diff --git a/drivers/ub/ubus/decoder.c b/drivers/ub/ubus/decoder.c
index dbd6191b693a629172e592353b9b030a759bc2de..0a2a061144292f710853fe9982ae65058982f49f 100644
--- a/drivers/ub/ubus/decoder.c
+++ b/drivers/ub/ubus/decoder.c
@@ -8,7 +8,6 @@
 #include <linux/dma-mapping.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
-#include <linux/ktime.h>
 #include <linux/resource_ext.h>
 
 #include "ubus.h"
@@ -25,52 +24,28 @@
 #define CMDQ_SIZE_USE_MASK	GENMASK(11, 8)
 #define CMDQ_SIZE_USE_OFFSET	8
 #define CMDQ_ENABLE		0x1
-#define CMD_ENTRY_SIZE		16
 
 #define EVTQ_SIZE_USE_MASK	GENMASK(11, 8)
 #define EVTQ_SIZE_USE_OFFSET	8
 #define EVTQ_ENABLE		0x1
-#define EVT_ENTRY_SIZE		16
 
-#define DECODER_QUEUE_TIMEOUT_US 1000000 /* 1s */
-
-static void ub_decoder_uninit_queue(struct ub_decoder *decoder)
+static void ub_decoder_uninit_queue(struct ub_bus_controller *ubc,
+				    struct ub_decoder *decoder)
 {
-	iounmap(decoder->cmdq.qbase);
-	iounmap(decoder->evtq.qbase);
+	if (ubc->ops->uninit_decoder_queue)
+		ubc->ops->uninit_decoder_queue(decoder);
+	else
+		ub_err(ubc->uent, "ub bus controller can't uninit decoder queue\n");
 }
 
 static int ub_decoder_init_queue(struct ub_bus_controller *ubc,
 				 struct ub_decoder *decoder)
 {
-	struct ub_entity *uent = ubc->uent;
+	if (ubc->ops->init_decoder_queue && ubc->ops->uninit_decoder_queue)
+		return ubc->ops->init_decoder_queue(decoder);
 
-	if (ubc->ops->register_decoder_base_addr) {
-		ubc->ops->register_decoder_base_addr(ubc, &decoder->cmdq.base,
-						     &decoder->evtq.base);
-	} else {
-		ub_err(uent,
-		       "ub_bus_controller_ops does not provide register_decoder_base_addr func, exit\n");
-		return -EINVAL;
-	}
-
-	if (decoder->cmdq.qs == 0 || decoder->evtq.qs == 0) {
-		ub_err(uent, "decoder cmdq or evtq qs is 0\n");
-		return -EINVAL;
-	}
-
-	decoder->cmdq.qbase = ioremap(decoder->cmdq.base,
-				      (1 << decoder->cmdq.qs) * CMD_ENTRY_SIZE);
-	if (!decoder->cmdq.qbase)
-		return -ENOMEM;
-
-	decoder->evtq.qbase = ioremap(decoder->evtq.base,
-				      (1 << decoder->evtq.qs) * EVT_ENTRY_SIZE);
-	if (!decoder->evtq.qbase) {
-		iounmap(decoder->cmdq.qbase);
-		return -ENOMEM;
-	}
-	return 0;
+	ub_err(ubc->uent, "ub bus controller can't init decoder queue\n");
+	return -EINVAL;
 }
 
 static u32 set_mmio_base_reg(struct ub_decoder *decoder)
@@ -242,11 +217,11 @@ static u32 ub_decoder_device_set(struct ub_decoder *decoder)
 static int ub_decoder_create_page_table(struct ub_bus_controller *ubc,
 					struct ub_decoder *decoder)
 {
-	if (ubc->ops->create_decoder_table)
+	if (ubc->ops->create_decoder_table && ubc->ops->free_decoder_table)
 		return ubc->ops->create_decoder_table(decoder);
 
 	ub_err(decoder->uent, "ub bus controller can't create decoder table\n");
-	return -EPERM;
+	return -EINVAL;
 }
 
 static void ub_decoder_free_page_table(struct ub_bus_controller *ubc,
@@ -307,6 +282,11 @@ static int ub_get_decoder_cap(struct ub_decoder *decoder)
 	decoder->cmdq.qs = (val & CMDQ_SIZE_MASK) >> CMDQ_SIZE_OFFSET;
 	decoder->evtq.qs = (val & EVTQ_SIZE_MASK) >> EVTQ_SIZE_OFFSET;
 
+	if (decoder->cmdq.qs == 0 || decoder->evtq.qs == 0) {
+		ub_err(uent, "decoder cmdq or evtq qs is 0\n");
+		return -EINVAL;
+	}
+
 	size = decoder->mmio_end_addr - decoder->mmio_base_addr + 1;
 	if (size > mmio_size[decoder->mmio_size_sup])
 		decoder->mmio_end_addr = decoder->mmio_base_addr +
@@ -366,7 +346,7 @@ static int ub_create_decoder(struct ub_bus_controller *ubc)
 release_page_table:
 	ub_decoder_free_page_table(ubc, decoder);
 release_queue:
-	ub_decoder_uninit_queue(decoder);
+	ub_decoder_uninit_queue(ubc, decoder);
 release_decoder:
 	kfree(decoder);
 	return ret;
@@ -415,374 +395,29 @@ static void ub_remove_decoder(struct ub_bus_controller *ubc)
 
 	ub_decoder_free_page_table(ubc, decoder);
 
-	ub_decoder_uninit_queue(decoder);
+	ub_decoder_uninit_queue(ubc, decoder);
 
 	kfree(decoder);
 
