diff --git a/arch/arm/boot/dts/rk3506-amp.dtsi b/arch/arm/boot/dts/rk3506-amp.dtsi
index bfbf5bbef7e9..00ba83dd38e9 100644
--- a/arch/arm/boot/dts/rk3506-amp.dtsi
+++ b/arch/arm/boot/dts/rk3506-amp.dtsi
@@ -32,7 +32,7 @@
 			/* UART4 */
 			GIC_AMP_IRQ_CFG_ROUTE(70, 0xd0, CPU_GET_AFFINITY(0, 2))
 			/* MAILBOX */
-			GIC_AMP_IRQ_CFG_ROUTE(174, 0xd0, CPU_GET_AFFINITY(0, 2))>;
+			GIC_AMP_IRQ_CFG_ROUTE(176, 0xd0, CPU_GET_AFFINITY(0, 2))>;
 
 		status = "okay";
 	};
@@ -40,10 +40,11 @@
 	rpmsg: rpmsg@3c00000 {
 		compatible = "rockchip,rpmsg";
 		mbox-names = "rpmsg-rx", "rpmsg-tx";
-		mboxes = <&mailbox0 0 &mailbox0 3>;
+		mboxes = <&mailbox0 0 &mailbox2 0>;
 		rockchip,vdev-nums = <1>;
-		rockchip,link-id = <0x03>;
-		reg = <0x3c00000 0x100000>;
+		/* CPU2: link-id 0x02; */
+		rockchip,link-id = <0x02>;
+		reg = <0x3c00000 0x20000>;
 		memory-region = <&rpmsg_dma_reserved>;
 
 		status = "okay";
@@ -59,6 +60,11 @@
 	status = "okay";
 };
 
+&mailbox2 {
+	rockchip,txpoll-period-ms = <1>;
+	status = "okay";
+};
+
 &reserved_memory {
 	/* remote amp core address */
 	amp_shmem_reserved: amp-shmem@3b00000 {
diff --git a/arch/arm/configs/rockchip_amp.config b/arch/arm/configs/rockchip_amp.config
index dc677bc4467f..afe4430e2372 100644
--- a/arch/arm/configs/rockchip_amp.config
+++ b/arch/arm/configs/rockchip_amp.config
@@ -1 +1,31 @@
+CONFIG_MAILBOX=y
 CONFIG_ROCKCHIP_AMP=y
+CONFIG_RPMSG_VIRTIO=y
+# CONFIG_ALTERA_MBOX is not set
+# CONFIG_ARM_MHU is not set
+# CONFIG_ARM_MHU_V2 is not set
+# CONFIG_ARM_SCPI_PROTOCOL is not set
+CONFIG_BLK_MQ_VIRTIO=y
+# CONFIG_BT_VIRTIO is not set
+# CONFIG_CRYPTO_DEV_VIRTIO is not set
+# CONFIG_GPIO_VIRTIO is not set
+# CONFIG_HW_RANDOM_VIRTIO is not set
+CONFIG_MAILBOX_POLL_PERIOD_US=y
+# CONFIG_MAILBOX_TEST is not set
+# CONFIG_PL320_MBOX is not set
+# CONFIG_PLATFORM_MHU is not set
+CONFIG_ROCKCHIP_MBOX=y
+# CONFIG_ROCKCHIP_MBOX_DEMO is not set
+CONFIG_RPMSG=y
+# CONFIG_RPMSG_CHAR is not set
+# CONFIG_RPMSG_CTRL is not set
+CONFIG_RPMSG_NS=y
+# CONFIG_RPMSG_QCOM_GLINK_RPM is not set
+CONFIG_RPMSG_ROCKCHIP_MBOX=y
+# CONFIG_RPMSG_ROCKCHIP_TEST is not set
+# CONFIG_RPMSG_TTY is not set
+# CONFIG_SND_SOC_FSL_RPMSG is not set
+# CONFIG_SND_VIRTIO is not set
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_ANCHOR=y
+# CONFIG_VIRTIO_BLK is not set
diff --git a/arch/arm64/boot/dts/rockchip/rk3576-vehicle-evb-v20.dts b/arch/arm64/boot/dts/rockchip/rk3576-vehicle-evb-v20.dts
index 4baaa407d49d..09bf21924567 100644
--- a/arch/arm64/boot/dts/rockchip/rk3576-vehicle-evb-v20.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3576-vehicle-evb-v20.dts
@@ -62,14 +62,14 @@
 		};
 	};
 
