refer to [QDL MODE Section](https://flash.comma.ai/) for more information.):
+Flashing to a comma four (mici): put the device in [QDL mode](https://flash.comma.ai/) before flashing.
 ```
 ./flash_kernel.sh
 ./flash_system.sh
diff --git a/agnos-kernel-sdm845 b/agnos-kernel-sdm845
deleted file mode 160000
index 8b0e4d2..0000000
--- a/agnos-kernel-sdm845
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 8b0e4d289b246a5cc1b0484b25a3f9f8d4772544
diff --git a/build_kernel.sh b/build_kernel.sh
index 59a0699..949fb79 100755
--- a/build_kernel.sh
+++ b/build_kernel.sh
@@ -1,120 +1,130 @@
 #!/usr/bin/env bash
-set -e
+set -euo pipefail
 
-DEFCONFIG=tici_defconfig
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$DIR"
 
-# Get directories and make sure we're in the correct spot to start the build
-DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
-TOOLS=$DIR/tools
-TMP_DIR=/tmp/agnos-builder-tmp
-OUTPUT_DIR=$DIR/output
-BOOT_IMG=./boot.img
-cd $DIR
+SOURCE_DIR="$DIR/kernel/linux"
+KERNEL_DIR="$DIR/build/linux"
+OUT_DIR="$DIR/build/kernel-out"
+SPECTRA_DIR="$DIR/build/spectra-camera"
+OUTPUT_DIR="$DIR/output"
+TOOLS="$DIR/tools"
 
-if [[ "$(uname)" == 'Darwin' ]]; then
-  BASE_VOLUME_PATH=$(echo $DIR | grep -o "^/Volumes/[^/]*" || echo "/")
-  if ! diskutil info -plist $BASE_VOLUME_PATH | grep -q "<string>Case-sensitive APFS</string>"; then
-    echo "---------------   macOS support   ---------------"
+if [[ "$(uname)" == Darwin ]]; then
+  BASE_VOLUME_PATH=$(echo "$DIR" | grep -o "^/Volumes/[^/]*" || echo "/")
+  if ! diskutil info -plist "$BASE_VOLUME_PATH" | grep -q "<string>Case-sensitive APFS</string>"; then
     echo "Ensure you are in a Case-sensitive APFS volume to build the AGNOS kernel."
     echo "https://github.com/commaai/agnos-builder?tab=readme-ov-file#macos"
-    echo "-------------------------------------------------"
     exit 1
   fi
 fi
 
-# Setup kernel build container
-echo "Building agnos-meta-builder docker image"
-export DOCKER_BUILDKIT=1
-docker build -f Dockerfile.builder -t agnos-meta-builder $DIR \
-  --build-arg UNAME=$(id -nu) \
-  --build-arg UID=$(id -u) \
-  --build-arg GID=$(id -g)
-echo "Starting agnos-meta-builder container"
-CONTAINER_ID=$(docker run -d -v $DIR:$DIR -w $DIR agnos-meta-builder)
-
-# Cleanup container on exit
-trap "echo \"Cleaning up container:\"; \
-docker container rm -f $CONTAINER_ID" EXIT
-
-# Clone kernel if not done already
-if git submodule status --cached agnos-kernel-sdm845/ | grep "^-"; then
-  echo "Cloning agnos-kernel-sdm845"
-  git submodule update --init agnos-kernel-sdm845
+if [ ! -f "$SOURCE_DIR/Makefile" ]; then
+  git submodule update --init kernel/linux
+fi
+if [ ! -f "$DIR/kernel/spectra/kernel/spectra-camera/Kbuild" ]; then
+  git submodule update --init kernel/spectra
 fi
 
-$DIR/tools/extract_tools.sh
+# Build the pinned upstream tree plus our patches, keeping the submodule clean.
+# The separate output directory preserves incremental build artifacts.
+SOURCE_ID=$({
+  git -C "$SOURCE_DIR" rev-parse HEAD
+  git -C "$DIR/kernel/spectra" rev-parse HEAD
+  shasum -a 256 kernel/patches/*.patch kernel/dts/*
+} | shasum -a 256 | cut -d ' ' -f 1)
+if [ "$(cat "$KERNEL_DIR/.agnos-source" 2>/dev/null || true)" != "$SOURCE_ID" ]; then
+  rm -rf "$KERNEL_DIR"
+  mkdir -p "$KERNEL_DIR"
+  git -C "$SOURCE_DIR" archive HEAD | tar -xf - -C "$KERNEL_DIR"
+  git -C "$KERNEL_DIR" init -q
+  for patch in "$DIR"/kernel/patches/*.patch; do
+    git -C "$KERNEL_DIR" apply --check --whitespace=error "$patch"
+    git -C "$KERNEL_DIR" apply --whitespace=error "$patch"
+  done
+  cp kernel/dts/* "$KERNEL_DIR/arch/arm64/boot/dts/qcom/"
+  echo "$SOURCE_ID" > "$KERNEL_DIR/.agnos-source"
+fi
+
+SPECTRA_ID=$(git -C "$DIR/kernel/spectra" rev-parse HEAD)
+if [ "$(cat "$SPECTRA_DIR/.agnos-source" 2>/dev/null || true)" != "$SPECTRA_ID" ]; then
+  rm -rf "$SPECTRA_DIR"
+  mkdir -p "$SPECTRA_DIR"
+  git -C "$DIR/kernel/spectra" archive HEAD kernel/spectra-camera | \
+    tar -xf - --strip-components=2 -C "$SPECTRA_DIR"
+  echo "$SPECTRA_ID" > "$SPECTRA_DIR/.agnos-source"
+fi
+
+docker build -f Dockerfile.builder -t agnos-mainline-builder . \
+  --build-arg UNAME="$(id -nu)" --build-arg UID="$(id -u)" --build-arg GID="$(id -g)"
 
 build_kernel() {
-  cd agnos-kernel-sdm845
-
-  # Build parameters
-  ARCH=$(uname -m)
-  if [ "$ARCH" != "arm64" ] && [ "$ARCH" != "aarch64" ]; then
-    export CROSS_COMPILE=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-
-    export CC=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-gcc
-    export LD=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-ld.bfd
-  fi
-
-  # Build arm64 arch
   export ARCH=arm64
+  export CROSS_COMPILE=""
+  if [[ "$(uname -m)" != aarch64 && "$(uname -m)" != arm64 ]]; then
+    export CROSS_COMPILE=aarch64-linux-gnu-
+  fi
+  export CCACHE_DIR="$DIR/.ccache"
+  export KBUILD_BUILD_USER=comma
+  export KBUILD_BUILD_HOST=agnos
+  export LOCALVERSION=-agnos
 
-  # Set ccache dir
-  export CCACHE_DIR=$DIR/.ccache
+  cd "$KERNEL_DIR"
+  local args=(O="$OUT_DIR" CC="ccache ${CROSS_COMPILE}gcc" HOSTCC="ccache gcc" HOSTCXX="ccache g++")
+  make "${args[@]}" defconfig
+  KCONFIG_CONFIG="$OUT_DIR/.config" scripts/kconfig/merge_config.sh -m -y \
+    "$OUT_DIR/.config" "$DIR/kernel/configs/mici.config"
+  make "${args[@]}" olddefconfig
+  make -j"$(nproc)" "${args[@]}" Image qcom/sdm845-comma-mici.dtb modules
+  make -j"$(nproc)" "${args[@]}" M="$SPECTRA_DIR" modules
 
-  # Force ccache usage for kernel build (both target and host compilers)
-  export PATH="/usr/lib/ccache:$PATH"
-  export HOSTCC="ccache gcc"
-  export HOSTCXX="ccache g++"
+  local tmp="$DIR/build/boot"
+  mkdir -p "$tmp" "$OUTPUT_DIR"
+  python3 - "$OUT_DIR/arch/arm64/boot/Image" \
+    "$OUT_DIR/arch/arm64/boot/dts/qcom/sdm845-comma-mici.dtb" "$tmp/Image-dtb" <<'PY'
+import struct
+import sys
+from pathlib import Path
 
-  # Avoid LINUX_COMPILE_HOST to change on every run thus invalidating cache
-  # https://patchwork.kernel.org/project/linux-kbuild/patch/1302015561-21047-8-git-send-email-mmarek@suse.cz/
-  export KBUILD_BUILD_HOST="docker"
+image = Path(sys.argv[1]).read_bytes()
+dtb = Path(sys.argv[2]).read_bytes()
+Path(sys.argv[3]).write_bytes(b"UNCOMPRESSED_IMG" + struct.pack("<I", len(image)) + image + dtb)
+PY
+  python3 "$TOOLS/mkbootimg" \
+    --kernel "$tmp/Image-dtb" --ramdisk /dev/null \
+    --cmdline 'console=ttyMSM0,115200n8 isolcpus=6,7 earlycon=msm_geni_serial,0xA84000 androidboot.hardware=qcom androidboot.console=ttyMSM0 firmware_class.path=/lib/firmware/updates net.ifnames=0' \
+    --pagesize 4096 --base 0x80000000 --kernel_offset 0x8000 \
+    --ramdisk_offset 0x8000 --tags_offset 0x100 --output "$tmp/boot.img.nonsecure"
 
-  # Disable all warnings
-  export KCFLAGS="-w"
+  openssl dgst -sha256 -binary "$tmp/boot.img.nonsecure" > "$tmp/boot.img.sha256"
+  openssl pkeyutl -sign -in "$tmp/boot.img.sha256" -inkey "$DIR/vble-qti.key" \
+    -out "$tmp/boot.img.sig" -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pkcs1
+  dd if=/dev/zero of="$tmp/boot.img.sig.padded" bs=2048 count=1 status=none
+  dd if="$tmp/boot.img.sig" of="$tmp/boot.img.sig.padded" conv=notrunc status=none
+  cat "$tmp/boot.img.nonsecure" "$tmp/boot.img.sig.padded" > "$OUTPUT_DIR/boot.img"
 
-  # Load defconfig and build kernel
-  echo "-- First make --"
-  make $DEFCONFIG O=out
-  echo "-- Second make: $(nproc --all) cores --"
-  make -j$(nproc --all) O=out  # Image-dtb
-
-  # Turn on if you want perf
-  # LDFLAGS=-static make -j$(nproc --all) -C tools/perf
-
-  # Copy over Image-dtb
-  mkdir -p $TMP_DIR
-  cd $TMP_DIR
-  cp $DIR/agnos-kernel-sdm845/out/arch/arm64/boot/Image-dtb .
-
-  # Make boot image
-  $TOOLS/mkbootimg \
-    --kernel Image-dtb \
-    --ramdisk /dev/null \
-    --cmdline "console=ttyMSM0,115200n8 isolcpus=6,7 quiet loglevel=3 earlycon=msm_geni_serial,0xA84000 androidboot.hardware=qcom androidboot.console=ttyMSM0 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 service_locator.enable=1 androidboot.selinux=permissive firmware_class.path=/firmware/image net.ifnames=0 dyndbg=\"\"" \
-    --pagesize 4096 \
-    --base 0x80000000 \
-    --kernel_offset 0x8000 \
-    --ramdisk_offset 0x8000 \
-    --tags_offset 0x100 \
-    --output $BOOT_IMG.nonsecure
-
-  # le signing
-  openssl dgst -sha256 -binary $BOOT_IMG.nonsecure > $BOOT_IMG.sha256
-  openssl pkeyutl -sign -in $BOOT_IMG.sha256 -inkey $DIR/vble-qti.key -out $BOOT_IMG.sig -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pkcs1
-  dd if=/dev/zero of=$BOOT_IMG.sig.padded bs=2048 count=1
-  dd if=$BOOT_IMG.sig of=$BOOT_IMG.sig.padded conv=notrunc
-  cat $BOOT_IMG.nonsecure $BOOT_IMG.sig.padded > $BOOT_IMG
-
-  # Copy to output dir
-  mkdir -p $OUTPUT_DIR
-  mv $BOOT_IMG $OUTPUT_DIR/
-  cd $DIR/agnos-kernel-sdm845
-
-  echo "-- Install kernel UAPI headers --"
-  rm -rf $OUTPUT_DIR/linux-headers
-  make headers_install O=out INSTALL_HDR_PATH=$OUTPUT_DIR/linux-headers
+  rm -rf "$OUTPUT_DIR/linux-headers"
+  make "${args[@]}" headers_install INSTALL_HDR_PATH="$OUTPUT_DIR/linux-headers"
+  cp -a "$SPECTRA_DIR/uapi/." "$OUTPUT_DIR/linux-headers/include/"
+  rm -rf "$OUTPUT_DIR/kernel-modules"
+  make "${args[@]}" modules_install INSTALL_MOD_PATH="$OUTPUT_DIR/kernel-modules" INSTALL_MOD_STRIP=1
+  make "${args[@]}" M="$SPECTRA_DIR" modules_install \
+    INSTALL_MOD_PATH="$OUTPUT_DIR/kernel-modules" INSTALL_MOD_STRIP=1
+  find "$OUTPUT_DIR/kernel-modules" -type l -name build -delete
+  python3 "$DIR/kernel/package_modules.py" "$OUTPUT_DIR/kernel-modules" \
+    --report "$OUTPUT_DIR/modules-mici.json"
 }
 
-# Run build_kernel in container
-docker exec -u $(id -nu) $CONTAINER_ID bash -c "set -e; export DEFCONFIG=$DEFCONFIG DIR=$DIR TOOLS=$TOOLS TMP_DIR=$TMP_DIR OUTPUT_DIR=$OUTPUT_DIR BOOT_IMG=$BOOT_IMG; $(declare -f build_kernel); build_kernel"
+docker run --rm -i -u "$(id -u):$(id -g)" -v "$DIR:$DIR" -w "$DIR" \
+  --entrypoint bash agnos-mainline-builder <<EOF
+set -euo pipefail
+DIR='$DIR'
+KERNEL_DIR='$KERNEL_DIR'
+OUT_DIR='$OUT_DIR'
+SPECTRA_DIR='$SPECTRA_DIR'
+OUTPUT_DIR='$OUTPUT_DIR'
+TOOLS='$TOOLS'
+$(declare -f build_kernel)
+build_kernel
+EOF
diff --git a/build_system.sh b/build_system.sh
index 3c34473..59824cd 100755
--- a/build_system.sh
+++ b/build_system.sh
@@ -52,7 +52,7 @@ if [ ! -z "$NS" ]; then
   fi
   BUILD="nsc build --region ${NS_REGION:-us} --output-local $BUILD_DIR/image --build-arg ZSTD=1"
 fi
-GIT_HASH=${GIT_HASH:-$(git --git-dir=$DIR/.git rev-parse HEAD)}
+GIT_HASH=${GIT_HASH:-$(git -C "$DIR" rev-parse HEAD)}
 rm -rf $BUILD_DIR/image
 $BUILD -f Dockerfile.agnos $DIR --platform=linux/arm64 \
   --build-arg UBUNTU_BASE_IMAGE=$UBUNTU_FILE \
diff --git a/kernel/README.md b/kernel/README.md
new file mode 100644
index 0000000..161c7b1
--- /dev/null
+++ b/kernel/README.md
@@ -0,0 +1,104 @@
+# mici mainline kernel
+
+This builds only `sdm845-comma-mici.dtb`. The Ubuntu base, system layout and
+Android boot-image format remain those used by AGNOS master.
+
+## Sources
+
+- `linux`: upstream Linux v7.3, commit
+  `c03c1a14507dfaf8b856c2608f9ac216021fc222`.
+- `spectra`: commaai/vamos, commit
+  `7626c378c3d5762df673dd14d457631057779d27`. Only its
+  `kernel/spectra-camera` source is built. Its README records the original
+  Qualcomm camera source and the mainline port's provenance.
+- `patches`: ordered Linux changes, applied with strict whitespace checks.
+  Display, touch, SPI and Wi-Fi patches retain their original author headers.
+  Camera clock/GPIO and Venus fixes extend the existing vamos approach.
+- `dts`: the mici board, its common SDM845 wiring, and the retained Spectra
+  camera nodes. There are three camera sensors; the unused fourth sensor and
+  its supplies are omitted.
+
+Both submodules stay unmodified. `build_kernel.sh` reconstructs generated
+sources under `build/` when their pins or patches change, then merges
+`configs/mici.config` into arm64 defconfig.
+
+## Camera approach
+
+Upstream SDM845 CAMSS can capture all three OS04C10 sensors as RAW12. It does
+not yet provide the complete image-processing path used by openpilot. The
+investigated IFE YUV/stats/parameters series targets newer VFE hardware, and
+the OPE series targets a different processing block. This port reuses the
+existing vamos Spectra driver to retain the production ISP/BPS configuration,
+sensor tuning, exposure control and synchronization ABI.
+
+The camera driver is a separate GPL module built against the exact kernel
+output. Its expected out-of-tree taint bit is 4096; other taint bits, GPU
+recoveries and kernel warnings still need investigation. Its UAPI headers are
+installed with the kernel headers. Firmware remains the existing
+`CAMERA_ICP.elf`; the UP's operating system is not part of the port.
+
+## Build
+
+```sh
+git submodule update --init kernel/linux kernel/spectra
+./build_kernel.sh
+./build_system.sh
+```
+
+The build produces `output/boot.img`, `output/kernel-modules/`,
+`output/linux-headers/` and `output/system.img`. The system-image build consumes
+the matching headers and modules from the kernel build. Do not run the two
+builds concurrently when preparing a release pair.
+
+Qualcomm audio/video/camera modules load after the existing firmware mount.
+Wi-Fi and Bluetooth UART drivers load as modules after the root filesystem is
+available, so early firmware requests cannot fail before their files exist.
+QRTR, remote storage and firmware file services replace the downstream
+modem/Wi-Fi userspace daemons. Mesa and the pinned COMMA raylib build replace
+the KGSL graphics runtime. Source pins and license notices are installed in
+the resulting image.
+
+The QRTR patches retain Igor Opaniuk's October 19, 2026 upstream
+[HELLO-gate fixes](https://lore.kernel.org/all/20261019-upstream-qrtr-hello-gate-fix_b4-v1-0-bd420aec171b@oss.qualcomm.com/).
+They preserve service announcements while a new remote endpoint is not ready
+to receive its first HELLO. Losing those announcements on Linux 7.3 prevented
+the modem from finding remote storage and caused repeated startup watchdogs.
+Repeated cold and warm boots must verify modem and Wi-Fi readiness without
+relying on recovery from an initial crash.
+
+Per-device panel gamma curves are staged from `/persist/comma/dwo_gamma_curves`
+before the first DRM modeset. The panel uses its defaults when calibration is
+absent. Framebuffer console emulation is disabled so it cannot prepare the
+panel before the calibration service runs.
+
+## USB-C
+
+Mici's external port uses the shared Qualcomm gen1 TCPM backend, DWC3 role
+switching and QMP SuperSpeed orientation switching. Its dedicated PMI8998
+VBUS regulator provides bounded source readiness, standard fault notifications
+and shutdown cleanup; the internal modem remains on the secondary fixed host.
+These drivers are built in for early ADB/NCM availability.
+
+[USB provenance and testing](USB.md) records the upstream RFC, local changes,
+42 fault scenarios and the remaining physical acceptance checks. Static review
+and compilation do not establish source voltage, fault recovery, both cable
+orientations or actual chestnut acceptance.
+
+## Openpilot integration and testing
+
+The matching local openpilot changes use MSM/IR3 tinygrad, DMA-BUF ownership
+and CPU-access synchronization, standard Venus encoding/decoding, Mesa EGL,
+and the mainline hardware interfaces. A stock KGSL/ION openpilot build is not
+a validation target for this image. Companion changes are maintained locally
+for review and transfer; this repository does not publish their PRs.
+
+Use the AGNOS `TESTING.md` checklist in addition to openpilot's camera and
+onroad tests. Validate repeated model/warp execution, camera restarts and
+error recovery, segment drains, clip decoding, UI handoffs, power management,
+boot/time/network readiness, and peripheral behavior. A single passing
+onroad run is insufficient. Keep fixture limitations and stock failures
+separate from mainline failures, and preserve logs from unsuccessful runs.
+
+Flash and recover only the reserved DUT. Back up its boot images, system and
+test state first; verify the active slot and image hashes. Never reflash the
+UP. Do not hot-unbind the GPU, display controller or CAMCC during testing.
diff --git a/kernel/USB.md b/kernel/USB.md
new file mode 100644
index 0000000..c513c96
--- /dev/null
+++ b/kernel/USB.md
@@ -0,0 +1,100 @@
+# mici USB-C
+
+The mici board connects its external USB-C port to the primary DWC3/QMP
+controller and the Quectel modem to the secondary controller. The primary
+controller uses USB role switching; the secondary remains a fixed host.
+The connector graph connects the PMI8998 Type-C controller to DWC3 for data
+roles and to the QMP combo PHY for SuperSpeed orientation.
+
+TCPM, the Qualcomm PMIC backend and the VBUS regulator are built in so the
+port does not depend on loading modules before ADB/NCM becomes available.
+Userspace reads the standard Type-C partner/orientation and UDC interfaces.
+There is no fabricated connection state or orientation attribute.
+
+## Provenance
+
+Patch 0027 is an unmodified aggregate of patches 01, 03, 04, 05, 06, 08 from David
+Heidelberg's September 26, 2026 RFC,
+[Qualcomm Type-C support for 1st generation](https://lore.kernel.org/all/20260926-typec-v1-0-31adc19f32c6@ixit.cz/).
+The [series archive](https://patchew.org/linux/20260926-typec-v1-0-31adc19f32c6@ixit.cz/)
+records review discussion and the original mails. Its downloaded mbox SHA256
+is `e35d6beaff5089f72ab7c1829a9d295af2f7e35b224120c1aeb46e3581b1969b`.
+The selected changes add the shared TCPM backend, bindings and a disabled
+PMI8998 node. Phone board changes are omitted. The original RFC supports
+externally powered docks; it does not provide VBUS sourcing.
+
+Patch 0028 adds mici's source and fault handling. Its register definitions
+and source/input sequence follow the stock kernel at
+`c368754c26c7b9659de187addc6cccedc6cfb0a0`:
+
+- [SMB2 register definitions](https://github.com/commaai/agnos-kernel-sdm845/blob/c368754c26c7b9659de187addc6cccedc6cfb0a0/drivers/power/supply/qcom/smb-reg.h).
+- [SMB2 source/input handling and protected writes](https://github.com/commaai/agnos-kernel-sdm845/blob/c368754c26c7b9659de187addc6cccedc6cfb0a0/drivers/power/supply/qcom/smb-lib.c).
+- [PMI8998 current-limit encoding](https://github.com/commaai/agnos-kernel-sdm845/blob/c368754c26c7b9659de187addc6cccedc6cfb0a0/drivers/power/supply/qcom/qpnp-smb2.c).
+- [Board PD/VBUS wiring](https://github.com/commaai/agnos-kernel-sdm845/blob/c368754c26c7b9659de187addc6cccedc6cfb0a0/arch/arm64/boot/dts/qcom/comma_common.dtsi).
+
+PMI8998 uses 250 mA current-limit steps through 2 A, rather than PM8150B's
+500 mA steps. The board advertises 5 V / 1.5 A source and 5 V / 3 A sink operation.
+Its conservative 7.5 W sink operating-power policy permits a normal contract
+with a 5 V / 1.5 A supply. TCPM can still request 3 A from a capable source.
+Source enable suspends USBIN, exits the buck/boost 1-in-8 mode, enables OTG,
+and waits up to 250 ms for actual boost softstart and enabled status. The
+engineering register and PBS workaround use the required SEC_ACCESS unlock.
+
+OTG failure/overcurrent IRQs emit standard regulator notifications. The
+Type-C consumer and aggregate VBUS/VCONN fault IRQs request standard TCPM
+error recovery. Source readiness uses actual regulator status/error flags.
+Shutdown stops callbacks and TCPM before disabling VBUS/VCONN and selecting
+the sink role.
+
+The primary VBUS output is dedicated to the connector, with one intended
+consumer. The charger remains disabled. Recovery uses regulator force-disable
+for an unowned failed or inherited output, including when CMD_OTG is already
+off but engineering state still needs cleanup. It never enables an output
+to acquire a cleanup reference. USBIN restoration stays pending across failed
+cleanup and retries. Adding another consumer or enabling the charger requires
+coordinating ownership; independent debugfs/raw regulator control is unsuitable.
+
+## Fault tests
+
+After generating the patched source with `build_kernel.sh`, run:
+
+```sh
+python3 -m unittest discover -s kernel/tests -v
+```
+
+`AGNOS_USB_KERNEL_SOURCE` can select another prepared kernel source directory.
+The tests compile the actual proposed C helpers with injected regmap,
+regulator and TCPM interfaces. They use a host C compiler and Python's standard
+library, without target hardware.
+
+There are 42 scenarios across three test runners:
+
+- 27 gen1 source/input, boot reconciliation, notifier lifetime and retry cases.
+- 11 provider readiness, protected-register, rollback and fault-event cases.
+- 4 shutdown ordering and error-continuation cases.
+
+Coverage includes regulator enable failure followed by failed USBIN restore;
+preserving the original input snapshot during retries; a provider clearing
+CMD_OTG before HALT restoration fails; an on request after partial owned
+disable; query-to-cleanup races without re-sourcing; pending teardown; startup
+timeouts; VCONN-off with an unreadable orientation register; and callbacks
+after the TCPM pointer has been cleared.
+
+The complete stack has passed strict patch application, targeted ARM64
+compilation with the built-in configuration, these fault tests and independent
+static review. These checks do not establish physical USB acceptance.
+
+## Physical acceptance
+
+Validate source voltage/readiness, source-off discharge, current limiting,
+overcurrent/VCONN recovery, bootloader handoff, cold/warm reboot, PD/data roles,
+USB3 attach/replug and both cable orientations. Confirm modem independence
+throughout. A powered UP gadget can exercise a host link once its temporary
+gadget configuration and recovery path are explicitly prepared.
+
+Actual chestnut enumeration, firmware activation/recovery, sustained GPU
+inference, hotplug and 12 V loss/recovery still require a physical fixture.
+Chestnut's external GPU power does not establish that its USB bridge remains
+powered without VBUS. Firmware power cycling should use tested standard
+Type-C control, with a measured VBUS drop; switching only the USB data role
+does not guarantee that VBUS is off.
diff --git a/kernel/configs/mici.config b/kernel/configs/mici.config
new file mode 100644
index 0000000..1bb9085
--- /dev/null
+++ b/kernel/configs/mici.config
@@ -0,0 +1,242 @@
+# GRAPHICS
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_DRM=y
+# CONFIG_DRM_FBDEV_EMULATION is not set
+CONFIG_DRM_DISPLAY_HELPER=y
+CONFIG_DRM_MIPI_DSI=y
+CONFIG_DRM_MSM=y
+CONFIG_DRM_PANEL=y
+CONFIG_DRM_PANEL_DWO_DO0200FAT07=y
+CONFIG_QCOM_LLCC=y
+CONFIG_QCOM_OCMEM=y
+CONFIG_REGULATOR_QCOM_REFGEN=y
+
+# OVERLAYFS
+CONFIG_OVERLAY_FS=y
+
+# UFS
+CONFIG_PHY_QCOM_QMP=y
+CONFIG_PHY_QCOM_QMP_UFS=y
+CONFIG_SCSI_UFS_QCOM=y
+
+# USB
+CONFIG_PHY_QCOM_QMP_COMBO=y
+CONFIG_PHY_QCOM_QMP_USB=y
+CONFIG_PHY_QCOM_QUSB2=y
+CONFIG_TYPEC=y
+CONFIG_TYPEC_TCPM=y
+CONFIG_TYPEC_QCOM_PMIC=y
+CONFIG_REGULATOR_QCOM_USB_VBUS=y
+CONFIG_USB_ROLE_SWITCH=y
+CONFIG_USB_DWC3_DUAL_ROLE=y
+CONFIG_USB_CONFIGFS=y
+CONFIG_USB_SERIAL=y
+CONFIG_USB_SERIAL_WWAN=y
+CONFIG_USB_SERIAL_OPTION=y
+
+# Networking
+CONFIG_IPV6=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NFT_CT=y
+
+# Bluetooth
+CONFIG_BT=y
+CONFIG_BT_LE=y
+CONFIG_BT_QCA=m
+CONFIG_POWER_SEQUENCING=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_SERDEV=y
+CONFIG_BT_HCIUART_H4=y
+CONFIG_BT_HCIUART_QCA=y
+
+# WiFi
+CONFIG_RFKILL=y
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_ATH10K=m
+CONFIG_ATH10K_SNOC=m
+
+# Remoteproc / Modem
+CONFIG_QCOM_RMTFS_MEM=y
+CONFIG_QCOM_Q6V5_MSS=y
+CONFIG_QCOM_SYSMON=y
+CONFIG_RPMSG_QCOM_GLINK_SMEM=y
+CONFIG_QRTR=y
+CONFIG_QRTR_SMD=y
+CONFIG_QCOM_PDR_HELPERS=y
+CONFIG_RPMSG_CHAR=y
+CONFIG_RESET_QCOM_PDC=y
+
+# PPP (for USB LTE modem data connection)
+CONFIG_PPP=y
+CONFIG_PPP_ASYNC=y
+CONFIG_PPP_DEFLATE=y
+CONFIG_PPP_BSDCOMP=y
+CONFIG_PPP_MPPE=y
+
+# I2C
+CONFIG_I2C_QCOM_GENI=y
+
+# SPI
+CONFIG_SPI_QCOM_GENI=y
+CONFIG_SPI_SPIDEV=y
+CONFIG_QCOM_GPI_DMA=y
+
+# Touchscreen
+CONFIG_TOUCHSCREEN_EDT_FT5X06=y
+
+# GPIO
+# TODO: migrate gpio.sh, lte.sh, and power_drop_monitor.py to chardev (libgpiod)
+# and remove GPIO_SYSFS (deprecated)
+CONFIG_EXPERT=y
+CONFIG_GPIO_SYSFS=y
+
+# Misc
+CONFIG_LOCALVERSION_AUTO=n
+CONFIG_DRM_MSM_GPU_STATE=y
+CONFIG_DMABUF_HEAPS=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DMABUF_HEAPS_CMA=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_VIDEO_DEV=y
+# CONFIG_VIDEO_QCOM_CAMSS is not set
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
+CONFIG_VIDEO_QCOM_VENUS=m
+CONFIG_I2C_CHARDEV=y
+CONFIG_POWER_RESET_QCOM_PON=y
+CONFIG_INTERCONNECT_QCOM_OSM_L3=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_HID_MULTITOUCH=y
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_SQUASHFS_ZSTD=y
+CONFIG_FW_LOADER_USER_HELPER=y
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_USER_API_SKCIPHER=y
+CONFIG_QCOM_Q6V5_PAS=m
+CONFIG_QCOM_PD_MAPPER=y
+CONFIG_QCOM_APR=y
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_SOC=y
+CONFIG_SND_SOC_QCOM=y
+CONFIG_SND_SOC_QDSP6=y
+CONFIG_SND_SOC_SDM845=y
+CONFIG_SND_SOC_SPDIF=y
+
+# LMh supplies the interrupt domains required by the SDM845 CPUFreq driver.
+CONFIG_QCOM_LMH=y
+CONFIG_QCOM_SPMI_TEMP_ALARM=y
+# Ubuntu selects iptables-legacy; preserve its firewall tables and hotspot NAT.
+CONFIG_NETFILTER_XTABLES=y
+CONFIG_NETFILTER_XTABLES_LEGACY=y
+CONFIG_IP_NF_IPTABLES=y
+CONFIG_IP_NF_IPTABLES_LEGACY=y
+CONFIG_IP_NF_FILTER=y
+CONFIG_IP_NF_NAT=y
+CONFIG_IP_NF_MANGLE=y
+CONFIG_IP_NF_RAW=y
+CONFIG_IP_NF_SECURITY=y
+CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_IP6_NF_IPTABLES=y
+CONFIG_IP6_NF_IPTABLES_LEGACY=y
+CONFIG_IP6_NF_FILTER=y
+CONFIG_IP6_NF_NAT=y
+CONFIG_IP6_NF_MANGLE=y
+CONFIG_IP6_NF_RAW=y
+CONFIG_IP6_NF_SECURITY=y
+CONFIG_IP6_NF_TARGET_REJECT=y
+CONFIG_NETFILTER_XT_MATCH_STATE=y
+CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
+
+# Seed the kernel RNG and preserve the PMIC clock before userspace starts.
+CONFIG_HW_RANDOM_QCOM=y
+CONFIG_RTC_DRV_PM8XXX=y
+
+# PMIC ADCs provide die and board thermistor temperatures.
+CONFIG_QCOM_SPMI_ADC5=y
+CONFIG_QCOM_SPMI_ADC_TM5=y
+CONFIG_SOUNDWIRE=y
+CONFIG_SDM_CAMCC_845=y
+# CONFIG_I2C_QCOM_CCI is not set
+CONFIG_QCOM_SOCINFO=y
+
+CONFIG_MODULE_COMPRESS_ZSTD=y
+
+CONFIG_MODULE_COMPRESS=y
+
+# Spectra manages its shared camera GPIOs through its resource manager.
+# CONFIG_GPIO_SHARED is not set
+
+# Batteryless SoM rail monitoring
+CONFIG_QCOM_SPMI_FG_ADC=y
+CONFIG_SENSORS_IIO_HWMON=y
+
+# Cabin IR illumination (PMI8998 channel 3, 300 mA maximum)
+CONFIG_LEDS_CLASS_FLASH=y
+CONFIG_LEDS_QCOM_FLASH=y
+
+# Preserve console/userspace logs and the bootloader's power-drop cookie.
+CONFIG_PSTORE=y
+CONFIG_PSTORE_RAM=y
+CONFIG_PSTORE_CONSOLE=y
+CONFIG_PSTORE_PMSG=y
+
+# Build only Qualcomm SoC platforms; retain generic ARM64 and peripheral support.
+CONFIG_ARCH_QCOM=y
+# CONFIG_ARCH_ACTIONS is not set
+# CONFIG_ARCH_AIROHA is not set
+# CONFIG_ARCH_SUNXI is not set
+# CONFIG_ARCH_ALPINE is not set
+# CONFIG_ARCH_APPLE is not set
+# CONFIG_ARCH_ARTPEC is not set
+# CONFIG_ARCH_ASPEED is not set
+# CONFIG_ARCH_AXIADO is not set
+# CONFIG_ARCH_BCM is not set
+# CONFIG_ARCH_BCM2835 is not set
+# CONFIG_ARCH_BCM_IPROC is not set
+# CONFIG_ARCH_BCMBCA is not set
+# CONFIG_ARCH_BRCMSTB is not set
+# CONFIG_ARCH_BERLIN is not set
+# CONFIG_ARCH_BLAIZE is not set
+# CONFIG_ARCH_BST is not set
+# CONFIG_ARCH_CIX is not set
+# CONFIG_ARCH_EXYNOS is not set
+# CONFIG_ARCH_K3 is not set
+# CONFIG_ARCH_LG1K is not set
+# CONFIG_ARCH_HISI is not set
+# CONFIG_ARCH_KEEMBAY is not set
+# CONFIG_ARCH_MEDIATEK is not set
+# CONFIG_ARCH_MESON is not set
+# CONFIG_ARCH_MICROCHIP is not set
+# CONFIG_ARCH_SPARX5 is not set
+# CONFIG_ARCH_MVEBU is not set
+# CONFIG_ARCH_NXP is not set
+# CONFIG_ARCH_LAYERSCAPE is not set
+# CONFIG_ARCH_MXC is not set
+# CONFIG_ARCH_S32 is not set
+# CONFIG_ARCH_MA35 is not set
+# CONFIG_ARCH_NPCM is not set
+# CONFIG_ARCH_REALTEK is not set
+# CONFIG_ARCH_RENESAS is not set
+# CONFIG_ARCH_ROCKCHIP is not set
+# CONFIG_ARCH_SEATTLE is not set
+# CONFIG_ARCH_INTEL_SOCFPGA is not set
+# CONFIG_ARCH_SOPHGO is not set
+# CONFIG_ARCH_STM32 is not set
+# CONFIG_ARCH_SYNQUACER is not set
+# CONFIG_ARCH_TEGRA is not set
+# CONFIG_ARCH_TESLA_FSD is not set
+# CONFIG_ARCH_SPRD is not set
+# CONFIG_ARCH_THUNDER is not set
+# CONFIG_ARCH_THUNDER2 is not set
+# CONFIG_ARCH_UNIPHIER is not set
+# CONFIG_ARCH_VEXPRESS is not set
+# CONFIG_ARCH_VISCONTI is not set
+# CONFIG_ARCH_XGENE is not set
+# CONFIG_ARCH_ZYNQMP is not set
diff --git a/kernel/dts/sdm845-comma-common.dtsi b/kernel/dts/sdm845-comma-common.dtsi
new file mode 100644
index 0000000..7a65fb3
--- /dev/null
+++ b/kernel/dts/sdm845-comma-common.dtsi
@@ -0,0 +1,522 @@
+/dts-v1/;
+
+#include <dt-bindings/arm/qcom,ids.h>
+#include <dt-bindings/regulator/qcom,rpmh-regulator.h>
+#include "sdm845.dtsi"
+#include "pm8998.dtsi"
+#include "pmi8998.dtsi"
+
+/ {
+	aliases {
+		serial0 = &uart9;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	lcd3v3: lcd3v3 {
+		compatible = "regulator-fixed";
+		regulator-name = "lcd3v3";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		gpio = <&pm8998_gpios 13 GPIO_ACTIVE_HIGH>;
+		regulator-boot-on;
+	};
+
+	vph_pwr: vph-pwr-regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "vph_pwr";
+		regulator-min-microvolt = <3700000>;
+		regulator-max-microvolt = <3700000>;
+	};
+
+	/*
+	 * Apparently RPMh does not provide support for PM8998 S4 because it
+	 * is always-on; model it as a fixed regulator.
+	 */
+	vreg_s4a_1p8: pm8998-smps4 {
+		compatible = "regulator-fixed";
+		regulator-name = "vreg_s4a_1p8";
+
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+
+		regulator-always-on;
+		regulator-boot-on;
+
+		vin-supply = <&vph_pwr>;
+	};
+};
+
+&apps_rsc {
+	pm8998-rpmh-regulators {
+		compatible = "qcom,pm8998-rpmh-regulators";
+		qcom,pmic-id = "a";
+
+		vdd-s1-supply = <&vph_pwr>;
+		vdd-s2-supply = <&vph_pwr>;
+		vdd-s3-supply = <&vph_pwr>;
+		vdd-s4-supply = <&vph_pwr>;
+		vdd-s5-supply = <&vph_pwr>;
+		vdd-s6-supply = <&vph_pwr>;
+		vdd-s7-supply = <&vph_pwr>;
+		vdd-s8-supply = <&vph_pwr>;
+		vdd-s9-supply = <&vph_pwr>;
+		vdd-s10-supply = <&vph_pwr>;
+		vdd-s11-supply = <&vph_pwr>;
+		vdd-s12-supply = <&vph_pwr>;
+		vdd-s13-supply = <&vph_pwr>;
+		vdd-l1-l27-supply = <&vreg_s7a_1p025>;
+		vdd-l2-l8-l17-supply = <&vreg_s3a_1p35>;
+		vdd-l3-l11-supply = <&vreg_s7a_1p025>;
+		vdd-l4-l5-supply = <&vreg_s7a_1p025>;
+		vdd-l6-supply = <&vph_pwr>;
+		vdd-l7-l12-l14-l15-supply = <&vreg_s5a_2p04>;
+		vdd-l9-supply = <&vreg_bob>;
+		vdd-l10-l23-l25-supply = <&vreg_bob>;
+		vdd-l13-l19-l21-supply = <&vreg_bob>;
+		vdd-l16-l28-supply = <&vreg_bob>;
+		vdd-l18-l22-supply = <&vreg_bob>;
+		vdd-l20-l24-supply = <&vreg_bob>;
+		vdd-l26-supply = <&vreg_s3a_1p35>;
+		vin-lvs-1-2-supply = <&vreg_s4a_1p8>;
+
+		vreg_s2a_1p125: smps2 {
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1100000>;
+		};
+
+		vreg_s3a_1p35: smps3 {
+			regulator-min-microvolt = <1352000>;
+			regulator-max-microvolt = <1352000>;
+		};
+
+		vreg_s5a_2p04: smps5 {
+			regulator-min-microvolt = <1904000>;
+			regulator-max-microvolt = <2040000>;
+		};
+
+		vreg_s7a_1p025: smps7 {
+			regulator-min-microvolt = <900000>;
+			regulator-max-microvolt = <1028000>;
+		};
+
+		vdd_qusb_hs0:
+		vdda_hp_pcie_core:
+		vdda_mipi_csi0_0p9:
+		vdda_mipi_csi1_0p9:
+		vdda_mipi_csi2_0p9:
+		vdda_mipi_dsi0_pll:
+		vdda_mipi_dsi1_pll:
+		vdda_qlink_lv:
+		vdda_qlink_lv_ck:
+		vdda_qrefs_0p875:
+		vdda_pcie_core:
+		vdda_pll_cc_ebi01:
+		vdda_pll_cc_ebi23:
+		vdda_sp_sensor:
+		vdda_ufs1_core:
+		vdda_ufs2_core:
+		vdda_usb1_ss_core:
+		vdda_usb2_ss_core:
+		vreg_l1a_0p875: ldo1 {
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <880000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vddpx_10:
+		vreg_l2a_1p2: ldo2 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+			regulator-always-on;
+		};
+
+		vreg_l3a_1p0: ldo3 {
+			regulator-min-microvolt = <1000000>;
+			regulator-max-microvolt = <1000000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vdd_wcss_cx:
+		vdd_wcss_mx:
+		vdda_wcss_pll:
+		vreg_l5a_0p8: ldo5 {
+			regulator-min-microvolt = <800000>;
+			regulator-max-microvolt = <800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vddpx_13:
+		vreg_l6a_1p8: ldo6 {
+			regulator-min-microvolt = <1856000>;
+			regulator-max-microvolt = <1856000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l7a_1p8: ldo7 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l8a_1p2: ldo8 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1248000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l9a_1p8: ldo9 {
+			regulator-min-microvolt = <1704000>;
+			regulator-max-microvolt = <2928000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l10a_1p8: ldo10 {
+			regulator-min-microvolt = <1704000>;
+			regulator-max-microvolt = <2928000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l11a_1p0: ldo11 {
+			regulator-min-microvolt = <1000000>;
+			regulator-max-microvolt = <1048000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vdd_qfprom:
+		vdd_qfprom_sp:
+		vdda_apc1_cs_1p8:
+		vdda_gfx_cs_1p8:
+		vdda_qrefs_1p8:
+		vdda_qusb_hs0_1p8:
+		vddpx_11:
+		vreg_l12a_1p8: ldo12 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vddpx_2:
+		vreg_l13a_2p95: ldo13 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <2960000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l14a_1p88: ldo14 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l15a_1p8: ldo15 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l16a_2p7: ldo16 {
+			regulator-min-microvolt = <2704000>;
+			regulator-max-microvolt = <2704000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l17a_1p3: ldo17 {
+			regulator-min-microvolt = <1304000>;
+			regulator-max-microvolt = <1304000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l18a_2p7: ldo18 {
+			regulator-min-microvolt = <2704000>;
+			regulator-max-microvolt = <2960000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l19a_3p0: ldo19 {
+			regulator-min-microvolt = <2856000>;
+			regulator-max-microvolt = <3104000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l20a_2p95: ldo20 {
+			regulator-min-microvolt = <2704000>;
+			regulator-max-microvolt = <2960000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l21a_2p95: ldo21 {
+			regulator-min-microvolt = <2704000>;
+			regulator-max-microvolt = <2960000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l22a_2p85: ldo22 {
+			regulator-min-microvolt = <2864000>;
+			regulator-max-microvolt = <3312000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l23a_3p3: ldo23 {
+			regulator-min-microvolt = <3000000>;
+			regulator-max-microvolt = <3312000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vdda_qusb_hs0_3p1:
+		vreg_l24a_3p075: ldo24 {
+			regulator-min-microvolt = <3088000>;
+			regulator-max-microvolt = <3088000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l25a_3p3: ldo25 {
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3312000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vdda_hp_pcie_1p2:
+		vdda_hv_ebi0:
+		vdda_hv_ebi1:
+		vdda_hv_ebi2:
+		vdda_hv_ebi3:
+		vdda_mipi_csi_1p25:
+		vdda_mipi_dsi0_1p2:
+		vdda_mipi_dsi1_1p2:
+		vdda_pcie_1p2:
+		vdda_ufs1_1p2:
+		vdda_ufs2_1p2:
+		vdda_usb1_ss_1p2:
+		vdda_usb2_ss_1p2:
+		vreg_l26a_1p2: ldo26 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_l28a_3p0: ldo28 {
+			regulator-min-microvolt = <2856000>;
+			regulator-max-microvolt = <3008000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+		};
+
+		vreg_lvs1a_1p8: lvs1 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+		};
+
+		vreg_lvs2a_1p8: lvs2 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+		};
+	};
+
+	pmi8998-rpmh-regulators {
+		compatible = "qcom,pmi8998-rpmh-regulators";
+		qcom,pmic-id = "b";
+
+		vdd-bob-supply = <&vph_pwr>;
+
+		vreg_bob: bob {
+			regulator-min-microvolt = <3312000>;
+			regulator-max-microvolt = <3600000>;
+			regulator-initial-mode = <RPMH_REGULATOR_MODE_AUTO>;
+			regulator-allow-bypass;
+		};
+	};
+
+	pm8005-rpmh-regulators {
+		compatible = "qcom,pm8005-rpmh-regulators";
+		qcom,pmic-id = "c";
+
+		vdd-s1-supply = <&vph_pwr>;
+		vdd-s2-supply = <&vph_pwr>;
+		vdd-s3-supply = <&vph_pwr>;
+		vdd-s4-supply = <&vph_pwr>;
+
+		vreg_s3c_0p6: smps3 {
+			regulator-min-microvolt = <600000>;
+			regulator-max-microvolt = <600000>;
+		};
+	};
+};
+
+&gcc {
+	protected-clocks = <GCC_QSPI_CORE_CLK>,
+			   <GCC_QSPI_CORE_CLK_SRC>,
+			   <GCC_QSPI_CNOC_PERIPH_AHB_CLK>,
+			   <GCC_LPASS_Q6_AXI_CLK>,
+			   <GCC_LPASS_SWAY_CLK>;
+};
+
+&gmu {
+	status = "okay";
+};
+
+&gpi_dma0 {
+	status = "okay";
+};
+
+&gpu {
+	status = "okay";
+
+	zap-shader {
+		memory-region = <&gpu_mem>;
+		firmware-name = "qcom/sdm845/a630_zap.mbn";
+	};
+};
+
+&i2c4 {
+	clock-frequency = <400000>;
+
+	status = "okay";
+};
+
+&i2c5 {
+	clock-frequency = <100000>;
+
+	status = "okay";
+};
+
+&mdss {
+	status = "okay";
+};
+
+&mdss_dsi0 {
+	vdda-supply = <&vdda_mipi_dsi0_1p2>;
+
+	status = "okay";
+};
+
+&mdss_dsi0_phy {
+	vdds-supply = <&vdda_mipi_dsi0_pll>;
+
+	status = "okay";
+};
+
+&mss_pil {
+	firmware-name = "qcom/sdm845/mba.mbn", "qcom/sdm845/modem_nm.mbn";
+
+	status = "okay";
+};
+
+&qupv3_id_0 {
+	status = "okay";
+};
+
+&qupv3_id_1 {
+	status = "okay";
+};
+
+&spi0 {
+	status = "okay";
+
+	panda_spi: spidev@0 {
+		compatible = "commaai,panda";
+		spi-max-frequency = <50000000>;
+		reg = <0>;
+	};
+};
+
+&uart6 {
+	pinctrl-0 = <&qup_uart6_4pin>;
+
+	status = "okay";
+
+	bluetooth {
+		compatible = "qcom,wcn3990-bt";
+		vddio-supply = <&vreg_s4a_1p8>;
+		vddxo-supply = <&vreg_l7a_1p8>;
+		vddrf-supply = <&vreg_l17a_1p3>;
+		vddch0-supply = <&vreg_l25a_3p3>;
+		max-speed = <3200000>;
+	};
+};
+
+&uart9 {
+	status = "okay";
+};
+
+&ufs_mem_hc {
+	reset-gpios = <&tlmm 150 GPIO_ACTIVE_LOW>;
+
+	vcc-supply = <&vreg_l20a_2p95>;
+	vcc-max-microamp = <600000>;
+
+	status = "okay";
+};
+
+&ufs_mem_phy {
+	vdda-phy-supply = <&vdda_ufs1_core>;
+	vdda-pll-supply = <&vdda_ufs1_1p2>;
+	vdda-phy-max-microamp = <62900>;
+	vdda-pll-max-microamp = <18300>;
+
+	status = "okay";
+};
+
+&usb_1 {
+	status = "okay";
+};
+
+&usb_1_dwc3 {
+	dr_mode = "peripheral";
+};
+
+&usb_1_hsphy {
+	vdd-supply = <&vdd_qusb_hs0>;
+	vdda-phy-dpdm-supply = <&vdda_qusb_hs0_3p1>;
+	vdda-pll-supply = <&vdda_qusb_hs0_1p8>;
+
+	status = "okay";
+};
+
+&usb_1_qmpphy {
+	vdda-phy-supply = <&vdda_usb1_ss_1p2>;
+	vdda-pll-supply = <&vdda_usb1_ss_core>;
+
+	status = "okay";
+};
+
+&usb_2 {
+	status = "okay";
+};
+
+&usb_2_dwc3 {
+	dr_mode = "host";
+};
+
+&usb_2_hsphy {
+	vdd-supply = <&vdd_qusb_hs0>;
+	vdda-pll-supply = <&vdda_qusb_hs0_1p8>;
+	vdda-phy-dpdm-supply = <&vdda_qusb_hs0_3p1>;
+
+	status = "okay";
+};
+
+&usb_2_qmpphy {
+	vdda-phy-supply = <&vdda_usb2_ss_1p2>;
+	vdda-pll-supply = <&vdda_usb2_ss_core>;
+
+	status = "okay";
+};
+
+&vreg_lvs1a_1p8 {
+	regulator-always-on;
+};
+
+&wifi {
+	vdd-0.8-cx-mx-supply = <&vreg_l5a_0p8>;
+	vdd-1.3-rfa-supply = <&vreg_l17a_1p3>;
+	vdd-1.8-xo-supply = <&vreg_l7a_1p8>;
+	vdd-3.3-ch0-supply = <&vreg_l25a_3p3>;
+	vdd-3.3-ch1-supply = <&vreg_l23a_3p3>;
+
+	qcom,snoc-host-cap-skip-quirk;
+
+	status = "okay";
+};
diff --git a/kernel/dts/sdm845-comma-mici.dts b/kernel/dts/sdm845-comma-mici.dts
new file mode 100644
index 0000000..4c85f2f
--- /dev/null
+++ b/kernel/dts/sdm845-comma-mici.dts
@@ -0,0 +1,421 @@
+/dts-v1/;
+
+#include "sdm845-comma-common.dtsi"
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/sound/qcom,q6afe.h>
+#include <dt-bindings/sound/qcom,q6asm.h>
+
+/ {
+	model = "comma mici";
+	compatible = "comma,mici", "qcom,sdm845";
+	qcom,msm-id = <QCOM_ID_SDA845 0x20001>, <QCOM_ID_SDM845 0x20001>,
+		      <QCOM_ID_SDM845 0x20000>, <348 0x20001>;
+	qcom,board-id = <0x22 0>;
+
+	reserved-memory {
+		ramoops@b0000000 {
+			compatible = "ramoops";
+			reg = <0 0xb0000000 0 0x003ff000>;
+			record-size = <0x40000>;
+			console-size = <0x40000>;
+			ftrace-size = <0x40000>;
+			pmsg-size = <0x200000>;
+		};
+
+		/* ABL's power-drop cookie is at the end of this page. */
+		cookies@b03ff000 {
+			no-map;
+			reg = <0 0xb03ff000 0 0x1000>;
+		};
+	};
+
+	aliases {
+		hsuart0 = &uart3;
+		i2c0 = &i2c10;
+		i2c1 = &i2c4;
+		i2c2 = &i2c5;
+		i2c4 = &i2c0;
+		i2c5 = &i2c1;
+		i2c10 = &i2c2;
+	};
+};
+
+&i2c10 {
+	clock-frequency = <400000>;
+	status = "okay";
+};
+
+&i2c5 {
+	touchscreen@38 {
+		compatible = "focaltech,ft3168";
+		reg = <0x38>;
+
+		interrupts-extended = <&tlmm 125 IRQ_TYPE_EDGE_FALLING>;
+		reset-gpios = <&tlmm 104 GPIO_ACTIVE_LOW>;
+
+		iovcc-supply = <&vreg_s4a_1p8>;
+		vcc-supply = <&lcd3v3>;
+
+		touchscreen-size-x = <240>;
+		touchscreen-size-y = <536>;
+	};
+};
+
+&mdss_dsi0 {
+	panel@0 {
+		compatible = "dwo,do0200fat07";
+
+		reg = <0>;
+
+		vddio-supply = <&vreg_l14a_1p88>;
+		vdd-supply = <&lcd3v3>;
+
+		reset-gpios = <&tlmm 6 GPIO_ACTIVE_LOW>;
+
+		rotation = <90>;
+
+		port {
+			panel_in: endpoint {
+				remote-endpoint = <&mdss_dsi0_out>;
+			};
+		};
+	};
+};
+
+&mdss_dsi0_out {
+	remote-endpoint = <&panel_in>;
+	data-lanes = <0>;
+};
+
+&uart3 {
+	status = "okay";
+};
+
+&wifi {
+	qcom,calibration-variant = "comma-mici";
+};
+
+/ {
+	spkr_codec: audio-codec-0 {
+		compatible = "linux,spdif-dit";
+		#sound-dai-cells = <0>;
+	};
+
+	mic_codec: audio-codec-1 {
+		compatible = "linux,spdif-dir";
+		#sound-dai-cells = <0>;
+	};
+};
+
+&adsp_pas {
+	firmware-name = "adsp.mdt";
+	status = "okay";
+};
+
+&q6afedai {
+	dai@12 {
+		reg = <SECONDARY_MI2S_RX>;
+		qcom,sd-lines = <1>;
+	};
+
+	dai@13 {
+		reg = <SECONDARY_MI2S_TX>;
+		qcom,sd-lines = <0>;
+	};
+};
+
+&q6asmdai {
+	dai@0 {
+		reg = <MSM_FRONTEND_DAI_MULTIMEDIA1>;
+		direction = <Q6ASM_DAI_RX>;
+	};
+
+	dai@1 {
+		reg = <MSM_FRONTEND_DAI_MULTIMEDIA2>;
+		direction = <Q6ASM_DAI_TX>;
+	};
+};
+
+&sound {
+	compatible = "qcom,sdm845-sndcard";
+	model = "comma-mici";
+	pinctrl-names = "default";
+	pinctrl-0 = <&sec_mi2s_active>;
+
+	mm1-dai-link {
+		link-name = "MultiMedia1";
+		cpu {
+			sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA1>;
+		};
+	};
+
+	mm2-dai-link {
+		link-name = "MultiMedia2";
+		cpu {
+			sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA2>;
+		};
+	};
+
+	speaker-dai-link {
+		link-name = "Secondary MI2S Playback";
+		cpu {
+			sound-dai = <&q6afedai SECONDARY_MI2S_RX>;
+		};
+		platform {
+			sound-dai = <&q6routing>;
+		};
+		codec {
+			sound-dai = <&spkr_codec>;
+		};
+	};
+
+	mic-dai-link {
+		link-name = "Secondary MI2S Capture";
+		cpu {
+			sound-dai = <&q6afedai SECONDARY_MI2S_TX>;
+		};
+		platform {
+			sound-dai = <&q6routing>;
+		};
+		codec {
+			sound-dai = <&mic_codec>;
+		};
+	};
+};
+
+&tlmm {
+	sec_mi2s_active: sec-mi2s-active-state {
+		pins = "gpio80", "gpio81", "gpio82", "gpio83";
+		function = "sec_mi2s";
+		drive-strength = <8>;
+		bias-disable;
+	};
+};
+
+&venus {
+	status = "okay";
+	firmware-name = "venus.mdt";
+};
+
+
+&pm8998_adc {
+	channel@4d {
+		reg = <ADC5_AMUX_THM1_100K_PU>;
+		label = "intake_therm";
+		qcom,ratiometric;
+		qcom,hw-settle-time = <200>;
+	};
+	channel@4e {
+		reg = <ADC5_AMUX_THM2_100K_PU>;
+		label = "exhaust_therm";
+		qcom,ratiometric;
+		qcom,hw-settle-time = <200>;
+	};
+	channel@50 {
+		reg = <ADC5_AMUX_THM4_100K_PU>;
+		label = "bottom_soc_therm";
+		qcom,ratiometric;
+		qcom,hw-settle-time = <200>;
+	};
+	channel@51 {
+		reg = <ADC5_AMUX_THM5_100K_PU>;
+		label = "gnss_therm";
+		qcom,ratiometric;
+		qcom,hw-settle-time = <200>;
+	};
+};
+
+&pm8998_adc_tm {
+	status = "okay";
+	intake-therm@0 {
+		reg = <0>;
+		io-channels = <&pm8998_adc ADC5_AMUX_THM1_100K_PU>;
+		qcom,ratiometric;
+		qcom,hw-settle-time-us = <200>;
+	};
+	exhaust-therm@1 {
+		reg = <1>;
+		io-channels = <&pm8998_adc ADC5_AMUX_THM2_100K_PU>;
+		qcom,ratiometric;
+		qcom,hw-settle-time-us = <200>;
+	};
+	bottom-soc-therm@2 {
+		reg = <2>;
+		io-channels = <&pm8998_adc ADC5_AMUX_THM4_100K_PU>;
+		qcom,ratiometric;
+		qcom,hw-settle-time-us = <200>;
+	};
+	gnss-therm@3 {
+		reg = <3>;
+		io-channels = <&pm8998_adc ADC5_AMUX_THM5_100K_PU>;
+		qcom,ratiometric;
+		qcom,hw-settle-time-us = <200>;
+	};
+};
+
+/ {
+	thermal-zones {
+		intake {
+			polling-delay-passive = <1000>;
+			polling-delay = <0>;
+			thermal-sensors = <&pm8998_adc_tm 0>;
+			trips {
+				intake-alert {
+					temperature = <125000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+		exhaust {
+			polling-delay-passive = <1000>;
+			polling-delay = <0>;
+			thermal-sensors = <&pm8998_adc_tm 1>;
+			trips {
+				exhaust-alert {
+					temperature = <125000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+		bottom_soc {
+			polling-delay-passive = <1000>;
+			polling-delay = <0>;
+			thermal-sensors = <&pm8998_adc_tm 2>;
+			trips {
+				bottom-soc-alert {
+					temperature = <125000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+		gnss {
+			polling-delay-passive = <1000>;
+			polling-delay = <0>;
+			thermal-sensors = <&pm8998_adc_tm 3>;
+			trips {
+				gnss-alert {
+					temperature = <125000>;
+					hysteresis = <10000>;
+					type = "passive";
+				};
+			};
+		};
+	};
+};
+
+/* These board supplies also feed the camera modules. */
+&vreg_l8a_1p2 {
+	regulator-always-on;
+};
+
+&vreg_l19a_3p0 {
+	regulator-always-on;
+};
+
+
+#include "sdm845-comma-spectra.dtsi"
+
+&cam_sensor_mclk0_active { drive-strength = <2>; };
+&cam_sensor_mclk1_active { drive-strength = <2>; };
+&cam_sensor_mclk2_active { drive-strength = <2>; };
+
+/ {
+	som_power: som-power {
+		compatible = "iio-hwmon";
+		io-channels = <&mici_fg_adc 0>, <&mici_fg_adc 1>;
+	};
+};
+
+&pmi8998_lsid0 {
+	mici_fg_adc: adc@4100 {
+		compatible = "qcom,pmi8998-fg-adc";
+		reg = <0x4100>;
+		#io-channel-cells = <1>;
+	};
+};
+
+&pmi8998_flash {
+	status = "okay";
+
+	led-2 {
+		color = <LED_COLOR_ID_IR>;
+		function = LED_FUNCTION_TORCH;
+		led-sources = <3>;
+		led-max-microamp = <300000>;
+	};
+};
+
+/* USB-C / chestnut proposal: requires the gen1 TCPM and PMI8998 VBUS patches. */
+#include <dt-bindings/usb/pd.h>
+
+&pmi8998_lsid0 {
+	mici_vbus: usb-vbus-regulator@1100 {
+		compatible = "qcom,pmi8998-vbus-reg";
+		reg = <0x1100>;
+		interrupts = <0x2 0x11 0x0 IRQ_TYPE_EDGE_RISING>,
+			     <0x2 0x11 0x1 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "otg-fail", "otg-overcurrent";
+		regulator-name = "smb2-vbus";
+		regulator-min-microamp = <1500000>;
+		regulator-max-microamp = <1500000>;
+	};
+};
+
+/* Batteryless mici uses the USBIN controls through the Type-C backend. */
+&pmi8998_charger {
+	status = "disabled";
+};
+
+&pmi8998_typec {
+	status = "okay";
+	vdd-pdphy-supply = <&vreg_l24a_3p075>;
+
+	connector {
+		compatible = "usb-c-connector";
+		power-role = "dual";
+		data-role = "dual";
+		try-power-role = "sink";
+		self-powered;
+		vbus-supply = <&mici_vbus>;
+		source-pdos = <PDO_FIXED(5000, 1500, PDO_FIXED_DUAL_ROLE |
+					PDO_FIXED_USB_COMM | PDO_FIXED_DATA_SWAP)>;
+		sink-pdos = <PDO_FIXED(5000, 3000, PDO_FIXED_DUAL_ROLE |
+				      PDO_FIXED_USB_COMM | PDO_FIXED_DATA_SWAP)>;
+		op-sink-microwatt = <7500000>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				mici_typec_hs: endpoint {
+					remote-endpoint = <&usb_1_dwc3_hs>;
+				};
+			};
+
+			port@1 {
+				reg = <1>;
+				mici_typec_ss: endpoint {
+					remote-endpoint = <&usb_1_qmpphy_out>;
+				};
+			};
+		};
+	};
+};
+
+&usb_1_dwc3 {
+	dr_mode = "otg";
+	usb-role-switch;
+};
+
+&usb_1_dwc3_hs {
+	remote-endpoint = <&mici_typec_hs>;
+};
+
+&usb_1_qmpphy_out {
+	remote-endpoint = <&mici_typec_ss>;
+};
diff --git a/kernel/dts/sdm845-comma-spectra.dtsi b/kernel/dts/sdm845-comma-spectra.dtsi
new file mode 100644
index 0000000..e5e501d
--- /dev/null
+++ b/kernel/dts/sdm845-comma-spectra.dtsi
@@ -0,0 +1,1423 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Camera-only nodes from cameras-spectra-mainline-andi, 391dedc767d9.