 	ubc->decoder = NULL;
 }
 
-struct sync_entry {
-	u64 op : 8;
-	u64 reserve0 : 4;
-	u64 cm : 2;
-	u64 ntf_sh : 2;
-	u64 ntf_attr : 4;
-	u64 reserve1 : 12;
-	u64 notify_data : 32;
-	u64 reserve2 : 2;
-	u64 notify_addr : 50;
-	u64 reserve3 : 12;
-};
-
-struct tlbi_all_entry {
-	u32 op : 8;
-	u32 reserve0 : 24;
-	u32 reserve1;
-	u32 reserve2;
-	u32 reserve3;
-};
-
-struct tlbi_partial_entry {
-	u32 op : 8;
-	u32 reserve0 : 24;
-	u32 tlbi_addr_base : 28;
-	u32 reserve1 : 4;
-	u32 tlbi_addr_limt : 28;
-	u32 reserve2 : 4;
-	u32 reserve3;
-};
-
-#define TLBI_ADDR_MASK GENMASK_ULL(43, 20)
-#define TLBI_ADDR_OFFSET 20
-#define CMDQ_ENT_DWORDS 2
-
-#define NTF_SH_NSH		0b00
-#define NTF_SH_OSH		0b10
-#define NTF_SH_ISH		0b11
-#define NTF_ATTR_IR_NC		0b00
-#define NTF_ATTR_IR_WBRA	0b01
-#define NTF_ATTR_IR_WT		0b10
-#define NTF_ATTR_IR_WB		0b11
-#define NTF_ATTR_OR_NC		0b0000
-#define NTF_ATTR_OR_WBRA	0b0100
-#define NTF_ATTR_OR_WT		0b1000
-#define NTF_ATTR_OR_WB		0b1100
-
-#define Q_IDX(qs, p) ((p) & ((1 << (qs)) - 1))
-#define Q_WRP(qs, p) ((p) & (1 << (qs)))
-#define Q_OVF(p) ((p) & Q_OVERFLOW_FLAG)
-
-enum NOTIFY_TYPE {
-	DISABLE_NOTIFY = 0,
-	ENABLE_NOTIFY = 1,
-};
-
-static bool queue_has_space(struct ub_decoder_queue *q, u32 n)
-{
-	u32 space, prod, cons;
-
-	prod = Q_IDX(q->qs, q->prod.cmdq_wr_idx);
-	cons = Q_IDX(q->qs, q->cons.cmdq_rd_idx);
-
-	if (Q_WRP(q->qs, q->prod.cmdq_wr_idx) ==
-	    Q_WRP(q->qs, q->cons.cmdq_rd_idx))
-		space = (1 << q->qs) - (prod - cons);
-	else
-		space = cons - prod;
-
-	return space >= n;
-}
-
-static u32 queue_inc_prod_n(struct ub_decoder_queue *q, u32 n)
-{
-	u32 prod = (Q_WRP(q->qs, q->prod.cmdq_wr_idx) |
-		   Q_IDX(q->qs, q->prod.cmdq_wr_idx)) + n;
-	return Q_WRP(q->qs, prod) | Q_IDX(q->qs, prod);
-}
-
-#define CMD_0_OP		GENMASK_ULL(7, 0)
-#define CMD_0_ADDR_BASE		GENMASK_ULL(59, 32)
-#define CMD_1_ADDR_LIMT		GENMASK_ULL(27, 0)
-
-static void decoder_cmdq_issue_cmd(struct ub_decoder *decoder, phys_addr_t addr,
-				   u64 size, enum ub_cmd_op_type op)
-{
-	struct ub_decoder_queue *cmdq = &(decoder->cmdq);
-	struct tlbi_partial_entry entry = {};
-	u64 cmd[CMDQ_ENT_DWORDS] = {};
-	void *pi;
-	int i;
-
-	entry.op = op;
-	entry.tlbi_addr_base = (addr & TLBI_ADDR_MASK) >> TLBI_ADDR_OFFSET;
-	entry.tlbi_addr_limt = ((addr + size - 1U) & TLBI_ADDR_MASK) >>
-			       TLBI_ADDR_OFFSET;
-
-	cmd[0] |= FIELD_PREP(CMD_0_OP, entry.op);
-	cmd[0] |= FIELD_PREP(CMD_0_ADDR_BASE, entry.tlbi_addr_base);
-	cmd[1] |= FIELD_PREP(CMD_1_ADDR_LIMT, entry.tlbi_addr_limt);
-
-	pi = cmdq->qbase + Q_IDX(cmdq->qs, cmdq->prod.cmdq_wr_idx) *
-	     sizeof(struct tlbi_partial_entry);
-
-	for (i = 0; i < CMDQ_ENT_DWORDS; i++)
-		writeq(cmd[i], pi + i * sizeof(u64));
-
-	cmdq->prod.cmdq_wr_idx = queue_inc_prod_n(cmdq, 1);
-}
-
-#define NTF_DMA_ADDR_OFFSERT	2
-#define SYNC_0_OP		GENMASK_ULL(7, 0)
-#define SYNC_0_CM		GENMASK_ULL(13, 12)
-#define SYNC_0_NTF_ISH		GENMASK_ULL(15, 14)
-#define SYNC_0_NTF_ATTR		GENMASK_ULL(19, 16)
-#define SYNC_0_NTF_DATA		GENMASK_ULL(63, 32)
-#define SYNC_1_NTF_ADDR		GENMASK_ULL(51, 2)
-#define SYNC_NTF_DATA		0xffffffff
-
-static void decoder_cmdq_issue_sync(struct ub_decoder *decoder)
-{
-	struct ub_decoder_queue *cmdq = &(decoder->cmdq);
-	u64 cmd[CMDQ_ENT_DWORDS] = {};
-	struct sync_entry entry = {};
-	phys_addr_t sync_dma;
-	void __iomem *pi;
-	int i;
-
-	entry.op = SYNC;
-	entry.cm = ENABLE_NOTIFY;
-	sync_dma = cmdq->base + Q_IDX(cmdq->qs, cmdq->prod.cmdq_wr_idx) *
-		   sizeof(struct sync_entry);
-	entry.ntf_sh = NTF_SH_NSH;
-	entry.ntf_attr = NTF_ATTR_IR_NC | NTF_ATTR_OR_NC;
-	entry.notify_data = SYNC_NTF_DATA;
-	entry.notify_addr = sync_dma >> NTF_DMA_ADDR_OFFSERT;
-
-	cmd[0] |= FIELD_PREP(SYNC_0_OP, entry.op);
-	cmd[0] |= FIELD_PREP(SYNC_0_CM, entry.cm);
-	cmd[0] |= FIELD_PREP(SYNC_0_NTF_ISH, entry.ntf_sh);
-	cmd[0] |= FIELD_PREP(SYNC_0_NTF_ATTR, entry.ntf_attr);
-	cmd[0] |= FIELD_PREP(SYNC_0_NTF_DATA, entry.notify_data);
-	cmd[1] |= FIELD_PREP(SYNC_1_NTF_ADDR, entry.notify_addr);
-
-	pi = cmdq->qbase + Q_IDX(cmdq->qs, cmdq->prod.cmdq_wr_idx) *
-	     sizeof(struct sync_entry);
-	for (i = 0; i < CMDQ_ENT_DWORDS; i++)
-		writeq(cmd[i], pi + i * sizeof(u64));
-
-	decoder->notify = pi;
-	cmdq->prod.cmdq_wr_idx = queue_inc_prod_n(cmdq, 1);
-}
-
-static void decoder_cmdq_update_prod(struct ub_decoder *decoder)
-{
-	struct ub_entity *uent = decoder->uent;
-	struct queue_idx q;
-	int ret;
-
-	ret = ub_cfg_read_dword(uent, DECODER_CMDQ_PROD, &q.val);
-	if (ret)
-		ub_err(uent, "update pi, read decoder cmdq prod failed\n");
-
-	decoder->cmdq.prod.cmdq_err_resp = q.cmdq_err_resp;
-	ret = ub_cfg_write_dword(uent, DECODER_CMDQ_PROD,
-				 decoder->cmdq.prod.val);
-	if (ret)
-		ub_err(uent, "update pi, write decoder cmdq prod failed\n");
-}
-
-static int wait_for_cmdq_free(struct ub_decoder *decoder, u32 n)
-{