-	usb_otg0_vcc5v_buck: usb_otg0_vcc5v-buck {
+	usb_otg_vcc5v_buck: usb_otg_vcc5v-buck {
 		compatible = "regulator-fixed";
-		regulator-name = "usb_otg0_vcc5v_buck";
+		regulator-name = "usb_otg_vcc5v_buck";
 		regulator-boot-on;
 		regulator-always-on;
 		regulator-min-microvolt = <5000000>;
 		regulator-max-microvolt = <5000000>;
-		enable-active-high;
+		//enable-active-high;
 		gpio = <&i2c0_nca9539_gpio 0 GPIO_ACTIVE_HIGH>;
 		vin-supply = <&vcc5v0_buck>;
 		regulator-state-mem {
@@ -524,3 +524,30 @@
 &ufs {
 	status = "disabled";
 };
+
+&u2phy0 {
+	rockchip,sel-pipe-phystatus;
+	status = "okay";
+};
+
+&u2phy0_otg {
+	/delete-property/rockchip,sel-pipe-phystatus;
+	//vbus-supply = <&usb_otg_vcc5v_buck>;
+	status = "okay";
+};
+
+&u2phy1_otg {
+	phy-supply = <&usb_host_vcc5v_buck>;
+	status = "okay";
+};
+
+&usbdp_phy {
+	maximum-speed = "high-speed";
+	status = "okay";
+};
+
+&usb_drd1_dwc3 {
+	maximum-speed = "high-speed";
+	snps,dis_u2_susphy_quirk;
+	status = "okay";
+};
diff --git a/drivers/media/platform/rockchip/isp/dev.h b/drivers/media/platform/rockchip/isp/dev.h
index 5c5e17ab303f..1670cec2488c 100644
--- a/drivers/media/platform/rockchip/isp/dev.h
+++ b/drivers/media/platform/rockchip/isp/dev.h
@@ -290,6 +290,7 @@ struct rkisp_device {
 	spinlock_t aiisp_lock;
 	struct rkisp_cmsk_cfg cmsk_cfg;
 	struct rkisp_aiisp_cfg aiisp_cfg;
+	struct rkisp_fpn_cfg fpn_cfg;
 
 	bool is_cmsk_upd;
 	bool is_hw_link;
diff --git a/drivers/media/platform/rockchip/isp/hw.c b/drivers/media/platform/rockchip/isp/hw.c
index eebffdd9a88d..37f946a64de4 100644
--- a/drivers/media/platform/rockchip/isp/hw.c
+++ b/drivers/media/platform/rockchip/isp/hw.c
@@ -1067,7 +1067,7 @@ static void isp_config_clk(struct rkisp_hw_dev *dev, int on)
 			val = 0;
 
 		if ((dev->isp_ver == ISP_V20 || dev->isp_ver == ISP_V30) && on)
-			val |= CLK_CTRL_ISP_3A;
+			val |= CLK_CTRL_ISP_3A | CLK_CTRL_ISP_RAW;
 		if (dev->isp_ver == ISP_V32)
 			rv1106_sdmmc_get_lock();
 		writel(val, dev->base_addr + CTRL_VI_ISP_CLK_CTRL);
diff --git a/drivers/media/platform/rockchip/isp/isp_params.c b/drivers/media/platform/rockchip/isp/isp_params.c
index 96d1c67e798f..4181c27acc6c 100644
--- a/drivers/media/platform/rockchip/isp/isp_params.c
+++ b/drivers/media/platform/rockchip/isp/isp_params.c
@@ -275,6 +275,12 @@ static void rkisp_params_vb2_stop_streaming(struct vb2_queue *vq)
 	params_vdev->rdbk_times = 0;
 	if (!(dev->isp_state & ISP_START))
 		rkisp_params_stream_stop(params_vdev);
+	dev->fpn_cfg.en = 0;
+	if (dev->fpn_cfg.buf) {
+		vfree(dev->fpn_cfg.buf);
+		dev->fpn_cfg.buf = NULL;
+		dev->fpn_cfg.buf_size = 0;
+	}
 }
 