+
+#include <dt-bindings/clock/qcom,camcc-sdm845.h>
+#include <dt-bindings/clock/qcom,gcc-sdm845.h>
+#include <dt-bindings/clock/qcom,rpmh.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/interconnect/qcom,icc.h>
+#include <dt-bindings/interconnect/qcom,sdm845.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
+
+/ {
+	titan_top_gdsc: titan-top-gdsc-fixed {
+		compatible = "regulator-fixed";
+		regulator-name = "titan_top_gdsc";
+		regulator-always-on;
+		regulator-boot-on;
+	};
+
+	ife_0_gdsc: ife-0-gdsc-fixed {
+		compatible = "regulator-fixed";
+		regulator-name = "ife_0_gdsc";
+		regulator-always-on;
+		regulator-boot-on;
+	};
+
+	ife_1_gdsc: ife-1-gdsc-fixed {
+		compatible = "regulator-fixed";
+		regulator-name = "ife_1_gdsc";
+		regulator-always-on;
+		regulator-boot-on;
+	};
+
+	ipe_0_gdsc: ipe-0-gdsc-fixed {
+		compatible = "regulator-fixed";
+		regulator-name = "ipe_0_gdsc";
+		regulator-always-on;
+		regulator-boot-on;
+	};
+
+	ipe_1_gdsc: ipe-1-gdsc-fixed {
+		compatible = "regulator-fixed";
+		regulator-name = "ipe_1_gdsc";
+		regulator-always-on;
+		regulator-boot-on;
+	};
+
+	bps_gdsc: bps-gdsc-fixed {
+		compatible = "regulator-fixed";
+		regulator-name = "bps_gdsc";
+		regulator-always-on;
+		regulator-boot-on;
+	};
+
+	camera_rear_ldo: camera-rear-ldo {
+		compatible = "regulator-fixed";
+		regulator-name = "camera_rear_ldo";
+		regulator-min-microvolt = <1050000>;
+		regulator-max-microvolt = <1050000>;
+		gpio = <&pm8998_gpios 12 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		pinctrl-names = "default";
+		pinctrl-0 = <&camera_rear_dvdd_en_default>;
+		regulator-always-on;
+		regulator-boot-on;
+	};
+
+
+
+
+
+
+};
+&camss {
+	status = "disabled";
+};
+
+&cci {
+	status = "disabled";
+};
+
+&pm8998_gpios {
+
+	camera_rear_dvdd_en_default: camera-rear-dvdd-en-state {
+		pins = "gpio12";
+		function = "normal";
+		bias-disable;
+		drive-push-pull;
+		qcom,drive-strength = <PMIC_GPIO_STRENGTH_HIGH>;
+		output-high;
+	};
+
+
+};
+
+&tlmm {
+	cci0_active: cci0-active-state {
+		pins = "gpio17", "gpio18";
+		function = "cci_i2c";
+		bias-pull-up;
+		drive-strength = <2>;
+	};
+
+	cci0_suspend: cci0-suspend-state {
+		pins = "gpio17", "gpio18";
+		function = "cci_i2c";
+		bias-pull-down;
+		drive-strength = <2>;
+	};
+
+	cci1_active: cci1-active-state {
+		pins = "gpio19", "gpio20";
+		function = "cci_i2c";
+		bias-pull-up;
+		drive-strength = <2>;
+	};
+
+	cci1_suspend: cci1-suspend-state {
+		pins = "gpio19", "gpio20";
+		function = "cci_i2c";
+		bias-pull-down;
+		drive-strength = <2>;
+	};
+
+	cam_sensor_mclk0_active: cam-sensor-mclk0-active-state {
+		pins = "gpio13";
+		function = "cam_mclk";
+		bias-disable;
+		drive-strength = <8>;
+	};
+
+	cam_sensor_mclk0_suspend: cam-sensor-mclk0-suspend-state {
+		pins = "gpio13";
+		function = "cam_mclk";
+		bias-pull-down;
+		drive-strength = <8>;
+	};
+
+	cam_sensor_mclk1_active: cam-sensor-mclk1-active-state {
+		pins = "gpio14";
+		function = "cam_mclk";
+		bias-disable;
+		drive-strength = <8>;
+	};
+
+	cam_sensor_mclk1_suspend: cam-sensor-mclk1-suspend-state {
+		pins = "gpio14";
+		function = "cam_mclk";
+		bias-pull-down;
+		drive-strength = <8>;
+	};
+
+	cam_sensor_mclk2_active: cam-sensor-mclk2-active-state {
+		pins = "gpio15";
+		function = "cam_mclk";
+		bias-disable;
+		drive-strength = <8>;
+	};
+
+	cam_sensor_mclk2_suspend: cam-sensor-mclk2-suspend-state {
+		pins = "gpio15";
+		function = "cam_mclk";
+		bias-pull-down;
+		drive-strength = <8>;
+	};
+
+	cam_sensor_mclk3_active: cam-sensor-mclk3-active-state {
+		pins = "gpio16";
+		function = "cam_mclk";
+		bias-disable;
+		drive-strength = <2>;
+	};
+
+	cam_sensor_mclk3_suspend: cam-sensor-mclk3-suspend-state {
+		pins = "gpio16";
+		function = "cam_mclk";
+		bias-pull-down;
+		drive-strength = <2>;
+	};
+
+	cam_sensor_rear_active: cam-sensor-rear-active-state {
+		pins = "gpio9";
+		function = "gpio";
+		bias-disable;
+		drive-strength = <2>;
+	};
+
+	cam_sensor_rear_suspend: cam-sensor-rear-suspend-state {
+		pins = "gpio9";
+		function = "gpio";
+		bias-pull-down;
+		drive-strength = <2>;
+		output-low;
+	};
+
+	cam_sensor_front_active: cam-sensor-front-active-state {
+		pins = "gpio28";
+		function = "gpio";
+		bias-disable;
+		drive-strength = <2>;
+	};
+
+	cam_sensor_front_suspend: cam-sensor-front-suspend-state {
+		pins = "gpio28";
+		function = "gpio";
+		bias-pull-down;
+		drive-strength = <2>;
+		output-low;
+	};
+
+	cam_sensor_iris_active: cam-sensor-iris-active-state {
+		pins = "gpio21";
+		function = "gpio";
+		bias-disable;
+		drive-strength = <2>;
+	};
+
+	cam_sensor_iris_suspend: cam-sensor-iris-suspend-state {
+		pins = "gpio21";
+		function = "gpio";
+		bias-pull-down;
+		drive-strength = <2>;
+		output-low;
+	};
+
+	cam_res_mgr_active: cam-res-mgr-active-state {
+		pins = "gpio8";
+		function = "gpio";
+		bias-disable;
+		drive-strength = <2>;
+	};
+
+	cam_res_mgr_suspend: cam-res-mgr-suspend-state {
+		pins = "gpio8";
+		function = "gpio";
+		bias-disable;
+		drive-strength = <2>;
+		output-low;
+	};
+};
+
+&soc {
+	#address-cells = <2>;
+	#size-cells = <2>;
+	qcom,cam-req-mgr {
+		compatible = "qcom,cam-req-mgr";
+		status = "ok";
+	};
+
+	cam_csiphy0: qcom,csiphy@ac65000 {
+		cell-index = <0>;
+		compatible = "qcom,csiphy-v1.0", "qcom,csiphy";
+		reg = <0 0x0ac65000 0 0x1000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0x65000>;
+		interrupts = <GIC_SPI 477 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&titan_top_gdsc>;
+		regulator-names = "gdscr";
+		csi-vdd-voltage = <1200000>;
+		mipi-csi-vdd-supply = <&vreg_l1a_0p875>;
+		clocks = <&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&clock_camcc CAM_CC_CSIPHY0_CLK>,
+			<&clock_camcc CAM_CC_CSI0PHYTIMER_CLK_SRC>,
+			<&clock_camcc CAM_CC_CSI0PHYTIMER_CLK>;
+		clock-names = "camnoc_axi_clk",
+			"soc_ahb_clk",
+			"slow_ahb_src_clk",
+			"cpas_ahb_clk",
+			"cphy_rx_clk_src",
+			"csiphy0_clk",
+			"csi0phytimer_clk_src",
+			"csi0phytimer_clk";
+		src-clock-name = "csi0phytimer_clk_src";
+		clock-cntl-level = "svs", "turbo";
+		clock-rates =
+			<0 0 0 0 320000000 0 269333333 0>,
+			<0 0 0 0 384000000 0 269333333 0>;
+		status = "ok";
+	};
+
+	cam_csiphy1: qcom,csiphy@ac66000 {
+		cell-index = <1>;
+		compatible = "qcom,csiphy-v1.0", "qcom,csiphy";
+		reg = <0 0x0ac66000 0 0x1000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0x66000>;
+		interrupts = <GIC_SPI 478 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&titan_top_gdsc>;
+		regulator-names = "gdscr";
+		csi-vdd-voltage = <1200000>;
+		mipi-csi-vdd-supply = <&vreg_l1a_0p875>;
+		clocks = <&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&clock_camcc CAM_CC_CSIPHY1_CLK>,
+			<&clock_camcc CAM_CC_CSI1PHYTIMER_CLK_SRC>,
+			<&clock_camcc CAM_CC_CSI1PHYTIMER_CLK>;
+		clock-names = "camnoc_axi_clk",
+			"soc_ahb_clk",
+			"slow_ahb_src_clk",
+			"cpas_ahb_clk",
+			"cphy_rx_clk_src",
+			"csiphy1_clk",
+			"csi1phytimer_clk_src",
+			"csi1phytimer_clk";
+		src-clock-name = "csi1phytimer_clk_src";
+		clock-cntl-level = "svs", "turbo";
+		clock-rates =
+			<0 0 0 0 320000000 0 269333333 0>,
+			<0 0 0 0 384000000 0 269333333 0>;
+		status = "ok";
+	};
+
+	cam_csiphy2: qcom,csiphy@ac67000 {
+		cell-index = <2>;
+		compatible = "qcom,csiphy-v1.0", "qcom,csiphy";
+		reg = <0 0x0ac67000 0 0x1000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0x67000>;
+		interrupts = <GIC_SPI 479 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&titan_top_gdsc>;
+		regulator-names = "gdscr";
+		csi-vdd-voltage = <1200000>;
+		mipi-csi-vdd-supply = <&vreg_l1a_0p875>;
+		clocks = <&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&clock_camcc CAM_CC_CSIPHY2_CLK>,
+			<&clock_camcc CAM_CC_CSI2PHYTIMER_CLK_SRC>,
+			<&clock_camcc CAM_CC_CSI2PHYTIMER_CLK>;
+		clock-names = "camnoc_axi_clk",
+			"soc_ahb_clk",
+			"slow_ahb_src_clk",
+			"cpas_ahb_clk",
+			"cphy_rx_clk_src",
+			"csiphy2_clk",
+			"csi2phytimer_clk_src",
+			"csi2phytimer_clk";
+		src-clock-name = "csi2phytimer_clk_src";
+		clock-cntl-level = "svs", "turbo";
+		clock-rates =
+			<0 0 0 0 320000000 0 269333333 0>,
+			<0 0 0 0 384000000 0 269333333 0>;
+		status = "ok";
+	};
+
+	cam_csiphy3: qcom,csiphy@ac68000 {
+		cell-index = <3>;
+		compatible = "qcom,csiphy-v1.0", "qcom,csiphy";
+		reg = <0 0x0ac68000 0 0x1000>;
+		reg-names = "csiphy";
+		reg-cam-base = <0x68000>;
+		interrupts = <GIC_SPI 448 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&titan_top_gdsc>;
+		regulator-names = "gdscr";
+		csi-vdd-voltage = <1200000>;
+		mipi-csi-vdd-supply = <&vreg_l1a_0p875>;
+		clocks = <&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&clock_camcc CAM_CC_CSIPHY3_CLK>,
+			<&clock_camcc CAM_CC_CSI3PHYTIMER_CLK_SRC>,
+			<&clock_camcc CAM_CC_CSI3PHYTIMER_CLK>;
+		clock-names = "camnoc_axi_clk",
+			"soc_ahb_clk",
+			"slow_ahb_src_clk",
+			"cpas_ahb_clk",
+			"cphy_rx_clk_src",
+			"csiphy3_clk",
+			"csi3phytimer_clk_src",
+			"csi3phytimer_clk";
+		src-clock-name = "csi3phytimer_clk_src";
+		clock-cntl-level = "svs", "turbo";
+		clock-rates =
+			<0 0 0 0 320000000 0 269333333 0>,
+			<0 0 0 0 384000000 0 269333333 0>;
+		status = "ok";
+	};
+
+	cam_cci: qcom,cci@ac4a000 {
+		cell-index = <0>;
+		compatible = "qcom,cci";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0 0x0ac4a000 0 0x4000>;
+		reg-names = "cci";
+		reg-cam-base = <0x4a000>;
+		interrupt-names = "cci";
+		interrupts = <GIC_SPI 460 IRQ_TYPE_EDGE_RISING>;
+		status = "ok";
+		gdscr-supply = <&titan_top_gdsc>;
+		regulator-names = "gdscr";
+		clocks = <&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_CCI_CLK>,
+			<&clock_camcc CAM_CC_CCI_CLK_SRC>;
+		clock-names = "camnoc_axi_clk",
+			"soc_ahb_clk",
+			"slow_ahb_src_clk",
+			"cpas_ahb_clk",
+			"cci_clk",
+			"cci_clk_src";
+		src-clock-name = "cci_clk_src";
+		clock-cntl-level = "lowsvs";
+		clock-rates = <0 0 0 0 0 37500000>;
+		pinctrl-names = "cam_default", "cam_suspend";
+
+		pinctrl-0 = <&cci0_active &cci1_active
+			     &cam_sensor_mclk0_active
+			     &cam_sensor_mclk1_active
+			     &cam_sensor_mclk2_active
+			     &cam_sensor_mclk3_active>;
+		pinctrl-1 = <&cci0_suspend &cci1_suspend
+			     &cam_sensor_mclk0_suspend
+			     &cam_sensor_mclk1_suspend
+			     &cam_sensor_mclk2_suspend
+			     &cam_sensor_mclk3_suspend>;
+		gpios = <&tlmm 17 0>,
+			<&tlmm 18 0>,
+			<&tlmm 19 0>,
+			<&tlmm 20 0>;
+		gpio-req-tbl-num = <0 1 2 3>;
+		gpio-req-tbl-flags = <1 1 1 1>;
+		gpio-req-tbl-label = "CCI_I2C_DATA0",
+					"CCI_I2C_CLK0",
+					"CCI_I2C_DATA1",
+					"CCI_I2C_CLK1";
+
+		i2c_freq_100Khz: qcom,i2c_standard_mode {
+			hw-thigh = <201>;
+			hw-tlow = <174>;
+			hw-tsu-sto = <204>;
+			hw-tsu-sta = <231>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <162>;
+			hw-tbuf = <227>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_400Khz: qcom,i2c_fast_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_custom: qcom,i2c_custom_mode {
+			hw-thigh = <38>;
+			hw-tlow = <56>;
+			hw-tsu-sto = <40>;
+			hw-tsu-sta = <40>;
+			hw-thd-dat = <22>;
+			hw-thd-sta = <35>;
+			hw-tbuf = <62>;
+			hw-scl-stretch-en = <1>;
+			hw-trdhld = <6>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+
+		i2c_freq_1Mhz: qcom,i2c_fast_plus_mode {
+			hw-thigh = <16>;
+			hw-tlow = <22>;
+			hw-tsu-sto = <17>;
+			hw-tsu-sta = <18>;
+			hw-thd-dat = <16>;
+			hw-thd-sta = <15>;
+			hw-tbuf = <24>;
+			hw-scl-stretch-en = <0>;
+			hw-trdhld = <3>;
+			hw-tsp = <3>;
+			cci-clk-src = <37500000>;
+			status = "ok";
+		};
+	};
+
+	qcom,cam_smmu {
+		compatible = "qcom,msm-cam-smmu";
+		status = "ok";
+
+		msm_cam_smmu_ife {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x808 0x0>,
+				<&apps_smmu 0x810 0x8>,
+				<&apps_smmu 0xc08 0x0>,
+				<&apps_smmu 0xc10 0x8>;
+			label = "ife";
+			ife_iova_mem_map: iova-mem-map {
+				iova-mem-region-io {
+					iova-region-name = "io";
+					iova-region-start = <0x7400000>;
+					iova-region-len = <0xd8c00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_jpeg {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x1060 0x8>,
+				<&apps_smmu 0x1068 0x8>;
+			label = "jpeg";
+			jpeg_iova_mem_map: iova-mem-map {
+				iova-mem-region-io {
+					iova-region-name = "io";
+					iova-region-start = <0x7400000>;
+					iova-region-len = <0xd8c00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_icp_fw {
+			compatible = "qcom,msm-cam-smmu-fw-dev";
+			label = "icp";
+			memory-region = <&camera_mem>;
+		};
+
+		msm_cam_smmu_icp {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x1078 0x2>,
+				<&apps_smmu 0x1020 0x8>,
+				<&apps_smmu 0x1040 0x8>,
+				<&apps_smmu 0x1030 0x0>,
+				<&apps_smmu 0x1050 0x0>;
+			label = "icp";
+			icp_iova_mem_map: iova-mem-map {
+				iova-mem-region-firmware {
+					iova-region-name = "firmware";
+					iova-region-start = <0x0>;
+
+					iova-region-len = <0x400000>;
+					iova-region-id = <0x0>;
+					status = "ok";
+				};
+
+				iova-mem-region-shared {
+					iova-region-name = "shared";
+					iova-region-start = <0x7400000>;
+					iova-region-len = <0x6400000>;
+					iova-region-id = <0x1>;
+					status = "ok";
+				};
+
+				iova-mem-region-secondary-heap {
+					iova-region-name = "secheap";
+					iova-region-start = <0xd800000>;
+					iova-region-len = <0x100000>;
+					iova-region-id = <0x4>;
+					status = "ok";
+				};
+
+				iova-mem-region-io {
+					iova-region-name = "io";
+					iova-region-start = <0xda00000>;
+					iova-region-len = <0xd2500000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+
+				iova-mem-qdss-region {
+					iova-region-name = "qdss";
+					iova-region-start = <0xd900000>;
+					iova-region-len = <0x100000>;
+					iova-region-id = <0x5>;
+					qdss-phy-addr = <0x16790000>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_cpas_cdm {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x1000 0x0>;
+			label = "cpas-cdm0";
+			cpas_cdm_iova_mem_map: iova-mem-map {
+				iova-mem-region-io {
+					iova-region-name = "io";
+					iova-region-start = <0x7400000>;
+					iova-region-len = <0xd8c00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+
+		msm_cam_smmu_secure {
+			compatible = "qcom,msm-cam-smmu-cb";
+			label = "cam-secure";
+			qcom,secure-cb;
+		};
+
+		msm_cam_smmu_fd {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&apps_smmu 0x1070 0x0>;
+			label = "fd";
+			fd_iova_mem_map: iova-mem-map {
+				iova-mem-region-io {
+					iova-region-name = "io";
+					iova-region-start = <0x7400000>;
+					iova-region-len = <0xd8c00000>;
+					iova-region-id = <0x3>;
+					status = "ok";
+				};
+			};
+		};
+	};
+
+	qcom,cam-cpas@ac40000 {
+		cell-index = <0>;
+		compatible = "qcom,cam-cpas";
+		label = "cpas";
+		arch-compat = "cpas_top";
+		status = "ok";
+		reg-names = "cam_cpas_top", "cam_camnoc";
+		reg = <0 0x0ac40000 0 0x1000>,
+			<0 0x0ac42000 0 0x5000>;
+		reg-cam-base = <0x40000 0x42000>;
+		interrupt-names = "cpas_camnoc";
+		interrupts = <GIC_SPI 459 IRQ_TYPE_EDGE_RISING>;
+		qcom,cpas-hw-ver = <0x170100>;
+		camnoc-axi-min-ib-bw = <3000000000>;
+		regulator-names = "camss-vdd";
+		camss-vdd-supply = <&titan_top_gdsc>;
+		power-domains = <&clock_camcc TITAN_TOP_GDSC>;
+		clock-names = "gcc_ahb_clk",
+			"gcc_axi_clk",
+			"soc_ahb_clk",
+			"slow_ahb_clk_src",
+			"cpas_ahb_clk",
+			"camnoc_axi_clk";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>;
+		src-clock-name = "slow_ahb_clk_src";
+		clock-rates = <0 0 0 0 0 0>,
+			<0 0 0 19200000 0 0>,
+			<0 0 0 60000000 0 0>,
+			<0 0 0 66660000 0 0>,
+			<0 0 0 73840000 0 0>,
+			<0 0 0 80000000 0 0>,
+			<0 0 0 80000000 0 0>;
+		clock-cntl-level = "suspend", "minsvs", "lowsvs", "svs",
+			"svs_l1", "nominal", "turbo";
+
+		client-id-based;
+
+		client-names =
+			"csiphy0", "csiphy1", "csiphy2", "csiphy3", "cci0",
+			"csid0", "csid1", "csid2",
+			"ife0", "ife1", "ife2", "ipe0",
+			"ipe1", "cam-cdm-intf0", "cpas-cdm0", "bps0",
+			"icp0", "jpeg-dma0", "jpeg-enc0", "fd0", "lrmecpas";
+		client-axi-port-names =
+			"cam_hf_1", "cam_hf_2", "cam_hf_2", "cam_hf_1", "cam_sf_1",
+			"cam_hf_1", "cam_hf_2", "cam_hf_2",
+			"cam_hf_1", "cam_hf_2", "cam_hf_2", "cam_sf_1",
+			"cam_sf_1", "cam_sf_1", "cam_sf_1", "cam_sf_1",
+			"cam_sf_1", "cam_sf_1", "cam_sf_1", "cam_sf_1",
+			"cam_sf_1";
+		client-bus-camnoc-based;
+		qcom,axi-port-list {
+			qcom,axi-port1 {
+				qcom,axi-port-name = "cam_hf_1";
+				qcom,axi-port-mnoc {
+					qcom,msm-bus,name = "cam_hf_1_mnoc";
+					qcom,msm-bus-vector-dyn-vote;
+				};
+				qcom,axi-port-camnoc {
+					qcom,msm-bus,name = "cam_hf_1_camnoc";
+					qcom,msm-bus-vector-dyn-vote;
+				};
+			};
+			qcom,axi-port2 {
+				qcom,axi-port-name = "cam_hf_2";
+				qcom,axi-port-mnoc {
+					qcom,msm-bus,name = "cam_hf_2_mnoc";
+					qcom,msm-bus-vector-dyn-vote;
+				};
+				qcom,axi-port-camnoc {
+					qcom,msm-bus,name = "cam_hf_2_camnoc";
+					qcom,msm-bus-vector-dyn-vote;
+				};
+			};
+			qcom,axi-port3 {
+				qcom,axi-port-name = "cam_sf_1";
+				qcom,axi-port-mnoc {
+					qcom,msm-bus,name = "cam_sf_1_mnoc";
+					qcom,msm-bus-vector-dyn-vote;
+				};
+				qcom,axi-port-camnoc {
+					qcom,msm-bus,name = "cam_sf_1_camnoc";
+					qcom,msm-bus-vector-dyn-vote;
+				};
+			};
+		};
+	};
+
+	qcom,cam-cdm-intf {
+		compatible = "qcom,cam-cdm-intf";
+		cell-index = <0>;
+		label = "cam-cdm-intf";
+		num-hw-cdm = <1>;
+		cdm-client-names = "vfe",
+			"jpegdma",
+			"jpegenc",
+			"fd",
+			"lrmecdm";
+		status = "ok";
+	};
+
+	qcom,cpas-cdm0@ac48000 {
+		cell-index = <0>;
+		compatible = "qcom,cam170-cpas-cdm0";
+		label = "cpas-cdm";
+		reg = <0 0x0ac48000 0 0x1000>;
+		reg-names = "cpas-cdm";
+		reg-cam-base = <0x48000>;
+		interrupts = <GIC_SPI 461 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "cpas-cdm";
+		regulator-names = "camss";
+		camss-supply = <&titan_top_gdsc>;
+		clock-names = "gcc_camera_ahb",
+			"gcc_camera_axi",
+			"cam_cc_soc_ahb_clk",
+			"cam_cc_cpas_ahb_clk",
+			"cam_cc_camnoc_axi_clk";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>;
+		clock-rates = <0 0 0 0 0>;
+		clock-cntl-level = "svs";
+		cdm-client-names = "ife";
+		status = "ok";
+	};
+
+	qcom,cam-isp {
+		compatible = "qcom,cam-isp";
+		arch-compat = "ife";
+		status = "ok";
+	};
+
+	cam_csid0: qcom,csid0@acb3000 {
+		cell-index = <0>;
+		compatible = "qcom,csid170";
+		reg-names = "csid";
+		reg = <0 0x0acb3000 0 0x1000>;
+		reg-cam-base = <0xb3000>;
+		interrupt-names = "csid";
+		interrupts = <GIC_SPI 464 IRQ_TYPE_EDGE_RISING>;
+		regulator-names = "camss", "ife0";
+		camss-supply = <&titan_top_gdsc>;
+		ife0-supply = <&ife_0_gdsc>;
+
+		power-domains = <&clock_camcc IFE_0_GDSC>;
+		clock-names = "camera_ahb",
+			"camera_axi",
+			"soc_ahb_clk",
+			"cpas_ahb_clk",
+			"slow_ahb_clk_src",
+			"ife_csid_clk",
+			"ife_csid_clk_src",
+			"ife_cphy_rx_clk",
+			"cphy_rx_clk_src",
+			"ife_clk",
+			"ife_clk_src",
+			"camnoc_axi_clk",
+			"ife_axi_clk";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_0_CSID_CLK>,
+			<&clock_camcc CAM_CC_IFE_0_CSID_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_0_CPHY_RX_CLK>,
+			<&clock_camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_0_CLK>,
+			<&clock_camcc CAM_CC_IFE_0_CLK_SRC>,
+			<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_IFE_0_AXI_CLK>;
+		clock-rates =
+			<0 0 0 0 0 0 384000000 0 0 0 404000000 0 0>,
+			<0 0 0 0 0 0 538000000 0 0 0 600000000 0 0>;
+		clock-cntl-level = "svs", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+		clock-control-debugfs = "true";
+		status = "ok";
+	};
+
+	cam_vfe0: qcom,vfe0@acaf000 {
+		cell-index = <0>;
+		compatible = "qcom,vfe170";
+		reg-names = "ife";
+		reg = <0 0x0acaf000 0 0x4000>;
+		reg-cam-base = <0xaf000>;
+		interrupt-names = "ife";
+		interrupts = <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>;
+		regulator-names = "camss", "ife0";
+		camss-supply = <&titan_top_gdsc>;
+		ife0-supply = <&ife_0_gdsc>;
+
+		power-domains = <&clock_camcc IFE_0_GDSC>;
+		clock-names = "camera_ahb",
+			"camera_axi",
+			"soc_ahb_clk",
+			"cpas_ahb_clk",
+			"slow_ahb_clk_src",
+			"ife_clk",
+			"ife_clk_src",
+			"camnoc_axi_clk",
+			"ife_axi_clk";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_0_CLK>,
+			<&clock_camcc CAM_CC_IFE_0_CLK_SRC>,
+			<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_IFE_0_AXI_CLK>;
+		clock-rates =
+			<0 0 0 0 0 0 404000000 0 0>,
+			<0 0 0 0 0 0 480000000 0 0>,
+			<0 0 0 0 0 0 600000000 0 0>;
+		clock-cntl-level = "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+		clock-control-debugfs = "true";
+		clock-names-option = "ife_dsp_clk";
+		clocks-option = <&clock_camcc CAM_CC_IFE_0_DSP_CLK>;
+		clock-rates-option = <600000000>;
+		status = "ok";
+	};
+
+	cam_csid1: qcom,csid1@acba000 {
+		cell-index = <1>;
+		compatible = "qcom,csid170";
+		reg-names = "csid";
+		reg = <0 0x0acba000 0 0x1000>;
+		reg-cam-base = <0xba000>;
+		interrupt-names = "csid";
+		interrupts = <GIC_SPI 466 IRQ_TYPE_EDGE_RISING>;
+		regulator-names = "camss", "ife1";
+		camss-supply = <&titan_top_gdsc>;
+		ife1-supply = <&ife_1_gdsc>;
+
+		power-domains = <&clock_camcc IFE_1_GDSC>;
+		clock-names = "camera_ahb",
+			"camera_axi",
+			"soc_ahb_clk",
+			"cpas_ahb_clk",
+			"slow_ahb_clk_src",
+			"ife_csid_clk",
+			"ife_csid_clk_src",
+			"ife_cphy_rx_clk",
+			"cphy_rx_clk_src",
+			"ife_clk",
+			"ife_clk_src",
+			"camnoc_axi_clk",
+			"ife_axi_clk";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_1_CSID_CLK>,
+			<&clock_camcc CAM_CC_IFE_1_CSID_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_1_CPHY_RX_CLK>,
+			<&clock_camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_1_CLK>,
+			<&clock_camcc CAM_CC_IFE_1_CLK_SRC>,
+			<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_IFE_1_AXI_CLK>;
+		clock-rates =
+			<0 0 0 0 0 0 384000000 0 0 0 404000000 0 0>,
+			<0 0 0 0 0 0 538000000 0 0 0 600000000 0 0>;
+		clock-cntl-level = "svs", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+		clock-control-debugfs = "true";
+		status = "ok";
+	};
+
+	cam_vfe1: qcom,vfe1@acb6000 {
+		cell-index = <1>;
+		compatible = "qcom,vfe170";
+		reg-names = "ife";
+		reg = <0 0x0acb6000 0 0x4000>;
+		reg-cam-base = <0xb6000>;
+		interrupt-names = "ife";
+		interrupts = <GIC_SPI 467 IRQ_TYPE_EDGE_RISING>;
+		regulator-names = "camss", "ife1";
+		camss-supply = <&titan_top_gdsc>;
+		ife1-supply = <&ife_1_gdsc>;
+
+		power-domains = <&clock_camcc IFE_1_GDSC>;
+		clock-names = "camera_ahb",
+			"camera_axi",
+			"soc_ahb_clk",
+			"cpas_ahb_clk",
+			"slow_ahb_clk_src",
+			"ife_clk",
+			"ife_clk_src",
+			"camnoc_axi_clk",
+			"ife_axi_clk";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_1_CLK>,
+			<&clock_camcc CAM_CC_IFE_1_CLK_SRC>,
+			<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_IFE_1_AXI_CLK>;
+		clock-rates =
+			<0 0 0 0 0 0 404000000 0 0>,
+			<0 0 0 0 0 0 480000000 0 0>,
+			<0 0 0 0 0 0 600000000 0 0>;
+		clock-cntl-level = "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+		clock-control-debugfs = "true";
+		clock-names-option = "ife_dsp_clk";
+		clocks-option = <&clock_camcc CAM_CC_IFE_1_DSP_CLK>;
+		clock-rates-option = <600000000>;
+		status = "ok";
+	};
+
+	cam_csid_lite: qcom,csid-lite@acc8000 {
+		cell-index = <2>;
+		compatible = "qcom,csid-lite170";
+		reg-names = "csid-lite";
+		reg = <0 0x0acc8000 0 0x1000>;
+		reg-cam-base = <0xc8000>;
+		interrupt-names = "csid-lite";
+		interrupts = <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>;
+		regulator-names = "camss";
+		camss-supply = <&titan_top_gdsc>;
+
+		power-domains = <&clock_camcc TITAN_TOP_GDSC>;
+		clock-names = "camera_ahb",
+			"camera_axi",
+			"soc_ahb_clk",
+			"cpas_ahb_clk",
+			"slow_ahb_clk_src",
+			"ife_csid_clk",
+			"ife_csid_clk_src",
+			"ife_cphy_rx_clk",
+			"cphy_rx_clk_src",
+			"ife_clk",
+			"ife_clk_src",
+			"camnoc_axi_clk";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_LITE_CSID_CLK>,
+			<&clock_camcc CAM_CC_IFE_LITE_CSID_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+			<&clock_camcc CAM_CC_CPHY_RX_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_LITE_CLK>,
+			<&clock_camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>;
+		clock-rates =
+			<0 0 0 0 0 0 384000000 0 0 0 404000000 0>,
+			<0 0 0 0 0 0 538000000 0 0 0 600000000 0>;
+		clock-cntl-level = "svs", "turbo";
+		src-clock-name = "ife_csid_clk_src";
+		clock-control-debugfs = "true";
+		status = "ok";
+	};
+
+	cam_vfe_lite: qcom,vfe-lite@acc4000 {
+		cell-index = <2>;
+		compatible = "qcom,vfe-lite170";
+		reg-names = "ife-lite";
+		reg = <0 0x0acc4000 0 0x4000>;
+		reg-cam-base = <0xc4000>;
+		interrupt-names = "ife-lite";
+		interrupts = <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>;
+		regulator-names = "camss";
+		camss-supply = <&titan_top_gdsc>;
+
+		power-domains = <&clock_camcc TITAN_TOP_GDSC>;
+		clock-names = "camera_ahb",
+			"camera_axi",
+			"soc_ahb_clk",
+			"cpas_ahb_clk",
+			"slow_ahb_clk_src",
+			"ife_clk",
+			"ife_clk_src",
+			"camnoc_axi_clk";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_SLOW_AHB_CLK_SRC>,
+			<&clock_camcc CAM_CC_IFE_LITE_CLK>,
+			<&clock_camcc CAM_CC_IFE_LITE_CLK_SRC>,
+			<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>;
+		clock-rates =
+			<0 0 0 0 0 0 404000000 0>,
+			<0 0 0 0 0 0 480000000 0>,
+			<0 0 0 0 0 0 600000000 0>;
+		clock-cntl-level = "svs", "svs_l1", "turbo";
+		src-clock-name = "ife_clk_src";
+		clock-control-debugfs = "true";
+		status = "ok";
+	};
+
+	qcom,cam-icp {
+		compatible = "qcom,cam-icp";
+		compat-hw-name = "qcom,a5",
+			"qcom,ipe0",
+			"qcom,ipe1",
+			"qcom,bps";
+		num-a5 = <1>;
+		num-ipe = <2>;
+		num-bps = <1>;
+		status = "ok";
+	};
+
+	cam_a5: qcom,a5@ac00000 {
+		cell-index = <0>;
+		compatible = "qcom,cam-a5";
+		reg = <0 0x0ac00000 0 0x6000>,
+			<0 0x0ac10000 0 0x8000>,
+			<0 0x0ac18000 0 0x3000>;
+		reg-names = "a5_qgic", "a5_sierra", "a5_csr";
+		reg-cam-base = <0x00000 0x10000 0x18000>;
+		interrupts = <GIC_SPI 463 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "a5";
+		regulator-names = "camss-vdd";
+		camss-vdd-supply = <&titan_top_gdsc>;
+		clock-names = "gcc_cam_ahb_clk",
+			"gcc_cam_axi_clk",
+			"soc_fast_ahb",
+			"soc_ahb_clk",
+			"cpas_ahb_clk",
+			"camnoc_axi_clk",
+			"icp_clk",
+			"icp_clk_src";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+				<&gcc GCC_CAMERA_AXI_CLK>,
+				<&clock_camcc CAM_CC_FAST_AHB_CLK_SRC>,
+				<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+				<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+				<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+				<&clock_camcc CAM_CC_ICP_CLK>,
+				<&clock_camcc CAM_CC_ICP_CLK_SRC>;
+		clock-rates =
+			<0 0 200000000 0 0 0 0 400000000>,
+			<0 0 200000000 0 0 0 0 600000000>;
+		clock-cntl-level = "svs", "turbo";
+		fw_name = "CAMERA_ICP.elf";
+		ubwc-cfg = <0x7B 0x1EF>;
+		status = "ok";
+	};
+
+	cam_ipe0: qcom,ipe0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-ipe";
+		reg = <0 0x0ac87000 0 0x3000>;
+		reg-names = "ipe0_top";
+		reg-cam-base = <0x87000>;
+		regulator-names = "ipe0-vdd";
+		ipe0-vdd-supply = <&ipe_0_gdsc>;
+
+		power-domains = <&clock_camcc IPE_0_GDSC>;
+		clock-names = "ipe_0_ahb_clk",
+			"ipe_0_areg_clk",
+			"ipe_0_axi_clk",
+			"ipe_0_clk",
+			"ipe_0_clk_src";
+		src-clock-name = "ipe_0_clk_src";
+		clock-control-debugfs = "true";
+		clocks = <&clock_camcc CAM_CC_IPE_0_AHB_CLK>,
+				<&clock_camcc CAM_CC_IPE_0_AREG_CLK>,
+				<&clock_camcc CAM_CC_IPE_0_AXI_CLK>,
+				<&clock_camcc CAM_CC_IPE_0_CLK>,
+				<&clock_camcc CAM_CC_IPE_0_CLK_SRC>;
+		clock-rates =
+			<0 0 0 0 404000000>,
+			<0 0 0 0 480000000>,
+			<0 0 0 0 538000000>,
+			<0 0 0 0 600000000>;
+		clock-cntl-level = "svs",
+			"svs_l1", "nominal", "turbo";
+		status = "ok";
+	};
+
+	cam_ipe1: qcom,ipe1 {
+		cell-index = <1>;
+		compatible = "qcom,cam-ipe";
+		reg = <0 0x0ac91000 0 0x3000>;
+		reg-names = "ipe1_top";
+		reg-cam-base = <0x91000>;
+		regulator-names = "ipe1-vdd";
+		ipe1-vdd-supply = <&ipe_1_gdsc>;
+
+		power-domains = <&clock_camcc IPE_1_GDSC>;
+		clock-names = "ipe_1_ahb_clk",
+			"ipe_1_areg_clk",
+			"ipe_1_axi_clk",
+			"ipe_1_clk",
+			"ipe_1_clk_src";
+		src-clock-name = "ipe_1_clk_src";
+		clock-control-debugfs = "true";
+		clocks = <&clock_camcc CAM_CC_IPE_1_AHB_CLK>,
+				<&clock_camcc CAM_CC_IPE_1_AREG_CLK>,
+				<&clock_camcc CAM_CC_IPE_1_AXI_CLK>,
+				<&clock_camcc CAM_CC_IPE_1_CLK>,
+				<&clock_camcc CAM_CC_IPE_1_CLK_SRC>;
+		clock-rates =
+			<0 0 0 0 404000000>,
+			<0 0 0 0 480000000>,
+			<0 0 0 0 538000000>,
+			<0 0 0 0 600000000>;
+		clock-cntl-level = "svs",
+			"svs_l1", "nominal", "turbo";
+		status = "ok";
+	};
+
+	cam_bps: qcom,bps {
+		cell-index = <0>;
+		compatible = "qcom,cam-bps";
+		reg = <0 0x0ac6f000 0 0x3000>;
+		reg-names = "bps_top";
+		reg-cam-base = <0x6f000>;
+		regulator-names = "bps-vdd";
+		bps-vdd-supply = <&bps_gdsc>;
+
+		power-domains = <&clock_camcc BPS_GDSC>;
+		clock-names = "bps_ahb_clk",
+			"bps_areg_clk",
+			"bps_axi_clk",
+			"bps_clk",
+			"bps_clk_src";
+		src-clock-name = "bps_clk_src";
+		clock-control-debugfs = "true";
+		clocks = <&clock_camcc CAM_CC_BPS_AHB_CLK>,
+				<&clock_camcc CAM_CC_BPS_AREG_CLK>,
+				<&clock_camcc CAM_CC_BPS_AXI_CLK>,
+				<&clock_camcc CAM_CC_BPS_CLK>,
+				<&clock_camcc CAM_CC_BPS_CLK_SRC>;
+		clock-rates =
+			<0 0 0 0 404000000>,
+			<0 0 0 0 480000000>,
+			<0 0 0 0 600000000>,
+			<0 0 0 0 600000000>;
+		clock-cntl-level = "svs",
+			"svs_l1", "nominal", "turbo";
+		status = "ok";
+	};
+
+	qcom,cam-jpeg {
+		compatible = "qcom,cam-jpeg";
+		compat-hw-name = "qcom,jpegenc",
+			"qcom,jpegdma";
+		num-jpeg-enc = <1>;
+		num-jpeg-dma = <1>;
+		status = "ok";
+	};
+
+	cam_jpeg_enc: qcom,jpegenc@ac4e000 {
+		cell-index = <0>;
+		compatible = "qcom,cam_jpeg_enc";
+		reg-names = "jpege_hw";
+		reg = <0 0x0ac4e000 0 0x4000>;
+		reg-cam-base = <0x4e000>;
+		interrupt-names = "jpeg";
+		interrupts = <GIC_SPI 474 IRQ_TYPE_EDGE_RISING>;
+		regulator-names = "camss-vdd";
+		camss-vdd-supply = <&titan_top_gdsc>;
+		clock-names = "camera_ahb",
+			"camera_axi",
+			"soc_ahb_clk",
+			"cpas_ahb_clk",
+			"camnoc_axi_clk",
+			"jpegenc_clk_src",
+			"jpegenc_clk";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_JPEG_CLK_SRC>,
+			<&clock_camcc CAM_CC_JPEG_CLK>;
+		clock-rates = <0 0 0 0 0 600000000 0>;
+		src-clock-name = "jpegenc_clk_src";
+		clock-cntl-level = "nominal";
+		status = "ok";
+	};
+
+	cam_jpeg_dma: qcom,jpegdma@ac52000 {
+		cell-index = <0>;
+		compatible = "qcom,cam_jpeg_dma";
+		reg-names = "jpegdma_hw";
+		reg = <0 0x0ac52000 0 0x4000>;
+		reg-cam-base = <0x52000>;
+		interrupt-names = "jpegdma";
+		interrupts = <GIC_SPI 475 IRQ_TYPE_EDGE_RISING>;
+		regulator-names = "camss-vdd";
+		camss-vdd-supply = <&titan_top_gdsc>;
+		clock-names = "camera_ahb",
+			"camera_axi",
+			"soc_ahb_clk",
+			"cpas_ahb_clk",
+			"camnoc_axi_clk",
+			"jpegdma_clk_src",
+			"jpegdma_clk";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_JPEG_CLK_SRC>,
+			<&clock_camcc CAM_CC_JPEG_CLK>;
+		clock-rates = <0 0 0 0 0 600000000 0>;
+		src-clock-name = "jpegdma_clk_src";
+		clock-cntl-level = "nominal";
+		status = "ok";
+	};
+
+	qcom,cam-fd {
+		compatible = "qcom,cam-fd";
+		compat-hw-name = "qcom,fd";
+		num-fd = <1>;
+		status = "ok";
+	};
+
+	cam_fd: qcom,fd@ac5a000 {
+		cell-index = <0>;
+		compatible = "qcom,fd41";
+		reg-names = "fd_core", "fd_wrapper";
+		reg = <0 0x0ac5a000 0 0x1000>,
+			<0 0x0ac5b000 0 0x400>;
+		reg-cam-base = <0x5a000 0x5b000>;
+		interrupt-names = "fd";
+		interrupts = <GIC_SPI 462 IRQ_TYPE_EDGE_RISING>;
+		regulator-names = "camss-vdd";
+		camss-vdd-supply = <&titan_top_gdsc>;
+		clock-names = "gcc_ahb_clk",
+			"gcc_axi_clk",
+			"soc_ahb_clk",
+			"cpas_ahb_clk",
+			"camnoc_axi_clk",
+			"fd_core_clk_src",
+			"fd_core_clk",
+			"fd_core_uar_clk";
+		clocks = <&gcc GCC_CAMERA_AHB_CLK>,
+			<&gcc GCC_CAMERA_AXI_CLK>,
+			<&clock_camcc CAM_CC_SOC_AHB_CLK>,
+			<&clock_camcc CAM_CC_CPAS_AHB_CLK>,
+			<&clock_camcc CAM_CC_CAMNOC_AXI_CLK>,
+			<&clock_camcc CAM_CC_FD_CORE_CLK_SRC>,
+			<&clock_camcc CAM_CC_FD_CORE_CLK>,
+			<&clock_camcc CAM_CC_FD_CORE_UAR_CLK>;
+		src-clock-name = "fd_core_clk_src";
+		clock-control-debugfs = "true";
+		clock-cntl-level = "svs", "svs_l1", "turbo";
+		clock-rates =
+			<0 0 0 0 0 400000000 0 0>,
+			<0 0 0 0 0 538000000 0 0>,
+			<0 0 0 0 0 600000000 0 0>;
+		status = "ok";
+	};
+};
+
+&cam_cci {
+	qcom,cam-res-mgr {
+		compatible = "qcom,cam-res-mgr";
+		status = "ok";
+
+		gpios = <&tlmm 8 GPIO_ACTIVE_HIGH>;
+		pinctrl-names = "cam_res_mgr_default", "cam_res_mgr_suspend";
+		pinctrl-0 = <&cam_res_mgr_active>;
+		pinctrl-1 = <&cam_res_mgr_suspend>;
+	};
+
+	qcom,cam-sensor@0 {
+		cell-index = <0>;
+		compatible = "qcom,cam-sensor";
+		reg = <0x0>;
+		csiphy-sd-index = <0>;
+		sensor-position-roll = <180>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <0>;
+		cam_vio-supply = <&vreg_lvs1a_1p8>;
+		cam_vana-supply = <&vreg_bob>;
+		cam_vdig-supply = <&camera_rear_ldo>;
+		cam_clk-supply = <&titan_top_gdsc>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vdig", "cam_clk";
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 3312000 1050000 0>;
+		rgltr-max-voltage = <0 3600000 1050000 0>;
+		rgltr-load-current = <0 80000 105000 0>;
+		gpio-no-mux = <0>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 9 0>,
+			<&tlmm 8 0>;
+		gpio-reset = <1>;
+		gpio-vana = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags = <1 0 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK0", "CAM_RESET0", "CAM_VANA0";
+		sensor-mode = <0>;
+		cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_camcc CAM_CC_MCLK0_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "turbo";
+		clock-rates = <24000000>;
+	};
+
+	qcom,cam-sensor@1 {
+		cell-index = <1>;
+		compatible = "qcom,cam-sensor";
+		reg = <0x1>;
+		csiphy-sd-index = <1>;
+		sensor-position-roll = <180>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <0>;
+		cam_vio-supply = <&vreg_lvs1a_1p8>;
+		cam_vana-supply = <&vreg_bob>;
+		cam_vdig-supply = <&camera_rear_ldo>;
+		cam_clk-supply = <&titan_top_gdsc>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vdig", "cam_clk";
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 3312000 1050000 0>;
+		rgltr-max-voltage = <0 3600000 1050000 0>;
+		rgltr-load-current = <0 80000 105000 0>;
+		gpio-no-mux = <0>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 7 0>,
+			<&tlmm 8 0>;
+		gpio-reset = <1>;
+		gpio-vana = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags = <1 0 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK1", "CAM_RESET1", "CAM_VANA1";
+		sensor-mode = <0>;
+		cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_camcc CAM_CC_MCLK1_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "turbo";
+		clock-rates = <24000000>;
+	};
+
+	qcom,cam-sensor@2 {
+		cell-index = <2>;
+		compatible = "qcom,cam-sensor";
+		reg = <0x02>;
+		csiphy-sd-index = <2>;
+		sensor-position-roll = <180>;
+		sensor-position-pitch = <0>;
+		sensor-position-yaw = <0>;
+		cam_vio-supply = <&vreg_lvs1a_1p8>;
+		cam_vana-supply = <&vreg_bob>;
+		cam_vdig-supply = <&camera_rear_ldo>;
+		cam_clk-supply = <&titan_top_gdsc>;
+		regulator-names = "cam_vio", "cam_vana", "cam_vdig", "cam_clk";
+		rgltr-cntrl-support;
+		rgltr-min-voltage = <0 3312000 1050000 0>;
+		rgltr-max-voltage = <0 3600000 1050000 0>;
+		rgltr-load-current = <0 80000 105000 0>;
+		gpio-no-mux = <0>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 12 0>,
+			<&tlmm 8 0>;
+		gpio-reset = <1>;
+		gpio-vana = <2>;
+		gpio-req-tbl-num = <0 1 2>;
+		gpio-req-tbl-flags = <1 0 0>;
+		gpio-req-tbl-label = "CAMIF_MCLK2", "CAM_RESET2", "CAM_VANA2";
+		sensor-mode = <0>;
+		cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_camcc CAM_CC_MCLK2_CLK>;
+		clock-names = "cam_clk";
+		clock-cntl-level = "turbo";
+		clock-rates = <24000000>;
+	};
+
+
+};
diff --git a/kernel/linux b/kernel/linux
new file mode 160000
index 0000000..c03c1a1
--- /dev/null
+++ b/kernel/linux
@@ -0,0 +1 @@
+Subproject commit c03c1a14507dfaf8b856c2608f9ac216021fc222
diff --git a/kernel/package_modules.py b/kernel/package_modules.py
new file mode 100644
index 0000000..0be4067
--- /dev/null
+++ b/kernel/package_modules.py
@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+"""Keep mici modules and optional peripherals after modules_install."""
+import argparse
+import json
+from pathlib import Path
+import subprocess
+
+# Onboard devices, service loads, post-root WLAN/BT, and existing interfaces.
+# A root can be built in or modular; silently dropping either is a build error.
+ROOTS = '''
+qcom_q6v5_pas venus_core venus_enc venus_dec spectra_camera fastrpc rpmsg_ctrl
+icc_bwmon qcom_stats qcom_wdt coresight_funnel coresight_replicator coresight_stm
+coresight_tmc stm_p_basic fuse dm_mod hci_uart btqca cfg80211 mac80211
+ath10k_core ath10k_snoc mhi_net cpufreq_powersave cpufreq_conservative qrtr_tun qrtr_mhi
+wcd934x snd_soc_wcd934x snd_soc_wsa881x
+'''.split()
+
+# Preserve configured optional USB/eGPU, networking, crypto and storage APIs.
+# Family selection also accommodates newly configured peripheral drivers.
+FAMILIES = (
+  'kernel/drivers/usb/', 'kernel/drivers/net/usb/',
+  'kernel/drivers/gpu/drm/nouveau/', 'kernel/drivers/gpu/drm/ttm/',
+  'kernel/sound/usb/', 'kernel/drivers/bluetooth/', 'kernel/net/bluetooth/',
+  'kernel/drivers/bus/mhi/', 'kernel/drivers/net/wwan/',
+  'kernel/drivers/net/veth.ko', 'kernel/drivers/net/tun.ko', 'kernel/drivers/net/tap.ko',
+  'kernel/drivers/net/macvlan.ko', 'kernel/drivers/net/macvtap.ko', 'kernel/drivers/net/ipvlan/',
+  'kernel/drivers/net/ethernet/qualcomm/rmnet/', 'kernel/drivers/net/ipa/',
+  'kernel/drivers/gnss/', 'kernel/drivers/md/',
+  'kernel/net/netfilter/', 'kernel/net/ipv4/', 'kernel/net/ipv6/', 'kernel/net/can/',
+  'kernel/net/bridge/', 'kernel/net/802/', 'kernel/net/8021q/', 'kernel/net/sched/',
+  'kernel/crypto/', 'kernel/arch/arm64/crypto/', 'kernel/fs/fuse/',
+)
+
+
+def module_name(path):
+  return Path(path).name.removesuffix('.zst').removesuffix('.xz').removesuffix('.gz').removesuffix('.ko').replace('-', '_')
+
+
+def select_modules(directory, roots=ROOTS, families=FAMILIES):
+  dependencies = {}
+  for line in (directory / 'modules.dep').read_text().splitlines():
+    module, required = line.split(':', 1)
+    dependencies[module] = required.split()
+  if any(path not in dependencies for required in dependencies.values() for path in required):
+    raise ValueError('Installed hard dependency is missing')
+  by_name = {module_name(path): path for path in dependencies}
+  if len(by_name) != len(dependencies):
+    raise ValueError('Duplicate module basename')
+  for path in dependencies:
+    relative = Path(path)
+    if relative.is_absolute() or '..' in relative.parts or not (directory / relative).is_file():
+      raise ValueError(f'Invalid installed module: {path}')
+  builtins = {module_name(path) for path in (directory / 'modules.builtin').read_text().splitlines()}
+  soft = {}
+  for line in (directory / 'modules.softdep').read_text().splitlines():
+    words = line.split()
+    if words and words[0] == 'softdep':
+      soft.setdefault(words[1].replace('-', '_'), set()).update(
+        name.replace('-', '_') for name in words[2:] if name not in ('pre:', 'post:'))
+
+  pending = set(roots) | {module_name(path) for path in dependencies if path.startswith(families)}
+  # USB and HID device drivers also live outside drivers/usb and drivers/hid.
+  for line in (directory / 'modules.alias').read_text().splitlines():
+    words = line.split()
+    if len(words) == 3 and words[0] == 'alias' and words[1].startswith(('usb:', 'hid:')):
+      pending.add(words[2])
+  keep = set()
+  visited = set()
+  while pending:
+    name = min(pending)
+    pending.remove(name)
+    name = name.replace('-', '_')
+    if name in visited:
+      continue
+    visited.add(name)
+    pending.update(soft.get(name, ()))
+    if name in builtins:
+      continue
+    if name not in by_name:
+      raise ValueError(f'Required module is neither installed nor builtin: {name}')
+    path = by_name[name]
+    if path in keep:
+      continue
+    keep.add(path)
+    pending.update(module_name(required) for required in dependencies[path])
+  return keep, set(dependencies) - keep
+
+
+def package(root, report=None):
+  versions = sorted((root / 'lib/modules').iterdir())
+  if len(versions) != 1 or not versions[0].is_dir():
+    raise ValueError('Expected exactly one installed kernel version')
+  directory = versions[0]
+  keep, remove = select_modules(directory)
+  before = sum(path.stat().st_size for path in directory.rglob('*') if path.is_file())
+  order = (directory / 'modules.order').read_text().splitlines()
+  uncompressed = {str(Path(path).with_suffix('')) if path.endswith(('.zst', '.xz', '.gz')) else path for path in keep}
+  # Validate the complete graph before changing any installed files.
+  for path in sorted(remove):
+    (directory / path).unlink()
+  (directory / 'modules.order').write_text(''.join(path + '\n' for path in order if path in uncompressed))
+  for path in sorted(directory.rglob('*'), reverse=True):
+    if path.is_dir() and not any(path.iterdir()):
+      path.rmdir()
+  # Keep full modules.builtin/modinfo; regenerate every modular and builtin index.
+  subprocess.run(['depmod', '-b', str(root), directory.name], check=True)
+  after = sum(path.stat().st_size for path in directory.rglob('*') if path.is_file())
+  result = {'version': directory.name, 'keep': sorted(keep), 'remove': sorted(remove),
+            'before_bytes': before, 'after_bytes': after}
+  if report:
+    report.write_text(json.dumps(result, indent=2) + '\n')
+  print(f'{directory.name}: kept {len(keep)} modules, removed {len(remove)}, saved {before - after} bytes')
+
+
+if __name__ == '__main__':
+  parser = argparse.ArgumentParser(description=__doc__)
+  parser.add_argument('root', type=Path, help='modules_install INSTALL_MOD_PATH; modifies only this build output')
+  parser.add_argument('--report', type=Path)
+  args = parser.parse_args()
+  package(args.root.resolve(), args.report)
diff --git a/kernel/patches/0001-clk-qcom-dispcc-sdm845-dont-keep-MDSS-GDSC-on.patch b/kernel/patches/0001-clk-qcom-dispcc-sdm845-dont-keep-MDSS-GDSC-on.patch
new file mode 100644
index 0000000..cf0186a
--- /dev/null
+++ b/kernel/patches/0001-clk-qcom-dispcc-sdm845-dont-keep-MDSS-GDSC-on.patch
@@ -0,0 +1,40 @@
+From c1341a65e2ce2d80d72fea6a1142f48da16bf9fe Mon Sep 17 00:00:00 2001
+From: Robin Reckmann <robin.reckmann@gmail.com>
+Date: Tue, 24 Mar 2026 21:53:49 +0900
+Subject: clk: qcom: dispcc-sdm845: don't keep MDSS GDSC on across late
+ init
+
+On SDM845 systems where the bootloader leaves the display pipeline enabled
+for splash/handoff, keeping the MDSS power domain on across late init can
+leave the display controller in stale bootloader state during early Linux
+display bring-up.