-	ktime_t timeout = ktime_add_us(ktime_get(), DECODER_QUEUE_TIMEOUT_US);
-	struct ub_decoder_queue *cmdq = &(decoder->cmdq);
-	struct ub_entity *uent = decoder->uent;
-	int ret;
-
-	while (true) {
-		ret = ub_cfg_read_dword(uent, DECODER_CMDQ_CONS,
-					&(cmdq->cons.val));
-		if (ret)
-			return ret;
-
-		if (queue_has_space(cmdq, n + 1))
-			return 0;
-
-		if (ktime_compare(ktime_get(), timeout) > 0) {
-			ub_err(uent, "decoder cmdq wait free entry timeout\n");
-			return -ETIMEDOUT;
-		}
-		cpu_relax();
-	}
-}
-
-static int wait_for_cmdq_notify(struct ub_decoder *decoder)
-{
-	ktime_t timeout;
-	u32 val;
-
-	timeout = ktime_add_us(ktime_get(), DECODER_QUEUE_TIMEOUT_US);
-	while (true) {
-		val = readl(decoder->notify);
-		if (val == SYNC_NTF_DATA)
-			return 0;
-
-		if (ktime_compare(ktime_get(), timeout) > 0) {
-			ub_err(decoder->uent, "decoder cmdq wait notify timeout\n");
-			return -ETIMEDOUT;
-		}
-		cpu_relax();
-	}
-}
-
-int ub_decoder_cmd_request(struct ub_decoder *decoder, phys_addr_t addr,
-			   u64 size, enum ub_cmd_op_type op)
-{
-	int ret;
-
-	ret = wait_for_cmdq_free(decoder, 1);
-	if (ret)
-		return ret;
-
-	decoder_cmdq_issue_cmd(decoder, addr, size, op);
-	decoder_cmdq_issue_sync(decoder);
-	decoder_cmdq_update_prod(decoder);
-
-	ret = wait_for_cmdq_notify(decoder);
-	return ret;
-}
-EXPORT_SYMBOL_GPL(ub_decoder_cmd_request);
-
-static bool queue_empty(struct ub_decoder_queue *q)
-{
-	return (Q_IDX(q->qs, q->prod.eventq_wr_idx) ==
-		Q_IDX(q->qs, q->cons.eventq_rd_idx)) &&
-	       (Q_WRP(q->qs, q->prod.eventq_wr_idx) ==
-		Q_WRP(q->qs, q->cons.eventq_rd_idx));
-}
-
-static void queue_inc_cons(struct ub_decoder_queue *q)
-{
-	u32 cons = (Q_WRP(q->qs, q->cons.eventq_rd_idx) |
-		    Q_IDX(q->qs, q->cons.eventq_rd_idx)) + 1;
-	q->cons.eventq_rd_idx = Q_WRP(q->qs, cons) | Q_IDX(q->qs, cons);
-}
-
-enum event_op_type {
-	RESERVED = 0x00,
-	EVENT_ADDR_OUT_OF_RANGE = 0x01,
-	EVENT_ILLEGAL_CMD = 0x02,
-};
-
-#define EVTQ_0_ID		GENMASK_ULL(7, 0)
-#define EVTQ_0_ADDR		GENMASK_ULL(59, 32)
-#define EVTQ_0_CMD_OPCODE	GENMASK_ULL(39, 32)
-#define EVTQ_ENT_DWORDS		2
-#define MAX_REASON_NUM		3
-
-static const char * const cmd_err_reason[MAX_REASON_NUM] = {
-	"no error",
-	"illegal command",
-	"abort error(read command with 2bit ecc)"
-};
-
-static void fix_err_cmd(struct ub_decoder *decoder)
-{
-	struct ub_decoder_queue *cmdq = &(decoder->cmdq);
-	struct ub_entity *uent = decoder->uent;
-	u64 cmd[CMDQ_ENT_DWORDS] = {};
-	struct queue_idx prod, cons;
-	void *pi;
-	int i;
-
-	if (ub_cfg_read_dword(uent, DECODER_CMDQ_CONS, &cons.val)) {
-		ub_err(uent, "decoder fix error cmd, read ci failed\n");
-		return;
-	}
-	if (ub_cfg_read_dword(uent, DECODER_CMDQ_PROD, &prod.val)) {
-		ub_err(uent, "decoder fix error cmd, read pi failed\n");
-		return;
-	}
-
-	cmd[0] |= FIELD_PREP(CMD_0_OP, TLBI_ALL);
-	pi = cmdq->qbase + Q_IDX(cmdq->qs, cons.cmdq_rd_idx) *
-	     sizeof(struct tlbi_partial_entry);
-
-	for (i = 0; i < CMDQ_ENT_DWORDS; i++)
-		writeq(cmd[i], pi + i * sizeof(u64));
-
-	if (cons.cmdq_err_reason >= MAX_REASON_NUM)
-		ub_err(uent, "cmdq err reason is invalid, reason=%u\n",
-			cons.cmdq_err_reason);
-	else
-		ub_err(uent, "cmdq err reason is %s\n", cmd_err_reason[cons.cmdq_err_reason]);
-
-	prod.cmdq_err_resp = cons.cmdq_err;
-
-	if (ub_cfg_write_dword(uent, DECODER_CMDQ_PROD, prod.val))
-		ub_err(uent, "decoder fix error cmd, write pi err resp failed\n");
-}
-
-static void handle_evt(struct ub_decoder *decoder, u64 *evt)
-{
-	struct ub_entity *uent = decoder->uent;
-
-	switch (FIELD_GET(EVTQ_0_ID, evt[0])) {
-	case EVENT_ADDR_OUT_OF_RANGE:
-		ub_err(uent, "decoder event, input addr out of range, addr=%#.7x00000\n",
-		       (u32)FIELD_GET(EVTQ_0_ADDR, evt[0]));
-		break;
-	case EVENT_ILLEGAL_CMD:
-		ub_err(uent, "decoder event, illegal cmd, cmd_opcode=%#x\n",
-		       (u32)FIELD_GET(EVTQ_0_CMD_OPCODE, evt[0]));
-		fix_err_cmd(decoder);
-		break;
-	default:
-		ub_err(uent, "invalid event opcode, opcode=%#x\n",
-		       (u32)FIELD_GET(EVTQ_0_ID, evt[0]));
-	}
-}
-
-static void decoder_event_deal(struct ub_decoder *decoder)
-{
-	struct ub_decoder_queue *evtq = &decoder->evtq;
-	struct ub_entity *uent = decoder->uent;
-	u64 evt[EVTQ_ENT_DWORDS];
-	void *ci;
-	int i;
-
-	if (ub_cfg_read_dword(uent, DECODER_EVENTQ_PROD, &(evtq->prod.val))) {
-		ub_err(uent, "decoder handle event, read eventq pi failed\n");
-		return;
-	}
-
-	while (!queue_empty(evtq)) {
-		ci = evtq->qbase + Q_IDX(evtq->qs, evtq->cons.eventq_rd_idx) *
-		     EVT_ENTRY_SIZE;
-
-		for (i = 0; i < EVTQ_ENT_DWORDS; i++)
-			evt[i] = readq(ci + i * sizeof(u64));
-
-		handle_evt(decoder, evt);
-		queue_inc_cons(evtq);
-
-		if (ub_cfg_write_dword(uent, DECODER_EVENTQ_CONS,
-				       evtq->cons.val))
-			ub_err(uent, "decoder handle event, write eventq ci failed\n");
-	}
-}
 