 static int
diff --git a/drivers/media/platform/rockchip/isp/isp_params_v3x.c b/drivers/media/platform/rockchip/isp/isp_params_v3x.c
index f3055039739d..93bd106cc1bc 100644
--- a/drivers/media/platform/rockchip/isp/isp_params_v3x.c
+++ b/drivers/media/platform/rockchip/isp/isp_params_v3x.c
@@ -634,6 +634,7 @@ static void
 isp_lsc_enable(struct rkisp_isp_params_vdev *params_vdev, bool en, u32 id)
 {
 	struct isp3x_isp_params_cfg *params_rec = params_vdev->isp3x_params + id;
+	struct rkisp_isp_params_val_v3x *priv_val = params_vdev->priv_val;
 	u32 val = isp3_param_read(params_vdev, ISP3X_LSC_CTRL, id);
 
 	if (en == !!(val & ISP_LSC_EN))
@@ -641,9 +642,12 @@ isp_lsc_enable(struct rkisp_isp_params_vdev *params_vdev, bool en, u32 id)
 
 	if (en) {
 		isp3_param_set_bits(params_vdev, ISP3X_LSC_CTRL, ISP_LSC_EN, id);
-		if (params_vdev->dev->hw_dev->is_single)
-			isp_lsc_matrix_cfg_sram(params_vdev,
-						&params_rec->others.lsc_cfg, false, id);
+		if (params_vdev->dev->hw_dev->is_single) {
+			if (!in_interrupt())
+				isp_lsc_matrix_cfg_sram(params_vdev, &params_rec->others.lsc_cfg, false, id);
+			else if (id == ISP3_LEFT)
+				tasklet_schedule(&priv_val->lsc_tasklet);
+		}
 	} else {
 		isp3_param_clear_bits(params_vdev, ISP3X_LSC_CTRL, ISP_LSC_EN, id);
 		isp3_param_clear_bits(params_vdev, ISP3X_GAIN_CTRL, BIT(8), id);
diff --git a/drivers/media/platform/rockchip/isp/procfs.c b/drivers/media/platform/rockchip/isp/procfs.c
index d0a08a0e495c..94c983bd475f 100644
--- a/drivers/media/platform/rockchip/isp/procfs.c
+++ b/drivers/media/platform/rockchip/isp/procfs.c
@@ -241,6 +241,8 @@ static void isp30_show(struct rkisp_device *dev, struct seq_file *p)
 	};
 	u32 val, tmp;
 
+	val = rkisp_read(dev, CSI2RX_FPN_CTRL, false);
+	seq_printf(p, "%-10s %s(0x%x)\n", "FPN", (val & 1) ? "ON" : "OFF", val);
 	val = rkisp_read(dev, ISP3X_CMSK_CTRL0, false);
 	seq_printf(p, "%-10s %s(0x%x)\n", "CMSK", (val & 1) ? "ON" : "OFF", val);
 	val = rkisp_read(dev, ISP3X_DPCC0_MODE, false);
diff --git a/drivers/media/platform/rockchip/isp/regs_v2x.h b/drivers/media/platform/rockchip/isp/regs_v2x.h
index 979710b58a12..12dfdbad8449 100644
--- a/drivers/media/platform/rockchip/isp/regs_v2x.h
+++ b/drivers/media/platform/rockchip/isp/regs_v2x.h
@@ -561,7 +561,8 @@
 #define CSI2RX_RAWFBC_EN_SHD			(CSI2RX_BASE + 0x000c8)
 #define CSI2RX_FPN_CTRL				(CSI2RX_BASE + 0x000d0)
 #define CSI2RX_FPN_TABLE_CTRL			(CSI2RX_BASE + 0x000d4)
-#define CSI2RX_FPN_TABLE_DATA			(CSI2RX_BASE + 0x000d8)
+#define CSI2RX_FPN_TABLE_DATA0			(CSI2RX_BASE + 0x000d8)
+#define CSI2RX_FPN_TABLE_DATA1			(CSI2RX_BASE + 0x000dc)
 #define CSI2RX_Y_STAT_CTRL			(CSI2RX_BASE + 0x000f0)
 #define CSI2RX_Y_STAT_RO			(CSI2RX_BASE + 0x000f4)
 #define CSI2RX_VERSION				(CSI2RX_BASE + 0x000fc)
@@ -2432,6 +2433,12 @@
 #define SW_CSI_ESP_IDCD_OBPIX(a)	((a) & 0x7F)
 #define SW_CSI_ESP_IDCD_EFPIX(a)	(((a) & 0x7F) << 16)
 
