diff --git a/BUILD.bazel b/BUILD.bazel
index 71ffa33..f7c68e1 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -9,7 +9,6 @@
 load(
     ":mgk_modules.bzl",
     "mgk_gki_modules",
-    "mgk_implicit_module_out",
     "mgk_module_outs",
     "platform_ack_modules",
 )
@@ -274,7 +273,6 @@
     dtbo_names = KIRKWOOD_64_DTBO_NAMES,
     gki_modules = mgk_gki_modules,
     in_tree_modules = mgk_module_outs + platform_ack_modules,
-    in_tree_modules_discard = mgk_implicit_module_out,
     insmod_cfgs = KIRKWOOD_64_INSMOD_CFGS,
     kleaf_modules = mt8696_common_kleaf_modules,
 )
diff --git a/arch/arm64/configs/kirkwood_64_defconfig b/arch/arm64/configs/kirkwood_64_defconfig
index 4d490a4..4a232fa 100644
--- a/arch/arm64/configs/kirkwood_64_defconfig
+++ b/arch/arm64/configs/kirkwood_64_defconfig
@@ -146,7 +146,7 @@
 CONFIG_DEVICE_MODULES_MTK_SCPSYS_PM_DOMAINS=m
 CONFIG_CFG80211=m
 CONFIG_CFG80211_CERTIFICATION_ONUS=y
-CONFIG_CFG80211_EXTRA_REGDB_KEYDIR="\$(srctree)/../kernel_device_modules-5.15/net/wireless/certs" # nocheck: This is expanded during compilation
+CONFIG_CFG80211_EXTRA_REGDB_KEYDIR="\${ROOT_DIR}/kernel_device_modules-5.15/net/wireless/certs" # nocheck: This is expanded during compilation
 CONFIG_NL80211_TESTMODE=y
 CONFIG_MAC80211=m
 CONFIG_SND_SOC_MT8696=m
@@ -192,5 +192,6 @@
 # CONFIG_MTK_SCPSYS_PM_DOMAINS is not set
 # CONFIG_MTK_SCPSYS is not set
 # CONFIG_MODULE_SIG_ALL is not set
+# CONFIG_ARM_MEDIATEK_CPUFREQ_HW is not set
 CONFIG_MTK_DMABUF_DEFFERRED_MAX_MBYTES=32
 CONFIG_DEVICE_MODULES_SPI_SPIDEV=m
diff --git a/device.bazelrc b/device.bazelrc
index d52a4df..747e652 100644
--- a/device.bazelrc
+++ b/device.bazelrc
@@ -1,6 +1,6 @@
 build:download_gki --use_prebuilt_gki
 build:download_gki --use_signed_prebuilts
-build:download_gki --action_env=KLEAF_DOWNLOAD_BUILD_NUMBER_MAP="gki_prebuilts=12916019"
+build:download_gki --action_env=KLEAF_DOWNLOAD_BUILD_NUMBER_MAP="gki_prebuilts=13512086"
 build:no_download_gki --use_prebuilt_gki=false
 
 # disable GKI prebuilts by default
diff --git a/drivers/gpu/img-rogue/23.2/build/linux/config/core.mk b/drivers/gpu/img-rogue/23.2/build/linux/config/core.mk
index 7b7b8ab..8966b22 100644
--- a/drivers/gpu/img-rogue/23.2/build/linux/config/core.mk
+++ b/drivers/gpu/img-rogue/23.2/build/linux/config/core.mk
@@ -1281,6 +1281,9 @@
 $(eval $(call TunableBothConfigC,RGX_FW_IRQ_OS_COUNTERS,))
 $(eval $(call TunableBothConfigC,RGX_IRQ_HYPERV_HANDLER,))
 
+PVRSRV_MAX_REAL_TIME_CONTEXTS ?= 1
+$(eval $(call KernelConfigC,PVRSRV_MAX_REAL_TIME_CONTEXTS,$(PVRSRV_MAX_REAL_TIME_CONTEXTS),))
+
 #
 # GPU virtualization validation
 #
diff --git a/drivers/gpu/img-rogue/23.2/build/linux/config/core_volcanic.mk b/drivers/gpu/img-rogue/23.2/build/linux/config/core_volcanic.mk
index 6db6dbd..9dbd8b9 100644
--- a/drivers/gpu/img-rogue/23.2/build/linux/config/core_volcanic.mk
+++ b/drivers/gpu/img-rogue/23.2/build/linux/config/core_volcanic.mk
@@ -1102,6 +1102,10 @@
 $(eval $(call TunableBothConfigC,PVR_ENABLE_PHR,,\
 Enable the Periodic Hardware Reset functionality (PHR)))
 
+
+PVRSRV_MAX_REAL_TIME_CONTEXTS ?= 1
+$(eval $(call KernelConfigC,PVRSRV_MAX_REAL_TIME_CONTEXTS,$(PVRSRV_MAX_REAL_TIME_CONTEXTS),))
+
 #
 # GPU virtualization validation
 #
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/cache_bridge/server_cache_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/cache_bridge/server_cache_bridge.c
index b2f5267..614599b 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/cache_bridge/server_cache_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/cache_bridge/server_cache_bridge.c
@@ -68,7 +68,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 static_assert(CACHE_BATCH_MAX <= IMG_UINT32_MAX,
 	      "CACHE_BATCH_MAX must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeCacheOpQueue(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psCacheOpQueueIN_UI8,
 			 IMG_UINT8 * psCacheOpQueueOUT_UI8, CONNECTION_DATA * psConnection)
@@ -300,10 +300,10 @@ PVRSRVBridgeCacheOpQueue(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CACHEOPQUEUE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeCacheOpExec(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psCacheOpExecIN_UI8,
 			IMG_UINT8 * psCacheOpExecOUT_UI8, CONNECTION_DATA * psConnection)
@@ -352,10 +352,10 @@ PVRSRVBridgeCacheOpExec(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CACHEOPEXEC, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeCacheOpLog(IMG_UINT32 ui32DispatchTableEntry,
 		       IMG_UINT8 * psCacheOpLogIN_UI8,
 		       IMG_UINT8 * psCacheOpLogOUT_UI8, CONNECTION_DATA * psConnection)
@@ -406,7 +406,7 @@ PVRSRVBridgeCacheOpLog(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CACHEOPLOG, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/cmm_bridge/server_cmm_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/cmm_bridge/server_cmm_bridge.c
index cc658c7..019daf5 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/cmm_bridge/server_cmm_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/cmm_bridge/server_cmm_bridge.c
@@ -75,7 +75,7 @@ static PVRSRV_ERROR _DevmemIntExportCtxpsContextExportIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntExportCtx(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psDevmemIntExportCtxIN_UI8,
 			       IMG_UINT8 * psDevmemIntExportCtxOUT_UI8,
@@ -179,10 +179,10 @@ PVRSRVBridgeDevmemIntExportCtx(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTEXPORTCTX, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnexportCtx(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psDevmemIntUnexportCtxIN_UI8,
 				 IMG_UINT8 * psDevmemIntUnexportCtxOUT_UI8,
@@ -218,7 +218,7 @@ PVRSRVBridgeDevmemIntUnexportCtx(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntUnexportCtx_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNEXPORTCTX, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntAcquireRemoteCtxpsContextIntRelease(void *pvData)
@@ -228,7 +228,7 @@ static PVRSRV_ERROR _DevmemIntAcquireRemoteCtxpsContextIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntAcquireRemoteCtx(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psDevmemIntAcquireRemoteCtxIN_UI8,
 				      IMG_UINT8 * psDevmemIntAcquireRemoteCtxOUT_UI8,
@@ -352,7 +352,7 @@ PVRSRVBridgeDevmemIntAcquireRemoteCtx(IMG_UINT32 ui32DispatchTableEntry,
 
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTACQUIREREMOTECTX, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/devicememhistory_bridge/server_devicememhistory_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/devicememhistory_bridge/server_devicememhistory_bridge.c
index 72c6a86..fa81161 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/devicememhistory_bridge/server_devicememhistory_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/devicememhistory_bridge/server_devicememhistory_bridge.c
@@ -71,7 +71,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevicememHistoryMap(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psDevicememHistoryMapIN_UI8,
 				IMG_UINT8 * psDevicememHistoryMapOUT_UI8,
@@ -199,13 +199,13 @@ PVRSRVBridgeDevicememHistoryMap(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVICEMEMHISTORYMAP, eError);
 }
 
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevicememHistoryUnmap(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psDevicememHistoryUnmapIN_UI8,
 				  IMG_UINT8 * psDevicememHistoryUnmapOUT_UI8,
@@ -333,13 +333,13 @@ PVRSRVBridgeDevicememHistoryUnmap(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVICEMEMHISTORYUNMAP, eError);
 }
 
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevicememHistoryMapVRange(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psDevicememHistoryMapVRangeIN_UI8,
 				      IMG_UINT8 * psDevicememHistoryMapVRangeOUT_UI8,
@@ -438,13 +438,13 @@ PVRSRVBridgeDevicememHistoryMapVRange(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVICEMEMHISTORYMAPVRANGE, eError);
 }
 
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevicememHistoryUnmapVRange(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psDevicememHistoryUnmapVRangeIN_UI8,
 					IMG_UINT8 * psDevicememHistoryUnmapVRangeOUT_UI8,
@@ -546,7 +546,7 @@ PVRSRVBridgeDevicememHistoryUnmapVRange(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVICEMEMHISTORYUNMAPVRANGE, eError);
 }
 
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
@@ -556,7 +556,7 @@ static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 	      "PMR_MAX_SUPPORTED_4K_PAGE_COUNT must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevicememHistorySparseChange(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psDevicememHistorySparseChangeIN_UI8,
 					 IMG_UINT8 * psDevicememHistorySparseChangeOUT_UI8,
@@ -758,7 +758,7 @@ PVRSRVBridgeDevicememHistorySparseChange(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVICEMEMHISTORYSPARSECHANGE, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/di_bridge/server_di_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/di_bridge/server_di_bridge.c
index 154bccd..04c2af8 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/di_bridge/server_di_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/di_bridge/server_di_bridge.c
@@ -75,7 +75,7 @@ static PVRSRV_ERROR _DICreateContextpsContextIntRelease(void *pvData)
 static_assert(PRVSRVTL_MAX_STREAM_NAME_SIZE <= IMG_UINT32_MAX,
 	      "PRVSRVTL_MAX_STREAM_NAME_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDICreateContext(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psDICreateContextIN_UI8,
 			    IMG_UINT8 * psDICreateContextOUT_UI8, CONNECTION_DATA * psConnection)
@@ -227,10 +227,10 @@ PVRSRVBridgeDICreateContext(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DICREATECONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDIDestroyContext(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psDIDestroyContextIN_UI8,
 			     IMG_UINT8 * psDIDestroyContextOUT_UI8, CONNECTION_DATA * psConnection)
@@ -262,13 +262,13 @@ PVRSRVBridgeDIDestroyContext(IMG_UINT32 ui32DispatchTableEntry,
 
 DIDestroyContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DIDESTROYCONTEXT, eError);
 }
 
 static_assert(DI_IMPL_BRG_PATH_LEN <= IMG_UINT32_MAX,
 	      "DI_IMPL_BRG_PATH_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDIReadEntry(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psDIReadEntryIN_UI8,
 			IMG_UINT8 * psDIReadEntryOUT_UI8, CONNECTION_DATA * psConnection)
@@ -387,7 +387,7 @@ PVRSRVBridgeDIReadEntry(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DIREADENTRY, eError);
 }
 
 static_assert(DI_IMPL_BRG_PATH_LEN <= IMG_UINT32_MAX,
@@ -395,7 +395,7 @@ static_assert(DI_IMPL_BRG_PATH_LEN <= IMG_UINT32_MAX,
 static_assert(DI_IMPL_BRG_PATH_LEN <= IMG_UINT32_MAX,
 	      "DI_IMPL_BRG_PATH_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDIWriteEntry(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psDIWriteEntryIN_UI8,
 			 IMG_UINT8 * psDIWriteEntryOUT_UI8, CONNECTION_DATA * psConnection)
@@ -543,10 +543,10 @@ PVRSRVBridgeDIWriteEntry(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DIWRITEENTRY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDIListAllEntries(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psDIListAllEntriesIN_UI8,
 			     IMG_UINT8 * psDIListAllEntriesOUT_UI8, CONNECTION_DATA * psConnection)
@@ -591,7 +591,7 @@ PVRSRVBridgeDIListAllEntries(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DILISTALLENTRIES, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/dmabuf_bridge/server_dmabuf_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/dmabuf_bridge/server_dmabuf_bridge.c
index d3b3279..56fb021 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/dmabuf_bridge/server_dmabuf_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/dmabuf_bridge/server_dmabuf_bridge.c
@@ -76,7 +76,7 @@ static PVRSRV_ERROR _PhysmemImportDmaBufpsPMRPtrIntRelease(void *pvData)
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemImportDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPhysmemImportDmaBufIN_UI8,
 				IMG_UINT8 * psPhysmemImportDmaBufOUT_UI8,
@@ -218,7 +218,7 @@ PVRSRVBridgePhysmemImportDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMIMPORTDMABUF, eError);
 }
 
 static PVRSRV_ERROR _PhysmemImportDmaBufLockedpsPMRPtrIntRelease(void *pvData)
@@ -231,7 +231,7 @@ static PVRSRV_ERROR _PhysmemImportDmaBufLockedpsPMRPtrIntRelease(void *pvData)
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemImportDmaBufLocked(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psPhysmemImportDmaBufLockedIN_UI8,
 				      IMG_UINT8 * psPhysmemImportDmaBufLockedOUT_UI8,
@@ -374,10 +374,10 @@ PVRSRVBridgePhysmemImportDmaBufLocked(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMIMPORTDMABUFLOCKED, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemExportDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPhysmemExportDmaBufIN_UI8,
 				IMG_UINT8 * psPhysmemExportDmaBufOUT_UI8,
@@ -427,7 +427,7 @@ PVRSRVBridgePhysmemExportDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMEXPORTDMABUF, eError);
 }
 
 static PVRSRV_ERROR _PhysmemImportSparseDmaBufpsPMRPtrIntRelease(void *pvData)
@@ -442,7 +442,7 @@ static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemImportSparseDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psPhysmemImportSparseDmaBufIN_UI8,
 				      IMG_UINT8 * psPhysmemImportSparseDmaBufOUT_UI8,
@@ -620,7 +620,7 @@ PVRSRVBridgePhysmemImportSparseDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMIMPORTSPARSEDMABUF, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/htbuffer_bridge/server_htbuffer_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/htbuffer_bridge/server_htbuffer_bridge.c
index 50b4fcb..d9845cc 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/htbuffer_bridge/server_htbuffer_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/htbuffer_bridge/server_htbuffer_bridge.c
@@ -72,7 +72,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 static_assert(HTB_FLAG_NUM_EL <= IMG_UINT32_MAX,
 	      "HTB_FLAG_NUM_EL must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHTBControl(IMG_UINT32 ui32DispatchTableEntry,
 		       IMG_UINT8 * psHTBControlIN_UI8,
 		       IMG_UINT8 * psHTBControlOUT_UI8, CONNECTION_DATA * psConnection)
@@ -175,7 +175,7 @@ PVRSRVBridgeHTBControl(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HTBCONTROL, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/mm_bridge/server_mm_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/mm_bridge/server_mm_bridge.c
index 07f82bd..d476d7f 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/mm_bridge/server_mm_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/mm_bridge/server_mm_bridge.c
@@ -89,7 +89,7 @@ static PVRSRV_ERROR _PMRExportPMRpsPMRExportIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRExportPMR(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psPMRExportPMRIN_UI8,
 			 IMG_UINT8 * psPMRExportPMROUT_UI8, CONNECTION_DATA * psConnection)
@@ -254,7 +254,7 @@ PVRSRVBridgePMRExportPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMREXPORTPMR, eError);
 }
 
 #else
@@ -263,7 +263,7 @@ PVRSRVBridgePMRExportPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 #if defined(SUPPORT_INSECURE_EXPORT)
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRUnexportPMR(IMG_UINT32 ui32DispatchTableEntry,
 			   IMG_UINT8 * psPMRUnexportPMRIN_UI8,
 			   IMG_UINT8 * psPMRUnexportPMROUT_UI8, CONNECTION_DATA * psConnection)
@@ -351,14 +351,14 @@ PVRSRVBridgePMRUnexportPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 PMRUnexportPMR_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRUNEXPORTPMR, eError);
 }
 
 #else
 #define PVRSRVBridgePMRUnexportPMR NULL
 #endif
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRGetUID(IMG_UINT32 ui32DispatchTableEntry,
 		      IMG_UINT8 * psPMRGetUIDIN_UI8,
 		      IMG_UINT8 * psPMRGetUIDOUT_UI8, CONNECTION_DATA * psConnection)
@@ -403,7 +403,7 @@ PVRSRVBridgePMRGetUID(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRGETUID, eError);
 }
 
 static PVRSRV_ERROR _PMRMakeLocalImportHandlepsExtMemIntRelease(void *pvData)
@@ -413,7 +413,7 @@ static PVRSRV_ERROR _PMRMakeLocalImportHandlepsExtMemIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRMakeLocalImportHandle(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psPMRMakeLocalImportHandleIN_UI8,
 				     IMG_UINT8 * psPMRMakeLocalImportHandleOUT_UI8,
@@ -497,10 +497,10 @@ PVRSRVBridgePMRMakeLocalImportHandle(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRMAKELOCALIMPORTHANDLE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRUnmakeLocalImportHandle(IMG_UINT32 ui32DispatchTableEntry,
 				       IMG_UINT8 * psPMRUnmakeLocalImportHandleIN_UI8,
 				       IMG_UINT8 * psPMRUnmakeLocalImportHandleOUT_UI8,
@@ -536,7 +536,7 @@ PVRSRVBridgePMRUnmakeLocalImportHandle(IMG_UINT32 ui32DispatchTableEntry,
 
 PMRUnmakeLocalImportHandle_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRUNMAKELOCALIMPORTHANDLE, eError);
 }
 
 #if defined(SUPPORT_INSECURE_EXPORT)
@@ -547,7 +547,7 @@ static PVRSRV_ERROR _PMRImportPMRpsPMRIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRImportPMR(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psPMRImportPMRIN_UI8,
 			 IMG_UINT8 * psPMRImportPMROUT_UI8, CONNECTION_DATA * psConnection)
@@ -632,7 +632,7 @@ PVRSRVBridgePMRImportPMR(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRIMPORTPMR, eError);
 }
 
 #else
@@ -646,7 +646,7 @@ static PVRSRV_ERROR _PMRLocalImportPMRpsPMRIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRLocalImportPMR(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psPMRLocalImportPMRIN_UI8,
 			      IMG_UINT8 * psPMRLocalImportPMROUT_UI8,
@@ -730,10 +730,10 @@ PVRSRVBridgePMRLocalImportPMR(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRLOCALIMPORTPMR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRUnrefPMR(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psPMRUnrefPMRIN_UI8,
 			IMG_UINT8 * psPMRUnrefPMROUT_UI8, CONNECTION_DATA * psConnection)
@@ -765,10 +765,10 @@ PVRSRVBridgePMRUnrefPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 PMRUnrefPMR_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRUNREFPMR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRUnrefUnlockPMR(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psPMRUnrefUnlockPMRIN_UI8,
 			      IMG_UINT8 * psPMRUnrefUnlockPMROUT_UI8,
@@ -801,7 +801,7 @@ PVRSRVBridgePMRUnrefUnlockPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 PMRUnrefUnlockPMR_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRUNREFUNLOCKPMR, eError);
 }
 
 static PVRSRV_ERROR _PhysmemNewRamBackedPMRpsPMRPtrIntRelease(void *pvData)
@@ -816,7 +816,7 @@ static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemNewRamBackedPMR(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psPhysmemNewRamBackedPMRIN_UI8,
 				   IMG_UINT8 * psPhysmemNewRamBackedPMROUT_UI8,
@@ -999,7 +999,7 @@ PVRSRVBridgePhysmemNewRamBackedPMR(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMNEWRAMBACKEDPMR, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntCtxCreatepsDevMemServerContextIntRelease(void *pvData)
@@ -1009,7 +1009,7 @@ static PVRSRV_ERROR _DevmemIntCtxCreatepsDevMemServerContextIntRelease(void *pvD
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntCtxCreate(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psDevmemIntCtxCreateIN_UI8,
 			       IMG_UINT8 * psDevmemIntCtxCreateOUT_UI8,
@@ -1108,10 +1108,10 @@ PVRSRVBridgeDevmemIntCtxCreate(IMG_UINT32 ui32DispatchTableEntry,
 