 static irqreturn_t decoder_event_deal_handle(int irq, void *data)
 {
 	struct ub_entity *uent = (struct ub_entity *)data;
 	struct ub_decoder *decoder = uent->ubc->decoder;
-
 	if (!decoder) {
 		ub_err(uent, "decoder does not exist\n");
-		return IRQ_HANDLED;
+		return IRQ_NONE;
+	}
+
+	if (!uent->ubc->ops->decoder_event_deal) {
+		ub_err(uent, "decoder event deal does not exist\n");
+		return IRQ_NONE;
 	}
 
-	decoder_event_deal(decoder);
+	uent->ubc->ops->decoder_event_deal(decoder);
 	return IRQ_HANDLED;
 }
 
@@ -884,8 +519,8 @@ int ub_decoder_map(struct ub_decoder *decoder, struct decoder_map_info *info)
 	}
 
 	ubc = decoder->uent->ubc;
-	if (!ubc->ops->decoder_map) {
-		pr_err("decoder_map ops not exist\n");
+	if (!ubc->ops->decoder_map && !ubc->ops->decoder_unmap) {
+		pr_err("decoder_map or decoder_unmap ops not exist\n");
 		return -EINVAL;
 	}
 
diff --git a/drivers/ub/ubus/decoder.h b/drivers/ub/ubus/decoder.h
index 6667d07e9219605f4191410e48ca927cb83e1ac5..48ffe9102a46335aafdc0315b1e2b7ec185b030d 100644
--- a/drivers/ub/ubus/decoder.h
+++ b/drivers/ub/ubus/decoder.h
@@ -107,8 +107,6 @@ void ub_decoder_init(struct ub_entity *uent);
 void ub_decoder_uninit(struct ub_entity *uent);
 void ub_init_decoder_usi(struct ub_entity *uent);
 void ub_uninit_decoder_usi(struct ub_entity *uent);
-int ub_decoder_cmd_request(struct ub_decoder *decoder, phys_addr_t addr,
-			   u64 size, enum ub_cmd_op_type op);
 int ub_decoder_map(struct ub_decoder *decoder, struct decoder_map_info *info);
 int ub_decoder_unmap(struct ub_decoder *decoder, phys_addr_t addr, u64 size);
 #endif /* __DECODER_H__ */
diff --git a/drivers/ub/ubus/ubus_controller.h b/drivers/ub/ubus/ubus_controller.h
index 04eb4a3d76480619d66af0f44e2af07ab91e01a5..7ef19e3eaa738c9a911cc86417800e5f97c6f30d 100644
--- a/drivers/ub/ubus/ubus_controller.h
+++ b/drivers/ub/ubus/ubus_controller.h
@@ -18,8 +18,8 @@ struct ub_bus_controller_ops {
 	void (*mem_decoder_remove)(struct ub_bus_controller *ubc);
 	void (*register_ubmem_irq)(struct ub_bus_controller *ubc);
 	void (*unregister_ubmem_irq)(struct ub_bus_controller *ubc);
-	void (*register_decoder_base_addr)(struct ub_bus_controller *ubc,
-					   u64 *cmd_queue, u64 *event_queue);
+	int (*init_decoder_queue)(struct ub_decoder *decoder);
+	void (*uninit_decoder_queue)(struct ub_decoder *decoder);
 	int (*entity_enable)(struct ub_entity *uent, u8 enable);
 	int (*create_decoder_table)(struct ub_decoder *decoder);
 	void (*free_decoder_table)(struct ub_decoder *decoder);
@@ -27,6 +27,7 @@ struct ub_bus_controller_ops {
 			   struct decoder_map_info *info);
 	int (*decoder_unmap)(struct ub_decoder *decoder, phys_addr_t addr,
 			     u64 size);
+	void (*decoder_event_deal)(struct ub_decoder *decoder);
 
 	KABI_RESERVE(1)
 	KABI_RESERVE(2)
diff --git a/drivers/ub/ubus/ubus_driver.c b/drivers/ub/ubus/ubus_driver.c
index 974020bf3c388437ad5fb7ad456fca730fd30927..6d5594156c3d16d0d5ab03358bcbabb3f8581f14 100644
--- a/drivers/ub/ubus/ubus_driver.c
+++ b/drivers/ub/ubus/ubus_driver.c
@@ -61,6 +61,12 @@ int ub_get_bus_controller(struct ub_entity *ubc_dev[], unsigned int max_num,
 {
 	struct ub_bus_controller *ubc;
 	unsigned int ubc_num = 0;
+	int ret;
+
+	if (!manage_subsystem_ops) {
+		pr_err("manage subsystem ops is null\n");
+		return -EINVAL;
+	}
 
 	if (!real_num || !ubc_dev) {
 		pr_err("%s: input parameters invalid\n", __func__);
@@ -70,16 +76,25 @@ int ub_get_bus_controller(struct ub_entity *ubc_dev[], unsigned int max_num,
 	list_for_each_entry(ubc, &ubc_list, node) {
 		if (ubc_num >= max_num) {
 			pr_err("ubc list num over max num %u\n", max_num);
-			ub_put_bus_controller(ubc_dev, max_num);
-			return -ENOMEM;
+			ret = -ENOMEM;
+			goto ubc_put;
 		}
 