+#define SW_FPN_EN			BIT(0)
+#define SW_FPN_ROW_EN			BIT(1)
+#define SW_FPN_BITS(a)			(((a) & 0x3) << 2)
+
+#define SW_FPN_CFG			BIT(0)
+
 #define SW_Y_STAT_INT_MODE_MASK		GENMASK(3, 2)
 #define SW_Y_STAT_RD_FRM_ID_MASK	GENMASK(5, 4)
 #define SW_Y_STAT_RD_TILE_ID_MASK	GENMASK(7, 6)
diff --git a/drivers/media/platform/rockchip/isp/rkisp.c b/drivers/media/platform/rockchip/isp/rkisp.c
index 5a343bcbc5cb..256643755b71 100644
--- a/drivers/media/platform/rockchip/isp/rkisp.c
+++ b/drivers/media/platform/rockchip/isp/rkisp.c
@@ -87,6 +87,7 @@
 
 static void rkisp_config_cmsk(struct rkisp_device *dev);
 static void rkisp_config_aiisp(struct rkisp_device *dev);
+static void rkisp_config_fpn(struct rkisp_device *dev);
 
 static inline struct rkisp_device *sd_to_isp_dev(struct v4l2_subdev *sd)
 {
@@ -1825,6 +1826,8 @@ static int rkisp_config_isp(struct rkisp_device *dev)
 	dev->is_aiisp_upd = dev->is_aiisp_en;
 	rkisp_config_cmsk(dev);
 	rkisp_config_aiisp(dev);
+	if (dev->hw_dev->is_single)
+		rkisp_config_fpn(dev);
 	return 0;
 }
 
@@ -3768,6 +3771,84 @@ static int rkisp_get_offline_raw_buf_cnt(struct rkisp_device *dev, int *cnt)
 	return 0;
 }
 