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTCTXCREATE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntCtxDestroy(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psDevmemIntCtxDestroyIN_UI8,
 				IMG_UINT8 * psDevmemIntCtxDestroyOUT_UI8,
@@ -1149,7 +1149,7 @@ PVRSRVBridgeDevmemIntCtxDestroy(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntCtxDestroy_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTCTXDESTROY, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntHeapCreatepsDevmemHeapPtrIntRelease(void *pvData)
@@ -1159,7 +1159,7 @@ static PVRSRV_ERROR _DevmemIntHeapCreatepsDevmemHeapPtrIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntHeapCreate(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psDevmemIntHeapCreateIN_UI8,
 				IMG_UINT8 * psDevmemIntHeapCreateOUT_UI8,
@@ -1246,10 +1246,10 @@ PVRSRVBridgeDevmemIntHeapCreate(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTHEAPCREATE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntHeapDestroy(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psDevmemIntHeapDestroyIN_UI8,
 				 IMG_UINT8 * psDevmemIntHeapDestroyOUT_UI8,
@@ -1285,7 +1285,7 @@ PVRSRVBridgeDevmemIntHeapDestroy(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntHeapDestroy_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTHEAPDESTROY, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntMapPMRpsMappingIntRelease(void *pvData)
@@ -1295,7 +1295,7 @@ static PVRSRV_ERROR _DevmemIntMapPMRpsMappingIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntMapPMR(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psDevmemIntMapPMRIN_UI8,
 			    IMG_UINT8 * psDevmemIntMapPMROUT_UI8, CONNECTION_DATA * psConnection)
@@ -1418,10 +1418,10 @@ PVRSRVBridgeDevmemIntMapPMR(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTMAPPMR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnmapPMR(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psDevmemIntUnmapPMRIN_UI8,
 			      IMG_UINT8 * psDevmemIntUnmapPMROUT_UI8,
@@ -1454,7 +1454,7 @@ PVRSRVBridgeDevmemIntUnmapPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntUnmapPMR_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNMAPPMR, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntReserveRangepsReservationIntRelease(void *pvData)
@@ -1464,7 +1464,7 @@ static PVRSRV_ERROR _DevmemIntReserveRangepsReservationIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntReserveRange(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psDevmemIntReserveRangeIN_UI8,
 				  IMG_UINT8 * psDevmemIntReserveRangeOUT_UI8,
@@ -1550,7 +1550,7 @@ PVRSRVBridgeDevmemIntReserveRange(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTRESERVERANGE, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntReserveRangeAndMapPMRpsMappingIntRelease(void *pvData)
@@ -1560,7 +1560,7 @@ static PVRSRV_ERROR _DevmemIntReserveRangeAndMapPMRpsMappingIntRelease(void *pvD
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntReserveRangeAndMapPMR(IMG_UINT32 ui32DispatchTableEntry,
 					   IMG_UINT8 * psDevmemIntReserveRangeAndMapPMRIN_UI8,
 					   IMG_UINT8 * psDevmemIntReserveRangeAndMapPMROUT_UI8,
@@ -1668,10 +1668,10 @@ PVRSRVBridgeDevmemIntReserveRangeAndMapPMR(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTRESERVERANGEANDMAPPMR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnreserveRangeAndUnmapPMR(IMG_UINT32 ui32DispatchTableEntry,
 					       IMG_UINT8 *
 					       psDevmemIntUnreserveRangeAndUnmapPMRIN_UI8,
@@ -1713,10 +1713,10 @@ PVRSRVBridgeDevmemIntUnreserveRangeAndUnmapPMR(IMG_UINT32 ui32DispatchTableEntry
 
 DevmemIntUnreserveRangeAndUnmapPMR_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNRESERVERANGEANDUNMAPPMR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnreserveRange(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psDevmemIntUnreserveRangeIN_UI8,
 				    IMG_UINT8 * psDevmemIntUnreserveRangeOUT_UI8,
@@ -1754,7 +1754,7 @@ PVRSRVBridgeDevmemIntUnreserveRange(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntUnreserveRange_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNRESERVERANGE, eError);
 }
 
 static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
@@ -1762,7 +1762,7 @@ static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 	      "PMR_MAX_SUPPORTED_4K_PAGE_COUNT must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeChangeSparseMem(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psChangeSparseMemIN_UI8,
 			    IMG_UINT8 * psChangeSparseMemOUT_UI8, CONNECTION_DATA * psConnection)
@@ -1946,10 +1946,10 @@ PVRSRVBridgeChangeSparseMem(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CHANGESPARSEMEM, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIsVDevAddrValid(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psDevmemIsVDevAddrValidIN_UI8,
 				  IMG_UINT8 * psDevmemIsVDevAddrValidOUT_UI8,
@@ -1999,12 +1999,12 @@ PVRSRVBridgeDevmemIsVDevAddrValid(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMISVDEVADDRVALID, eError);
 }
 
 #if defined(RGX_FEATURE_FBCDC)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemInvalidateFBSCTable(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psDevmemInvalidateFBSCTableIN_UI8,
 				      IMG_UINT8 * psDevmemInvalidateFBSCTableOUT_UI8,
@@ -2054,14 +2054,14 @@ PVRSRVBridgeDevmemInvalidateFBSCTable(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINVALIDATEFBSCTABLE, eError);
 }
 
 #else
 #define PVRSRVBridgeDevmemInvalidateFBSCTable NULL
 #endif
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHeapCfgHeapConfigCount(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psHeapCfgHeapConfigCountIN_UI8,
 				   IMG_UINT8 * psHeapCfgHeapConfigCountOUT_UI8,
@@ -2080,10 +2080,10 @@ PVRSRVBridgeHeapCfgHeapConfigCount(IMG_UINT32 ui32DispatchTableEntry,
 	    HeapCfgHeapConfigCount(psConnection, OSGetDevNode(psConnection),
 				   &psHeapCfgHeapConfigCountOUT->ui32NumHeapConfigs);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HEAPCFGHEAPCONFIGCOUNT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHeapCfgHeapCount(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psHeapCfgHeapCountIN_UI8,
 			     IMG_UINT8 * psHeapCfgHeapCountOUT_UI8, CONNECTION_DATA * psConnection)
@@ -2098,13 +2098,13 @@ PVRSRVBridgeHeapCfgHeapCount(IMG_UINT32 ui32DispatchTableEntry,
 			     psHeapCfgHeapCountIN->ui32HeapConfigIndex,
 			     &psHeapCfgHeapCountOUT->ui32NumHeaps);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HEAPCFGHEAPCOUNT, eError);
 }
 
 static_assert(DEVMEM_HEAPNAME_MAXLENGTH <= IMG_UINT32_MAX,
 	      "DEVMEM_HEAPNAME_MAXLENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHeapCfgHeapConfigName(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psHeapCfgHeapConfigNameIN_UI8,
 				  IMG_UINT8 * psHeapCfgHeapConfigNameOUT_UI8,
@@ -2220,13 +2220,13 @@ PVRSRVBridgeHeapCfgHeapConfigName(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HEAPCFGHEAPCONFIGNAME, eError);
 }
 
 static_assert(DEVMEM_HEAPNAME_MAXLENGTH <= IMG_UINT32_MAX,
 	      "DEVMEM_HEAPNAME_MAXLENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHeapCfgHeapDetails(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psHeapCfgHeapDetailsIN_UI8,
 			       IMG_UINT8 * psHeapCfgHeapDetailsOUT_UI8,
@@ -2342,10 +2342,10 @@ PVRSRVBridgeHeapCfgHeapDetails(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HEAPCFGHEAPDETAILS, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntRegisterPFNotifyKM(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psDevmemIntRegisterPFNotifyKMIN_UI8,
 					IMG_UINT8 * psDevmemIntRegisterPFNotifyKMOUT_UI8,
@@ -2394,13 +2394,13 @@ PVRSRVBridgeDevmemIntRegisterPFNotifyKM(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTREGISTERPFNOTIFYKM, eError);
 }
 
 static_assert(PVRSRV_PHYS_HEAP_LAST <= IMG_UINT32_MAX,
 	      "PVRSRV_PHYS_HEAP_LAST must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysHeapGetMemInfo(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psPhysHeapGetMemInfoIN_UI8,
 			       IMG_UINT8 * psPhysHeapGetMemInfoOUT_UI8,
@@ -2538,10 +2538,10 @@ PVRSRVBridgePhysHeapGetMemInfo(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSHEAPGETMEMINFO, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeGetDefaultPhysicalHeap(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psGetDefaultPhysicalHeapIN_UI8,
 				   IMG_UINT8 * psGetDefaultPhysicalHeapOUT_UI8,
@@ -2560,10 +2560,10 @@ PVRSRVBridgeGetDefaultPhysicalHeap(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVGetDefaultPhysicalHeapKM(psConnection, OSGetDevNode(psConnection),
 					   &psGetDefaultPhysicalHeapOUT->eHeap);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_GETDEFAULTPHYSICALHEAP, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemGetFaultAddress(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psDevmemGetFaultAddressIN_UI8,
 				  IMG_UINT8 * psDevmemGetFaultAddressOUT_UI8,
@@ -2613,12 +2613,12 @@ PVRSRVBridgeDevmemGetFaultAddress(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMGETFAULTADDRESS, eError);
 }
 
 #if defined(PVRSRV_ENABLE_PROCESS_STATS)
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVStatsUpdateOOMStat(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psPVRSRVStatsUpdateOOMStatIN_UI8,
 				     IMG_UINT8 * psPVRSRVStatsUpdateOOMStatOUT_UI8,
@@ -2636,7 +2636,7 @@ PVRSRVBridgePVRSRVStatsUpdateOOMStat(IMG_UINT32 ui32DispatchTableEntry,
 				     psPVRSRVStatsUpdateOOMStatIN->ui32ui32StatType,
 				     psPVRSRVStatsUpdateOOMStatIN->ui32pid);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVSTATSUPDATEOOMSTAT, eError);
 }
 
 #else
@@ -2650,7 +2650,7 @@ static PVRSRV_ERROR _DevmemXIntReserveRangepsReservationIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemXIntReserveRange(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psDevmemXIntReserveRangeIN_UI8,
 				   IMG_UINT8 * psDevmemXIntReserveRangeOUT_UI8,
@@ -2736,10 +2736,10 @@ PVRSRVBridgeDevmemXIntReserveRange(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMXINTRESERVERANGE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemXIntUnreserveRange(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psDevmemXIntUnreserveRangeIN_UI8,
 				     IMG_UINT8 * psDevmemXIntUnreserveRangeOUT_UI8,
@@ -2777,10 +2777,10 @@ PVRSRVBridgeDevmemXIntUnreserveRange(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemXIntUnreserveRange_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMXINTUNRESERVERANGE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemXIntMapPages(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psDevmemXIntMapPagesIN_UI8,
 			       IMG_UINT8 * psDevmemXIntMapPagesOUT_UI8,
@@ -2855,10 +2855,10 @@ PVRSRVBridgeDevmemXIntMapPages(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMXINTMAPPAGES, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemXIntUnmapPages(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psDevmemXIntUnmapPagesIN_UI8,
 				 IMG_UINT8 * psDevmemXIntUnmapPagesOUT_UI8,
@@ -2911,10 +2911,10 @@ PVRSRVBridgeDevmemXIntUnmapPages(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMXINTUNMAPPAGES, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemXIntMapVRangeToBackingPage(IMG_UINT32 ui32DispatchTableEntry,
 					     IMG_UINT8 * psDevmemXIntMapVRangeToBackingPageIN_UI8,
 					     IMG_UINT8 * psDevmemXIntMapVRangeToBackingPageOUT_UI8,
@@ -2969,7 +2969,7 @@ PVRSRVBridgeDevmemXIntMapVRangeToBackingPage(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMXINTMAPVRANGETOBACKINGPAGE, eError);
 }
 
 static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
@@ -2977,7 +2977,7 @@ static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 	      "PMR_MAX_SUPPORTED_4K_PAGE_COUNT must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeChangeSparseMem2(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psChangeSparseMem2IN_UI8,
 			     IMG_UINT8 * psChangeSparseMem2OUT_UI8, CONNECTION_DATA * psConnection)
@@ -3181,7 +3181,7 @@ PVRSRVBridgeChangeSparseMem2(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CHANGESPARSEMEM2, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntReserveRange2psReservationIntRelease(void *pvData)
@@ -3191,7 +3191,7 @@ static PVRSRV_ERROR _DevmemIntReserveRange2psReservationIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntReserveRange2(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psDevmemIntReserveRange2IN_UI8,
 				   IMG_UINT8 * psDevmemIntReserveRange2OUT_UI8,
@@ -3278,10 +3278,10 @@ PVRSRVBridgeDevmemIntReserveRange2(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTRESERVERANGE2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnreserveRange2(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psDevmemIntUnreserveRange2IN_UI8,
 				     IMG_UINT8 * psDevmemIntUnreserveRange2OUT_UI8,
@@ -3319,10 +3319,10 @@ PVRSRVBridgeDevmemIntUnreserveRange2(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntUnreserveRange2_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNRESERVERANGE2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntMapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psDevmemIntMapPMR2IN_UI8,
 			     IMG_UINT8 * psDevmemIntMapPMR2OUT_UI8, CONNECTION_DATA * psConnection)
@@ -3411,10 +3411,10 @@ PVRSRVBridgeDevmemIntMapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTMAPPMR2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnmapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psDevmemIntUnmapPMR2IN_UI8,
 			       IMG_UINT8 * psDevmemIntUnmapPMR2OUT_UI8,
@@ -3463,7 +3463,7 @@ PVRSRVBridgeDevmemIntUnmapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNMAPPMR2, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntReserveRangeAndMapPMR2psReservationIntRelease(void *pvData)
@@ -3473,7 +3473,7 @@ static PVRSRV_ERROR _DevmemIntReserveRangeAndMapPMR2psReservationIntRelease(void
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntReserveRangeAndMapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 					    IMG_UINT8 * psDevmemIntReserveRangeAndMapPMR2IN_UI8,
 					    IMG_UINT8 * psDevmemIntReserveRangeAndMapPMR2OUT_UI8,
@@ -3582,10 +3582,10 @@ PVRSRVBridgeDevmemIntReserveRangeAndMapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTRESERVERANGEANDMAPPMR2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnreserveRangeAndUnmapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 						IMG_UINT8 *
 						psDevmemIntUnreserveRangeAndUnmapPMR2IN_UI8,
@@ -3628,7 +3628,7 @@ PVRSRVBridgeDevmemIntUnreserveRangeAndUnmapPMR2(IMG_UINT32 ui32DispatchTableEntr
 
 DevmemIntUnreserveRangeAndUnmapPMR2_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNRESERVERANGEANDUNMAPPMR2, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/mmextmem_bridge/server_mmextmem_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/mmextmem_bridge/server_mmextmem_bridge.c
index 538d04c..9d018ff 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/mmextmem_bridge/server_mmextmem_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/mmextmem_bridge/server_mmextmem_bridge.c
@@ -76,7 +76,7 @@ static PVRSRV_ERROR _PhysmemWrapExtMempsPMRPtrIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemWrapExtMem(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psPhysmemWrapExtMemIN_UI8,
 			      IMG_UINT8 * psPhysmemWrapExtMemOUT_UI8,
@@ -131,7 +131,7 @@ PVRSRVBridgePhysmemWrapExtMem(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMWRAPEXTMEM, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/pdump_bridge/server_pdump_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/pdump_bridge/server_pdump_bridge.c
index 6b3baf6..8099578 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/pdump_bridge/server_pdump_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/pdump_bridge/server_pdump_bridge.c
@@ -70,7 +70,7 @@ static_assert(PVRSRV_PDUMP_MAX_FILENAME_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRV_PDUMP_MAX_FILENAME_SIZE must not be larger than IMG_UINT32_MAX");
 static_assert(4 <= IMG_UINT32_MAX, "4 must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpImageDescriptor(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psPDumpImageDescriptorIN_UI8,
 				 IMG_UINT8 * psPDumpImageDescriptorOUT_UI8,
@@ -241,13 +241,13 @@ PVRSRVBridgePDumpImageDescriptor(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPIMAGEDESCRIPTOR, eError);
 }
 
 static_assert(PVRSRV_PDUMP_MAX_COMMENT_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRV_PDUMP_MAX_COMMENT_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpComment(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psPVRSRVPDumpCommentIN_UI8,
 			       IMG_UINT8 * psPVRSRVPDumpCommentOUT_UI8,
@@ -349,10 +349,10 @@ PVRSRVBridgePVRSRVPDumpComment(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPCOMMENT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpSetFrame(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPVRSRVPDumpSetFrameIN_UI8,
 				IMG_UINT8 * psPVRSRVPDumpSetFrameOUT_UI8,
@@ -369,13 +369,13 @@ PVRSRVBridgePVRSRVPDumpSetFrame(IMG_UINT32 ui32DispatchTableEntry,
 	    PDumpSetFrameKM(psConnection, OSGetDevNode(psConnection),
 			    psPVRSRVPDumpSetFrameIN->ui32Frame);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPSETFRAME, eError);
 }
 
 static_assert(PVRSRV_PDUMP_MAX_FILENAME_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRV_PDUMP_MAX_FILENAME_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpDataDescriptor(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPDumpDataDescriptorIN_UI8,
 				IMG_UINT8 * psPDumpDataDescriptorOUT_UI8,
@@ -515,7 +515,7 @@ PVRSRVBridgePDumpDataDescriptor(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPDATADESCRIPTOR, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/pdumpctrl_bridge/server_pdumpctrl_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/pdumpctrl_bridge/server_pdumpctrl_bridge.c
index 2d5578c..1d25737 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/pdumpctrl_bridge/server_pdumpctrl_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/pdumpctrl_bridge/server_pdumpctrl_bridge.c
@@ -67,7 +67,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpGetState(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPVRSRVPDumpGetStateIN_UI8,
 				IMG_UINT8 * psPVRSRVPDumpGetStateOUT_UI8,
@@ -85,10 +85,10 @@ PVRSRVBridgePVRSRVPDumpGetState(IMG_UINT32 ui32DispatchTableEntry,
 
 	psPVRSRVPDumpGetStateOUT->eError = PDumpGetStateKM(&psPVRSRVPDumpGetStateOUT->ui64State);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPGETSTATE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpGetFrame(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPVRSRVPDumpGetFrameIN_UI8,
 				IMG_UINT8 * psPVRSRVPDumpGetFrameOUT_UI8,
@@ -107,10 +107,10 @@ PVRSRVBridgePVRSRVPDumpGetFrame(IMG_UINT32 ui32DispatchTableEntry,
 	    PDumpGetFrameKM(psConnection, OSGetDevNode(psConnection),
 			    &psPVRSRVPDumpGetFrameOUT->ui32Frame);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPGETFRAME, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpSetDefaultCaptureParams(IMG_UINT32 ui32DispatchTableEntry,
 					       IMG_UINT8 *
 					       psPVRSRVPDumpSetDefaultCaptureParamsIN_UI8,
@@ -138,10 +138,10 @@ PVRSRVBridgePVRSRVPDumpSetDefaultCaptureParams(IMG_UINT32 ui32DispatchTableEntry
 					   psPVRSRVPDumpSetDefaultCaptureParamsIN->
 					   ui32AutoTermTimeout);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPSETDEFAULTCAPTUREPARAMS, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpIsLastCaptureFrame(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psPVRSRVPDumpIsLastCaptureFrameIN_UI8,
 					  IMG_UINT8 * psPVRSRVPDumpIsLastCaptureFrameOUT_UI8,
@@ -160,10 +160,10 @@ PVRSRVBridgePVRSRVPDumpIsLastCaptureFrame(IMG_UINT32 ui32DispatchTableEntry,
 	psPVRSRVPDumpIsLastCaptureFrameOUT->eError =
 	    PDumpIsLastCaptureFrameKM(&psPVRSRVPDumpIsLastCaptureFrameOUT->bpbIsLastCaptureFrame);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPISLASTCAPTUREFRAME, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpForceCaptureStop(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psPVRSRVPDumpForceCaptureStopIN_UI8,
 					IMG_UINT8 * psPVRSRVPDumpForceCaptureStopOUT_UI8,
@@ -181,7 +181,7 @@ PVRSRVBridgePVRSRVPDumpForceCaptureStop(IMG_UINT32 ui32DispatchTableEntry,
 	psPVRSRVPDumpForceCaptureStopOUT->eError =
 	    PDumpForceCaptureStopKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPFORCECAPTURESTOP, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/pdumpmm_bridge/server_pdumpmm_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/pdumpmm_bridge/server_pdumpmm_bridge.c
index 38e1a66..8fc3b7d 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/pdumpmm_bridge/server_pdumpmm_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/pdumpmm_bridge/server_pdumpmm_bridge.c
@@ -68,7 +68,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpLoadMem(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psPMRPDumpLoadMemIN_UI8,
 			    IMG_UINT8 * psPMRPDumpLoadMemOUT_UI8, CONNECTION_DATA * psConnection)
@@ -117,10 +117,10 @@ PVRSRVBridgePMRPDumpLoadMem(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPLOADMEM, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpLoadMemValue32(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psPMRPDumpLoadMemValue32IN_UI8,
 				   IMG_UINT8 * psPMRPDumpLoadMemValue32OUT_UI8,
@@ -172,10 +172,10 @@ PVRSRVBridgePMRPDumpLoadMemValue32(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPLOADMEMVALUE32, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpLoadMemValue64(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psPMRPDumpLoadMemValue64IN_UI8,
 				   IMG_UINT8 * psPMRPDumpLoadMemValue64OUT_UI8,
@@ -227,13 +227,13 @@ PVRSRVBridgePMRPDumpLoadMemValue64(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPLOADMEMVALUE64, eError);
 }
 