-		ubc_dev[ubc_num] = ub_entity_get(ubc->uent);
+		if (!ub_entity_get(ubc->uent)) {
+			pr_err("The ub_entity of ubc is null\n");
+			ret = -EINVAL;
+			goto ubc_put;
+		}
+		ubc_dev[ubc_num] = ubc->uent;
 		ubc_num++;
 	}
 	*real_num = ubc_num;
 
 	return 0;
+
+ubc_put:
+	ub_put_bus_controller(ubc_dev, max_num);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(ub_get_bus_controller);
 
diff --git a/drivers/ub/ubus/ubus_entity.c b/drivers/ub/ubus/ubus_entity.c
index 105c6f396b44c91e1147e9b2d455d637050dcc5b..3dbc196d4da47563475911203b59df42cdbe06bf 100644
--- a/drivers/ub/ubus/ubus_entity.c
+++ b/drivers/ub/ubus/ubus_entity.c
@@ -1057,9 +1057,6 @@ static struct ub_entity *ub_get_ue_by_entity_idx(struct ub_entity *pue, u32 enti
 {
 	struct ub_entity *ue;
 
-	if (ub_check_ue_para(pue, entity_idx))
-		return NULL;
-
 	list_for_each_entry(ue, &pue->ue_list, node) {
 		if (ue->entity_idx == entity_idx)
 			return ue;
diff --git a/drivers/ub/ubus/vendor/hisilicon/controller.c b/drivers/ub/ubus/vendor/hisilicon/controller.c
index 6c9c8e32047999d91bde3635bb3b6d9447dbd86a..b9a4e6dc02d0700cff529ade7fda0ae162dc3390 100644
--- a/drivers/ub/ubus/vendor/hisilicon/controller.c
+++ b/drivers/ub/ubus/vendor/hisilicon/controller.c
@@ -22,12 +22,14 @@ static struct ub_bus_controller_ops hi_ubc_ops = {
 	.mem_decoder_remove = hi_mem_decoder_remove,
 	.register_ubmem_irq = hi_register_ubmem_irq,
 	.unregister_ubmem_irq = hi_unregister_ubmem_irq,
-	.register_decoder_base_addr = hi_register_decoder_base_addr,
+	.init_decoder_queue = hi_init_decoder_queue,
+	.uninit_decoder_queue = hi_uninit_decoder_queue,
 	.entity_enable = hi_send_entity_enable_msg,
 	.create_decoder_table = hi_create_decoder_table,
 	.free_decoder_table = hi_free_decoder_table,
 	.decoder_map = hi_decoder_map,
 	.decoder_unmap = hi_decoder_unmap,
+	.decoder_event_deal = hi_decoder_event_deal,
 };
 
 static void ub_bus_controller_debugfs_init(struct ub_bus_controller *ubc)
diff --git a/drivers/ub/ubus/vendor/hisilicon/hisi-decoder.c b/drivers/ub/ubus/vendor/hisilicon/hisi-decoder.c
index ac1fa0498ffc57783c454a789824c3001fcf9c95..00f958696b66dfed0d6f99169e0645357d6ebfa8 100644
--- a/drivers/ub/ubus/vendor/hisilicon/hisi-decoder.c
+++ b/drivers/ub/ubus/vendor/hisilicon/hisi-decoder.c
@@ -6,6 +6,7 @@
 #define pr_fmt(fmt)	"ubus hisi decoder: " fmt
 
 #include <linux/dma-mapping.h>
+#include <linux/ktime.h>
 #include <ub/ubfi/ubfi.h>
 #include "../../ubus.h"
 #include "hisi-ubus.h"
@@ -136,6 +137,10 @@ struct range_table_entry {
 					DECODER_SUB_PAGE_TABLE_MASK) >> \
 					DECODER_SUB_PAGE_TABLE_LOC)
 
+#define DECODER_QUEUE_TIMEOUT_US 1000000 /* 1s */
+#define CMD_ENTRY_SIZE 16
+#define EVT_ENTRY_SIZE 16
+
 static void fill_page_entry(struct page_entry *page,
 			    struct decoder_map_info *info, u64 offset)
 {
@@ -616,13 +621,37 @@ static void ub_decoder_init_page_table(struct ub_decoder *decoder, void *pgtlb_b
 	}
 }
 
-void hi_register_decoder_base_addr(struct ub_bus_controller *ubc,
-				   u64 *cmd_queue, u64 *event_queue)
+int hi_init_decoder_queue(struct ub_decoder *decoder)
 {
-	struct hi_ubc_private_data *data = (struct hi_ubc_private_data *)ubc->data;
+	struct hi_ubc_private_data *data;
+	struct ub_bus_controller *ubc;
+
+	if (!decoder)
+		return -EINVAL;
+
+	ubc = decoder->uent->ubc;
+	data = (struct hi_ubc_private_data *)ubc->data;
+	decoder->cmdq.base = data->io_decoder_cmdq;
+	decoder->evtq.base = data->io_decoder_evtq;
+
+	decoder->cmdq.qbase = ioremap(decoder->cmdq.base,
+				      (1 << decoder->cmdq.qs) * CMD_ENTRY_SIZE);
+	if (!decoder->cmdq.qbase)
+		return -ENOMEM;
+
+	decoder->evtq.qbase = ioremap(decoder->evtq.base,
+				      (1 << decoder->evtq.qs) * EVT_ENTRY_SIZE);
+	if (!decoder->evtq.qbase) {
+		iounmap(decoder->cmdq.qbase);
+		return -ENOMEM;
+	}
+	return 0;
+}
 