+static void rkisp_config_fpn(struct rkisp_device *dev)
+{
+	struct rkisp_fpn_cfg *cfg = &dev->fpn_cfg;
+	u32 i, val, *data;
+
+	if (!cfg->en) {
+		rkisp_unite_write(dev, CSI2RX_FPN_CTRL, 0, true);
+		return;
+	}
+	val = SW_FPN_EN | SW_FPN_BITS(cfg->data_shift);
+	if (cfg->row_en)
+		val |= SW_FPN_ROW_EN;
+	rkisp_unite_write(dev, CSI2RX_FPN_CTRL, val, true);
+	rkisp_unite_write(dev, CSI2RX_FPN_TABLE_CTRL, SW_FPN_CFG, true);
+	data = cfg->buf;
+	/* 32bit: 8 fpn, first data line for DATA0, second line for DATA1 */
+	for (i = 0; i < cfg->buf_size / 8; i++) {
+		val = *(data + i);
+		rkisp_unite_write(dev, CSI2RX_FPN_TABLE_DATA0, val, true);
+		val = *(data + cfg->buf_size / 8 + i);
+		rkisp_unite_write(dev, CSI2RX_FPN_TABLE_DATA1, val, true);
+	}
+	rkisp_unite_write(dev, CSI2RX_FPN_TABLE_CTRL, 0, true);
+}
+
+static int rkisp_set_fpn(struct rkisp_device *dev, struct rkisp_fpn_cfg *cfg)
+{
+	u32 w = dev->isp_sdev.out_crop.width;
+	u32 h = dev->isp_sdev.out_crop.height;
+	int ret = 0;
+
+	if (!cfg->en && dev->fpn_cfg.en) {
+		dev->fpn_cfg.en = 0;
+		if (dev->fpn_cfg.buf) {
+			vfree(dev->fpn_cfg.buf);
+			dev->fpn_cfg.buf = NULL;
+			dev->fpn_cfg.buf_size = 0;
+		}
+		return ret;
+	}
+
+	if ((cfg->row_en && cfg->buf_size < h) ||
+	    (!cfg->row_en && cfg->buf_size < w)) {
+		dev_err(dev->dev, "fpn buf size %d row_en:%d error for %dx%d\n",
+			cfg->buf_size, cfg->row_en, w, h);
+		ret = -EINVAL;
+		goto err;
+	}
+
+	if (dev->fpn_cfg.buf && dev->fpn_cfg.buf_size < cfg->buf_size) {
+		vfree(dev->fpn_cfg.buf);
+		dev->fpn_cfg.buf = NULL;
+		dev->fpn_cfg.buf_size = 0;
+	}
+
+	if (!dev->fpn_cfg.buf) {
+		dev->fpn_cfg.buf = vmalloc(cfg->buf_size);
+		if (!dev->fpn_cfg.buf) {
+			ret = -ENOMEM;
+			goto err;
+		}
+	}
+	if (copy_from_user(dev->fpn_cfg.buf, cfg->buf, cfg->buf_size)) {
+		dev_err(dev->dev, "copy fpn data err\n");
+		vfree(dev->fpn_cfg.buf);
+		dev->fpn_cfg.buf = NULL;
+		dev->fpn_cfg.buf_size = 0;
+		ret = -EFAULT;
+		goto err;
+	}
+	dev->fpn_cfg.en = cfg->en;
+	dev->fpn_cfg.row_en = cfg->row_en;
+	dev->fpn_cfg.data_shift = cfg->data_shift;
+	dev->fpn_cfg.buf_size = cfg->buf_size;
+err:
+	return ret;
+}
+
 static long rkisp_ioctl(struct v4l2_subdev *sd, unsigned int cmd, void *arg)
 {
 	struct rkisp_device *isp_dev = sd_to_isp_dev(sd);
@@ -3927,6 +4008,9 @@ static long rkisp_ioctl(struct v4l2_subdev *sd, unsigned int cmd, void *arg)
 	case RKISP_CMD_GET_OFFLINE_RAW_BUFCNT:
 		ret = rkisp_get_offline_raw_buf_cnt(isp_dev, arg);
 		break;
+	case RKISP_CMD_SET_FPN:
+		ret = rkisp_set_fpn(isp_dev, arg);
+		break;
 	default:
 		ret = -ENOIOCTLCMD;
 	}
@@ -4024,6 +4108,10 @@ static long rkisp_compat_ioctl32(struct v4l2_subdev *sd,
 		size = sizeof(int);
 		cp_t_us = true;
 		break;
+	case RKISP_CMD_SET_FPN:
+		size = sizeof(struct rkisp_fpn_cfg);
+		cp_f_us = true;
+		break;
 	default:
 		return -ENOIOCTLCMD;
 	}
diff --git a/drivers/rpmsg/rockchip_rpmsg_mbox.c b/drivers/rpmsg/rockchip_rpmsg_mbox.c
index c70e89b023d7..6362d5eb49f1 100644
--- a/drivers/rpmsg/rockchip_rpmsg_mbox.c
+++ b/drivers/rpmsg/rockchip_rpmsg_mbox.c
@@ -41,9 +41,10 @@ struct rk_rpmsg_dev {
 	struct platform_device *pdev;
 	int vdev_nums;
 	unsigned int link_id;
-	int first_notify;
+	bool need_notify;
 	u32 flags;
-	struct mbox_client mbox_cl;
+	struct mbox_client mbox_rx_cl;
+	struct mbox_client mbox_tx_cl;
 	struct mbox_chan *mbox_rx_chan;
 	struct mbox_chan *mbox_tx_chan;
 	struct rk_virtio_dev *rpvdev[RPMSG_MAX_INSTANCE_NUM];
@@ -55,20 +56,46 @@ struct rk_rpmsg_vq_info {
 	struct rk_rpmsg_dev *rpdev;
 };
 