 static_assert(PVRSRV_PDUMP_MAX_FILENAME_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRV_PDUMP_MAX_FILENAME_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpSaveToFile(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psPMRPDumpSaveToFileIN_UI8,
 			       IMG_UINT8 * psPMRPDumpSaveToFileOUT_UI8,
@@ -367,7 +367,7 @@ PVRSRVBridgePMRPDumpSaveToFile(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPSAVETOFILE, eError);
 }
 
 static_assert(PHYSMEM_PDUMP_MEMSPACE_MAX_LENGTH <= IMG_UINT32_MAX,
@@ -375,7 +375,7 @@ static_assert(PHYSMEM_PDUMP_MEMSPACE_MAX_LENGTH <= IMG_UINT32_MAX,
 static_assert(PHYSMEM_PDUMP_SYMNAME_MAX_LENGTH <= IMG_UINT32_MAX,
 	      "PHYSMEM_PDUMP_SYMNAME_MAX_LENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpSymbolicAddr(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psPMRPDumpSymbolicAddrIN_UI8,
 				 IMG_UINT8 * psPMRPDumpSymbolicAddrOUT_UI8,
@@ -553,10 +553,10 @@ PVRSRVBridgePMRPDumpSymbolicAddr(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPSYMBOLICADDR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpPol32(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psPMRPDumpPol32IN_UI8,
 			  IMG_UINT8 * psPMRPDumpPol32OUT_UI8, CONNECTION_DATA * psConnection)
@@ -606,10 +606,10 @@ PVRSRVBridgePMRPDumpPol32(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPPOL32, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpCheck32(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psPMRPDumpCheck32IN_UI8,
 			    IMG_UINT8 * psPMRPDumpCheck32OUT_UI8, CONNECTION_DATA * psConnection)
@@ -659,10 +659,10 @@ PVRSRVBridgePMRPDumpCheck32(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPCHECK32, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpCBP(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psPMRPDumpCBPIN_UI8,
 			IMG_UINT8 * psPMRPDumpCBPOUT_UI8, CONNECTION_DATA * psConnection)
@@ -711,13 +711,13 @@ PVRSRVBridgePMRPDumpCBP(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPCBP, eError);
 }
 
 static_assert(PVRSRV_PDUMP_MAX_FILENAME_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRV_PDUMP_MAX_FILENAME_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntPDumpSaveToFileVirtual(IMG_UINT32 ui32DispatchTableEntry,
 					    IMG_UINT8 * psDevmemIntPDumpSaveToFileVirtualIN_UI8,
 					    IMG_UINT8 * psDevmemIntPDumpSaveToFileVirtualOUT_UI8,
@@ -864,7 +864,7 @@ PVRSRVBridgeDevmemIntPDumpSaveToFileVirtual(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTPDUMPSAVETOFILEVIRTUAL, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/pvrtl_bridge/server_pvrtl_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/pvrtl_bridge/server_pvrtl_bridge.c
index 9facf79..0693d57 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/pvrtl_bridge/server_pvrtl_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/pvrtl_bridge/server_pvrtl_bridge.c
@@ -75,7 +75,7 @@ static PVRSRV_ERROR _TLOpenStreampsSDIntRelease(void *pvData)
 static_assert(PRVSRVTL_MAX_STREAM_NAME_SIZE <= IMG_UINT32_MAX,
 	      "PRVSRVTL_MAX_STREAM_NAME_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLOpenStream(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psTLOpenStreamIN_UI8,
 			 IMG_UINT8 * psTLOpenStreamOUT_UI8, CONNECTION_DATA * psConnection)
@@ -238,10 +238,10 @@ PVRSRVBridgeTLOpenStream(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLOPENSTREAM, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLCloseStream(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psTLCloseStreamIN_UI8,
 			  IMG_UINT8 * psTLCloseStreamOUT_UI8, CONNECTION_DATA * psConnection)
@@ -273,10 +273,10 @@ PVRSRVBridgeTLCloseStream(IMG_UINT32 ui32DispatchTableEntry,
 
 TLCloseStream_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLCLOSESTREAM, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLAcquireData(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psTLAcquireDataIN_UI8,
 			  IMG_UINT8 * psTLAcquireDataOUT_UI8, CONNECTION_DATA * psConnection)
@@ -324,10 +324,10 @@ PVRSRVBridgeTLAcquireData(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLACQUIREDATA, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLReleaseData(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psTLReleaseDataIN_UI8,
 			  IMG_UINT8 * psTLReleaseDataOUT_UI8, CONNECTION_DATA * psConnection)
@@ -375,7 +375,7 @@ PVRSRVBridgeTLReleaseData(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLRELEASEDATA, eError);
 }
 
 static_assert(PRVSRVTL_MAX_STREAM_NAME_SIZE <= IMG_UINT32_MAX,
@@ -383,7 +383,7 @@ static_assert(PRVSRVTL_MAX_STREAM_NAME_SIZE <= IMG_UINT32_MAX,
 static_assert(PVRSRVTL_MAX_DISCOVERABLE_STREAMS_BUFFER <= IMG_UINT32_MAX,
 	      "PVRSRVTL_MAX_DISCOVERABLE_STREAMS_BUFFER must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLDiscoverStreams(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psTLDiscoverStreamsIN_UI8,
 			      IMG_UINT8 * psTLDiscoverStreamsOUT_UI8,
@@ -513,10 +513,10 @@ PVRSRVBridgeTLDiscoverStreams(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLDISCOVERSTREAMS, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLReserveStream(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psTLReserveStreamIN_UI8,
 			    IMG_UINT8 * psTLReserveStreamOUT_UI8, CONNECTION_DATA * psConnection)
@@ -566,10 +566,10 @@ PVRSRVBridgeTLReserveStream(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLRESERVESTREAM, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLCommitStream(IMG_UINT32 ui32DispatchTableEntry,
 			   IMG_UINT8 * psTLCommitStreamIN_UI8,
 			   IMG_UINT8 * psTLCommitStreamOUT_UI8, CONNECTION_DATA * psConnection)
@@ -615,13 +615,13 @@ PVRSRVBridgeTLCommitStream(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLCOMMITSTREAM, eError);
 }
 
 static_assert(PVRSRVTL_MAX_PACKET_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRVTL_MAX_PACKET_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLWriteData(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psTLWriteDataIN_UI8,
 			IMG_UINT8 * psTLWriteDataOUT_UI8, CONNECTION_DATA * psConnection)
@@ -745,7 +745,7 @@ PVRSRVBridgeTLWriteData(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLWRITEDATA, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxbreakpoint_bridge/server_rgxbreakpoint_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxbreakpoint_bridge/server_rgxbreakpoint_bridge.c
index 78fd2b4..2d95e72 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxbreakpoint_bridge/server_rgxbreakpoint_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxbreakpoint_bridge/server_rgxbreakpoint_bridge.c
@@ -67,7 +67,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetBreakpoint(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psRGXSetBreakpointIN_UI8,
 			     IMG_UINT8 * psRGXSetBreakpointOUT_UI8, CONNECTION_DATA * psConnection)
@@ -119,10 +119,10 @@ PVRSRVBridgeRGXSetBreakpoint(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETBREAKPOINT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXClearBreakpoint(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXClearBreakpointIN_UI8,
 			       IMG_UINT8 * psRGXClearBreakpointOUT_UI8,
@@ -170,10 +170,10 @@ PVRSRVBridgeRGXClearBreakpoint(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCLEARBREAKPOINT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXEnableBreakpoint(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRGXEnableBreakpointIN_UI8,
 				IMG_UINT8 * psRGXEnableBreakpointOUT_UI8,
@@ -222,10 +222,10 @@ PVRSRVBridgeRGXEnableBreakpoint(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXENABLEBREAKPOINT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDisableBreakpoint(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psRGXDisableBreakpointIN_UI8,
 				 IMG_UINT8 * psRGXDisableBreakpointOUT_UI8,
@@ -274,10 +274,10 @@ PVRSRVBridgeRGXDisableBreakpoint(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDISABLEBREAKPOINT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXOverallocateBPRegisters(IMG_UINT32 ui32DispatchTableEntry,
 				       IMG_UINT8 * psRGXOverallocateBPRegistersIN_UI8,
 				       IMG_UINT8 * psRGXOverallocateBPRegistersOUT_UI8,
@@ -295,7 +295,7 @@ PVRSRVBridgeRGXOverallocateBPRegisters(IMG_UINT32 ui32DispatchTableEntry,
 					       psRGXOverallocateBPRegistersIN->ui32TempRegs,
 					       psRGXOverallocateBPRegistersIN->ui32SharedRegs);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXOVERALLOCATEBPREGISTERS, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxcmp_bridge/server_rgxcmp_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxcmp_bridge/server_rgxcmp_bridge.c
index a8d284e..111268c 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxcmp_bridge/server_rgxcmp_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxcmp_bridge/server_rgxcmp_bridge.c
@@ -79,7 +79,7 @@ static_assert(RGXFWIF_RF_CMD_SIZE <= IMG_UINT32_MAX,
 static_assert(RGXFWIF_STATIC_COMPUTECONTEXT_SIZE <= IMG_UINT32_MAX,
 	      "RGXFWIF_STATIC_COMPUTECONTEXT_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateComputeContext(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psRGXCreateComputeContextIN_UI8,
 				    IMG_UINT8 * psRGXCreateComputeContextOUT_UI8,
@@ -306,10 +306,10 @@ PVRSRVBridgeRGXCreateComputeContext(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATECOMPUTECONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyComputeContext(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRGXDestroyComputeContextIN_UI8,
 				     IMG_UINT8 * psRGXDestroyComputeContextOUT_UI8,
@@ -361,10 +361,10 @@ PVRSRVBridgeRGXDestroyComputeContext(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyComputeContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYCOMPUTECONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFlushComputeData(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRGXFlushComputeDataIN_UI8,
 				IMG_UINT8 * psRGXFlushComputeDataOUT_UI8,
@@ -428,10 +428,10 @@ PVRSRVBridgeRGXFlushComputeData(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFLUSHCOMPUTEDATA, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetComputeContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psRGXSetComputeContextPriorityIN_UI8,
 					 IMG_UINT8 * psRGXSetComputeContextPriorityOUT_UI8,
@@ -498,10 +498,10 @@ PVRSRVBridgeRGXSetComputeContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETCOMPUTECONTEXTPRIORITY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXNotifyComputeWriteOffsetUpdate(IMG_UINT32 ui32DispatchTableEntry,
 					      IMG_UINT8 * psRGXNotifyComputeWriteOffsetUpdateIN_UI8,
 					      IMG_UINT8 *
@@ -568,7 +568,7 @@ PVRSRVBridgeRGXNotifyComputeWriteOffsetUpdate(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXNOTIFYCOMPUTEWRITEOFFSETUPDATE, eError);
 }
 
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
@@ -580,7 +580,7 @@ static_assert(RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE <= IMG_UINT32_MAX,
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
 	      "PVRSRV_MAX_SYNCS must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXKickCDM2(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psRGXKickCDM2IN_UI8,
 			IMG_UINT8 * psRGXKickCDM2OUT_UI8, CONNECTION_DATA * psConnection)
@@ -972,10 +972,10 @@ PVRSRVBridgeRGXKickCDM2(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXKICKCDM2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetComputeContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psRGXSetComputeContextPropertyIN_UI8,
 					 IMG_UINT8 * psRGXSetComputeContextPropertyOUT_UI8,
@@ -1043,10 +1043,10 @@ PVRSRVBridgeRGXSetComputeContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETCOMPUTECONTEXTPROPERTY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXGetLastDeviceError(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXGetLastDeviceErrorIN_UI8,
 				  IMG_UINT8 * psRGXGetLastDeviceErrorOUT_UI8,
@@ -1081,13 +1081,13 @@ PVRSRVBridgeRGXGetLastDeviceError(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXGetLastDeviceError_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXGETLASTDEVICEERROR, eError);
 }
 
 static_assert(RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE <= IMG_UINT32_MAX,
 	      "RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXKickTimestampQuery(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXKickTimestampQueryIN_UI8,
 				  IMG_UINT8 * psRGXKickTimestampQueryOUT_UI8,
@@ -1234,7 +1234,7 @@ PVRSRVBridgeRGXKickTimestampQuery(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXKICKTIMESTAMPQUERY, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxfwdbg_bridge/server_rgxfwdbg_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxfwdbg_bridge/server_rgxfwdbg_bridge.c
index 07b6162..199f008 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxfwdbg_bridge/server_rgxfwdbg_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxfwdbg_bridge/server_rgxfwdbg_bridge.c
@@ -68,7 +68,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetFWLog(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXFWDebugSetFWLogIN_UI8,
 			       IMG_UINT8 * psRGXFWDebugSetFWLogOUT_UI8,
@@ -84,10 +84,10 @@ PVRSRVBridgeRGXFWDebugSetFWLog(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXFWDebugSetFWLogKM(psConnection, OSGetDevNode(psConnection),
 				       psRGXFWDebugSetFWLogIN->ui32RGXFWLogType);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETFWLOG, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugDumpFreelistPageList(IMG_UINT32 ui32DispatchTableEntry,
 					   IMG_UINT8 * psRGXFWDebugDumpFreelistPageListIN_UI8,
 					   IMG_UINT8 * psRGXFWDebugDumpFreelistPageListOUT_UI8,
@@ -105,10 +105,10 @@ PVRSRVBridgeRGXFWDebugDumpFreelistPageList(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXFWDebugDumpFreelistPageListOUT->eError =
 	    PVRSRVRGXFWDebugDumpFreelistPageListKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGDUMPFREELISTPAGELIST, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSuspendDevice(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psRGXFWDebugSuspendDeviceIN_UI8,
 				    IMG_UINT8 * psRGXFWDebugSuspendDeviceOUT_UI8,
@@ -126,10 +126,10 @@ PVRSRVBridgeRGXFWDebugSuspendDevice(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXFWDebugSuspendDeviceOUT->eError =
 	    PVRSRVRGXFWDebugSuspendDeviceKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSUSPENDDEVICE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugResumeDevice(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXFWDebugResumeDeviceIN_UI8,
 				   IMG_UINT8 * psRGXFWDebugResumeDeviceOUT_UI8,
@@ -147,10 +147,10 @@ PVRSRVBridgeRGXFWDebugResumeDevice(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXFWDebugResumeDeviceOUT->eError =
 	    PVRSRVRGXFWDebugResumeDeviceKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGRESUMEDEVICE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetVzConnectionCooldownPeriodInSec(IMG_UINT32 ui32DispatchTableEntry,
 							 IMG_UINT8 *
 							 psRGXFWDebugSetVzConnectionCooldownPeriodInSecIN_UI8,
@@ -173,10 +173,10 @@ PVRSRVBridgeRGXFWDebugSetVzConnectionCooldownPeriodInSec(IMG_UINT32 ui32Dispatch
 								 psRGXFWDebugSetVzConnectionCooldownPeriodInSecIN->
 								 ui32ui32VzConnectionCooldownPeriodInSec);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETVZCONNECTIONCOOLDOWNPERIODINSEC, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetHCSDeadline(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRGXFWDebugSetHCSDeadlineIN_UI8,
 				     IMG_UINT8 * psRGXFWDebugSetHCSDeadlineOUT_UI8,
@@ -193,10 +193,10 @@ PVRSRVBridgeRGXFWDebugSetHCSDeadline(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXFWDebugSetHCSDeadlineKM(psConnection, OSGetDevNode(psConnection),
 					     psRGXFWDebugSetHCSDeadlineIN->ui32RGXHCSDeadline);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETHCSDEADLINE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetDriverPriority(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psRGXFWDebugSetDriverPriorityIN_UI8,
 					IMG_UINT8 * psRGXFWDebugSetDriverPriorityOUT_UI8,
@@ -214,10 +214,10 @@ PVRSRVBridgeRGXFWDebugSetDriverPriority(IMG_UINT32 ui32DispatchTableEntry,
 						psRGXFWDebugSetDriverPriorityIN->ui32DriverID,
 						psRGXFWDebugSetDriverPriorityIN->ui32Priority);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETDRIVERPRIORITY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetDriverTimeSlice(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psRGXFWDebugSetDriverTimeSliceIN_UI8,
 					 IMG_UINT8 * psRGXFWDebugSetDriverTimeSliceOUT_UI8,
@@ -235,10 +235,10 @@ PVRSRVBridgeRGXFWDebugSetDriverTimeSlice(IMG_UINT32 ui32DispatchTableEntry,
 						 psRGXFWDebugSetDriverTimeSliceIN->ui32DriverID,
 						 psRGXFWDebugSetDriverTimeSliceIN->ui32TimeSlice);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETDRIVERTIMESLICE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetDriverTimeSliceInterval(IMG_UINT32 ui32DispatchTableEntry,
 						 IMG_UINT8 *
 						 psRGXFWDebugSetDriverTimeSliceIntervalIN_UI8,
@@ -260,10 +260,10 @@ PVRSRVBridgeRGXFWDebugSetDriverTimeSliceInterval(IMG_UINT32 ui32DispatchTableEnt
 							 psRGXFWDebugSetDriverTimeSliceIntervalIN->
 							 ui32TimeSliceInterval);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETDRIVERTIMESLICEINTERVAL, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetDriverIsolationGroup(IMG_UINT32 ui32DispatchTableEntry,
 					      IMG_UINT8 * psRGXFWDebugSetDriverIsolationGroupIN_UI8,
 					      IMG_UINT8 *
@@ -285,10 +285,10 @@ PVRSRVBridgeRGXFWDebugSetDriverIsolationGroup(IMG_UINT32 ui32DispatchTableEntry,
 						      psRGXFWDebugSetDriverIsolationGroupIN->
 						      ui32IsolationGroup);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETDRIVERISOLATIONGROUP, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetOSNewOnlineState(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psRGXFWDebugSetOSNewOnlineStateIN_UI8,
 					  IMG_UINT8 * psRGXFWDebugSetOSNewOnlineStateOUT_UI8,
@@ -307,10 +307,10 @@ PVRSRVBridgeRGXFWDebugSetOSNewOnlineState(IMG_UINT32 ui32DispatchTableEntry,
 						  psRGXFWDebugSetOSNewOnlineStateIN->
 						  ui32OSNewState);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETOSNEWONLINESTATE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugMapGuestHeap(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXFWDebugMapGuestHeapIN_UI8,
 				   IMG_UINT8 * psRGXFWDebugMapGuestHeapOUT_UI8,
@@ -328,10 +328,10 @@ PVRSRVBridgeRGXFWDebugMapGuestHeap(IMG_UINT32 ui32DispatchTableEntry,
 					   psRGXFWDebugMapGuestHeapIN->ui32DriverID,
 					   psRGXFWDebugMapGuestHeapIN->ui64ui64GuestHeapBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGMAPGUESTHEAP, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugPHRConfigure(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXFWDebugPHRConfigureIN_UI8,
 				   IMG_UINT8 * psRGXFWDebugPHRConfigureOUT_UI8,
@@ -348,10 +348,10 @@ PVRSRVBridgeRGXFWDebugPHRConfigure(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXFWDebugPHRConfigureKM(psConnection, OSGetDevNode(psConnection),
 					   psRGXFWDebugPHRConfigureIN->ui32ui32PHRMode);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGPHRCONFIGURE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugWdgConfigure(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXFWDebugWdgConfigureIN_UI8,
 				   IMG_UINT8 * psRGXFWDebugWdgConfigureOUT_UI8,
@@ -368,10 +368,10 @@ PVRSRVBridgeRGXFWDebugWdgConfigure(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXFWDebugWdgConfigureKM(psConnection, OSGetDevNode(psConnection),
 					   psRGXFWDebugWdgConfigureIN->ui32ui32WdgPeriodUs);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGWDGCONFIGURE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCurrentTime(IMG_UINT32 ui32DispatchTableEntry,
 			   IMG_UINT8 * psRGXCurrentTimeIN_UI8,
 			   IMG_UINT8 * psRGXCurrentTimeOUT_UI8, CONNECTION_DATA * psConnection)
@@ -387,12 +387,12 @@ PVRSRVBridgeRGXCurrentTime(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXCurrentTime(psConnection, OSGetDevNode(psConnection),
 				 &psRGXCurrentTimeOUT->ui64Time);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCURRENTTIME, eError);
 }
 
 #if defined(SUPPORT_VALIDATION)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugInjectFault(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXFWDebugInjectFaultIN_UI8,
 				  IMG_UINT8 * psRGXFWDebugInjectFaultOUT_UI8,
@@ -410,7 +410,7 @@ PVRSRVBridgeRGXFWDebugInjectFault(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXFWDebugInjectFaultOUT->eError =
 	    PVRSRVRGXFWDebugInjectFaultKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGINJECTFAULT, eError);
 }
 