+
+This can cause the first DSI modeset to fail with:
+
+  disp_cc_mdss_pclk0_clk_src: rcg didn't update its configuration
+
+and can also lead to display handoff issues when the panel driver is built
+into the kernel and probes early.
+
+Set GENPD_FLAG_NO_STAY_ON on mdss_gdsc so the MDSS power domain is not kept
+enabled until late_initcall_sync, allowing Linux to bring the display block
+up from a clean state.
+---
+ drivers/clk/qcom/dispcc-sdm845.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/dispcc-sdm845.c b/drivers/clk/qcom/dispcc-sdm845.c
+index 2f9e9665d..91c5bc42b 100644
+--- a/drivers/clk/qcom/dispcc-sdm845.c
++++ b/drivers/clk/qcom/dispcc-sdm845.c
+@@ -763,6 +763,7 @@ static struct gdsc mdss_gdsc = {
+ 	.en_rest_wait_val = 0x5,
+ 	.pd = {
+ 		.name = "mdss_gdsc",
++		.flags = GENPD_FLAG_NO_STAY_ON,
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+ 	.flags = HW_CTRL | POLL_CFG_GDSCR,
+-- 
+2.53.0
+
diff --git a/kernel/patches/0002-drm-panel-add-dwo-do0200fat07-panel-driver.patch b/kernel/patches/0002-drm-panel-add-dwo-do0200fat07-panel-driver.patch
new file mode 100644
index 0000000..0932ade
--- /dev/null
+++ b/kernel/patches/0002-drm-panel-add-dwo-do0200fat07-panel-driver.patch
@@ -0,0 +1,383 @@
+From afef331e1a2be2ef2f4f25ee9dfc711aadb5f2b8 Mon Sep 17 00:00:00 2001
+From: Robin Reckmann <robin.reckmann@gmail.com>
+Date: Thu, 26 Mar 2026 00:24:06 +0900
+Subject: drm/panel: add dwo do0200fat07 panel driver
+
+Add support for the dwo do0200fat07 240x536 panel found on the comma mici.
+---
+ drivers/gpu/drm/panel/Kconfig                 |  10 +
+ drivers/gpu/drm/panel/Makefile                |   1 +
+ drivers/gpu/drm/panel/panel-dwo-do0200fat07.c | 333 ++++++++++++++++++
+ 3 files changed, 344 insertions(+)
+ create mode 100644 drivers/gpu/drm/panel/panel-dwo-do0200fat07.c
+
+diff --git a/drivers/gpu/drm/panel/Kconfig b/drivers/gpu/drm/panel/Kconfig
+--- a/drivers/gpu/drm/panel/Kconfig
++++ b/drivers/gpu/drm/panel/Kconfig
+@@ -136,6 +136,16 @@
+ 	help
+ 	  Say Y here if you want to enable support for ChipWealth
+ 	  CH13726A-based display panels.
++
++config DRM_PANEL_DWO_DO0200FAT07
++   tristate "DWO DO0200FAT07 panel"
++   depends on OF
++   depends on DRM_MIPI_DSI
++   depends on BACKLIGHT_CLASS_DEVICE
++   select VIDEOMODE_HELPERS
++   help
++     Say Y here if you want to enable support for the DWo DO0200FAT07
++     panel.
+ 
+ config DRM_PANEL_EBBG_FT8719
+ 	tristate "EBBG FT8719 panel driver"
+diff --git a/drivers/gpu/drm/panel/Makefile b/drivers/gpu/drm/panel/Makefile
+--- a/drivers/gpu/drm/panel/Makefile
++++ b/drivers/gpu/drm/panel/Makefile
+@@ -16,6 +16,7 @@
+ obj-$(CONFIG_DRM_PANEL_LVDS) += panel-lvds.o
+ obj-$(CONFIG_DRM_PANEL_SIMPLE) += panel-simple.o
+ obj-$(CONFIG_DRM_PANEL_EDP) += panel-edp.o
++obj-$(CONFIG_DRM_PANEL_DWO_DO0200FAT07) += panel-dwo-do0200fat07.o
+ obj-$(CONFIG_DRM_PANEL_EBBG_FT8719) += panel-ebbg-ft8719.o
+ obj-$(CONFIG_DRM_PANEL_ELIDA_KD35T133) += panel-elida-kd35t133.o
+ obj-$(CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA02) += panel-feixin-k101-im2ba02.o
+diff --git a/drivers/gpu/drm/panel/panel-dwo-do0200fat07.c b/drivers/gpu/drm/panel/panel-dwo-do0200fat07.c
+new file mode 100644
+--- /dev/null
++++ b/drivers/gpu/drm/panel/panel-dwo-do0200fat07.c
+@@ -0,0 +1,334 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Copyright (c) 2026 Robin Reckmann <robin.reckmann@gmail.com>
++
++#include <linux/backlight.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/mod_devicetable.h>
++#include <linux/module.h>
++#include <linux/regulator/consumer.h>
++
++#include <video/mipi_display.h>
++
++#include <drm/drm_mipi_dsi.h>
++#include <drm/drm_modes.h>
++#include <drm/drm_of.h>
++#include <drm/drm_panel.h>
++#include <drm/drm_probe_helper.h>
++
++struct dwo_do0200fat07 {
++	struct drm_panel panel;
++	struct mipi_dsi_device *dsi;
++	struct gpio_desc *reset_gpio;
++	struct regulator *vddio;
++	struct regulator *vdd;
++	enum drm_panel_orientation orientation;
++};
++
++static inline struct dwo_do0200fat07 *
++to_dwo_do0200fat07(struct drm_panel *panel)
++{
++	return container_of(panel, struct dwo_do0200fat07, panel);
++}
++
++static void dwo_do0200fat07_reset(struct dwo_do0200fat07 *ctx)
++{
++	gpiod_set_value_cansleep(ctx->reset_gpio, 0);
++	usleep_range(1000, 2000);
++	gpiod_set_value_cansleep(ctx->reset_gpio, 1);
++	usleep_range(1000, 2000);
++	gpiod_set_value_cansleep(ctx->reset_gpio, 0);
++	usleep_range(10000, 11000);
++}
++
++static int dwo_do0200fat07_power_on(struct dwo_do0200fat07 *ctx)
++{
++	int ret;
++
++	ret = regulator_enable(ctx->vddio);
++	if (ret)
++		return ret;
++	usleep_range(3000, 5000);
++
++	ret = regulator_enable(ctx->vdd);
++	if (ret) {
++		regulator_disable(ctx->vddio);
++		return ret;
++	}
++	usleep_range(3000, 5000);
++	return 0;
++}
++
++static void dwo_do0200fat07_power_off(struct dwo_do0200fat07 *ctx)
++{
++	regulator_disable(ctx->vdd);
++	regulator_disable(ctx->vddio);
++}
++
++static int dwo_do0200fat07_init_sequence(struct dwo_do0200fat07 *ctx)
++{
++	struct mipi_dsi_multi_context dsi_ctx = { .dsi = ctx->dsi };
++
++	mipi_dsi_dcs_write_seq_multi(&dsi_ctx, 0xfe, 0x05);
++	mipi_dsi_dcs_write_seq_multi(&dsi_ctx, 0x91, 0x00);
++	mipi_dsi_dcs_write_seq_multi(&dsi_ctx, 0x00, 0x00);
++
++	mipi_dsi_dcs_write_seq_multi(&dsi_ctx, 0xfe, 0x01);
++	mipi_dsi_dcs_write_seq_multi(&dsi_ctx, 0x1c, 0x99);
++
++	mipi_dsi_dcs_write_seq_multi(&dsi_ctx, 0xfe, 0x00);
++
++	mipi_dsi_dcs_set_pixel_format_multi(
++		&dsi_ctx,
++		MIPI_DCS_PIXEL_FMT_24BIT | (MIPI_DCS_PIXEL_FMT_24BIT << 4));
++	mipi_dsi_dcs_set_display_brightness_multi(&dsi_ctx, 0x0000);
++
++	mipi_dsi_dcs_write_seq_multi(&dsi_ctx, MIPI_DCS_SET_ADDRESS_MODE, 0x00);
++
++	mipi_dsi_dcs_set_tear_on_multi(&dsi_ctx,
++				       MIPI_DSI_DCS_TEAR_MODE_VHBLANK);
++
++	mipi_dsi_dcs_write_seq_multi(&dsi_ctx, 0xc2, 0x03);
++
++	mipi_dsi_dcs_exit_sleep_mode_multi(&dsi_ctx);
++	mipi_dsi_msleep(&dsi_ctx, 100);
++
++	return dsi_ctx.accum_err;
++}
++
++static int dwo_do0200fat07_prepare(struct drm_panel *panel)
++{
++	struct dwo_do0200fat07 *ctx = to_dwo_do0200fat07(panel);
++	struct device *dev = &ctx->dsi->dev;
++	int ret;
++
++	ret = dwo_do0200fat07_power_on(ctx);
++	if (ret) {
++		dev_err(dev, "Failed to power on: %d\n", ret);
++		return ret;
++	}
++
++	dwo_do0200fat07_reset(ctx);
++
++	ret = dwo_do0200fat07_init_sequence(ctx);
++	if (ret < 0) {
++		dev_err(dev, "Failed to initialize panel: %d\n", ret);
++		gpiod_set_value_cansleep(ctx->reset_gpio, 1);
++		dwo_do0200fat07_power_off(ctx);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int dwo_do0200fat07_unprepare(struct drm_panel *panel)
++{
++	struct dwo_do0200fat07 *ctx = to_dwo_do0200fat07(panel);
++
++	gpiod_set_value_cansleep(ctx->reset_gpio, 1);
++	usleep_range(1000, 2000);
++	dwo_do0200fat07_power_off(ctx);
++
++	return 0;
++}
++
++static int dwo_do0200fat07_enable(struct drm_panel *panel)
++{
++	struct dwo_do0200fat07 *ctx = to_dwo_do0200fat07(panel);
++	struct mipi_dsi_multi_context c = { .dsi = ctx->dsi };
++
++	mipi_dsi_dcs_set_display_on_multi(&c);
++	mipi_dsi_msleep(&c, 20);
++
++	return c.accum_err;
++}
++
++static int dwo_do0200fat07_disable(struct drm_panel *panel)
++{
++	struct dwo_do0200fat07 *ctx = to_dwo_do0200fat07(panel);
++	struct mipi_dsi_multi_context c = { .dsi = ctx->dsi };
++
++	mipi_dsi_dcs_set_display_off_multi(&c);
++	mipi_dsi_msleep(&c, 20);
++
++	mipi_dsi_dcs_enter_sleep_mode_multi(&c);
++	mipi_dsi_msleep(&c, 120);
++
++	return c.accum_err;
++}
++
++static const struct drm_display_mode dwo_do0200fat07_mode = {
++	.clock = (240 + 20 + 20 + 40) * (536 + 20 + 4 + 12) * 60 / 1000,
++	.hdisplay = 240,
++	.hsync_start = 240 + 20,
++	.hsync_end = 240 + 20 + 20,
++	.htotal = 240 + 20 + 20 + 40,
++	.vdisplay = 536,
++	.vsync_start = 536 + 20,
++	.vsync_end = 536 + 20 + 4,
++	.vtotal = 536 + 20 + 4 + 12,
++	.width_mm = 20,
++	.height_mm = 44,
++	.type = DRM_MODE_TYPE_DRIVER,
++};
++
++static int dwo_do0200fat07_get_modes(struct drm_panel *panel,
++				     struct drm_connector *connector)
++{
++	struct drm_display_mode *mode;
++
++	mode = drm_mode_duplicate(connector->dev, &dwo_do0200fat07_mode);
++	if (!mode)
++		return -ENOMEM;
++
++	drm_mode_set_name(mode);
++	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
++	drm_mode_probed_add(connector, mode);
++
++	connector->display_info.bpc = 8;
++	connector->display_info.width_mm = dwo_do0200fat07_mode.width_mm;
++	connector->display_info.height_mm = dwo_do0200fat07_mode.height_mm;
++
++	return 1;
++}
++
++static enum drm_panel_orientation
++dwo_do0200fat07_get_orientation(struct drm_panel *panel)
++{
++	struct dwo_do0200fat07 *ctx = to_dwo_do0200fat07(panel);
++
++	return ctx->orientation;
++}
++
++static const struct drm_panel_funcs dwo_do0200fat07_panel_funcs = {
++	.prepare = dwo_do0200fat07_prepare,
++	.unprepare = dwo_do0200fat07_unprepare,
++	.enable = dwo_do0200fat07_enable,
++	.disable = dwo_do0200fat07_disable,
++	.get_modes = dwo_do0200fat07_get_modes,
++	.get_orientation = dwo_do0200fat07_get_orientation,
++};
++
++static int dwo_do0200fat07_bl_update_status(struct backlight_device *bl)
++{
++	struct mipi_dsi_device *dsi = bl_get_data(bl);
++	u16 brightness = backlight_get_brightness(bl);
++	int ret;
++
++	dsi->mode_flags &= ~MIPI_DSI_MODE_LPM;
++
++	ret = mipi_dsi_dcs_set_display_brightness(dsi, brightness);
++
++	dsi->mode_flags |= MIPI_DSI_MODE_LPM;
++
++	return ret;
++}
++
++static const struct backlight_ops dwo_do0200fat07_bl_ops = {
++	.update_status = dwo_do0200fat07_bl_update_status,
++};
++
++static struct backlight_device *
++dwo_do0200fat07_create_backlight(struct mipi_dsi_device *dsi)
++{
++	struct device *dev = &dsi->dev;
++	const struct backlight_properties props = {
++		.type = BACKLIGHT_RAW,
++		.brightness = 255,
++		.max_brightness = 255,
++	};
++
++	return devm_backlight_device_register(dev, dev_name(dev), dev, dsi,
++					      &dwo_do0200fat07_bl_ops, &props);
++}
++
++static int dwo_do0200fat07_probe(struct mipi_dsi_device *dsi)
++{
++	struct device *dev = &dsi->dev;
++	struct dwo_do0200fat07 *ctx;
++	int ret;
++
++	ctx = devm_drm_panel_alloc(dev, struct dwo_do0200fat07, panel,
++				   &dwo_do0200fat07_panel_funcs,
++				   DRM_MODE_CONNECTOR_DSI);
++	if (IS_ERR(ctx))
++		return PTR_ERR(ctx);
++
++	ctx->vddio = devm_regulator_get(dev, "vddio");
++	if (IS_ERR(ctx->vddio))
++		return dev_err_probe(dev, PTR_ERR(ctx->vddio),
++				     "Failed to get vddio-supply\n");
++
++	ctx->vdd = devm_regulator_get(dev, "vdd");
++	if (IS_ERR(ctx->vdd))
++		return dev_err_probe(dev, PTR_ERR(ctx->vdd),
++				     "Failed to get vdd-supply\n");
++
++	ctx->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
++	if (IS_ERR(ctx->reset_gpio))
++		return dev_err_probe(dev, PTR_ERR(ctx->reset_gpio),
++				     "Failed to get reset-gpios\n");
++
++	ctx->dsi = dsi;
++	mipi_dsi_set_drvdata(dsi, ctx);
++
++	dsi->lanes = 1;
++	dsi->format = MIPI_DSI_FMT_RGB888;
++	dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST |
++			  MIPI_DSI_CLOCK_NON_CONTINUOUS | MIPI_DSI_MODE_LPM;
++
++	ctx->panel.prepare_prev_first = true;
++
++	ctx->panel.backlight = dwo_do0200fat07_create_backlight(dsi);
++	if (IS_ERR(ctx->panel.backlight))
++		return dev_err_probe(dev, PTR_ERR(ctx->panel.backlight),
++				     "Failed to create backlight\n");
++
++	ret = drm_of_get_panel_orientation(dev->of_node, &ctx->orientation);
++	if (ret) {
++		return dev_err_probe(dev, ret, "Failed to get orientation\n");
++	}
++
++	drm_panel_add(&ctx->panel);
++
++	ret = mipi_dsi_attach(dsi);
++	if (ret < 0) {
++		drm_panel_remove(&ctx->panel);
++		return dev_err_probe(dev, ret,
++				     "Failed to attach to DSI host\n");
++	}
++
++	return 0;
++}
++
++static void dwo_do0200fat07_remove(struct mipi_dsi_device *dsi)
++{
++	struct dwo_do0200fat07 *ctx = mipi_dsi_get_drvdata(dsi);
++	int ret;
++
++	ret = mipi_dsi_detach(dsi);
++	if (ret < 0)
++		dev_err(&dsi->dev, "Failed to detach from DSI host: %d\n", ret);
++
++	drm_panel_remove(&ctx->panel);
++}
++
++static const struct of_device_id dwo_do0200fat07_of_match[] = {
++	{ .compatible = "dwo,do0200fat07" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, dwo_do0200fat07_of_match);
++
++static struct mipi_dsi_driver dwo_do0200fat07_driver = {
++	.probe = dwo_do0200fat07_probe,
++	.remove = dwo_do0200fat07_remove,
++	.driver = {
++		.name = "panel-dwo-do0200fat07",
++		.of_match_table = dwo_do0200fat07_of_match,
++	},
++};
++module_mipi_dsi_driver(dwo_do0200fat07_driver);
++
++MODULE_AUTHOR("Robin Reckmann <robin.reckmann@gmail.com>");
++MODULE_DESCRIPTION("DRM driver for DWo DO0200FAT07 panel");
++MODULE_LICENSE("GPL");
diff --git a/kernel/patches/0003-input-edt-ft5x06-add-support-for-FocalTech-FT3168.patch b/kernel/patches/0003-input-edt-ft5x06-add-support-for-FocalTech-FT3168.patch
new file mode 100644
index 0000000..c7aac6f
--- /dev/null
+++ b/kernel/patches/0003-input-edt-ft5x06-add-support-for-FocalTech-FT3168.patch
@@ -0,0 +1,42 @@
+From 98ef45adca93ac64657409bec38cb0117304862c Mon Sep 17 00:00:00 2001
+From: Robin Reckmann <robin.reckmann@gmail.com>
+Date: Thu, 26 Mar 2026 21:31:22 +0900
+Subject: input: edt-ft5x06 - add support for FocalTech FT3168
+
+---
+ drivers/input/touchscreen/edt-ft5x06.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
+index d3b1177185a3..84c0f35c1ae5 100644
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -1457,6 +1457,10 @@ static const struct edt_i2c_chip_data edt_ft3518_data = {
+ 	.max_support_points = 10,
+ };
+ 
++static const struct edt_i2c_chip_data edt_ft3168_data = {
++	.max_support_points = 2,
++};
++
+ static const struct edt_i2c_chip_data edt_ft5452_data = {
+ 	.max_support_points = 5,
+ };
+@@ -1488,6 +1492,7 @@ static const struct i2c_device_id edt_ft5x06_ts_id[] = {
+ 	{ .name = "ft3518", .driver_data = (long)&edt_ft3518_data },
+ 	{ .name = "ft5452", .driver_data = (long)&edt_ft5452_data },
+ 	/* Note no edt- prefix for compatibility with the ft6236.c driver */
++	{ .name = "ft3168", .driver_data = (long)&edt_ft3168_data },
+ 	{ .name = "ft6236", .driver_data = (long)&edt_ft6236_data },
+ 	{ .name = "ft8201", .driver_data = (long)&edt_ft8201_data },
+ 	{ .name = "ft8716", .driver_data = (long)&edt_ft8716_data },
+@@ -1502,6 +1507,7 @@ static const struct of_device_id edt_ft5x06_of_match[] = {
+ 	{ .compatible = "edt,edt-ft5406", .data = &edt_ft5x06_data },
+ 	{ .compatible = "edt,edt-ft5506", .data = &edt_ft5506_data },
+ 	{ .compatible = "evervision,ev-ft5726", .data = &edt_ft5506_data },
++	{ .compatible = "focaltech,ft3168", .data = &edt_ft3168_data },
+ 	{ .compatible = "focaltech,ft3518", .data = &edt_ft3518_data },
+ 	{ .compatible = "focaltech,ft5426", .data = &edt_ft5506_data },
+ 	{ .compatible = "focaltech,ft5452", .data = &edt_ft5452_data },
+-- 
+2.53.0
diff --git a/kernel/patches/0004-input-edt-ft5x06-add-touch_count-sysfs-attribute.patch b/kernel/patches/0004-input-edt-ft5x06-add-touch_count-sysfs-attribute.patch
new file mode 100644
index 0000000..662ece8
--- /dev/null
+++ b/kernel/patches/0004-input-edt-ft5x06-add-touch_count-sysfs-attribute.patch
@@ -0,0 +1,47 @@
+diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
+index bf498bd4d..98871ecc8 100644
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -146,6 +146,7 @@ struct edt_ft5x06_ts_data {
+ 	enum edt_ver version;
+ 	unsigned int crc_errors;
+ 	unsigned int header_errors;
++	u64 touch_count;
+ };
+ 
+ struct edt_i2c_chip_data {
+@@ -337,6 +338,8 @@ static irqreturn_t edt_ft5x06_ts_isr(int irq, void *dev_id)
+ 					       type != TOUCH_EVENT_UP))
+ 			touchscreen_report_pos(tsdata->input, &tsdata->prop,
+ 					       x, y, true);
++		else if (type == TOUCH_EVENT_UP)
++			tsdata->touch_count++;
+ 	}
+ 
+ 	input_mt_report_pointer_emulation(tsdata->input, true);
+@@ -566,6 +569,17 @@ static ssize_t crc_errors_show(struct device *dev,
+ 
+ static DEVICE_ATTR_RO(crc_errors);
+ 
++static ssize_t touch_count_show(struct device *dev,
++				struct device_attribute *attr, char *buf)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct edt_ft5x06_ts_data *tsdata = i2c_get_clientdata(client);
++
++	return sysfs_emit(buf, "%llu\n", tsdata->touch_count);
++}
++
++static DEVICE_ATTR_RO(touch_count);
++
+ static struct attribute *edt_ft5x06_attrs[] = {
+ 	&edt_ft5x06_attr_gain.dattr.attr,
+ 	&edt_ft5x06_attr_offset.dattr.attr,
+@@ -577,6 +591,7 @@ static struct attribute *edt_ft5x06_attrs[] = {
+ 	&dev_attr_fw_version.attr,
+ 	&dev_attr_header_errors.attr,
+ 	&dev_attr_crc_errors.attr,
++	&dev_attr_touch_count.attr,
+ 	NULL
+ };
+ ATTRIBUTE_GROUPS(edt_ft5x06);
diff --git a/kernel/patches/0005-spi-spidev-add-commaai-panda-compatible.patch b/kernel/patches/0005-spi-spidev-add-commaai-panda-compatible.patch
new file mode 100644
index 0000000..9b70ffb
--- /dev/null
+++ b/kernel/patches/0005-spi-spidev-add-commaai-panda-compatible.patch
@@ -0,0 +1,33 @@
+From 566e9f46796f570d676a64584a7b0081f1273b93 Mon Sep 17 00:00:00 2001
+From: Trey Moen <trey@moen.ai>
+Date: Sat, 28 Mar 2026 14:18:11 -0700
+Subject: [PATCH] spi: spidev: add commaai,panda compatible
+
+Register the commaai,panda compatible string in spidev to expose
+the comma Panda as /dev/spidevB.C from device tree.
+---
+ drivers/spi/spidev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 638221178384..25f1e1e71eed 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -688,6 +688,7 @@ static const struct spi_device_id spidev_spi_ids[] = {
+ 	{ .name = /* abb */ "spi-sensor" },
+ 	{ .name = /* arduino */ "unoq-mcu" },
+ 	{ .name = /* cisco */ "spi-petra" },
++	{ .name = /* commaai */ "panda" },
+ 	{ .name = /* dh */ "dhcom-board" },
+ 	{ .name = /* elgin */ "jg10309-01" },
+ 	{ .name = /* gocontroll */ "moduline-module-slot"},
+@@ -722,6 +723,7 @@ static const struct of_device_id spidev_dt_ids[] = {
+ 	{ .compatible = "abb,spi-sensor", .data = &spidev_of_check },
+ 	{ .compatible = "arduino,unoq-mcu", .data = &spidev_of_check },
+ 	{ .compatible = "cisco,spi-petra", .data = &spidev_of_check },
++	{ .compatible = "commaai,panda", .data = &spidev_of_check },
+ 	{ .compatible = "dh,dhcom-board", .data = &spidev_of_check },
+ 	{ .compatible = "elgin,jg10309-01", .data = &spidev_of_check },
+ 	{ .compatible = "gocontroll,moduline-module-slot", .data = &spidev_of_check},
+-- 
+2.53.0
diff --git a/kernel/patches/0006-wifi-set-mac-from-soc-serial-number.patch b/kernel/patches/0006-wifi-set-mac-from-soc-serial-number.patch
new file mode 100644
index 0000000..72168c3
--- /dev/null
+++ b/kernel/patches/0006-wifi-set-mac-from-soc-serial-number.patch
@@ -0,0 +1,90 @@
+From 93dfd71059244e5e08b567ebc3c31c661fc1f1cb Mon Sep 17 00:00:00 2001
+From: Robin Reckmann <robin.reckmann@gmail.com>
+Date: Mon, 30 Mar 2026 13:53:50 +0900
+Subject: wifi: Set mac address from SoC serial number
+
+This copies the behavior of the downstream qcacld-3.0 wifi driver.
+Using 00:0a:f5 OUI and lowest 3 bytes from soc serial number.
+
+The WCN3990 firmware on mici reports a bogus 0e:00:00:00:00:00 MAC
+which passes is_valid_ether_addr(), so also override that.
+
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 46 +++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 154ac7a70..7af4494e1 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -17,6 +17,8 @@
+ #include <linux/of.h>
+ #include <linux/bitfield.h>
+ #include <linux/random.h>
++#include <linux/soc/qcom/smem.h>
++#include <linux/soc/qcom/socinfo.h>
+ 
+ #include "hif.h"
+ #include "core.h"
+@@ -233,6 +235,47 @@ int ath10k_mac_ext_resource_config(struct ath10k *ar, u32 val)
+ 	return 0;
+ }
+ 
++/* The WCN3990 firmware reports a bogus locally-administered MAC instead
++ * of leaving the address unset, so it can't be caught by
++ * is_valid_ether_addr() alone.
++ */
++static bool ath10k_mac_is_fw_dummy_addr(const u8 *mac)
++{
++	static const u8 dummy[ETH_ALEN] = { 0x0e, 0x00, 0x00, 0x00, 0x00, 0x00 };
++
++	return ether_addr_equal(mac, dummy);
++}
++
++static int ath10k_mac_from_socinfo(u8 *mac)
++{
++	const struct socinfo *info;
++	size_t item_size;
++	u32 serial;
++
++	info = qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_HW_SW_BUILD_ID, &item_size);
++	if (IS_ERR(info))
++		return PTR_ERR(info);
++
++	if (offsetofend(struct socinfo, serial_num) > item_size)
++		return -EINVAL;
++
++	serial = le32_to_cpu(info->serial_num);
++	if (!serial)
++		return -ENODEV;
++
++	mac[0] = 0x00;
++	mac[1] = 0x0a;
++	mac[2] = 0xf5;
++	mac[3] = (serial >> 16) & 0xff;
++	mac[4] = (serial >> 8) & 0xff;
++	mac[5] = serial & 0xff;
++
++	if (!is_valid_ether_addr(mac))
++		return -EINVAL;
++
++	return 0;
++}
++
+ /**********/
+ /* Crypto */
+ /**********/
+@@ -9998,6 +10040,10 @@ int ath10k_mac_register(struct ath10k *ar)
+ 	void *channels;
+ 	int ret;
+ 
++	if (!is_valid_ether_addr(ar->mac_addr) ||
++	    ath10k_mac_is_fw_dummy_addr(ar->mac_addr))
++		ath10k_mac_from_socinfo(ar->mac_addr);
++
+ 	if (!is_valid_ether_addr(ar->mac_addr)) {
+ 		ath10k_warn(ar, "invalid MAC address; choosing random\n");
+ 		eth_random_addr(ar->mac_addr);
+-- 
+2.53.0
+
diff --git a/kernel/patches/0007-driver-squashfs-ignore-discard-mount-option.patch b/kernel/patches/0007-driver-squashfs-ignore-discard-mount-option.patch
new file mode 100644
index 0000000..84b4a0c
--- /dev/null
+++ b/kernel/patches/0007-driver-squashfs-ignore-discard-mount-option.patch
@@ -0,0 +1,37 @@
+From: Trey Moen <trey@moen.ai>
+Subject: squashfs: accept and ignore the "discard" mount option
+
+The legacy comma AGNOS fstab mounts /persist (squashfs) with "discard".
+Old kernels ignored unknown squashfs options; the new mount API rejects
+them, failing persist.mount and dropping systemd into maintenance mode.
+Accept the flag as a no-op.
+
+diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
+index 4465cf056..cdf89c3db 100644
+--- a/fs/squashfs/super.c
++++ b/fs/squashfs/super.c
+@@ -48,6 +48,7 @@ enum Opt_errors {
+ enum squashfs_param {
+ 	Opt_errors,
+ 	Opt_threads,
++	Opt_discard,
+ };
+ 
+ struct squashfs_mount_opts {
+@@ -65,6 +66,7 @@ static const struct constant_table squashfs_param_errors[] = {
+ static const struct fs_parameter_spec squashfs_fs_parameters[] = {
+ 	fsparam_enum("errors", Opt_errors, squashfs_param_errors),
+ 	fsparam_string("threads", Opt_threads),
++	fsparam_flag("discard", Opt_discard),
+ 	{}
+ };
+ 
+@@ -142,6 +144,8 @@ static int squashfs_parse_param(struct fs_context *fc, struct fs_parameter *para
+ 		if (squashfs_parse_param_threads(param->string, opts) != 0)
+ 			return -EINVAL;
+ 		break;
++	case Opt_discard:
++		break;
+ 	default:
+ 		return -EINVAL;
+ 	}
diff --git a/kernel/patches/0008-wifi-ath10k-only-wait-for-response-to-SET_KEY.patch b/kernel/patches/0008-wifi-ath10k-only-wait-for-response-to-SET_KEY.patch
new file mode 100644
index 0000000..e541b53
--- /dev/null
+++ b/kernel/patches/0008-wifi-ath10k-only-wait-for-response-to-SET_KEY.patch
@@ -0,0 +1,41 @@
+From: Richard Acayan <mailingradian@gmail.com>
+Date: Mon, 9 Feb 2026 18:12:58 -0800
+Subject: wifi: ath10k: only wait for response to SET_KEY
+
+When sending DELETE_KEY, the driver times out waiting for a response
+that doesn't come. Only wait for a response when sending SET_KEY.
+
+Sample dmesg:
+
+	[  117.285854] wlan0: deauthenticating from XX:XX:XX:XX:XX:XX by local choice (Reason: 3=DEAUTH_LEAVING)
+	[  120.302934] ath10k_snoc 18800000.wifi: failed to install key for vdev 0 peer XX:XX:XX:XX:XX:XX: -110
+	[  120.302996] wlan0: failed to remove key (0, XX:XX:XX:XX:XX:XX) from hardware (-110)
+
+Signed-off-by: Richard Acayan <mailingradian@gmail.com>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index da6f7957a0ae..73aa93043f8a 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -324,9 +324,11 @@ static int ath10k_install_key(struct ath10k_vif *arvif,
+ 	if (ret)
+ 		return ret;
+ 
+-	time_left = wait_for_completion_timeout(&ar->install_key_done, 3 * HZ);
+-	if (time_left == 0)
+-		return -ETIMEDOUT;
++	if (cmd != DISABLE_KEY) {
++		time_left = wait_for_completion_timeout(&ar->install_key_done, 3 * HZ);
++		if (time_left == 0)
++			return -ETIMEDOUT;
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.53.0
+
+
diff --git a/kernel/patches/0009-clk-qcom-revert-dispcc-pixel-clock-parent-enable.patch b/kernel/patches/0009-clk-qcom-revert-dispcc-pixel-clock-parent-enable.patch
new file mode 100644
index 0000000..2246997
--- /dev/null
+++ b/kernel/patches/0009-clk-qcom-revert-dispcc-pixel-clock-parent-enable.patch
@@ -0,0 +1,38 @@
+From a1d63493634e98360140027fef49d82b1ff0a267 Mon Sep 17 00:00:00 2001
+From: Robin Reckmann <robin.reckmann@gmail.com>
+Subject: [PATCH] clk: qcom: dispcc-sdm845: avoid enabling DSI PLL during probe
+
+CLK_OPS_PARENT_ENABLE makes orphan reparenting enable the DSI PLL.
+Enabling it before PHY initialization can cause 10nm PLL lock failures.
+
+Keep the DSI PLL disabled during reparenting; normal DSI and MDSS paths
+prepare it when needed.
+
+This reverts commit a1d63493634e ("clk: qcom: dispcc-sdm845: Enable parents
+for pixel clocks") for the SDM845 display clock topology.
+---
+ drivers/clk/qcom/dispcc-sdm845.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/dispcc-sdm845.c b/drivers/clk/qcom/dispcc-sdm845.c
+index 78e43f6d7502..2f9e9665d7e9 100644
+--- a/drivers/clk/qcom/dispcc-sdm845.c
++++ b/drivers/clk/qcom/dispcc-sdm845.c
+@@ -280,7 +280,7 @@ static struct clk_rcg2 disp_cc_mdss_pclk0_clk_src = {
+ 		.name = "disp_cc_mdss_pclk0_clk_src",
+ 		.parent_data = disp_cc_parent_data_4,
+ 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_4),
+-		.flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
++		.flags = CLK_SET_RATE_PARENT,
+ 		.ops = &clk_pixel_ops,
+ 	},
+ };
+@@ -295,7 +295,7 @@ static struct clk_rcg2 disp_cc_mdss_pclk1_clk_src = {
+ 		.name = "disp_cc_mdss_pclk1_clk_src",
+ 		.parent_data = disp_cc_parent_data_4,
+ 		.num_parents = ARRAY_SIZE(disp_cc_parent_data_4),
+-		.flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
++		.flags = CLK_SET_RATE_PARENT,
+ 		.ops = &clk_pixel_ops,
+ 	},
+ };
diff --git a/kernel/patches/0010-ASoC-sdm845-restrict-soundwire-to-slimbus.patch b/kernel/patches/0010-ASoC-sdm845-restrict-soundwire-to-slimbus.patch
new file mode 100644
index 0000000..f2e5fc3
--- /dev/null
+++ b/kernel/patches/0010-ASoC-sdm845-restrict-soundwire-to-slimbus.patch
@@ -0,0 +1,83 @@
+Subject: [PATCH] ASoC: sdm845: restrict SoundWire callbacks to SLIMbus DAIs
+
+SECONDARY_MI2S_TX is 19 in the Q6DSP DAI namespace, the same numeric value
+as LPASS_CDC_DMA_TX3 in the DSP-bypass namespace. The shared SoundWire
+helper recognizes both. Calling it unconditionally routes secondary MI2S
+capture into SoundWire and dereferences the SPDIF capture codec's missing
+DAI operations on comma four.
+
+Dispatch SoundWire operations only for this machine's SLIMbus DAIs,
+matching its existing DAI initialization and hw_params handling. Accept
+secondary MI2S capture in hw_params along with playback.
+---
+--- a/sound/soc/qcom/sdm845.c
++++ b/sound/soc/qcom/sdm845.c
+@@ -211,6 +211,7 @@
+ 		break;
+ 	case QUATERNARY_MI2S_RX:
+ 	case SECONDARY_MI2S_RX:
++	case SECONDARY_MI2S_TX:
+ 		break;
+ 	default:
+ 		pr_err("%s: invalid dai id 0x%x\n", __func__, cpu_dai->id);
+@@ -408,13 +409,13 @@
+ 		}
+ 		break;
+ 	case SLIMBUS_0_RX...SLIMBUS_6_TX:
+-		break;
++		return qcom_snd_sdw_startup(substream);
+ 
+ 	default:
+ 		pr_err("%s: invalid dai id 0x%x\n", __func__, cpu_dai->id);
+ 		break;
+ 	}
+-	return qcom_snd_sdw_startup(substream);
++	return 0;
+ }
+ 
+ static void  sdm845_snd_shutdown(struct snd_pcm_substream *substream)
+@@ -455,6 +456,8 @@
+ 		}
+ 		break;
+ 	case SLIMBUS_0_RX...SLIMBUS_6_TX:
++		qcom_snd_sdw_shutdown(substream);
++		break;
+ 	case QUATERNARY_MI2S_RX:
+ 		break;
+ 
+@@ -463,7 +466,6 @@
+ 		break;
+ 	}
+ 
+-	qcom_snd_sdw_shutdown(substream);
+ }
+ 
+ static int sdm845_snd_prepare(struct snd_pcm_substream *substream)
+@@ -472,7 +474,12 @@
+ 	struct sdm845_snd_data *data = snd_soc_card_get_drvdata(rtd->card);
+ 	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+ 
+-	return qcom_snd_sdw_prepare(substream, &data->stream_prepared[cpu_dai->id]);
++	switch (cpu_dai->id) {
++	case SLIMBUS_0_RX...SLIMBUS_6_TX:
++		return qcom_snd_sdw_prepare(substream, &data->stream_prepared[cpu_dai->id]);
++	default:
++		return 0;
++	}
+ }
+ 
+ static int sdm845_snd_hw_free(struct snd_pcm_substream *substream)
+@@ -481,7 +488,12 @@
+ 	struct sdm845_snd_data *data = snd_soc_card_get_drvdata(rtd->card);
+ 	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+ 
+-	return qcom_snd_sdw_hw_free(substream, &data->stream_prepared[cpu_dai->id]);
++	switch (cpu_dai->id) {
++	case SLIMBUS_0_RX...SLIMBUS_6_TX:
++		return qcom_snd_sdw_hw_free(substream, &data->stream_prepared[cpu_dai->id]);
++	default:
++		return 0;
++	}
+ }
+ 
+ static const struct snd_soc_ops sdm845_be_ops = {
diff --git a/kernel/patches/0011-ASoC-q6asm-use-left-aligned-24-bit-pcm.patch b/kernel/patches/0011-ASoC-q6asm-use-left-aligned-24-bit-pcm.patch
new file mode 100644
index 0000000..c881bed
--- /dev/null
+++ b/kernel/patches/0011-ASoC-q6asm-use-left-aligned-24-bit-pcm.patch
@@ -0,0 +1,66 @@
+Subject: [PATCH] ASoC: q6asm: describe left-aligned 24-bit PCM as S32_LE
+
+Q6ASM v2 places 24-bit samples in the high bits of 32-bit words, for
+both playback and capture. ALSA S24_LE uses the low three bytes, causing
+about 48 dB attenuation in playback. Advertise S32_LE with 24 significant
+MSBs while retaining 24 as the DSP sample width. Leave S16_LE unchanged.
+---
+--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
++++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
+@@ -90,7 +90,7 @@
+ 				SNDRV_PCM_INFO_INTERLEAVED |
+ 				SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME),
+ 	.formats =              (SNDRV_PCM_FMTBIT_S16_LE |
+-				SNDRV_PCM_FMTBIT_S24_LE),
++				SNDRV_PCM_FMTBIT_S32_LE),
+ 	.rates =                SNDRV_PCM_RATE_8000_48000,
+ 	.rate_min =             8000,
+ 	.rate_max =             48000,
+@@ -113,7 +113,7 @@
+ 				SNDRV_PCM_INFO_INTERLEAVED |
+ 				SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME),
+ 	.formats =              (SNDRV_PCM_FMTBIT_S16_LE |
+-				SNDRV_PCM_FMTBIT_S24_LE),
++				SNDRV_PCM_FMTBIT_S32_LE),
+ 	.rates =                SNDRV_PCM_RATE_8000_192000,
+ 	.rate_min =             8000,
+ 	.rate_max =             192000,
+@@ -139,7 +139,7 @@
+ 				  SNDRV_PCM_RATE_176400 |		\
+ 				  SNDRV_PCM_RATE_192000),		\
+ 			.formats = (SNDRV_PCM_FMTBIT_S16_LE |		\
+-					SNDRV_PCM_FMTBIT_S24_LE),	\
++					SNDRV_PCM_FMTBIT_S32_LE),	\
+ 			.channels_min = 1,				\
+ 			.channels_max = 8,				\
+ 			.rate_min =     8000,				\
+@@ -151,7 +151,7 @@
+ 				  SNDRV_PCM_RATE_12000 |		\
+ 				  SNDRV_PCM_RATE_24000),		\
+ 			.formats = (SNDRV_PCM_FMTBIT_S16_LE |		\
+-				    SNDRV_PCM_FMTBIT_S24_LE),		\
++				    SNDRV_PCM_FMTBIT_S32_LE),		\
+ 			.channels_min = 1,				\
+ 			.channels_max = 4,				\
+ 			.rate_min =     8000,				\
+@@ -383,6 +383,11 @@
+ 		return -EINVAL;
+ 	}
+ 
++	/* Q6ASM v2 stores 24-bit samples in the high bits of 32-bit words. */
++	ret = snd_pcm_hw_constraint_msbits(runtime, 0, 32, 24);
++	if (ret < 0)
++		return ret;
++
+ 	prtd = kzalloc_obj(*prtd);
+ 	if (prtd == NULL)
+ 		return -ENOMEM;
+@@ -506,7 +511,7 @@
+ 	case SNDRV_PCM_FORMAT_S16_LE:
+ 		prtd->bits_per_sample = 16;
+ 		break;
+-	case SNDRV_PCM_FORMAT_S24_LE:
++	case SNDRV_PCM_FORMAT_S32_LE:
+ 		prtd->bits_per_sample = 24;
+ 		break;
+ 	}
diff --git a/kernel/patches/0012-wifi-ath10k-persist-in-order-rx-amsdu.patch b/kernel/patches/0012-wifi-ath10k-persist-in-order-rx-amsdu.patch
new file mode 100644
index 0000000..6556505
--- /dev/null
+++ b/kernel/patches/0012-wifi-ath10k-persist-in-order-rx-amsdu.patch
@@ -0,0 +1,125 @@
+From: Richard Acayan <mailingradian@gmail.com>
+Date: Mon, 9 Feb 2026 18:12:58 -0800
+Subject: wifi: ath10k: make in-order rx amsdu buffers persistent
+
+The WCN3990 might split MSDUs among multiple "in-order" indications. The
+driver needs information from previous indications to handle MPDUs that
+are not started by the same indications that complete them. Move the
+list that tracks unprocessed MSDUs to the driver state so the driver can
+handle MPDUs that are split in this way and be less confused.
+
+Fixes: c545070e404b ("ath10k: implement rx reorder support")
+Signed-off-by: Richard Acayan <mailingradian@gmail.com>
+---
+--- a/drivers/net/wireless/ath/ath10k/htt.h
++++ b/drivers/net/wireless/ath/ath10k/htt.h
+@@ -1929,6 +1929,10 @@
+ 	bool bundle_tx;
+ 	struct sk_buff_head tx_req_head;
+ 	struct sk_buff_head tx_complete_head;
++
++	u8 rx_in_ord_split_tid;
++	u16 rx_in_ord_split_peer_id;
++	struct sk_buff_head rx_in_ord_split;
+ };
+ 
+ struct ath10k_htt_tx_ops {
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -296,6 +296,8 @@
+ 	skb_queue_purge(&htt->rx_in_ord_compl_q);
+ 	skb_queue_purge(&htt->tx_fetch_ind_q);
+ 
++	skb_queue_purge(&htt->rx_in_ord_split);
++
+ 	spin_lock_bh(&htt->rx_ring.lock);
+ 	ath10k_htt_rx_ring_free(htt);
+ 	spin_unlock_bh(&htt->rx_ring.lock);
+@@ -845,6 +847,8 @@
+ 	skb_queue_head_init(&htt->rx_in_ord_compl_q);
+ 	skb_queue_head_init(&htt->tx_fetch_ind_q);
+ 	atomic_set(&htt->num_mpdus_ready, 0);
++
++	skb_queue_head_init(&htt->rx_in_ord_split);
+ 
+ 	ath10k_dbg(ar, ATH10K_DBG_BOOT, "htt rx ring size %d fill_level %d\n",
+ 		   htt->rx_ring.size, htt->rx_ring.fill_level);
+@@ -3262,7 +3266,6 @@
+ 	struct ath10k_htt *htt = &ar->htt;
+ 	struct htt_resp *resp = (void *)skb->data;
+ 	struct ieee80211_rx_status *status = &htt->rx_status;
+-	struct sk_buff_head list;
+ 	struct sk_buff_head amsdu;
+ 	u16 peer_id;
+ 	u16 msdu_count;
+@@ -3297,16 +3300,32 @@
+ 		return -EINVAL;
+ 	}
+ 
++	if (!skb_queue_empty(&htt->rx_in_ord_split)) {
++		/* It might still be possible to handle this case if there is
++		 * only one peer that splits at each given moment. We are
++		 * bailing out because we should have a test case for this
++		 * before trying to fix it.
++		 */
++		if (tid != htt->rx_in_ord_split_tid
++		 || peer_id != htt->rx_in_ord_split_peer_id
++		 || offload) {
++			ath10k_warn(ar, "split amsdu did not resume immediately\n");
++			htt->rx_confused = true;
++			return -EIO;
++		}
++	}
++
+ 	/* The event can deliver more than 1 A-MSDU. Each A-MSDU is later
+ 	 * extracted and processed.
++	 *
++	 * It can also continue a previous A-MSDU.
+ 	 */
+-	__skb_queue_head_init(&list);
+ 	if (ar->hw_params.target_64bit)
+ 		ret = ath10k_htt_rx_pop_paddr64_list(htt, &resp->rx_in_ord_ind,
+-						     &list);
++						     &htt->rx_in_ord_split);
+ 	else
+ 		ret = ath10k_htt_rx_pop_paddr32_list(htt, &resp->rx_in_ord_ind,
+-						     &list);
++						     &htt->rx_in_ord_split);
+ 
+ 	if (ret < 0) {
+ 		ath10k_warn(ar, "failed to pop paddr list: %d\n", ret);
+@@ -3319,11 +3338,12 @@
+ 	 * separately.
+ 	 */
+ 	if (offload)
+-		ath10k_htt_rx_h_rx_offload(ar, &list);
+-
+-	while (!skb_queue_empty(&list)) {
++		ath10k_htt_rx_h_rx_offload(ar, &htt->rx_in_ord_split);
++
++	while (!skb_queue_empty(&htt->rx_in_ord_split)) {
+ 		__skb_queue_head_init(&amsdu);
+-		ret = ath10k_htt_rx_extract_amsdu(&ar->hw_params, &list, &amsdu);
++		ret = ath10k_htt_rx_extract_amsdu(&ar->hw_params,
++						  &htt->rx_in_ord_split, &amsdu);
+ 		switch (ret) {
+ 		case 0:
+ 			/* Note: The in-order indication may report interleaved
+@@ -3339,12 +3359,15 @@
+ 			ath10k_htt_rx_h_enqueue(ar, &amsdu, status);
+ 			break;
+ 		case -EAGAIN:
+-			fallthrough;
++			htt->rx_in_ord_split_tid = tid;
++			htt->rx_in_ord_split_peer_id = peer_id;
++
++			return -EIO;
+ 		default:
+ 			/* Should not happen. */
+ 			ath10k_warn(ar, "failed to extract amsdu: %d\n", ret);
+ 			htt->rx_confused = true;
+-			__skb_queue_purge(&list);
++			__skb_queue_purge(&htt->rx_in_ord_split);
+ 			ath10k_core_start_recovery(ar);
+ 			return -EIO;
+ 		}
diff --git a/kernel/patches/0013-gpio-allow-disabling-automatic-shared-ownership.patch b/kernel/patches/0013-gpio-allow-disabling-automatic-shared-ownership.patch
new file mode 100644
index 0000000..139cfa8
--- /dev/null
+++ b/kernel/patches/0013-gpio-allow-disabling-automatic-shared-ownership.patch
@@ -0,0 +1,36 @@
+From: Andrei Radulescu <andi.radulescu@gmail.com>
+Subject: [PATCH] gpio: allow disabling automatic shared GPIO ownership
+
+The downstream Spectra resource manager arbitrates shared camera GPIOs
+through the legacy integer API. Reserving those lines for GPIO proxies
+makes every sensor power-up fail with EBUSY before Spectra can acquire
+them.
+
+Expose the existing setting to expert configurations so vamOS can retain
+Spectra's GPIO ownership. Keep automatic sharing enabled by default.
+
+Signed-off-by: Andrei Radulescu <andi.radulescu@gmail.com>
+---
+ drivers/gpio/Kconfig | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -46,9 +46,15 @@ config GPIOLIB_IRQCHIP
+ 	bool
+ 
+ config GPIO_SHARED
+-	def_bool y
++	bool "Automatic shared GPIO ownership" if EXPERT
++	default y
+ 	depends on HAVE_SHARED_GPIOS || COMPILE_TEST
+ 	select AUXILIARY_BUS
++	help
++	  Automatically reserve GPIOs referenced by multiple firmware consumers
++	  and arbitrate their values through shared GPIO proxies. Disable this
++	  when legacy GPIO consumers already manage ownership of shared lines.
++	  If unsure, say Y.
+ 
+ config DEBUG_GPIO
+ 	bool "Debug GPIO calls"
diff --git a/kernel/patches/0014-clk-qcom-camcc-sdm845-round-shared-parent-rates.patch b/kernel/patches/0014-clk-qcom-camcc-sdm845-round-shared-parent-rates.patch
new file mode 100644
index 0000000..6dd0160
--- /dev/null
+++ b/kernel/patches/0014-clk-qcom-camcc-sdm845-round-shared-parent-rates.patch
@@ -0,0 +1,251 @@
+Subject: [PATCH] clk: qcom: camcc-sdm845: round shared PLL parent rates
+
+The 808 MHz camera PLL runs at 808000195 Hz. Requesting its nominal
+rate for another RCG makes CCF reprogram siblings despite the parent
+staying at the same achievable rate. Their recalculated rates can then
+select the next frequency-table entry and an inactive parent. This also
+occurs through the ordinary CSI timer RCGs, not only the shared RCGs.
+
+Return the achievable parent rate while preserving the canonical RCG
+frequency. Keep the other operations and non-propagating clocks unchanged.
+---
+--- a/drivers/clk/qcom/camcc-sdm845.c
++++ b/drivers/clk/qcom/camcc-sdm845.c
+@@ -16,6 +16,27 @@
+ #include "clk-rcg.h"
+ #include "clk-regmap.h"
+ #include "gdsc.h"
++
++static struct clk_ops cam_cc_shared_ops;
++static struct clk_ops cam_cc_rcg_ops;
++
++static int cam_cc_determine_rate(struct clk_hw *hw, struct clk_rate_request *req)
++{
++	long parent_rate;
++	int ret;
++
++	ret = clk_rcg2_ops.determine_rate(hw, req);
++	if (ret || !(clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT))
++		return ret;
++
++	/* Avoid reprogramming siblings for the fractional PLL rounding error. */
++	parent_rate = clk_hw_round_rate(req->best_parent_hw, req->best_parent_rate);
++	if (parent_rate < 0)
++		return parent_rate;
++
++	req->best_parent_rate = parent_rate;
++	return 0;
++}
+ 
+ enum {
+ 	P_BI_TCXO,
+@@ -205,7 +226,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -269,7 +290,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &cam_cc_rcg_ops,
+ 	},
+ };
+ 
+@@ -284,7 +305,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &cam_cc_rcg_ops,
+ 	},
+ };
+ 
+@@ -299,7 +320,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &cam_cc_rcg_ops,
+ 	},
+ };
+ 
+@@ -314,7 +335,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &cam_cc_rcg_ops,
+ 	},
+ };
+ 
+@@ -361,7 +382,7 @@
+ 		.name = "cam_cc_fd_core_clk_src",
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -384,7 +405,7 @@
+ 		.name = "cam_cc_icp_clk_src",
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -409,7 +430,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -431,7 +452,7 @@
+ 		.name = "cam_cc_ife_0_csid_clk_src",
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -446,7 +467,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -460,7 +481,7 @@
+ 		.name = "cam_cc_ife_1_csid_clk_src",
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -475,7 +496,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -489,7 +510,7 @@
+ 		.name = "cam_cc_ife_lite_csid_clk_src",
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -515,7 +536,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -530,7 +551,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -545,7 +566,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -570,7 +591,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_shared_ops,
++		.ops = &cam_cc_shared_ops,
+ 	},
+ };
+ 
+@@ -593,7 +614,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &cam_cc_rcg_ops,
+ 	},
+ };
+ 
+@@ -608,7 +629,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &cam_cc_rcg_ops,
+ 	},
+ };
+ 
+@@ -623,7 +644,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &cam_cc_rcg_ops,
+ 	},
+ };
+ 
+@@ -638,7 +659,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &cam_cc_rcg_ops,
+ 	},
+ };
+ 
+@@ -662,7 +683,7 @@
+ 		.parent_data = cam_cc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(cam_cc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &cam_cc_rcg_ops,
+ 	},
+ };
+ 
+@@ -1719,6 +1740,11 @@
+ 	struct regmap *regmap;
+ 	struct alpha_pll_config cam_cc_pll_config = { };
+ 
++	cam_cc_shared_ops = clk_rcg2_shared_ops;
++	cam_cc_shared_ops.determine_rate = cam_cc_determine_rate;
++	cam_cc_rcg_ops = clk_rcg2_ops;
++	cam_cc_rcg_ops.determine_rate = cam_cc_determine_rate;
++
+ 	regmap = qcom_cc_map(pdev, &cam_cc_sdm845_desc);
+ 	if (IS_ERR(regmap))
+ 		return PTR_ERR(regmap);
diff --git a/kernel/patches/0015-media-venus-handle-absent-codecs-during-recovery.patch b/kernel/patches/0015-media-venus-handle-absent-codecs-during-recovery.patch
new file mode 100644
index 0000000..a84c8ea
--- /dev/null
+++ b/kernel/patches/0015-media-venus-handle-absent-codecs-during-recovery.patch
@@ -0,0 +1,18 @@
+Subject: [PATCH] media: venus: handle absent codec children during recovery
+
+The encoder and decoder are separate modules. A firmware error can occur
+when only one child has bound. Do not dereference the absent child while
+waiting for runtime PM to become idle.
+---
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -104,7 +104,8 @@
+ 	core->state = CORE_UNINIT;
+ 
+ 	for (i = 0; i < max_attempts; i++) {
+-		if (!pm_runtime_active(core->dev_dec) && !pm_runtime_active(core->dev_enc))
++		if ((!core->dev_dec || !pm_runtime_active(core->dev_dec)) &&
++		    (!core->dev_enc || !pm_runtime_active(core->dev_enc)))
+ 			break;
+ 		msleep(10);
+ 	}
diff --git a/kernel/patches/0016-media-venus-configure-hevc-vui-timing.patch b/kernel/patches/0016-media-venus-configure-hevc-vui-timing.patch
new file mode 100644
index 0000000..66c5c45
--- /dev/null
+++ b/kernel/patches/0016-media-venus-configure-hevc-vui-timing.patch
@@ -0,0 +1,36 @@
+Subject: [PATCH] media: venus: configure VUI timing for HEVC encoding
+
+The firmware timing-info property is shared by H.264 and HEVC. Enable
+it for HEVC too so encoded streams describe the configured frame rate.
+Keep the H.264-specific entropy and filtering properties codec-specific.
+---
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -687,11 +687,9 @@
+ 	if (ret)
+ 		return ret;
+ 
+-	if (inst->fmt_cap->pixfmt == V4L2_PIX_FMT_H264) {
++	if (inst->fmt_cap->pixfmt == V4L2_PIX_FMT_H264 ||
++	    inst->fmt_cap->pixfmt == V4L2_PIX_FMT_HEVC) {
+ 		struct hfi_h264_vui_timing_info info;
+-		struct hfi_h264_entropy_control entropy;
+-		struct hfi_h264_db_control deblock;
+-		struct hfi_h264_8x8_transform h264_transform;
+ 
+ 		ptype = HFI_PROPERTY_PARAM_VENC_H264_VUI_TIMING_INFO;
+ 		info.enable = 1;
+@@ -701,6 +699,13 @@
+ 		ret = hfi_session_set_property(inst, ptype, &info);
+ 		if (ret)
+ 			return ret;
++
++	}
++
++	if (inst->fmt_cap->pixfmt == V4L2_PIX_FMT_H264) {
++		struct hfi_h264_entropy_control entropy;
++		struct hfi_h264_db_control deblock;
++		struct hfi_h264_8x8_transform h264_transform;
+ 
+ 		ptype = HFI_PROPERTY_PARAM_VENC_H264_ENTROPY_CONTROL;
+ 		entropy.entropy_mode = venc_v4l2_to_hfi(
diff --git a/kernel/patches/0017-media-venus-preserve-parent-node-reference.patch b/kernel/patches/0017-media-venus-preserve-parent-node-reference.patch
new file mode 100644
index 0000000..849c75f
--- /dev/null
+++ b/kernel/patches/0017-media-venus-preserve-parent-node-reference.patch
@@ -0,0 +1,21 @@
+Subject: [PATCH] media: venus: preserve the parent node reference during child lookup
+
+of_find_node_by_name() consumes a reference to its starting node. Passing
+dev->of_node without taking a reference drops the parent's reference
+twice on each probe, causing refcount warnings and a crash on reload.
+
+Only children of the Venus node are relevant here.
+Use of_get_child_by_name() to preserve the parent's reference.
+
+---
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -307,7 +307,7 @@ static int venus_add_video_core(struct venus_core *core, const char *node_name,
+ 	if (!node_name)
+ 		return 0;
+ 
+-	enp = of_find_node_by_name(dev->of_node, node_name);
++	enp = of_get_child_by_name(dev->of_node, node_name);
+ 	if (enp) {
+ 		of_node_put(enp);
+ 		return 0;
diff --git a/kernel/patches/0018-media-venus-report-accepted-capture-size.patch b/kernel/patches/0018-media-venus-report-accepted-capture-size.patch
new file mode 100644
index 0000000..747e81f
--- /dev/null
+++ b/kernel/patches/0018-media-venus-report-accepted-capture-size.patch
@@ -0,0 +1,17 @@
+Subject: [PATCH] media: venus: report the accepted encoder capture size
+
+S_FMT preserves a requested capture sizeimage above the calculated minimum,
+and queue_setup requires buffers of that size. Return the stored size from
+G_FMT too, so applications do not allocate smaller buffers after querying
+the selected format.
+---
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -321,6 +321,7 @@ static int venc_g_fmt(struct file *file, void *fh, struct v4l2_format *f)
+ 		pixmp->colorspace = inst->colorspace;
+ 		pixmp->ycbcr_enc = inst->ycbcr_enc;
+ 		pixmp->quantization = inst->quantization;
++		pixmp->plane_fmt[0].sizeimage = inst->output_buf_size;
+ 		pixmp->xfer_func = inst->xfer_func;
+ 	} else if (f->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+ 		pixmp->width = inst->out_width;
diff --git a/kernel/patches/0019-media-venus-honor-encoder-capture-buffer-requirements.patch b/kernel/patches/0019-media-venus-honor-encoder-capture-buffer-requirements.patch
new file mode 100644
index 0000000..f8e3f7f
--- /dev/null
+++ b/kernel/patches/0019-media-venus-honor-encoder-capture-buffer-requirements.patch
@@ -0,0 +1,32 @@
+Subject: [PATCH] media: venus: honor encoder capture buffer requirements
+
+The generic compressed-frame size can be smaller than the firmware's
+encoder output requirement. Query that requirement after configuring the
+session and include it in the capture queue's allocation size. Keep larger
+application requests and the format helper's page alignment.