+static void rk_rpmsg_tx_callback(struct mbox_client *client, void *message)
+{
+	struct rk_virtio_dev *rpvdev;
+	struct rk_rpmsg_dev *rpdev = container_of(client, struct rk_rpmsg_dev, mbox_tx_cl);
+	struct platform_device *pdev = rpdev->pdev;
+	struct device *dev = &pdev->dev;
+	struct rockchip_mbox_msg *rx_msg = message;
+
+	dev_dbg(dev, "rpmsg master tx cb: receive cmd=0x%x data=0x%x\n",
+		rx_msg->cmd, rx_msg->data);
+
+	if (rx_msg->data != RPMSG_MBOX_MAGIC)
+		dev_err(dev, "rpmsg master tx cb: mailbox data error 0x%8x!\n",
+			rx_msg->data);
+
+	/* TODO: only support one remote core now */
+	rpvdev = rpdev->rpvdev[0];
+
+	/*
+	 *  Recv TX CONSUME message
+	 *  Enabled RL_ALLOW_CONSUMED_BUFFERS_NOTIFICATION in rpmsg-lite
+	 */
+	vring_interrupt(0, rpvdev->vq[1]);
+}
+
 static void rk_rpmsg_rx_callback(struct mbox_client *client, void *message)
 {
 	u32 link_id;
 	struct rk_virtio_dev *rpvdev;
-	struct rk_rpmsg_dev *rpdev = container_of(client, struct rk_rpmsg_dev, mbox_cl);
+	struct rk_rpmsg_dev *rpdev = container_of(client, struct rk_rpmsg_dev, mbox_rx_cl);
 	struct platform_device *pdev = rpdev->pdev;
 	struct device *dev = &pdev->dev;
 	struct rockchip_mbox_msg *rx_msg;
 
 	rx_msg = message;
-	dev_dbg(dev, "rpmsg master: receive cmd=0x%x data=0x%x\n",
+	dev_dbg(dev, "rpmsg master rx cb: receive cmd=0x%x data=0x%x\n",
 		rx_msg->cmd, rx_msg->data);
 	if (rx_msg->data != RPMSG_MBOX_MAGIC)
-		dev_err(dev, "rpmsg master: mailbox data error!\n");
+		dev_err(dev, "rpmsg master rx cb: mailbox data error 0x%8x!\n",
+			rx_msg->data);
 	link_id = rx_msg->cmd & 0xFFU;
 	/* TODO: only support one remote core now */
 	rpvdev = rpdev->rpvdev[0];
@@ -77,6 +104,12 @@ static void rk_rpmsg_rx_callback(struct mbox_client *client, void *message)
 	vring_interrupt(0, rpvdev->vq[0]);
 }
 
+static void rk_rpmsg_xfer_done(struct mbox_client *cl, void *mssg, int r)
+{
+	if (!r)
+		kfree(mssg);
+}
+
 static bool rk_rpmsg_notify(struct virtqueue *vq)
 {
 	struct rk_rpmsg_vq_info *rpvq = vq->priv;
@@ -85,25 +118,44 @@ static bool rk_rpmsg_notify(struct virtqueue *vq)
 	struct device *dev = &pdev->dev;
 	u32 link_id;
 	int ret;
-	struct rockchip_mbox_msg tx_msg;
+	struct rockchip_mbox_msg *tx_msg;
 
-	memset(&tx_msg, 0, sizeof(tx_msg));
 	dev_dbg(dev, "queue_id-0x%x virt_vring_addr 0x%p\n",
 		rpvq->queue_id, rpvq->vring_addr);
 
 	link_id = rpdev->link_id;
-	tx_msg.cmd = link_id & 0xFFU;
-	tx_msg.data = RPMSG_MBOX_MAGIC;
 