 #else
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxhwperf_bridge/server_rgxhwperf_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxhwperf_bridge/server_rgxhwperf_bridge.c
index fdcc3a3..de943c8 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxhwperf_bridge/server_rgxhwperf_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxhwperf_bridge/server_rgxhwperf_bridge.c
@@ -66,7 +66,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCtrlHWPerf(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psRGXCtrlHWPerfIN_UI8,
 			  IMG_UINT8 * psRGXCtrlHWPerfOUT_UI8, CONNECTION_DATA * psConnection)
@@ -81,10 +81,10 @@ PVRSRVBridgeRGXCtrlHWPerf(IMG_UINT32 ui32DispatchTableEntry,
 				  psRGXCtrlHWPerfIN->ui32StreamId,
 				  psRGXCtrlHWPerfIN->bToggle, psRGXCtrlHWPerfIN->ui64Mask);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCTRLHWPERF, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXGetHWPerfBvncFeatureFlags(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psRGXGetHWPerfBvncFeatureFlagsIN_UI8,
 					 IMG_UINT8 * psRGXGetHWPerfBvncFeatureFlagsOUT_UI8,
@@ -103,13 +103,13 @@ PVRSRVBridgeRGXGetHWPerfBvncFeatureFlags(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXGetHWPerfBvncFeatureFlagsKM(psConnection, OSGetDevNode(psConnection),
 						 &psRGXGetHWPerfBvncFeatureFlagsOUT->sBVNC);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXGETHWPERFBVNCFEATUREFLAGS, eError);
 }
 
 static_assert(RGXFWIF_HWPERF_CTRL_BLKS_MAX <= IMG_UINT32_MAX,
 	      "RGXFWIF_HWPERF_CTRL_BLKS_MAX must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXConfigMuxHWPerfCounters(IMG_UINT32 ui32DispatchTableEntry,
 				       IMG_UINT8 * psRGXConfigMuxHWPerfCountersIN_UI8,
 				       IMG_UINT8 * psRGXConfigMuxHWPerfCountersOUT_UI8,
@@ -218,13 +218,13 @@ PVRSRVBridgeRGXConfigMuxHWPerfCounters(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCONFIGMUXHWPERFCOUNTERS, eError);
 }
 
 static_assert(RGXFWIF_HWPERF_CTRL_BLKS_MAX <= IMG_UINT32_MAX,
 	      "RGXFWIF_HWPERF_CTRL_BLKS_MAX must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXControlHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXControlHWPerfBlocksIN_UI8,
 				   IMG_UINT8 * psRGXControlHWPerfBlocksOUT_UI8,
@@ -326,13 +326,13 @@ PVRSRVBridgeRGXControlHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCONTROLHWPERFBLOCKS, eError);
 }
 
 static_assert(RGX_HWPERF_MAX_CUSTOM_CNTRS <= IMG_UINT32_MAX,
 	      "RGX_HWPERF_MAX_CUSTOM_CNTRS must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXConfigCustomCounters(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psRGXConfigCustomCountersIN_UI8,
 				    IMG_UINT8 * psRGXConfigCustomCountersOUT_UI8,
@@ -439,13 +439,13 @@ PVRSRVBridgeRGXConfigCustomCounters(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCONFIGCUSTOMCOUNTERS, eError);
 }
 
 static_assert(RGXFWIF_HWPERF_CTRL_BLKS_MAX <= IMG_UINT32_MAX,
 	      "RGXFWIF_HWPERF_CTRL_BLKS_MAX must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXConfigureHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRGXConfigureHWPerfBlocksIN_UI8,
 				     IMG_UINT8 * psRGXConfigureHWPerfBlocksOUT_UI8,
@@ -551,12 +551,12 @@ PVRSRVBridgeRGXConfigureHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCONFIGUREHWPERFBLOCKS, eError);
 }
 
 static_assert(1 <= IMG_UINT32_MAX, "1 must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXGetConfiguredHWPerfMuxCounters(IMG_UINT32 ui32DispatchTableEntry,
 					      IMG_UINT8 * psRGXGetConfiguredHWPerfMuxCountersIN_UI8,
 					      IMG_UINT8 *
@@ -669,12 +669,12 @@ PVRSRVBridgeRGXGetConfiguredHWPerfMuxCounters(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXGETCONFIGUREDHWPERFMUXCOUNTERS, eError);
 }
 
 static_assert(1 <= IMG_UINT32_MAX, "1 must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXGetConfiguredHWPerfCounters(IMG_UINT32 ui32DispatchTableEntry,
 					   IMG_UINT8 * psRGXGetConfiguredHWPerfCountersIN_UI8,
 					   IMG_UINT8 * psRGXGetConfiguredHWPerfCountersOUT_UI8,
@@ -781,10 +781,13 @@ PVRSRVBridgeRGXGetConfiguredHWPerfCounters(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXGETCONFIGUREDHWPERFCOUNTERS, eError);
 }
 
-static IMG_INT
+static_assert(RGXFWIF_HWPERF_CTRL_BLKS_MAX <= IMG_UINT32_MAX,
+	      "RGXFWIF_HWPERF_CTRL_BLKS_MAX must not be larger than IMG_UINT32_MAX");
+
+static size_t
 PVRSRVBridgeRGXGetEnabledHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psRGXGetEnabledHWPerfBlocksIN_UI8,
 				      IMG_UINT8 * psRGXGetEnabledHWPerfBlocksOUT_UI8,
@@ -807,6 +810,12 @@ PVRSRVBridgeRGXGetEnabledHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 	IMG_UINT64 ui64BufferSize =
 	    ((IMG_UINT64) psRGXGetEnabledHWPerfBlocksIN->ui32ArrayLen * sizeof(IMG_UINT32)) + 0;
 
+	if (psRGXGetEnabledHWPerfBlocksIN->ui32ArrayLen > RGXFWIF_HWPERF_CTRL_BLKS_MAX)
+	{
+		psRGXGetEnabledHWPerfBlocksOUT->eError = PVRSRV_ERROR_BRIDGE_ARRAY_SIZE_TOO_BIG;
+		goto RGXGetEnabledHWPerfBlocks_exit;
+	}
+
 	psRGXGetEnabledHWPerfBlocksOUT->pui32EnabledBlockIDs =
 	    psRGXGetEnabledHWPerfBlocksIN->pui32EnabledBlockIDs;
 
@@ -892,12 +901,12 @@ PVRSRVBridgeRGXGetEnabledHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXGETENABLEDHWPERFBLOCKS, eError);
 }
 
 #if defined(PVRSRV_FORCE_HWPERF_TO_SCHED_CLK)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXGetHWPerfTimeStamp(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXGetHWPerfTimeStampIN_UI8,
 				  IMG_UINT8 * psRGXGetHWPerfTimeStampOUT_UI8,
@@ -916,7 +925,7 @@ PVRSRVBridgeRGXGetHWPerfTimeStamp(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXGetHWPerfTimeStampKM(psConnection, OSGetDevNode(psConnection),
 					  &psRGXGetHWPerfTimeStampOUT->ui64TimeStamp);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXGETHWPERFTIMESTAMP, eError);
 }
 
 #else
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxkicksync_bridge/server_rgxkicksync_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxkicksync_bridge/server_rgxkicksync_bridge.c
index 8d943cd..dfa3f9a 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxkicksync_bridge/server_rgxkicksync_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxkicksync_bridge/server_rgxkicksync_bridge.c
@@ -74,7 +74,7 @@ static PVRSRV_ERROR _RGXCreateKickSyncContextpsKickSyncContextIntRelease(void *p
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateKickSyncContext(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRGXCreateKickSyncContextIN_UI8,
 				     IMG_UINT8 * psRGXCreateKickSyncContextOUT_UI8,
@@ -161,10 +161,10 @@ PVRSRVBridgeRGXCreateKickSyncContext(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEKICKSYNCCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyKickSyncContext(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psRGXDestroyKickSyncContextIN_UI8,
 				      IMG_UINT8 * psRGXDestroyKickSyncContextOUT_UI8,
@@ -202,7 +202,7 @@ PVRSRVBridgeRGXDestroyKickSyncContext(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyKickSyncContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYKICKSYNCCONTEXT, eError);
 }
 
 static_assert(PVRSRV_MAX_DEV_VARS <= IMG_UINT32_MAX,
@@ -210,7 +210,7 @@ static_assert(PVRSRV_MAX_DEV_VARS <= IMG_UINT32_MAX,
 static_assert(PVRSRV_SYNC_NAME_LENGTH <= IMG_UINT32_MAX,
 	      "PVRSRV_SYNC_NAME_LENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXKickSync2(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psRGXKickSync2IN_UI8,
 			 IMG_UINT8 * psRGXKickSync2OUT_UI8, CONNECTION_DATA * psConnection)
@@ -462,10 +462,10 @@ PVRSRVBridgeRGXKickSync2(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXKICKSYNC2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetKickSyncContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psRGXSetKickSyncContextPropertyIN_UI8,
 					  IMG_UINT8 * psRGXSetKickSyncContextPropertyOUT_UI8,
@@ -519,7 +519,7 @@ PVRSRVBridgeRGXSetKickSyncContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETKICKSYNCCONTEXTPROPERTY, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxpdump_bridge/server_rgxpdump_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxpdump_bridge/server_rgxpdump_bridge.c
index 6a52346..a7366f0 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxpdump_bridge/server_rgxpdump_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxpdump_bridge/server_rgxpdump_bridge.c
@@ -65,7 +65,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpTraceBuffer(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psPDumpTraceBufferIN_UI8,
 			     IMG_UINT8 * psPDumpTraceBufferOUT_UI8, CONNECTION_DATA * psConnection)
@@ -79,10 +79,10 @@ PVRSRVBridgePDumpTraceBuffer(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVPDumpTraceBufferKM(psConnection, OSGetDevNode(psConnection),
 				     psPDumpTraceBufferIN->ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPTRACEBUFFER, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpSignatureBuffer(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psPDumpSignatureBufferIN_UI8,
 				 IMG_UINT8 * psPDumpSignatureBufferOUT_UI8,
@@ -99,12 +99,12 @@ PVRSRVBridgePDumpSignatureBuffer(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVPDumpSignatureBufferKM(psConnection, OSGetDevNode(psConnection),
 					 psPDumpSignatureBufferIN->ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPSIGNATUREBUFFER, eError);
 }
 
 #if defined(SUPPORT_VALIDATION)
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpComputeCRCSignatureCheck(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psPDumpComputeCRCSignatureCheckIN_UI8,
 					  IMG_UINT8 * psPDumpComputeCRCSignatureCheckOUT_UI8,
@@ -122,14 +122,14 @@ PVRSRVBridgePDumpComputeCRCSignatureCheck(IMG_UINT32 ui32DispatchTableEntry,
 						  psPDumpComputeCRCSignatureCheckIN->
 						  ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPCOMPUTECRCSIGNATURECHECK, eError);
 }
 
 #else
 #define PVRSRVBridgePDumpComputeCRCSignatureCheck NULL
 #endif
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpCRCSignatureCheck(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psPDumpCRCSignatureCheckIN_UI8,
 				   IMG_UINT8 * psPDumpCRCSignatureCheckOUT_UI8,
@@ -146,10 +146,10 @@ PVRSRVBridgePDumpCRCSignatureCheck(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVPDumpCRCSignatureCheckKM(psConnection, OSGetDevNode(psConnection),
 					   psPDumpCRCSignatureCheckIN->ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPCRCSIGNATURECHECK, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpValCheckPreCommand(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psPDumpValCheckPreCommandIN_UI8,
 				    IMG_UINT8 * psPDumpValCheckPreCommandOUT_UI8,
@@ -166,10 +166,10 @@ PVRSRVBridgePDumpValCheckPreCommand(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVPDumpValCheckPreCommandKM(psConnection, OSGetDevNode(psConnection),
 					    psPDumpValCheckPreCommandIN->ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPVALCHECKPRECOMMAND, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpValCheckPostCommand(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psPDumpValCheckPostCommandIN_UI8,
 				     IMG_UINT8 * psPDumpValCheckPostCommandOUT_UI8,
@@ -186,7 +186,7 @@ PVRSRVBridgePDumpValCheckPostCommand(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVPDumpValCheckPostCommandKM(psConnection, OSGetDevNode(psConnection),
 					     psPDumpValCheckPostCommandIN->ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPVALCHECKPOSTCOMMAND, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxregconfig_bridge/server_rgxregconfig_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxregconfig_bridge/server_rgxregconfig_bridge.c
index 5484014..7802ff2 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxregconfig_bridge/server_rgxregconfig_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxregconfig_bridge/server_rgxregconfig_bridge.c
@@ -67,7 +67,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetRegConfigType(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRGXSetRegConfigTypeIN_UI8,
 				IMG_UINT8 * psRGXSetRegConfigTypeOUT_UI8,
@@ -84,10 +84,10 @@ PVRSRVBridgeRGXSetRegConfigType(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXSetRegConfigTypeKM(psConnection, OSGetDevNode(psConnection),
 					psRGXSetRegConfigTypeIN->ui8RegPowerIsland);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETREGCONFIGTYPE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXAddRegconfig(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psRGXAddRegconfigIN_UI8,
 			    IMG_UINT8 * psRGXAddRegconfigOUT_UI8, CONNECTION_DATA * psConnection)
@@ -103,10 +103,10 @@ PVRSRVBridgeRGXAddRegconfig(IMG_UINT32 ui32DispatchTableEntry,
 				    psRGXAddRegconfigIN->ui64RegValue,
 				    psRGXAddRegconfigIN->ui64RegMask);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXADDREGCONFIG, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXClearRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psRGXClearRegConfigIN_UI8,
 			      IMG_UINT8 * psRGXClearRegConfigOUT_UI8,
@@ -122,10 +122,10 @@ PVRSRVBridgeRGXClearRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXClearRegConfigOUT->eError =
 	    PVRSRVRGXClearRegConfigKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCLEARREGCONFIG, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXEnableRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXEnableRegConfigIN_UI8,
 			       IMG_UINT8 * psRGXEnableRegConfigOUT_UI8,
@@ -142,10 +142,10 @@ PVRSRVBridgeRGXEnableRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXEnableRegConfigOUT->eError =
 	    PVRSRVRGXEnableRegConfigKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXENABLEREGCONFIG, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDisableRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRGXDisableRegConfigIN_UI8,
 				IMG_UINT8 * psRGXDisableRegConfigOUT_UI8,
@@ -163,7 +163,7 @@ PVRSRVBridgeRGXDisableRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXDisableRegConfigOUT->eError =
 	    PVRSRVRGXDisableRegConfigKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDISABLEREGCONFIG, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxta3d_bridge/common_rgxta3d_bridge.h b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxta3d_bridge/common_rgxta3d_bridge.h
index 7271ad4..0b164b8 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxta3d_bridge/common_rgxta3d_bridge.h
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxta3d_bridge/common_rgxta3d_bridge.h
@@ -74,7 +74,8 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define PVRSRV_BRIDGE_RGXTA3D_RGXSETRENDERCONTEXTPROPERTY			PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+14
 #define PVRSRV_BRIDGE_RGXTA3D_RGXCREATEZSBUFFER2			PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+15
 #define PVRSRV_BRIDGE_RGXTA3D_RGXCREATEFREELIST2			PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+16
-#define PVRSRV_BRIDGE_RGXTA3D_CMD_LAST			(PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+16)
+#define PVRSRV_BRIDGE_RGXTA3D_RGXCREATEHWRTDATASET2			PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+17
+#define PVRSRV_BRIDGE_RGXTA3D_CMD_LAST			(PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+17)
 
 /*******************************************
             RGXCreateHWRTDataSet
@@ -466,4 +467,47 @@ typedef struct PVRSRV_BRIDGE_OUT_RGXCREATEFREELIST2_TAG
 	PVRSRV_ERROR eError;
 } __packed PVRSRV_BRIDGE_OUT_RGXCREATEFREELIST2;
 
+/*******************************************
+            RGXCreateHWRTDataSet2
+ *******************************************/
+
+/* Bridge in structure for RGXCreateHWRTDataSet2 */
+typedef struct PVRSRV_BRIDGE_IN_RGXCREATEHWRTDATASET2_TAG
+{
+	IMG_UINT64 ui64FlippedMultiSampleCtl;
+	IMG_UINT64 ui64MultiSampleCtl;
+	IMG_HANDLE hPMMlistsReservation;
+	IMG_DEV_VIRTADDR *psMacrotileArrayDevVAddr;
+	IMG_DEV_VIRTADDR *psRTCDevVAddr;
+	IMG_DEV_VIRTADDR *psRgnHeaderDevVAddr;
+	IMG_DEV_VIRTADDR *psTailPtrsDevVAddr;
+	IMG_DEV_VIRTADDR *psVHeapTableDevVAddr;
+	IMG_HANDLE *phKmHwRTDataSet;
+	IMG_HANDLE *phapsFreeLists;
+	IMG_UINT32 ui32ISPMergeLowerX;
+	IMG_UINT32 ui32ISPMergeLowerY;
+	IMG_UINT32 ui32ISPMergeScaleX;
+	IMG_UINT32 ui32ISPMergeScaleY;
+	IMG_UINT32 ui32ISPMergeUpperX;
+	IMG_UINT32 ui32ISPMergeUpperY;
+	IMG_UINT32 ui32ISPMtileSize;
+	IMG_UINT32 ui32MTileStride;
+	IMG_UINT32 ui32PPPScreen;
+	IMG_UINT32 ui32RgnHeaderSize;
+	IMG_UINT32 ui32TEAA;
+	IMG_UINT32 ui32TEMTILE1;
+	IMG_UINT32 ui32TEMTILE2;
+	IMG_UINT32 ui32TEScreen;
+	IMG_UINT32 ui32TPCSize;
+	IMG_UINT32 ui32TPCStride;
+	IMG_UINT16 ui16MaxRTs;
+} __packed PVRSRV_BRIDGE_IN_RGXCREATEHWRTDATASET2;
+
+/* Bridge out structure for RGXCreateHWRTDataSet2 */
+typedef struct PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2_TAG
+{
+	IMG_HANDLE *phKmHwRTDataSet;
+	PVRSRV_ERROR eError;
+} __packed PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2;
+
 #endif /* COMMON_RGXTA3D_BRIDGE_H */
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxta3d_bridge/server_rgxta3d_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxta3d_bridge/server_rgxta3d_bridge.c
index 700cec5..9aa4ec1 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxta3d_bridge/server_rgxta3d_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxta3d_bridge/server_rgxta3d_bridge.c
@@ -89,7 +89,7 @@ static_assert(RGXMKIF_NUM_GEOMDATAS <= IMG_UINT32_MAX,
 static_assert(RGXMKIF_NUM_RTDATAS <= IMG_UINT32_MAX,
 	      "RGXMKIF_NUM_RTDATAS must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateHWRTDataSet(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psRGXCreateHWRTDataSetIN_UI8,
 				 IMG_UINT8 * psRGXCreateHWRTDataSetOUT_UI8,
@@ -531,10 +531,10 @@ PVRSRVBridgeRGXCreateHWRTDataSet(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyHWRTDataSet(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXDestroyHWRTDataSetIN_UI8,
 				  IMG_UINT8 * psRGXDestroyHWRTDataSetOUT_UI8,
@@ -572,7 +572,7 @@ PVRSRVBridgeRGXDestroyHWRTDataSet(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyHWRTDataSet_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYHWRTDATASET, eError);
 }
 
 static PVRSRV_ERROR _RGXCreateZSBufferpssZSBufferKMIntRelease(void *pvData)
@@ -582,7 +582,7 @@ static PVRSRV_ERROR _RGXCreateZSBufferpssZSBufferKMIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psRGXCreateZSBufferIN_UI8,
 			      IMG_UINT8 * psRGXCreateZSBufferOUT_UI8,
@@ -686,10 +686,10 @@ PVRSRVBridgeRGXCreateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEZSBUFFER, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXDestroyZSBufferIN_UI8,
 			       IMG_UINT8 * psRGXDestroyZSBufferOUT_UI8,
@@ -726,7 +726,7 @@ PVRSRVBridgeRGXDestroyZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyZSBuffer_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYZSBUFFER, eError);
 }
 
 static PVRSRV_ERROR _RGXPopulateZSBufferpssPopulationIntRelease(void *pvData)
@@ -736,7 +736,7 @@ static PVRSRV_ERROR _RGXPopulateZSBufferpssPopulationIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXPopulateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRGXPopulateZSBufferIN_UI8,
 				IMG_UINT8 * psRGXPopulateZSBufferOUT_UI8,
@@ -820,10 +820,10 @@ PVRSRVBridgeRGXPopulateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXPOPULATEZSBUFFER, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXUnpopulateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXUnpopulateZSBufferIN_UI8,
 				  IMG_UINT8 * psRGXUnpopulateZSBufferOUT_UI8,
@@ -859,7 +859,7 @@ PVRSRVBridgeRGXUnpopulateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXUnpopulateZSBuffer_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXUNPOPULATEZSBUFFER, eError);
 }
 
 static PVRSRV_ERROR _RGXCreateFreeListpsCleanupCookieIntRelease(void *pvData)
@@ -869,7 +869,7 @@ static PVRSRV_ERROR _RGXCreateFreeListpsCleanupCookieIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateFreeList(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psRGXCreateFreeListIN_UI8,
 			      IMG_UINT8 * psRGXCreateFreeListOUT_UI8,
@@ -1009,10 +1009,10 @@ PVRSRVBridgeRGXCreateFreeList(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEFREELIST, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyFreeList(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXDestroyFreeListIN_UI8,
 			       IMG_UINT8 * psRGXDestroyFreeListOUT_UI8,
@@ -1047,7 +1047,7 @@ PVRSRVBridgeRGXDestroyFreeList(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyFreeList_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYFREELIST, eError);
 }
 
 static PVRSRV_ERROR _RGXCreateRenderContextpsRenderContextIntRelease(void *pvData)
@@ -1062,7 +1062,7 @@ static_assert(RGXFWIF_RF_CMD_SIZE <= IMG_UINT32_MAX,
 static_assert(RGXFWIF_STATIC_RENDERCONTEXT_SIZE <= IMG_UINT32_MAX,
 	      "RGXFWIF_STATIC_RENDERCONTEXT_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateRenderContext(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXCreateRenderContextIN_UI8,
 				   IMG_UINT8 * psRGXCreateRenderContextOUT_UI8,
@@ -1275,10 +1275,10 @@ PVRSRVBridgeRGXCreateRenderContext(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATERENDERCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyRenderContext(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psRGXDestroyRenderContextIN_UI8,
 				    IMG_UINT8 * psRGXDestroyRenderContextOUT_UI8,
@@ -1316,10 +1316,10 @@ PVRSRVBridgeRGXDestroyRenderContext(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyRenderContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYRENDERCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSendZSStoreDisable(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXSendZSStoreDisableIN_UI8,
 				  IMG_UINT8 * psRGXSendZSStoreDisableOUT_UI8,
@@ -1374,10 +1374,10 @@ PVRSRVBridgeRGXSendZSStoreDisable(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSENDZSSTOREDISABLE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetRenderContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psRGXSetRenderContextPriorityIN_UI8,
 					IMG_UINT8 * psRGXSetRenderContextPriorityOUT_UI8,
@@ -1430,10 +1430,10 @@ PVRSRVBridgeRGXSetRenderContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETRENDERCONTEXTPRIORITY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXRenderContextStalled(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psRGXRenderContextStalledIN_UI8,
 				    IMG_UINT8 * psRGXRenderContextStalledOUT_UI8,
@@ -1483,7 +1483,7 @@ PVRSRVBridgeRGXRenderContextStalled(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXRENDERCONTEXTSTALLED, eError);
 }
 