-	*cmd_queue = data->io_decoder_cmdq;
-	*event_queue = data->io_decoder_evtq;
+void hi_uninit_decoder_queue(struct ub_decoder *decoder)
+{
+	iounmap(decoder->cmdq.qbase);
+	iounmap(decoder->evtq.qbase);
 }
 
 int hi_create_decoder_table(struct ub_decoder *decoder)
@@ -697,7 +726,7 @@ int hi_decoder_unmap(struct ub_decoder *decoder, phys_addr_t addr, u64 size)
 	ret = handle_table(decoder, &info, false);
 	if (ret)
 		return ret;
-	return ub_decoder_cmd_request(decoder, addr, size, TLBI_PARTIAL);
+	return hi_decoder_cmd_request(decoder, addr, size, TLBI_PARTIAL);
 }
 
 int hi_decoder_map(struct ub_decoder *decoder, struct decoder_map_info *info)
@@ -712,3 +741,356 @@ int hi_decoder_map(struct ub_decoder *decoder, struct decoder_map_info *info)
 
 	return handle_table(decoder, info, true);
 }
+
+struct sync_entry {
+	u64 op : 8;
+	u64 reserve0 : 4;
+	u64 cm : 2;
+	u64 ntf_sh : 2;
+	u64 ntf_attr : 4;
+	u64 reserve1 : 12;
+	u64 notify_data : 32;
+	u64 reserve2 : 2;
+	u64 notify_addr : 50;
+	u64 reserve3 : 12;
+};
+
+struct tlbi_all_entry {
+	u32 op : 8;
+	u32 reserve0 : 24;
+	u32 reserve1;
+	u32 reserve2;
+	u32 reserve3;
+};
+
+struct tlbi_partial_entry {
+	u32 op : 8;
+	u32 reserve0 : 24;
+	u32 tlbi_addr_base : 28;
+	u32 reserve1 : 4;
+	u32 tlbi_addr_limt : 28;
+	u32 reserve2 : 4;
+	u32 reserve3;
+};
+
+#define TLBI_ADDR_MASK GENMASK_ULL(43, 20)
+#define TLBI_ADDR_OFFSET 20
+#define CMDQ_ENT_DWORDS 2
+
+#define NTF_SH_NSH		0b00
+#define NTF_SH_OSH		0b10
+#define NTF_SH_ISH		0b11
+
+#define NTF_ATTR_IR_NC		0b00
+#define NTF_ATTR_IR_WBRA	0b01
+#define NTF_ATTR_IR_WT		0b10
+#define NTF_ATTR_IR_WB		0b11
+#define NTF_ATTR_OR_NC		0b0000
+#define NTF_ATTR_OR_WBRA	0b0100
+#define NTF_ATTR_OR_WT		0b1000
+#define NTF_ATTR_OR_WB		0b1100
+
+#define Q_IDX(qs, p) ((p) & ((1 << (qs)) - 1))
+#define Q_WRP(qs, p) ((p) & (1 << (qs)))
+#define Q_OVF(p) ((p) & Q_OVERFLOW_FLAG)
+
+enum NOTIFY_TYPE {
+	DISABLE_NOTIFY = 0,
+	ENABLE_NOTIFY = 1,
+};
+
+static bool queue_has_space(struct ub_decoder_queue *q, u32 n)
+{
+	u32 space, prod, cons;
+
+	prod = Q_IDX(q->qs, q->prod.cmdq_wr_idx);
+	cons = Q_IDX(q->qs, q->cons.cmdq_rd_idx);
+
+	if (Q_WRP(q->qs, q->prod.cmdq_wr_idx) ==
+	    Q_WRP(q->qs, q->cons.cmdq_rd_idx))
+		space = (1 << q->qs) - (prod - cons);
+	else
+		space = cons - prod;
+
+	return space >= n;
+}
+
+static u32 queue_inc_prod_n(struct ub_decoder_queue *q, u32 n)
+{
+	u32 prod = (Q_WRP(q->qs, q->prod.cmdq_wr_idx) |
+		   Q_IDX(q->qs, q->prod.cmdq_wr_idx)) + n;
+	return Q_WRP(q->qs, prod) | Q_IDX(q->qs, prod);
+}
+
+#define CMD_0_OP GENMASK_ULL(7, 0)
+#define CMD_0_ADDR_BASE GENMASK_ULL(59, 32)
+#define CMD_1_ADDR_LIMT GENMASK_ULL(27, 0)
+
+static void decoder_cmdq_issue_cmd(struct ub_decoder *decoder, phys_addr_t addr,
+				   u64 size, enum ub_cmd_op_type op)
+{
+	struct ub_decoder_queue *cmdq = &(decoder->cmdq);
+	struct tlbi_partial_entry entry = {};
+	u64 cmd[CMDQ_ENT_DWORDS] = {};
+	void *pi;
+	int i;
+
+	entry.op = op;
+	entry.tlbi_addr_base = (addr & TLBI_ADDR_MASK) >> TLBI_ADDR_OFFSET;
+	entry.tlbi_addr_limt = ((addr + size - 1U) & TLBI_ADDR_MASK) >>
+			       TLBI_ADDR_OFFSET;
+
+	cmd[0] |= FIELD_PREP(CMD_0_OP, entry.op);
+	cmd[0] |= FIELD_PREP(CMD_0_ADDR_BASE, entry.tlbi_addr_base);
+	cmd[1] |= FIELD_PREP(CMD_1_ADDR_LIMT, entry.tlbi_addr_limt);
+
+	pi = cmdq->qbase + Q_IDX(cmdq->qs, cmdq->prod.cmdq_wr_idx) *
+	     sizeof(struct tlbi_partial_entry);
+
+	for (i = 0; i < CMDQ_ENT_DWORDS; i++)
+		writeq(cmd[i], pi + i * sizeof(u64));
+
+	cmdq->prod.cmdq_wr_idx = queue_inc_prod_n(cmdq, 1);
+}
+
+#define NTF_DMA_ADDR_OFFSERT 2
+#define SYNC_0_OP GENMASK_ULL(7, 0)
+#define SYNC_0_CM GENMASK_ULL(13, 12)
+#define SYNC_0_NTF_ISH GENMASK_ULL(15, 14)
+#define SYNC_0_NTF_ATTR GENMASK_ULL(19, 16)
+#define SYNC_0_NTF_DATA GENMASK_ULL(63, 32)
+#define SYNC_1_NTF_ADDR GENMASK_ULL(51, 2)
+#define SYNC_NTF_DATA 0xffffffff
+
+static void decoder_cmdq_issue_sync(struct ub_decoder *decoder)
+{
+	struct ub_decoder_queue *cmdq = &(decoder->cmdq);
+	u64 cmd[CMDQ_ENT_DWORDS] = {};
+	struct sync_entry entry = {};
+	phys_addr_t sync_dma;
+	void __iomem *pi;
+	int i;
+
+	entry.op = SYNC;
+	entry.cm = ENABLE_NOTIFY;
+	sync_dma = cmdq->base + Q_IDX(cmdq->qs, cmdq->prod.cmdq_wr_idx) *
+		   sizeof(struct sync_entry);
+	entry.ntf_sh = NTF_SH_NSH;
+	entry.ntf_attr = NTF_ATTR_IR_NC | NTF_ATTR_OR_NC;
+	entry.notify_data = SYNC_NTF_DATA;
+	entry.notify_addr = sync_dma >> NTF_DMA_ADDR_OFFSERT;
+
+	cmd[0] |= FIELD_PREP(SYNC_0_OP, entry.op);
+	cmd[0] |= FIELD_PREP(SYNC_0_CM, entry.cm);
+	cmd[0] |= FIELD_PREP(SYNC_0_NTF_ISH, entry.ntf_sh);
+	cmd[0] |= FIELD_PREP(SYNC_0_NTF_ATTR, entry.ntf_attr);
+	cmd[0] |= FIELD_PREP(SYNC_0_NTF_DATA, entry.notify_data);
+	cmd[1] |= FIELD_PREP(SYNC_1_NTF_ADDR, entry.notify_addr);
+
+	pi = cmdq->qbase + Q_IDX(cmdq->qs, cmdq->prod.cmdq_wr_idx) *
+	     sizeof(struct sync_entry);
+	for (i = 0; i < CMDQ_ENT_DWORDS; i++)
+		writeq(cmd[i], pi + i * sizeof(u64));
+
+	decoder->notify = pi;
+	cmdq->prod.cmdq_wr_idx = queue_inc_prod_n(cmdq, 1);
+}
+
+static void decoder_cmdq_update_prod(struct ub_decoder *decoder)
+{
+	struct ub_entity *uent = decoder->uent;
+	struct queue_idx q;
+	int ret;
+
+	ret = ub_cfg_read_dword(uent, DECODER_CMDQ_PROD, &q.val);
+	if (ret)
+		ub_err(uent, "update pi, read decoder cmdq prod fail\n");
+
+	decoder->cmdq.prod.cmdq_err_resp = q.cmdq_err_resp;
+	ret = ub_cfg_write_dword(uent, DECODER_CMDQ_PROD,