-	if ((rpdev->first_notify == 0) && (rpvq->queue_id % 2 == 0)) {
-		/* first_notify is used in the master init handshake phase. */
-		dev_dbg(dev, "rpmsg first_notify\n");
-		rpdev->first_notify++;
+	if ((!rpdev->need_notify) && (rpvq->queue_id % 2 == 0)) {
+		/* first notify is used in the master init handshake phase. */
+		dev_dbg(dev, "rpmsg handshake notify\n");
 	} else if (rpvq->queue_id % 2 == 0) {
 		/* tx done is not supported, so ignored */
 		return true;
 	}
-	ret = mbox_send_message(rpdev->mbox_tx_chan, &tx_msg);
+
+	if (!rpdev->mbox_tx_chan->mbox->ops->last_tx_done(rpdev->mbox_tx_chan)) {
+		/*
+		 * Mailbox BUSY means remote side has not processed previous
+		 * notification. The remote side will process all availd
+		 * messages after meeting the last notification.
+		 */
+		return true;
+	}
+
+	if (rpdev->need_notify)
+		mbox_client_txdone(rpdev->mbox_tx_chan, 0);
+	else
+		rpdev->need_notify = true;
+
+	tx_msg = kzalloc(sizeof(*tx_msg), GFP_KERNEL);
+	if (!tx_msg) {
+		dev_err(dev, "Can not get memory for tx_msg\n");
+		return false;
+	}
+	tx_msg->cmd = link_id & 0xFFU;
+	tx_msg->data = RPMSG_MBOX_MAGIC;
+
+	ret = mbox_send_message(rpdev->mbox_tx_chan, tx_msg);
 	if (ret < 0) {
 		dev_err(dev, "mbox send failed!\n");
 		return false;
@@ -300,12 +352,13 @@ static int rockchip_rpmsg_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	dev_info(dev, "rockchip rpmsg platform probe.\n");
-	rpdev->pdev = pdev;
-	rpdev->first_notify = 0;
 
-	cl = &rpdev->mbox_cl;
+	rpdev->pdev = pdev;
+	rpdev->need_notify = false;
+	cl = &rpdev->mbox_rx_cl;
 	cl->dev = dev;
 	cl->rx_callback = rk_rpmsg_rx_callback;
+	cl->tx_done = rk_rpmsg_xfer_done;
 
 	rpdev->mbox_rx_chan = mbox_request_channel_byname(cl, "rpmsg-rx");
 	if (IS_ERR(rpdev->mbox_rx_chan)) {
@@ -313,6 +366,13 @@ static int rockchip_rpmsg_probe(struct platform_device *pdev)
 		dev_err(dev, "failed to request mbox rx chan, ret %d\n", ret);
 		return ret;
 	}
+
+	cl = &rpdev->mbox_tx_cl;
+	cl->dev = dev;
+	cl->rx_callback = rk_rpmsg_tx_callback;
+	cl->tx_done = rk_rpmsg_xfer_done;
+	cl->knows_txdone = true;
+
 	rpdev->mbox_tx_chan = mbox_request_channel_byname(cl, "rpmsg-tx");
 	if (IS_ERR(rpdev->mbox_tx_chan)) {
 		ret = PTR_ERR(rpdev->mbox_tx_chan);
diff --git a/drivers/video/rockchip/mpp/mpp_rkvdec2.c b/drivers/video/rockchip/mpp/mpp_rkvdec2.c
index 741924e03ef5..50ec9334ddc4 100644
--- a/drivers/video/rockchip/mpp/mpp_rkvdec2.c
+++ b/drivers/video/rockchip/mpp/mpp_rkvdec2.c
@@ -1346,7 +1346,7 @@ static int rkvdec2_vdpu382_reset(struct mpp_dev *mpp)
 	int ret = 0;
 
 	/*
-	 * only for rk3528 and rk3562
+	 * only for rk3528
 	 * use mmu reset as soft reset
 	 * rkvdec will reset together when rkvdec_mmu force reset
 	 */
@@ -1550,7 +1550,7 @@ static const struct mpp_dev_var rkvdec_rk3568_data = {
 	.dev_ops = &rkvdec_rk3568_dev_ops,
 };
 