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
@@ -1505,7 +1505,7 @@ static_assert(RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE <= IMG_UINT32_MAX,
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
 	      "PVRSRV_MAX_SYNCS must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXKickTA3D2(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psRGXKickTA3D2IN_UI8,
 			 IMG_UINT8 * psRGXKickTA3D2OUT_UI8, CONNECTION_DATA * psConnection)
@@ -2335,10 +2335,10 @@ PVRSRVBridgeRGXKickTA3D2(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXKICKTA3D2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetRenderContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psRGXSetRenderContextPropertyIN_UI8,
 					IMG_UINT8 * psRGXSetRenderContextPropertyOUT_UI8,
@@ -2392,7 +2392,7 @@ PVRSRVBridgeRGXSetRenderContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETRENDERCONTEXTPROPERTY, eError);
 }
 
 static PVRSRV_ERROR _RGXCreateZSBuffer2pssZSBufferKMIntRelease(void *pvData)
@@ -2402,7 +2402,7 @@ static PVRSRV_ERROR _RGXCreateZSBuffer2pssZSBufferKMIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateZSBuffer2(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXCreateZSBuffer2IN_UI8,
 			       IMG_UINT8 * psRGXCreateZSBuffer2OUT_UI8,
@@ -2508,7 +2508,7 @@ PVRSRVBridgeRGXCreateZSBuffer2(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEZSBUFFER2, eError);
 }
 
 static PVRSRV_ERROR _RGXCreateFreeList2psCleanupCookieIntRelease(void *pvData)
@@ -2518,7 +2518,7 @@ static PVRSRV_ERROR _RGXCreateFreeList2psCleanupCookieIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateFreeList2(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXCreateFreeList2IN_UI8,
 			       IMG_UINT8 * psRGXCreateFreeList2OUT_UI8,
@@ -2659,7 +2659,474 @@ PVRSRVBridgeRGXCreateFreeList2(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEFREELIST2, eError);
+}
+
+static PVRSRV_ERROR _RGXCreateHWRTDataSet2psKmHwRTDataSetIntRelease(void *pvData)
+{
+	PVRSRV_ERROR eError;
+	eError = RGXDestroyHWRTDataSet((RGX_KM_HW_RT_DATASET *) pvData);
+	return eError;
+}
+
+static_assert(RGXMKIF_NUM_GEOMDATAS <= IMG_UINT32_MAX,
+	      "RGXMKIF_NUM_GEOMDATAS must not be larger than IMG_UINT32_MAX");
+static_assert(RGXMKIF_NUM_RTDATA_FREELISTS <= IMG_UINT32_MAX,
+	      "RGXMKIF_NUM_RTDATA_FREELISTS must not be larger than IMG_UINT32_MAX");
+static_assert(RGXMKIF_NUM_GEOMDATAS <= IMG_UINT32_MAX,
+	      "RGXMKIF_NUM_GEOMDATAS must not be larger than IMG_UINT32_MAX");
+static_assert(RGXMKIF_NUM_RTDATAS <= IMG_UINT32_MAX,
+	      "RGXMKIF_NUM_RTDATAS must not be larger than IMG_UINT32_MAX");
+static_assert(RGXMKIF_NUM_RTDATAS <= IMG_UINT32_MAX,
+	      "RGXMKIF_NUM_RTDATAS must not be larger than IMG_UINT32_MAX");
+static_assert(RGXMKIF_NUM_GEOMDATAS <= IMG_UINT32_MAX,
+	      "RGXMKIF_NUM_GEOMDATAS must not be larger than IMG_UINT32_MAX");
+static_assert(RGXMKIF_NUM_RTDATAS <= IMG_UINT32_MAX,
+	      "RGXMKIF_NUM_RTDATAS must not be larger than IMG_UINT32_MAX");
+
+static size_t
+PVRSRVBridgeRGXCreateHWRTDataSet2(IMG_UINT32 ui32DispatchTableEntry,
+				  IMG_UINT8 * psRGXCreateHWRTDataSet2IN_UI8,
+				  IMG_UINT8 * psRGXCreateHWRTDataSet2OUT_UI8,
+				  CONNECTION_DATA * psConnection)
+{
+	PVRSRV_BRIDGE_IN_RGXCREATEHWRTDATASET2 *psRGXCreateHWRTDataSet2IN =
+	    (PVRSRV_BRIDGE_IN_RGXCREATEHWRTDATASET2 *)
+	    IMG_OFFSET_ADDR(psRGXCreateHWRTDataSet2IN_UI8, 0);
+	PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2 *psRGXCreateHWRTDataSet2OUT =
+	    (PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2 *)
+	    IMG_OFFSET_ADDR(psRGXCreateHWRTDataSet2OUT_UI8, 0);
+
+	IMG_DEV_VIRTADDR *sVHeapTableDevVAddrInt = NULL;
+	IMG_HANDLE hPMMlistsReservation = psRGXCreateHWRTDataSet2IN->hPMMlistsReservation;
+	DEVMEMINT_RESERVATION2 *psPMMlistsReservationInt = NULL;
+	RGX_FREELIST **psapsFreeListsInt = NULL;
+	IMG_HANDLE *hapsFreeListsInt2 = NULL;
+	IMG_DEV_VIRTADDR *sTailPtrsDevVAddrInt = NULL;
+	IMG_DEV_VIRTADDR *sMacrotileArrayDevVAddrInt = NULL;
+	IMG_DEV_VIRTADDR *sRgnHeaderDevVAddrInt = NULL;
+	IMG_DEV_VIRTADDR *sRTCDevVAddrInt = NULL;
+	RGX_KM_HW_RT_DATASET **psKmHwRTDataSetInt = NULL;
+	IMG_HANDLE *hKmHwRTDataSetInt2 = NULL;
+
+	IMG_UINT32 ui32NextOffset = 0;
+	IMG_BYTE *pArrayArgsBuffer = NULL;
+	IMG_BOOL bHaveEnoughSpace = IMG_FALSE;
+
+	IMG_UINT32 ui32BufferSize = 0;
+	IMG_UINT64 ui64BufferSize =
+	    ((IMG_UINT64) RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(RGX_FREELIST *)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(IMG_HANDLE)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_RTDATAS * sizeof(IMG_DEV_VIRTADDR)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_RTDATAS * sizeof(IMG_DEV_VIRTADDR)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_RTDATAS * sizeof(RGX_KM_HW_RT_DATASET *)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_RTDATAS * sizeof(IMG_HANDLE)) + 0;
+
+	psRGXCreateHWRTDataSet2OUT->phKmHwRTDataSet = psRGXCreateHWRTDataSet2IN->phKmHwRTDataSet;
+
+	if (ui64BufferSize > IMG_UINT32_MAX)
+	{
+		psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_BRIDGE_BUFFER_TOO_SMALL;
+		goto RGXCreateHWRTDataSet2_exit;
+	}
+
+	ui32BufferSize = (IMG_UINT32) ui64BufferSize;
+
+	if (ui32BufferSize != 0)
+	{
+		/* Try to use remainder of input buffer for copies if possible, word-aligned for safety. */
+		IMG_UINT32 ui32InBufferOffset =
+		    PVR_ALIGN(sizeof(*psRGXCreateHWRTDataSet2IN), sizeof(unsigned long));
+		IMG_UINT32 ui32InBufferExcessSize =
+		    ui32InBufferOffset >=
+		    PVRSRV_MAX_BRIDGE_IN_SIZE ? 0 : PVRSRV_MAX_BRIDGE_IN_SIZE - ui32InBufferOffset;
+
+		bHaveEnoughSpace = ui32BufferSize <= ui32InBufferExcessSize;
+		if (bHaveEnoughSpace)
+		{
+			IMG_BYTE *pInputBuffer = (IMG_BYTE *) (void *)psRGXCreateHWRTDataSet2IN;
+
+			pArrayArgsBuffer = &pInputBuffer[ui32InBufferOffset];
+		}
+		else
+		{
+			pArrayArgsBuffer = OSAllocMemNoStats(ui32BufferSize);
+
+			if (!pArrayArgsBuffer)
+			{
+				psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_OUT_OF_MEMORY;
+				goto RGXCreateHWRTDataSet2_exit;
+			}
+		}
+	}
+
+	{
+		sVHeapTableDevVAddrInt =
+		    (IMG_DEV_VIRTADDR *) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		ui32NextOffset += RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR);
+	}
+
+	/* Copy the data over */
+	if (RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR) > 0)
+	{
+		if (OSCopyFromUser
+		    (NULL, sVHeapTableDevVAddrInt,
+		     (const void __user *)psRGXCreateHWRTDataSet2IN->psVHeapTableDevVAddr,
+		     RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR)) != PVRSRV_OK)
+		{
+			psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
+
+			goto RGXCreateHWRTDataSet2_exit;
+		}
+	}
+
+	{
+		psapsFreeListsInt =
+		    (RGX_FREELIST **) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		OSCachedMemSet(psapsFreeListsInt, 0,
+			       RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(RGX_FREELIST *));
+		ui32NextOffset += RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(RGX_FREELIST *);
+		hapsFreeListsInt2 =
+		    (IMG_HANDLE *) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		ui32NextOffset += RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(IMG_HANDLE);
+	}
+
+	/* Copy the data over */
+	if (RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(IMG_HANDLE) > 0)
+	{
+		if (OSCopyFromUser
+		    (NULL, hapsFreeListsInt2,
+		     (const void __user *)psRGXCreateHWRTDataSet2IN->phapsFreeLists,
+		     RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(IMG_HANDLE)) != PVRSRV_OK)
+		{
+			psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
+
+			goto RGXCreateHWRTDataSet2_exit;
+		}
+	}
+
+	{
+		sTailPtrsDevVAddrInt =
+		    (IMG_DEV_VIRTADDR *) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		ui32NextOffset += RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR);
+	}
+
+	/* Copy the data over */
+	if (RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR) > 0)
+	{
+		if (OSCopyFromUser
+		    (NULL, sTailPtrsDevVAddrInt,
+		     (const void __user *)psRGXCreateHWRTDataSet2IN->psTailPtrsDevVAddr,
+		     RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR)) != PVRSRV_OK)
+		{
+			psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
+
+			goto RGXCreateHWRTDataSet2_exit;
+		}
+	}
+
+	{
+		sMacrotileArrayDevVAddrInt =
+		    (IMG_DEV_VIRTADDR *) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		ui32NextOffset += RGXMKIF_NUM_RTDATAS * sizeof(IMG_DEV_VIRTADDR);
+	}
+
+	/* Copy the data over */
+	if (RGXMKIF_NUM_RTDATAS * sizeof(IMG_DEV_VIRTADDR) > 0)
+	{
+		if (OSCopyFromUser
+		    (NULL, sMacrotileArrayDevVAddrInt,
+		     (const void __user *)psRGXCreateHWRTDataSet2IN->psMacrotileArrayDevVAddr,
+		     RGXMKIF_NUM_RTDATAS * sizeof(IMG_DEV_VIRTADDR)) != PVRSRV_OK)
+		{
+			psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
+
+			goto RGXCreateHWRTDataSet2_exit;
+		}
+	}
+
+	{
+		sRgnHeaderDevVAddrInt =
+		    (IMG_DEV_VIRTADDR *) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		ui32NextOffset += RGXMKIF_NUM_RTDATAS * sizeof(IMG_DEV_VIRTADDR);
+	}
+
+	/* Copy the data over */
+	if (RGXMKIF_NUM_RTDATAS * sizeof(IMG_DEV_VIRTADDR) > 0)
+	{
+		if (OSCopyFromUser
+		    (NULL, sRgnHeaderDevVAddrInt,
+		     (const void __user *)psRGXCreateHWRTDataSet2IN->psRgnHeaderDevVAddr,
+		     RGXMKIF_NUM_RTDATAS * sizeof(IMG_DEV_VIRTADDR)) != PVRSRV_OK)
+		{
+			psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
+
+			goto RGXCreateHWRTDataSet2_exit;
+		}
+	}
+
+	{
+		sRTCDevVAddrInt =
+		    (IMG_DEV_VIRTADDR *) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		ui32NextOffset += RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR);
+	}
+
+	/* Copy the data over */
+	if (RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR) > 0)
+	{
+		if (OSCopyFromUser
+		    (NULL, sRTCDevVAddrInt,
+		     (const void __user *)psRGXCreateHWRTDataSet2IN->psRTCDevVAddr,
+		     RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR)) != PVRSRV_OK)
+		{
+			psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
+
+			goto RGXCreateHWRTDataSet2_exit;
+		}
+	}
+	if (IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset) != NULL)
+	{
+		psKmHwRTDataSetInt =
+		    (RGX_KM_HW_RT_DATASET **) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		OSCachedMemSet(psKmHwRTDataSetInt, 0,
+			       RGXMKIF_NUM_RTDATAS * sizeof(RGX_KM_HW_RT_DATASET *));
+		ui32NextOffset += RGXMKIF_NUM_RTDATAS * sizeof(RGX_KM_HW_RT_DATASET *);
+		hKmHwRTDataSetInt2 =
+		    (IMG_HANDLE *) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		ui32NextOffset += RGXMKIF_NUM_RTDATAS * sizeof(IMG_HANDLE);
+	}
+
+	/* Lock over handle lookup. */
+	LockHandle(psConnection->psHandleBase);
+
+	/* Look up the address from the handle */
+	psRGXCreateHWRTDataSet2OUT->eError =
+	    PVRSRVLookupHandleUnlocked(psConnection->psHandleBase,
+				       (void **)&psPMMlistsReservationInt,
+				       hPMMlistsReservation,
+				       PVRSRV_HANDLE_TYPE_DEVMEMINT_RESERVATION2, IMG_TRUE);
+	if (unlikely(psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK))
+	{
+		UnlockHandle(psConnection->psHandleBase);
+		goto RGXCreateHWRTDataSet2_exit;
+	}
+
+	{
+		IMG_UINT32 i;
+
+		for (i = 0; i < RGXMKIF_NUM_RTDATA_FREELISTS; i++)
+		{
+			/* Look up the address from the handle */
+			psRGXCreateHWRTDataSet2OUT->eError =
+			    PVRSRVLookupHandleUnlocked(psConnection->psHandleBase,
+						       (void **)&psapsFreeListsInt[i],
+						       hapsFreeListsInt2[i],
+						       PVRSRV_HANDLE_TYPE_RGX_FREELIST, IMG_TRUE);
+			if (unlikely(psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK))
+			{
+				UnlockHandle(psConnection->psHandleBase);
+				goto RGXCreateHWRTDataSet2_exit;
+			}
+		}
+	}
+	/* Release now we have looked up handles. */
+	UnlockHandle(psConnection->psHandleBase);
+
+	psRGXCreateHWRTDataSet2OUT->eError =
+	    RGXCreateHWRTDataSet2(psConnection, OSGetDevNode(psConnection),
+				  sVHeapTableDevVAddrInt,
+				  psPMMlistsReservationInt,
+				  psapsFreeListsInt,
+				  psRGXCreateHWRTDataSet2IN->ui32PPPScreen,
+				  psRGXCreateHWRTDataSet2IN->ui64MultiSampleCtl,
+				  psRGXCreateHWRTDataSet2IN->ui64FlippedMultiSampleCtl,
+				  psRGXCreateHWRTDataSet2IN->ui32TPCStride,
+				  sTailPtrsDevVAddrInt,
+				  psRGXCreateHWRTDataSet2IN->ui32TPCSize,
+				  psRGXCreateHWRTDataSet2IN->ui32TEScreen,
+				  psRGXCreateHWRTDataSet2IN->ui32TEAA,
+				  psRGXCreateHWRTDataSet2IN->ui32TEMTILE1,
+				  psRGXCreateHWRTDataSet2IN->ui32TEMTILE2,
+				  psRGXCreateHWRTDataSet2IN->ui32MTileStride,
+				  psRGXCreateHWRTDataSet2IN->ui32ISPMergeLowerX,
+				  psRGXCreateHWRTDataSet2IN->ui32ISPMergeLowerY,
+				  psRGXCreateHWRTDataSet2IN->ui32ISPMergeUpperX,
+				  psRGXCreateHWRTDataSet2IN->ui32ISPMergeUpperY,
+				  psRGXCreateHWRTDataSet2IN->ui32ISPMergeScaleX,
+				  psRGXCreateHWRTDataSet2IN->ui32ISPMergeScaleY,
+				  sMacrotileArrayDevVAddrInt,
+				  sRgnHeaderDevVAddrInt,
+				  sRTCDevVAddrInt,
+				  psRGXCreateHWRTDataSet2IN->ui32RgnHeaderSize,
+				  psRGXCreateHWRTDataSet2IN->ui32ISPMtileSize,
+				  psRGXCreateHWRTDataSet2IN->ui16MaxRTs, psKmHwRTDataSetInt);
+	/* Exit early if bridged call fails */
+	if (unlikely(psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK))
+	{
+		goto RGXCreateHWRTDataSet2_exit;
+	}
+
+	/* Lock over handle creation. */
+	LockHandle(psConnection->psHandleBase);
+	if (hKmHwRTDataSetInt2)
+	{
+		IMG_UINT32 i;
+
+		for (i = 0; i < RGXMKIF_NUM_RTDATAS; i++)
+		{
+
+			psRGXCreateHWRTDataSet2OUT->eError =
+			    PVRSRVAllocHandleUnlocked(psConnection->psHandleBase,
+						      &hKmHwRTDataSetInt2[i],
+						      (void *)psKmHwRTDataSetInt[i],
+						      PVRSRV_HANDLE_TYPE_RGX_KM_HW_RT_DATASET,
+						      PVRSRV_HANDLE_ALLOC_FLAG_MULTI,
+						      (PFN_HANDLE_RELEASE) &
+						      _RGXCreateHWRTDataSet2psKmHwRTDataSetIntRelease);
+			if (unlikely(psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK))
+			{
+				IMG_UINT32 j;
+				/* Ensure the remaining handles are set to NULL. hKmHwRTDataSetInt2[i] was
+				 * zeroed when calling PVRSRVAllocHandleUnlocked, so we start at the next
+				 * element. If it was the last iteration, the loop doesn't run.
+				 */
+				for (j = i + 1; j < RGXMKIF_NUM_RTDATAS; j++)
+				{
+					hKmHwRTDataSetInt2[j] = NULL;
+				}
+				UnlockHandle(psConnection->psHandleBase);
+				goto RGXCreateHWRTDataSet2_exit;
+			}
+
+		}
+	}
+	/* Release now we have created handles. */
+	UnlockHandle(psConnection->psHandleBase);
+
+	/* If dest ptr is non-null and we have data to copy */
+	if ((hKmHwRTDataSetInt2) && ((RGXMKIF_NUM_RTDATAS * sizeof(RGX_KM_HW_RT_DATASET *)) > 0))
+	{
+		if (unlikely
+		    (OSCopyToUser
+		     (NULL, (void __user *)psRGXCreateHWRTDataSet2OUT->phKmHwRTDataSet,
+		      hKmHwRTDataSetInt2,
+		      (RGXMKIF_NUM_RTDATAS * sizeof(RGX_KM_HW_RT_DATASET *))) != PVRSRV_OK))
+		{
+			psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
+
+			goto RGXCreateHWRTDataSet2_exit;
+		}
+	}
+
+RGXCreateHWRTDataSet2_exit:
+
+	/* Lock over handle lookup cleanup. */
+	LockHandle(psConnection->psHandleBase);
+
+	/* Unreference the previously looked up handle */
+	if (psPMMlistsReservationInt)
+	{
+		PVRSRVReleaseHandleUnlocked(psConnection->psHandleBase,
+					    hPMMlistsReservation,
+					    PVRSRV_HANDLE_TYPE_DEVMEMINT_RESERVATION2);
+	}
+
+	if (hapsFreeListsInt2)
+	{
+		IMG_UINT32 i;
+
+		for (i = 0; i < RGXMKIF_NUM_RTDATA_FREELISTS; i++)
+		{
+
+			/* Unreference the previously looked up handle */
+			if (psapsFreeListsInt && psapsFreeListsInt[i])
+			{
+				PVRSRVReleaseHandleUnlocked(psConnection->psHandleBase,
+							    hapsFreeListsInt2[i],
+							    PVRSRV_HANDLE_TYPE_RGX_FREELIST);
+			}
+		}
+	}
+	/* Release now we have cleaned up look up handles. */
+	UnlockHandle(psConnection->psHandleBase);
+
+	if (psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK)
+	{
+		if (hKmHwRTDataSetInt2)
+		{
+			PVRSRV_ERROR eError;
+
+			/* Lock over handle creation cleanup. */
+			LockHandle(psConnection->psHandleBase);
+
+			{
+				IMG_UINT32 idx;
+				for (idx = 0; idx < RGXMKIF_NUM_RTDATAS; idx++)
+				{
+					if (hKmHwRTDataSetInt2[idx])
+					{
+
+						eError =
+						    PVRSRVDestroyHandleUnlocked(psConnection->
+										psHandleBase,
+										hKmHwRTDataSetInt2
+										[idx],
+										PVRSRV_HANDLE_TYPE_RGX_KM_HW_RT_DATASET);
+						if (unlikely
+						    ((eError != PVRSRV_OK)
+						     && (eError != PVRSRV_ERROR_RETRY)))
+						{
+							PVR_DPF((PVR_DBG_ERROR,
+								 "%s: %s",
+								 __func__,
+								 PVRSRVGetErrorString(eError)));
+						}
+						/* Releasing the handle should free/destroy/release the resource.
+						 * This should never fail... */
+						PVR_ASSERT((eError == PVRSRV_OK)
+							   || (eError == PVRSRV_ERROR_RETRY));
+
+					}
+					else
+					{
+						/* Free/Destroy/Release the resource */
+						RGXDestroyHWRTDataSet(psKmHwRTDataSetInt[idx]);
+					}
+				}
+			}
+
+			/* Release now we have cleaned up creation handles. */
+			UnlockHandle(psConnection->psHandleBase);
+
+		}
+
+		else if (psKmHwRTDataSetInt)
+		{
+			IMG_UINT32 i;
+			for (i = 0; i < RGXMKIF_NUM_RTDATAS; i++)
+			{
+				if (psKmHwRTDataSetInt[i])
+				{
+					RGXDestroyHWRTDataSet(psKmHwRTDataSetInt[i]);
+				}
+			}
+		}
+
+	}
+
+	/* Allocated space should be equal to the last updated offset */
+#ifdef PVRSRV_NEED_PVR_ASSERT
+	if (psRGXCreateHWRTDataSet2OUT->eError == PVRSRV_OK)
+		PVR_ASSERT(ui32BufferSize == ui32NextOffset);
+#endif /* PVRSRV_NEED_PVR_ASSERT */
+
+	if (!bHaveEnoughSpace && pArrayArgsBuffer)
+		OSFreeMemNoStats(pArrayArgsBuffer);
+
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2, eError);
 }
 