+				 decoder->cmdq.prod.val);
+	if (ret)
+		ub_err(uent, "update pi, write decoder cmdq prod fail\n");
+}
+
+static int wait_for_cmdq_free(struct ub_decoder *decoder, u32 n)
+{
+	ktime_t timeout = ktime_add_us(ktime_get(), DECODER_QUEUE_TIMEOUT_US);
+	struct ub_decoder_queue *cmdq = &(decoder->cmdq);
+	struct ub_entity *uent = decoder->uent;
+	int ret;
+
+	while (true) {
+		ret = ub_cfg_read_dword(uent, DECODER_CMDQ_CONS,
+					&(cmdq->cons.val));
+		if (ret)
+			return ret;
+
+		if (queue_has_space(cmdq, n + 1))
+			return 0;
+
+		if (ktime_compare(ktime_get(), timeout) > 0) {
+			ub_err(uent, "decoder cmdq wait free entry timeout\n");
+			return -ETIMEDOUT;
+		}
+		cpu_relax();
+	}
+}
+
+static int wait_for_cmdq_notify(struct ub_decoder *decoder)
+{
+	ktime_t timeout;
+	u32 val;
+
+	timeout = ktime_add_us(ktime_get(), DECODER_QUEUE_TIMEOUT_US);
+	while (true) {
+		val = readl(decoder->notify);
+		if (val == SYNC_NTF_DATA)
+			return 0;
+
+		if (ktime_compare(ktime_get(), timeout) > 0) {
+			ub_err(decoder->uent, "decoder cmdq wait notify timeout\n");
+			return -ETIMEDOUT;
+		}
+		cpu_relax();
+	}
+}
+
+int hi_decoder_cmd_request(struct ub_decoder *decoder, phys_addr_t addr,
+			   u64 size, enum ub_cmd_op_type op)
+{
+	int ret;
+
+	ret = wait_for_cmdq_free(decoder, 1);
+	if (ret)
+		return ret;
+
+	decoder_cmdq_issue_cmd(decoder, addr, size, op);
+	decoder_cmdq_issue_sync(decoder);
+	decoder_cmdq_update_prod(decoder);
+
+	ret = wait_for_cmdq_notify(decoder);
+	return ret;
+}
+#ifdef UBUS_KP_TOOL_STUB
+EXPORT_SYMBOL_GPL(hi_decoder_cmd_request);
+#endif
+
+static bool queue_empty(struct ub_decoder_queue *q)
+{
+	return (Q_IDX(q->qs, q->prod.eventq_wr_idx) ==
+		Q_IDX(q->qs, q->cons.eventq_rd_idx)) &&
+	       (Q_WRP(q->qs, q->prod.eventq_wr_idx) ==
+		Q_WRP(q->qs, q->cons.eventq_rd_idx));
+}
+
+static void queue_inc_cons(struct ub_decoder_queue *q)
+{
+	u32 cons = (Q_WRP(q->qs, q->cons.eventq_rd_idx) |
+		    Q_IDX(q->qs, q->cons.eventq_rd_idx)) + 1;
+	q->cons.eventq_rd_idx = Q_WRP(q->qs, cons) | Q_IDX(q->qs, cons);
+}
+
+enum event_op_type {
+	RESERVED = 0x0,
+	EVENT_ADDR_OUT_OF_RANGE = 0x01,
+	EVENT_ILLEGAL_CMD = 0x02,
+};
+
+#define EVTQ_0_ID GENMASK_ULL(7, 0)
+#define EVTQ_0_ADDR GENMASK_ULL(59, 32)
+#define EVTQ_0_CMD_OPCODE GENMASK_ULL(39, 32)
+#define EVTQ_ENT_DWORDS 2
+#define MAX_REASON_NUM 3
+
+static const char *cmd_err_reason[MAX_REASON_NUM] = {
+	"no error",
+	"illegal command",
+	"abort error(read command with 2bit ecc)"
+};
+
+static void fix_err_cmd(struct ub_decoder *decoder)
+{
+	struct ub_decoder_queue *cmdq = &(decoder->cmdq);
+	struct ub_entity *uent = decoder->uent;
+	u64 cmd[CMDQ_ENT_DWORDS] = {};
+	struct queue_idx prod, cons;
+	void *pi;
+	int i;
+
+	if (ub_cfg_read_dword(uent, DECODER_CMDQ_CONS, &cons.val)) {
+		ub_err(uent, "decoder fix error cmd, read ci failed\n");
+		return;
+	}
+	if (ub_cfg_read_dword(uent, DECODER_CMDQ_PROD, &prod.val)) {
+		ub_err(uent, "decoder fix error cmd, read pi failed\n");
+		return;
+	}
+
+	cmd[0] |= FIELD_PREP(CMD_0_OP, TLBI_ALL);
+	pi = cmdq->qbase + Q_IDX(cmdq->qs, cons.cmdq_rd_idx) *
+	     sizeof(struct tlbi_partial_entry);
+
+	for (i = 0; i < CMDQ_ENT_DWORDS; i++)
+		writeq(cmd[i], pi + i * sizeof(u64));
+
+	if (cons.cmdq_err_reason >= MAX_REASON_NUM)
+		ub_err(uent, "cmdq err reason is invalid, reason=%u\n",
+			cons.cmdq_err_reason);
+	else
+		ub_err(uent, "cmdq err reason is %s\n", cmd_err_reason[cons.cmdq_err_reason]);
+
+	prod.cmdq_err_resp = cons.cmdq_err;
+
+	if (ub_cfg_write_dword(uent, DECODER_CMDQ_PROD, prod.val))
+		ub_err(uent, "decoder fix error cmd, write pi err resp failed\n");
+}
+
+static void handle_evt(struct ub_decoder *decoder, u64 *evt)
+{
+	struct ub_entity *uent = decoder->uent;
+
+	switch (FIELD_GET(EVTQ_0_ID, evt[0])) {
+	case EVENT_ADDR_OUT_OF_RANGE:
+		ub_err(uent, "decoder event, input addr out of range, addr=%#.7x00000\n",
+		       (u32)FIELD_GET(EVTQ_0_ADDR, evt[0]));
+		break;
+	case EVENT_ILLEGAL_CMD:
+		ub_err(uent, "decoder event, illegal cmd, cmd_opcode=%#x\n",
+		       (u32)FIELD_GET(EVTQ_0_CMD_OPCODE, evt[0]));
+		fix_err_cmd(decoder);
+		break;
+	default:
+		ub_err(uent, "invalid event opcode, opcode=%#x\n",
+		       (u32)FIELD_GET(EVTQ_0_ID, evt[0]));
+	}
+}
+
+void hi_decoder_event_deal(struct ub_decoder *decoder)
+{
+	struct ub_decoder_queue *evtq = &decoder->evtq;
+	struct ub_entity *uent = decoder->uent;
+	u64 evt[EVTQ_ENT_DWORDS];
+	void *ci;
+	int i;
+
+	if (ub_cfg_read_dword(uent, DECODER_EVENTQ_PROD, &(evtq->prod.val))) {
+		ub_err(uent, "decoder handle event, read eventq pi fail\n");
+		return;
+	}
+
+	while (!queue_empty(evtq)) {
+		ci = evtq->qbase + Q_IDX(evtq->qs, evtq->cons.eventq_rd_idx) *
+		     EVT_ENTRY_SIZE;
+
+		for (i = 0; i < EVTQ_ENT_DWORDS; i++)
+			evt[i] = readq(ci + i * sizeof(u64));
+
+		handle_evt(decoder, evt);
+		queue_inc_cons(evtq);
+
+		if (ub_cfg_write_dword(uent, DECODER_EVENTQ_CONS,
+				       evtq->cons.val))
+			ub_err(uent, "decoder handle event, write eventq ci fail\n");
+	}
+}
diff --git a/drivers/ub/ubus/vendor/hisilicon/hisi-decoder.h b/drivers/ub/ubus/vendor/hisilicon/hisi-decoder.h
index 50658ef7b9cbd5bf3598b43c1d8b7853c0e53d1c..fc49a25b80d6aee0cd335ca5fdefeaa0b08d92fb 100644
--- a/drivers/ub/ubus/vendor/hisilicon/hisi-decoder.h
+++ b/drivers/ub/ubus/vendor/hisilicon/hisi-decoder.h
@@ -38,8 +38,8 @@
 			       DECODER_PAGE_SIZE * \
 			       RGTLB_TO_PGTLB)
 