+---
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -1089,6 +1089,7 @@ static int venc_queue_setup(struct vb2_queue *q,
+ {
+ 	struct venus_inst *inst = vb2_get_drv_priv(q);
+ 	struct venus_core *core = inst->core;
++	struct hfi_buffer_requirements bufreq;
+ 	unsigned int num, min = 4;
+ 	int ret;
+ 
+@@ -1158,9 +1159,14 @@ static int venc_queue_setup(struct vb2_queue *q,
+ 		*num_planes = inst->fmt_cap->num_planes;
+ 		*num_buffers = max(*num_buffers, min);
+ 		inst->num_output_bufs = *num_buffers;
++		ret = venus_helper_get_bufreq(inst, HFI_BUFFER_OUTPUT, &bufreq);
++		if (ret)
++			break;
++
+ 		sizes[0] = venus_helper_get_framesz(inst->fmt_cap->pixfmt,
+ 						    inst->width,
+ 						    inst->height);
++		sizes[0] = max(sizes[0], ALIGN(bufreq.size, SZ_4K));
+ 		sizes[0] = max(sizes[0], inst->output_buf_size);
+ 		inst->output_buf_size = sizes[0];
+ 		break;
diff --git a/kernel/patches/0020-media-venus-allocate-valid-encoder-eos-memory.patch b/kernel/patches/0020-media-venus-allocate-valid-encoder-eos-memory.patch
new file mode 100644
index 0000000..ff60744
--- /dev/null
+++ b/kernel/patches/0020-media-venus-allocate-valid-encoder-eos-memory.patch
@@ -0,0 +1,110 @@
+Subject: [PATCH] media: venus: allocate valid memory for encoder EOS
+
+The SDM845 stock firmware validates the EOS input address and allocation
+length even when the payload is empty. A synthetic unmapped address with
+zero allocation length fails session validation at encoder drain.
+
+Allocate one coherent page per encoder instance on its first STOP command
+and retain it until session teardown. Reuse it across drain/start cycles.
+Leave the encoder state unchanged if allocation or EOS submission fails.
+---
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -4,6 +4,7 @@
+  * Copyright (C) 2017 Linaro Ltd.
+  */
+ #include <linux/clk.h>
++#include <linux/dma-mapping.h>
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+@@ -22,6 +23,13 @@
+ #include "pm_helpers.h"
+ 
+ #define NUM_B_FRAMES_MAX	4
++
++/* Keep EOS memory mapped until the firmware session is closed. */
++struct venc_eos_instance {
++	struct venus_inst inst;
++	void *eos_va;
++	dma_addr_t eos_da;
++};
+ 
+ /*
+  * Three resons to keep MPLANE formats (despite that the number of planes
+@@ -528,6 +536,7 @@
+ venc_encoder_cmd(struct file *file, void *fh, struct v4l2_encoder_cmd *cmd)
+ {
+ 	struct venus_inst *inst = to_inst(file);
++	struct venc_eos_instance *eos = container_of(inst, struct venc_eos_instance, inst);
+ 	struct hfi_frame_data fdata = {0};
+ 	int ret = 0;
+ 
+@@ -546,13 +555,22 @@
+ 		if (!(inst->streamon_out && inst->streamon_cap))
+ 			goto unlock;
+ 
++		if (!eos->eos_va) {
++			eos->eos_va = dma_alloc_coherent(inst->core->dev, SZ_4K,
++						       &eos->eos_da, GFP_KERNEL);
++			if (!eos->eos_va) {
++				ret = -ENOMEM;
++				goto unlock;
++			}
++		}
+ 		fdata.buffer_type = HFI_BUFFER_INPUT;
+ 		fdata.flags |= HFI_BUFFERFLAG_EOS;
+-		fdata.device_addr = 0xdeadb000;
++		fdata.device_addr = eos->eos_da;
++		fdata.alloc_len = SZ_4K;
+ 
+ 		ret = hfi_session_process_buf(inst, &fdata);
+-
+-		inst->enc_state = VENUS_ENC_STATE_DRAIN;
++		if (!ret)
++			inst->enc_state = VENUS_ENC_STATE_DRAIN;
+ 	} else if (cmd->cmd == V4L2_ENC_CMD_START) {
+ 		if (inst->enc_state == VENUS_ENC_STATE_DRAIN) {
+ 			ret = -EBUSY;
+@@ -1468,11 +1486,13 @@
+ {
+ 	struct venus_core *core = video_drvdata(file);
+ 	struct venus_inst *inst;
++	struct venc_eos_instance *eos;
+ 	int ret;
+ 
+-	inst = kzalloc_obj(*inst);
+-	if (!inst)
++	eos = kzalloc_obj(*eos);
++	if (!eos)
+ 		return -ENOMEM;
++	inst = &eos->inst;
+ 
+ 	INIT_LIST_HEAD(&inst->dpbbufs);
+ 	INIT_LIST_HEAD(&inst->registeredbufs);
+@@ -1533,20 +1553,23 @@
+ err_ctrl_deinit:
+ 	v4l2_ctrl_handler_free(&inst->ctrl_handler);
+ err_free:
+-	kfree(inst);
++	kfree(eos);
+ 	return ret;
+ }
+ 
+ static int venc_close(struct file *file)
+ {
+ 	struct venus_inst *inst = to_inst(file);
++	struct venc_eos_instance *eos = container_of(inst, struct venc_eos_instance, inst);
+ 
+ 	venc_pm_get(inst);
+ 	venus_close_common(inst, file);
++	if (eos->eos_va)
++		dma_free_coherent(inst->core->dev, SZ_4K, eos->eos_va, eos->eos_da);
+ 	inst->enc_state = VENUS_ENC_STATE_DEINIT;
+ 	venc_pm_put(inst, false);
+ 
+-	kfree(inst);
++	kfree(eos);
+ 	return 0;
+ }
+ 
diff --git a/kernel/patches/0021-media-venus-keep-capture-buffers-across-encoder-drain.patch b/kernel/patches/0021-media-venus-keep-capture-buffers-across-encoder-drain.patch
new file mode 100644
index 0000000..63c2577
--- /dev/null
+++ b/kernel/patches/0021-media-venus-keep-capture-buffers-across-encoder-drain.patch
@@ -0,0 +1,25 @@
+Subject: [PATCH] media: venus: keep capture buffers across encoder drain
+
+Capture buffers can be requeued after firmware completes EOS but
+before userspace dequeues LAST. Returning them empty in STOPPED
+leaves empty completions with zero timestamps after START. This
+breaks frame reconciliation.
+
+Keep capture buffers on the normal firmware queue across drain
+and restart. This fixes a hardware regression that queues capture
+after LAST before START; it previously returned an empty non-LAST
+buffer as the next encoded frame.
+---
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -1353,7 +1353,9 @@
+ 
+ 	mutex_lock(&inst->lock);
+ 
+-	if (inst->enc_state == VENUS_ENC_STATE_STOPPED) {
++	/* Capture buffers queued after EOS are needed when encoding resumes. */
++	if (inst->enc_state == VENUS_ENC_STATE_STOPPED &&
++	    V4L2_TYPE_IS_OUTPUT(vb->type)) {
+ 		vbuf->sequence = inst->sequence_cap++;
+ 		vbuf->field = V4L2_FIELD_NONE;
+ 		vb2_set_plane_payload(vb, 0, 0);
diff --git a/kernel/patches/0022-serial-qcom-geni-keep-rx-dma-buffer.patch b/kernel/patches/0022-serial-qcom-geni-keep-rx-dma-buffer.patch
new file mode 100644
index 0000000..89042dc
--- /dev/null
+++ b/kernel/patches/0022-serial-qcom-geni-keep-rx-dma-buffer.patch
@@ -0,0 +1,42 @@
+From: Adeeb Shihadeh <adeeb@comma.ai>
+Subject: [PATCH] serial: qcom-geni: keep the mapped RX DMA buffer alive
+
+Non-console UART probe allocates and maps DMA_RX_BUF_SIZE bytes.  Do not
+resize that buffer to the FIFO depth during port setup: dma_map_single()
+would still refer to the freed original allocation, while RX copies from
+the replacement buffer.  The FIFO receive handler uses a local buffer and
+no longer needs this resize.
+
+This fixes zero-filled GNSS UART input on SDM845 and prevents DMA writes
+through a stale mapping.
+
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -1293,7 +1293,6 @@
+ static int setup_fifos(struct qcom_geni_serial_port *port)
+ {
+ 	struct uart_port *uport;
+-	u32 old_rx_fifo_depth = port->rx_fifo_depth;
+ 
+ 	uport = &port->uport;
+ 	port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se);
+@@ -1301,19 +1300,6 @@
+ 	port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se);
+ 	uport->fifosize =
+ 		(port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE;
+-
+-	if (port->rx_buf && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) {
+-		/*
+-		 * Use krealloc rather than krealloc_array because rx_buf is
+-		 * accessed as 1 byte entries as well as 4 byte entries so it's
+-		 * not necessarily an array.
+-		 */
+-		port->rx_buf = devm_krealloc(uport->dev, port->rx_buf,
+-					     port->rx_fifo_depth * sizeof(u32),
+-					     GFP_KERNEL);
+-		if (!port->rx_buf)
+-			return -ENOMEM;
+-	}
+ 
+ 	return 0;
+ }
diff --git a/kernel/patches/0023-drm-panel-dwo-load-factory-gamma.patch b/kernel/patches/0023-drm-panel-dwo-load-factory-gamma.patch
new file mode 100644
index 0000000..353e440
--- /dev/null
+++ b/kernel/patches/0023-drm-panel-dwo-load-factory-gamma.patch
@@ -0,0 +1,314 @@
+From 24103ea9e5f0e111cc104c4180aa497a4894d098 Mon Sep 17 00:00:00 2001
+From: Adeeb Shihadeh <adeebshihadeh@gmail.com>
+Date: Wed, 21 Oct 2026 10:40:06 -0700
+Subject: [PATCH] drm/panel: load per-device DWO gamma calibration as firmware
+
+Read an optional 150-byte firmware table containing three channels of
+25 big-endian gamma points. Apply the existing factory register order
+on each prepare, preserving panel defaults when no calibration is
+supplied. Leave command mode on transfer failure.
+
+Serialize panel preparation and backlight updates so brightness writes
+cannot alter gamma registers while command mode is selected. Defer
+backlight writes until the panel has been prepared.
+---
+ drivers/gpu/drm/panel/panel-dwo-do0200fat07.c | 177 +++++++++++++++++-
+ 1 file changed, 167 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-dwo-do0200fat07.c b/drivers/gpu/drm/panel/panel-dwo-do0200fat07.c
+index d5fb266..1961381 100644
+--- a/drivers/gpu/drm/panel/panel-dwo-do0200fat07.c
++++ b/drivers/gpu/drm/panel/panel-dwo-do0200fat07.c
+@@ -3,9 +3,11 @@
+ 
+ #include <linux/backlight.h>
+ #include <linux/delay.h>
++#include <linux/firmware.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/module.h>
++#include <linux/mutex.h>
+ #include <linux/regulator/consumer.h>
+ 
+ #include <video/mipi_display.h>
+@@ -16,12 +18,103 @@
+ #include <drm/drm_panel.h>
+ #include <drm/drm_probe_helper.h>
+ 
++/* 3 channels, each containing 25 big-endian 16-bit gamma points. */
++#define DWO_GAMMA_FIRMWARE "comma/dwo-do0200fat07-gamma.bin"
++#define DWO_GAMMA_CHANNELS 3
++#define DWO_GAMMA_POINTS 25
++
++static const u8 dwo_gamma_addr[DWO_GAMMA_CHANNELS][DWO_GAMMA_POINTS][2] = {
++	{
++		{ 0x00, 0x01 },
++		{ 0x02, 0x03 },
++		{ 0x04, 0x05 },
++		{ 0x06, 0x07 },
++		{ 0x08, 0x09 },
++		{ 0x0a, 0x0b },
++		{ 0x0c, 0x0d },
++		{ 0x0e, 0x0f },
++		{ 0x10, 0x11 },
++		{ 0x12, 0x13 },
++		{ 0x14, 0x15 },
++		{ 0x16, 0x17 },
++		{ 0x18, 0x19 },
++		{ 0x1a, 0x1b },
++		{ 0x1c, 0x1d },
++		{ 0x1e, 0x1f },
++		{ 0x20, 0x21 },
++		{ 0x22, 0x23 },
++		{ 0x24, 0x25 },
++		{ 0x26, 0x27 },
++		{ 0x28, 0x29 },
++		{ 0x2a, 0x2b },
++		{ 0x2d, 0x2f },
++		{ 0x30, 0x31 },
++		{ 0x32, 0x33 },
++	},
++	{
++		{ 0x34, 0x35 },
++		{ 0x36, 0x37 },
++		{ 0x38, 0x39 },
++		{ 0x3a, 0x3b },
++		{ 0x3d, 0x3f },
++		{ 0x40, 0x41 },
++		{ 0x42, 0x43 },
++		{ 0x44, 0x45 },
++		{ 0x46, 0x47 },
++		{ 0x48, 0x49 },
++		{ 0x4a, 0x4b },
++		{ 0x4c, 0x4d },
++		{ 0x4e, 0x4f },
++		{ 0x50, 0x51 },
++		{ 0x52, 0x53 },
++		{ 0x54, 0x55 },
++		{ 0x56, 0x58 },
++		{ 0x59, 0x5a },
++		{ 0x5b, 0x5c },
++		{ 0x5d, 0x5e },
++		{ 0x5f, 0x60 },
++		{ 0x61, 0x62 },
++		{ 0x63, 0x64 },
++		{ 0x65, 0x66 },
++		{ 0x67, 0x68 },
++	},
++	{
++		{ 0x69, 0x6a },
++		{ 0x6b, 0x6c },
++		{ 0x6d, 0x6e },
++		{ 0x6f, 0x70 },
++		{ 0x71, 0x72 },
++		{ 0x73, 0x74 },
++		{ 0x75, 0x76 },
++		{ 0x77, 0x78 },
++		{ 0x79, 0x7a },
++		{ 0x7b, 0x7c },
++		{ 0x7d, 0x7e },
++		{ 0x7f, 0x80 },
++		{ 0x81, 0x82 },
++		{ 0x83, 0x84 },
++		{ 0x85, 0x86 },
++		{ 0x87, 0x88 },
++		{ 0x89, 0x8a },
++		{ 0x8b, 0x8c },
++		{ 0x8d, 0x8e },
++		{ 0x8f, 0x90 },
++		{ 0x91, 0x92 },
++		{ 0x93, 0x94 },
++		{ 0x95, 0x96 },
++		{ 0x97, 0x98 },
++		{ 0x99, 0x9a },
++	},
++};
++
+ struct dwo_do0200fat07 {
+ 	struct drm_panel panel;
+ 	struct mipi_dsi_device *dsi;
+ 	struct gpio_desc *reset_gpio;
+ 	struct regulator *vddio;
+ 	struct regulator *vdd;
++	struct mutex lock;
++	bool prepared;
+ 	enum drm_panel_orientation orientation;
+ };
+ 
+@@ -65,6 +158,53 @@ static void dwo_do0200fat07_power_off(struct dwo_do0200fat07 *ctx)
+ 	regulator_disable(ctx->vddio);
+ }
+ 
++static int dwo_do0200fat07_load_gamma(struct dwo_do0200fat07 *ctx)
++{
++	struct mipi_dsi_multi_context dsi_ctx = { .dsi = ctx->dsi };
++	const u8 exit_command_mode[] = { 0xfe, 0xa0 };
++	const struct firmware *firmware;
++	struct device *dev = &ctx->dsi->dev;
++	int color, point, ret;
++
++	ret = request_firmware_direct(&firmware, DWO_GAMMA_FIRMWARE, dev);
++	if (ret) {
++		if (ret != -ENOENT)
++			dev_warn(dev, "Failed to load panel gamma: %d\n", ret);
++		return 0;
++	}
++
++	if (firmware->size != DWO_GAMMA_CHANNELS * DWO_GAMMA_POINTS * 2) {
++		dev_warn(dev, "Ignoring invalid panel gamma size: %zu\n",
++			 firmware->size);
++		release_firmware(firmware);
++		return 0;
++	}
++
++	mipi_dsi_dcs_write_seq_multi(&dsi_ctx, 0xfe, 0xa2);
++	for (color = 0; color < DWO_GAMMA_CHANNELS; color++) {
++		for (point = DWO_GAMMA_POINTS - 1; point >= 0; point--) {
++			const u8 *value = &firmware->data[(color * DWO_GAMMA_POINTS + point) * 2];
++			u8 command[] = { dwo_gamma_addr[color][point][0], value[0] };
++
++			mipi_dsi_dcs_write_buffer_multi(&dsi_ctx, command, sizeof(command));
++			command[0] = dwo_gamma_addr[color][point][1];
++			command[1] = value[1];
++			mipi_dsi_dcs_write_buffer_multi(&dsi_ctx, command, sizeof(command));
++		}
++	}
++
++	/* Leave command mode even if a gamma write failed. */
++	ret = mipi_dsi_dcs_write_buffer(ctx->dsi, exit_command_mode,
++				      sizeof(exit_command_mode));
++	if (ret < 0 && !dsi_ctx.accum_err)
++		dsi_ctx.accum_err = ret;
++	if (!dsi_ctx.accum_err)
++		dev_info(dev, "Successfully setup screen calibration\n");
++
++	release_firmware(firmware);
++	return dsi_ctx.accum_err;
++}
++
+ static int dwo_do0200fat07_init_sequence(struct dwo_do0200fat07 *ctx)
+ {
+ 	struct mipi_dsi_multi_context dsi_ctx = { .dsi = ctx->dsi };
+@@ -92,8 +232,10 @@ static int dwo_do0200fat07_init_sequence(struct dwo_do0200fat07 *ctx)
+ 
+ 	mipi_dsi_dcs_exit_sleep_mode_multi(&dsi_ctx);
+ 	mipi_dsi_msleep(&dsi_ctx, 100);
++	if (dsi_ctx.accum_err)
++		return dsi_ctx.accum_err;
+ 
+-	return dsi_ctx.accum_err;
++	return dwo_do0200fat07_load_gamma(ctx);
+ }
+ 
+ static int dwo_do0200fat07_prepare(struct drm_panel *panel)
+@@ -102,10 +244,11 @@ static int dwo_do0200fat07_prepare(struct drm_panel *panel)
+ 	struct device *dev = &ctx->dsi->dev;
+ 	int ret;
+ 
++	mutex_lock(&ctx->lock);
+ 	ret = dwo_do0200fat07_power_on(ctx);
+ 	if (ret) {
+ 		dev_err(dev, "Failed to power on: %d\n", ret);
+-		return ret;
++		goto out;
+ 	}
+ 
+ 	dwo_do0200fat07_reset(ctx);
+@@ -115,19 +258,25 @@ static int dwo_do0200fat07_prepare(struct drm_panel *panel)
+ 		dev_err(dev, "Failed to initialize panel: %d\n", ret);
+ 		gpiod_set_value_cansleep(ctx->reset_gpio, 1);
+ 		dwo_do0200fat07_power_off(ctx);
+-		return ret;
++		goto out;
+ 	}
+ 
+-	return 0;
++	ctx->prepared = true;
++out:
++	mutex_unlock(&ctx->lock);
++	return ret;
+ }
+ 
+ static int dwo_do0200fat07_unprepare(struct drm_panel *panel)
+ {
+ 	struct dwo_do0200fat07 *ctx = to_dwo_do0200fat07(panel);
+ 
++	mutex_lock(&ctx->lock);
++	ctx->prepared = false;
+ 	gpiod_set_value_cansleep(ctx->reset_gpio, 1);
+ 	usleep_range(1000, 2000);
+ 	dwo_do0200fat07_power_off(ctx);
++	mutex_unlock(&ctx->lock);
+ 
+ 	return 0;
+ }
+@@ -211,16 +360,21 @@ static const struct drm_panel_funcs dwo_do0200fat07_panel_funcs = {
+ 
+ static int dwo_do0200fat07_bl_update_status(struct backlight_device *bl)
+ {
+-	struct mipi_dsi_device *dsi = bl_get_data(bl);
++	struct dwo_do0200fat07 *ctx = bl_get_data(bl);
++	struct mipi_dsi_device *dsi = ctx->dsi;
+ 	u16 brightness = backlight_get_brightness(bl);
+-	int ret;
++	int ret = 0;
+ 
++	mutex_lock(&ctx->lock);
++	if (!ctx->prepared)
++		goto out;
+ 	dsi->mode_flags &= ~MIPI_DSI_MODE_LPM;
+ 
+ 	ret = mipi_dsi_dcs_set_display_brightness(dsi, brightness);
+ 
+ 	dsi->mode_flags |= MIPI_DSI_MODE_LPM;
+-
++out:
++	mutex_unlock(&ctx->lock);
+ 	return ret;
+ }
+ 
+@@ -229,8 +383,9 @@ static const struct backlight_ops dwo_do0200fat07_bl_ops = {
+ };
+ 
+ static struct backlight_device *
+-dwo_do0200fat07_create_backlight(struct mipi_dsi_device *dsi)
++dwo_do0200fat07_create_backlight(struct dwo_do0200fat07 *ctx)
+ {
++	struct mipi_dsi_device *dsi = ctx->dsi;
+ 	struct device *dev = &dsi->dev;
+ 	const struct backlight_properties props = {
+ 		.type = BACKLIGHT_RAW,
+@@ -238,7 +393,7 @@ dwo_do0200fat07_create_backlight(struct mipi_dsi_device *dsi)
+ 		.max_brightness = 255,
+ 	};
+ 
+-	return devm_backlight_device_register(dev, dev_name(dev), dev, dsi,
++	return devm_backlight_device_register(dev, dev_name(dev), dev, ctx,
+ 					      &dwo_do0200fat07_bl_ops, &props);
+ }
+ 
+@@ -254,6 +409,7 @@ static int dwo_do0200fat07_probe(struct mipi_dsi_device *dsi)
+ 	if (IS_ERR(ctx))
+ 		return PTR_ERR(ctx);
+ 
++	mutex_init(&ctx->lock);
+ 	ctx->vddio = devm_regulator_get(dev, "vddio");
+ 	if (IS_ERR(ctx->vddio))
+ 		return dev_err_probe(dev, PTR_ERR(ctx->vddio),
+@@ -279,7 +435,7 @@ static int dwo_do0200fat07_probe(struct mipi_dsi_device *dsi)
+ 
+ 	ctx->panel.prepare_prev_first = true;
+ 
+-	ctx->panel.backlight = dwo_do0200fat07_create_backlight(dsi);
++	ctx->panel.backlight = dwo_do0200fat07_create_backlight(ctx);
+ 	if (IS_ERR(ctx->panel.backlight))
+ 		return dev_err_probe(dev, PTR_ERR(ctx->panel.backlight),
+ 				     "Failed to create backlight\n");
+@@ -332,3 +488,4 @@ module_mipi_dsi_driver(dwo_do0200fat07_driver);
+ MODULE_AUTHOR("Robin Reckmann <robin.reckmann@gmail.com>");
+ MODULE_DESCRIPTION("DRM driver for DWo DO0200FAT07 panel");
+ MODULE_LICENSE("GPL");
++MODULE_FIRMWARE(DWO_GAMMA_FIRMWARE);
+-- 
+2.55.0
+
diff --git a/kernel/patches/0024-media-venus-allocate-valid-decoder-eos-memory.patch b/kernel/patches/0024-media-venus-allocate-valid-decoder-eos-memory.patch
new file mode 100644
index 0000000..940371e
--- /dev/null
+++ b/kernel/patches/0024-media-venus-allocate-valid-decoder-eos-memory.patch
@@ -0,0 +1,110 @@
+Subject: [PATCH] media: venus: allocate valid memory for decoder EOS
+
+The SDM845 firmware validates decoder EOS input addresses too. An unmapped
+0xdeadb000 address triggers HFI session error 0x1001 when draining a valid
+HEVC stream on mici. Retain one coherent page per decoder instance until
+session teardown, mirroring the encoder fix. Keep the older IRIS2 firmware
+NULL-address workaround unchanged.
+
+Reproduced on v7.3 with mainline Venus using V4L2_MEMORY_DMABUF decoding;
+encoder output decodes correctly and the session fails on DEC_CMD_STOP.
+---
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -4,6 +4,7 @@
+  * Copyright (C) 2017 Linaro Ltd.
+  */
+ #include <linux/clk.h>
++#include <linux/dma-mapping.h>
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+@@ -20,6 +21,13 @@
+ #include "helpers.h"
+ #include "vdec.h"
+ #include "pm_helpers.h"
++
++/* Keep EOS memory mapped until the firmware session is closed. */
++struct vdec_eos_instance {
++	struct venus_inst inst;
++	void *eos_va;
++	dma_addr_t eos_da;
++};
+ 
+ /*
+  * Three resons to keep MPLANE formats (despite that the number of planes
+@@ -548,6 +556,7 @@
+ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd)
+ {
+ 	struct venus_inst *inst = to_inst(file);
++	struct vdec_eos_instance *eos = container_of(inst, struct vdec_eos_instance, inst);
+ 	struct vb2_queue *dst_vq;
+ 	struct hfi_frame_data fdata = {0};
+ 	int ret;
+@@ -574,10 +583,20 @@
+ 		 * avoids misapplying this quirk and breaking VP9 decode on SC7280.
+ 		 */
+ 
+-		if (IS_IRIS2(inst->core) && is_fw_rev_or_older(inst->core, 1, 0, 87))
++		if (IS_IRIS2(inst->core) && is_fw_rev_or_older(inst->core, 1, 0, 87)) {
+ 			fdata.device_addr = 0;
+-		else
+-			fdata.device_addr = 0xdeadb000;
++		} else {
++			if (!eos->eos_va) {
++				eos->eos_va = dma_alloc_coherent(inst->core->dev, SZ_4K,
++							       &eos->eos_da, GFP_KERNEL);
++				if (!eos->eos_va) {
++					ret = -ENOMEM;
++					goto unlock;
++				}
++			}
++			fdata.device_addr = eos->eos_da;
++			fdata.alloc_len = SZ_4K;
++		}
+ 
+ 		ret = hfi_session_process_buf(inst, &fdata);
+ 
+@@ -1681,11 +1700,13 @@
+ {
+ 	struct venus_core *core = video_drvdata(file);
+ 	struct venus_inst *inst;
++	struct vdec_eos_instance *eos;
+ 	int ret;
+ 
+-	inst = kzalloc_obj(*inst);
+-	if (!inst)
++	eos = kzalloc_obj(*eos);
++	if (!eos)
+ 		return -ENOMEM;
++	inst = &eos->inst;
+ 
+ 	INIT_LIST_HEAD(&inst->dpbbufs);
+ 	INIT_LIST_HEAD(&inst->registeredbufs);
+@@ -1751,21 +1772,24 @@
+ err_ctrl_deinit:
+ 	v4l2_ctrl_handler_free(&inst->ctrl_handler);
+ err_free:
+-	kfree(inst);
++	kfree(eos);
+ 	return ret;
+ }
+ 
+ static int vdec_close(struct file *file)
+ {
+ 	struct venus_inst *inst = to_inst(file);
++	struct vdec_eos_instance *eos = container_of(inst, struct vdec_eos_instance, inst);
+ 
+ 	vdec_pm_get(inst);
+ 	cancel_work_sync(&inst->delayed_process_work);
+ 	venus_close_common(inst, file);
++	if (eos->eos_va)
++		dma_free_coherent(inst->core->dev, SZ_4K, eos->eos_va, eos->eos_da);
+ 	ida_destroy(&inst->dpb_ids);
+ 	vdec_pm_put(inst, false);
+ 
+-	kfree(inst);
++	kfree(eos);
+ 	return 0;
+ }
+ 
diff --git a/kernel/patches/0025-iio-adc-pmi8998-fuel-gauge.patch b/kernel/patches/0025-iio-adc-pmi8998-fuel-gauge.patch
new file mode 100644
index 0000000..b3df592
--- /dev/null
+++ b/kernel/patches/0025-iio-adc-pmi8998-fuel-gauge.patch
@@ -0,0 +1,369 @@
+Subject: [PATCH] iio: adc: expose batteryless PMI8998 rail measurements
+
+mici has no INA monitor. Its externally supplied VBAT rail is measured by
+PMI8998's fuel-gauge ADC. Use standard IIO voltage/current channels so the
+existing iio-hwmon bridge can expose millivolts and milliamps to userspace.
+
+Voltage/current scaling follows the PMI8998 fuel-gauge RFC:
+https://patch.msgid.link/20251124-pmi8998_fuel_gauge-v1-2-dd3791f61478@ixit.cz
+Instantaneous IADC conversion follows commaai/agnos-kernel-sdm845 commit
+8e3385d2d36228e40892920211e8c91d46a6858f (faster power measurement #112).
+
+Return the previous completed sample and arm the next conversion, like
+downstream. Both triggering and restoring control clear IADC on hardware,
+so delayed work latches a completed sample before restoring control.
+Wait at least 170 ms, including timer rounding. Preserve actual zero
+samples and propagate conversion/restore failures. Serialize transactions
+and retain restoration state across failures. Cancel work before teardown.
+No battery or charger policy is added.
+---
+diff --git a/drivers/iio/adc/qcom-spmi-fg-adc.c b/drivers/iio/adc/qcom-spmi-fg-adc.c
+new file mode 100644
+--- /dev/null
++++ b/drivers/iio/adc/qcom-spmi-fg-adc.c
+@@ -0,0 +1,260 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * PMI8998 fuel-gauge ADC measurements for systems without a battery.
++ * Conversion factors follow the PMI8998 fuel-gauge driver submitted by
++ * Casey Connolly, Joel Selvaraj and Yassine Oudjana. Direct IADC conversion
++ * follows commaai/agnos-kernel-sdm845 commit 8e3385d2d362.
++ */
++#include <linux/jiffies.h>
++#include <linux/iio/iio.h>
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/platform_device.h>
++#include <linux/property.h>
++#include <linux/regmap.h>
++#include <linux/string.h>
++#include <linux/unaligned.h>
++#include <linux/workqueue.h>
++#include <soc/qcom/qcom-spmi-pmic.h>
++
++#define FG_VBATT_LSB		0xa0
++#define FG_IADC_LSB		0xae
++#define FG_SEC_ACCESS		0xd0
++#define FG_TM_MISC		0xe5
++#define FG_DIRECT_MODE		BIT(4)
++#define FG_IADC_CONV		BIT(2)
++#define FG_ADC_ENABLE		BIT(1)
++
++struct fg_adc {
++	struct device *dev;
++	struct regmap *regmap;
++	/* Serialize direct conversions and control-register restoration. */
++	struct mutex lock;
++	u32 base;
++	bool swap_bytes;
++	struct delayed_work restore_work;
++	bool converting;
++	bool restore_pending;
++	u8 saved_control;
++	int restore_error;
++	int conversion_error;
++	u8 current_raw[2];
++	bool current_valid;
++};
++
++static int fg_adc_write_control(struct fg_adc *adc, u8 value)
++{
++	int ret;
++
++	ret = regmap_write(adc->regmap, adc->base + FG_SEC_ACCESS, 0xa5);
++	if (ret)
++		return ret;
++	return regmap_write(adc->regmap, adc->base + FG_TM_MISC, value);
++}
++
++static void fg_adc_restore_work(struct work_struct *work)
++{
++	struct fg_adc *adc = container_of(to_delayed_work(work), struct fg_adc, restore_work);
++	u8 data[2];
++
++	mutex_lock(&adc->lock);
++	/* Restoring control clears IADC, so latch the completed sample first. */
++	adc->conversion_error = regmap_bulk_read(adc->regmap, adc->base + FG_IADC_LSB, data, 2);
++	if (!adc->conversion_error) {
++		memcpy(adc->current_raw, data, sizeof(data));
++		adc->current_valid = true;
++	}
++	adc->restore_error = fg_adc_write_control(adc, adc->saved_control);
++	adc->restore_pending = !!adc->restore_error;
++	adc->converting = false;
++	mutex_unlock(&adc->lock);
++}
++
++static void fg_adc_stop_conversions(void *data)
++{
++	struct fg_adc *adc = data;
++	int ret = 0;
++
++	cancel_delayed_work_sync(&adc->restore_work);
++	mutex_lock(&adc->lock);
++	if (adc->restore_pending) {
++		ret = fg_adc_write_control(adc, adc->saved_control);
++		adc->restore_pending = !!ret;
++	}
++	mutex_unlock(&adc->lock);
++	if (ret)
++		dev_warn(adc->dev, "Failed to restore ADC control: %d\n", ret);
++}
++
++static int fg_adc_read_current(struct fg_adc *adc, u8 *data)
++{
++	unsigned int control;
++	u8 value;
++	int ret;
++
++	/* Report a failed restore once, rather than silently accepting it. */
++	if (adc->restore_error) {
++		ret = adc->restore_error;
++		adc->restore_error = fg_adc_write_control(adc, adc->saved_control);
++		adc->restore_pending = !!adc->restore_error;
++		return ret;
++	}
++
++	if (adc->conversion_error) {
++		ret = adc->conversion_error;
++		adc->conversion_error = 0;
++		return ret;
++	}
++
++	/* Both trigger and restore clear IADC: use the last completed sample. */
++	if (!adc->current_valid) {
++		ret = regmap_bulk_read(adc->regmap, adc->base + FG_IADC_LSB, adc->current_raw, 2);
++		if (ret)
++			return ret;
++		adc->current_valid = true;
++	}
++	memcpy(data, adc->current_raw, sizeof(adc->current_raw));
++	if (adc->converting)
++		return 0;
++
++	ret = regmap_read(adc->regmap, adc->base + FG_TM_MISC, &control);
++	if (ret)
++		return ret;
++
++	/* Save before touching control so a failed trigger can be unwound. */
++	adc->saved_control = control;
++	adc->restore_pending = true;
++	/* Trigger on a rising edge, leaving unrelated control bits unchanged. */
++	value = (control | FG_DIRECT_MODE | FG_ADC_ENABLE) & ~FG_IADC_CONV;
++	ret = fg_adc_write_control(adc, value);
++	if (!ret)
++		ret = fg_adc_write_control(adc, value | FG_IADC_CONV);
++	if (ret) {
++		adc->restore_error = fg_adc_write_control(adc, control);
++		adc->restore_pending = !!adc->restore_error;
++		return ret;
++	}
++
++	adc->converting = true;
++	/* One extra tick prevents rounding below the 170 ms conversion time. */
++	schedule_delayed_work(&adc->restore_work, msecs_to_jiffies(170) + 1);
++	return 0;
++}
++
++static int fg_adc_read_raw(struct iio_dev *indio_dev,
++			   const struct iio_chan_spec *chan,
++			   int *val, int *val2, long mask)
++{
++	struct fg_adc *adc = iio_priv(indio_dev);
++	u8 data[2];
++	u16 raw;
++	int ret;
++
++	switch (mask) {
++	case IIO_CHAN_INFO_SCALE:
++		/* IIO voltage/current units are millivolts and milliamps. */
++		*val = chan->type == IIO_VOLTAGE ? 122070 : 488281;
++		*val2 = 1000000;
++		return IIO_VAL_FRACTIONAL;
++	case IIO_CHAN_INFO_RAW:
++		mutex_lock(&adc->lock);
++		if (chan->type == IIO_CURRENT)
++			ret = fg_adc_read_current(adc, data);
++		else
++			ret = regmap_bulk_read(adc->regmap,
++					       adc->base + FG_VBATT_LSB, data, 2);
++		mutex_unlock(&adc->lock);
++		if (ret)
++			return ret;
++		raw = adc->swap_bytes ? get_unaligned_be16(data) : get_unaligned_le16(data);
++		*val = chan->type == IIO_CURRENT ? (s16)raw : raw;
++		return IIO_VAL_INT;
++	default:
++		return -EINVAL;
++	}
++}
++
++static int fg_adc_read_label(struct iio_dev *indio_dev,
++			     const struct iio_chan_spec *chan, char *buf)
++{
++	return sysfs_emit(buf, "%s\n", chan->datasheet_name);
++}
++
++static const struct iio_info fg_adc_info = {
++	.read_raw = fg_adc_read_raw,
++	.read_label = fg_adc_read_label,
++};
++
++static const struct iio_chan_spec fg_adc_channels[] = {
++	{
++		.type = IIO_VOLTAGE,
++		.indexed = 1,
++		.channel = 0,
++		.datasheet_name = "vbat",
++		.info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
++	},
++	{
++		.type = IIO_CURRENT,
++		.indexed = 1,
++		.channel = 1,
++		.datasheet_name = "ibat",
++		.info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
++	},
++};
++
++static int fg_adc_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	const struct qcom_spmi_pmic *pmic;
++	struct iio_dev *indio_dev;
++	struct fg_adc *adc;
++	int ret;
++
++	indio_dev = devm_iio_device_alloc(dev, sizeof(*adc));
++	if (!indio_dev)
++		return -ENOMEM;
++	adc = iio_priv(indio_dev);
++	adc->dev = dev;
++	adc->regmap = dev_get_regmap(dev->parent, NULL);
++	if (!adc->regmap)
++		return -ENODEV;
++	ret = device_property_read_u32(dev, "reg", &adc->base);
++	if (ret)
++		return ret;
++	pmic = qcom_pmic_get(dev);
++	if (IS_ERR(pmic))
++		return dev_err_probe(dev, PTR_ERR(pmic), "Cannot read PMIC revision\n");
++	if (pmic->subtype != PMI8998_SUBTYPE)
++		return -ENODEV;
++	adc->swap_bytes = pmic->major < 2;
++	mutex_init(&adc->lock);
++	INIT_DELAYED_WORK(&adc->restore_work, fg_adc_restore_work);
++	ret = devm_add_action_or_reset(dev, fg_adc_stop_conversions, adc);
++	if (ret)
++		return ret;
++
++	indio_dev->name = "pmi8998-fg-adc";
++	indio_dev->modes = INDIO_DIRECT_MODE;
++	indio_dev->info = &fg_adc_info;
++	indio_dev->channels = fg_adc_channels;
++	indio_dev->num_channels = ARRAY_SIZE(fg_adc_channels);
++	return devm_iio_device_register(dev, indio_dev);
++}
++
++static const struct of_device_id fg_adc_match[] = {
++	{ .compatible = "qcom,pmi8998-fg-adc" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, fg_adc_match);
++
++static struct platform_driver fg_adc_driver = {
++	.probe = fg_adc_probe,
++	.driver = {
++		.name = "qcom-pmi8998-fg-adc",
++		.of_match_table = fg_adc_match,
++	},
++};
++module_platform_driver(fg_adc_driver);
++
++MODULE_DESCRIPTION("Qualcomm PMI8998 fuel-gauge ADC");
++MODULE_LICENSE("GPL");
+diff --git a/Documentation/devicetree/bindings/iio/adc/qcom,pmi8998-fg-adc.yaml b/Documentation/devicetree/bindings/iio/adc/qcom,pmi8998-fg-adc.yaml
+new file mode 100644
+--- /dev/null
++++ b/Documentation/devicetree/bindings/iio/adc/qcom,pmi8998-fg-adc.yaml
+@@ -0,0 +1,48 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/iio/adc/qcom,pmi8998-fg-adc.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Qualcomm PMI8998 fuel-gauge ADC
++
++maintainers:
++  - Adeeb Shihadeh <adeeb@comma.ai>
++
++description: |
++  Voltage and instantaneous current measurements from the PMI8998 fuel-gauge
++  ADC, for systems where VBAT is externally powered and no battery fuel-gauge
++  algorithm is running. The current channel uses a direct IADC conversion.
++  This device must not be used together with a fuel-gauge driver controlling
++  the same hardware.
++
++properties:
++  compatible:
++    const: qcom,pmi8998-fg-adc
++
++  reg:
++    maxItems: 1
++
++  '#io-channel-cells':
++    const: 1
++    description: 0 selects VBAT voltage and 1 selects VBAT current.
++
++required:
++  - compatible
++  - reg
++  - '#io-channel-cells'
++
++additionalProperties: false
++
++examples:
++  - |
++    pmic {
++      #address-cells = <1>;
++      #size-cells = <0>;
++
++      adc@4100 {
++        compatible = "qcom,pmi8998-fg-adc";
++        reg = <0x4100>;
++        #io-channel-cells = <1>;
++      };
++    };
+diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
+--- a/drivers/iio/adc/Kconfig
++++ b/drivers/iio/adc/Kconfig
+@@ -1366,6 +1366,17 @@
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called qcom-pm8xxx-xoadc.
+ 
++config QCOM_SPMI_FG_ADC
++	tristate "Qualcomm PMI8998 fuel-gauge ADC"
++	depends on MFD_SPMI_PMIC
++	help
++	  Voltage and instantaneous current measurements on batteryless PMI8998
++	  systems. The channels can be consumed by the standard iio-hwmon bridge.
++	  Do not enable together with a driver for the same fuel gauge.
++
++	  To compile this driver as a module, choose M here: the module will
++	  be called qcom-spmi-fg-adc.
++
+ config QCOM_SPMI_RRADC
+ 	tristate "Qualcomm SPMI RRADC"
+ 	depends on MFD_SPMI_PMIC
+diff --git a/drivers/iio/adc/Makefile b/drivers/iio/adc/Makefile
+--- a/drivers/iio/adc/Makefile
++++ b/drivers/iio/adc/Makefile
+@@ -121,6 +121,7 @@
+ obj-$(CONFIG_QCOM_SPMI_ADC5) += qcom-spmi-adc5.o
+ obj-$(CONFIG_QCOM_SPMI_ADC5_GEN3) += qcom-spmi-adc5-gen3.o
+ obj-$(CONFIG_QCOM_SPMI_IADC) += qcom-spmi-iadc.o
++obj-$(CONFIG_QCOM_SPMI_FG_ADC) += qcom-spmi-fg-adc.o
+ obj-$(CONFIG_QCOM_SPMI_RRADC) += qcom-spmi-rradc.o
+ obj-$(CONFIG_QCOM_SPMI_VADC) += qcom-spmi-vadc.o
+ obj-$(CONFIG_QCOM_VADC_COMMON) += qcom-vadc-common.o
diff --git a/kernel/patches/0026-wifi-ath10k-recover-mismatched-split-rx.patch b/kernel/patches/0026-wifi-ath10k-recover-mismatched-split-rx.patch
new file mode 100644
index 0000000..f04e264
--- /dev/null
+++ b/kernel/patches/0026-wifi-ath10k-recover-mismatched-split-rx.patch
@@ -0,0 +1,19 @@
+From: Adeeb Shihadeh <adeeb@comma.ai>
+Subject: [PATCH] wifi: ath10k: recover after mismatched split RX indications
+
+A mismatched continuation sets rx_confused, which rejects every subsequent
+RX indication until the ring is reinitialized. Schedule recovery just as
+the neighboring malformed-list and extraction error paths already do.
+The caller only reschedules NAPI and cannot clear this condition itself.
+
+---
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -3311,6 +3311,7 @@
+ 		 || offload) {
+ 			ath10k_warn(ar, "split amsdu did not resume immediately\n");
+ 			htt->rx_confused = true;
++			ath10k_core_start_recovery(ar);
+ 			return -EIO;
+ 		}
+ 	}
diff --git a/kernel/patches/0027-usb-typec-add-qualcomm-gen1-port-backend.patch b/kernel/patches/0027-usb-typec-add-qualcomm-gen1-port-backend.patch
new file mode 100644
index 0000000..2be01d7
--- /dev/null
+++ b/kernel/patches/0027-usb-typec-add-qualcomm-gen1-port-backend.patch
@@ -0,0 +1,935 @@
+From: David Heidelberg <david@ixit.cz>
+Subject: [PATCH] usb: typec: add Qualcomm gen1 port backend
+
+Unmodified aggregate of patches 01, 03, 04, 05, 06, 08 from David Heidelberg's
+2026-09-26 RFC "Qualcomm Type-C support for 1st generation":
+https://lore.kernel.org/all/20260926-typec-v1-0-31adc19f32c6@ixit.cz/
+https://patchew.org/linux/20260926-typec-v1-0-31adc19f32c6@ixit.cz/
+
+The selected patches add the gen1 shared Qualcomm TCPM backend, its binding,
+and a disabled PMI8998 controller node. Phone board DTS changes are omitted.
+The original RFC covers externally powered docks and has no VBUS source
+provider; the following local patch supplies mici's dedicated source path.
+
+Applied to Linux c03c1a14507dfaf8b856c2608f9ac216021fc222 (v7.3).
+Original mbox SHA256:
+e35d6beaff5089f72ab7c1829a9d295af2f7e35b224120c1aeb46e3581b1969b
+
+diff --git a/Documentation/devicetree/bindings/mfd/qcom,spmi-pmic.yaml b/Documentation/devicetree/bindings/mfd/qcom,spmi-pmic.yaml
+--- a/Documentation/devicetree/bindings/mfd/qcom,spmi-pmic.yaml
++++ b/Documentation/devicetree/bindings/mfd/qcom,spmi-pmic.yaml
+@@ -204,7 +204,9 @@
+ 
+   "^typec@[0-9a-f]+$":
+     type: object
+-    $ref: /schemas/usb/qcom,pmic-typec.yaml#
++    oneOf:
++      - $ref: /schemas/usb/qcom,pmic-typec.yaml#
++      - $ref: /schemas/usb/qcom,pmic-typec-gen1.yaml#
+ 
+   "^usb-detect@[0-9a-f]+$":
+     type: object
+diff --git a/Documentation/devicetree/bindings/usb/qcom,pmic-typec-gen1.yaml b/Documentation/devicetree/bindings/usb/qcom,pmic-typec-gen1.yaml
+new file mode 100644
+--- /dev/null
++++ b/Documentation/devicetree/bindings/usb/qcom,pmic-typec-gen1.yaml
+@@ -0,0 +1,130 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/usb/qcom,pmic-typec-gen1.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Qualcomm PMIC USB Type-C block (gen1)
++
++maintainers:
++  - David Heidelberg <david@ixit.cz>
++
++description:
++  First generation of the Qualcomm PMIC Type-C port controller.
++
++properties:
++  compatible:
++    enum:
++      - qcom,pm660-typec
++      - qcom,pmi8998-typec
++
++  reg:
++    items:
++      - description: USBIN peripheral base (Type-C CC logic)
++      - description: USB PD PHY peripheral base
++
++  interrupts:
++    items:
++      - description: Type-C change - CC state, tCCDebounce done, VBUS change or error
++      - description: Power Domain Signal TX - HardReset or CableReset signal TX
++      - description: Power Domain Signal RX - HardReset or CableReset signal RX
++      - description: Power Domain TX complete
++      - description: Power Domain RX complete
++      - description: Power Domain TX fail
++      - description: Power Domain TX message discard
++      - description: Power Domain RX message discard
++      - description: Power Domain Fast Role Swap event
++
++  interrupt-names:
++    items:
++      - const: type-c-change
++      - const: sig-tx
++      - const: sig-rx
++      - const: msg-tx
++      - const: msg-rx
++      - const: msg-tx-failed
++      - const: msg-tx-discarded
++      - const: msg-rx-discarded
++      - const: fr-swap
++
++  vdd-pdphy-supply:
++    description: VDD regulator supply to the PDPHY.
++
++  connector:
++    type: object
++    $ref: /schemas/connector/usb-connector.yaml#
++    unevaluatedProperties: false
++
++required:
++  - compatible
++  - reg
++  - interrupts
++  - interrupt-names
++  - vdd-pdphy-supply
++  - connector
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/interrupt-controller/irq.h>
++    #include <dt-bindings/usb/pd.h>
++
++    pmic {
++        #address-cells = <1>;
++        #size-cells = <0>;
++
++        typec@1300 {
++            compatible = "qcom,pmi8998-typec";
++            reg = <0x1300>,
++                  <0x1700>;
++
++            interrupts = <0x2 0x13 0x7 IRQ_TYPE_EDGE_RISING>,
++                         <0x2 0x17 0x0 IRQ_TYPE_EDGE_RISING>,
++                         <0x2 0x17 0x1 IRQ_TYPE_EDGE_RISING>,
++                         <0x2 0x17 0x2 IRQ_TYPE_EDGE_RISING>,
++                         <0x2 0x17 0x3 IRQ_TYPE_EDGE_RISING>,
++                         <0x2 0x17 0x4 IRQ_TYPE_EDGE_RISING>,
++                         <0x2 0x17 0x5 IRQ_TYPE_EDGE_RISING>,
++                         <0x2 0x17 0x6 IRQ_TYPE_EDGE_RISING>,
++                         <0x2 0x17 0x7 IRQ_TYPE_EDGE_RISING>;
++            interrupt-names = "type-c-change",
++                              "sig-tx",
++                              "sig-rx",
++                              "msg-tx",
++                              "msg-rx",
++                              "msg-tx-failed",
++                              "msg-tx-discarded",
++                              "msg-rx-discarded",
++                              "fr-swap";
++
++            vdd-pdphy-supply = <&vreg_l24a_3p075>;
++
++            connector {
++                compatible = "usb-c-connector";
++
++                power-role = "dual";
++                data-role = "dual";
++                try-power-role = "sink";
++
++                source-pdos = <PDO_FIXED(5000, 900, PDO_FIXED_DUAL_ROLE |
++                               PDO_FIXED_USB_COMM | PDO_FIXED_DATA_SWAP)>;
++                sink-pdos = <PDO_FIXED(5000, 3000, PDO_FIXED_DUAL_ROLE |
++                             PDO_FIXED_USB_COMM | PDO_FIXED_DATA_SWAP)>;
++                op-sink-microwatt = <15000000>;
++
++                ports {
++                    #address-cells = <1>;
++                    #size-cells = <0>;
++
++                    port@0 {
++                        reg = <0>;
++                        endpoint {
++                            remote-endpoint = <&usb_dwc3_hs>;
++                        };
++                    };
++                };
++            };
++        };
++    };
++...
+diff --git a/arch/arm64/boot/dts/qcom/pmi8998.dtsi b/arch/arm64/boot/dts/qcom/pmi8998.dtsi
+--- a/arch/arm64/boot/dts/qcom/pmi8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/pmi8998.dtsi
+@@ -25,6 +25,33 @@
+ 			io-channels = <&pmi8998_rradc 3>,
+ 				      <&pmi8998_rradc 4>;
+ 			io-channel-names = "usbin_i", "usbin_v";
++
++			status = "disabled";
++		};
++
++		pmi8998_typec: typec@1300 {
++			compatible = "qcom,pmi8998-typec";
++			reg = <0x1300>,
++			      <0x1700>;
++
++			interrupts = <0x2 0x13 0x7 IRQ_TYPE_EDGE_RISING>,
++				     <0x2 0x17 0x0 IRQ_TYPE_EDGE_RISING>,
++				     <0x2 0x17 0x1 IRQ_TYPE_EDGE_RISING>,
++				     <0x2 0x17 0x2 IRQ_TYPE_EDGE_RISING>,
++				     <0x2 0x17 0x3 IRQ_TYPE_EDGE_RISING>,
++				     <0x2 0x17 0x4 IRQ_TYPE_EDGE_RISING>,
++				     <0x2 0x17 0x5 IRQ_TYPE_EDGE_RISING>,
++				     <0x2 0x17 0x6 IRQ_TYPE_EDGE_RISING>,
++				     <0x2 0x17 0x7 IRQ_TYPE_EDGE_RISING>;
++			interrupt-names = "type-c-change",
++					  "sig-tx",
++					  "sig-rx",
++					  "msg-tx",
++					  "msg-rx",
++					  "msg-tx-failed",
++					  "msg-tx-discarded",
++					  "msg-rx-discarded",
++					  "fr-swap";
+ 
+ 			status = "disabled";
+ 		};
+diff --git a/drivers/usb/typec/tcpm/qcom/Makefile b/drivers/usb/typec/tcpm/qcom/Makefile
+--- a/drivers/usb/typec/tcpm/qcom/Makefile
++++ b/drivers/usb/typec/tcpm/qcom/Makefile
+@@ -3,5 +3,6 @@
+ obj-$(CONFIG_TYPEC_QCOM_PMIC)		+= qcom_pmic_tcpm.o
+ qcom_pmic_tcpm-y			+= qcom_pmic_typec.o \
+ 					   qcom_pmic_typec_port.o \
++					   qcom_pmic_typec_port_gen1.o \
+ 					   qcom_pmic_typec_pdphy.o \
+ 					   qcom_pmic_typec_pdphy_stub.o \
+diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
+--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
++++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
+@@ -17,10 +17,17 @@
+ #include "qcom_pmic_typec.h"
+ #include "qcom_pmic_typec_pdphy.h"
+ #include "qcom_pmic_typec_port.h"
++#include "qcom_pmic_typec_port_gen1.h"
++
++typedef int (*pmic_typec_port_probe_fn)(struct platform_device *pdev,
++					struct pmic_typec *tcpm,
++					const struct pmic_typec_port_resources *res,
++					struct regmap *regmap, u32 base);
+ 
+ struct pmic_typec_resources {
+ 	const struct pmic_typec_pdphy_resources	*pdphy_res;
+ 	const struct pmic_typec_port_resources	*port_res;
++	pmic_typec_port_probe_fn	port_probe;
+ };
+ 
+ static int qcom_pmic_typec_init(struct tcpc_dev *tcpc)
+@@ -60,8 +67,7 @@
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = qcom_pmic_typec_port_probe(pdev, tcpm,
+-					 res->port_res, regmap, base);
++	ret = res->port_probe(pdev, tcpm, res->port_res, regmap, base);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -134,19 +140,29 @@
+ 	fwnode_handle_put(tcpm->tcpc.fwnode);
+ }
+ 
++static const struct pmic_typec_resources gen1_typec_res = {
++	.pdphy_res = &pm8150b_pdphy_res,
++	.port_res = &gen1_port_res,
++	.port_probe = qcom_pmic_typec_gen1_port_probe,
++};
++
+ static const struct pmic_typec_resources pm8150b_typec_res = {
+ 	.pdphy_res = &pm8150b_pdphy_res,
+ 	.port_res = &pm8150b_port_res,
++	.port_probe = qcom_pmic_typec_port_probe,
+ };
+ 
+ static const struct pmic_typec_resources pmi632_typec_res = {
+ 	/* PD PHY not present */
+ 	.port_res = &pm8150b_port_res,
++	.port_probe = qcom_pmic_typec_port_probe,
+ };
+ 
+ static const struct of_device_id qcom_pmic_typec_table[] = {
++	{ .compatible = "qcom,pm660-typec", .data = &gen1_typec_res },
+ 	{ .compatible = "qcom,pm8150b-typec", .data = &pm8150b_typec_res },
+ 	{ .compatible = "qcom,pmi632-typec", .data = &pmi632_typec_res },
++	{ .compatible = "qcom,pmi8998-typec", .data = &gen1_typec_res },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, qcom_pmic_typec_table);
+diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.h b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.h
+--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.h
++++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.h
+@@ -11,7 +11,7 @@
+ 	struct tcpm_port	*tcpm_port;
+ 	struct tcpc_dev		tcpc;
+ 	struct pmic_typec_pdphy	*pmic_typec_pdphy;
+-	struct pmic_typec_port	*pmic_typec_port;
++	void			*pmic_typec_port;
+ 
+ 	int (*pdphy_start)(struct pmic_typec *tcpm,
+ 			   struct tcpm_port *tcpm_port);
+diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
+--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
++++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
+@@ -10,6 +10,7 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
++#include <linux/property.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/slab.h>
+@@ -733,6 +734,7 @@
+ 	pmic_typec_port->vdd_vbus = devm_of_regulator_get_optional(dev,
+ 								   to_of_node(connector),
+ 								   "vbus");
++	fwnode_handle_put(connector);
+ 	if (pmic_typec_port->vdd_vbus == ERR_PTR(-ENODEV))
+ 		pmic_typec_port->vdd_vbus = devm_regulator_get(dev, "vdd-vbus");
+ 	if (IS_ERR(pmic_typec_port->vdd_vbus))
+diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c
+new file mode 100644
+--- /dev/null
++++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c
+@@ -0,0 +1,605 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Qualcomm Type-C port backend (1st gen)
++ *
++ * GEN1 predates the standalone PM8150B-style Type-C register block.
++ * Its CC/role controls live in the USBIN peripheral, while the PD PHY
++ * is a separate PMIC peripheral.
++ */
++
++#include <linux/interrupt.h>
++#include <linux/kernel.h>
++#include <linux/mutex.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/property.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++#include <linux/slab.h>
++#include <linux/usb/tcpm.h>
++
++#include "qcom_pmic_typec.h"
++#include "qcom_pmic_typec_port.h"
++#include "qcom_pmic_typec_port_gen1.h"
++
++/* USBIN Type-C status */
++#define TYPEC_STATUS_1_REG				0x0b
++#define  UFP_TYPEC_MASK					GENMASK(7, 5)
++#define  UFP_TYPEC_RDSTD				BIT(7)
++#define  UFP_TYPEC_RD1P5				BIT(6)
++#define  UFP_TYPEC_RD3P0				BIT(5)
++
++#define TYPEC_STATUS_2_REG				0x0c
++#define  DFP_TYPEC_MASK					GENMASK(3, 0)
++#define  DFP_RD_OPEN					BIT(3)
++#define  DFP_RD_RA_VCONN				BIT(2)
++#define  DFP_RD_RD					BIT(1)
++#define  DFP_RA_RA					BIT(0)
++
++#define TYPEC_STATUS_4_REG				0x0e
++#define  UFP_DFP_MODE_STATUS				BIT(7)
++#define  TYPEC_VBUS_STATUS				BIT(6)
++#define  TYPEC_VBUS_ERROR				BIT(5)
++#define  TYPEC_DEBOUNCE_DONE				BIT(4)
++#define  CC_ORIENTATION					BIT(1)
++#define  CC_ATTACHED					BIT(0)
++
++/* USBIN Type-C configuration */
++#define TYPEC_CFG_REG					0x58
++#define  TYPEC_OR_U_USB					BIT(0)
++
++#define TYPEC_CFG_2_REG					0x59
++#define  EN_TRY_SOURCE_MODE				BIT(3)
++#define  EN_80UA_180UA_CUR_SOURCE			BIT(0)
++
++#define TYPEC_CFG_3_REG					0x5a
++#define  EN_TRYSINK_MODE				BIT(2)
++
++#define TYPEC_INTRPT_ENB_REG				0x67
++#define  VBUS_ERROR_INT_EN				BIT(5)
++#define  DEBOUNCE_DONE_INT_EN				BIT(3)
++#define  CCSTATE_CHANGE_INT_EN				BIT(2)
++#define  VBUS_DEASSERT_INT_EN				BIT(1)
++#define  VBUS_ASSERT_INT_EN				BIT(0)
++
++#define TYPEC_SW_CTRL_REG				0x68
++#define  VCONN_EN_ORIENTATION				BIT(6)
++#define  VCONN_EN_SRC					BIT(4)
++#define  VCONN_EN_VALUE					BIT(3)
++#define  POWER_ROLE_CMD_MASK				GENMASK(2, 0)
++#define  UFP_EN_CMD					BIT(2)
++#define  DFP_EN_CMD					BIT(1)
++#define  TYPEC_DISABLE_CMD				BIT(0)
++
++/* GEN1 TYPEC_PBS_WA_BIT workaround used by the downstream SMB2 driver. */
++#define MISC_BASE_OFFSET				0x300
++#define TM_IO_DTEST4_SEL				0xe9
++#define PBS_CRUDE_SENSOR_ENABLE				0xa5
++
++/* Interrupt numbers */
++#define PMIC_TYPEC_CHANGE_IRQ				0x0
++
++struct gen1_typec_port {
++	struct device		*dev;
++	struct tcpm_port	*tcpm_port;
++	struct regmap		*regmap;
++	u32			base;
++	int			irq;
++
++	struct regulator	*vbus;
++	bool			vbus_enabled;
++	bool			vbus_present;
++	bool			vbus_valid;
++	struct mutex		lock; /* serializes register RMW and VBUS state */
++};
++
++const struct pmic_typec_port_resources gen1_port_res = {
++	.nr_irqs = 1,
++	.irq_params = {
++		{
++			.irq_name = "type-c-change",
++			.virq = PMIC_TYPEC_CHANGE_IRQ,
++		},
++	},
++};
++
++/*
++ * Failure of this workaround write is non-fatal and
++ * we can continue with the role transition.