 /* ***************************************************************************
@@ -2761,6 +3228,11 @@ PVRSRV_ERROR InitRGXTA3DBridge(void)
 			      sizeof(PVRSRV_BRIDGE_IN_RGXCREATEFREELIST2),
 			      sizeof(PVRSRV_BRIDGE_OUT_RGXCREATEFREELIST2));
 
+	SetDispatchTableEntry(PVRSRV_BRIDGE_RGXTA3D, PVRSRV_BRIDGE_RGXTA3D_RGXCREATEHWRTDATASET2,
+			      PVRSRVBridgeRGXCreateHWRTDataSet2, NULL,
+			      sizeof(PVRSRV_BRIDGE_IN_RGXCREATEHWRTDATASET2),
+			      sizeof(PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2));
+
 	return PVRSRV_OK;
 }
 
@@ -2809,4 +3281,6 @@ void DeinitRGXTA3DBridge(void)
 
 	UnsetDispatchTableEntry(PVRSRV_BRIDGE_RGXTA3D, PVRSRV_BRIDGE_RGXTA3D_RGXCREATEFREELIST2);
 
+	UnsetDispatchTableEntry(PVRSRV_BRIDGE_RGXTA3D, PVRSRV_BRIDGE_RGXTA3D_RGXCREATEHWRTDATASET2);
+
 }
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtimerquery_bridge/server_rgxtimerquery_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtimerquery_bridge/server_rgxtimerquery_bridge.c
index 4af3cfc..22f2810 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtimerquery_bridge/server_rgxtimerquery_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtimerquery_bridge/server_rgxtimerquery_bridge.c
@@ -65,7 +65,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXBeginTimerQuery(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXBeginTimerQueryIN_UI8,
 			       IMG_UINT8 * psRGXBeginTimerQueryOUT_UI8,
@@ -81,10 +81,10 @@ PVRSRVBridgeRGXBeginTimerQuery(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXBeginTimerQueryKM(psConnection, OSGetDevNode(psConnection),
 				       psRGXBeginTimerQueryIN->ui32QueryId);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXBEGINTIMERQUERY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXEndTimerQuery(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psRGXEndTimerQueryIN_UI8,
 			     IMG_UINT8 * psRGXEndTimerQueryOUT_UI8, CONNECTION_DATA * psConnection)
@@ -99,10 +99,10 @@ PVRSRVBridgeRGXEndTimerQuery(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXEndTimerQueryOUT->eError =
 	    PVRSRVRGXEndTimerQueryKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXENDTIMERQUERY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXQueryTimer(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psRGXQueryTimerIN_UI8,
 			  IMG_UINT8 * psRGXQueryTimerOUT_UI8, CONNECTION_DATA * psConnection)
@@ -118,7 +118,7 @@ PVRSRVBridgeRGXQueryTimer(IMG_UINT32 ui32DispatchTableEntry,
 				  &psRGXQueryTimerOUT->ui64StartTime,
 				  &psRGXQueryTimerOUT->ui64EndTime);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXQUERYTIMER, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtq2_bridge/server_rgxtq2_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtq2_bridge/server_rgxtq2_bridge.c
index 8dfc01b..bccd646 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtq2_bridge/server_rgxtq2_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtq2_bridge/server_rgxtq2_bridge.c
@@ -77,7 +77,7 @@ static PVRSRV_ERROR _RGXTDMCreateTransferContextpsTransferContextIntRelease(void
 static_assert(RGXFWIF_RF_CMD_SIZE <= IMG_UINT32_MAX,
 	      "RGXFWIF_RF_CMD_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMCreateTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psRGXTDMCreateTransferContextIN_UI8,
 					IMG_UINT8 * psRGXTDMCreateTransferContextOUT_UI8,
@@ -268,10 +268,10 @@ PVRSRVBridgeRGXTDMCreateTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMCREATETRANSFERCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMDestroyTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psRGXTDMDestroyTransferContextIN_UI8,
 					 IMG_UINT8 * psRGXTDMDestroyTransferContextOUT_UI8,
@@ -324,10 +324,10 @@ PVRSRVBridgeRGXTDMDestroyTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXTDMDestroyTransferContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMDESTROYTRANSFERCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMSetTransferContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 					     IMG_UINT8 * psRGXTDMSetTransferContextPriorityIN_UI8,
 					     IMG_UINT8 * psRGXTDMSetTransferContextPriorityOUT_UI8,
@@ -395,10 +395,10 @@ PVRSRVBridgeRGXTDMSetTransferContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMSETTRANSFERCONTEXTPRIORITY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMNotifyWriteOffsetUpdate(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psRGXTDMNotifyWriteOffsetUpdateIN_UI8,
 					  IMG_UINT8 * psRGXTDMNotifyWriteOffsetUpdateOUT_UI8,
@@ -465,7 +465,7 @@ PVRSRVBridgeRGXTDMNotifyWriteOffsetUpdate(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMNOTIFYWRITEOFFSETUPDATE, eError);
 }
 
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
@@ -477,7 +477,7 @@ static_assert(RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE <= IMG_UINT32_MAX,
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
 	      "PVRSRV_MAX_SYNCS must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMSubmitTransfer2(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXTDMSubmitTransfer2IN_UI8,
 				  IMG_UINT8 * psRGXTDMSubmitTransfer2OUT_UI8,
@@ -882,7 +882,7 @@ PVRSRVBridgeRGXTDMSubmitTransfer2(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMSUBMITTRANSFER2, eError);
 }
 
 static PVRSRV_ERROR _RGXTDMGetSharedMemorypsCLIPMRMemIntRelease(void *pvData)
@@ -899,7 +899,7 @@ static PVRSRV_ERROR _RGXTDMGetSharedMemorypsUSCPMRMemIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMGetSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXTDMGetSharedMemoryIN_UI8,
 				  IMG_UINT8 * psRGXTDMGetSharedMemoryOUT_UI8,
@@ -988,10 +988,10 @@ PVRSRVBridgeRGXTDMGetSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMGETSHAREDMEMORY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMReleaseSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psRGXTDMReleaseSharedMemoryIN_UI8,
 				      IMG_UINT8 * psRGXTDMReleaseSharedMemoryOUT_UI8,
@@ -1041,10 +1041,10 @@ PVRSRVBridgeRGXTDMReleaseSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXTDMReleaseSharedMemory_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMRELEASESHAREDMEMORY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMSetTransferContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 					     IMG_UINT8 * psRGXTDMSetTransferContextPropertyIN_UI8,
 					     IMG_UINT8 * psRGXTDMSetTransferContextPropertyOUT_UI8,
@@ -1115,7 +1115,7 @@ PVRSRVBridgeRGXTDMSetTransferContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMSETTRANSFERCONTEXTPROPERTY, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtq_bridge/server_rgxtq_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtq_bridge/server_rgxtq_bridge.c
index 1d067ac..95e7f54 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtq_bridge/server_rgxtq_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/rgxtq_bridge/server_rgxtq_bridge.c
@@ -78,7 +78,7 @@ static PVRSRV_ERROR _RGXCreateTransferContextpsTransferContextIntRelease(void *p
 static_assert(RGXFWIF_RF_CMD_SIZE <= IMG_UINT32_MAX,
 	      "RGXFWIF_RF_CMD_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRGXCreateTransferContextIN_UI8,
 				     IMG_UINT8 * psRGXCreateTransferContextOUT_UI8,
@@ -251,10 +251,10 @@ PVRSRVBridgeRGXCreateTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATETRANSFERCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psRGXDestroyTransferContextIN_UI8,
 				      IMG_UINT8 * psRGXDestroyTransferContextOUT_UI8,
@@ -292,10 +292,10 @@ PVRSRVBridgeRGXDestroyTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyTransferContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYTRANSFERCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetTransferContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psRGXSetTransferContextPriorityIN_UI8,
 					  IMG_UINT8 * psRGXSetTransferContextPriorityOUT_UI8,
@@ -348,7 +348,7 @@ PVRSRVBridgeRGXSetTransferContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETTRANSFERCONTEXTPRIORITY, eError);
 }
 
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
@@ -360,7 +360,7 @@ static_assert(RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE <= IMG_UINT32_MAX,
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
 	      "PVRSRV_MAX_SYNCS must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSubmitTransfer2(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXSubmitTransfer2IN_UI8,
 			       IMG_UINT8 * psRGXSubmitTransfer2OUT_UI8,
@@ -1020,7 +1020,7 @@ PVRSRVBridgeRGXSubmitTransfer2(IMG_UINT32 ui32DispatchTableEntry,
 	if (pArrayArgsBuffer2)
 		OSFreeMemNoStats(pArrayArgsBuffer2);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSUBMITTRANSFER2, eError);
 }
 
 static PVRSRV_ERROR _RGXTQGetSharedMemorypsCLIPMRMemIntRelease(void *pvData)
@@ -1037,7 +1037,7 @@ static PVRSRV_ERROR _RGXTQGetSharedMemorypsUSCPMRMemIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTQGetSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psRGXTQGetSharedMemoryIN_UI8,
 				 IMG_UINT8 * psRGXTQGetSharedMemoryOUT_UI8,
@@ -1112,10 +1112,10 @@ PVRSRVBridgeRGXTQGetSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTQGETSHAREDMEMORY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTQReleaseSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRGXTQReleaseSharedMemoryIN_UI8,
 				     IMG_UINT8 * psRGXTQReleaseSharedMemoryOUT_UI8,
@@ -1151,10 +1151,10 @@ PVRSRVBridgeRGXTQReleaseSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXTQReleaseSharedMemory_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTQRELEASESHAREDMEMORY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetTransferContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psRGXSetTransferContextPropertyIN_UI8,
 					  IMG_UINT8 * psRGXSetTransferContextPropertyOUT_UI8,
@@ -1208,7 +1208,7 @@ PVRSRVBridgeRGXSetTransferContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETTRANSFERCONTEXTPROPERTY, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/ri_bridge/server_ri_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/ri_bridge/server_ri_bridge.c
index 1f9db7d..940f942 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/ri_bridge/server_ri_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/ri_bridge/server_ri_bridge.c
@@ -65,7 +65,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIWritePMREntry(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psRIWritePMREntryIN_UI8,
 			    IMG_UINT8 * psRIWritePMREntryOUT_UI8, CONNECTION_DATA * psConnection)
@@ -110,7 +110,7 @@ PVRSRVBridgeRIWritePMREntry(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIWRITEPMRENTRY, eError);
 }
 
 static PVRSRV_ERROR _RIWriteMEMDESCEntrypsRIHandleIntRelease(void *pvData)
@@ -123,7 +123,7 @@ static PVRSRV_ERROR _RIWriteMEMDESCEntrypsRIHandleIntRelease(void *pvData)
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIWriteMEMDESCEntry(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRIWriteMEMDESCEntryIN_UI8,
 				IMG_UINT8 * psRIWriteMEMDESCEntryOUT_UI8,
@@ -294,7 +294,7 @@ PVRSRVBridgeRIWriteMEMDESCEntry(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIWRITEMEMDESCENTRY, eError);
 }
 
 static PVRSRV_ERROR _RIWriteProcListEntrypsRIHandleIntRelease(void *pvData)
@@ -307,7 +307,7 @@ static PVRSRV_ERROR _RIWriteProcListEntrypsRIHandleIntRelease(void *pvData)
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIWriteProcListEntry(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psRIWriteProcListEntryIN_UI8,
 				 IMG_UINT8 * psRIWriteProcListEntryOUT_UI8,
@@ -446,10 +446,10 @@ PVRSRVBridgeRIWriteProcListEntry(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIWRITEPROCLISTENTRY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIUpdateMEMDESCAddr(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRIUpdateMEMDESCAddrIN_UI8,
 				IMG_UINT8 * psRIUpdateMEMDESCAddrOUT_UI8,
@@ -498,10 +498,10 @@ PVRSRVBridgeRIUpdateMEMDESCAddr(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIUPDATEMEMDESCADDR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIDeleteMEMDESCEntry(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psRIDeleteMEMDESCEntryIN_UI8,
 				 IMG_UINT8 * psRIDeleteMEMDESCEntryOUT_UI8,
@@ -537,10 +537,10 @@ PVRSRVBridgeRIDeleteMEMDESCEntry(IMG_UINT32 ui32DispatchTableEntry,
 
 RIDeleteMEMDESCEntry_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIDELETEMEMDESCENTRY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIDumpList(IMG_UINT32 ui32DispatchTableEntry,
 		       IMG_UINT8 * psRIDumpListIN_UI8,
 		       IMG_UINT8 * psRIDumpListOUT_UI8, CONNECTION_DATA * psConnection)
@@ -585,10 +585,10 @@ PVRSRVBridgeRIDumpList(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIDUMPLIST, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIDumpAll(IMG_UINT32 ui32DispatchTableEntry,
 		      IMG_UINT8 * psRIDumpAllIN_UI8,
 		      IMG_UINT8 * psRIDumpAllOUT_UI8, CONNECTION_DATA * psConnection)
@@ -603,10 +603,10 @@ PVRSRVBridgeRIDumpAll(IMG_UINT32 ui32DispatchTableEntry,
 
 	psRIDumpAllOUT->eError = RIDumpAllKM();
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIDUMPALL, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIDumpProcess(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psRIDumpProcessIN_UI8,
 			  IMG_UINT8 * psRIDumpProcessOUT_UI8, CONNECTION_DATA * psConnection)
@@ -620,10 +620,10 @@ PVRSRVBridgeRIDumpProcess(IMG_UINT32 ui32DispatchTableEntry,
 
 	psRIDumpProcessOUT->eError = RIDumpProcessKM(psRIDumpProcessIN->ui32Pid);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIDUMPPROCESS, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIWritePMREntryWithOwner(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRIWritePMREntryWithOwnerIN_UI8,
 				     IMG_UINT8 * psRIWritePMREntryWithOwnerOUT_UI8,
@@ -672,7 +672,7 @@ PVRSRVBridgeRIWritePMREntryWithOwner(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIWRITEPMRENTRYWITHOWNER, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/srvcore_bridge/server_srvcore_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/srvcore_bridge/server_srvcore_bridge.c
index d40e53b..06d2b1d 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/srvcore_bridge/server_srvcore_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/srvcore_bridge/server_srvcore_bridge.c
@@ -68,7 +68,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeConnect(IMG_UINT32 ui32DispatchTableEntry,
 		    IMG_UINT8 * psConnectIN_UI8,
 		    IMG_UINT8 * psConnectOUT_UI8, CONNECTION_DATA * psConnection)
@@ -87,10 +87,10 @@ PVRSRVBridgeConnect(IMG_UINT32 ui32DispatchTableEntry,
 			    &psConnectOUT->ui8KernelArch,
 			    &psConnectOUT->ui32CapabilityFlags, &psConnectOUT->ui64PackedBvnc);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CONNECT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDisconnect(IMG_UINT32 ui32DispatchTableEntry,
 		       IMG_UINT8 * psDisconnectIN_UI8,
 		       IMG_UINT8 * psDisconnectOUT_UI8, CONNECTION_DATA * psConnection)
@@ -105,7 +105,7 @@ PVRSRVBridgeDisconnect(IMG_UINT32 ui32DispatchTableEntry,
 
 	psDisconnectOUT->eError = PVRSRVDisconnectKM();
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DISCONNECT, eError);
 }
 
 static PVRSRV_ERROR _AcquireGlobalEventObjecthGlobalEventObjectIntRelease(void *pvData)
@@ -115,7 +115,7 @@ static PVRSRV_ERROR _AcquireGlobalEventObjecthGlobalEventObjectIntRelease(void *
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeAcquireGlobalEventObject(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psAcquireGlobalEventObjectIN_UI8,
 				     IMG_UINT8 * psAcquireGlobalEventObjectOUT_UI8,
@@ -170,10 +170,10 @@ PVRSRVBridgeAcquireGlobalEventObject(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_ACQUIREGLOBALEVENTOBJECT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeReleaseGlobalEventObject(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psReleaseGlobalEventObjectIN_UI8,
 				     IMG_UINT8 * psReleaseGlobalEventObjectOUT_UI8,
@@ -211,7 +211,7 @@ PVRSRVBridgeReleaseGlobalEventObject(IMG_UINT32 ui32DispatchTableEntry,
 