-void hi_register_decoder_base_addr(struct ub_bus_controller *ubc,
-				   u64 *cmd_queue, u64 *event_queue);
+int hi_init_decoder_queue(struct ub_decoder *decoder);
+void hi_uninit_decoder_queue(struct ub_decoder *decoder);
 
 int hi_create_decoder_table(struct ub_decoder *decoder);
 void hi_free_decoder_table(struct ub_decoder *decoder);
@@ -47,4 +47,8 @@ void hi_free_decoder_table(struct ub_decoder *decoder);
 int hi_decoder_map(struct ub_decoder *decoder, struct decoder_map_info *info);
 int hi_decoder_unmap(struct ub_decoder *decoder, phys_addr_t addr, u64 size);
 
+int hi_decoder_cmd_request(struct ub_decoder *decoder, phys_addr_t addr,
+			   u64 size, enum ub_cmd_op_type op);
+void hi_decoder_event_deal(struct ub_decoder *decoder);
+
 #endif /* __HISI_DECODER_H__ */
diff --git a/drivers/ub/ubus/vendor/hisilicon/msg.c b/drivers/ub/ubus/vendor/hisilicon/msg.c
index 5c4e672aa55e4cb19f387a49041750705e817c0f..6d4e9d422c49a4757a699f59637e6f6298171892 100644
--- a/drivers/ub/ubus/vendor/hisilicon/msg.c
+++ b/drivers/ub/ubus/vendor/hisilicon/msg.c
@@ -249,14 +249,14 @@ static int hi_msg_sync_wait(struct hi_message_device *hmd, int task_type,
 	unsigned long flags;
 	int idx;
 
-	while (!time_after64(get_jiffies_64(), end_time)) {
+	do {
 		idx = hi_msg_cq_poll(hmc, task_type, msn);
 		if (idx >= 0)
 			return idx;
 
 		if (flag)
 			usleep_range(SLEEP_MIN_US, SLEEP_MAX_US);
-	}
+	} while (!time_after64(get_jiffies_64(), end_time));
 
 	timeout_msg = kzalloc(TIMEOUT_MSG_INFO_SZ, GFP_ATOMIC);
 	if (!timeout_msg)