++ */
++static void gen1_typec_pbs_wa(struct gen1_typec_port *port, bool sink)
++{
++	unsigned int val = sink ? 0 : PBS_CRUDE_SENSOR_ENABLE;
++	int ret;
++
++	ret = regmap_write(port->regmap, port->base +
++			   MISC_BASE_OFFSET + TM_IO_DTEST4_SEL, val);
++	if (!ret)
++		return;
++
++	dev_warn(port->dev,
++		 "failed to update GEN1 Type-C PBS workaround: %d\n",
++		 ret);
++}
++
++static int gen1_typec_set_power_role(struct gen1_typec_port *port,
++				     unsigned int role)
++{
++	int ret;
++
++	gen1_typec_pbs_wa(port, role == UFP_EN_CMD);
++
++	ret = regmap_update_bits(port->regmap,
++				 port->base + TYPEC_SW_CTRL_REG,
++				 POWER_ROLE_CMD_MASK, role);
++	if (ret)
++		dev_err(port->dev, "failed to set Type-C power role: %d\n", ret);
++
++	return ret;
++}
++
++static int gen1_typec_get_vbus(struct tcpc_dev *tcpc)
++{
++	struct pmic_typec *tcpm = tcpc_to_tcpm(tcpc);
++	struct gen1_typec_port *port = tcpm->pmic_typec_port;
++	unsigned int status;
++	int ret;
++
++	mutex_lock(&port->lock);
++	ret = regmap_read(port->regmap, port->base +
++			  TYPEC_STATUS_4_REG, &status);
++	if (ret)
++		ret = port->vbus_enabled;
++	else
++		ret = port->vbus_enabled || !!(status & TYPEC_VBUS_STATUS);
++	mutex_unlock(&port->lock);
++
++	return ret;
++}
++
++static int gen1_typec_set_vbus(struct tcpc_dev *tcpc, bool on, bool sink)
++{
++	struct pmic_typec *tcpm = tcpc_to_tcpm(tcpc);
++	struct gen1_typec_port *port = tcpm->pmic_typec_port;
++	bool changed = false;
++	int ret = 0;
++
++	if (!port->vbus)
++		return 0;
++
++	mutex_lock(&port->lock);
++
++	if (port->vbus_enabled == on)
++		goto out;
++
++	if (on)
++		ret = regulator_enable(port->vbus);
++	else
++		ret = regulator_disable(port->vbus);
++
++	if (!ret) {
++		port->vbus_enabled = on;
++		changed = true;
++	}
++
++out:
++	mutex_unlock(&port->lock);
++
++	/*
++	 * set_vbus() may run during tcpm_register_port() before port_start()
++	 * provides tcpm_port. Once registered, notify TCPM whenever the
++	 * source regulator actually changes state. get_vbus() also accounts
++	 * for vbus_enabled when GEN1 does not reflect sourced VBUS in
++	 * TYPEC_VBUS_STATUS.
++	 */
++	if (changed && port->tcpm_port)
++		tcpm_vbus_change(port->tcpm_port);
++
++	return ret;
++}
++
++static int gen1_typec_get_cc(struct tcpc_dev *tcpc,
++			     enum typec_cc_status *cc1,
++			     enum typec_cc_status *cc2)
++{
++	struct pmic_typec *tcpm = tcpc_to_tcpm(tcpc);
++	struct gen1_typec_port *port = tcpm->pmic_typec_port;
++	enum typec_cc_status active = TYPEC_CC_OPEN;
++	unsigned int status1, status2, status4;
++	bool orientation_cc2;
++	int ret;
++
++	*cc1 = TYPEC_CC_OPEN;
++	*cc2 = TYPEC_CC_OPEN;
++
++	mutex_lock(&port->lock);
++
++	ret = regmap_read(port->regmap, port->base +
++			  TYPEC_STATUS_4_REG, &status4);
++	if (ret)
++		goto out;
++
++	if (!(status4 & CC_ATTACHED))
++		goto out;
++
++	/*
++	 * CC is not stable until tCCDebounce has elapsed. TCPM ignores
++	 * -EBUSY and the DEBOUNCE_DONE interrupt triggers a new read.
++	 */
++	if (!(status4 & TYPEC_DEBOUNCE_DONE)) {
++		ret = -EBUSY;
++		goto out;
++	}
++
++	ret = regmap_read(port->regmap, port->base +
++			  TYPEC_STATUS_1_REG, &status1);
++	if (ret)
++		goto out;
++
++	ret = regmap_read(port->regmap, port->base +
++			  TYPEC_STATUS_2_REG, &status2);
++	if (ret)
++		goto out;
++
++	orientation_cc2 = !!(status4 & CC_ORIENTATION);
++
++	if (status4 & UFP_DFP_MODE_STATUS) {
++		/* Local port is DFP/source; decode the partner's Rd/Ra. */
++		switch (status2 & DFP_TYPEC_MASK) {
++		case DFP_RA_RA:
++			*cc1 = TYPEC_CC_RA;
++			*cc2 = TYPEC_CC_RA;
++			goto out;
++		case DFP_RD_RD:
++			*cc1 = TYPEC_CC_RD;
++			*cc2 = TYPEC_CC_RD;
++			goto out;
++		case DFP_RD_RA_VCONN:
++			active = TYPEC_CC_RD;
++			*cc1 = TYPEC_CC_RA;
++			*cc2 = TYPEC_CC_RA;
++			break;
++		case DFP_RD_OPEN:
++			active = TYPEC_CC_RD;
++			break;
++		default:
++			dev_dbg(port->dev, "unhandled GEN1 DFP status %#x\n",
++				status2);
++			goto out;
++		}
++	} else {
++		/* Local port is UFP/sink; decode the partner's advertised Rp. */
++		switch (status1 & UFP_TYPEC_MASK) {
++		case UFP_TYPEC_RDSTD:
++			active = TYPEC_CC_RP_DEF;
++			break;
++		case UFP_TYPEC_RD1P5:
++			active = TYPEC_CC_RP_1_5;
++			break;
++		case UFP_TYPEC_RD3P0:
++			active = TYPEC_CC_RP_3_0;
++			break;
++		default:
++			dev_dbg(port->dev, "unhandled GEN1 UFP status %#x\n",
++				status1);
++			goto out;
++		}
++	}
++
++	if (orientation_cc2)
++		*cc2 = active;
++	else
++		*cc1 = active;
++
++out:
++	mutex_unlock(&port->lock);
++	return ret;
++}
++
++static int gen1_typec_set_cc(struct tcpc_dev *tcpc,
++			     enum typec_cc_status cc)
++{
++	struct pmic_typec *tcpm = tcpc_to_tcpm(tcpc);
++	struct gen1_typec_port *port = tcpm->pmic_typec_port;
++	unsigned int role;
++	unsigned int rp_current = 0;
++	int ret;
++
++	switch (cc) {
++	case TYPEC_CC_OPEN:
++		role = TYPEC_DISABLE_CMD;
++		break;
++	case TYPEC_CC_RD:
++		role = UFP_EN_CMD;
++		break;
++	case TYPEC_CC_RP_DEF:
++		role = DFP_EN_CMD;
++		rp_current = 0;
++		break;
++	case TYPEC_CC_RP_1_5:
++	case TYPEC_CC_RP_3_0:
++		/*
++		 * GEN1 can only source 80 uA (default) or 180 uA (1.5 A).
++		 * Advertise 1.5 A for 3.0 A requests, TCPM ignores set_cc()
++		 * errors and would otherwise keep a stale Rp.
++		 */
++		role = DFP_EN_CMD;
++		rp_current = EN_80UA_180UA_CUR_SOURCE;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	mutex_lock(&port->lock);
++
++	if (role == DFP_EN_CMD) {
++		ret = regmap_update_bits(port->regmap,
++					 port->base + TYPEC_CFG_2_REG,
++					 EN_80UA_180UA_CUR_SOURCE,
++					 rp_current);
++		if (ret)
++			goto out;
++	}
++
++	ret = gen1_typec_set_power_role(port, role);
++
++out:
++	mutex_unlock(&port->lock);
++	return ret;
++}
++
++static int gen1_typec_set_polarity(struct tcpc_dev *tcpc,
++				   enum typec_cc_polarity polarity)
++{
++	/* USB PHY orientation is handled outside this PMIC Type-C block. */
++	return 0;
++}
++
++static int gen1_typec_set_vconn(struct tcpc_dev *tcpc, bool on)
++{
++	struct pmic_typec *tcpm = tcpc_to_tcpm(tcpc);
++	struct gen1_typec_port *port = tcpm->pmic_typec_port;
++	unsigned int status4, orientation, mask, val;
++	int ret;
++
++	mutex_lock(&port->lock);
++
++	ret = regmap_read(port->regmap, port->base +
++			  TYPEC_STATUS_4_REG, &status4);
++	if (ret)
++		goto out;
++
++	/* VCONN is driven on the inactive CC pin. */
++	orientation = (status4 & CC_ORIENTATION) ?
++		      0 : VCONN_EN_ORIENTATION;
++
++	if (on) {
++		mask = VCONN_EN_ORIENTATION | VCONN_EN_VALUE;
++		val = orientation | VCONN_EN_VALUE;
++	} else {
++		mask = VCONN_EN_VALUE;
++		val = 0;
++	}
++
++	ret = regmap_update_bits(port->regmap,
++				 port->base + TYPEC_SW_CTRL_REG,
++				 mask, val);
++
++out:
++	mutex_unlock(&port->lock);
++	return ret;
++}
++
++static int gen1_typec_start_toggling(struct tcpc_dev *tcpc,
++				     enum typec_port_type port_type,
++				     enum typec_cc_status cc)
++{
++	struct pmic_typec *tcpm = tcpc_to_tcpm(tcpc);
++	struct gen1_typec_port *port = tcpm->pmic_typec_port;
++	unsigned int role;
++	unsigned int try_src = 0;
++	unsigned int try_snk = 0;
++	int ret;
++
++	switch (port_type) {
++	case TYPEC_PORT_SRC:
++		role = DFP_EN_CMD;
++		break;
++	case TYPEC_PORT_SNK:
++		role = UFP_EN_CMD;
++		break;
++	case TYPEC_PORT_DRP:
++		role = 0;
++		/*
++		 * Like the PM8150B backend, keep hardware Try.SNK enabled
++		 * while TCPM owns the policy state machine.
++		 */
++		try_snk = EN_TRYSINK_MODE;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	mutex_lock(&port->lock);
++
++	ret = regmap_update_bits(port->regmap,
++				 port->base + TYPEC_CFG_2_REG,
++				 EN_TRY_SOURCE_MODE, try_src);
++	if (ret)
++		goto out;
++
++	ret = regmap_update_bits(port->regmap,
++				 port->base + TYPEC_CFG_3_REG,
++				 EN_TRYSINK_MODE, try_snk);
++	if (ret)
++		goto out;
++
++	/* Disable first so the state machine restarts toggling. */
++	ret = gen1_typec_set_power_role(port, TYPEC_DISABLE_CMD);
++	if (ret)
++		goto out;
++
++	ret = gen1_typec_set_power_role(port, role);
++
++out:
++	mutex_unlock(&port->lock);
++	return ret;
++}
++
++static irqreturn_t gen1_typec_irq(int irq, void *data)
++{
++	struct gen1_typec_port *port = data;
++	unsigned int status4;
++	bool vbus;
++	bool vbus_changed = false;
++
++	/*
++	 * GEN1 exposes a single aggregate Type-C change interrupt. Always
++	 * notify TCPM of CC changes. Only generate a VBUS event when the
++	 * hardware VBUS state changes, or on the first observation so TCPM
++	 * can establish the initial vSafe0V state.
++	 */
++	mutex_lock(&port->lock);
++
++	if (!regmap_read(port->regmap, port->base +
++			 TYPEC_STATUS_4_REG, &status4)) {
++		if (status4 & TYPEC_VBUS_ERROR)
++			dev_warn_ratelimited(port->dev, "Type-C VBUS error\n");
++
++		vbus = !!(status4 & TYPEC_VBUS_STATUS);
++
++		if (!port->vbus_valid || vbus != port->vbus_present) {
++			port->vbus_present = vbus;
++			port->vbus_valid = true;
++			vbus_changed = true;
++		}
++	}
++
++	mutex_unlock(&port->lock);
++
++	if (port->tcpm_port) {
++		if (vbus_changed)
++			tcpm_vbus_change(port->tcpm_port);
++
++		tcpm_cc_change(port->tcpm_port);
++	}
++
++	return IRQ_HANDLED;
++}
++
++static int gen1_typec_port_start(struct pmic_typec *tcpm,
++				 struct tcpm_port *tcpm_port)
++{
++	struct gen1_typec_port *port = tcpm->pmic_typec_port;
++	unsigned int irq_mask;
++	int ret;
++
++	/*
++	 * TYPE_C_OR_U_USB == 0 selects the Type-C state machine on GEN1.
++	 */
++	ret = regmap_update_bits(port->regmap,
++				 port->base + TYPEC_CFG_REG,
++				 TYPEC_OR_U_USB, 0);
++	if (ret)
++		return ret;
++
++	/*
++	 * GEN1 exposes a single aggregate type-c-change interrupt, the
++	 * handler re-reads TYPEC_STATUS_4 to find out what changed.
++	 */
++	irq_mask = CCSTATE_CHANGE_INT_EN | DEBOUNCE_DONE_INT_EN |
++		   VBUS_ASSERT_INT_EN | VBUS_DEASSERT_INT_EN |
++		   VBUS_ERROR_INT_EN;
++
++	ret = regmap_write(port->regmap,
++			   port->base + TYPEC_INTRPT_ENB_REG,
++			   irq_mask);
++	if (ret)
++		return ret;
++
++	/* Select software control for VCONN, initially disabled. */
++	ret = regmap_update_bits(port->regmap,
++				 port->base + TYPEC_SW_CTRL_REG,
++				 VCONN_EN_SRC | VCONN_EN_VALUE,
++				 VCONN_EN_SRC);
++	if (ret)
++		return ret;
++
++	port->tcpm_port = tcpm_port;
++	enable_irq(port->irq);
++
++	return 0;
++}
++
++static void gen1_typec_port_stop(struct pmic_typec *tcpm)
++{
++	struct gen1_typec_port *port = tcpm->pmic_typec_port;
++
++	disable_irq(port->irq);
++	port->tcpm_port = NULL;
++}
++
++int qcom_pmic_typec_gen1_port_probe(struct platform_device *pdev,
++				    struct pmic_typec *tcpm,
++				    const struct pmic_typec_port_resources *res,
++				    struct regmap *regmap,
++				    u32 base)
++{
++	struct device *dev = &pdev->dev;
++	struct gen1_typec_port *port;
++	struct fwnode_handle *connector;
++	int ret;
++
++	if (!res->nr_irqs || res->nr_irqs > PMIC_TYPEC_MAX_IRQS)
++		return -EINVAL;
++
++	port = devm_kzalloc(dev, sizeof(*port), GFP_KERNEL);
++	if (!port)
++		return -ENOMEM;
++
++	connector = device_get_named_child_node(dev, "connector");
++	if (!connector)
++		return -EINVAL;
++
++	port->vbus = devm_of_regulator_get_optional(dev,
++						    to_of_node(connector),
++						    "vbus");
++	fwnode_handle_put(connector);
++	if (IS_ERR(port->vbus)) {
++		if (PTR_ERR(port->vbus) != -ENODEV)
++			return PTR_ERR(port->vbus);
++		port->vbus = NULL;
++	}
++
++	port->irq = platform_get_irq_byname(pdev,
++					    res->irq_params[0].irq_name);
++	if (port->irq < 0)
++		return port->irq;
++
++	port->dev = dev;
++	port->regmap = regmap;
++	port->base = base;
++	mutex_init(&port->lock);
++
++	ret = devm_request_threaded_irq(dev, port->irq, NULL,
++					gen1_typec_irq,
++					IRQF_ONESHOT | IRQF_NO_AUTOEN,
++					res->irq_params[0].irq_name, port);
++	if (ret)
++		return ret;
++
++	tcpm->pmic_typec_port = port;
++
++	tcpm->tcpc.get_vbus = gen1_typec_get_vbus;
++	tcpm->tcpc.set_vbus = gen1_typec_set_vbus;
++	tcpm->tcpc.get_cc = gen1_typec_get_cc;
++	tcpm->tcpc.set_cc = gen1_typec_set_cc;
++	tcpm->tcpc.set_polarity = gen1_typec_set_polarity;
++	tcpm->tcpc.set_vconn = gen1_typec_set_vconn;
++	tcpm->tcpc.start_toggling = gen1_typec_start_toggling;
++
++	tcpm->port_start = gen1_typec_port_start;
++	tcpm->port_stop = gen1_typec_port_stop;
++
++	return 0;
++}
+diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.h b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.h
+new file mode 100644
+--- /dev/null
++++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.h
+@@ -0,0 +1,15 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++#ifndef __QCOM_PMIC_TYPEC_PORT_GEN1_H__
++#define __QCOM_PMIC_TYPEC_PORT_GEN1_H__
++
++#include "qcom_pmic_typec_port.h"
++
++extern const struct pmic_typec_port_resources gen1_port_res;
++
++int qcom_pmic_typec_gen1_port_probe(struct platform_device *pdev,
++				    struct pmic_typec *tcpm,
++				    const struct pmic_typec_port_resources *res,
++				    struct regmap *regmap,
++				    u32 base);
++
++#endif /* __QCOM_PMIC_TYPEC_PORT_GEN1_H__ */
diff --git a/kernel/patches/0028-usb-pmi8998-vbus-and-fault-recovery.patch b/kernel/patches/0028-usb-pmi8998-vbus-and-fault-recovery.patch
new file mode 100644
index 0000000..5216dff
--- /dev/null
+++ b/kernel/patches/0028-usb-pmi8998-vbus-and-fault-recovery.patch
@@ -0,0 +1,743 @@
+Subject: [PATCH] usb: support mici PMI8998 VBUS and fault recovery
+
+Add a distinct PMI8998 regulator with the stock 250 mA current encoding,
+protected HALT1_IN8 sequence and bounded boost readiness polling. Forward
+OTG/VCONN faults through standard regulator and TCPM APIs.
+
+Keep USBIN restore state across failed transitions. Dedicated-rail cleanup
+runs the complete provider disable even when CMD_OTG is already off, never
+re-enables a failed output, and quiesces callbacks/TCPM before shutdown.
+The charger must remain disabled and the connector the sole VBUS consumer.
+
+Register definitions and the source/input sequence follow the existing
+commaai/agnos-kernel-sdm845 SMB2 driver. See kernel/USB.md for provenance,
+fault tests and the remaining physical acceptance checks.
+
+diff --git a/Documentation/devicetree/bindings/regulator/qcom,usb-vbus-regulator.yaml b/Documentation/devicetree/bindings/regulator/qcom,usb-vbus-regulator.yaml
+--- a/Documentation/devicetree/bindings/regulator/qcom,usb-vbus-regulator.yaml
++++ b/Documentation/devicetree/bindings/regulator/qcom,usb-vbus-regulator.yaml
+@@ -17,6 +17,9 @@
+   The pm8150b variant uses an OTG current-limit selector, supporting limits
+   of 500 mA, 1000 mA, 1500 mA, 2000 mA, 2500 mA and 3000 mA.
+ 
++  The pmi8998 variant has a different OTG current-limit encoding, supporting
++  250 mA through 2000 mA in 250 mA steps.
++
+   The pm4125 variant uses a different register layout with a 2-bit VBOOST
+   voltage selector supporting output voltages of 4.25 V, 4.5 V, 4.75 V
+   and 5.0 V.
+@@ -25,6 +28,7 @@
+   compatible:
+     oneOf:
+       - enum:
++          - qcom,pmi8998-vbus-reg
+           - qcom,pm8150b-vbus-reg
+           - qcom,pm4125-vbus-reg
+       - items:
+@@ -38,13 +42,35 @@
+     maxItems: 1
+     description: VBUS output base address
+ 
++  interrupts:
++    maxItems: 2
++
++  interrupt-names:
++    items:
++      - const: otg-fail
++      - const: otg-overcurrent
++
+ allOf:
+   - $ref: regulator.yaml#
+   - if:
+       properties:
+         compatible:
+           contains:
++            const: qcom,pmi8998-vbus-reg
++    then:
++      required:
++        - interrupts
++        - interrupt-names
++    else:
++      properties:
++        interrupts: false
++        interrupt-names: false
++  - if:
++      properties:
++        compatible:
++          contains:
+             enum:
++              - qcom,pmi8998-vbus-reg
+               - qcom,pm8150b-vbus-reg
+               - qcom,pm6150-vbus-reg
+               - qcom,pm7250b-vbus-reg
+diff --git a/drivers/regulator/qcom_usb_vbus-regulator.c b/drivers/regulator/qcom_usb_vbus-regulator.c
+--- a/drivers/regulator/qcom_usb_vbus-regulator.c
++++ b/drivers/regulator/qcom_usb_vbus-regulator.c
+@@ -12,6 +12,8 @@
+ #include <linux/regulator/driver.h>
+ #include <linux/regulator/of_regulator.h>
+ #include <linux/regmap.h>
++#include <linux/iopoll.h>
++#include <linux/interrupt.h>
+ 
+ #define CMD_OTG				0x40
+ #define OTG_EN				BIT(0)
+@@ -19,6 +21,17 @@
+ #define OTG_CURRENT_LIMIT_MASK		GENMASK(2, 0)
+ #define OTG_CFG				0x53
+ #define OTG_EN_SRC_CFG			BIT(1)
++#define OTG_ENG_CFG			0xc0
++#define OTG_HALT_1_IN_8			BIT(0)
++#define SEC_ACCESS			0xd0
++#define SEC_UNLOCK			0xa5
++#define OTG_STATUS			0x09
++#define OTG_SOFTSTART_DONE		BIT(3)
++#define OTG_STATE_MASK			GENMASK(2, 0)
++#define OTG_STATE_ENABLED		2
++#define OTG_INT_RT_STS			0x10
++#define OTG_OVERCURRENT			BIT(1)
++#define OTG_FAIL				BIT(0)
+ 
+ #define PM4125_VBOOST_EN		0x50
+ #define PM4125_VBOOST_SEL		0x52
+@@ -45,6 +58,10 @@
+ 	500000, 1000000, 1500000, 2000000, 2500000, 3000000,
+ };
+ 
++static const unsigned int pmi8998_curr_table[] = {
++	250000, 500000, 750000, 1000000, 1250000, 1500000, 1750000, 2000000,
++};
++
+ static const unsigned int pm4125_vboost_table[] = {
+ 	4250000, 4500000, 4750000, 5000000,
+ };
+@@ -68,6 +85,124 @@
+ 	.ops = &qcom_usb_vbus_reg_ops,
+ };
+ 
++static int pmi8998_halt_1_in_8(struct regulator_dev *rdev, bool halt)
++{
++	unsigned int base = rdev->desc->enable_reg - CMD_OTG;
++	int ret;
++
++	/* The engineering register is protected by the peripheral SEC_ACCESS. */
++	ret = regmap_write(rdev->regmap, base + SEC_ACCESS, SEC_UNLOCK);
++	if (ret)
++		return ret;
++	return regmap_update_bits(rdev->regmap, base + OTG_ENG_CFG,
++				 OTG_HALT_1_IN_8, halt ? OTG_HALT_1_IN_8 : 0);
++}
++
++static int pmi8998_vbus_enable(struct regulator_dev *rdev)
++{
++	unsigned int base = rdev->desc->enable_reg - CMD_OTG;
++	unsigned int status;
++	int ret;
++	int rollback;
++
++	/* SMB2 must leave the low-power buck/boost mode before sourcing VBUS. */
++	ret = pmi8998_halt_1_in_8(rdev, true);
++	if (ret)
++		return ret;
++
++	ret = regulator_enable_regmap(rdev);
++	if (!ret)
++		ret = regmap_read_poll_timeout(rdev->regmap, base + OTG_STATUS,
++					      status,
++					      (status & OTG_SOFTSTART_DONE) &&
++					      (status & OTG_STATE_MASK) == OTG_STATE_ENABLED,
++					      1000, 250000);
++	if (!ret)
++		return 0;
++
++	/* Never report a command write as a completed, usable VBUS transition. */
++	rollback = regulator_disable_regmap(rdev);
++	if (!rollback)
++		rollback = pmi8998_halt_1_in_8(rdev, false);
++	if (rollback)
++		dev_err(&rdev->dev, "failed to roll back VBUS enable: %d\n", rollback);
++	return ret;
++}
++
++static int pmi8998_vbus_disable(struct regulator_dev *rdev)
++{
++	int ret;
++
++	ret = regulator_disable_regmap(rdev);
++	if (ret)
++		return ret;
++
++	return pmi8998_halt_1_in_8(rdev, false);
++}
++
++static int pmi8998_vbus_get_error_flags(struct regulator_dev *rdev,
++				      unsigned int *flags)
++{
++	unsigned int base = rdev->desc->enable_reg - CMD_OTG;
++	unsigned int command, status, fault;
++	int ret;
++
++	*flags = 0;
++	ret = regmap_read(rdev->regmap, base + CMD_OTG, &command);
++	if (ret)
++		return ret;
++	if (!(command & OTG_EN))
++		return 0;
++	ret = regmap_read(rdev->regmap, base + OTG_STATUS, &status);
++	if (ret)
++		return ret;
++	ret = regmap_read(rdev->regmap, base + OTG_INT_RT_STS, &fault);
++	if (ret)
++		return ret;
++	if (fault & OTG_OVERCURRENT)
++		*flags |= REGULATOR_ERROR_OVER_CURRENT;
++	if ((fault & OTG_FAIL) || !(status & OTG_SOFTSTART_DONE) ||
++	    (status & OTG_STATE_MASK) != OTG_STATE_ENABLED)
++		*flags |= REGULATOR_ERROR_FAIL;
++	return 0;
++}
++
++static const struct regulator_ops pmi8998_vbus_reg_ops = {
++	.enable = pmi8998_vbus_enable,
++	.disable = pmi8998_vbus_disable,
++	.is_enabled = regulator_is_enabled_regmap,
++	.get_current_limit = regulator_get_current_limit_regmap,
++	.set_current_limit = regulator_set_current_limit_regmap,
++	.get_error_flags = pmi8998_vbus_get_error_flags,
++};
++
++static const struct qcom_usb_vbus_reg_data pmi8998_data = {
++	.cmd_otg = CMD_OTG,
++	.otg_cfg = OTG_CFG,
++	.otg_en_src_cfg = OTG_EN_SRC_CFG,
++	.csel_reg = OTG_CURRENT_LIMIT_CFG,
++	.csel_mask = OTG_CURRENT_LIMIT_MASK,
++	.curr_table = pmi8998_curr_table,
++	.n_current_limits = ARRAY_SIZE(pmi8998_curr_table),
++	.ops = &pmi8998_vbus_reg_ops,
++};
++
++static irqreturn_t pmi8998_vbus_fail_irq(int irq, void *data)
++{
++	struct regulator_dev *rdev = data;
++
++	regulator_notifier_call_chain(rdev, REGULATOR_EVENT_FAIL, NULL);
++	return IRQ_HANDLED;
++}
++
++static irqreturn_t pmi8998_vbus_oc_irq(int irq, void *data)
++{
++	struct regulator_dev *rdev = data;
++
++	regulator_notifier_call_chain(rdev, REGULATOR_EVENT_OVER_CURRENT, NULL);
++	return IRQ_HANDLED;
++}
++
+ static const struct regulator_ops qcom_usb_vbus_pm4125_reg_ops = {
+ 	.enable = regulator_enable_regmap,
+ 	.disable = regulator_disable_regmap,
+@@ -97,7 +232,7 @@
+ 	struct regmap *regmap;
+ 	struct regulator_config config = { };
+ 	struct regulator_init_data *init_data;
+-	int ret;
++	int ret, irq;
+ 	u32 base;
+ 
+ 	ret = of_property_read_u32(dev->of_node, "reg", &base);
+@@ -150,20 +285,40 @@
+ 	config.of_node = dev->of_node;
+ 	config.regmap = regmap;
+ 
++	/* Establish software control before consumers can enable the output. */
++	ret = regmap_update_bits(regmap, base + data->otg_cfg,
++				 data->otg_en_src_cfg, 0);
++	if (ret)
++		return dev_err_probe(dev, ret, "failed to select software VBUS control\n");
++
+ 	rdev = devm_regulator_register(dev, rdesc, &config);
+ 	if (IS_ERR(rdev)) {
+ 		ret = PTR_ERR(rdev);
+ 		dev_err(dev, "not able to register vbus reg %d\n", ret);
+ 		return ret;
+ 	}
+-
+-	/* Disable HW logic for VBUS enable */
+-	regmap_update_bits(regmap, base + data->otg_cfg, data->otg_en_src_cfg, 0);
++	if (data == &pmi8998_data) {
++		irq = platform_get_irq_byname(pdev, "otg-fail");
++		if (irq < 0)
++			return irq;
++		ret = devm_request_threaded_irq(dev, irq, NULL, pmi8998_vbus_fail_irq,
++						IRQF_ONESHOT, "otg-fail", rdev);
++		if (ret)
++			return ret;
++		irq = platform_get_irq_byname(pdev, "otg-overcurrent");
++		if (irq < 0)
++			return irq;
++		ret = devm_request_threaded_irq(dev, irq, NULL, pmi8998_vbus_oc_irq,
++						IRQF_ONESHOT, "otg-overcurrent", rdev);
++		if (ret)
++			return ret;
++	}
+ 
+ 	return 0;
+ }
+ 
+ static const struct of_device_id qcom_usb_vbus_regulator_match[] = {
++	{ .compatible = "qcom,pmi8998-vbus-reg", .data = &pmi8998_data },
+ 	{ .compatible = "qcom,pm8150b-vbus-reg", .data = &pm8150b_data },
+ 	{ .compatible = "qcom,pm4125-vbus-reg",  .data = &pm4125_data },
+ 	{ }
+diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
+--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
++++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
+@@ -28,6 +28,7 @@
+ 	const struct pmic_typec_pdphy_resources	*pdphy_res;
+ 	const struct pmic_typec_port_resources	*port_res;
+ 	pmic_typec_port_probe_fn	port_probe;
++	void (*port_shutdown)(struct pmic_typec *tcpm);
+ };
+ 
+ static int qcom_pmic_typec_init(struct tcpc_dev *tcpc)
+@@ -133,17 +134,32 @@
+ static void qcom_pmic_typec_remove(struct platform_device *pdev)
+ {
+ 	struct pmic_typec *tcpm = platform_get_drvdata(pdev);
++	const struct pmic_typec_resources *res = of_device_get_match_data(&pdev->dev);
+ 
+ 	tcpm->pdphy_stop(tcpm);
+ 	tcpm->port_stop(tcpm);
+ 	tcpm_unregister_port(tcpm->tcpm_port);
++	if (res->port_shutdown)
++		res->port_shutdown(tcpm);
+ 	fwnode_handle_put(tcpm->tcpc.fwnode);
++}
++
++static void qcom_pmic_typec_shutdown(struct platform_device *pdev)
++{
++	const struct pmic_typec_resources *res = of_device_get_match_data(&pdev->dev);
++
++	if (!res->port_shutdown)
++		return;
++
++	/* Stop IRQ/work callbacks and TCPM before forcing the final safe state. */
++	qcom_pmic_typec_remove(pdev);
+ }
+ 
+ static const struct pmic_typec_resources gen1_typec_res = {
+ 	.pdphy_res = &pm8150b_pdphy_res,
+ 	.port_res = &gen1_port_res,
+ 	.port_probe = qcom_pmic_typec_gen1_port_probe,
++	.port_shutdown = qcom_pmic_typec_gen1_port_shutdown,
+ };
+ 
+ static const struct pmic_typec_resources pm8150b_typec_res = {
+@@ -174,6 +190,7 @@
+ 	},
+ 	.probe = qcom_pmic_typec_probe,
+ 	.remove = qcom_pmic_typec_remove,
++	.shutdown = qcom_pmic_typec_shutdown,
+ };
+ 
+ module_platform_driver(qcom_pmic_typec_driver);
+diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c
+--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c
++++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c
+@@ -10,6 +10,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/kernel.h>
+ #include <linux/mutex.h>
++#include <linux/notifier.h>
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/property.h>
+@@ -43,6 +44,7 @@
+ #define  TYPEC_DEBOUNCE_DONE				BIT(4)
+ #define  CC_ORIENTATION					BIT(1)
+ #define  CC_ATTACHED					BIT(0)
++#define  TYPEC_VCONN_OVERCURRENT				BIT(2)
+ 
+ /* USBIN Type-C configuration */
+ #define TYPEC_CFG_REG					0x58
+@@ -64,6 +66,7 @@
+ 
+ #define TYPEC_SW_CTRL_REG				0x68
+ #define  VCONN_EN_ORIENTATION				BIT(6)
++#define  VCONN_OVERCURRENT_INT_EN				BIT(5)
+ #define  VCONN_EN_SRC					BIT(4)
+ #define  VCONN_EN_VALUE					BIT(3)
+ #define  POWER_ROLE_CMD_MASK				GENMASK(2, 0)
+@@ -71,10 +74,15 @@
+ #define  DFP_EN_CMD					BIT(1)
+ #define  TYPEC_DISABLE_CMD				BIT(0)
+ 
++#define USBIN_CMD_IL_REG					0x40
++#define  USBIN_SUSPEND					BIT(0)
++
+ /* GEN1 TYPEC_PBS_WA_BIT workaround used by the downstream SMB2 driver. */
+ #define MISC_BASE_OFFSET				0x300
+ #define TM_IO_DTEST4_SEL				0xe9
+ #define PBS_CRUDE_SENSOR_ENABLE				0xa5
++#define SEC_ACCESS					0xd0
++#define SEC_UNLOCK					0xa5
+ 
+ /* Interrupt numbers */
+ #define PMIC_TYPEC_CHANGE_IRQ				0x0
+@@ -88,6 +96,11 @@
+ 
+ 	struct regulator	*vbus;
+ 	bool			vbus_enabled;
++	bool			vbus_uncertain;
++	bool			vbus_fault;
++	struct notifier_block	vbus_notifier;
++	unsigned int		usbin_restore;
++	bool			usbin_saved;
+ 	bool			vbus_present;
+ 	bool			vbus_valid;
+ 	struct mutex		lock; /* serializes register RMW and VBUS state */
+@@ -113,7 +126,10 @@
+ 	int ret;
+ 
+ 	ret = regmap_write(port->regmap, port->base +
+-			   MISC_BASE_OFFSET + TM_IO_DTEST4_SEL, val);
++			   MISC_BASE_OFFSET + SEC_ACCESS, SEC_UNLOCK);
++	if (!ret)
++		ret = regmap_write(port->regmap, port->base +
++				   MISC_BASE_OFFSET + TM_IO_DTEST4_SEL, val);
+ 	if (!ret)
+ 		return;
+ 
+@@ -142,45 +158,144 @@
+ {
+ 	struct pmic_typec *tcpm = tcpc_to_tcpm(tcpc);
+ 	struct gen1_typec_port *port = tcpm->pmic_typec_port;
+-	unsigned int status;
++	unsigned int status, errors = 0;
+ 	int ret;
+ 
+ 	mutex_lock(&port->lock);
+ 	ret = regmap_read(port->regmap, port->base +
+ 			  TYPEC_STATUS_4_REG, &status);
+-	if (ret)
+-		ret = port->vbus_enabled;
++	if (port->vbus_enabled) {
++		/* An owned source reference alone does not prove usable VBUS. */
++		ret = regulator_is_enabled(port->vbus);
++		if (ret > 0 && !port->vbus_fault) {
++			ret = regulator_get_error_flags(port->vbus, &errors);
++			ret = ret == -EOPNOTSUPP || ret == -EINVAL ? 1 : !ret && !errors;
++		} else {
++			ret = 0;
++		}
++	} else {
++		ret = !ret && !port->vbus_uncertain && !!(status & TYPEC_VBUS_STATUS);
++	}
++	mutex_unlock(&port->lock);
++
++	return ret;
++}
++
++static int gen1_typec_restore_usbin(struct gen1_typec_port *port)
++{
++	int ret;
++
++	if (!port->usbin_saved)
++		return 0;
++
++	ret = regmap_update_bits(port->regmap,
++				 port->base + USBIN_CMD_IL_REG,
++				 USBIN_SUSPEND, port->usbin_restore);
++	if (!ret)
++		port->usbin_saved = false;
+ 	else
+-		ret = port->vbus_enabled || !!(status & TYPEC_VBUS_STATUS);
+-	mutex_unlock(&port->lock);
++		dev_err(port->dev, "failed to restore USBIN input state: %d\n", ret);
+ 
+ 	return ret;
+ }
+ 
++static int gen1_typec_stop_vbus(struct gen1_typec_port *port)
++{
++	int ret;
++
++	/*
++	 * This dedicated VBUS rail has one consumer. A failed provider enable
++	 * can leave CMD_OTG or its engineering state set without a reference.
++	 * Force the provider's complete disable sequence, even if CMD is off;
++	 * never acquire a reference by enabling a possibly failed source.
++	 */
++	if (!port->vbus_enabled && port->vbus_uncertain) {
++		ret = regulator_force_disable(port->vbus);
++		if (ret)
++			return ret;
++	}
++	if (port->vbus_enabled) {
++		port->vbus_uncertain = true;
++		ret = regulator_disable(port->vbus);
++		if (ret)
++			return ret;
++		port->vbus_enabled = false;
++	}
++	if (port->vbus_uncertain) {
++		ret = regulator_is_enabled(port->vbus);
++		if (ret < 0)
++			return ret;
++		if (ret)
++			return -EBUSY;
++		port->vbus_uncertain = false;
++	}
++	return gen1_typec_restore_usbin(port);
++}
++
+ static int gen1_typec_set_vbus(struct tcpc_dev *tcpc, bool on, bool sink)
+ {
+ 	struct pmic_typec *tcpm = tcpc_to_tcpm(tcpc);
+ 	struct gen1_typec_port *port = tcpm->pmic_typec_port;
+-	bool changed = false;
+-	int ret = 0;
++	bool changed = false, was_enabled;
++	unsigned int usbin;
++	int ret = 0, rollback;
+ 
+ 	if (!port->vbus)
+ 		return 0;
+ 
+ 	mutex_lock(&port->lock);
+ 
+-	if (port->vbus_enabled == on)
+-		goto out;
+-
+-	if (on)
++	if (on && port->vbus_uncertain) {
++		ret = gen1_typec_stop_vbus(port);
++		if (ret)
++			goto out;
++	}
++
++	if (port->vbus_enabled == on) {
++		if (!on && (port->usbin_saved || port->vbus_uncertain))
++			goto source_off;
++		goto out;
++	}
++
++	if (on) {
++		/*
++		 * Avoid drawing the boost output back through USBIN. The SMB2
++		 * charger must remain disabled until the two drivers share
++		 * ownership of USBIN input-current control.
++		 */
++		/* A failed rollback must not replace the original input state. */
++		if (!port->usbin_saved) {
++			ret = regmap_read(port->regmap,
++					  port->base + USBIN_CMD_IL_REG, &usbin);
++			if (ret)
++				goto out;
++		}
++		ret = regmap_update_bits(port->regmap,
++					 port->base + USBIN_CMD_IL_REG,
++					 USBIN_SUSPEND, USBIN_SUSPEND);
++		if (ret)
++			goto out;
++		if (!port->usbin_saved) {
++			port->usbin_restore = usbin & USBIN_SUSPEND;
++			port->usbin_saved = true;
++		}
+ 		ret = regulator_enable(port->vbus);
+-	else
+-		ret = regulator_disable(port->vbus);
+-
+-	if (!ret) {
+-		port->vbus_enabled = on;
++		if (ret) {
++			port->vbus_uncertain = true;
++			rollback = gen1_typec_stop_vbus(port);
++			if (rollback)
++				dev_err(port->dev, "incomplete VBUS enable unwind: %d\n", rollback);
++			goto out;
++		}
++		port->vbus_fault = false;
++		port->vbus_enabled = true;
+ 		changed = true;
+-	}
++		goto out;
++	}
++source_off:
++	was_enabled = port->vbus_enabled;
++	ret = gen1_typec_stop_vbus(port);
++	changed = was_enabled && !port->vbus_enabled;
+ 
+ out:
+ 	mutex_unlock(&port->lock);
+@@ -196,6 +311,59 @@
+ 		tcpm_vbus_change(port->tcpm_port);
+ 
+ 	return ret;
++}
++
++static int gen1_typec_vbus_event(struct notifier_block *nb,
++				unsigned long event, void *data)
++{
++	struct gen1_typec_port *port = container_of(nb, struct gen1_typec_port,
++						 vbus_notifier);
++
++	if (!(event & (REGULATOR_EVENT_FAIL | REGULATOR_EVENT_OVER_CURRENT)))
++		return NOTIFY_DONE;
++
++	mutex_lock(&port->lock);
++	port->vbus_fault = true;
++	if (port->tcpm_port)
++		tcpm_port_error_recovery(port->tcpm_port);
++	mutex_unlock(&port->lock);
++	return NOTIFY_OK;
++}
++
++static void gen1_typec_vbus_cleanup(void *data)
++{
++	struct pmic_typec *tcpm = data;
++	struct gen1_typec_port *port = tcpm->pmic_typec_port;
++	int ret;
++
++	/* TCPM teardown already requests source-off; retry an incomplete unwind. */
++	ret = gen1_typec_set_vbus(&tcpm->tcpc, false, false);
++	if (ret)
++		dev_err(port->dev, "failed to clean up VBUS/USBIN state: %d\n", ret);
++}
++
++static int gen1_typec_init_vbus(struct pmic_typec *tcpm)
++{
++	struct gen1_typec_port *port = tcpm->pmic_typec_port;
++	int ret, cleanup;
++
++	if (!port->vbus)
++		return 0;
++
++	ret = regulator_is_enabled(port->vbus);
++	/*
++	 * Establish source-off before TCPM may select a sink role. This is a
++	 * dedicated output; force-disable also cleans an inherited HALT state
++	 * when CMD_OTG is already off. There is no pre-boot input snapshot;
++	 * release source-only USBIN suspension only for a known inherited source.
++	 */
++	if (ret > 0) {
++		port->usbin_restore = 0;
++		port->usbin_saved = true;
++	}
++	port->vbus_uncertain = true;
++	cleanup = gen1_typec_set_vbus(&tcpm->tcpc, false, false);
++	return ret < 0 ? ret : cleanup;
+ }
+ 
+ static int gen1_typec_get_cc(struct tcpc_dev *tcpc,
+@@ -364,20 +532,19 @@
+ 
+ 	mutex_lock(&port->lock);
+ 
+-	ret = regmap_read(port->regmap, port->base +
+-			  TYPEC_STATUS_4_REG, &status4);
+-	if (ret)
+-		goto out;
+-
+-	/* VCONN is driven on the inactive CC pin. */
+-	orientation = (status4 & CC_ORIENTATION) ?
+-		      0 : VCONN_EN_ORIENTATION;
+-
+ 	if (on) {
+-		mask = VCONN_EN_ORIENTATION | VCONN_EN_VALUE;
+-		val = orientation | VCONN_EN_VALUE;
++		ret = regmap_read(port->regmap, port->base +
++				  TYPEC_STATUS_4_REG, &status4);
++		if (ret)
++			goto out;
++
++		/* VCONN is driven on the inactive CC pin. */
++		orientation = (status4 & CC_ORIENTATION) ?
++			      0 : VCONN_EN_ORIENTATION;
++		mask = VCONN_EN_ORIENTATION | VCONN_EN_VALUE | VCONN_OVERCURRENT_INT_EN;
++		val = orientation | VCONN_EN_VALUE | VCONN_OVERCURRENT_INT_EN;
+ 	} else {
+-		mask = VCONN_EN_VALUE;
++		mask = VCONN_EN_VALUE | VCONN_OVERCURRENT_INT_EN;
+ 		val = 0;
+ 	}
+ 
+@@ -465,6 +632,9 @@
+ 			 TYPEC_STATUS_4_REG, &status4)) {
+ 		if (status4 & TYPEC_VBUS_ERROR)
+ 			dev_warn_ratelimited(port->dev, "Type-C VBUS error\n");
++		if ((status4 & (TYPEC_VBUS_ERROR | TYPEC_VCONN_OVERCURRENT)) &&
++		    port->tcpm_port)
++			tcpm_port_error_recovery(port->tcpm_port);
+ 
+ 		vbus = !!(status4 & TYPEC_VBUS_STATUS);
+ 
+@@ -525,7 +695,11 @@
+ 	if (ret)
+ 		return ret;
+ 
++	mutex_lock(&port->lock);
+ 	port->tcpm_port = tcpm_port;
++	if (port->vbus_fault)
++		tcpm_port_error_recovery(tcpm_port);
++	mutex_unlock(&port->lock);
+ 	enable_irq(port->irq);
+ 
+ 	return 0;
+@@ -536,7 +710,27 @@
+ 	struct gen1_typec_port *port = tcpm->pmic_typec_port;
+ 
+ 	disable_irq(port->irq);
++	mutex_lock(&port->lock);
+ 	port->tcpm_port = NULL;
++	mutex_unlock(&port->lock);
++}
++
++void qcom_pmic_typec_gen1_port_shutdown(struct pmic_typec *tcpm)
++{
++	struct gen1_typec_port *port = tcpm->pmic_typec_port;
++	int ret;
++
++	/* IRQ callbacks and the TCPM worker have already stopped. */
++	gen1_typec_vbus_cleanup(tcpm);
++	ret = gen1_typec_set_vconn(&tcpm->tcpc, false);
++	if (ret)
++		dev_err(port->dev, "failed to turn VCONN off at shutdown: %d\n", ret);
++
++	mutex_lock(&port->lock);
++	ret = gen1_typec_set_power_role(port, UFP_EN_CMD);
++	mutex_unlock(&port->lock);
++	if (ret)
++		dev_err(port->dev, "failed to select sink role at shutdown: %d\n", ret);
+ }
+ 
+ int qcom_pmic_typec_gen1_port_probe(struct platform_device *pdev,
+@@ -601,5 +795,16 @@
+ 	tcpm->port_start = gen1_typec_port_start;
+ 	tcpm->port_stop = gen1_typec_port_stop;
+ 
+-	return 0;
+-}
++	ret = devm_add_action_or_reset(dev, gen1_typec_vbus_cleanup, tcpm);
++	if (ret)
++		return ret;
++
++	if (port->vbus) {
++		port->vbus_notifier.notifier_call = gen1_typec_vbus_event;
++		ret = devm_regulator_register_notifier(port->vbus, &port->vbus_notifier);
++		if (ret)
++			return ret;
++	}
++
++	return gen1_typec_init_vbus(tcpm);
++}
+diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.h b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.h
+--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.h
++++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.h
+@@ -12,4 +12,6 @@
+ 				    struct regmap *regmap,
+ 				    u32 base);
+ 
++void qcom_pmic_typec_gen1_port_shutdown(struct pmic_typec *tcpm);
++
+ #endif /* __QCOM_PMIC_TYPEC_PORT_GEN1_H__ */
diff --git a/kernel/patches/0029-qrtr-keep-announcing-services-after-send-errors.patch b/kernel/patches/0029-qrtr-keep-announcing-services-after-send-errors.patch
new file mode 100644
index 0000000..9b680ee
--- /dev/null
+++ b/kernel/patches/0029-qrtr-keep-announcing-services-after-send-errors.patch
@@ -0,0 +1,54 @@
+From: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
+Date: Mon, 19 Oct 2026 13:12:01 +0200
+Subject: [PATCH 1/2] net: qrtr: ns: keep going when an announcement cannot be sent
+Link: https://lore.kernel.org/all/20261019-upstream-qrtr-hello-gate-fix_b4-v1-1-bd420aec171b@oss.qualcomm.com/
+
+announce_servers() answers a HELLO by announcing every local server to
+the new node, and stops at the first send error: the node then never
+learns about the servers after that one. ctrl_cmd_new_server() returns
+before lookup_notify() when the broadcast of a new local server fails,
+so lookups already registered for that service, including the ones of
+remote nodes, are never told the server exists.
+
+A send failure to one node says nothing about the others. Log it and
+carry on in both places.
+
+Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace")
+Assisted-by: Claude:claude-opus-5-5
+Signed-off-by: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
+---
+ net/qrtr/ns.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c
+index bcb090ee79d4..dfc2cdad688f 100644
+--- a/net/qrtr/ns.c
++++ b/net/qrtr/ns.c
+@@ -232,7 +232,7 @@ static int announce_servers(struct sockaddr_qrtr *sq)
+ 				continue;
+ 
+ 			pr_err("failed to announce new service\n");
+-			return ret;
++			/* the remote needs the other servers no less */
+ 		}
+ 	}
+ 	return 0;
+@@ -488,10 +488,12 @@ static int ctrl_cmd_new_server(struct sockaddr_qrtr *from,
+ 
+ 	if (srv->node == qrtr_ns.local_node) {
+ 		ret = service_announce_new(&qrtr_ns.bcast_sq, srv);
+-		if (ret < 0) {
++		/*
++		 * A failed broadcast must not hide the server from the
++		 * lookups already registered for it.
++		 */
++		if (ret < 0)
+ 			pr_err("failed to announce new service\n");
+-			return ret;
+-		}
+ 	}
+ 
+ 	/* Notify any potential lookups about the new server */
+
+-- 
+2.53.0
diff --git a/kernel/patches/0030-qrtr-hold-control-packets-until-hello-is-sent.patch b/kernel/patches/0030-qrtr-hold-control-packets-until-hello-is-sent.patch
new file mode 100644
index 0000000..d8ba134
--- /dev/null
+++ b/kernel/patches/0030-qrtr-hold-control-packets-until-hello-is-sent.patch
@@ -0,0 +1,157 @@
+From: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
+Date: Mon, 19 Oct 2026 13:12:02 +0200
+Subject: [PATCH 2/2] net: qrtr: hold control packets behind the HELLO gate instead of dropping them
+Link: https://lore.kernel.org/all/20261019-upstream-qrtr-hello-gate-fix_b4-v1-2-bd420aec171b@oss.qualcomm.com/
+
+Since commit 544d85de4dc2 ("net: qrtr: Send HELLO message on endpoint
+register") qrtr_node_enqueue() refuses every non-HELLO packet to a node
+with -EAGAIN until the HELLO to that node has been sent, and a HELLO
+that cannot be sent yet is retried 100 ms later. The name server does
+not retry, so whatever it sends in that window is lost: the replies to
+the remote's HELLO (announce_servers()) and the NEW_SERVER broadcasts of
+local servers registering at the same time.
+
+A freshly booted remoteproc hits this every time: its glink channel has
+no rx intent yet, so our HELLO fails once. On the QCM2290 (Arduino UNO Q)
+rmtfs and tqftpserv register in the same instant as the modem starts;
+when the RMTFS announcement falls into the window the modem waits for a
+service that exists until its watchdog fires 40 s later ("DOG detects
+stalled initialization"), about one boot in five, and WiFi (whose
+firmware runs on the modem) comes up a minute late.
+
+Keep refusing data packets (they would count against the flow control
+window), but queue control packets for a node whose HELLO is not out
+yet, bounded to 64, and send them in order right after the HELLO
+succeeds. Purge the queue when the endpoint goes away.
+
+Fixes: 544d85de4dc2 ("net: qrtr: Send HELLO message on endpoint register")
+Assisted-by: Claude:claude-opus-5-5
+Signed-off-by: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
+---
+ net/qrtr/af_qrtr.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 52 insertions(+), 7 deletions(-)
+
+diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
+index e7b3647424b8..071fa980fae2 100644
+--- a/net/qrtr/af_qrtr.c
++++ b/net/qrtr/af_qrtr.c
+@@ -122,6 +122,7 @@ static DEFINE_XARRAY_ALLOC(qrtr_ports);
+  * @qrtr_tx_flow: xarray of qrtr_tx_flow, keyed by node << 32 | port
+  * @qrtr_tx_lock: lock for qrtr_tx_flow inserts
+  * @hello_sent: hello packet send successful
++ * @tx_backlog: control packets waiting for the hello to be sent
+  * @rx_queue: receive queue
+  * @item: list item for broadcast list
+  * @say_hello: delayed work for sending hello packet
+@@ -136,6 +137,7 @@ struct qrtr_node {
+ 	struct mutex qrtr_tx_lock; /* for qrtr_tx_flow */
+ 
+ 	bool hello_sent;
++	struct sk_buff_head tx_backlog;
+ 
+ 	struct sk_buff_head rx_queue;
+ 	struct list_head item;
+@@ -195,6 +197,7 @@ static void __qrtr_node_release(struct kref *kref)
+ 
+ 	cancel_delayed_work_sync(&node->say_hello);
+ 
++	skb_queue_purge(&node->tx_backlog);
+ 	skb_queue_purge(&node->rx_queue);
+ 
+ 	/* Free tx flow counters */
+@@ -340,6 +343,26 @@ static void qrtr_tx_flow_failed(struct qrtr_node *node, int dest_node,
+ 	}
+ }
+ 
++/*
++ * Control packets for a node whose HELLO has not gone out yet are held back
++ * and sent right after it; this bounds how many.
++ */
++#define QRTR_TX_BACKLOG_MAX	64
++
++/* Send the control packets held back until the HELLO, in order. */
++static void qrtr_node_flush_backlog(struct qrtr_node *node)
++{
++	struct sk_buff *skb;
++
++	lockdep_assert_held(&node->ep_lock);
++
++	while ((skb = skb_dequeue(&node->tx_backlog))) {
++		if (node->ep->xmit(node->ep, skb))
++			pr_warn_ratelimited("qrtr: held control packet to node %u lost\n",
++					    node->nid);
++	}
++}
++
+ /* Pass an outgoing packet socket buffer to the endpoint driver. */
+ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+ 			     int type, struct sockaddr_qrtr *from,
+@@ -349,8 +372,12 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+ 	size_t len = skb->len;
+ 	int rc, confirm_rx;
+ 
++	/*
++	 * Data before the HELLO is refused: it would count against the flow
++	 * control window. Control packets are held back further down.
++	 */
+ 	mutex_lock(&node->ep_lock);
+-	if (!node->hello_sent && type != QRTR_TYPE_HELLO) {
++	if (!node->hello_sent && type == QRTR_TYPE_DATA) {
+ 		mutex_unlock(&node->ep_lock);
+ 		kfree_skb(skb);
+ 		return -EAGAIN;
+@@ -383,13 +410,29 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+ 
+ 	if (!rc) {
+ 		mutex_lock(&node->ep_lock);
+-		rc = -ENODEV;
+-		if (node->ep)
+-			rc = node->ep->xmit(node->ep, skb);
+-		else
++		if (!node->ep) {
+ 			kfree_skb(skb);
+-		if (!rc && type == QRTR_TYPE_HELLO)
+-			node->hello_sent = true;
++			rc = -ENODEV;
++		} else if (!node->hello_sent && type != QRTR_TYPE_HELLO) {
++			/*
++			 * The remote may not take traffic yet (a freshly
++			 * booted remoteproc without rx intents). Dropping
++			 * here would lose name server announcements for
++			 * good, so hold them until the HELLO is out.
++			 */
++			if (skb_queue_len(&node->tx_backlog) < QRTR_TX_BACKLOG_MAX) {
++				skb_queue_tail(&node->tx_backlog, skb);
++			} else {
++				kfree_skb(skb);
++				rc = -EAGAIN;
++			}
++		} else {
++			rc = node->ep->xmit(node->ep, skb);
++			if (!rc && type == QRTR_TYPE_HELLO) {
++				node->hello_sent = true;
++				qrtr_node_flush_backlog(node);
++			}
++		}
+ 		mutex_unlock(&node->ep_lock);
+ 	}
+ 	/* Need to ensure that a subsequent message carries the otherwise lost
+@@ -657,6 +700,7 @@ int qrtr_endpoint_register(struct qrtr_endpoint *ep, unsigned int nid)
+ 
+ 	kref_init(&node->ref);
+ 	mutex_init(&node->ep_lock);
++	skb_queue_head_init(&node->tx_backlog);
+ 	skb_queue_head_init(&node->rx_queue);
+ 	node->nid = QRTR_EP_NID_AUTO;
+ 	node->ep = ep;
+@@ -700,6 +744,7 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)
+ 
+ 	mutex_lock(&node->ep_lock);
+ 	node->ep = NULL;
++	skb_queue_purge(&node->tx_backlog);
+ 	mutex_unlock(&node->ep_lock);
+ 
+ 	/* Notify the local controller about the event */
+
+-- 
+2.53.0
diff --git a/kernel/patches/0031-spmi-pmic-arb-bound-irqs-by-hardware-ownership.patch b/kernel/patches/0031-spmi-pmic-arb-bound-irqs-by-hardware-ownership.patch
new file mode 100644
index 0000000..aa3dce9
--- /dev/null
+++ b/kernel/patches/0031-spmi-pmic-arb-bound-irqs-by-hardware-ownership.patch
@@ -0,0 +1,75 @@
+Subject: [PATCH] spmi: pmic-arb: bound IRQ dispatch by hardware ownership
+
+Firmware can leave an APPS-owned interrupt pending before a Linux client
+translates its IRQ. Bounds derived only from translated IRQs can exclude
+that peripheral and leave its interrupt pending.
+
+For arbiters with a complete ownership map, derive the bounds after all
+ownership entries have been read and check ownership before PIC access.
+Keep lazy discovery on older arbiters and leave the existing unmapped-IRQ
+cleanup unchanged.
+
+--- a/drivers/spmi/spmi-pmic-arb.c
++++ b/drivers/spmi/spmi-pmic-arb.c
+@@ -782,7 +782,8 @@
+ 			id = ffs(status) - 1;
+ 			status &= ~BIT(id);
+ 			apid = id + i * 32;
+-			if (apid < first || apid > last) {
++			if (apid < first || apid > last ||
++			    (bus->apid_count && bus->apid_data[apid].irq_ee != ee)) {
+ 				WARN_ONCE(true, "spurious spmi irq received for apid=%d\n",
+ 					apid);
+ 				continue;
+@@ -1001,11 +1002,13 @@
+ 	}
+ 
+ 	apid = rc;
+-	/* Keep track of {max,min}_apid for bounding search during interrupt */
+-	if (apid > bus->max_apid)
+-		bus->max_apid = apid;
+-	if (apid < bus->min_apid)
+-		bus->min_apid = apid;
++	/* Older arbiters discover their ownership map lazily. */
++	if (!bus->apid_count) {
++		if (apid > bus->max_apid)
++			bus->max_apid = apid;
++		if (apid < bus->min_apid)
++			bus->min_apid = apid;
++	}
+ 
+ 	*out_hwirq = spec_to_hwirq(intspec[0], intspec[1], intspec[2], apid);
+ 	*out_type  = intspec[3] & IRQ_TYPE_SENSE_MASK;
+@@ -1276,6 +1279,9 @@
+ 
+ 	apidd = &bus->apid_data[bus->base_apid];
+ 	apid_max = bus->base_apid + bus->apid_count;
++	for (i = bus->base_apid; i < apid_max; i++)
++		bus->apid_data[i].irq_ee = INVALID_EE;
++
+ 	for (i = bus->base_apid; i < apid_max; i++, apidd++) {
+ 		offset = pmic_arb->ver_ops->apid_map_offset(i);
+ 		if (offset >= pmic_arb->core_size)
+@@ -1309,6 +1315,22 @@
+ 
+ 		apidd->ppid = ppid;
+ 		bus->last_apid = i;
++	}
++
++	/*
++	 * Firmware can leave an interrupt pending before its Linux IRQ mapping
++	 * exists. Bound dispatch by the final hardware IRQ ownership map, not
++	 * by the subset of clients which have translated an interrupt so far.