-static const struct mpp_dev_var rkvdec_vdpu382_data = {
+static const struct mpp_dev_var rkvdec_rk3528_data = {
 	.device_type = MPP_DEVICE_RKVDEC,
 	.hw_info = &rkvdec_vdpu382_hw_info,
 	.trans_info = rkvdec_v2_trans,
@@ -1558,6 +1558,14 @@ static const struct mpp_dev_var rkvdec_vdpu382_data = {
 	.dev_ops = &rkvdec_v2_dev_ops,
 };
 
+static const struct mpp_dev_var rkvdec_rk3562_data = {
+	.device_type = MPP_DEVICE_RKVDEC,
+	.hw_info = &rkvdec_vdpu382_hw_info,
+	.trans_info = rkvdec_v2_trans,
+	.hw_ops = &rkvdec_v2_hw_ops,
+	.dev_ops = &rkvdec_v2_dev_ops,
+};
+
 static const struct mpp_dev_var rkvdec_rk3588_data = {
 	.device_type = MPP_DEVICE_RKVDEC,
 	.hw_info = &rkvdec_v2_hw_info,
@@ -1594,13 +1602,13 @@ static const struct of_device_id mpp_rkvdec2_dt_match[] = {
 #ifdef CONFIG_CPU_RK3528
 	{
 		.compatible = "rockchip,rkv-decoder-rk3528",
-		.data = &rkvdec_vdpu382_data,
+		.data = &rkvdec_rk3528_data,
 	},
 #endif
 #ifdef CONFIG_CPU_RK3562
 	{
 		.compatible = "rockchip,rkv-decoder-rk3562",
-		.data = &rkvdec_vdpu382_data,
+		.data = &rkvdec_rk3562_data,
 	},
 #endif
 #ifdef CONFIG_CPU_RK3576
diff --git a/include/uapi/linux/rk-isp2-config.h b/include/uapi/linux/rk-isp2-config.h
index 2e39011b1f31..841790be482e 100644
--- a/include/uapi/linux/rk-isp2-config.h
+++ b/include/uapi/linux/rk-isp2-config.h
@@ -80,6 +80,9 @@
 #define RKISP_CMD_GET_OFFLINE_RAW_BUFCNT \
 	_IOR('V', BASE_VIDIOC_PRIVATE + 22, int)
 
+#define RKISP_CMD_SET_FPN \
+	_IOW('V', BASE_VIDIOC_PRIVATE + 25, struct rkisp_fpn_cfg)
+
 /****************ISP VIDEO IOCTL******************************/
 
 #define RKISP_CMD_GET_CSI_MEMORY_MODE \
@@ -129,6 +132,7 @@
 
 /* BASE_VIDIOC_PRIVATE + 115 for RKISP_CMD_GET_PARAMS_V39 */
 /* BASE_VIDIOC_PRIVATE + 116 for RKISP_CMD_GET_PARAMS_V33 */
+/* BASE_VIDIOC_PRIVATE + 117 for RKISP_CMD_SET_QUICK_STREAM */
 
 /**********************EVENT_PRIVATE***************************/
 #define RKISP_V4L2_EVENT_AIISP_LINECNT (V4L2_EVENT_PRIVATE_START + 1)
@@ -349,6 +353,29 @@ struct isp2x_mesh_head {
 	__u32 data_oft;
 } __attribute__ ((packed));
 
+enum {
+	RKISP_FPN_DATA_SHIFT_0 = 0,
+	RKISP_FPN_DATA_SHIFT_1,
+	RKISP_FPN_DATA_SHIFT_2,
+	RKISP_FPN_DATA_SHIFT_3,
+};
+
+/* struct rkisp_aiisp_cfg
+ * en: enable fpn function
+ * row_en: row fpn mode other column fpn
+ * data_shift: fpn data shift, 4bits of 7bits calculate fpn data
+ * buf_size: buf size: row_en ? height : width
+ * buf: fpn data, two row or two column fpn data, 4bit one fpn data
+ */
+struct rkisp_fpn_cfg {
+	char en;
+	char row_en;
+	char data_shift;
+	char reserved;
+	int buf_size;
+	void *buf;
+} __attribute__ ((packed));
+
 #define RKISP_AIISP_WR_LINECNT_ID	0
 #define RKISP_AIISP_RD_LINECNT_ID	1
 struct rkisp_aiisp_ev_info {