++	 * Duplicate PPID entries above can change an earlier APID's IRQ owner.
++	 */
++	bus->min_apid = pmic_arb->max_periphs - 1;
++	bus->max_apid = 0;
++	for (i = bus->base_apid; i < apid_max; i++) {
++		if (bus->apid_data[i].irq_ee != pmic_arb->ee)
++			continue;
++		if (i < bus->min_apid)
++			bus->min_apid = i;
++		bus->max_apid = i;
+ 	}
+ 
+ 	/* Dump the mapping table for debug purposes. */
diff --git a/kernel/spectra b/kernel/spectra
new file mode 160000
index 0000000..7626c37
--- /dev/null
+++ b/kernel/spectra
@@ -0,0 +1 @@
+Subproject commit 7626c378c3d5762df673dd14d457631057779d27
diff --git a/kernel/tests/spmi_irq_cases.c b/kernel/tests/spmi_irq_cases.c
new file mode 100644
index 0000000..bc95cc1
--- /dev/null
+++ b/kernel/tests/spmi_irq_cases.c
@@ -0,0 +1,176 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#define CHECK(x) do { if (!(x)) { fprintf(stderr, "%s:%d: %s\n", __func__, __LINE__, #x); return 1; } } while (0)
+
+static void setup(unsigned int base, unsigned int count, u8 ee)
+{
+ memset(&arb, 0, sizeof(arb)); memset(&bus, 0, sizeof(bus));
+ memset(apids, 0, sizeof(apids)); memset(ppids, 0, sizeof(ppids));
+ memset(core, 0, sizeof(core)); memset(owners, 0, sizeof(owners));
+ memset(acc, 0, sizeof(acc)); memset(pic_status, 0, sizeof(pic_status));
+ memset(clear, 0, sizeof(clear)); memset(owner_status, 0, sizeof(owner_status));
+ memset(mappings, 0, sizeof(mappings)); memset(pic_reads, 0, sizeof(pic_reads));
+ memset(pic_writes, 0, sizeof(pic_writes)); memset(summary_reads, 0, sizeof(summary_reads));
+ warnings = handled = bad_irqs = summary_count = 0;
+ pmic_enable = pmic_latched = 0x90; /* IRQ4 legacy plugin + IRQ7 active Type-C. */
+ arb.core = core; arb.core_size = sizeof(core); arb.ee = ee;
+ arb.max_periphs = MAX_APIDS; arb.ver_ops = &ops;
+ bus.pmic_arb = &arb; bus.domain = &domain; bus.spmic = &controller;
+ bus.base_apid = base; bus.apid_count = count; bus.apid_data = apids;
+ bus.ppid_to_apid = ppids;
+ domain.host_data = &bus; domain.node = &controller;
+ controller.dev.of_node = &controller; desc.bus = &bus;
+ pmic_arb_init_apid_min_max(&bus);
+}
+static void entry(unsigned int a, u16 p, u8 write_ee, bool irq_owner)
+{
+ core[a] = ((u32)p << 8) | (irq_owner ? PMIC_ARB_CHAN_IS_IRQ_OWNER_MASK : 0);
+ owners[a] = write_ee;
+}
+static void read_map(void)
+{
+ if (_pmic_arb_read_apid_map(&bus, core, PMIC_ARB_PPID_MASK, 8,
+                            PMIC_ARB_CHAN_IS_IRQ_OWNER_MASK)) abort();
+}
+static int translate(u16 p, u8 irq)
+{
+ struct irq_fwspec spec = { .param_count = 4, .param = { p >> 8, p & 255, irq, 1 } };
+ unsigned long hw; unsigned int type;
+ return qpnpint_irq_domain_translate(&domain, &spec, &hw, &type);
+}
+static void pending(unsigned int a, unsigned int irq)
+{
+ acc[a] = 1; pic_status[a] |= BIT(irq);
+ owner_status[(a >> 5) - (bus.base_apid >> 5)] |= BIT(a & 31);
+}
+static int pending_before_mapping(void)
+{
+ setup(0, 512, 0);
+ entry(172, 0x100, 0, true); entry(209, 0x200, 0, true); entry(211, 0x213, 0, true);
+ read_map(); CHECK(!translate(0x100, 0)); CHECK(!translate(0x200, 0));
+ pending(211, 4); pmic_arb_chained_irq(&desc);
+ CHECK(!warnings); CHECK(clear[211] == BIT(4)); CHECK(!pic_status[211]);
+ CHECK(pmic_enable == 0x90 && pmic_latched == 0x90); CHECK(!handled);
+ return 0;
+}
+static int mapped_owned(void)
+{
+ setup(0, 512, 0); entry(211, 0x213, 0, true); read_map();
+ CHECK(!translate(0x213, 7)); mappings[211][7] = 37; pending(211, 7);
+ pmic_arb_chained_irq(&desc); CHECK(handled == 1 && !warnings && !pic_writes[211]); return 0;
+}
+static int foreign_inside_range(void)
+{
+ setup(0, 512, 0);
+ entry(172, 0x100, 0, true); entry(220, 0x200, 0, true); entry(211, 0x213, 1, true);
+ read_map(); CHECK(!translate(0x100, 0)); CHECK(!translate(0x200, 0));
+ pending(211, 4); pmic_arb_chained_irq(&desc);
+ CHECK(!pic_reads[211] && !pic_writes[211]); CHECK(warnings == 1); return 0;
+}
+static int invalid_zero_entry(void)
+{
+ setup(0, 512, 0); entry(172, 0x100, 0, true); entry(220, 0x200, 0, true); read_map();
+ CHECK(apids[211].irq_ee == INVALID_EE);
+ CHECK(!translate(0x100, 0)); CHECK(!translate(0x200, 0));
+ /* No owner ACC status: exercise fallback, not just status dispatch. */
+ pic_status[211] = BIT(4); acc[211] = 1; pmic_arb_chained_irq(&desc);
+ CHECK(!pic_reads[211] && !pic_writes[211]); return 0;
+}
+static int duplicate_owner(void)
+{
+ setup(0, 512, 0);
+ entry(172, 0x100, 0, true); entry(209, 0x200, 0, true);
+ entry(211, 0x213, 0, true); entry(212, 0x213, 1, true); read_map();
+ CHECK(apids[211].irq_ee == 1 && apids[212].irq_ee == 1);
+ CHECK(fake_ppid_to_apid(&bus, 0x213) == 211);
+ CHECK(bus.min_apid == 172 && bus.max_apid == 209);
+ CHECK(!translate(0x213, 4)); CHECK(bus.max_apid == 209);
+ pending(211, 4); pmic_arb_chained_irq(&desc);
+ CHECK(!pic_reads[211] && !pic_writes[211]); return 0;
+}
+static int foreign_translation(void)
+{
+ setup(0, 512, 0); entry(172, 0x100, 0, true); entry(209, 0x200, 0, true);
+ entry(300, 0x213, 1, true); read_map();
+ CHECK(!translate(0x100, 0)); CHECK(!translate(0x200, 0)); CHECK(!translate(0x213, 4));
+ CHECK(bus.min_apid == 172 && bus.max_apid == 209);
+ pending(300, 4); pmic_arb_chained_irq(&desc); CHECK(!pic_reads[300]); return 0;
+}
+static int secondary_bus(unsigned int base)
+{
+ setup(base, 64, 0); entry(base - 1, 0x100, 0, true);
+ entry(base + 2, 0x200, 0, true); entry(base + 51, 0x213, 0, true); read_map();
+ CHECK(bus.min_apid == base + 2 && bus.max_apid == base + 51);
+ CHECK(!translate(0x200, 0)); CHECK(!translate(0x213, 7));
+ mappings[base + 51][7] = 37; pending(base + 51, 7); pmic_arb_chained_irq(&desc);
+ CHECK(handled == 1 && !warnings && !pic_reads[base - 1]);
+ CHECK(summary_count > 0 && summary_reads[0] == (int)(((base + 2) >> 5) - (base >> 5)));
+ return 0;
+}
+static int legacy_lazy(void)
+{
+ setup(0, 0, 0); ppids[0x100] = 172 | PMIC_ARB_APID_VALID;
+ ppids[0x213] = 211 | PMIC_ARB_APID_VALID;
+ apids[172] = (struct apid_data){ .ppid = 0x100, .irq_ee = 0 };
+ apids[211] = (struct apid_data){ .ppid = 0x213, .irq_ee = 0 };
+ CHECK(bus.min_apid == MAX_APIDS - 1 && bus.max_apid == 0);
+ CHECK(!translate(0x100, 0)); CHECK(bus.min_apid == 172 && bus.max_apid == 172);
+ CHECK(!translate(0x213, 7)); CHECK(bus.min_apid == 172 && bus.max_apid == 211);
+ mappings[211][7] = 37; pending(211, 7); pmic_arb_chained_irq(&desc);
+ CHECK(handled == 1 && !warnings); return 0;
+}
+static int ppid_zero(void)
+{
+ setup(0, 512, 0); entry(211, 0, 0, true); read_map();
+ CHECK(apids[211].ppid == 0 && apids[211].irq_ee == 0);
+ CHECK(bus.min_apid == 211 && bus.max_apid == 211);
+ CHECK(!translate(0, 4)); pending(211, 4); pmic_arb_chained_irq(&desc);
+ CHECK(clear[211] == BIT(4) && !warnings); return 0;
+}
+static int empty_owned(void)
+{
+ setup(519, 64, 0); entry(549, 0x213, 1, true); read_map();
+ CHECK(bus.min_apid > bus.max_apid);
+ pending(549, 4); pmic_arb_chained_irq(&desc);
+ CHECK(summary_count == 0 && !pic_reads[549] && !warnings); return 0;
+}
+static int truncated_map(void)
+{
+ setup(0, 512, 0); arb.core_size = 210 * sizeof(u32);
+ entry(172, 0x100, 0, true); entry(211, 0x213, 0, true); read_map();
+ CHECK(apids[211].irq_ee == INVALID_EE);
+ CHECK(bus.min_apid == 172 && bus.max_apid == 172); return 0;
+}
+static int nonzero_ee(void)
+{
+ setup(0, 512, 3); entry(211, 0x213, 3, true); entry(220, 0x200, 0, true); read_map();
+ CHECK(bus.min_apid == 211 && bus.max_apid == 211);
+ CHECK(apids[210].irq_ee == INVALID_EE); pending(211, 4); pmic_arb_chained_irq(&desc);
+ CHECK(clear[211] == BIT(4) && !pic_reads[220] && !warnings); return 0;
+}
+static int disabled_acc(void)
+{
+ setup(0, 512, 0); entry(211, 0x213, 0, true); read_map(); CHECK(!translate(0x213, 7));
+ pending(211, 7); acc[211] = 0; mappings[211][7] = 37; pmic_arb_chained_irq(&desc);
+ CHECK(!handled && !pic_writes[211] && !warnings); return 0;
+}
+int main(int argc, char **argv)
+{
+ int ret = 99;
+ if (argc != 2) return 99;
+ if (!strcmp(argv[1], "pending_before_mapping")) ret = pending_before_mapping();
+ if (!strcmp(argv[1], "mapped_owned")) ret = mapped_owned();
+ if (!strcmp(argv[1], "foreign_inside_range")) ret = foreign_inside_range();
+ if (!strcmp(argv[1], "invalid_zero_entry")) ret = invalid_zero_entry();
+ if (!strcmp(argv[1], "duplicate_owner")) ret = duplicate_owner();
+ if (!strcmp(argv[1], "foreign_translation")) ret = foreign_translation();
+ if (!strcmp(argv[1], "secondary_aligned")) ret = secondary_bus(512);
+ if (!strcmp(argv[1], "secondary_unaligned")) ret = secondary_bus(519);
+ if (!strcmp(argv[1], "legacy_lazy")) ret = legacy_lazy();
+ if (!strcmp(argv[1], "ppid_zero")) ret = ppid_zero();
+ if (!strcmp(argv[1], "empty_owned")) ret = empty_owned();
+ if (!strcmp(argv[1], "truncated_map")) ret = truncated_map();
+ if (!strcmp(argv[1], "nonzero_ee")) ret = nonzero_ee();
+ if (!strcmp(argv[1], "disabled_acc")) ret = disabled_acc();
+ if (!ret) printf("PASS %s\n", argv[1]);
+ return ret;
+}
diff --git a/kernel/tests/spmi_irq_harness.h b/kernel/tests/spmi_irq_harness.h
new file mode 100644
index 0000000..552cdbd
--- /dev/null
+++ b/kernel/tests/spmi_irq_harness.h
@@ -0,0 +1,150 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Fake MMIO/IRQ boundary for executing extracted, unmodified driver functions. */
+#include <errno.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+
+typedef uint8_t u8;
+typedef uint16_t u16;
+typedef uint32_t u32;
+#define __iomem
+#define BIT(n) (1U << (n))
+#define GENMASK(h,l) ((UINT32_MAX >> (31 - (h))) & (UINT32_MAX << (l)))
+#define FIELD_PREP(mask,val) (((unsigned long)(val) << __builtin_ctz(mask)) & (mask))
+#define FIELD_GET(mask,val) (((unsigned long)(val) & (mask)) >> __builtin_ctz(mask))
+#define FIELD_MAX(mask) ((mask) >> __builtin_ctz(mask))
+#define HWIRQ_SID_MASK GENMASK(28,24)
+#define HWIRQ_PID_MASK GENMASK(23,16)
+#define HWIRQ_IRQID_MASK GENMASK(15,13)
+#define HWIRQ_APID_MASK GENMASK(12,0)
+#define spec_to_hwirq(s,p,i,a) (FIELD_PREP(HWIRQ_SID_MASK,s) | FIELD_PREP(HWIRQ_PID_MASK,p) | FIELD_PREP(HWIRQ_IRQID_MASK,i) | FIELD_PREP(HWIRQ_APID_MASK,a))
+#define PMIC_ARB_MAX_PPID BIT(13)
+#define PMIC_ARB_APID_VALID BIT(15)
+#define PMIC_ARB_PPID_MASK GENMASK(11,0)
+#define PMIC_ARB_CHAN_IS_IRQ_OWNER_MASK BIT(24)
+#define INVALID_EE 0xff
+#define SPMI_OWNERSHIP_PERIPH2OWNER(x) ((x) & 7)
+#define SPMI_PIC_ACC_ENABLE_BIT BIT(0)
+#define IRQ_TYPE_SENSE_MASK 0xf
+#define MAX_APIDS 8192
+
+struct spmi_pmic_arb_bus;
+struct apid_data { u16 ppid; u8 write_ee, irq_ee; };
+struct pmic_arb_ver_ops {
+ void *(*owner_acc_status)(struct spmi_pmic_arb_bus *, u8, int);
+ void *(*acc_enable)(struct spmi_pmic_arb_bus *, u16);
+ void *(*irq_status)(struct spmi_pmic_arb_bus *, u16);
+ void *(*irq_clear)(struct spmi_pmic_arb_bus *, u16);
+ u32 (*apid_map_offset)(u16);
+ void *(*apid_owner)(struct spmi_pmic_arb_bus *, u16);
+ int (*ppid_to_apid)(struct spmi_pmic_arb_bus *, u16);
+};
+struct spmi_pmic_arb {
+ void *core;
+ size_t core_size;
+ u8 ee;
+ int max_periphs;
+ const struct pmic_arb_ver_ops *ver_ops;
+};
+struct fake_dev { void *of_node; };
+struct spmi_controller { struct fake_dev dev; };
+struct irq_domain { void *host_data; void *node; };
+struct spmi_pmic_arb_bus {
+ struct spmi_pmic_arb *pmic_arb;
+ struct irq_domain *domain;
+ struct spmi_controller *spmic;
+ u16 base_apid;
+ int apid_count;
+ u16 *ppid_to_apid;
+ u16 last_apid;
+ struct apid_data *apid_data;
+ u16 min_apid, max_apid;
+};
+struct irq_chip { int unused; };
+struct irq_desc { struct spmi_pmic_arb_bus *bus; struct irq_chip chip; };
+struct irq_fwspec { int param_count; u32 param[4]; };
+
+static struct spmi_pmic_arb arb;
+static struct spmi_pmic_arb_bus bus;
+static struct spmi_controller controller;
+static struct irq_domain domain;
+static struct irq_desc desc;
+static struct apid_data apids[MAX_APIDS];
+static u16 ppids[PMIC_ARB_MAX_PPID];
+static u32 core[MAX_APIDS], owners[MAX_APIDS];
+static u32 acc[MAX_APIDS], pic_status[MAX_APIDS], clear[MAX_APIDS];
+static u32 owner_status[MAX_APIDS / 32];
+static unsigned int mappings[MAX_APIDS][8];
+static unsigned int pic_reads[MAX_APIDS], pic_writes[MAX_APIDS];
+static int summary_reads[MAX_APIDS / 32], summary_count;
+static unsigned int warnings, handled, bad_irqs;
+static u8 pmic_enable, pmic_latched;
+
+static void log_discard(const void *dev, const char *fmt, ...) { (void)dev; (void)fmt; }
+#define dev_dbg log_discard
+#define dev_err log_discard
+#define dev_err_ratelimited log_discard
+#define WARN_ONCE(cond,...) do { if (cond) warnings++; } while (0)
+#define irq_desc_get_handler_data(d) ((d)->bus)
+#define irq_desc_get_chip(d) (&(d)->chip)
+#define chained_irq_enter(c,d) do { (void)(c); (void)(d); } while (0)
+#define chained_irq_exit(c,d) do { (void)(c); (void)(d); } while (0)
+#define irq_domain_get_of_node(d) ((d)->node)
+static void handle_bad_irq(struct irq_desc *d) { (void)d; bad_irqs++; }
+static void generic_handle_irq(unsigned int irq) { if (!irq) abort(); handled++; }
+static unsigned int irq_find_mapping(struct irq_domain *d, unsigned long hw)
+{
+ (void)d;
+ return mappings[FIELD_GET(HWIRQ_APID_MASK,hw)][FIELD_GET(HWIRQ_IRQID_MASK,hw)];
+}
+
+static int index_in(const void *p, const u32 *a, size_t n)
+{
+ uintptr_t x = (uintptr_t)p, lo = (uintptr_t)a;
+ return x >= lo && x < lo + n * sizeof(*a) ? (int)((x - lo) / sizeof(*a)) : -1;
+}
+static u32 readl_relaxed(const void *p)
+{
+ int i;
+ if ((i = index_in(p, acc, MAX_APIDS)) >= 0 ||
+     (i = index_in(p, pic_status, MAX_APIDS)) >= 0) pic_reads[i]++;
+ return *(const u32 *)p;
+}
+static void writel_relaxed(u32 value, void *p)
+{
+ int i = index_in(p, clear, MAX_APIDS);
+ if (i < 0) { fprintf(stderr, "unexpected MMIO write\n"); abort(); }
+ pic_writes[i]++;
+ clear[i] |= value;
+ pic_status[i] &= ~value;
+ if (!pic_status[i]) {
+  unsigned int relative_bucket = (i >> 5) - (bus.base_apid >> 5);
+  owner_status[relative_bucket] &= ~BIT(i & 31);
+ }
+}
+static void *fake_owner_status(struct spmi_pmic_arb_bus *b, u8 ee, int bucket)
+{
+ if (b != &bus || ee != arb.ee || bucket < 0 || bucket >= MAX_APIDS / 32) abort();
+ summary_reads[summary_count++] = bucket;
+ return &owner_status[bucket];
+}
+static void *fake_acc(struct spmi_pmic_arb_bus *b, u16 a) { (void)b; return &acc[a]; }
+static void *fake_status(struct spmi_pmic_arb_bus *b, u16 a) { (void)b; return &pic_status[a]; }
+static void *fake_clear(struct spmi_pmic_arb_bus *b, u16 a) { (void)b; return &clear[a]; }
+static void *fake_owner(struct spmi_pmic_arb_bus *b, u16 a) { (void)b; return &owners[a]; }
+static u32 fake_map_offset(u16 a) { return sizeof(u32) * a; }
+static int fake_ppid_to_apid(struct spmi_pmic_arb_bus *b, u16 p)
+{
+ return b->ppid_to_apid[p] & PMIC_ARB_APID_VALID ? (int)(b->ppid_to_apid[p] & ~PMIC_ARB_APID_VALID) : -ENODEV;
+}
+static const struct pmic_arb_ver_ops ops = {
+ .owner_acc_status = fake_owner_status, .acc_enable = fake_acc,
+ .irq_status = fake_status, .irq_clear = fake_clear,
+ .apid_map_offset = fake_map_offset, .apid_owner = fake_owner,
+ .ppid_to_apid = fake_ppid_to_apid,
+};
diff --git a/kernel/tests/test_gen1_vbus_faults.py b/kernel/tests/test_gen1_vbus_faults.py
new file mode 100644
index 0000000..177ca7f
--- /dev/null
+++ b/kernel/tests/test_gen1_vbus_faults.py
@@ -0,0 +1,472 @@
+import os
+import re
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+
+KERNEL_SOURCE = Path(os.environ.get('AGNOS_USB_KERNEL_SOURCE', Path(__file__).resolve().parents[2] / 'build/linux'))
+SOURCE = KERNEL_SOURCE / 'drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c'
+
+
+def extract(source, name):
+  start = re.search(rf'^(?:static )?(?:int|void|struct|irqreturn_t) {name}\b', source, re.M).start()
+  opening = source.index('{', start)
+  depth = 1
+  end = opening + 1
+  while depth:
+    depth += (source[end] == '{') - (source[end] == '}')
+    end += 1
+  return source[start:end] + (';' if source[end:end + 1] == ';' else '') + '\n'
+
+
+PREFIX = r'''
+#include <assert.h>
+#include <errno.h>
+#include <limits.h>
+#include <stddef.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+typedef uint32_t u32;
+#define USBIN_CMD_IL_REG 0x40
+#define USBIN_SUSPEND 1
+#define TYPEC_STATUS_4_REG 0x0e
+#define TYPEC_VBUS_STATUS 0x40
+#define TYPEC_VBUS_ERROR 0x20
+#define TYPEC_VCONN_OVERCURRENT 0x04
+#define TYPEC_SW_CTRL_REG 0x68
+#define CC_ORIENTATION 2
+#define VCONN_EN_ORIENTATION 0x40
+#define VCONN_EN_VALUE 8
+#define VCONN_OVERCURRENT_INT_EN 0x20
+#define REGULATOR_EVENT_FAIL 0x100
+#define REGULATOR_EVENT_OVER_CURRENT 0x200
+#define NOTIFY_DONE 0
+#define NOTIFY_OK 1
+#define IRQ_HANDLED 1
+#define container_of(ptr, type, member) ((type *)((char *)(ptr) - offsetof(type, member)))
+typedef int irqreturn_t;
+struct device { int unused; };
+struct tcpm_port { int unused; };
+struct regulator { int unused; };
+struct regmap { int unused; };
+struct mutex { int held; };
+struct notifier_block { int unused; };
+struct pmic_typec;
+struct tcpc_dev { struct pmic_typec *owner; };
+struct pmic_typec { struct tcpc_dev tcpc; void *pmic_typec_port; };
+#define tcpc_to_tcpm(tcpc) ((tcpc)->owner)
+static struct {
+  unsigned int usbin, typec_status, typec_control, source_errors;
+  uint64_t fail_updates;
+  int read_failure, enable_failure, disable_failure, force_failure, query_failure;
+  int reads, updates, enables, disables, forces, hardware_enables, references;
+  int errors, events, recoveries, cc_events, errorflags_failure;
+  bool hardware_on, halt, failed_enable_leaves_on, failed_enable_leaves_halt;
+  bool failed_disable_turns_off, turn_off_after_query;
+} fake;
+#define dev_err(dev, ...) do { (void)(dev); fake.errors++; } while (0)
+#define dev_warn_ratelimited(dev, ...) do { (void)(dev); fake.errors++; } while (0)
+static void mutex_lock(struct mutex *lock) { assert(!lock->held); lock->held = 1; }
+static void mutex_unlock(struct mutex *lock) { assert(lock->held); lock->held = 0; }
+static int take_failure(int *failure) { int ret = *failure; *failure = 0; return ret; }
+static int regmap_read(struct regmap *map, unsigned int address, unsigned int *value)
+{
+  fake.reads++;
+  int ret = take_failure(&fake.read_failure);
+  if (ret) return ret;
+  assert(address == 0x1340 || address == 0x130e);
+  *value = address == 0x1340 ? fake.usbin : fake.typec_status;
+  return 0;
+}
+static int regmap_update_bits(struct regmap *map, unsigned int address, unsigned int mask, unsigned int value)
+{
+  fake.updates++;
+  assert(address == 0x1340 || address == 0x1368);
+  if (fake.fail_updates & (UINT64_C(1) << fake.updates)) return -EREMOTEIO;
+  unsigned int *reg = address == 0x1340 ? &fake.usbin : &fake.typec_control;
+  *reg = (*reg & ~mask) | (value & mask);
+  return 0;
+}
+static int regulator_enable(struct regulator *regulator)
+{
+  fake.enables++;
+  int ret = take_failure(&fake.enable_failure);
+  if (ret) {
+    if (fake.failed_enable_leaves_on) fake.hardware_on = true;
+    if (fake.failed_enable_leaves_halt) fake.halt = true;
+    return ret;
+  }
+  if (!fake.hardware_on) { fake.hardware_enables++; fake.hardware_on = true; }
+  fake.references++;
+  fake.halt = true;
+  return 0;
+}
+static int regulator_disable(struct regulator *regulator)
+{
+  fake.disables++;
+  assert(fake.references > 0); /* An unbalanced disable must fail this test. */
+  int ret = take_failure(&fake.disable_failure);
+  if (ret) { if (fake.failed_disable_turns_off) fake.hardware_on = false; return ret; }
+  if (--fake.references == 0) fake.hardware_on = fake.halt = false;
+  return 0;
+}
+static int regulator_force_disable(struct regulator *regulator)
+{
+  fake.forces++;
+  int ret = take_failure(&fake.force_failure);
+  if (ret) return ret;
+  fake.hardware_on = fake.halt = false;
+  return 0;
+}
+static int regulator_is_enabled(struct regulator *regulator)
+{
+  int ret = take_failure(&fake.query_failure);
+  if (ret) return ret;
+  ret = fake.hardware_on;
+  if (fake.turn_off_after_query) { fake.hardware_on = false; fake.turn_off_after_query = false; }
+  return ret;
+}
+static void tcpm_vbus_change(struct tcpm_port *port) { fake.events++; }
+static void tcpm_cc_change(struct tcpm_port *port) { fake.cc_events++; }
+static void tcpm_port_error_recovery(struct tcpm_port *port) { assert(port); fake.recoveries++; }
+static void disable_irq(int irq) { }
+static int regulator_get_error_flags(struct regulator *regulator, unsigned int *flags)
+{
+  *flags = fake.source_errors;
+  return take_failure(&fake.errorflags_failure);
+}
+'''
+
+TESTS = r'''
+static struct gen1_typec_port port;
+static struct pmic_typec tcpm;
+static struct regulator regulator;
+static struct regmap map;
+static struct device device;
+static struct tcpm_port registered_port;
+
+static void reset(unsigned int usbin)
+{
+  memset(&fake, 0, sizeof(fake));
+  memset(&port, 0, sizeof(port));
+  memset(&tcpm, 0, sizeof(tcpm));
+  fake.usbin = usbin;
+  port.base = 0x1300;
+  port.dev = &device;
+  port.regmap = &map;
+  port.vbus = &regulator;
+  port.tcpm_port = &registered_port;
+  tcpm.pmic_typec_port = &port;
+  tcpm.tcpc.owner = &tcpm;
+}
+static int set(bool on) { return gen1_typec_set_vbus(&tcpm.tcpc, on, false); }
+static void fail_enable_and_rollback(void)
+{
+  fake.enable_failure = -EBUSY;
+  fake.fail_updates = UINT64_C(1) << 2;
+  assert(set(true) == -EBUSY);
+  assert(port.usbin_saved && !port.vbus_enabled && port.usbin_restore == 0);
+  assert(fake.usbin == 0xa5 && fake.references == 0 && fake.errors >= 1);
+}
+static void test_read_and_suspend_errors(void)
+{
+  reset(0xa4);
+  fake.read_failure = -EIO;
+  assert(set(true) == -EIO);
+  assert(!port.usbin_saved && fake.usbin == 0xa4 && fake.enables == 0);
+  reset(0xa4);
+  fake.fail_updates = UINT64_C(1) << 1;
+  assert(set(true) == -EREMOTEIO);
+  assert(!port.usbin_saved && fake.usbin == 0xa4 && fake.enables == 0);
+}
+static void test_enable_error_successful_rollback(void)
+{
+  reset(0xa4);
+  fake.enable_failure = -EBUSY;
+  assert(set(true) == -EBUSY);
+  assert(!port.usbin_saved && !port.vbus_enabled && fake.usbin == 0xa4);
+  assert(fake.references == 0 && fake.events == 0 && fake.errors == 0);
+}
+static void test_enable_error_failed_rollback_off_retry(void)
+{
+  reset(0xa4);
+  fail_enable_and_rollback();
+  assert(set(false) == 0);
+  assert(!port.usbin_saved && fake.usbin == 0xa4 && fake.disables == 0);
+}
+static void test_enable_retry_keeps_original_snapshot(void)
+{
+  reset(0xa4);
+  fail_enable_and_rollback();
+  assert(set(true) == 0);
+  assert(port.usbin_saved && port.usbin_restore == 0 && fake.reads == 1);
+  assert(set(false) == 0);
+  assert(fake.usbin == 0xa4 && fake.references == 0 && fake.events == 2);
+}
+static void test_enable_retry_failure_keeps_original_snapshot(void)
+{
+  reset(0xa4);
+  fail_enable_and_rollback();
+  fake.enable_failure = -EAGAIN;
+  fake.fail_updates |= UINT64_C(1) << 4;
+  assert(set(true) == -EAGAIN);
+  assert(port.usbin_saved && port.usbin_restore == 0 && fake.reads == 1);
+  assert(set(false) == 0 && fake.usbin == 0xa4 && fake.disables == 0);
+}
+static void test_resuspend_error_keeps_pending_restore(void)
+{
+  reset(0xa4);
+  fail_enable_and_rollback();
+  fake.fail_updates |= UINT64_C(1) << 3;
+  assert(set(true) == -EREMOTEIO);
+  assert(port.usbin_saved && port.usbin_restore == 0 && fake.enables == 1);
+  assert(set(false) == 0 && fake.usbin == 0xa4);
+}
+static void test_originally_suspended_input_is_restored(void)
+{
+  reset(0xa5);
+  fake.enable_failure = -EBUSY;
+  fake.fail_updates = UINT64_C(1) << 2;
+  assert(set(true) == -EBUSY);
+  assert(port.usbin_saved && port.usbin_restore == 1);
+  assert(set(false) == 0 && !port.usbin_saved && fake.usbin == 0xa5);
+}
+static void test_disable_failure_keeps_owned_reference(void)
+{
+  reset(0xa4);
+  assert(set(true) == 0);
+  fake.disable_failure = -EIO;
+  assert(set(false) == -EIO);
+  assert(port.vbus_enabled && port.usbin_saved && fake.references == 1);
+  assert(fake.usbin == 0xa5 && fake.hardware_on && fake.events == 1);
+  assert(set(false) == 0);
+  assert(!port.vbus_enabled && !port.usbin_saved && fake.references == 0);
+}
+static void test_restore_failure_after_source_off_retries_without_disable(void)
+{
+  reset(0xa4);
+  assert(set(true) == 0);
+  fake.fail_updates = UINT64_C(1) << 2;
+  assert(set(false) == -EREMOTEIO);
+  assert(!port.vbus_enabled && port.usbin_saved && !fake.hardware_on);
+  assert(fake.references == 0 && fake.events == 2);
+  assert(set(false) == 0 && fake.disables == 1 && fake.usbin == 0xa4);
+}
+static void test_teardown_retries_pending_restore_and_is_idempotent(void)
+{
+  reset(0xa4);
+  fail_enable_and_rollback();
+  fake.fail_updates |= UINT64_C(1) << 3;
+  gen1_typec_vbus_cleanup(&tcpm);
+  assert(port.usbin_saved && fake.usbin == 0xa5);
+  gen1_typec_vbus_cleanup(&tcpm);
+  assert(!port.usbin_saved && fake.usbin == 0xa4);
+  gen1_typec_vbus_cleanup(&tcpm);
+  assert(fake.disables == 0 && fake.updates == 4);
+}
+static void test_bootloader_off_does_not_enable_output(void)
+{
+  reset(0xa4);
+  assert(gen1_typec_init_vbus(&tcpm) == 0);
+  assert(fake.enables == 0 && fake.disables == 0 && fake.forces == 1 && fake.updates == 0);
+}
+static void test_bootloader_source_is_balanced_and_normalized(void)
+{
+  reset(0xa5);
+  fake.hardware_on = true;
+  assert(gen1_typec_init_vbus(&tcpm) == 0);
+  assert(!fake.hardware_on && fake.hardware_enables == 0 && fake.references == 0);
+  assert(fake.enables == 0 && fake.disables == 0 && fake.forces == 1 && fake.usbin == 0xa4);
+}
+static void test_bootloader_query_and_force_errors_abort(void)
+{
+  reset(0xa5);
+  fake.hardware_on = true;
+  fake.query_failure = -EIO;
+  assert(gen1_typec_init_vbus(&tcpm) == -EIO);
+  assert(fake.enables == 0 && fake.disables == 0 && fake.forces == 1 && !fake.hardware_on);
+  reset(0xa5);
+  fake.hardware_on = true;
+  fake.force_failure = -EBUSY;
+  assert(gen1_typec_init_vbus(&tcpm) == -EBUSY);
+  assert(!port.vbus_enabled && port.vbus_uncertain && port.usbin_saved && fake.hardware_on);
+}
+static void test_bootloader_force_error_remains_pending_for_cleanup(void)
+{
+  reset(0xa5);
+  fake.hardware_on = true;
+  fake.force_failure = -EIO;
+  assert(gen1_typec_init_vbus(&tcpm) == -EIO);
+  assert(!port.vbus_enabled && port.vbus_uncertain && port.usbin_saved && fake.references == 0);
+  gen1_typec_vbus_cleanup(&tcpm);
+  assert(!fake.hardware_on && fake.references == 0 && fake.usbin == 0xa4);
+}
+static void test_bootloader_restore_error_is_retried_by_cleanup(void)
+{
+  reset(0xa5);
+  fake.hardware_on = true;
+  fake.fail_updates = UINT64_C(1) << 1;
+  assert(gen1_typec_init_vbus(&tcpm) == -EREMOTEIO);
+  assert(!port.vbus_enabled && port.usbin_saved && fake.references == 0);
+  gen1_typec_vbus_cleanup(&tcpm);
+  assert(fake.disables == 0 && fake.forces == 1 && fake.usbin == 0xa4 && !port.usbin_saved);
+}
+static void test_force_cleanup_never_changes_consumer_reference_counts(void)
+{
+  reset(0xa5);
+  fake.hardware_on = true;
+  fake.references = 1;
+  assert(gen1_typec_init_vbus(&tcpm) == 0);
+  assert(!fake.hardware_on && fake.references == 1 && fake.enables == 0 && fake.disables == 0);
+}
+static void test_failed_enable_partial_output_is_forced_off(void)
+{
+  reset(0xa4);
+  fake.enable_failure = -ETIMEDOUT;
+  fake.failed_enable_leaves_on = true;
+  assert(set(true) == -ETIMEDOUT);
+  assert(fake.enables == 1 && fake.disables == 0 && fake.forces == 1 && fake.references == 0);
+  assert(!fake.hardware_on && !port.usbin_saved && fake.usbin == 0xa4);
+}
+static void test_failed_enable_partial_output_force_failure_stays_pending(void)
+{
+  reset(0xa4);
+  fake.enable_failure = -ETIMEDOUT;
+  fake.failed_enable_leaves_on = true;
+  fake.force_failure = -EIO;
+  assert(set(true) == -ETIMEDOUT);
+  assert(fake.hardware_on && !port.vbus_enabled && port.vbus_uncertain);
+  assert(port.usbin_saved && fake.usbin == 0xa5 && fake.references == 0);
+  assert(set(false) == 0 && fake.references == 0 && fake.usbin == 0xa4);
+}
+static void test_failed_enable_unknown_output_keeps_input_suspended(void)
+{
+  reset(0xa4);
+  fake.enable_failure = -EIO;
+  fake.force_failure = -EREMOTEIO;
+  assert(set(true) == -EIO);
+  assert(port.vbus_uncertain && port.usbin_saved && fake.usbin == 0xa5);
+  assert(set(false) == 0 && fake.usbin == 0xa4 && !port.vbus_uncertain);
+}
+static void test_source_off_query_error_is_retryable_without_disable(void)
+{
+  reset(0xa4);
+  assert(set(true) == 0);
+  fake.query_failure = -EREMOTEIO;
+  assert(set(false) == -EREMOTEIO);
+  assert(!port.vbus_enabled && port.vbus_uncertain && port.usbin_saved);
+  assert(fake.references == 0 && fake.usbin == 0xa5);
+  assert(set(false) == 0 && fake.disables == 1 && fake.usbin == 0xa4);
+}
+static void test_get_vbus_requires_real_source_status(void)
+{
+  reset(0xa4);
+  assert(set(true) == 0);
+  assert(gen1_typec_get_vbus(&tcpm.tcpc) == 1);
+  fake.hardware_on = false;
+  assert(gen1_typec_get_vbus(&tcpm.tcpc) == 0);
+  fake.hardware_on = true;
+  fake.source_errors = 1;
+  assert(gen1_typec_get_vbus(&tcpm.tcpc) == 0);
+  fake.source_errors = 0;
+  fake.errorflags_failure = -EIO;
+  assert(gen1_typec_get_vbus(&tcpm.tcpc) == 0);
+  port.vbus_fault = true;
+  assert(gen1_typec_get_vbus(&tcpm.tcpc) == 0);
+}
+static void test_regulator_fault_notifier_and_stop_lifetime(void)
+{
+  reset(0xa4);
+  assert(gen1_typec_vbus_event(&port.vbus_notifier, 1, NULL) == NOTIFY_DONE);
+  assert(!port.vbus_fault && fake.recoveries == 0);
+  assert(gen1_typec_vbus_event(&port.vbus_notifier, REGULATOR_EVENT_FAIL, NULL) == NOTIFY_OK);
+  assert(port.vbus_fault && fake.recoveries == 1);
+  gen1_typec_port_stop(&tcpm);
+  assert(port.tcpm_port == NULL);
+  gen1_typec_vbus_event(&port.vbus_notifier, REGULATOR_EVENT_OVER_CURRENT, NULL);
+  assert(fake.recoveries == 1);
+}
+static void test_typec_irq_recovers_vconn_and_vbus_faults(void)
+{
+  reset(0xa4);
+  fake.typec_status = TYPEC_VCONN_OVERCURRENT;
+  gen1_typec_irq(0, &port);
+  assert(fake.recoveries == 1);
+  fake.typec_status = TYPEC_VBUS_ERROR;
+  gen1_typec_irq(0, &port);
+  assert(fake.recoveries == 2);
+  gen1_typec_port_stop(&tcpm);
+  gen1_typec_irq(0, &port);
+  assert(fake.recoveries == 2);
+}
+static void test_no_resourcing_after_boot_query_race(void)
+{
+  reset(0xa5);
+  fake.hardware_on = true;
+  fake.turn_off_after_query = true;
+  assert(gen1_typec_init_vbus(&tcpm) == 0);
+  assert(fake.enables == 0 && fake.hardware_enables == 0 && fake.forces == 1);
+}
+static void test_cmd_off_failed_halt_rollback_stays_pending(void)
+{
+  reset(0xa4);
+  fake.enable_failure = -EIO;
+  fake.failed_enable_leaves_halt = true;
+  fake.force_failure = -EREMOTEIO;
+  assert(set(true) == -EIO);
+  assert(!fake.hardware_on && fake.halt && port.usbin_saved && port.vbus_uncertain);
+  assert(set(false) == 0);
+  assert(!fake.halt && fake.usbin == 0xa4 && fake.enables == 1 && fake.forces == 2);
+}
+static void test_on_request_after_partial_owned_disable_reconciles_first(void)
+{
+  reset(0xa4);
+  assert(set(true) == 0);
+  fake.disable_failure = -EIO;
+  fake.failed_disable_turns_off = true;
+  assert(set(false) == -EIO);
+  assert(!fake.hardware_on && fake.halt && port.vbus_enabled && port.vbus_uncertain);
+  assert(set(true) == 0);
+  assert(fake.hardware_on && port.vbus_enabled && !port.vbus_uncertain && fake.references == 1);
+  assert(fake.enables == 2 && fake.disables == 2);
+  assert(set(false) == 0 && fake.references == 0 && fake.usbin == 0xa4);
+}
+static void test_vconn_off_writes_without_orientation_read(void)
+{
+  reset(0xa4);
+  fake.typec_control = VCONN_EN_VALUE | VCONN_OVERCURRENT_INT_EN | VCONN_EN_ORIENTATION;
+  fake.read_failure = -EIO;
+  assert(gen1_typec_set_vconn(&tcpm.tcpc, false) == 0);
+  assert(fake.reads == 0 && !(fake.typec_control & (VCONN_EN_VALUE | VCONN_OVERCURRENT_INT_EN)));
+  assert(gen1_typec_set_vconn(&tcpm.tcpc, true) == -EIO);
+  assert(fake.updates == 1);
+}
+'''
+
+
+class TestGen1VbusFaults(unittest.TestCase):
+  def test_actual_c_fault_paths(self):
+    source = SOURCE.read_text()
+    production = '\n'.join(extract(source, name) for name in (
+      'gen1_typec_port', 'gen1_typec_get_vbus', 'gen1_typec_restore_usbin', 'gen1_typec_stop_vbus', 'gen1_typec_set_vbus',
+      'gen1_typec_vbus_event', 'gen1_typec_vbus_cleanup', 'gen1_typec_init_vbus', 'gen1_typec_irq', 'gen1_typec_port_stop',
+      'gen1_typec_set_vconn'))
+    cases = re.findall(r'^static void (test_\w+)\(void\)', TESTS, re.M)
+    main = 'int main(void) {\n' + ''.join(f'puts("{case}"); fflush(stdout); {case}();\n' for case in cases) + 'return 0; }\n'
+    with tempfile.TemporaryDirectory() as temp:
+      path = Path(temp)
+      (path / 'test.c').write_text(PREFIX + production + TESTS + main)
+      build = subprocess.run(['cc', '-std=c11', '-O2', '-Wall', '-Wextra', '-Werror', '-Wno-unused-parameter',
+                              str(path / 'test.c'), '-o', str(path / 'test')], capture_output=True, text=True)
+      self.assertEqual(build.returncode, 0, build.stderr)
+      run = subprocess.run([str(path / 'test')], capture_output=True, text=True)
+      self.assertEqual(run.returncode, 0, run.stdout + run.stderr)
+      print(f'{len(cases)} actual-C fault scenarios passed')
+
+
+if __name__ == '__main__':
+  unittest.main()
diff --git a/kernel/tests/test_pmi8998_vbus_faults.py b/kernel/tests/test_pmi8998_vbus_faults.py
new file mode 100644
index 0000000..15e7c16
--- /dev/null
+++ b/kernel/tests/test_pmi8998_vbus_faults.py
@@ -0,0 +1,220 @@
+import re
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+from test_gen1_vbus_faults import KERNEL_SOURCE, extract
+
+
+PREFIX = r'''
+#include <assert.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#define BIT(n) (1U << (n))
+#define GENMASK(hi, lo) (((~0U) >> (31 - (hi))) & ((~0U) << (lo)))
+#define REGULATOR_EVENT_FAIL 1
+#define REGULATOR_EVENT_OVER_CURRENT 2
+#define REGULATOR_ERROR_FAIL 1
+#define REGULATOR_ERROR_OVER_CURRENT 2
+#define IRQ_HANDLED 1
+typedef int irqreturn_t;
+struct device { int unused; };
+struct regmap { int unused; };
+struct regulator_desc { unsigned int enable_reg; };
+struct regulator_dev { struct device dev; struct regmap *regmap; struct regulator_desc *desc; };
+static struct {
+  unsigned int command, halt, fault, status;
+  int writes, updates, reads, status_reads, ready_after, poll_limit;
+  uint64_t fail_writes, fail_updates, fail_reads;
+  unsigned long event;
+  int notifications, errors;
+  bool unlocked;
+} fake;
+#define dev_err(dev, ...) do { (void)(dev); fake.errors++; } while (0)
+static int regmap_write(struct regmap *map, unsigned int address, unsigned int value)
+{
+  assert(address == 0x11d0 && value == 0xa5);
+  if (fake.fail_writes & (UINT64_C(1) << ++fake.writes)) return -EIO;
+  fake.unlocked = true;
+  return 0;
+}
+static int regmap_update_bits(struct regmap *map, unsigned int address, unsigned int mask, unsigned int value)
+{
+  assert(address == 0x1140 || address == 0x11c0);
+  bool failed = fake.fail_updates & (UINT64_C(1) << ++fake.updates);
+  if (address == 0x11c0) { assert(fake.unlocked); fake.unlocked = false; }
+  if (failed) return -EIO;
+  unsigned int *reg = address == 0x1140 ? &fake.command : &fake.halt;
+  *reg = (*reg & ~mask) | (value & mask);
+  return 0;
+}
+static int regmap_read(struct regmap *map, unsigned int address, unsigned int *value)
+{
+  if (fake.fail_reads & (UINT64_C(1) << ++fake.reads)) return -EIO;
+  switch (address) {
+    case 0x1140: *value = fake.command; break;
+    case 0x1110: *value = fake.fault; break;
+    case 0x1109:
+      fake.status_reads++;
+      *value = fake.status_reads >= fake.ready_after ? fake.status : 0;
+      break;
+    default: assert(false);
+  }
+  return 0;
+}
+#define regmap_read_poll_timeout(map, address, value, condition, delay, timeout) \
+  ({ int result = 0, count = 0; \
+     assert((delay) == 1000 && (timeout) == 250000); \
+     do { result = regmap_read(map, address, &(value)); \
+       if (result || (condition)) break; \
+     } while (++count < fake.poll_limit); \
+     result ? result : (condition) ? 0 : -ETIMEDOUT; })
+static int regulator_enable_regmap(struct regulator_dev *rdev)
+{ return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg, 1, 1); }
+static int regulator_disable_regmap(struct regulator_dev *rdev)
+{ return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg, 1, 0); }
+static void regulator_notifier_call_chain(struct regulator_dev *rdev, unsigned long event, void *data)
+{ fake.notifications++; fake.event = event; }
+'''
+
+TESTS = r'''
+static struct regulator_desc desc = { .enable_reg = 0x1140 };
+static struct regmap map;
+static struct regulator_dev rdev = { .regmap = &map, .desc = &desc };
+static void reset(void)
+{
+  memset(&fake, 0, sizeof(fake));
+  fake.status = 0x0a;
+  fake.ready_after = 1;
+  fake.poll_limit = 4;
+}
+static void test_enable_waits_for_softstart_and_state(void)
+{
+  reset();
+  fake.ready_after = 3;
+  assert(pmi8998_vbus_enable(&rdev) == 0);
+  assert(fake.status_reads == 3 && fake.command == 1 && fake.halt == 1);
+  assert(pmi8998_vbus_disable(&rdev) == 0);
+  assert(fake.command == 0 && fake.halt == 0);
+}
+static void test_enable_timeout_rolls_back(void)
+{
+  reset();
+  fake.ready_after = 100;
+  assert(pmi8998_vbus_enable(&rdev) == -ETIMEDOUT);
+  assert(fake.status_reads == 4 && !fake.command && !fake.halt);
+}
+static void test_softstart_alone_is_not_ready(void)
+{
+  reset();
+  fake.status = 0x08;
+  assert(pmi8998_vbus_enable(&rdev) == -ETIMEDOUT);
+  assert(!fake.command && !fake.halt);
+}
+static void test_enable_status_io_error_rolls_back(void)
+{
+  reset();
+  fake.fail_reads = UINT64_C(1) << 1;
+  assert(pmi8998_vbus_enable(&rdev) == -EIO);
+  assert(!fake.command && !fake.halt);
+}
+static void test_unlock_and_halt_errors_do_not_enable_output(void)
+{
+  reset();
+  fake.fail_writes = UINT64_C(1) << 1;
+  assert(pmi8998_vbus_enable(&rdev) == -EIO);
+  assert(!fake.command);
+  reset();
+  fake.fail_updates = UINT64_C(1) << 1;
+  assert(pmi8998_vbus_enable(&rdev) == -EIO);
+  assert(!fake.command);
+}
+static void test_command_write_error_rolls_back_halt(void)
+{
+  reset();
+  fake.fail_updates = UINT64_C(1) << 2;
+  assert(pmi8998_vbus_enable(&rdev) == -EIO);
+  assert(!fake.command && !fake.halt);
+}
+static void test_failed_rollback_is_reported_without_claiming_ready(void)
+{
+  reset();
+  fake.ready_after = 100;
+  fake.fail_updates = UINT64_C(1) << 3;
+  assert(pmi8998_vbus_enable(&rdev) == -ETIMEDOUT);
+  assert(fake.command == 1 && fake.halt == 1 && fake.errors == 1);
+}
+static void test_disable_failure_and_retry(void)
+{
+  reset();
+  fake.command = fake.halt = 1;
+  fake.fail_updates = UINT64_C(1) << 1;
+  assert(pmi8998_vbus_disable(&rdev) == -EIO);
+  assert(fake.command == 1 && fake.halt == 1);
+  assert(pmi8998_vbus_disable(&rdev) == 0);
+  assert(fake.command == 0 && fake.halt == 0);
+}
+static void test_disable_halt_restore_failure_is_not_atomic(void)
+{
+  reset();
+  fake.command = fake.halt = 1;
+  fake.fail_updates = UINT64_C(1) << 2;
+  assert(pmi8998_vbus_disable(&rdev) == -EIO);
+  assert(fake.command == 0 && fake.halt == 1);
+  assert(pmi8998_vbus_disable(&rdev) == 0);
+  assert(fake.command == 0 && fake.halt == 0);
+}
+static void test_actual_error_flags(void)
+{
+  unsigned int flags = 99;
+  reset();
+  assert(pmi8998_vbus_get_error_flags(&rdev, &flags) == 0 && flags == 0);
+  fake.command = 1;
+  assert(pmi8998_vbus_get_error_flags(&rdev, &flags) == 0 && flags == 0);
+  fake.fault = 2;
+  assert(pmi8998_vbus_get_error_flags(&rdev, &flags) == 0 && flags == REGULATOR_ERROR_OVER_CURRENT);
+  fake.fault = 1;
+  assert(pmi8998_vbus_get_error_flags(&rdev, &flags) == 0 && flags == REGULATOR_ERROR_FAIL);
+  fake.fault = 0;
+  fake.status = 8;
+  assert(pmi8998_vbus_get_error_flags(&rdev, &flags) == 0 && flags == REGULATOR_ERROR_FAIL);
+  fake.fail_reads = UINT64_C(1) << (fake.reads + 1);
+  assert(pmi8998_vbus_get_error_flags(&rdev, &flags) == -EIO);
+}
+static void test_standard_fault_notifier_events(void)
+{
+  reset();
+  assert(pmi8998_vbus_fail_irq(0, &rdev) == IRQ_HANDLED);
+  assert(fake.notifications == 1 && fake.event == REGULATOR_EVENT_FAIL);
+  assert(pmi8998_vbus_oc_irq(1, &rdev) == IRQ_HANDLED);
+  assert(fake.notifications == 2 && fake.event == REGULATOR_EVENT_OVER_CURRENT);
+}
+'''
+
+
+class TestPmi8998VbusFaults(unittest.TestCase):
+  def test_actual_provider_c_fault_paths(self):
+    source = (KERNEL_SOURCE / 'drivers/regulator/qcom_usb_vbus-regulator.c').read_text()
+    constants = source[source.index('#define CMD_OTG'):source.index('struct qcom_usb_vbus_reg_data')]
+    production = '\n'.join(extract(source, name) for name in (
+      'pmi8998_halt_1_in_8', 'pmi8998_vbus_enable', 'pmi8998_vbus_disable',
+      'pmi8998_vbus_get_error_flags', 'pmi8998_vbus_fail_irq', 'pmi8998_vbus_oc_irq'))
+    cases = re.findall(r'^static void (test_\w+)\(void\)', TESTS, re.M)
+    main = 'int main(void) {\n' + ''.join(f'puts("{case}"); fflush(stdout); {case}();\n' for case in cases) + 'return 0; }\n'
+    with tempfile.TemporaryDirectory() as temp:
+      path = Path(temp)
+      (path / 'test.c').write_text(PREFIX + constants + production + TESTS + main)
+      build = subprocess.run(['cc', '-std=c11', '-O2', '-Wall', '-Wextra', '-Werror', '-Wno-unused-parameter',
+                              str(path / 'test.c'), '-o', str(path / 'test')], capture_output=True, text=True)
+      self.assertEqual(build.returncode, 0, build.stderr)
+      run = subprocess.run([str(path / 'test')], capture_output=True, text=True)
+      self.assertEqual(run.returncode, 0, run.stdout + run.stderr)
+      print(f'{len(cases)} actual provider C fault scenarios passed')
+
+
+if __name__ == '__main__':
+  unittest.main()
diff --git a/kernel/tests/test_spmi_irq_bounds.py b/kernel/tests/test_spmi_irq_bounds.py
new file mode 100644
index 0000000..79376c6
--- /dev/null
+++ b/kernel/tests/test_spmi_irq_bounds.py
@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Run the real PMIC-arbiter C with fake MMIO; no kernel build or device needed.
+
+The baseline comes from kernel/linux. The fixed driver is produced by applying
+patch0031 to a temporary copy. Requires host cc and git; uses only Python stdlib.
+Run: python3 kernel/tests/test_spmi_irq_bounds.py -v
+"""
+import re
+import shutil
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+
+TESTS = Path(__file__).resolve().parent
+KERNEL = TESTS.parent
+PATCH = KERNEL / 'patches/0031-spmi-pmic-arb-bound-irqs-by-hardware-ownership.patch'
+DRIVER = Path('drivers/spmi/spmi-pmic-arb.c')
+FUNCTIONS = ['cleanup_irq', 'periph_interrupt', 'pmic_arb_chained_irq',
+             'qpnpint_irq_domain_translate', 'pmic_arb_init_apid_min_max', '_pmic_arb_read_apid_map']
+CASES = ['pending_before_mapping', 'mapped_owned', 'foreign_inside_range', 'invalid_zero_entry',
+         'duplicate_owner', 'foreign_translation', 'secondary_aligned', 'secondary_unaligned',
+         'legacy_lazy', 'ppid_zero', 'empty_owned', 'truncated_map', 'nonzero_ee', 'disabled_acc']
+BASELINE_FAIL = set(CASES) - {'mapped_owned', 'legacy_lazy', 'empty_owned', 'disabled_acc'}
+
+
+def extract(source, name):
+  """Extract a full function verbatim; braces in comments/literals do not count."""
+  match = re.search(r'^static [^;\n]+\b' + re.escape(name) + r'\(', source, re.M)
+  if not match:
+    raise ValueError(name)
+  start = source.index('{', match.start())
+  tokens = re.compile(r'/\*.*?\*/|//[^\n]*|"(?:\\.|[^"\\])*"|\'(?:\\.|[^\'\\])*\'|[{}]', re.S)
+  depth = 0
+  for token in tokens.finditer(source, start):
+    if token.group() == '{':
+      depth += 1
+    elif token.group() == '}':
+      depth -= 1
+      if depth == 0:
+        return source[match.start():token.end()] + '\n'
+  raise ValueError('unclosed ' + name)
+
+
+class TestSpmiIrqBounds(unittest.TestCase):
+  @classmethod
+  def setUpClass(cls):
+    cls.tmp = tempfile.TemporaryDirectory(prefix='spmi-irq-bounds-')
+    cls.addClassCleanup(cls.tmp.cleanup)
+    root = Path(cls.tmp.name)
+    fixed = root / 'fixed' / DRIVER
+    fixed.parent.mkdir(parents=True)
+    baseline = KERNEL / 'linux' / DRIVER
+    shutil.copy2(baseline, fixed)
+    subprocess.run(['git', 'apply', '--check', '--whitespace=error', str(PATCH)],
+                   cwd=root / 'fixed', check=True, capture_output=True, text=True)
+    subprocess.run(['git', 'apply', '--whitespace=error', str(PATCH)],
+                   cwd=root / 'fixed', check=True, capture_output=True, text=True)
+    cls.binaries = {}
+    for label, driver in [('before', baseline), ('fixed', fixed)]:
+      extracted = '\n'.join(extract(driver.read_text(), name) for name in FUNCTIONS)
+      harness = root / f'{label}.c'
+      harness.write_text('#include "spmi_irq_harness.h"\n' + extracted + '\n#include "spmi_irq_cases.c"\n')
+      binary = root / f'{label}.test'
+      command = ['cc', '-std=gnu11', '-O1', '-g', '-Wall', '-Wextra', '-Werror',
+                 '-fsanitize=undefined,bounds', '-fno-sanitize-recover=all', '-I', str(TESTS),
+                 str(harness), '-o', str(binary)]
+      subprocess.run(command, check=True, capture_output=True, text=True)
+      cls.binaries[label] = binary
+
+  def run_cases(self, label):
+    for case in CASES:
+      with self.subTest(variant=label, case=case):
+        result = subprocess.run([str(self.binaries[label]), case], capture_output=True, text=True)
+        expected = 1 if label == 'before' and case in BASELINE_FAIL else 0
+        self.assertEqual(result.returncode, expected, result.stdout + result.stderr)
+
+  def test_original_reproduces_failures_and_preserves_controls(self):
+    self.run_cases('before')
+
+  def test_patch_fixes_all_cases(self):
+    self.run_cases('fixed')
+
+
+if __name__ == '__main__':
+  unittest.main()
diff --git a/kernel/tests/test_typec_shutdown.py b/kernel/tests/test_typec_shutdown.py
new file mode 100644
index 0000000..2bdbd1f
--- /dev/null
+++ b/kernel/tests/test_typec_shutdown.py
@@ -0,0 +1,104 @@
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+from test_gen1_vbus_faults import KERNEL_SOURCE, extract
+
+
+PREFIX = r'''
+#include <assert.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+#define UFP_EN_CMD 4
+struct device { int unused; };
+struct mutex { bool held; };
+struct gen1_typec_port { struct device *dev; struct mutex lock; };
+struct tcpc_dev { void *fwnode; };
+struct pmic_typec {
+  void *pmic_typec_port;
+  void *tcpm_port;
+  struct tcpc_dev tcpc;
+  void (*pdphy_stop)(struct pmic_typec *);
+  void (*port_stop)(struct pmic_typec *);
+};
+struct pmic_typec_resources { void (*port_shutdown)(struct pmic_typec *); };
+struct platform_device { struct device dev; };
+static struct {
+  int steps[8], count, logs, vconn_failure, role_failure;
+  bool irq_live, worker_live;
+} fake;
+static struct gen1_typec_port port;
+static struct pmic_typec tcpm;
+static struct pmic_typec_resources resources;
+static struct platform_device pdev;
+static void step(int id) { assert(fake.count < 8); fake.steps[fake.count++] = id; }
+#define dev_err(dev, ...) do { (void)(dev); fake.logs++; } while (0)
+static void mutex_lock(struct mutex *lock) { assert(!lock->held); lock->held = true; }
+static void mutex_unlock(struct mutex *lock) { assert(lock->held); lock->held = false; }
+static void gen1_typec_vbus_cleanup(void *data)
+{ assert(!fake.irq_live && !fake.worker_live); step(4); }
+static int gen1_typec_set_vconn(struct tcpc_dev *tcpc, bool on)
+{ assert(!on && !fake.irq_live && !fake.worker_live); step(5); return fake.vconn_failure; }
+static int gen1_typec_set_power_role(struct gen1_typec_port *p, unsigned int role)
+{ assert(role == UFP_EN_CMD && p->lock.held && !fake.worker_live); step(6); return fake.role_failure; }
+static void *platform_get_drvdata(struct platform_device *device) { return &tcpm; }
+static const struct pmic_typec_resources *of_device_get_match_data(struct device *device) { return &resources; }
+static void tcpm_unregister_port(void *p) { assert(!fake.irq_live); fake.worker_live = false; step(3); }
+static void fwnode_handle_put(void *fwnode) { step(7); }
+static void stop_pdphy(struct pmic_typec *p) { step(1); }
+static void stop_port(struct pmic_typec *p) { fake.irq_live = false; step(2); }
+'''
+
+TESTS = r'''
+static void reset(bool gen1)
+{
+  memset(&fake, 0, sizeof(fake));
+  fake.irq_live = fake.worker_live = true;
+  tcpm.pmic_typec_port = &port;
+  tcpm.pdphy_stop = stop_pdphy;
+  tcpm.port_stop = stop_port;
+  resources.port_shutdown = gen1 ? qcom_pmic_typec_gen1_port_shutdown : NULL;
+}
+int main(void)
+{
+  reset(true);
+  qcom_pmic_typec_shutdown(&pdev);
+  assert(fake.count == 7);
+  for (int i = 0; i < 7; i++) assert(fake.steps[i] == i + 1);
+  reset(true);
+  fake.vconn_failure = fake.role_failure = -EIO;
+  qcom_pmic_typec_shutdown(&pdev);
+  assert(fake.count == 7 && fake.logs == 2); /* Attempt every safe-state operation. */
+  reset(false);
+  qcom_pmic_typec_shutdown(&pdev);
+  assert(fake.count == 0 && fake.irq_live && fake.worker_live);
+  reset(false);
+  qcom_pmic_typec_remove(&pdev);
+  assert(fake.count == 4 && fake.steps[3] == 7);
+  return 0;
+}
+'''
+
+
+class TestTypecShutdown(unittest.TestCase):
+  def test_actual_shutdown_order_and_error_paths(self):
+    common = (KERNEL_SOURCE / 'drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c').read_text()
+    gen1 = (KERNEL_SOURCE / 'drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c').read_text()
+    production = extract(gen1, 'qcom_pmic_typec_gen1_port_shutdown')
+    production += extract(common, 'qcom_pmic_typec_remove') + extract(common, 'qcom_pmic_typec_shutdown')
+    with tempfile.TemporaryDirectory() as temp:
+      path = Path(temp)
+      (path / 'test.c').write_text(PREFIX + production + TESTS)
+      build = subprocess.run(['cc', '-std=c11', '-O2', '-Wall', '-Wextra', '-Werror', '-Wno-unused-parameter',
+                              str(path / 'test.c'), '-o', str(path / 'test')], capture_output=True, text=True)
+      self.assertEqual(build.returncode, 0, build.stderr)
+      run = subprocess.run([str(path / 'test')], capture_output=True, text=True)
+      self.assertEqual(run.returncode, 0, run.stdout + run.stderr)
+      print('4 actual-C shutdown ordering/error scenarios passed')
+
+
+if __name__ == '__main__':
+  unittest.main()
diff --git a/scripts/kernel_faddr2line.sh b/scripts/kernel_faddr2line.sh
index 7300770..2324256 100755
--- a/scripts/kernel_faddr2line.sh
+++ b/scripts/kernel_faddr2line.sh
@@ -1,9 +1,14 @@
 #!/usr/bin/env bash
+set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"/..
-TOOLS=$ROOT_DIR/tools
-KERNEL_DIR=$ROOT_DIR/agnos-kernel-sdm845
-CROSS_COMPILE=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-
-
-$KERNEL_DIR/scripts/faddr2line $KERNEL_DIR/out/vmlinux $1
+KERNEL_DIR="$ROOT_DIR/build/linux"
 
+exec docker run --rm -i -v "$ROOT_DIR:$ROOT_DIR" -w "$ROOT_DIR" \
+  --entrypoint bash agnos-mainline-builder -c '
+set -euo pipefail
+if [[ "$(uname -m)" != aarch64 && "$(uname -m)" != arm64 ]]; then
+  export CROSS_COMPILE=aarch64-linux-gnu-
+fi
+exec "$1/scripts/faddr2line" "$2" "${@:3}"
+' bash "$KERNEL_DIR" "$ROOT_DIR/build/kernel-out/vmlinux" "$@"
diff --git a/userspace/adbd-linux.patch b/userspace/adbd-linux.patch
index 6176809..0e63354 100644
--- a/userspace/adbd-linux.patch
+++ b/userspace/adbd-linux.patch
@@ -48,11 +48,12 @@
      D("Event loop starting");
 --- a/packages/modules/adb/daemon/usb_ffs.cpp
 +++ b/packages/modules/adb/daemon/usb_ffs.cpp
-@@ -23,6 +23,11 @@
+@@ -23,6 +23,12 @@
  #include <linux/usb/ch9.h>
  #include <linux/usb/functionfs.h>
 
 +#if defined(__linux__) && !defined(__ANDROID__)
++#include <dirent.h>
 +#include <systemd/sd-daemon.h>
 +#endif
 +
@@ -60,14 +61,25 @@
  #include <android-base/logging.h>
  #include <android-base/properties.h>
  #include <android-base/unique_fd.h>
-@@ -317,5 +322,14 @@
+@@ -317,5 +323,25 @@
      *out_control = std::move(control);
      *out_bulk_in = std::move(bulk_in);
      *out_bulk_out = std::move(bulk_out);
 +#if defined(__linux__) && !defined(__ANDROID__)
-+    // This kernel unbinds the configfs gadget when ep0 closes. Rebind whenever
-+    // descriptors are recreated, including after a USB disconnect.
-+    if (!android::base::WriteStringToFile("a600000.dwc3", "/config/usb_gadget/g1/UDC")) {
++    // Rebind after descriptors are recreated. The controller's sysfs name
++    // differs between downstream and mainline kernels.
++    std::string controller;
++    if (DIR* dir = opendir("/sys/class/udc")) {
++        while (dirent* entry = readdir(dir)) {
++            if (entry->d_name[0] != '.') {
++                controller = entry->d_name;
++                break;
++            }
++        }
++        closedir(dir);
++    }
++    if (controller.empty() ||
++        !android::base::WriteStringToFile(controller, "/config/usb_gadget/g1/UDC")) {
 +        PLOG(ERROR) << "failed to bind AGNOS USB gadget";
 +        return false;
 +    }
diff --git a/userspace/base_setup.sh b/userspace/base_setup.sh
index 934d048..c4a5719 100755
--- a/userspace/base_setup.sh
+++ b/userspace/base_setup.sh
@@ -31,6 +31,8 @@ apt-fast install --no-install-recommends -yq \
     libc6-dev \
     libegl-dev \
     libegl1 \
+    libegl-mesa0 \
+    libgl1-mesa-dri \
     libgles-dev \
     libgles1 \
     libgles2 \
@@ -81,7 +83,7 @@ ln -sf /bin/bash /bin/sh
 mkdir /usr/lib64
 ln -s usr/lib64 /lib64
 
-# Install Ubuntu's graphics development files before replacing their libraries.
+# Install graphics development files for openpilot.
 /tmp/agnos/openpilot_dependencies.sh
 
 # Versioned LLVM packages don't provide the unversioned commands.
diff --git a/userspace/build_ffmpeg_headers.sh b/userspace/build_ffmpeg_headers.sh
new file mode 100755
index 0000000..7590f86
--- /dev/null
+++ b/userspace/build_ffmpeg_headers.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+set -euo pipefail
+
+# comma-deps-ffmpeg 7.1.0.post98 ships libswscale.so.8 but omits its public
+# headers. Supplement the matching FFmpeg 7.1 API without changing the library.
+revision=b08d7969c550a804a59511c7b83f2dd8cc0499b8  # official n7.1 release
+output=${FFMPEG_HEADERS_OUTPUT:-/tmp/agnos/ffmpeg-headers}
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+
+for file in libswscale/swscale.h libswscale/version.h libswscale/version_major.h COPYING.LGPLv2.1; do
+  mkdir -p "$work/$(dirname "$file")"
+  curl --fail --location --retry 3 --silent --show-error \
+    "https://raw.githubusercontent.com/FFmpeg/FFmpeg/$revision/$file" -o "$work/$file"
+done
+
+(cd "$work" && sha256sum --check <<'SUMS'
+42ab58ed743efc74ba2152a049b521d41a0fae31595a9b9c6858742391570ca4  libswscale/swscale.h
+35f3460f3be0ab1d9bab8735dbad97df71d4e6dbd46968c0e8c111714ce12a6e  libswscale/version.h
+59377e8cf1cf5243456f800078d2d32d654552682ebfcae3c0a90b82a950fc56  libswscale/version_major.h
+b634ab5640e258563c536e658cad87080553df6f34f62269a21d554844e58bfe  COPYING.LGPLv2.1
+SUMS
+)
+
+install -d "$output/include/libswscale" "$output/share/doc/ffmpeg-headers"
+install -m644 "$work/libswscale/"*.h "$output/include/libswscale/"
+install -m644 "$work/COPYING.LGPLv2.1" "$output/share/doc/ffmpeg-headers/"
+cat > "$output/share/doc/ffmpeg-headers/README" <<EOF_DOC
+FFmpeg libswscale development header supplement
+
+Source: https://github.com/FFmpeg/FFmpeg/tree/$revision
+Version: official n7.1 release, commit $revision
+License: LGPL-2.1-or-later; original notices remain in each header.
+
+comma-deps-ffmpeg 7.1.0.post98 for aarch64 includes libswscale.so.8 but omits
+these three public headers. They provide the matching FFmpeg 7.1 declarations
+for Venus NV12 scaling; this supplement does not replace a runtime library.
+Every downloaded header and the license are checked against pinned SHA256s.
+
+Copy include/libswscale into the installed Python ffmpeg package's
+install/include directory, as reported by ffmpeg.INCLUDE_DIR. On AGNOS this is:
+/usr/local/venv/lib/python3.12/site-packages/ffmpeg/install/include/libswscale
+
+Remove the supplement when comma-deps-ffmpeg ships its libswscale headers.
+EOF_DOC
diff --git a/userspace/build_msm_daemons.sh b/userspace/build_msm_daemons.sh
new file mode 100755
index 0000000..cb53956
--- /dev/null
+++ b/userspace/build_msm_daemons.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+set -euo pipefail
+
+mkdir -p /tmp/msm-daemons /tmp/agnos/msm-daemons
+cd /tmp/msm-daemons
+
+fetch() {
+  local repo=$1 tag=$2 revision=$3
+  git -c advice.detachedHead=false clone --depth 1 --branch "$tag" "https://github.com/linux-msm/$repo.git"
+  test "$(git -C "$repo" rev-parse HEAD)" = "$revision"
+}
+
+fetch qrtr v1.2 b51ffaf22707b6000ecfb894c5b750f3bb7843b2
+fetch qmic v1.0 4574736afce75aa5eec1e1069a19563410167c9f
+fetch rmtfs v1.3 b30a3eb38f9af283f18dbd3c7755653efc52c094
+fetch tqftpserv v1.2 b6bb92d40cfffe28621abcf7bfaa6d99beea46cb
+
+meson setup qrtr/build qrtr --prefix=/usr -Dqrtr-ns=enabled -Dsystemd-service=disabled
+meson compile -C qrtr/build
+meson install -C qrtr/build
+ldconfig
+
+make -C qmic -j"$(nproc)"
+make -C qmic install prefix=/usr
+make -C rmtfs -j"$(nproc)"
+
+meson setup tqftpserv/build tqftpserv --prefix=/usr -Dsystemd-unit-prefix=/usr/lib/systemd/system
+meson compile -C tqftpserv/build
+
+root=/tmp/agnos/msm-daemons
+DESTDIR="$root" meson install -C qrtr/build
+install -D -m755 rmtfs/rmtfs "$root/usr/bin/rmtfs"
+install -D -m755 tqftpserv/build/tqftpserv "$root/usr/bin/tqftpserv"
+rm -rf "$root/usr/include" "$root/usr/lib/"*/pkgconfig
+for repo in qrtr qmic rmtfs tqftpserv; do
+  install -D -m644 "$repo/LICENSE" "$root/usr/share/doc/$repo/copyright"
+  {
+    printf 'Source: https://github.com/linux-msm/%s\n' "$repo"
+    printf 'Revision: %s\n' "$(git -C "$repo" rev-parse HEAD)"
+    printf 'Local modifications: none\n'
+  } > "$root/usr/share/doc/$repo/SOURCES"
+done
+strip "$root/usr/bin/"* "$root/usr/lib/"*/libqrtr.so.1.2
diff --git a/userspace/build_raylib.sh b/userspace/build_raylib.sh
new file mode 100755
index 0000000..ff415dc
--- /dev/null
+++ b/userspace/build_raylib.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+set -euo pipefail
+
+build=/tmp/raylib-build
+output=/tmp/agnos/raylib
+raylib_python_rev=649d19c33175fdb7800e3ccbe988f140e659cfce
+raylib_rev=231c8eec359567ef0e5e9a8aeede8ac77659fdd5
+
+git init "$build"
+git -C "$build" remote add origin https://github.com/dorapilot/raylib-python-cffi.git
+git -C "$build" fetch --depth=1 origin "$raylib_python_rev"
+git -C "$build" checkout --detach FETCH_HEAD
+git -C "$build" submodule update --init --depth=1 raylib-c raygui
+test "$(git -C "$build/raylib-c" rev-parse HEAD)" = "$raylib_rev"
+git -C "$build" apply --check --whitespace=error /tmp/agnos/raylib-python.patch
+git -C "$build" apply /tmp/agnos/raylib-python.patch
+git -C "$build/raylib-c" apply --check --whitespace=error /tmp/agnos/raylib.patch
+git -C "$build/raylib-c" apply /tmp/agnos/raylib.patch
+
+python3 -m venv /tmp/raylib-venv
+/tmp/raylib-venv/bin/pip install --no-cache-dir \
+  setuptools==80.9.0 wheel==0.45.1 cffi==1.17.1 pycparser==2.22
+
+make -C "$build/raylib-c/src" -j"$(nproc)" \
+  PLATFORM=PLATFORM_COMMA GRAPHICS=GRAPHICS_API_OPENGL_ES3 RAYLIB_LIBTYPE=STATIC
+cp "$build/raygui/src/raygui.h" "$build/raylib-c/src/"
+
+cd "$build"
+mkdir -p "$output"
+cp LICENSE "$output/raylib-python-LICENSE"
+cp raylib-c/LICENSE "$output/raylib-LICENSE"
+cp raygui/LICENSE "$output/raygui-LICENSE"
+cp /tmp/agnos/raylib-python.patch /tmp/agnos/raylib.patch "$output/"
+{
+  printf 'https://github.com/dorapilot/raylib-python-cffi %s\n' "$raylib_python_rev"
+  git submodule status raylib-c raygui
+  printf 'Local changes: raylib-python.patch raylib.patch\n'
+  (cd "$output" && sha256sum raylib-python.patch raylib.patch)
+} > "$output/SOURCES"
+
+# Openpilot's C++ installer links the same COMMA backend statically.
+mkdir -p raylib/install/{include,lib,share/doc/comma-deps-raylib}
+cp raylib-c/src/{raylib.h,raymath.h,rlgl.h} raylib/install/include/
+cp raylib-c/src/libraylib.a raylib/install/lib/libraylib_comma.a
+cp "$output/"{*LICENSE*,*.patch,SOURCES} raylib/install/share/doc/comma-deps-raylib/
+
+RAYLIB_PLATFORM=PLATFORM_COMMA \
+RAYLIB_INCLUDE_PATH="$build/raylib-c/src" \
+RAYLIB_LIB_PATH="$build/raylib-c/src" \
+  /tmp/raylib-venv/bin/pip wheel --no-deps --no-build-isolation --wheel-dir "$output" .
diff --git a/userspace/power_burn/power_burn_max.c b/userspace/power_burn/power_burn_max.c
index 5bbd5c4..5e0d837 100644
--- a/userspace/power_burn/power_burn_max.c
+++ b/userspace/power_burn/power_burn_max.c
@@ -83,6 +83,14 @@ static void fatal_sig(int s) {
 }
 
 static void leds_on(void) {
+  char model[64], maximum[64];
+  if (sysfs_read("/sys/firmware/devicetree/base/model", model, sizeof(model)) == 0 &&
+      strcmp(model, "comma mici") == 0 &&
+      sysfs_read("/sys/class/leds/ir:torch/max_brightness", maximum, sizeof(maximum)) == 0) {
+    save_and_write("/sys/class/leds/ir:torch/brightness", maximum);
+    return;
+  }
+
   save_and_write("/sys/class/leds/led:torch_0/brightness",  "500");
   save_and_write("/sys/class/leds/led:torch_1/brightness",  "500");
   save_and_write("/sys/class/leds/led:torch_2/brightness",  "300");
diff --git a/userspace/raylib-python.patch b/userspace/raylib-python.patch
new file mode 100644
index 0000000..7ad9388
--- /dev/null
+++ b/userspace/raylib-python.patch
@@ -0,0 +1,33 @@
+diff --git a/MANIFEST.in b/MANIFEST.in
+index 6c6394e..7650bc8 100644
+--- a/MANIFEST.in
++++ b/MANIFEST.in
+@@ -12,5 +12,6 @@ include version.py
+ exclude tests/*
+ include raylib/py.typed
+ include pyray/py.typed
++recursive-include raylib/install *
+ 
+ 
+diff --git a/setup.py b/setup.py
+index c91f3bb..d456423 100644
+--- a/setup.py
++++ b/setup.py
+@@ -8,7 +8,7 @@ HERE = pathlib.Path(__file__).parent
+ 
+ # The text of the README file
+ README = (HERE / "README.md").read_text()
+-VERSION = (HERE / "version.py").read_text().split()[-1].strip("\"'")
++VERSION = "6.0.0.1.post98+mainline"
+ 
+ RAYLIB_PLATFORM = os.getenv("RAYLIB_PLATFORM", "Desktop")
+ if RAYLIB_PLATFORM == "SDL":
+@@ -25,7 +25,7 @@ class BinaryDistribution(Distribution):
+ 
+ # should be name="raylib"+NAME but then Github doesn't track dependants
+ setup(
+-    name="raylib",
++    name="comma-deps-raylib",
+     version=VERSION,
+     description="Python CFFI bindings for Raylib",
+     long_description=README,
diff --git a/userspace/raylib.patch b/userspace/raylib.patch
new file mode 100644
index 0000000..e61456b
--- /dev/null
+++ b/userspace/raylib.patch
@@ -0,0 +1,137 @@
+diff --git a/src/platforms/rcore_comma.c b/src/platforms/rcore_comma.c
+index c1f976f..d162df0 100644
+--- a/src/platforms/rcore_comma.c
++++ b/src/platforms/rcore_comma.c
+@@ -105,6 +105,8 @@ struct egl_platform {
+ // hold all the low level drm stuff
+ struct drm_platform {
+   int fd;
++  int broker_socket;
++  bool owns_fd;
+ 
+   uint32_t connector_id;
+   uint32_t crtc_id;
+@@ -136,7 +138,7 @@ typedef struct {
+ //----------------------------------------------------------------------------------
+ extern CoreData CORE;                   // Global CORE state context
+ 
+-static PlatformData platform = { 0 };   // Platform specific data
++static PlatformData platform = { .drm = { .fd = -1, .broker_socket = -1 }, .touch = { .fd = -1 } };
+ 
+ //----------------------------------------------------------------------------------
+ // comma specific code
+@@ -362,6 +364,9 @@ static int recv_fd(int sock) {
+ }
+ 
+ static int init_drm (const char *dev_path) {
++  platform.drm.fd = -1;
++  platform.drm.broker_socket = -1;
++  platform.drm.owns_fd = false;
+   const char *s = getenv("DRM_FD");
+   if (s) {
+     char *end = NULL;
+@@ -373,6 +378,7 @@ static int init_drm (const char *dev_path) {
+     platform.drm.fd = (int)v;
+   } else if (getenv("NO_MASTER")) {
+     platform.drm.fd = open(dev_path, O_RDONLY | O_NONBLOCK);
++    platform.drm.owns_fd = true;
+   } else {
+     const char *sock_path = "/tmp/drmfd.sock";
+     int s = socket(AF_UNIX, SOCK_STREAM, 0);
+@@ -380,6 +386,7 @@ static int init_drm (const char *dev_path) {
+       TRACELOG(LOG_WARNING, "COMMA: Failed to open socket to magic");
+       return -1;
+     }
++    platform.drm.broker_socket = s;
+ 
+     struct sockaddr_un addr;
+     memset(&addr, 0, sizeof(addr));
+@@ -392,6 +399,7 @@ static int init_drm (const char *dev_path) {
+     }
+ 
+     platform.drm.fd = recv_fd(s);
++    platform.drm.owns_fd = true;
+   }
+ 
+   if (platform.drm.fd < 0) {
+@@ -631,10 +639,21 @@ static int turn_screen_on () {
+     return -1;
+   }
+ 
++  int percent = 65;
++  f = fopen("/run/brightness/max_percent", "r");
++  if (f) {
++    int limit;
++    if (fscanf(f, "%d", &limit) == 1) {
++      if (limit < 30) limit = 30;
++      if (limit < percent) percent = limit;
++    }
++    fclose(f);
++  }
++
+   snprintf(filepath, sizeof(filepath), "%s/brightness", bl);
+   f = open_with_retry(filepath, "w");
+   if (f) {
+-    max_brightness = (int)((max_brightness / 100.0 ) * 65.0);
++    max_brightness = max_brightness * percent / 100;
+     fprintf(f, "%lu", max_brightness);
+     fclose(f);
+   } else {
+@@ -1173,7 +1192,8 @@ int InitPlatform(void) {
+   }
+ 
+   if (init_touch("/dev/input/by-path/platform-894000.i2c-event")) {
+-    TRACELOG(LOG_WARNING, "COMMA: Failed to initialize touch device, continuing without touch");
++    TRACELOG(LOG_FATAL, "COMMA: Failed to initialize touch device");
++    return -1;
+   }
+ 
+   if (init_screen()) {
+@@ -1204,7 +1224,19 @@ void ClosePlatform(void) {
+ 
+   if (platform.egl.display != EGL_NO_DISPLAY) {
+     eglMakeCurrent(platform.egl.display, EGL_NO_SURFACE, EGL_NO_SURFACE, EGL_NO_CONTEXT);
++  }
++
++  // EGL owns the surface bookkeeping used to release locked scanout buffers.
++  if (platform.gbm.surface) {
++    if (platform.gbm.current_bo && platform.gbm.current_bo != platform.gbm.next_bo) {
++      gbm_surface_release_buffer(platform.gbm.surface, platform.gbm.current_bo);
++    }
++    if (platform.gbm.next_bo) gbm_surface_release_buffer(platform.gbm.surface, platform.gbm.next_bo);
++  }
++  platform.gbm.current_bo = NULL;
++  platform.gbm.next_bo = NULL;
+ 
++  if (platform.egl.display != EGL_NO_DISPLAY) {
+     if (platform.egl.surface != EGL_NO_SURFACE) {
+       eglDestroySurface(platform.egl.display, platform.egl.surface);
+       platform.egl.surface = EGL_NO_SURFACE;
+@@ -1218,18 +1250,20 @@ void ClosePlatform(void) {
+   }
+ 
+   if (platform.gbm.surface) {
+-    if (platform.gbm.current_bo && platform.gbm.current_bo != platform.gbm.next_bo) {
+-      gbm_surface_release_buffer(platform.gbm.surface, platform.gbm.current_bo);
+-    }
+-    if (platform.gbm.next_bo) gbm_surface_release_buffer(platform.gbm.surface, platform.gbm.next_bo);
++    gbm_surface_destroy(platform.gbm.surface);
++    platform.gbm.surface = NULL;
+   }
+-  platform.gbm.current_bo = NULL;
+-  platform.gbm.next_bo = NULL;
+ 
+   if (platform.gbm.device) {
+     gbm_device_destroy(platform.gbm.device);
+     platform.gbm.device = NULL;
+   }
+ 
+-  close(platform.touch.fd);
++  if (platform.drm.owns_fd && platform.drm.fd >= 0) close(platform.drm.fd);
++  platform.drm.fd = -1;
++  platform.drm.owns_fd = false;
++  if (platform.drm.broker_socket >= 0) close(platform.drm.broker_socket);
++  platform.drm.broker_socket = -1;
++  if (platform.touch.fd >= 0) close(platform.touch.fd);
++  platform.touch.fd = -1;
+ }
diff --git a/userspace/root/etc/modprobe.d/qcom-firmware.conf b/userspace/root/etc/modprobe.d/qcom-firmware.conf
new file mode 100644
index 0000000..c21f192
--- /dev/null
+++ b/userspace/root/etc/modprobe.d/qcom-firmware.conf
@@ -0,0 +1,5 @@
+# These drivers load firmware from the separately mounted modem partition.
+# qcom-firmware.service starts them after the mount is ready.
+blacklist qcom_q6v5_pas
+blacklist venus_core
+blacklist spectra_camera
diff --git a/userspace/root/etc/udev/rules.d/60-persistent-v4l.rules b/userspace/root/etc/udev/rules.d/60-persistent-v4l.rules
new file mode 100644
index 0000000..95eeebe
--- /dev/null
+++ b/userspace/root/etc/udev/rules.d/60-persistent-v4l.rules
@@ -0,0 +1,27 @@
+# Based on systemd's persistent V4L rules, with private Spectra probing skipped.
+
+ACTION=="remove", GOTO="persistent_v4l_end"
+SUBSYSTEM!="video4linux", GOTO="persistent_v4l_end"
+ENV{MAJOR}=="", GOTO="persistent_v4l_end"
+
+# Spectra uses a private camera ABI; probing opens its exclusive hardware nodes.
+DRIVERS=="cam_req_mgr", GOTO="persistent_v4l_skip_probe"
+
+IMPORT{program}="v4l_id $devnode"
+
+LABEL="persistent_v4l_skip_probe"
+
+SUBSYSTEMS=="usb", IMPORT{builtin}="usb_id"
+KERNEL=="video*", ENV{ID_SERIAL}=="?*", SYMLINK+="v4l/by-id/$env{ID_BUS}-$env{ID_SERIAL}-video-index$attr{index}"
+
+# check for valid "index" number
+TEST!="index", GOTO="persistent_v4l_end"
+ATTR{index}!="?*", GOTO="persistent_v4l_end"
+
+IMPORT{builtin}="path_id"
+KERNEL=="video*|vbi*", ENV{ID_PATH}=="?*",                   SYMLINK+="v4l/by-path/$env{ID_PATH}-video-index$attr{index}"
+KERNEL=="video*|vbi*", ENV{ID_PATH_WITH_USB_REVISION}=="?*", SYMLINK+="v4l/by-path/$env{ID_PATH_WITH_USB_REVISION}-video-index$attr{index}"
+KERNEL=="audio*",      ENV{ID_PATH}=="?*",                   SYMLINK+="v4l/by-path/$env{ID_PATH}-audio-index$attr{index}"
+KERNEL=="audio*",      ENV{ID_PATH_WITH_USB_REVISION}=="?*", SYMLINK+="v4l/by-path/$env{ID_PATH_WITH_USB_REVISION}-audio-index$attr{index}"
+
+LABEL="persistent_v4l_end"
diff --git a/userspace/root/etc/udev/rules.d/78-modem.rules b/userspace/root/etc/udev/rules.d/78-modem.rules
index 9c92c33..1091e47 100644
--- a/userspace/root/etc/udev/rules.d/78-modem.rules
+++ b/userspace/root/etc/udev/rules.d/78-modem.rules
@@ -12,4 +12,7 @@ SUBSYSTEM=="tty",ATTRS{idVendor}=="2c7c",ATTRS{idProduct}=="0125",ENV{ID_USB_INT
 # Interface 3 - AT
 SUBSYSTEM=="tty",ATTRS{idVendor}=="2c7c",ATTRS{idProduct}=="6007",ENV{ID_USB_INTERFACE_NUM}=="02",SYMLINK+="modem_at0",GROUP="dialout",MODE="0660"
 SUBSYSTEM=="tty",ATTRS{idVendor}=="2c7c",ATTRS{idProduct}=="6007",ENV{ID_USB_INTERFACE_NUM}=="03",SYMLINK+="modem_at1",GROUP="dialout",MODE="0660"
-ACTION=="add",SUBSYSTEM=="usb",ATTR{idVendor}=="2c7c",ATTR{idProduct}=="6007",RUN+="/bin/sh -c 'echo -n $kernel:1.4 > /sys/bus/usb/drivers/cdc_ether/unbind'"
+# The modem exposes a CDC Ethernet gateway even without cellular registration.
+# Keep NetworkManager from auto-configuring it; modem.py owns cellular via PPP.
+# Match USB identity, since enumeration can name this interface usb0 or usb1.
+SUBSYSTEM=="net",ATTRS{idVendor}=="2c7c",ATTRS{idProduct}=="6007",ENV{NM_UNMANAGED}="1"
diff --git a/userspace/root/etc/udev/rules.d/90-camera.rules b/userspace/root/etc/udev/rules.d/90-camera.rules
new file mode 100644
index 0000000..0c7dd27
--- /dev/null
+++ b/userspace/root/etc/udev/rules.d/90-camera.rules
@@ -0,0 +1 @@
+SUBSYSTEM=="video4linux", KERNEL=="video*", ATTR{name}=="cam-req-mgr", SYMLINK+="v4l/by-path/platform-soc:qcom_cam-req-mgr-video-index0"
diff --git a/userspace/root/etc/udev/rules.d/94-backlight.rules b/userspace/root/etc/udev/rules.d/94-backlight.rules
index 0ca37de..926416a 100644
--- a/userspace/root/etc/udev/rules.d/94-backlight.rules
+++ b/userspace/root/etc/udev/rules.d/94-backlight.rules
@@ -1,10 +1,10 @@
-ACTION=="add", SUBSYSTEM=="backlight", KERNEL=="panel0-backlight", RUN+="/bin/chgrp video /sys/class/backlight/%k/brightness"
-ACTION=="add", SUBSYSTEM=="backlight", KERNEL=="panel0-backlight", RUN+="/bin/chmod g+w /sys/class/backlight/%k/brightness"
-ACTION=="add", SUBSYSTEM=="backlight", KERNEL=="panel0-backlight", RUN+="/bin/chgrp video /sys/class/backlight/%k/bl_power"
-ACTION=="add", SUBSYSTEM=="backlight", KERNEL=="panel0-backlight", RUN+="/bin/chmod g+w /sys/class/backlight/%k/bl_power"
-ACTION=="add", SUBSYSTEM=="platform", KERNEL=="soc:qcom,dsi-display@0", TEST=="max_brightness_percent", RUN+="/bin/chgrp video /sys/devices/platform/soc/%k/max_brightness_percent"
-ACTION=="add", SUBSYSTEM=="platform", KERNEL=="soc:qcom,dsi-display@0", TEST=="max_brightness_percent", RUN+="/bin/chmod g+w /sys/devices/platform/soc/%k/max_brightness_percent"
+ACTION=="add", SUBSYSTEM=="backlight", RUN+="/bin/chgrp video /sys/class/backlight/%k/brightness"
+ACTION=="add", SUBSYSTEM=="backlight", RUN+="/bin/chmod g+w /sys/class/backlight/%k/brightness"
+ACTION=="add", SUBSYSTEM=="backlight", RUN+="/bin/chgrp video /sys/class/backlight/%k/bl_power"
+ACTION=="add", SUBSYSTEM=="backlight", RUN+="/bin/chmod g+w /sys/class/backlight/%k/bl_power"
 ACTION=="add", SUBSYSTEM=="leds", KERNEL=="led:torch_2", RUN+="/bin/chgrp video /sys/class/leds/%k/brightness"
 ACTION=="add", SUBSYSTEM=="leds", KERNEL=="led:torch_2", RUN+="/bin/chmod g+w /sys/class/leds/%k/brightness"
 ACTION=="add", SUBSYSTEM=="leds", KERNEL=="led:switch_2", RUN+="/bin/chgrp video /sys/class/leds/%k/brightness"
 ACTION=="add", SUBSYSTEM=="leds", KERNEL=="led:switch_2", RUN+="/bin/chmod g+w /sys/class/leds/%k/brightness"
+ACTION=="add", SUBSYSTEM=="leds", KERNEL=="ir:torch", RUN+="/bin/chgrp video /sys/class/leds/%k/brightness"
+ACTION=="add", SUBSYSTEM=="leds", KERNEL=="ir:torch", RUN+="/bin/chmod g+w /sys/class/leds/%k/brightness"
diff --git a/userspace/root/etc/udev/rules.d/95-gpu.rules b/userspace/root/etc/udev/rules.d/95-gpu.rules
index 9663bab..a79ac64 100644
--- a/userspace/root/etc/udev/rules.d/95-gpu.rules
+++ b/userspace/root/etc/udev/rules.d/95-gpu.rules
@@ -1,3 +1,4 @@
 KERNEL=="kgsl-3d0", GROUP="gpu", MODE="0660"
 KERNEL=="ion", GROUP="gpu", MODE="0660"
 SUBSYSTEM=="drm", GROUP="gpu", MODE="0660"
+KERNEL=="system", SUBSYSTEM=="dma_heap", GROUP="gpu", MODE="0660"
diff --git a/userspace/root/etc/udev/rules.d/98-rmtfs.rules b/userspace/root/etc/udev/rules.d/98-rmtfs.rules
new file mode 100644
index 0000000..497bb6a
--- /dev/null
+++ b/userspace/root/etc/udev/rules.d/98-rmtfs.rules
@@ -0,0 +1 @@
+ACTION=="add", KERNEL=="qcom_rmtfs_mem1", TAG+="systemd", ENV{SYSTEMD_WANTS}+="wifi.service"
diff --git a/userspace/root/etc/udev/rules.d/99-gpio.rules b/userspace/root/etc/udev/rules.d/99-gpio.rules
index 39f2c3e..24ac665 100644
--- a/userspace/root/etc/udev/rules.d/99-gpio.rules
+++ b/userspace/root/etc/udev/rules.d/99-gpio.rules
@@ -1,2 +1,2 @@
 SUBSYSTEM=="gpio*", PROGRAM="/bin/sh -c 'find -L /sys/class/gpio/ -maxdepth 2 -exec chown root:gpio {} + -exec chmod 770 {} + || true'"
-SUBSYSTEM=="gpio", KERNEL=="gpiochip[0]", GROUP="gpio", MODE="660"
+SUBSYSTEM=="gpio", KERNEL=="gpiochip*", GROUP="gpio", MODE="660"
diff --git a/userspace/root/usr/comma/brightnessd.py b/userspace/root/usr/comma/brightnessd.py
index 01c1b95..8e1ccb6 100755
--- a/userspace/root/usr/comma/brightnessd.py
+++ b/userspace/root/usr/comma/brightnessd.py
@@ -1,45 +1,46 @@
 #!/usr/bin/env python3
 import time
+from pathlib import Path
 
 # limit display brightness with display uptime to prevent burn in
 
 BL_OFF = 4
-BL_POWER_PATH = "/sys/class/backlight/panel0-backlight/bl_power"
-BRIGHTNESS_PATH = "/sys/class/backlight/panel0-backlight/brightness"
-MAX_BRIGHTNESS_PATH= "/sys/devices/platform/soc/soc:qcom,dsi-display@0/max_brightness_percent"
+BACKLIGHT_PATH = Path("/sys/class/backlight/ae94000.dsi.0")
+LIMIT_PATH = Path("/run/brightness/max_percent")
 
 MAX_PERCENT = 90
 MIN_PERCENT = 30
 HOURLY_PERC_DECREASE = 5
 
-def read(path: str) -> int:
-  try:
-    with open(path) as f:
-      return int(f.read())
-  except Exception:
-    return 0
+def read(path: Path) -> int:
+  return int(path.read_text())
+
+
+def limit_brightness(last_off_ts: float, now: float) -> float:
+  bl_power = read(BACKLIGHT_PATH / "bl_power")
+  brightness = read(BACKLIGHT_PATH / "brightness")
+  if bl_power == BL_OFF or brightness == 0:
+    last_off_ts = now
+
+  uptime_hours = (now - last_off_ts) / (60*60)
+  percent = int(max(MAX_PERCENT - HOURLY_PERC_DECREASE*uptime_hours, MIN_PERCENT))
+  # Openpilot applies this cap to each request. Atomic replacement prevents a
+  # reader from seeing an empty file while the cap changes.
+  temporary = LIMIT_PATH.with_suffix(".tmp")
+  temporary.write_text(f"{percent}\n")
+  temporary.replace(LIMIT_PATH)
+
+  maximum = read(BACKLIGHT_PATH / "max_brightness") * percent // 100
+  if brightness > maximum:
+    (BACKLIGHT_PATH / "brightness").write_text(f"{maximum}\n")
+  return last_off_ts
 
 
 if __name__ == "__main__":
-  last_perc = None
   last_off_ts = time.monotonic()
   while True:
     try:
-      # sample brightness and backlight power
-      bl_power = read(BL_POWER_PATH)
-      brightness = read(BRIGHTNESS_PATH)
-      if bl_power == BL_OFF or brightness == 0:
-        last_off_ts = time.monotonic()
-
-      # calculate new max
-      uptime_hours = (time.monotonic() - last_off_ts) / (60*60)
-      clipped_perc = MAX_PERCENT - (HOURLY_PERC_DECREASE*uptime_hours)
-      clipped_perc = int(max(min(clipped_perc, MAX_PERCENT), MIN_PERCENT))
-
-      if clipped_perc != last_perc:
-        with open(MAX_BRIGHTNESS_PATH, 'w') as f:
-          f.write(f"{int(clipped_perc)}\n")
-      last_perc = clipped_perc
+      last_off_ts = limit_brightness(last_off_ts, time.monotonic())
     except Exception:
       pass
 
diff --git a/userspace/root/usr/comma/comma.sh b/userspace/root/usr/comma/comma.sh
index 9051d2b..68b2a8a 100755
--- a/userspace/root/usr/comma/comma.sh
+++ b/userspace/root/usr/comma/comma.sh
@@ -57,11 +57,18 @@ handle_setup_keys () {
 # factory reset handling
 if [ ! -f /run/comma-booted ]; then
   sudo touch /run/comma-booted
+  touch_count=0
+  for touch_counter in /sys/class/input/input*/device/touch_count; do
+    if [ -r "$touch_counter" ]; then
+      read -r touch_count < "$touch_counter"
+      break
+    fi
+  done
   if [ -f "$RESET_TRIGGER" ]; then
     echo "launching system reset, reset trigger present"
     rm -f $RESET_TRIGGER
     $RESET
-  elif (( "$(cat /sys/class/input/input2/device/touch_count)" > 4 )); then
+  elif [[ "$touch_count" =~ ^[0-9]+$ ]] && (( 10#$touch_count > 4 )); then
     echo "launching system reset, got taps"
     $RESET --tap-reset
   elif ! mountpoint -q /data; then
diff --git a/userspace/root/usr/comma/gpio.sh b/userspace/root/usr/comma/gpio.sh
index d87c01c..60e81af 100755
--- a/userspace/root/usr/comma/gpio.sh
+++ b/userspace/root/usr/comma/gpio.sh
@@ -1,9 +1,6 @@
 #!/bin/bash
 
-function gpio {
-  echo "out" > /sys/class/gpio/gpio$1/direction
-  echo $2 > /sys/class/gpio/gpio$1/value
-}
+source /usr/comma/gpio_base.sh
 
 pins=(
 # 27  # SW_3V3_EN
@@ -19,7 +16,7 @@ pins=(
 33  # GPS_SAFEBOOT_N
 32  # GPS_RST_N
 52  # LTE_BOOT
-1264  # POWER ALERT
+
 )
 
 for p in ${pins[@]}; do
@@ -31,8 +28,10 @@ for p in ${pins[@]}; do
     continue
   fi
 
-  echo $p > /sys/class/gpio/export
-  until [ -d /sys/class/gpio/gpio$p ]
+  pin=$(gpio_number "$p")
+  if [ -d /sys/class/gpio/gpio$pin ]; then continue; fi
+  echo $pin > /sys/class/gpio/export
+  until [ -d /sys/class/gpio/gpio$pin ]
   do
     sleep .05
   done
diff --git a/userspace/root/usr/comma/gpio_base.sh b/userspace/root/usr/comma/gpio_base.sh
new file mode 100755
index 0000000..1fab239
--- /dev/null
+++ b/userspace/root/usr/comma/gpio_base.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Mainline assigns GPIO bases dynamically; downstream TLMM starts at zero.
+TLMM_BASE=$(cat /sys/bus/platform/devices/3400000.pinctrl/gpio/*/base 2>/dev/null | head -1)
+TLMM_BASE=${TLMM_BASE:-0}
+
+gpio_number() {
+  echo $((TLMM_BASE + $1))
+}
+
+gpio() {
+  local pin=$(gpio_number "$1")
+  echo out > /sys/class/gpio/gpio$pin/direction
+  echo "$2" > /sys/class/gpio/gpio$pin/value
+}
diff --git a/userspace/root/usr/comma/lte/lte.sh b/userspace/root/usr/comma/lte/lte.sh
index 5b6bd1f..423f5d3 100755
--- a/userspace/root/usr/comma/lte/lte.sh
+++ b/userspace/root/usr/comma/lte/lte.sh
@@ -1,9 +1,6 @@
 #!/bin/bash
 
-function gpio {
-  echo "out" > /sys/class/gpio/gpio$1/direction
-  echo $2 > /sys/class/gpio/gpio$1/value
-}
+source /usr/comma/gpio_base.sh
 
 HUB_RST_N=30
 LTE_RST_N=50
diff --git a/userspace/root/usr/comma/magic.py b/userspace/root/usr/comma/magic.py
index f444517..59d74fc 100755
--- a/userspace/root/usr/comma/magic.py
+++ b/userspace/root/usr/comma/magic.py
@@ -7,14 +7,21 @@ import pyray as rl
 SOCK_PATH = "/tmp/drmfd.sock"
 DRM_DEVICE = "/dev/dri/card0"
 BACKGROUND = "/usr/comma/bg.png"
+BACKLIGHT = "/sys/class/backlight/ae94000.dsi.0"
 
 def power_screen():
   try:
-    with open("/sys/class/backlight/panel0-backlight/bl_power", "w") as f:
+    with open(f"{BACKLIGHT}/bl_power", "w") as f:
       f.write("0")
-    with open("/sys/class/backlight/panel0-backlight/max_brightness") as f:
-      max_brightness = int((int(f.read().strip()) / 100) * 65)
-    with open("/sys/class/backlight/panel0-backlight/brightness", "w") as f:
+    percent = 65
+    try:
+      with open("/run/brightness/max_percent") as f:
+        percent = max(30, min(percent, int(f.read())))
+    except (OSError, ValueError):
+      pass
+    with open(f"{BACKLIGHT}/max_brightness") as f:
+      max_brightness = int(f.read()) * percent // 100
+    with open(f"{BACKLIGHT}/brightness", "w") as f:
       f.write(str(max_brightness))
   except Exception:
     pass
diff --git a/userspace/root/usr/comma/screen_calibration.py b/userspace/root/usr/comma/screen_calibration.py
index 54ef5a3..92776f6 100755
--- a/userspace/root/usr/comma/screen_calibration.py
+++ b/userspace/root/usr/comma/screen_calibration.py
@@ -1,46 +1,29 @@
 #!/usr/bin/env python3
 
-import os
 import struct
+from pathlib import Path
 
-GAMMA_CURVES_FILE = "/persist/comma/dwo_gamma_curves"
-COMMAND_FILE = "/sys/kernel/debug/dsi_dwo_video_display/mipi_command"
+GAMMA_CURVES_FILE = Path("/persist/comma/dwo_gamma_curves")
+FIRMWARE_FILE = Path("/run/panel-firmware/dwo-do0200fat07-gamma.bin")
 
-GAMMA_ADDR = [
-  [(0x00, 0x01), (0x02, 0x03), (0x04, 0x05), (0x06, 0x07), (0x08, 0x09), (0x0A, 0x0B), (0x0C, 0x0D), (0x0E, 0x0F), (0x10, 0x11), (0x12, 0x13), (0x14, 0x15), (0x16, 0x17), (0x18, 0x19), (0x1A, 0x1B), (0x1C, 0x1D), (0x1E, 0x1F), (0x20, 0x21), (0x22, 0x23), (0x24, 0x25), (0x26, 0x27), (0x28, 0x29), (0x2A, 0x2B), (0x2D, 0x2F), (0x30, 0x31), (0x32, 0x33)],
-  [(0x34, 0x35), (0x36, 0x37), (0x38, 0x39), (0x3A, 0x3B), (0x3D, 0x3F), (0x40, 0x41), (0x42, 0x43), (0x44, 0x45), (0x46, 0x47), (0x48, 0x49), (0x4A, 0x4B), (0x4C, 0x4D), (0x4E, 0x4F), (0x50, 0x51), (0x52, 0x53), (0x54, 0x55), (0x56, 0x58), (0x59, 0x5A), (0x5B, 0x5C), (0x5D, 0x5E), (0x5F, 0x60), (0x61, 0x62), (0x63, 0x64), (0x65, 0x66), (0x67, 0x68)],
-  [(0x69, 0x6A), (0x6B, 0x6C), (0x6D, 0x6E), (0x6F, 0x70), (0x71, 0x72), (0x73, 0x74), (0x75, 0x76), (0x77, 0x78), (0x79, 0x7A), (0x7B, 0x7C), (0x7D, 0x7E), (0x7F, 0x80), (0x81, 0x82), (0x83, 0x84), (0x85, 0x86), (0x87, 0x88), (0x89, 0x8A), (0x8B, 0x8C), (0x8D, 0x8E), (0x8F, 0x90), (0x91, 0x92), (0x93, 0x94), (0x95, 0x96), (0x97, 0x98), (0x99, 0x9A)],
-]
 
-def command_mode(mode):
-  return f"39 01 00 00 0A 00 02 FE {((0b1010 << 4) | mode):02X}"
+def pack_gamma(text: str) -> bytes:
+  gamma = [[int(value, 16) for value in line.split()] for line in text.splitlines() if line.strip()]
+  if len(gamma) != 3 or any(len(channel) != 25 for channel in gamma):
+    raise ValueError("Expected three channels of 25 gamma points")
+  values = [point for channel in gamma for point in channel]
+  if any(point < 0 or point > 0xffff for point in values):
+    raise ValueError("Gamma points must fit in 16 bits")
+  return struct.pack(">75H", *values)
 
-def pack_command(command_str):
-  command_buf = bytes(map(lambda x: int(x, base=16), command_str.strip().split()))
-  return struct.pack(f"i{len(command_buf)}s", len(command_buf), command_buf)
-
-def set_gamma(gamma):
-  cmds = [command_mode(2)]
-  for color_idx in range(3):
-    for i, val in reversed(list(enumerate(gamma[color_idx]))):
-      msb, lsb = GAMMA_ADDR[color_idx][i]
-      cmds.append(f"39 0F 00 00 0A 00 02 {msb:02X} {(val >> 8) & 0xFF:02X}")
-      cmds.append(f"39 {'01' if i % 10 == 0 else '0F'} 00 00 0A 00 02 {lsb:02X} {val & 0xFF:02X}")
-  cmds.append(command_mode(0))
-
-  data = b"".join(pack_command(c) for c in cmds)
-  with open(COMMAND_FILE, "wb") as f:
-    f.write(data)
-  print("Successfully setup screen calibration")
 
 if __name__ == "__main__":
-  if not os.path.exists(GAMMA_CURVES_FILE):
+  FIRMWARE_FILE.unlink(missing_ok=True)
+  if not GAMMA_CURVES_FILE.exists():
     print("No gamma curves found")
-    exit(0)
-
-  assert os.path.exists(COMMAND_FILE), "MIPI command interface not found"
-
-  with open(GAMMA_CURVES_FILE, "r") as f:
-    gamma = [[int(x, 16) for x in l.strip().split()] for l in f]
-
-  set_gamma(gamma)
+  else:
+    data = pack_gamma(GAMMA_CURVES_FILE.read_text())
+    temporary = FIRMWARE_FILE.with_suffix(".tmp")
+    temporary.write_bytes(data)
+    temporary.replace(FIRMWARE_FILE)
+    print("Staged screen calibration firmware")
diff --git a/userspace/root/usr/comma/sound/sound_init.sh b/userspace/root/usr/comma/sound/sound_init.sh
index 8c5e5fd..756bc18 100755
--- a/userspace/root/usr/comma/sound/sound_init.sh
+++ b/userspace/root/usr/comma/sound/sound_init.sh
@@ -1,25 +1,13 @@
 #!/bin/bash
+set -euo pipefail
 
-/usr/comma/sound/adsp-start.sh
-
-echo "waiting for sound card to come online"
-while [ ! -d /proc/asound/sdm845tavilsndc ] || [ "$(cat /proc/asound/card0/state 2> /dev/null)" != "ONLINE" ] ; do
-  sleep 0.01
+# qcom-firmware.service loads ADSP after the firmware partition is mounted.
+for _ in $(seq 1 100); do
+  [ -d /proc/asound/commamici ] && break
+  sleep 0.1
 done
-echo "sound card online"
+test -d /proc/asound/commamici
 
-while ! amixer -D hw:0 controls | grep -q "SEC_MI2S_RX Audio Mixer MultiMedia1"; do
-  sleep 0.01
-done
-echo "mixer controls ready"
-
-amixer -D hw:0 -q cset "name='SEC_MI2S_RX Audio Mixer MultiMedia1'" 1
-if grep -q mici /sys/firmware/devicetree/base/model; then
-  amixer -D hw:0 -q cset "name='MultiMedia1 Mixer SEC_MI2S_TX'" 1
-else
-  amixer -D hw:0 -q cset "name='MultiMedia1 Mixer TERT_MI2S_TX'" 1
-  amixer -D hw:0 -q cset "name='TERT_MI2S_TX Channels'" Two
-fi
-
-# setup the amplifier registers
-/usr/local/venv/bin/python /usr/comma/sound/amplifier.py
+# Q6 routing uses one frontend for each direction.
+amixer -c commamici cset 'name=SEC_MI2S_RX Audio Mixer MultiMedia1' on > /dev/null
+amixer -c commamici cset 'name=MultiMedia2 Mixer SEC_MI2S_TX' on > /dev/null
diff --git a/userspace/root/usr/comma/tmpfiles.conf b/userspace/root/usr/comma/tmpfiles.conf
index 7594897..f87e3e9 100644
--- a/userspace/root/usr/comma/tmpfiles.conf
+++ b/userspace/root/usr/comma/tmpfiles.conf
@@ -8,6 +8,7 @@
 # See tmpfiles.d(5) for details
 
 # /var: rebuild enough for services to be happy
+L /var/run - - - - /run
 d /var/crash 0755 - - -
 q /var/tmp 1777 root root 30d
 d /var/tmp/xdg 0700 comma comma -
diff --git a/userspace/root/usr/lib/firmware/ath10k/WCN3990/hw1.0/board-2.bin b/userspace/root/usr/lib/firmware/ath10k/WCN3990/hw1.0/board-2.bin
new file mode 100644
index 0000000..5344336
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/ath10k/WCN3990/hw1.0/board-2.bin
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a6f2b5ba06d33bae9d0ec525b84b267ff0a26f4fde4e96a5b586e73096cfd769
+size 905596
diff --git a/userspace/root/usr/lib/firmware/ath10k/WCN3990/hw1.0/firmware-5.bin b/userspace/root/usr/lib/firmware/ath10k/WCN3990/hw1.0/firmware-5.bin
new file mode 100644
index 0000000..0d1d687
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/ath10k/WCN3990/hw1.0/firmware-5.bin
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fef6539e0127579536bc977be57a90d018b83f2931fedc3a8870fbe38d6c4127
+size 60
diff --git a/userspace/root/usr/lib/firmware/ath10k/WCN3990/hw1.0/wlanmdsp.mbn b/userspace/root/usr/lib/firmware/ath10k/WCN3990/hw1.0/wlanmdsp.mbn
new file mode 100644
index 0000000..afba0bf
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/ath10k/WCN3990/hw1.0/wlanmdsp.mbn
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:aa7a7b3ef5e4c43a242e7bca199b1bb358c1111ddfc39dcdecd9eba7473feb31
+size 3379868
diff --git a/userspace/root/usr/lib/firmware/comma/dwo-do0200fat07-gamma.bin b/userspace/root/usr/lib/firmware/comma/dwo-do0200fat07-gamma.bin
new file mode 120000
index 0000000..91af9ae
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/comma/dwo-do0200fat07-gamma.bin
@@ -0,0 +1 @@
+/run/panel-firmware/dwo-do0200fat07-gamma.bin
\ No newline at end of file
diff --git a/userspace/root/usr/lib/firmware/qca/crbtfw11.tlv b/userspace/root/usr/lib/firmware/qca/crbtfw11.tlv
new file mode 100644
index 0000000..00c6a53
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qca/crbtfw11.tlv
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d6532b99875890fb7969874ff6e904939ca0d6f2d2bd1e1fd3ae86470bebc9f5
+size 29368
diff --git a/userspace/root/usr/lib/firmware/qca/crbtfw20.tlv b/userspace/root/usr/lib/firmware/qca/crbtfw20.tlv
new file mode 100644
index 0000000..f761ae9
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qca/crbtfw20.tlv
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d9afa5d9facd528f437e83bcc8147681afd432296ebbba5e77904c13fab28209
+size 56180
diff --git a/userspace/root/usr/lib/firmware/qca/crbtfw21.tlv b/userspace/root/usr/lib/firmware/qca/crbtfw21.tlv
new file mode 100644
index 0000000..5192067
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qca/crbtfw21.tlv
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2a42859081393ca6a50a177773385eac4fcabb9f21fc1b78299ed35bf8a598c4
+size 170592
diff --git a/userspace/root/usr/lib/firmware/qca/crnv11.bin b/userspace/root/usr/lib/firmware/qca/crnv11.bin
new file mode 100644
index 0000000..eeea5ef
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qca/crnv11.bin
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:206deb651dcfd187d1fd39f1f064af20324d1b4e28dcd72f5ed23bb8ef605d00
+size 2798
diff --git a/userspace/root/usr/lib/firmware/qca/crnv20.bin b/userspace/root/usr/lib/firmware/qca/crnv20.bin
new file mode 100644
index 0000000..75aad6b
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qca/crnv20.bin
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6c96fe067860a79813b466a1d4644dc2748a4191b21a986a44d2cc0fe6ccaca7
+size 3936
diff --git a/userspace/root/usr/lib/firmware/qca/crnv21.bin b/userspace/root/usr/lib/firmware/qca/crnv21.bin
new file mode 100644
index 0000000..b4d1c9e
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qca/crnv21.bin
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:18cc38fff25a6a56bc163f1874184da93d90882dc047c9f0c534ed9888c543b3
+size 4520
diff --git a/userspace/root/usr/lib/firmware/qcom/a630_gmu.bin b/userspace/root/usr/lib/firmware/qcom/a630_gmu.bin
new file mode 120000
index 0000000..08910a3
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qcom/a630_gmu.bin
@@ -0,0 +1 @@
+../a630_gmu.bin
\ No newline at end of file
diff --git a/userspace/root/usr/lib/firmware/qcom/a630_sqe.fw b/userspace/root/usr/lib/firmware/qcom/a630_sqe.fw
new file mode 100644
index 0000000..b5092d0
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qcom/a630_sqe.fw
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1c21b527d9183487cc550dabbb3f43e555df5a977a461934fc61f0635a9aa90c
+size 34188
diff --git a/userspace/root/usr/lib/firmware/qcom/sdm845/a630_zap.mbn b/userspace/root/usr/lib/firmware/qcom/sdm845/a630_zap.mbn
new file mode 120000
index 0000000..cfb4a0d
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qcom/sdm845/a630_zap.mbn
@@ -0,0 +1 @@
+../../a630_zap.elf
\ No newline at end of file
diff --git a/userspace/root/usr/lib/firmware/qcom/sdm845/adspr.jsn b/userspace/root/usr/lib/firmware/qcom/sdm845/adspr.jsn
new file mode 100644
index 0000000..0964c15
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qcom/sdm845/adspr.jsn
@@ -0,0 +1,21 @@
+{
+    "sr_version": {
+        "major": 1,
+        "minor": 1,
+        "patch": 1
+    },
+    "sr_domain": {
+        "soc": "msm",
+        "domain": "adsp",
+        "subdomain": "root_pd",
+        "qmi_instance_id": 74
+    },
+    "sr_service": [
+        {
+            "provider": "tms",
+            "service": "servreg",
+            "service_data_valid": 0,
+            "service_data": 0
+        }
+    ]
+}
\ No newline at end of file
diff --git a/userspace/root/usr/lib/firmware/qcom/sdm845/adspua.jsn b/userspace/root/usr/lib/firmware/qcom/sdm845/adspua.jsn
new file mode 100644
index 0000000..2d6824e
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qcom/sdm845/adspua.jsn
@@ -0,0 +1,27 @@
+{
+    "sr_version": {
+        "major": 1,
+        "minor": 1,
+        "patch": 1
+    },
+    "sr_domain": {
+        "soc": "msm",
+        "domain": "adsp",
+        "subdomain": "audio_pd",
+        "qmi_instance_id": 74
+    },
+    "sr_service": [
+        {
+            "provider": "tms",
+            "service": "servreg",
+            "service_data_valid": 0,
+            "service_data": 0
+        },
+        {
+            "provider": "avs",
+            "service": "audio",
+            "service_data_valid": 0,
+            "service_data": 0
+        }
+    ]
+}
\ No newline at end of file
diff --git a/userspace/root/usr/lib/firmware/qcom/sdm845/cdspr.jsn b/userspace/root/usr/lib/firmware/qcom/sdm845/cdspr.jsn
new file mode 100644
index 0000000..5d976a6
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qcom/sdm845/cdspr.jsn
@@ -0,0 +1,21 @@
+{
+    "sr_version": {
+        "major": 1,
+        "minor": 1,
+        "patch": 1
+    },
+    "sr_domain": {
+        "soc": "msm",
+        "domain": "cdsp",
+        "subdomain": "root_pd",
+        "qmi_instance_id": 76
+    },
+    "sr_service": [
+        {
+            "provider": "tms",
+            "service": "servreg",
+            "service_data_valid": 0,
+            "service_data": 0
+        }
+    ]
+}
\ No newline at end of file
diff --git a/userspace/root/usr/lib/firmware/qcom/sdm845/mba.mbn b/userspace/root/usr/lib/firmware/qcom/sdm845/mba.mbn
new file mode 100644
index 0000000..c0232b3
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qcom/sdm845/mba.mbn
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:42f36f2a8bd1c3cfb10f03c7f34e7e31a699cc6d4fb21dc87c4321277d94f87e
+size 242400
diff --git a/userspace/root/usr/lib/firmware/qcom/sdm845/modem_nm.mbn b/userspace/root/usr/lib/firmware/qcom/sdm845/modem_nm.mbn
new file mode 100644
index 0000000..8268611
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qcom/sdm845/modem_nm.mbn
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f4d4963d7f6ccaeee4245f3c647b0544e2a7b4bcba297198dd0dea180fbeab1a
+size 5673184
diff --git a/userspace/root/usr/lib/firmware/qcom/sdm845/modemr.jsn b/userspace/root/usr/lib/firmware/qcom/sdm845/modemr.jsn
new file mode 100644
index 0000000..d947bf6
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qcom/sdm845/modemr.jsn
@@ -0,0 +1,21 @@
+{
+    "sr_version": {
+        "major": 1,
+        "minor": 1,
+        "patch": 1
+    },
+    "sr_domain": {
+        "soc": "msm",
+        "domain": "modem",
+        "subdomain": "root_pd",
+        "qmi_instance_id": 180
+    },
+    "sr_service": [
+        {
+            "provider": "tms",
+            "service": "servreg",
+            "service_data_valid": 0,
+            "service_data": 0
+        }
+    ]
+}
diff --git a/userspace/root/usr/lib/firmware/qcom/sdm845/modemuw.jsn b/userspace/root/usr/lib/firmware/qcom/sdm845/modemuw.jsn
new file mode 100644
index 0000000..88a400e
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qcom/sdm845/modemuw.jsn
@@ -0,0 +1,33 @@
+{
+    "sr_version": {
+        "major": 1,
+        "minor": 1,
+        "patch": 1
+    },
+    "sr_domain": {
+        "soc": "msm",
+        "domain": "modem",
+        "subdomain": "wlan_pd",
+        "qmi_instance_id": 180
+    },
+    "sr_service": [
+        {
+            "provider": "kernel",
+            "service": "elf_loader",
+            "service_data_valid": 0,
+            "service_data": 0
+        },
+        {
+            "provider": "tms",
+            "service": "servreg",
+            "service_data_valid": 0,
+            "service_data": 0
+        },
+        {
+            "provider": "wlan",
+            "service": "fw",
+            "service_data_valid": 0,
+            "service_data": 0
+        }
+    ]
+}
\ No newline at end of file
diff --git a/userspace/root/usr/lib/firmware/qcom/sdm845/wlanmdsp.mbn b/userspace/root/usr/lib/firmware/qcom/sdm845/wlanmdsp.mbn
new file mode 120000
index 0000000..379f7ff
--- /dev/null
+++ b/userspace/root/usr/lib/firmware/qcom/sdm845/wlanmdsp.mbn
@@ -0,0 +1 @@
+../../ath10k/WCN3990/hw1.0/wlanmdsp.mbn
\ No newline at end of file
diff --git a/userspace/root/usr/lib/firmware/regulatory.db b/userspace/root/usr/lib/firmware/regulatory.db
new file mode 100644
index 0000000..23d5d8a
Binary files /dev/null and b/userspace/root/usr/lib/firmware/regulatory.db differ
diff --git a/userspace/root/usr/lib/firmware/regulatory.db.p7s b/userspace/root/usr/lib/firmware/regulatory.db.p7s
new file mode 100644
index 0000000..7a4ffc7
Binary files /dev/null and b/userspace/root/usr/lib/firmware/regulatory.db.p7s differ
diff --git a/userspace/root/usr/lib/systemd/system/brightnessd.service b/userspace/root/usr/lib/systemd/system/brightnessd.service
index 18beace..4367b7f 100644
--- a/userspace/root/usr/lib/systemd/system/brightnessd.service
+++ b/userspace/root/usr/lib/systemd/system/brightnessd.service
@@ -2,6 +2,7 @@
 Description=Limit display brightness with uptime
 
 [Service]
+RuntimeDirectory=brightness
 Restart=on-failure
 ExecStart=/usr/local/venv/bin/python -u /usr/comma/brightnessd.py
 
diff --git a/userspace/root/usr/lib/systemd/system/magic.service b/userspace/root/usr/lib/systemd/system/magic.service
index 6782aeb..609e63c 100644
--- a/userspace/root/usr/lib/systemd/system/magic.service
+++ b/userspace/root/usr/lib/systemd/system/magic.service
@@ -1,20 +1,15 @@
 [Unit]
 Description=Magic
+Wants=screen_calibration.service
+After=screen_calibration.service
 StartLimitIntervalSec=0
 
 [Service]
 Type=simple
 User=comma
-PermissionsStartOnly=true
-ExecStartPre=/bin/bash -c "chgrp gpu /dev/ion /dev/kgsl-3d0"
-ExecStartPre=/bin/bash -c "chmod 660 /dev/ion /dev/kgsl-3d0"
-
-ExecStartPre=/bin/bash -c "mkdir -p /data/misc/display || true"
-ExecStartPre=/bin/bash -c "echo 0 > /data/misc/display/sdm_dbg_cfg.txt || true"
-ExecStartPre=/bin/bash -c "echo 0 > /data/misc/display/gbm_dbg_cfg.txt || true"
 
 ExecStart=/bin/bash -c "source /etc/profile && /usr/local/venv/bin/python -u /usr/comma/magic.py"
-# raylib exits if the touchscreen or backlight isn't accessible yet, e.g. before udev sets their permissions
+# udev may not have set DRM and backlight permissions yet.
 Restart=on-failure
 RestartSec=1
 
diff --git a/userspace/root/usr/lib/systemd/system/qcom-firmware.service b/userspace/root/usr/lib/systemd/system/qcom-firmware.service
new file mode 100644
index 0000000..35e5d97
--- /dev/null
+++ b/userspace/root/usr/lib/systemd/system/qcom-firmware.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Start Qualcomm audio, video and camera firmware
+RequiresMountsFor=/firmware/image
+After=firmware.mount
+Before=sound.service comma.service
+
+[Service]
+Type=oneshot
+ExecStart=/sbin/modprobe qcom_q6v5_pas
+ExecStart=/sbin/modprobe venus_core
+ExecStart=/sbin/modprobe spectra_camera
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/userspace/root/usr/lib/systemd/system/qrtr.service b/userspace/root/usr/lib/systemd/system/qrtr.service
new file mode 100644
index 0000000..f777f4d
--- /dev/null
+++ b/userspace/root/usr/lib/systemd/system/qrtr.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Qualcomm IPC router name service
+
+[Service]
+ExecStart=/usr/bin/qrtr-ns -f 1
+Restart=always
+RestartSec=1
+
+[Install]
+WantedBy=multi-user.target
diff --git a/userspace/root/usr/lib/systemd/system/screen_calibration.service b/userspace/root/usr/lib/systemd/system/screen_calibration.service
index c78705b..f7b6f2a 100644
--- a/userspace/root/usr/lib/systemd/system/screen_calibration.service
+++ b/userspace/root/usr/lib/systemd/system/screen_calibration.service
@@ -1,10 +1,14 @@
 [Unit]
-After=multi-user.target
+After=local-fs.target
+Before=magic.service
+RequiresMountsFor=/persist/comma
 Description=Set screen calibration
 
 [Service]
 Type=oneshot
 User=root
+RuntimeDirectory=panel-firmware
+RemainAfterExit=yes
 ExecStart=/usr/comma/screen_calibration.py
 
 [Install]
diff --git a/userspace/root/usr/lib/systemd/system/sound.service b/userspace/root/usr/lib/systemd/system/sound.service
index fffb2ad..01973e3 100644
--- a/userspace/root/usr/lib/systemd/system/sound.service
+++ b/userspace/root/usr/lib/systemd/system/sound.service
@@ -1,5 +1,7 @@
 [Unit]
 Description=Sound
+Requires=qcom-firmware.service
+After=qcom-firmware.service
 
 [Service]
 Type=oneshot
diff --git a/userspace/root/usr/lib/systemd/system/tqftpserv.service b/userspace/root/usr/lib/systemd/system/tqftpserv.service
new file mode 100644
index 0000000..2b57504
--- /dev/null
+++ b/userspace/root/usr/lib/systemd/system/tqftpserv.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=Qualcomm firmware file service
+Requires=qrtr.service
+After=qrtr.service
+Before=wifi.service
+
+[Service]
+ExecStart=/usr/bin/tqftpserv
+Restart=always
+StateDirectory=tqftpserv
+
+[Install]
+WantedBy=multi-user.target
diff --git a/userspace/root/usr/lib/systemd/system/wifi.service b/userspace/root/usr/lib/systemd/system/wifi.service
index 726af7d..7398193 100644
--- a/userspace/root/usr/lib/systemd/system/wifi.service
+++ b/userspace/root/usr/lib/systemd/system/wifi.service
@@ -1,8 +1,13 @@
 [Unit]
 Description=Wi-Fi stack: modem subsystem and its daemons
+Requires=qrtr.service tqftpserv.service
+After=qrtr.service tqftpserv.service
+ConditionPathExists=/dev/qcom_rmtfs_mem1
 
 [Service]
-ExecStart=/usr/comma/wifi.sh
+ExecStart=/usr/bin/rmtfs -P -s
+Restart=always
+RestartSec=1
 
 [Install]
 WantedBy=multi-user.target
diff --git a/userspace/root/usr/share/doc/mainline-firmware/NOTICE-SHA256SUMS b/userspace/root/usr/share/doc/mainline-firmware/NOTICE-SHA256SUMS
new file mode 100644
index 0000000..072579c
--- /dev/null
+++ b/userspace/root/usr/share/doc/mainline-firmware/NOTICE-SHA256SUMS
@@ -0,0 +1,4 @@
+337a55102138d7baa143ee4a4c6c91693e0113fece35d380b2a12109e8c23b3f  licenses/LICENSE.QualcommAtheros_ath10k
+be904cd28cb292b80cdb6cf412ab0d9159d431671e987ad433c1f62e0988a9bc  licenses/LICENSE.qcom
+fa43e1b9a13b341a07adca9dbe73d0f9072d7966fdfe811c01f0dd2872d7309a  licenses/NOTICE.qcom
+678b0df753c86198fc496d1f1033429bbd57f101472132ee7eaaf9f5e0a7fae1  licenses/wireless-regdb-LICENSE
diff --git a/userspace/root/usr/share/doc/mainline-firmware/README b/userspace/root/usr/share/doc/mainline-firmware/README
new file mode 100644
index 0000000..292feb0
--- /dev/null
+++ b/userspace/root/usr/share/doc/mainline-firmware/README
@@ -0,0 +1,81 @@
+Mainline mici firmware provenance
+================================
+
+SOURCES.json identifies the additional firmware used by this port. Every
+listed file was compared byte-for-byte with the specified source revision.
+SHA256SUMS paths are relative to /usr/lib/firmware. To verify an installed
+image:
+
+  cd /usr/lib/firmware
+  sha256sum -c /usr/share/doc/mainline-firmware/SHA256SUMS
+
+These are provenance records, not a replacement license for the firmware.
+The original notices in licenses/ apply only to the files assigned to them
+in SOURCES.json. They do not establish coverage for other similarly named
+blobs, device extracts, or board-data modifications.
+
+Verified upstream distributions
+-------------------------------
+
+Linux-firmware revision 59f9fc2ef8d1e312d2a613d4e1ffad2ff31a0a01:
+https://gitlab.com/kernel-firmware/linux-firmware/-/tree/59f9fc2ef8d1e312d2a613d4e1ffad2ff31a0a01
+
+The revision's WHENCE assigns firmware-5.bin to
+LICENSE.QualcommAtheros_ath10k. It assigns the matching A630 SQE/GMU,
+SDM845 MBA/modem images and ADSP/CDSP/modemuw JSON maps to LICENSE.qcom
+and NOTICE.qcom. The original files are copied unchanged into licenses/.
+The GMU alias resolves to an unchanged file already shipped by AGNOS.
+
+Wireless-regdb revision e05260afb7203dd0a7ba6faf9a30c86faf19a24e:
+https://git.kernel.org/pub/scm/linux/kernel/git/wens/wireless-regdb.git/commit/?id=e05260afb7203dd0a7ba6faf9a30c86faf19a24e
+
+Both regulatory.db and its signature match this revision, tagged
+master-2025-07-10. Its original LICENSE is licenses/wireless-regdb-LICENSE.
+
+Device-specific files whose notice coverage remains unverified
+-------------------------------------------------------------
+
+The following files exactly match commaai/vamos revision
+7626c378c3d5762df673dd14d457631057779d27 under kernel/firmware/:
+https://github.com/commaai/vamos/tree/7626c378c3d5762df673dd14d457631057779d27/kernel/firmware
+
+* ath10k/WCN3990/hw1.0/wlanmdsp.mbn:
+  vamos commit 9869d6e05200cb24ad403da110fc9ec620fe972e identifies it as
+  the device's /firmware/image/wlanmdsp.mbn, version
+  WLAN.HL.2.0.c10-00459-QCAHLSWMTPLZ-1. It differs from the upstream
+  linux-firmware image checked above. No license notice accompanying this
+  device-extracted version was found in the import.
+
+* ath10k/WCN3990/hw1.0/board-2.bin:
+  The same commit appends variant=comma-mici and variant=comma-tizi entries
+  to the generic board container. Their payloads exactly match the
+  pre-existing AGNOS /usr/comma/wlan/bdwlan.b01 and bdwlan.b00, respectively:
+    b01 SHA256 34757421765ee3bf9e57eafe59ea47b7c645918b7699753bcfebe31144ba76e7
+    b00 SHA256 52812b95b0ff0aedd0f9f55e21e80fb39057158d91c0b94845c52a3bbbc48e50
+  The source history identifies the custom board data but does not supply
+  its original redistribution notice. The generic upstream ath10k notice
+  is not asserted to license these modifications.
+
+* qca/crbtfw11.tlv, crbtfw20.tlv, crbtfw21.tlv,
+  crnv11.bin, crnv20.bin and crnv21.bin:
+  vamos commit d38d75f7209c49777cd9b9a47db3b90dc7d2268a imports these six
+  files without an upstream revision or redistribution notice. They were
+  not found as identical files in the linux-firmware revision above.
+
+* qcom/sdm845/modemr.jsn:
+  Imported by vamos commit f6f7978442a1381f6e9458b238061a9a868b366c.
+  This exact path is absent in the checked upstream linux-firmware tree,
+  and the import does not identify a separate notice for it.
+
+Original redistribution notices for these files still need to be located;
+no license coverage is inferred from their names or from other firmware.
+This directory records the unresolved status explicitly.
+
+Existing vendor firmware and runtime calibration
+------------------------------------------------
+
+The existing AGNOS a630_zap.elf is exposed through a mainline-compatible
+symlink. The remaining vendor audio/video firmware is loaded from the
+existing /firmware/image partition. Their redistribution notices have not
+been re-audited by this provenance update; no replacement images are added.
+Panel gamma bytes are generated at boot from each device's persist data.
diff --git a/userspace/root/usr/share/doc/mainline-firmware/SHA256SUMS b/userspace/root/usr/share/doc/mainline-firmware/SHA256SUMS
new file mode 100644
index 0000000..bb65de6
--- /dev/null
+++ b/userspace/root/usr/share/doc/mainline-firmware/SHA256SUMS
@@ -0,0 +1,20 @@
+a6f2b5ba06d33bae9d0ec525b84b267ff0a26f4fde4e96a5b586e73096cfd769  ath10k/WCN3990/hw1.0/board-2.bin
+fef6539e0127579536bc977be57a90d018b83f2931fedc3a8870fbe38d6c4127  ath10k/WCN3990/hw1.0/firmware-5.bin
+aa7a7b3ef5e4c43a242e7bca199b1bb358c1111ddfc39dcdecd9eba7473feb31  ath10k/WCN3990/hw1.0/wlanmdsp.mbn
+d6532b99875890fb7969874ff6e904939ca0d6f2d2bd1e1fd3ae86470bebc9f5  qca/crbtfw11.tlv
+d9afa5d9facd528f437e83bcc8147681afd432296ebbba5e77904c13fab28209  qca/crbtfw20.tlv
+2a42859081393ca6a50a177773385eac4fcabb9f21fc1b78299ed35bf8a598c4  qca/crbtfw21.tlv
+206deb651dcfd187d1fd39f1f064af20324d1b4e28dcd72f5ed23bb8ef605d00  qca/crnv11.bin
+6c96fe067860a79813b466a1d4644dc2748a4191b21a986a44d2cc0fe6ccaca7  qca/crnv20.bin
+18cc38fff25a6a56bc163f1874184da93d90882dc047c9f0c534ed9888c543b3  qca/crnv21.bin
+da8d9b1b1f5c1a0b311f32567093b4828f3c80031dd8435f91ac13c664e173a6  qcom/a630_gmu.bin
+1c21b527d9183487cc550dabbb3f43e555df5a977a461934fc61f0635a9aa90c  qcom/a630_sqe.fw
+4781dc9312fa017b0e611c752dae2183c0f205af8300b28417a496dae511b0a5  qcom/sdm845/adspr.jsn
+d6c6376f53e5449eb4f7b9e5a30679ebc2a9afaad28c13ff171f979e7b1af1f6  qcom/sdm845/adspua.jsn
+15e148599165b38f68e62302d63c87caa5f0b164deb81aa419bbb4ecf920bc4b  qcom/sdm845/cdspr.jsn
+42f36f2a8bd1c3cfb10f03c7f34e7e31a699cc6d4fb21dc87c4321277d94f87e  qcom/sdm845/mba.mbn
+f4d4963d7f6ccaeee4245f3c647b0544e2a7b4bcba297198dd0dea180fbeab1a  qcom/sdm845/modem_nm.mbn
+a94b089b03820c03fc395cac2aa18dd52ee806de53f18eeb2e7eb10bfb28aaf0  qcom/sdm845/modemr.jsn
+e75d94b61df3e86c5b3f7a976d93f726cb85f2b897a8ea80a0924b9bb9c1a3bf  qcom/sdm845/modemuw.jsn
+872b1654f84b09d70bb5c63248dbafd757aa4ac0ead2170d1cb2747892e8d37a  regulatory.db
+ee7c528c844b4c24753d0b4673b533052bf4d8a8493e7f62d25ba7ca328a32e3  regulatory.db.p7s
diff --git a/userspace/root/usr/share/doc/mainline-firmware/SOURCES.json b/userspace/root/usr/share/doc/mainline-firmware/SOURCES.json
new file mode 100644
index 0000000..3b5cb02
--- /dev/null
+++ b/userspace/root/usr/share/doc/mainline-firmware/SOURCES.json
@@ -0,0 +1,238 @@
+{
+  "format_version": 1,
+  "firmware_root": "/usr/lib/firmware",
+  "verification": "SHA256SUMS paths are relative to firmware_root. Source revisions were compared byte-for-byte; license assignments use upstream WHENCE. See README for unresolved notices.",
+  "files": [
+    {
+      "path": "ath10k/WCN3990/hw1.0/board-2.bin",
+      "sha256": "a6f2b5ba06d33bae9d0ec525b84b267ff0a26f4fde4e96a5b586e73096cfd769",
+      "source_repository": "https://github.com/commaai/vamos",
+      "source_revision": "7626c378c3d5762df673dd14d457631057779d27",
+      "source_path": "kernel/firmware/ath10k/WCN3990/hw1.0/board-2.bin",
+      "license_status": "unverified-see-README",
+      "import_commit": "9869d6e05200cb24ad403da110fc9ec620fe972e"
+    },
+    {
+      "path": "ath10k/WCN3990/hw1.0/firmware-5.bin",
+      "sha256": "fef6539e0127579536bc977be57a90d018b83f2931fedc3a8870fbe38d6c4127",
+      "source_repository": "https://gitlab.com/kernel-firmware/linux-firmware",
+      "source_revision": "59f9fc2ef8d1e312d2a613d4e1ffad2ff31a0a01",
+      "source_path": "ath10k/WCN3990/hw1.0/firmware-5.bin",
+      "license_status": "verified-upstream-WHENCE",
+      "license_files": [
+        "licenses/LICENSE.QualcommAtheros_ath10k"
+      ]
+    },
+    {
+      "path": "ath10k/WCN3990/hw1.0/wlanmdsp.mbn",
+      "sha256": "aa7a7b3ef5e4c43a242e7bca199b1bb358c1111ddfc39dcdecd9eba7473feb31",
+      "source_repository": "https://github.com/commaai/vamos",
+      "source_revision": "7626c378c3d5762df673dd14d457631057779d27",
+      "source_path": "kernel/firmware/ath10k/WCN3990/hw1.0/wlanmdsp.mbn",
+      "license_status": "unverified-see-README",
+      "import_commit": "9869d6e05200cb24ad403da110fc9ec620fe972e"
+    },
+    {
+      "path": "qca/crbtfw11.tlv",
+      "sha256": "d6532b99875890fb7969874ff6e904939ca0d6f2d2bd1e1fd3ae86470bebc9f5",
+      "source_repository": "https://github.com/commaai/vamos",
+      "source_revision": "7626c378c3d5762df673dd14d457631057779d27",
+      "source_path": "kernel/firmware/qca/crbtfw11.tlv",
+      "license_status": "unverified-see-README",
+      "import_commit": "d38d75f7209c49777cd9b9a47db3b90dc7d2268a"
+    },
+    {
+      "path": "qca/crbtfw20.tlv",
+      "sha256": "d9afa5d9facd528f437e83bcc8147681afd432296ebbba5e77904c13fab28209",
+      "source_repository": "https://github.com/commaai/vamos",
+      "source_revision": "7626c378c3d5762df673dd14d457631057779d27",
+      "source_path": "kernel/firmware/qca/crbtfw20.tlv",
+      "license_status": "unverified-see-README",
+      "import_commit": "d38d75f7209c49777cd9b9a47db3b90dc7d2268a"
+    },
+    {
+      "path": "qca/crbtfw21.tlv",
+      "sha256": "2a42859081393ca6a50a177773385eac4fcabb9f21fc1b78299ed35bf8a598c4",
+      "source_repository": "https://github.com/commaai/vamos",
+      "source_revision": "7626c378c3d5762df673dd14d457631057779d27",
+      "source_path": "kernel/firmware/qca/crbtfw21.tlv",
+      "license_status": "unverified-see-README",
+      "import_commit": "d38d75f7209c49777cd9b9a47db3b90dc7d2268a"
+    },
+    {
+      "path": "qca/crnv11.bin",
+      "sha256": "206deb651dcfd187d1fd39f1f064af20324d1b4e28dcd72f5ed23bb8ef605d00",
+      "source_repository": "https://github.com/commaai/vamos",
+      "source_revision": "7626c378c3d5762df673dd14d457631057779d27",
+      "source_path": "kernel/firmware/qca/crnv11.bin",
+      "license_status": "unverified-see-README",
+      "import_commit": "d38d75f7209c49777cd9b9a47db3b90dc7d2268a"
+    },
+    {
+      "path": "qca/crnv20.bin",
+      "sha256": "6c96fe067860a79813b466a1d4644dc2748a4191b21a986a44d2cc0fe6ccaca7",
+      "source_repository": "https://github.com/commaai/vamos",
+      "source_revision": "7626c378c3d5762df673dd14d457631057779d27",
+      "source_path": "kernel/firmware/qca/crnv20.bin",
+      "license_status": "unverified-see-README",
+      "import_commit": "d38d75f7209c49777cd9b9a47db3b90dc7d2268a"
+    },
+    {
+      "path": "qca/crnv21.bin",
+      "sha256": "18cc38fff25a6a56bc163f1874184da93d90882dc047c9f0c534ed9888c543b3",
+      "source_repository": "https://github.com/commaai/vamos",
+      "source_revision": "7626c378c3d5762df673dd14d457631057779d27",
+      "source_path": "kernel/firmware/qca/crnv21.bin",
+      "license_status": "unverified-see-README",
+      "import_commit": "d38d75f7209c49777cd9b9a47db3b90dc7d2268a"
+    },
+    {
+      "path": "qcom/a630_gmu.bin",
+      "sha256": "da8d9b1b1f5c1a0b311f32567093b4828f3c80031dd8435f91ac13c664e173a6",
+      "symlink_target": "../a630_gmu.bin",
+      "source_repository": "https://gitlab.com/kernel-firmware/linux-firmware",
+      "source_revision": "59f9fc2ef8d1e312d2a613d4e1ffad2ff31a0a01",
+      "source_path": "qcom/a630_gmu.bin",
+      "license_status": "verified-upstream-WHENCE",
+      "license_files": [
+        "licenses/LICENSE.qcom",
+        "licenses/NOTICE.qcom"
+      ]
+    },
+    {
+      "path": "qcom/a630_sqe.fw",
+      "sha256": "1c21b527d9183487cc550dabbb3f43e555df5a977a461934fc61f0635a9aa90c",
+      "source_repository": "https://gitlab.com/kernel-firmware/linux-firmware",
+      "source_revision": "59f9fc2ef8d1e312d2a613d4e1ffad2ff31a0a01",
+      "source_path": "qcom/a630_sqe.fw",
+      "license_status": "verified-upstream-WHENCE",
+      "license_files": [
+        "licenses/LICENSE.qcom",
+        "licenses/NOTICE.qcom"
+      ]
+    },
+    {
+      "path": "qcom/sdm845/adspr.jsn",
+      "sha256": "4781dc9312fa017b0e611c752dae2183c0f205af8300b28417a496dae511b0a5",
+      "source_repository": "https://gitlab.com/kernel-firmware/linux-firmware",
+      "source_revision": "59f9fc2ef8d1e312d2a613d4e1ffad2ff31a0a01",
+      "source_path": "qcom/sdm845/adspr.jsn",
+      "license_status": "verified-upstream-WHENCE",
+      "license_files": [
+        "licenses/LICENSE.qcom",
+        "licenses/NOTICE.qcom"
+      ]
+    },
+    {
+      "path": "qcom/sdm845/adspua.jsn",
+      "sha256": "d6c6376f53e5449eb4f7b9e5a30679ebc2a9afaad28c13ff171f979e7b1af1f6",
+      "source_repository": "https://gitlab.com/kernel-firmware/linux-firmware",
+      "source_revision": "59f9fc2ef8d1e312d2a613d4e1ffad2ff31a0a01",
+      "source_path": "qcom/sdm845/adspua.jsn",
+      "license_status": "verified-upstream-WHENCE",
+      "license_files": [
+        "licenses/LICENSE.qcom",
+        "licenses/NOTICE.qcom"
+      ]
+    },
+    {
+      "path": "qcom/sdm845/cdspr.jsn",
+      "sha256": "15e148599165b38f68e62302d63c87caa5f0b164deb81aa419bbb4ecf920bc4b",
+      "source_repository": "https://gitlab.com/kernel-firmware/linux-firmware",
+      "source_revision": "59f9fc2ef8d1e312d2a613d4e1ffad2ff31a0a01",
+      "source_path": "qcom/sdm845/cdspr.jsn",
+      "license_status": "verified-upstream-WHENCE",
+      "license_files": [
+        "licenses/LICENSE.qcom",
+        "licenses/NOTICE.qcom"
+      ]
+    },
+    {
+      "path": "qcom/sdm845/mba.mbn",
+      "sha256": "42f36f2a8bd1c3cfb10f03c7f34e7e31a699cc6d4fb21dc87c4321277d94f87e",
+      "source_repository": "https://gitlab.com/kernel-firmware/linux-firmware",
+      "source_revision": "59f9fc2ef8d1e312d2a613d4e1ffad2ff31a0a01",
+      "source_path": "qcom/sdm845/mba.mbn",
+      "license_status": "verified-upstream-WHENCE",
+      "license_files": [
+        "licenses/LICENSE.qcom",
+        "licenses/NOTICE.qcom"
+      ]
+    },
+    {
+      "path": "qcom/sdm845/modem_nm.mbn",
+      "sha256": "f4d4963d7f6ccaeee4245f3c647b0544e2a7b4bcba297198dd0dea180fbeab1a",
+      "source_repository": "https://gitlab.com/kernel-firmware/linux-firmware",
+      "source_revision": "59f9fc2ef8d1e312d2a613d4e1ffad2ff31a0a01",
+      "source_path": "qcom/sdm845/modem_nm.mbn",
+      "license_status": "verified-upstream-WHENCE",
+      "license_files": [
+        "licenses/LICENSE.qcom",
+        "licenses/NOTICE.qcom"
+      ]
+    },
+    {
+      "path": "qcom/sdm845/modemr.jsn",
+      "sha256": "a94b089b03820c03fc395cac2aa18dd52ee806de53f18eeb2e7eb10bfb28aaf0",
+      "source_repository": "https://github.com/commaai/vamos",
+      "source_revision": "7626c378c3d5762df673dd14d457631057779d27",
+      "source_path": "kernel/firmware/qcom/sdm845/modemr.jsn",
+      "license_status": "unverified-see-README",
+      "import_commit": "f6f7978442a1381f6e9458b238061a9a868b366c"
+    },
+    {
+      "path": "qcom/sdm845/modemuw.jsn",
+      "sha256": "e75d94b61df3e86c5b3f7a976d93f726cb85f2b897a8ea80a0924b9bb9c1a3bf",
+      "source_repository": "https://gitlab.com/kernel-firmware/linux-firmware",
+      "source_revision": "59f9fc2ef8d1e312d2a613d4e1ffad2ff31a0a01",
+      "source_path": "qcom/sdm845/modemuw.jsn",
+      "license_status": "verified-upstream-WHENCE",
+      "license_files": [
+        "licenses/LICENSE.qcom",
+        "licenses/NOTICE.qcom"
+      ]
+    },
+    {
+      "path": "regulatory.db",
+      "sha256": "872b1654f84b09d70bb5c63248dbafd757aa4ac0ead2170d1cb2747892e8d37a",
+      "source_repository": "https://git.kernel.org/pub/scm/linux/kernel/git/wens/wireless-regdb.git",
+      "source_revision": "e05260afb7203dd0a7ba6faf9a30c86faf19a24e",
+      "source_path": "regulatory.db",
+      "license_status": "verified-upstream",
+      "license_files": [
+        "licenses/wireless-regdb-LICENSE"
+      ]
+    },
+    {
+      "path": "regulatory.db.p7s",
+      "sha256": "ee7c528c844b4c24753d0b4673b533052bf4d8a8493e7f62d25ba7ca328a32e3",
+      "source_repository": "https://git.kernel.org/pub/scm/linux/kernel/git/wens/wireless-regdb.git",
+      "source_revision": "e05260afb7203dd0a7ba6faf9a30c86faf19a24e",
+      "source_path": "regulatory.db.p7s",
+      "license_status": "verified-upstream",
+      "license_files": [
+        "licenses/wireless-regdb-LICENSE"
+      ]
+    }
+  ],
+  "aliases": [
+    {
+      "path": "qcom/sdm845/wlanmdsp.mbn",
+      "target": "../../ath10k/WCN3990/hw1.0/wlanmdsp.mbn",
+      "license_status": "same-as-target"
+    },
+    {
+      "path": "qcom/sdm845/a630_zap.mbn",
+      "target": "../../a630_zap.elf",
+      "source_repository": "https://github.com/commaai/agnos-builder",
+      "source_revision": "f668ca88a05d71abed957f8cd79d04b03544fd00",
+      "source_path": "userspace/root/usr/lib/firmware/a630_zap.elf",
+      "license_status": "pre-existing-AGNOS-file-not-re-audited"
+    },
+    {
+      "path": "comma/dwo-do0200fat07-gamma.bin",
+      "target": "/run/panel-firmware/dwo-do0200fat07-gamma.bin",
+      "source": "Generated per device from /persist/comma/dwo_gamma_curves by /usr/comma/screen_calibration.py; no calibration bytes shipped here."
+    }
+  ]
+}
diff --git a/userspace/root/usr/share/doc/mainline-firmware/licenses/LICENSE.QualcommAtheros_ath10k b/userspace/root/usr/share/doc/mainline-firmware/licenses/LICENSE.QualcommAtheros_ath10k
new file mode 100644
index 0000000..c68935c
--- /dev/null
+++ b/userspace/root/usr/share/doc/mainline-firmware/licenses/LICENSE.QualcommAtheros_ath10k
@@ -0,0 +1,47 @@
+Copyright (c) 2015-2017, Qualcomm Atheros, Inc.
+All rights reserved.
+
+Redistribution. Reproduction and redistribution in binary form, without
+modification, for use solely in conjunction with a Qualcomm Atheros, Inc.
+chipset, is permitted provided that the following conditions are met:
+
+  • Redistributions must reproduce the above copyright notice and the following
+    disclaimer in the documentation and/or other materials provided with the
+    distribution.
+
+  • Neither the name of Qualcomm Atheros, Inc. nor the names of its suppliers
+    may be used to endorse or promote products derived from this Software
+    without specific prior written permission.
+
+  • No reverse engineering, decompilation, or disassembly of this Software is
+    permitted.
+
+Limited patent license. Qualcomm Atheros, Inc. (“Licensor”) grants you
+(“Licensee”) a limited, worldwide, royalty-free, non-exclusive license under
+the Patents to make, have made, use, import, offer to sell and sell the
+Software. No hardware per se is licensed hereunder.
+The term “Patents” as used in this agreement means only those patents or patent
+applications owned solely and exclusively by Licensor as of the date of
+Licensor’s submission of the Software and any patents deriving priority (i.e.,
+having a first effective filing date) therefrom. The term “Software” as used in
+this agreement means the firmware image submitted by Licensor, under the terms
+of this license, to git://git.kernel.org/pub/scm/linux/kernel/git/firmware/
+linux-firmware.git.
+Notwithstanding anything to the contrary herein, Licensor does not grant and
+Licensee does not receive, by virtue of this agreement or the Licensor’s
+submission of any Software, any license or other rights under any patent or
+patent application owned by any affiliate of Licensor or any other entity
+(other than Licensor), whether expressly, impliedly, by virtue of estoppel or
+exhaustion, or otherwise.
+
+DISCLAIMER. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
+BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/userspace/root/usr/share/doc/mainline-firmware/licenses/LICENSE.qcom b/userspace/root/usr/share/doc/mainline-firmware/licenses/LICENSE.qcom
new file mode 100644
index 0000000..faacf9c
--- /dev/null
+++ b/userspace/root/usr/share/doc/mainline-firmware/licenses/LICENSE.qcom
@@ -0,0 +1,206 @@
+PLEASE READ THIS LICENSE AGREEMENT ("AGREEMENT") CAREFULLY.  THIS AGREEMENT IS
+A BINDING LEGAL AGREEMENT ENTERED INTO BY AND BETWEEN YOU (OR IF YOU ARE
+ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, THEN THE ENTITY THAT YOU
+REPRESENT) AND QUALCOMM TECHNOLOGIES, INC. ("QTI" "WE" "OUR" OR "US").  THIS IS
+THE AGREEMENT THAT APPLIES TO YOUR USE OF THE DESIGNATED AND/OR LINKED
+APPLICATIONS, THE ENCLOSED QUALCOMM TECHNOLOGIES' MATERIALS, INCLUDING RELATED
+DOCUMENTATION AND ANY UPDATES OR IMPROVEMENTS THEREOF
+(COLLECTIVELY, "MATERIALS").  BY USING OR COMPLETING THE INSTALLATION OF THE
+MATERIALS, YOU ARE ACCEPTING THIS AGREEMENT AND YOU AGREE TO BE BOUND BY ITS
+TERMS AND CONDITIONS.  IF YOU DO NOT AGREE TO THESE TERMS, QTI IS UNWILLING TO
+AND DOES NOT LICENSE THE MATERIALS TO YOU. IF YOU DO NOT AGREE TO THESE TERMS
+YOU MUST DISCONTINUE THE INSTALLATION PROCESS AND YOU MAY NOT USE THE MATERIALS
+OR RETAIN ANY COPIES OF THE MATERIALS. ANY USE OR POSSESSION OF THE MATERIALS
+BY YOU IS SUBJECT TO THE TERMS AND CONDITIONS SET FORTH IN THIS AGREEMENT.
+
+1. RIGHT TO USE DELIVERABLES; RESTRICTIONS.
+
+  1.1 License.  Subject to the terms and conditions of this Agreement,
+  including, without limitation, the restrictions, conditions, limitations and
+  exclusions set forth in this Agreement, QTI hereby grants to you a
+  nonexclusive, limited license under QTI's copyrights to:  (i) install and use
+  the Materials; and (ii) to reproduce and redistribute the binary code portions
+  of the Materials (the "Redistributable Binary Code").  You may make and use a
+  reasonable number of copies of any documentation.
+
+  1.2 Redistribution Restrictions.  Distribution of the Redistributable Binary
+  Code is subject to the following restrictions: (i) Redistributable Binary Code
+  may only be distributed in binary format and may not be distributed in source
+  code format:; (ii)  the Redistributable Binary Code may only operate in
+  conjunction with platforms incorporating Qualcomm Technologies, Inc. chipsets;
+  (iii) redistribution of the Redistributable Binary Code must include the .txt
+  file setting forth the terms and condition of this Agreement; (iv) you may not
+  use Qualcomm Technologies' or its affiliates or subsidiaries name, logo or
+  trademarks; and (v) copyright, trademark, patent and any other notices that
+  appear on the Materials may not be removed or obscured.
+
+  1.3 Additional Restrictions.  Except as expressly permitted by this Agreement,
+  you shall have no right to sublicense, transfer or otherwise disclose the
+  Materials to any third party.  You shall not reverse engineer, reverse
+  assemble, reverse translate, decompile or reduce to source code form any
+  portion of the Materials provided in object code form or executable form.
+  Except for the purposes expressly permitted in this Agreement, You shall not
+  use the Materials for any other purpose.  QTI (or its licensors) shall retain
+  title and all ownership rights in and to the Materials and any alterations,
+  modifications (including all derivative works), translations or adaptations
+  made of the Materials, and all copies thereof, and nothing herein shall be
+  deemed to grant any right to You under any of QTI's or its affiliates'
+  patents.  You shall not subject the Materials to any third party license
+  terms (e.g., open source license terms).  You shall not use the Materials for
+  the purpose of identifying or providing evidence to support any potential
+  patent infringement claim against QTI, its affiliates, or any of QTI's or
+  QTI's affiliates' suppliers and/or direct or indirect customers.  QTI hereby
+  reserves all rights not expressly granted herein.
+
+  1.4 Third Party Software and Materials.  The Software may contain or link to
+  certain software and/or materials that are written or owned by third parties.
+  Such third party code and materials may be licensed under separate or
+  different terms and conditions and are not licensed to you under the terms of
+  this Agreement.  You agree to comply with all terms and conditions imposed on
+  you in the applicable third party licenses.  Such terms and conditions may
+  impose certain obligations on you as a condition to the permitted use of such
+  third party code and materials.  QTI does not represent or warrant that such
+  third party licensors have or will continue to license or make available their
+  code and materials to you.
+
+  1.5 Feedback.  QTI may from time to time receive suggestions, feedback or
+  other information from You regarding the Materials.  Any suggestions, feedback
+  or other disclosures received from You are and shall be entirely voluntary on
+  the part of You.  Notwithstanding any other term in this Agreement, QTI shall
+  be free to use suggestions, feedback or other information received from You,
+  without obligation of any kind to You.  The Parties agree that all inventions,
+  product improvements, and modifications conceived of or made by QTI that are
+  based, either in whole or in part, on ideas, feedback, suggestions, or
+  recommended improvements received from You are the exclusive property of QTI,
+  and all right, title and interest in and to any such inventions, product
+  improvements, and modifications will vest solely in QTI.
+
+  1.6 No Technical Support.  QTI is under no obligation to provide any form of
+  technical support for the Materials, and if QTI, in its sole discretion,
+  chooses to provide any form of support or information relating to the
+  Materials, such support and information shall be deemed confidential and
+  proprietary to QTI.
+
+2. WARRANTY DISCLAIMER.  YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT THE USE OF
+THE MATERIALS IS AT YOUR SOLE RISK.  THE MATERIALS AND TECHNICAL SUPPORT, IF
+ANY, ARE PROVIDED "AS IS" AND WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS OR
+IMPLIED.  QTI ITS LICENSORS AND AFFILIATES MAKE NO WARRANTIES, EXPRESS OR
+IMPLIED, WITH RESPECT TO THE MATERIALS OR ANY OTHER INFORMATION OR DOCUMENTATION
+PROVIDED UNDER THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTY OF
+MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR AGAINST INFRINGEMENT, OR
+ANY EXPRESS OR IMPLIED WARRANTY ARISING OUT OF TRADE USAGE OR OUT OF A COURSE OF
+DEALING OR COURSE OF PERFORMANCE.  NOTHING CONTAINED IN THIS AGREEMENT SHALL BE
+CONSTRUED AS (I) A WARRANTY OR REPRESENTATION BY QTI, ITS LICENSORS OR
+AFFILIATES AS TO THE VALIDITY OR SCOPE OF ANY PATENT, COPYRIGHT OR OTHER
+INTELLECTUAL PROPERTY RIGHT OR (II) A WARRANTY OR REPRESENTATION BY QTI THAT ANY
+MANUFACTURE OR USE WILL BE FREE FROM INFRINGEMENT OF PATENTS, COPYRIGHTS OR
+OTHER INTELLECTUAL PROPERTY RIGHTS OF OTHERS, AND IT SHALL BE THE SOLE
+RESPONSIBILITY OF YOU TO MAKE SUCH DETERMINATION AS IS NECESSARY WITH RESPECT TO
+THE ACQUISITION OF LICENSES UNDER PATENTS AND OTHER INTELLECTUAL PROPERTY OF
+THIRD PARTIES.
+
+3. NO OTHER LICENSES OR INTELLECTUAL PROPERTY RIGHTS. Neither this Agreement,
+nor any act by QTI or any of its affiliates pursuant to this Agreement or
+relating to the Materials (including, without limitation, the provision by QTI
+or its affiliates of the Materials), shall provide to You any license or any
+other rights whatsoever under any patents, trademarks, trade secrets, copyrights
+or any other intellectual property of QTI or any of its affiliates, except for
+the copyright rights expressly licensed under this Agreement. You understand and
+agree that:
+
+  (i) Neither this Agreement, nor delivery of the Materials, grants any right to
+  practice, or any other right at all with respect to, any patent of QTI or any
+  of its affiliates; and
+
+  (ii) A separate license agreement from QUALCOMM Incorporated is needed to use
+  or practice any patent of QUALCOMM Incorporated. You agree not to contend in
+  any context that, as a result of the provision or use of the Materials, either
+  QTI or any of its affiliates has any obligation to extend, or You or any other
+  party has obtained any right to, any license, whether express or implied, with
+  respect to any patent of QTI or any of its affiliates for any purpose.
+
+4. TERMINATION.  This Agreement shall be effective upon acceptance, or access or
+use of the Materials (whichever occurs first) by You and shall continue until
+terminated. You may terminate the Agreement at any time by deleting and
+destroying all copies of the Materials and all related information in Your
+possession or control. This Agreement terminates immediately and automatically,
+with or without notice, if You fail to comply with any provision hereof.
+Additionally, QTI may at any time terminate this Agreement, without cause, upon
+notice to You. Upon termination You must, to the extent possible, delete or
+destroy all copies of the Materials in Your possession and the license granted
+to You in this Agreement shall terminate. Sections 1.2 through 10 shall survive
+the termination of this Agreement. In the event that any restrictions,
+conditions, limitations are found to be either invalid or unenforceable, the
+rights granted to You in Section 1 (License) shall be null, void and ineffective
+from the Effective Date, and QTI shall also have the right to terminate this
+Agreement immediately, and with retroactive effect to the effective date.
+
+5. LIMITATION OF LIABILITY.  IN NO EVENT SHALL QTI, QTI's AFFILIATES OR ITS
+LICENSORS BE LIABLE TO YOU FOR ANY INCIDENTAL, CONSEQUENTIAL OR SPECIAL DAMAGES,
+INCLUDING BUT NOT LIMITED TO ANY LOST PROFITS, LOST SAVINGS, OR OTHER INCIDENTAL
+DAMAGES, ARISING OUT OF THE USE OR INABILITY TO USE, OR THE DELIVERY OR FAILURE
+TO DELIVER, ANY OF THE DELIVERABLES, OR ANY BREACH OF ANY OBLIGATION UNDER THIS
+AGREEMENT, EVEN IF QTI HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+THE FOREGOING LIMITATION OF LIABILITY SHALL REMAIN IN FULL FORCE AND EFFECT
+REGARDLESS OF WHETHER YOUR REMEDIES HEREUNDER ARE DETERMINED TO HAVE FAILED OF
+THEIR ESSENTIAL PURPOSE.  THE ENTIRE LIABILITY OF QTI, QTI's AFFILIATES AND ITS
+LICENSORS, AND THE SOLE AND EXCLUSIVE REMEDY OF YOU, FOR ANY CLAIM OR CAUSE OF
+ACTION ARISING HEREUNDER (WHETHER IN CONTRACT, TORT, OR OTHERWISE) SHALL NOT
+EXCEED US$50.
+
+6. INDEMNIFICATION.  You agree to indemnify and hold harmless QTI and its
+officers, directors, employees and successors and assigns against any and all
+third party claims, demands, causes of action, losses, liabilities, damages,
+costs and expenses, incurred by QTI (including but not limited to costs of
+defense, investigation and reasonable attorney's fees) arising out of, resulting
+from or related to: (i) any breach of this Agreement by You; and (ii) your acts,
+omissions, products and services.  If requested by QTI, You agree to defend QTI
+in connection with any third party claims, demands, or causes of action
+resulting from, arising out of or in connection with any of the foregoing.
+
+7. ASSIGNMENT.  You shall not assign this Agreement or any right or interest
+under this Agreement, nor delegate any obligation to be performed under this
+Agreement, without QTI's prior written consent.  For purposes of this Section 7,
+an "assignment" by You under this Section shall be deemed to include, without
+limitation, any merger, consolidation, sale of all or substantially all of its
+assets, or any substantial change in the management or control of You.
+Any attempted assignment in contravention of this Section 9 shall be void.
+QTI may freely assign this Agreement or delegate any or all of its rights and
+obligations hereunder to any third party.
+
+8. COMPLIANCE WITH LAWS; APPLICABLE LAW.  You agree to comply with all
+applicable local, international and national laws and regulations and with U.S.
+Export Administration Regulations, as they apply to the subject matter of this
+Agreement.  This Agreement is governed by the laws of the State of California,
+excluding California's choice of law rules.
+
+9. CONTRACTING PARTIES.  If the Materials are downloaded on any computer owned
+by a corporation or other legal entity, then this Agreement is formed by and
+between QTI and such entity.  The individual accepting the terms of this
+Agreement represents and warrants to QTI that they have the authority to bind
+such entity to the terms and conditions of this Agreement.
+
+10. MISCELLANEOUS PROVISIONS.  This Agreement, together with all exhibits
+attached hereto, which are incorporated herein by this reference, constitutes
+the entire agreement between QTI and You and supersedes all prior negotiations,
+representations and agreements between the parties with respect to the subject
+matter hereof.  No addition or modification of this Agreement shall be effective
+unless made in writing and signed by the respective representatives of QTI and
+You.  The restrictions, limitations, exclusions and conditions set forth in this
+Agreement shall apply even if QTI or any of its affiliates becomes aware of or
+fails to act in a manner to address any violation or failure to comply
+therewith.  You hereby acknowledge and agree that the restrictions, limitations,
+conditions and exclusions imposed in this Agreement on the rights granted in
+this Agreement are not a derogation of the benefits of such rights.  You further
+acknowledges that, in the absence of such restrictions, limitations, conditions
+and exclusions, QTI would not have entered into this Agreement with You.  Each
+party shall be responsible for and shall bear its own expenses in connection
+with this Agreement.  If any of the provisions of this Agreement are determined
+to be invalid, illegal, or otherwise unenforceable, the remaining provisions
+shall remain in full force and effect.  This Agreement is entered into solely
+in the English language, and if for any reason any other language version is
+prepared by any party, it shall be solely for convenience and the English
+version shall govern and control all aspects.  If You are located in the
+province of Quebec, Canada, the following applies: The Parties hereby confirm
+they have requested this Agreement and all related documents be prepared
+in English.
diff --git a/userspace/root/usr/share/doc/mainline-firmware/licenses/NOTICE.qcom b/userspace/root/usr/share/doc/mainline-firmware/licenses/NOTICE.qcom
new file mode 100644
index 0000000..184f88f
--- /dev/null
+++ b/userspace/root/usr/share/doc/mainline-firmware/licenses/NOTICE.qcom
@@ -0,0 +1,506 @@
+This NOTICE.txt file contains certain notices Qualcomm Technologies, Inc. ("QTI")
+is required to provide with certain software components. Notwithstanding anything
+in the notices in this file, your use of such software components together with
+the QTI software ("Software") is subject to the terms of your separate license
+from QTI. Compliance with all copyright laws and software licenses included in
+this file are the responsibility of the user. Except as may be granted by
+separate express written agreement, this file provides no license to any
+patents, trademarks, copyrights, or other intellectual property of QTI or its
+affiliates.
+Software provided with this notice is NOT A CONTRIBUTION to any open source
+project. If alternative licensing is available for any of the components with
+licenses or attributions provided below, a license choice is made for receiving
+such code by QTI.
+
+Copyright (c) 2013-2017 Qualcomm Technologies, Inc. All rights reserved.
+
+Qualcomm is a trademark of Qualcomm Incorporated, registered in the
+United States and other countries. All Qualcomm Incorporated trademarks are used
+with permission. Other products and brand names may be trademarks or registered
+trademarks of their respective owners.
+
+
+  LICENSE ISSUES
+  ==============
+
+  The OpenSSL toolkit stays under a dual license, i.e. both the conditions of
+  the OpenSSL License and the original SSLeay license apply to the toolkit.
+  See below for the actual license texts. Actually both licenses are BSD-style
+  Open Source licenses. In case of any license issues related to OpenSSL
+  please contact openssl-core@openssl.org.
+
+  OpenSSL License
+  ---------------
+
+/* ====================================================================
+ * Copyright (c) 1998-2011 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+ Original SSLeay License
+ -----------------------
+
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+
+------------------------------------------------------------------------------
+------------------------------------------------------------------------------
+
+/* ====================================================================
+ * Copyright (C) 1995-2005 Jean-loup Gailly
+ * Copyright (C) 1995-2009 Mark Adler
+ * Copyright (C) 1995-2003, 2010 Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+
+ /* zlib.h -- interface of the 'zlib' general purpose compression library
+  version 1.2.3, July 18th, 2005
+
+  Copyright (C) 1995-2005 Jean-loup Gailly and Mark Adler
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+  Jean-loup Gailly        Mark Adler
+  jloup@gzip.org          madler@alumni.caltech.edu
+
+
+  The data format used by the zlib library is described by RFCs (Request for
+  Comments) 1950 to 1952 in the files http://www.ietf.org/rfc/rfc1950.txt
+  (zlib format), rfc1951.txt (deflate format) and rfc1952.txt (gzip format).
+*/
+
+
+------------------------------------------------------------------------------
+
+ //
+// Copyright (c) 2004-2006 Qualphone, Inc. All rights reserved.
+//
+//
+/*
+ * This code implements the MD5 message-digest algorithm.
+ * The algorithm is due to Ron Rivest.	This code was
+ * written by Colin Plumb in 1993, no copyright is claimed.
+ * This code is in the public domain; do with it what you wish.
+ *
+ * Equivalent code is available from RSA Data Security, Inc.
+ * This code has been tested against that, and is equivalent,
+ * except that you don't need to include two pages of legalese
+ * with every copy.
+ *
+ * To compute the message digest of a chunk of bytes, declare an
+ * MD5Context structure, pass it to MD5Init, call MD5Update as
+ * needed on buffers full of bytes, and then call MD5Final, which
+ * will fill a supplied 16-byte array with the digest.
+ */
+
+
+------------------------------------------------------------------------------
+------------------------------------------------------------------------------
+
+
+
+/*
+ * Written by Aaron D. Gifford <me@aarongifford.com>
+ *
+ * Copyright 2000 Aaron D. Gifford.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+------------------------------------------------------------------------------
+------------------------------------------------------------------------------
+
+/*-
+ *  COPYRIGHT (C) 1986 Gary S. Brown.  You may use this program, or
+ *  code or tables extracted from it, as desired without restriction.
+ *
+ *  First, the polynomial itself and its table of feedback terms.  The
+ *  polynomial is
+ *  X^32+X^26+X^23+X^22+X^16+X^12+X^11+X^10+X^8+X^7+X^5+X^4+X^2+X^1+X^0
+ *
+ *  Note that we take it "backwards" and put the highest-order term in
+ *  the lowest-order bit.  The X^32 term is "implied"; the LSB is the
+ *  X^31 term, etc.  The X^0 term (usually shown as "+1") results in
+ *  the MSB being 1
+ *
+ *  Note that the usual hardware shift register implementation, which
+ *  is what we're using (we're merely optimizing it by doing eight-bit
+ *  chunks at a time) shifts bits into the lowest-order term.  In our
+ *  implementation, that means shifting towards the right.  Why do we
+ *  do it this way?  Because the calculated CRC must be transmitted in
+ *  order from highest-order term to lowest-order term.  UARTs transmit
+ *  characters in order from LSB to MSB.  By storing the CRC this way
+ *  we hand it to the UART in the order low-byte to high-byte; the UART
+ *  sends each low-bit to hight-bit; and the result is transmission bit
+ *  by bit from highest- to lowest-order term without requiring any bit
+ *  shuffling on our part.  Reception works similarly
+ *
+ *  The feedback terms table consists of 256, 32-bit entries.  Notes
+ *
+ *      The table can be generated at runtime if desired; code to do so
+ *      is shown later.  It might not be obvious, but the feedback
+ *      terms simply represent the results of eight shift/xor opera
+ *      tions for all combinations of data and CRC register values
+ *
+ *      The values must be right-shifted by eight bits by the "updcrc
+ *      logic; the shift must be unsigned (bring in zeroes).  On some
+ *      hardware you could probably optimize the shift in assembler by
+ *      using byte-swap instructions
+ *      polynomial $edb88320
+ *
+
+
+ ------------------------------------------------------------------------------
+
+ /*
+   The AES algorithm Rijndael implemented for block and key sizes of 128,
+   192 and 256 bits (16, 24 and 32 bytes) by Brian Gladman.
+
+   I retain copyright in this code but I encourage its free use provided
+   that I don't carry any responsibility for the results. I am especially
+   happy to see it used in free and open source software. If you do use
+   it I would appreciate an acknowledgement of its origin in the code or
+   the product that results and I would also appreciate knowing a liitle
+   about the use to which it is being put. I am grateful to Frank Yellin
+   for some ideas that are used in this implementation.
+
+   Dr B. R. Gladman <brg@gladman.uk.net> 1st June 2001.
+
+ ------------------------------------------------------------------------------
+
+ /*
+ * hash_32 - 32 bit Fowler/Noll/Vo hash code
+ *
+ * Fowler/Noll/Vo hash
+ *
+ * Please do not copyright this code.  This code is in the public domain.
+ *
+ * LANDON CURT NOLL DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO
+ * EVENT SHALL LANDON CURT NOLL BE LIABLE FOR ANY SPECIAL, INDIRECT OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
+ * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ *
+ ------------------------------------------------------------------------------
+ /*
+ * sha1.c
+ *
+ * Originally witten by Steve Reid <steve@edmweb.com>
+ *
+ * Modified by Aaron D. Gifford <agifford@infowest.com>
+ *
+ * NO COPYRIGHT - THIS IS 100% IN THE PUBLIC DOMAIN
+ *
+ * The original unmodified version is available at:
+ *    ftp://ftp.funet.fi/pub/crypt/hash/sha/sha1.c
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+------------------------------------------------------------------------------
+
+/*
+ * AES-based functions
+ *
+ * - AES Key Wrap Algorithm (128-bit KEK) (RFC3394)
+ * - One-Key CBC MAC (OMAC1) hash with AES-128
+ * - AES-128 CTR mode encryption
+ * - AES-128 EAX mode encryption/decryption
+ * - AES-128 CBC
+ *
+ * Copyright (c) 2003-2005, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See README and COPYING for more details.
+ */
+ ------------------------------------------------------------------------------
+ /*
+ * SHA1 hash implementation and interface functions
+ * Copyright (c) 2003-2005, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See README and COPYING for more details.
+ */
+ ------------------------------------------------------------------------------
+ /*
+ * hmac_sha1.c
+ *
+ * Version 1.0.0
+ *
+ * Written by Aaron D. Gifford <me@aarongifford.com>
+ *
+ * Copyright 1998, 2000 Aaron D. Gifford.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+------------------------------------------------------------------------------
+------------------------------------------------------------------------------
+
+/*
+* AUTHOR:   Aaron D. Gifford <me@aarongifford.com>
+*
+* Copyright (c) 2000-2001, Aaron D. Gifford
+* All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions
+* are met:
+* 1. Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright
+* notice, this list of conditions and the following disclaimer in the
+* documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of contributors
+* may be used to endorse or promote products derived from this software
+* without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTOR(S) "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTOR(S) BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+* SUCH DAMAGE.
+*/
+
+------------------------------------------------------------------------------
+
+/*
+ * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+ * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+ ------------------------------------------------------------------------------
+
+ /*
+ * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+------------------------------------------------------------------------------
+------------------------------------------------------------------------------
diff --git a/userspace/root/usr/share/doc/mainline-firmware/licenses/wireless-regdb-LICENSE b/userspace/root/usr/share/doc/mainline-firmware/licenses/wireless-regdb-LICENSE
new file mode 100644
index 0000000..652a6dd
--- /dev/null
+++ b/userspace/root/usr/share/doc/mainline-firmware/licenses/wireless-regdb-LICENSE
@@ -0,0 +1,16 @@
+Copyright (c) 2008, Luis R. Rodriguez <mcgrof@gmail.com>
+Copyright (c) 2008, Johannes Berg <johannes@sipsolutions.net>
+Copyright (c) 2008, Michael Green <Michael.Green@Atheros.com>
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
diff --git a/userspace/services.sh b/userspace/services.sh
index 5c20050..24fa5d5 100755
--- a/userspace/services.sh
+++ b/userspace/services.sh
@@ -1,8 +1,5 @@
 #!/bin/bash -e
 
-# Enable DSP services
-systemctl enable cdsp
-
 # Enable our services
 systemctl enable fs_setup.service
 systemctl enable serial-hostname.service
@@ -13,7 +10,9 @@ systemctl enable lte.service
 systemctl enable modem.service
 systemctl enable sound.service
 systemctl enable magic.service
-systemctl enable init-qcom.service
+systemctl enable qrtr.service
+systemctl enable tqftpserv.service
+systemctl enable qcom-firmware.service
 systemctl enable wifi.service
 systemctl enable varwatch.service
 systemctl enable power_monitor.service
diff --git a/userspace/trim.sh b/userspace/trim.sh
index 22e4063..d3af0b5 100755
--- a/userspace/trim.sh
+++ b/userspace/trim.sh
@@ -17,11 +17,9 @@ rm -f /usr/lib/aarch64-linux-gnu/libclang-20.so* $llvm/lib/libclang-20.so* $llvm
   $llvm/bin/{obj2yaml,yaml2obj,llvm-tblgen,llvm-jitlink-executor,lli-child-target,llvm-pdbutil,llvm-exegesis}
 find /usr/bin /usr/local/bin -xtype l -delete
 
-# AGNOS uses Adreno EGL/GLES/GBM. Keep LLVM20 for tinymesa's CPU compiler.
+# Use Ubuntu's Mesa Freedreno driver with the mainline DRM interface.
 lib=/usr/lib/aarch64-linux-gnu
-rm -f "$lib"/libgallium-*.so "$lib"/libEGL_mesa.so* "$lib"/libGLX_mesa.so* "$lib"/libgbm.so.1.0.0
-rm -rf "$lib"/dri "$lib"/gbm
-rm /usr/share/glvnd/egl_vendor.d/50_mesa.json
+rm -f "$lib"/libEGL_adreno.so "$lib"/libGLESv2_adreno.so "$lib"/libgsl.so \
+  "$lib"/libadreno_utils.so "$lib"/libllvm-qcom.so
 
-# Drop the removed libraries from ld.so.cache.
 ldconfig