 ReleaseGlobalEventObject_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RELEASEGLOBALEVENTOBJECT, eError);
 }
 
 static PVRSRV_ERROR _EventObjectOpenhOSEventIntRelease(void *pvData)
@@ -221,7 +221,7 @@ static PVRSRV_ERROR _EventObjectOpenhOSEventIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeEventObjectOpen(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psEventObjectOpenIN_UI8,
 			    IMG_UINT8 * psEventObjectOpenOUT_UI8, CONNECTION_DATA * psConnection)
@@ -300,10 +300,10 @@ PVRSRVBridgeEventObjectOpen(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_EVENTOBJECTOPEN, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeEventObjectWait(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psEventObjectWaitIN_UI8,
 			    IMG_UINT8 * psEventObjectWaitOUT_UI8, CONNECTION_DATA * psConnection)
@@ -349,10 +349,10 @@ PVRSRVBridgeEventObjectWait(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_EVENTOBJECTWAIT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeEventObjectClose(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psEventObjectCloseIN_UI8,
 			     IMG_UINT8 * psEventObjectCloseOUT_UI8, CONNECTION_DATA * psConnection)
@@ -384,10 +384,10 @@ PVRSRVBridgeEventObjectClose(IMG_UINT32 ui32DispatchTableEntry,
 
 EventObjectClose_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_EVENTOBJECTCLOSE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDumpDebugInfo(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psDumpDebugInfoIN_UI8,
 			  IMG_UINT8 * psDumpDebugInfoOUT_UI8, CONNECTION_DATA * psConnection)
@@ -401,10 +401,10 @@ PVRSRVBridgeDumpDebugInfo(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVDumpDebugInfoKM(psConnection, OSGetDevNode(psConnection),
 				  psDumpDebugInfoIN->ui32VerbLevel);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DUMPDEBUGINFO, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeGetDevClockSpeed(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psGetDevClockSpeedIN_UI8,
 			     IMG_UINT8 * psGetDevClockSpeedOUT_UI8, CONNECTION_DATA * psConnection)
@@ -420,10 +420,10 @@ PVRSRVBridgeGetDevClockSpeed(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVGetDevClockSpeedKM(psConnection, OSGetDevNode(psConnection),
 				     &psGetDevClockSpeedOUT->ui32ClockSpeed);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_GETDEVCLOCKSPEED, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHWOpTimeout(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psHWOpTimeoutIN_UI8,
 			IMG_UINT8 * psHWOpTimeoutOUT_UI8, CONNECTION_DATA * psConnection)
@@ -437,13 +437,13 @@ PVRSRVBridgeHWOpTimeout(IMG_UINT32 ui32DispatchTableEntry,
 
 	psHWOpTimeoutOUT->eError = PVRSRVHWOpTimeoutKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HWOPTIMEOUT, eError);
 }
 
 static_assert(RGXFW_ALIGN_CHECKS_UM_MAX <= IMG_UINT32_MAX,
 	      "RGXFW_ALIGN_CHECKS_UM_MAX must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeAlignmentCheck(IMG_UINT32 ui32DispatchTableEntry,
 			   IMG_UINT8 * psAlignmentCheckIN_UI8,
 			   IMG_UINT8 * psAlignmentCheckOUT_UI8, CONNECTION_DATA * psConnection)
@@ -541,10 +541,10 @@ PVRSRVBridgeAlignmentCheck(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_ALIGNMENTCHECK, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeGetDeviceStatus(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psGetDeviceStatusIN_UI8,
 			    IMG_UINT8 * psGetDeviceStatusOUT_UI8, CONNECTION_DATA * psConnection)
@@ -560,12 +560,12 @@ PVRSRVBridgeGetDeviceStatus(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVGetDeviceStatusKM(psConnection, OSGetDevNode(psConnection),
 				    &psGetDeviceStatusOUT->ui32DeviceSatus);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_GETDEVICESTATUS, eError);
 }
 
 static_assert(8 <= IMG_UINT32_MAX, "8 must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeGetMultiCoreInfo(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psGetMultiCoreInfoIN_UI8,
 			     IMG_UINT8 * psGetMultiCoreInfoOUT_UI8, CONNECTION_DATA * psConnection)
@@ -670,10 +670,10 @@ PVRSRVBridgeGetMultiCoreInfo(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_GETMULTICOREINFO, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeEventObjectWaitTimeout(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psEventObjectWaitTimeoutIN_UI8,
 				   IMG_UINT8 * psEventObjectWaitTimeoutOUT_UI8,
@@ -723,13 +723,13 @@ PVRSRVBridgeEventObjectWaitTimeout(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_EVENTOBJECTWAITTIMEOUT, eError);
 }
 
 static_assert(PVRSRV_PROCESS_STAT_TYPE_COUNT <= IMG_UINT32_MAX,
 	      "PVRSRV_PROCESS_STAT_TYPE_COUNT must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeFindProcessMemStats(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psFindProcessMemStatsIN_UI8,
 				IMG_UINT8 * psFindProcessMemStatsOUT_UI8,
@@ -843,7 +843,7 @@ PVRSRVBridgeFindProcessMemStats(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_FINDPROCESSMEMSTATS, eError);
 }
 
 static PVRSRV_ERROR _AcquireInfoPagepsPMRIntRelease(void *pvData)
@@ -853,7 +853,7 @@ static PVRSRV_ERROR _AcquireInfoPagepsPMRIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeAcquireInfoPage(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psAcquireInfoPageIN_UI8,
 			    IMG_UINT8 * psAcquireInfoPageOUT_UI8, CONNECTION_DATA * psConnection)
@@ -902,10 +902,10 @@ PVRSRVBridgeAcquireInfoPage(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_ACQUIREINFOPAGE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeReleaseInfoPage(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psReleaseInfoPageIN_UI8,
 			    IMG_UINT8 * psReleaseInfoPageOUT_UI8, CONNECTION_DATA * psConnection)
@@ -937,7 +937,7 @@ PVRSRVBridgeReleaseInfoPage(IMG_UINT32 ui32DispatchTableEntry,
 
 ReleaseInfoPage_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RELEASEINFOPAGE, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/sync_bridge/server_sync_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/sync_bridge/server_sync_bridge.c
index a0d9210..a54f23f 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/sync_bridge/server_sync_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/sync_bridge/server_sync_bridge.c
@@ -77,7 +77,7 @@ static PVRSRV_ERROR _AllocSyncPrimitiveBlockpsSyncHandleIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeAllocSyncPrimitiveBlock(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psAllocSyncPrimitiveBlockIN_UI8,
 				    IMG_UINT8 * psAllocSyncPrimitiveBlockOUT_UI8,
@@ -179,10 +179,10 @@ PVRSRVBridgeAllocSyncPrimitiveBlock(IMG_UINT32 ui32DispatchTableEntry,
 
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_ALLOCSYNCPRIMITIVEBLOCK, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeFreeSyncPrimitiveBlock(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psFreeSyncPrimitiveBlockIN_UI8,
 				   IMG_UINT8 * psFreeSyncPrimitiveBlockOUT_UI8,
@@ -218,10 +218,10 @@ PVRSRVBridgeFreeSyncPrimitiveBlock(IMG_UINT32 ui32DispatchTableEntry,
 
 FreeSyncPrimitiveBlock_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_FREESYNCPRIMITIVEBLOCK, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncPrimSet(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psSyncPrimSetIN_UI8,
 			IMG_UINT8 * psSyncPrimSetOUT_UI8, CONNECTION_DATA * psConnection)
@@ -269,12 +269,12 @@ PVRSRVBridgeSyncPrimSet(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCPRIMSET, eError);
 }
 
 #if defined(PDUMP)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncPrimPDump(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psSyncPrimPDumpIN_UI8,
 			  IMG_UINT8 * psSyncPrimPDumpOUT_UI8, CONNECTION_DATA * psConnection)
@@ -321,7 +321,7 @@ PVRSRVBridgeSyncPrimPDump(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCPRIMPDUMP, eError);
 }
 
 #else
@@ -330,7 +330,7 @@ PVRSRVBridgeSyncPrimPDump(IMG_UINT32 ui32DispatchTableEntry,
 
 #if defined(PDUMP)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncPrimPDumpValue(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psSyncPrimPDumpValueIN_UI8,
 			       IMG_UINT8 * psSyncPrimPDumpValueOUT_UI8,
@@ -381,7 +381,7 @@ PVRSRVBridgeSyncPrimPDumpValue(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCPRIMPDUMPVALUE, eError);
 }
 
 #else
@@ -390,7 +390,7 @@ PVRSRVBridgeSyncPrimPDumpValue(IMG_UINT32 ui32DispatchTableEntry,
 
 #if defined(PDUMP)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncPrimPDumpPol(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psSyncPrimPDumpPolIN_UI8,
 			     IMG_UINT8 * psSyncPrimPDumpPolOUT_UI8, CONNECTION_DATA * psConnection)
@@ -442,7 +442,7 @@ PVRSRVBridgeSyncPrimPDumpPol(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCPRIMPDUMPPOL, eError);
 }
 
 #else
@@ -451,7 +451,7 @@ PVRSRVBridgeSyncPrimPDumpPol(IMG_UINT32 ui32DispatchTableEntry,
 
 #if defined(PDUMP)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncPrimPDumpCBP(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psSyncPrimPDumpCBPIN_UI8,
 			     IMG_UINT8 * psSyncPrimPDumpCBPOUT_UI8, CONNECTION_DATA * psConnection)
@@ -502,7 +502,7 @@ PVRSRVBridgeSyncPrimPDumpCBP(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCPRIMPDUMPCBP, eError);
 }
 
 #else
@@ -512,7 +512,7 @@ PVRSRVBridgeSyncPrimPDumpCBP(IMG_UINT32 ui32DispatchTableEntry,
 static_assert(PVRSRV_SYNC_NAME_LENGTH <= IMG_UINT32_MAX,
 	      "PVRSRV_SYNC_NAME_LENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncAllocEvent(IMG_UINT32 ui32DispatchTableEntry,
 			   IMG_UINT8 * psSyncAllocEventIN_UI8,
 			   IMG_UINT8 * psSyncAllocEventOUT_UI8, CONNECTION_DATA * psConnection)
@@ -613,10 +613,10 @@ PVRSRVBridgeSyncAllocEvent(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCALLOCEVENT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncFreeEvent(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psSyncFreeEventIN_UI8,
 			  IMG_UINT8 * psSyncFreeEventOUT_UI8, CONNECTION_DATA * psConnection)
@@ -630,12 +630,12 @@ PVRSRVBridgeSyncFreeEvent(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVSyncFreeEventKM(psConnection, OSGetDevNode(psConnection),
 				  psSyncFreeEventIN->ui32FWAddr);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCFREEEVENT, eError);
 }
 
 #if defined(PDUMP)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncCheckpointSignalledPDumpPol(IMG_UINT32 ui32DispatchTableEntry,
 					    IMG_UINT8 * psSyncCheckpointSignalledPDumpPolIN_UI8,
 					    IMG_UINT8 * psSyncCheckpointSignalledPDumpPolOUT_UI8,
@@ -653,7 +653,7 @@ PVRSRVBridgeSyncCheckpointSignalledPDumpPol(IMG_UINT32 ui32DispatchTableEntry,
 	psSyncCheckpointSignalledPDumpPolOUT->eError =
 	    PVRSRVSyncCheckpointSignalledPDumpPolKM(psSyncCheckpointSignalledPDumpPolIN->hFence);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCCHECKPOINTSIGNALLEDPDUMPPOL, eError);
 }
 
 #else
diff --git a/drivers/gpu/img-rogue/23.2/generated/rogue/synctracking_bridge/server_synctracking_bridge.c b/drivers/gpu/img-rogue/23.2/generated/rogue/synctracking_bridge/server_synctracking_bridge.c
index 06757e5..1c2136a 100644
--- a/drivers/gpu/img-rogue/23.2/generated/rogue/synctracking_bridge/server_synctracking_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/rogue/synctracking_bridge/server_synctracking_bridge.c
@@ -66,7 +66,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncRecordRemoveByHandle(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psSyncRecordRemoveByHandleIN_UI8,
 				     IMG_UINT8 * psSyncRecordRemoveByHandleOUT_UI8,
@@ -102,7 +102,7 @@ PVRSRVBridgeSyncRecordRemoveByHandle(IMG_UINT32 ui32DispatchTableEntry,
 
 SyncRecordRemoveByHandle_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCRECORDREMOVEBYHANDLE, eError);
 }
 
 static PVRSRV_ERROR _SyncRecordAddpshRecordIntRelease(void *pvData)
@@ -115,7 +115,7 @@ static PVRSRV_ERROR _SyncRecordAddpshRecordIntRelease(void *pvData)
 static_assert(PVRSRV_SYNC_NAME_LENGTH <= IMG_UINT32_MAX,
 	      "PVRSRV_SYNC_NAME_LENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncRecordAdd(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psSyncRecordAddIN_UI8,
 			  IMG_UINT8 * psSyncRecordAddOUT_UI8, CONNECTION_DATA * psConnection)
@@ -284,7 +284,7 @@ PVRSRVBridgeSyncRecordAdd(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCRECORDADD, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/cache_bridge/server_cache_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/cache_bridge/server_cache_bridge.c
index b2f5267..614599b 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/cache_bridge/server_cache_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/cache_bridge/server_cache_bridge.c
@@ -68,7 +68,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 static_assert(CACHE_BATCH_MAX <= IMG_UINT32_MAX,
 	      "CACHE_BATCH_MAX must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeCacheOpQueue(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psCacheOpQueueIN_UI8,
 			 IMG_UINT8 * psCacheOpQueueOUT_UI8, CONNECTION_DATA * psConnection)
@@ -300,10 +300,10 @@ PVRSRVBridgeCacheOpQueue(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CACHEOPQUEUE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeCacheOpExec(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psCacheOpExecIN_UI8,
 			IMG_UINT8 * psCacheOpExecOUT_UI8, CONNECTION_DATA * psConnection)
@@ -352,10 +352,10 @@ PVRSRVBridgeCacheOpExec(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CACHEOPEXEC, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeCacheOpLog(IMG_UINT32 ui32DispatchTableEntry,
 		       IMG_UINT8 * psCacheOpLogIN_UI8,
 		       IMG_UINT8 * psCacheOpLogOUT_UI8, CONNECTION_DATA * psConnection)
@@ -406,7 +406,7 @@ PVRSRVBridgeCacheOpLog(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CACHEOPLOG, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/cmm_bridge/server_cmm_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/cmm_bridge/server_cmm_bridge.c
index cc658c7..019daf5 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/cmm_bridge/server_cmm_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/cmm_bridge/server_cmm_bridge.c
@@ -75,7 +75,7 @@ static PVRSRV_ERROR _DevmemIntExportCtxpsContextExportIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntExportCtx(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psDevmemIntExportCtxIN_UI8,
 			       IMG_UINT8 * psDevmemIntExportCtxOUT_UI8,
@@ -179,10 +179,10 @@ PVRSRVBridgeDevmemIntExportCtx(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTEXPORTCTX, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnexportCtx(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psDevmemIntUnexportCtxIN_UI8,
 				 IMG_UINT8 * psDevmemIntUnexportCtxOUT_UI8,
@@ -218,7 +218,7 @@ PVRSRVBridgeDevmemIntUnexportCtx(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntUnexportCtx_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNEXPORTCTX, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntAcquireRemoteCtxpsContextIntRelease(void *pvData)
@@ -228,7 +228,7 @@ static PVRSRV_ERROR _DevmemIntAcquireRemoteCtxpsContextIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntAcquireRemoteCtx(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psDevmemIntAcquireRemoteCtxIN_UI8,
 				      IMG_UINT8 * psDevmemIntAcquireRemoteCtxOUT_UI8,
@@ -352,7 +352,7 @@ PVRSRVBridgeDevmemIntAcquireRemoteCtx(IMG_UINT32 ui32DispatchTableEntry,
 
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTACQUIREREMOTECTX, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/devicememhistory_bridge/server_devicememhistory_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/devicememhistory_bridge/server_devicememhistory_bridge.c
index 72c6a86..fa81161 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/devicememhistory_bridge/server_devicememhistory_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/devicememhistory_bridge/server_devicememhistory_bridge.c
@@ -71,7 +71,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevicememHistoryMap(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psDevicememHistoryMapIN_UI8,
 				IMG_UINT8 * psDevicememHistoryMapOUT_UI8,
@@ -199,13 +199,13 @@ PVRSRVBridgeDevicememHistoryMap(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVICEMEMHISTORYMAP, eError);
 }
 
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevicememHistoryUnmap(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psDevicememHistoryUnmapIN_UI8,
 				  IMG_UINT8 * psDevicememHistoryUnmapOUT_UI8,
@@ -333,13 +333,13 @@ PVRSRVBridgeDevicememHistoryUnmap(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVICEMEMHISTORYUNMAP, eError);
 }
 
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevicememHistoryMapVRange(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psDevicememHistoryMapVRangeIN_UI8,
 				      IMG_UINT8 * psDevicememHistoryMapVRangeOUT_UI8,
@@ -438,13 +438,13 @@ PVRSRVBridgeDevicememHistoryMapVRange(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVICEMEMHISTORYMAPVRANGE, eError);
 }
 
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevicememHistoryUnmapVRange(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psDevicememHistoryUnmapVRangeIN_UI8,
 					IMG_UINT8 * psDevicememHistoryUnmapVRangeOUT_UI8,
@@ -546,7 +546,7 @@ PVRSRVBridgeDevicememHistoryUnmapVRange(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVICEMEMHISTORYUNMAPVRANGE, eError);
 }
 
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
@@ -556,7 +556,7 @@ static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 	      "PMR_MAX_SUPPORTED_4K_PAGE_COUNT must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevicememHistorySparseChange(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psDevicememHistorySparseChangeIN_UI8,
 					 IMG_UINT8 * psDevicememHistorySparseChangeOUT_UI8,
@@ -758,7 +758,7 @@ PVRSRVBridgeDevicememHistorySparseChange(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVICEMEMHISTORYSPARSECHANGE, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/di_bridge/server_di_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/di_bridge/server_di_bridge.c
index 154bccd..04c2af8 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/di_bridge/server_di_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/di_bridge/server_di_bridge.c
@@ -75,7 +75,7 @@ static PVRSRV_ERROR _DICreateContextpsContextIntRelease(void *pvData)
 static_assert(PRVSRVTL_MAX_STREAM_NAME_SIZE <= IMG_UINT32_MAX,
 	      "PRVSRVTL_MAX_STREAM_NAME_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDICreateContext(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psDICreateContextIN_UI8,
 			    IMG_UINT8 * psDICreateContextOUT_UI8, CONNECTION_DATA * psConnection)
@@ -227,10 +227,10 @@ PVRSRVBridgeDICreateContext(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DICREATECONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDIDestroyContext(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psDIDestroyContextIN_UI8,
 			     IMG_UINT8 * psDIDestroyContextOUT_UI8, CONNECTION_DATA * psConnection)
@@ -262,13 +262,13 @@ PVRSRVBridgeDIDestroyContext(IMG_UINT32 ui32DispatchTableEntry,
 
 DIDestroyContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DIDESTROYCONTEXT, eError);
 }
 
 static_assert(DI_IMPL_BRG_PATH_LEN <= IMG_UINT32_MAX,
 	      "DI_IMPL_BRG_PATH_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDIReadEntry(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psDIReadEntryIN_UI8,
 			IMG_UINT8 * psDIReadEntryOUT_UI8, CONNECTION_DATA * psConnection)
@@ -387,7 +387,7 @@ PVRSRVBridgeDIReadEntry(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DIREADENTRY, eError);
 }
 
 static_assert(DI_IMPL_BRG_PATH_LEN <= IMG_UINT32_MAX,
@@ -395,7 +395,7 @@ static_assert(DI_IMPL_BRG_PATH_LEN <= IMG_UINT32_MAX,
 static_assert(DI_IMPL_BRG_PATH_LEN <= IMG_UINT32_MAX,
 	      "DI_IMPL_BRG_PATH_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDIWriteEntry(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psDIWriteEntryIN_UI8,
 			 IMG_UINT8 * psDIWriteEntryOUT_UI8, CONNECTION_DATA * psConnection)
@@ -543,10 +543,10 @@ PVRSRVBridgeDIWriteEntry(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DIWRITEENTRY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDIListAllEntries(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psDIListAllEntriesIN_UI8,
 			     IMG_UINT8 * psDIListAllEntriesOUT_UI8, CONNECTION_DATA * psConnection)
@@ -591,7 +591,7 @@ PVRSRVBridgeDIListAllEntries(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DILISTALLENTRIES, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/dmabuf_bridge/server_dmabuf_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/dmabuf_bridge/server_dmabuf_bridge.c
index d3b3279..56fb021 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/dmabuf_bridge/server_dmabuf_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/dmabuf_bridge/server_dmabuf_bridge.c
@@ -76,7 +76,7 @@ static PVRSRV_ERROR _PhysmemImportDmaBufpsPMRPtrIntRelease(void *pvData)
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemImportDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPhysmemImportDmaBufIN_UI8,
 				IMG_UINT8 * psPhysmemImportDmaBufOUT_UI8,
@@ -218,7 +218,7 @@ PVRSRVBridgePhysmemImportDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMIMPORTDMABUF, eError);
 }
 
 static PVRSRV_ERROR _PhysmemImportDmaBufLockedpsPMRPtrIntRelease(void *pvData)
@@ -231,7 +231,7 @@ static PVRSRV_ERROR _PhysmemImportDmaBufLockedpsPMRPtrIntRelease(void *pvData)
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemImportDmaBufLocked(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psPhysmemImportDmaBufLockedIN_UI8,
 				      IMG_UINT8 * psPhysmemImportDmaBufLockedOUT_UI8,
@@ -374,10 +374,10 @@ PVRSRVBridgePhysmemImportDmaBufLocked(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMIMPORTDMABUFLOCKED, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemExportDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPhysmemExportDmaBufIN_UI8,
 				IMG_UINT8 * psPhysmemExportDmaBufOUT_UI8,
@@ -427,7 +427,7 @@ PVRSRVBridgePhysmemExportDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMEXPORTDMABUF, eError);
 }
 
 static PVRSRV_ERROR _PhysmemImportSparseDmaBufpsPMRPtrIntRelease(void *pvData)
@@ -442,7 +442,7 @@ static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemImportSparseDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psPhysmemImportSparseDmaBufIN_UI8,
 				      IMG_UINT8 * psPhysmemImportSparseDmaBufOUT_UI8,
@@ -620,7 +620,7 @@ PVRSRVBridgePhysmemImportSparseDmaBuf(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMIMPORTSPARSEDMABUF, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/htbuffer_bridge/server_htbuffer_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/htbuffer_bridge/server_htbuffer_bridge.c
index 50b4fcb..d9845cc 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/htbuffer_bridge/server_htbuffer_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/htbuffer_bridge/server_htbuffer_bridge.c
@@ -72,7 +72,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 static_assert(HTB_FLAG_NUM_EL <= IMG_UINT32_MAX,
 	      "HTB_FLAG_NUM_EL must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHTBControl(IMG_UINT32 ui32DispatchTableEntry,
 		       IMG_UINT8 * psHTBControlIN_UI8,
 		       IMG_UINT8 * psHTBControlOUT_UI8, CONNECTION_DATA * psConnection)
@@ -175,7 +175,7 @@ PVRSRVBridgeHTBControl(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HTBCONTROL, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/mm_bridge/server_mm_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/mm_bridge/server_mm_bridge.c
index 07f82bd..d476d7f 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/mm_bridge/server_mm_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/mm_bridge/server_mm_bridge.c
@@ -89,7 +89,7 @@ static PVRSRV_ERROR _PMRExportPMRpsPMRExportIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRExportPMR(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psPMRExportPMRIN_UI8,
 			 IMG_UINT8 * psPMRExportPMROUT_UI8, CONNECTION_DATA * psConnection)
@@ -254,7 +254,7 @@ PVRSRVBridgePMRExportPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMREXPORTPMR, eError);
 }
 
 #else
@@ -263,7 +263,7 @@ PVRSRVBridgePMRExportPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 #if defined(SUPPORT_INSECURE_EXPORT)
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRUnexportPMR(IMG_UINT32 ui32DispatchTableEntry,
 			   IMG_UINT8 * psPMRUnexportPMRIN_UI8,
 			   IMG_UINT8 * psPMRUnexportPMROUT_UI8, CONNECTION_DATA * psConnection)
@@ -351,14 +351,14 @@ PVRSRVBridgePMRUnexportPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 PMRUnexportPMR_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRUNEXPORTPMR, eError);
 }
 
 #else
 #define PVRSRVBridgePMRUnexportPMR NULL
 #endif
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRGetUID(IMG_UINT32 ui32DispatchTableEntry,
 		      IMG_UINT8 * psPMRGetUIDIN_UI8,
 		      IMG_UINT8 * psPMRGetUIDOUT_UI8, CONNECTION_DATA * psConnection)
@@ -403,7 +403,7 @@ PVRSRVBridgePMRGetUID(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRGETUID, eError);
 }
 
 static PVRSRV_ERROR _PMRMakeLocalImportHandlepsExtMemIntRelease(void *pvData)
@@ -413,7 +413,7 @@ static PVRSRV_ERROR _PMRMakeLocalImportHandlepsExtMemIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRMakeLocalImportHandle(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psPMRMakeLocalImportHandleIN_UI8,
 				     IMG_UINT8 * psPMRMakeLocalImportHandleOUT_UI8,
@@ -497,10 +497,10 @@ PVRSRVBridgePMRMakeLocalImportHandle(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRMAKELOCALIMPORTHANDLE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRUnmakeLocalImportHandle(IMG_UINT32 ui32DispatchTableEntry,
 				       IMG_UINT8 * psPMRUnmakeLocalImportHandleIN_UI8,
 				       IMG_UINT8 * psPMRUnmakeLocalImportHandleOUT_UI8,
@@ -536,7 +536,7 @@ PVRSRVBridgePMRUnmakeLocalImportHandle(IMG_UINT32 ui32DispatchTableEntry,
 
 PMRUnmakeLocalImportHandle_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRUNMAKELOCALIMPORTHANDLE, eError);
 }
 
 #if defined(SUPPORT_INSECURE_EXPORT)
@@ -547,7 +547,7 @@ static PVRSRV_ERROR _PMRImportPMRpsPMRIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRImportPMR(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psPMRImportPMRIN_UI8,
 			 IMG_UINT8 * psPMRImportPMROUT_UI8, CONNECTION_DATA * psConnection)
@@ -632,7 +632,7 @@ PVRSRVBridgePMRImportPMR(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRIMPORTPMR, eError);
 }
 
 #else
@@ -646,7 +646,7 @@ static PVRSRV_ERROR _PMRLocalImportPMRpsPMRIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRLocalImportPMR(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psPMRLocalImportPMRIN_UI8,
 			      IMG_UINT8 * psPMRLocalImportPMROUT_UI8,
@@ -730,10 +730,10 @@ PVRSRVBridgePMRLocalImportPMR(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRLOCALIMPORTPMR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRUnrefPMR(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psPMRUnrefPMRIN_UI8,
 			IMG_UINT8 * psPMRUnrefPMROUT_UI8, CONNECTION_DATA * psConnection)
@@ -765,10 +765,10 @@ PVRSRVBridgePMRUnrefPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 PMRUnrefPMR_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRUNREFPMR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRUnrefUnlockPMR(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psPMRUnrefUnlockPMRIN_UI8,
 			      IMG_UINT8 * psPMRUnrefUnlockPMROUT_UI8,
@@ -801,7 +801,7 @@ PVRSRVBridgePMRUnrefUnlockPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 PMRUnrefUnlockPMR_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRUNREFUNLOCKPMR, eError);
 }
 
 static PVRSRV_ERROR _PhysmemNewRamBackedPMRpsPMRPtrIntRelease(void *pvData)
@@ -816,7 +816,7 @@ static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemNewRamBackedPMR(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psPhysmemNewRamBackedPMRIN_UI8,
 				   IMG_UINT8 * psPhysmemNewRamBackedPMROUT_UI8,
@@ -999,7 +999,7 @@ PVRSRVBridgePhysmemNewRamBackedPMR(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMNEWRAMBACKEDPMR, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntCtxCreatepsDevMemServerContextIntRelease(void *pvData)
@@ -1009,7 +1009,7 @@ static PVRSRV_ERROR _DevmemIntCtxCreatepsDevMemServerContextIntRelease(void *pvD
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntCtxCreate(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psDevmemIntCtxCreateIN_UI8,
 			       IMG_UINT8 * psDevmemIntCtxCreateOUT_UI8,
@@ -1108,10 +1108,10 @@ PVRSRVBridgeDevmemIntCtxCreate(IMG_UINT32 ui32DispatchTableEntry,
 
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTCTXCREATE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntCtxDestroy(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psDevmemIntCtxDestroyIN_UI8,
 				IMG_UINT8 * psDevmemIntCtxDestroyOUT_UI8,
@@ -1149,7 +1149,7 @@ PVRSRVBridgeDevmemIntCtxDestroy(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntCtxDestroy_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTCTXDESTROY, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntHeapCreatepsDevmemHeapPtrIntRelease(void *pvData)
@@ -1159,7 +1159,7 @@ static PVRSRV_ERROR _DevmemIntHeapCreatepsDevmemHeapPtrIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntHeapCreate(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psDevmemIntHeapCreateIN_UI8,
 				IMG_UINT8 * psDevmemIntHeapCreateOUT_UI8,
@@ -1246,10 +1246,10 @@ PVRSRVBridgeDevmemIntHeapCreate(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTHEAPCREATE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntHeapDestroy(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psDevmemIntHeapDestroyIN_UI8,
 				 IMG_UINT8 * psDevmemIntHeapDestroyOUT_UI8,
@@ -1285,7 +1285,7 @@ PVRSRVBridgeDevmemIntHeapDestroy(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntHeapDestroy_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTHEAPDESTROY, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntMapPMRpsMappingIntRelease(void *pvData)
@@ -1295,7 +1295,7 @@ static PVRSRV_ERROR _DevmemIntMapPMRpsMappingIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntMapPMR(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psDevmemIntMapPMRIN_UI8,
 			    IMG_UINT8 * psDevmemIntMapPMROUT_UI8, CONNECTION_DATA * psConnection)
@@ -1418,10 +1418,10 @@ PVRSRVBridgeDevmemIntMapPMR(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTMAPPMR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnmapPMR(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psDevmemIntUnmapPMRIN_UI8,
 			      IMG_UINT8 * psDevmemIntUnmapPMROUT_UI8,
@@ -1454,7 +1454,7 @@ PVRSRVBridgeDevmemIntUnmapPMR(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntUnmapPMR_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNMAPPMR, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntReserveRangepsReservationIntRelease(void *pvData)
@@ -1464,7 +1464,7 @@ static PVRSRV_ERROR _DevmemIntReserveRangepsReservationIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntReserveRange(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psDevmemIntReserveRangeIN_UI8,
 				  IMG_UINT8 * psDevmemIntReserveRangeOUT_UI8,
@@ -1550,7 +1550,7 @@ PVRSRVBridgeDevmemIntReserveRange(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTRESERVERANGE, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntReserveRangeAndMapPMRpsMappingIntRelease(void *pvData)
@@ -1560,7 +1560,7 @@ static PVRSRV_ERROR _DevmemIntReserveRangeAndMapPMRpsMappingIntRelease(void *pvD
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntReserveRangeAndMapPMR(IMG_UINT32 ui32DispatchTableEntry,
 					   IMG_UINT8 * psDevmemIntReserveRangeAndMapPMRIN_UI8,
 					   IMG_UINT8 * psDevmemIntReserveRangeAndMapPMROUT_UI8,
@@ -1668,10 +1668,10 @@ PVRSRVBridgeDevmemIntReserveRangeAndMapPMR(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTRESERVERANGEANDMAPPMR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnreserveRangeAndUnmapPMR(IMG_UINT32 ui32DispatchTableEntry,
 					       IMG_UINT8 *
 					       psDevmemIntUnreserveRangeAndUnmapPMRIN_UI8,
@@ -1713,10 +1713,10 @@ PVRSRVBridgeDevmemIntUnreserveRangeAndUnmapPMR(IMG_UINT32 ui32DispatchTableEntry
 
 DevmemIntUnreserveRangeAndUnmapPMR_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNRESERVERANGEANDUNMAPPMR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnreserveRange(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psDevmemIntUnreserveRangeIN_UI8,
 				    IMG_UINT8 * psDevmemIntUnreserveRangeOUT_UI8,
@@ -1754,7 +1754,7 @@ PVRSRVBridgeDevmemIntUnreserveRange(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntUnreserveRange_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNRESERVERANGE, eError);
 }
 
 static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
@@ -1762,7 +1762,7 @@ static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 	      "PMR_MAX_SUPPORTED_4K_PAGE_COUNT must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeChangeSparseMem(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psChangeSparseMemIN_UI8,
 			    IMG_UINT8 * psChangeSparseMemOUT_UI8, CONNECTION_DATA * psConnection)
@@ -1946,10 +1946,10 @@ PVRSRVBridgeChangeSparseMem(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CHANGESPARSEMEM, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIsVDevAddrValid(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psDevmemIsVDevAddrValidIN_UI8,
 				  IMG_UINT8 * psDevmemIsVDevAddrValidOUT_UI8,
@@ -1999,12 +1999,12 @@ PVRSRVBridgeDevmemIsVDevAddrValid(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMISVDEVADDRVALID, eError);
 }
 
 #if defined(RGX_FEATURE_FBCDC)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemInvalidateFBSCTable(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psDevmemInvalidateFBSCTableIN_UI8,
 				      IMG_UINT8 * psDevmemInvalidateFBSCTableOUT_UI8,
@@ -2054,14 +2054,14 @@ PVRSRVBridgeDevmemInvalidateFBSCTable(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINVALIDATEFBSCTABLE, eError);
 }
 
 #else
 #define PVRSRVBridgeDevmemInvalidateFBSCTable NULL
 #endif
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHeapCfgHeapConfigCount(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psHeapCfgHeapConfigCountIN_UI8,
 				   IMG_UINT8 * psHeapCfgHeapConfigCountOUT_UI8,
@@ -2080,10 +2080,10 @@ PVRSRVBridgeHeapCfgHeapConfigCount(IMG_UINT32 ui32DispatchTableEntry,
 	    HeapCfgHeapConfigCount(psConnection, OSGetDevNode(psConnection),
 				   &psHeapCfgHeapConfigCountOUT->ui32NumHeapConfigs);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HEAPCFGHEAPCONFIGCOUNT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHeapCfgHeapCount(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psHeapCfgHeapCountIN_UI8,
 			     IMG_UINT8 * psHeapCfgHeapCountOUT_UI8, CONNECTION_DATA * psConnection)
@@ -2098,13 +2098,13 @@ PVRSRVBridgeHeapCfgHeapCount(IMG_UINT32 ui32DispatchTableEntry,
 			     psHeapCfgHeapCountIN->ui32HeapConfigIndex,
 			     &psHeapCfgHeapCountOUT->ui32NumHeaps);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HEAPCFGHEAPCOUNT, eError);
 }
 
 static_assert(DEVMEM_HEAPNAME_MAXLENGTH <= IMG_UINT32_MAX,
 	      "DEVMEM_HEAPNAME_MAXLENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHeapCfgHeapConfigName(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psHeapCfgHeapConfigNameIN_UI8,
 				  IMG_UINT8 * psHeapCfgHeapConfigNameOUT_UI8,
@@ -2220,13 +2220,13 @@ PVRSRVBridgeHeapCfgHeapConfigName(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HEAPCFGHEAPCONFIGNAME, eError);
 }
 
 static_assert(DEVMEM_HEAPNAME_MAXLENGTH <= IMG_UINT32_MAX,
 	      "DEVMEM_HEAPNAME_MAXLENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHeapCfgHeapDetails(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psHeapCfgHeapDetailsIN_UI8,
 			       IMG_UINT8 * psHeapCfgHeapDetailsOUT_UI8,
@@ -2342,10 +2342,10 @@ PVRSRVBridgeHeapCfgHeapDetails(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HEAPCFGHEAPDETAILS, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntRegisterPFNotifyKM(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psDevmemIntRegisterPFNotifyKMIN_UI8,
 					IMG_UINT8 * psDevmemIntRegisterPFNotifyKMOUT_UI8,
@@ -2394,13 +2394,13 @@ PVRSRVBridgeDevmemIntRegisterPFNotifyKM(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTREGISTERPFNOTIFYKM, eError);
 }
 
 static_assert(PVRSRV_PHYS_HEAP_LAST <= IMG_UINT32_MAX,
 	      "PVRSRV_PHYS_HEAP_LAST must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysHeapGetMemInfo(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psPhysHeapGetMemInfoIN_UI8,
 			       IMG_UINT8 * psPhysHeapGetMemInfoOUT_UI8,
@@ -2538,10 +2538,10 @@ PVRSRVBridgePhysHeapGetMemInfo(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSHEAPGETMEMINFO, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeGetDefaultPhysicalHeap(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psGetDefaultPhysicalHeapIN_UI8,
 				   IMG_UINT8 * psGetDefaultPhysicalHeapOUT_UI8,
@@ -2560,10 +2560,10 @@ PVRSRVBridgeGetDefaultPhysicalHeap(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVGetDefaultPhysicalHeapKM(psConnection, OSGetDevNode(psConnection),
 					   &psGetDefaultPhysicalHeapOUT->eHeap);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_GETDEFAULTPHYSICALHEAP, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemGetFaultAddress(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psDevmemGetFaultAddressIN_UI8,
 				  IMG_UINT8 * psDevmemGetFaultAddressOUT_UI8,
@@ -2613,12 +2613,12 @@ PVRSRVBridgeDevmemGetFaultAddress(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMGETFAULTADDRESS, eError);
 }
 
 #if defined(PVRSRV_ENABLE_PROCESS_STATS)
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVStatsUpdateOOMStat(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psPVRSRVStatsUpdateOOMStatIN_UI8,
 				     IMG_UINT8 * psPVRSRVStatsUpdateOOMStatOUT_UI8,
@@ -2636,7 +2636,7 @@ PVRSRVBridgePVRSRVStatsUpdateOOMStat(IMG_UINT32 ui32DispatchTableEntry,
 				     psPVRSRVStatsUpdateOOMStatIN->ui32ui32StatType,
 				     psPVRSRVStatsUpdateOOMStatIN->ui32pid);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVSTATSUPDATEOOMSTAT, eError);
 }
 
 #else
@@ -2650,7 +2650,7 @@ static PVRSRV_ERROR _DevmemXIntReserveRangepsReservationIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemXIntReserveRange(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psDevmemXIntReserveRangeIN_UI8,
 				   IMG_UINT8 * psDevmemXIntReserveRangeOUT_UI8,
@@ -2736,10 +2736,10 @@ PVRSRVBridgeDevmemXIntReserveRange(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMXINTRESERVERANGE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemXIntUnreserveRange(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psDevmemXIntUnreserveRangeIN_UI8,
 				     IMG_UINT8 * psDevmemXIntUnreserveRangeOUT_UI8,
@@ -2777,10 +2777,10 @@ PVRSRVBridgeDevmemXIntUnreserveRange(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemXIntUnreserveRange_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMXINTUNRESERVERANGE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemXIntMapPages(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psDevmemXIntMapPagesIN_UI8,
 			       IMG_UINT8 * psDevmemXIntMapPagesOUT_UI8,
@@ -2855,10 +2855,10 @@ PVRSRVBridgeDevmemXIntMapPages(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMXINTMAPPAGES, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemXIntUnmapPages(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psDevmemXIntUnmapPagesIN_UI8,
 				 IMG_UINT8 * psDevmemXIntUnmapPagesOUT_UI8,
@@ -2911,10 +2911,10 @@ PVRSRVBridgeDevmemXIntUnmapPages(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMXINTUNMAPPAGES, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemXIntMapVRangeToBackingPage(IMG_UINT32 ui32DispatchTableEntry,
 					     IMG_UINT8 * psDevmemXIntMapVRangeToBackingPageIN_UI8,
 					     IMG_UINT8 * psDevmemXIntMapVRangeToBackingPageOUT_UI8,
@@ -2969,7 +2969,7 @@ PVRSRVBridgeDevmemXIntMapVRangeToBackingPage(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMXINTMAPVRANGETOBACKINGPAGE, eError);
 }
 
 static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
@@ -2977,7 +2977,7 @@ static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 static_assert(PMR_MAX_SUPPORTED_4K_PAGE_COUNT <= IMG_UINT32_MAX,
 	      "PMR_MAX_SUPPORTED_4K_PAGE_COUNT must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeChangeSparseMem2(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psChangeSparseMem2IN_UI8,
 			     IMG_UINT8 * psChangeSparseMem2OUT_UI8, CONNECTION_DATA * psConnection)
@@ -3181,7 +3181,7 @@ PVRSRVBridgeChangeSparseMem2(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CHANGESPARSEMEM2, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntReserveRange2psReservationIntRelease(void *pvData)
@@ -3191,7 +3191,7 @@ static PVRSRV_ERROR _DevmemIntReserveRange2psReservationIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntReserveRange2(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psDevmemIntReserveRange2IN_UI8,
 				   IMG_UINT8 * psDevmemIntReserveRange2OUT_UI8,
@@ -3278,10 +3278,10 @@ PVRSRVBridgeDevmemIntReserveRange2(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTRESERVERANGE2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnreserveRange2(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psDevmemIntUnreserveRange2IN_UI8,
 				     IMG_UINT8 * psDevmemIntUnreserveRange2OUT_UI8,
@@ -3319,10 +3319,10 @@ PVRSRVBridgeDevmemIntUnreserveRange2(IMG_UINT32 ui32DispatchTableEntry,
 
 DevmemIntUnreserveRange2_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNRESERVERANGE2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntMapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psDevmemIntMapPMR2IN_UI8,
 			     IMG_UINT8 * psDevmemIntMapPMR2OUT_UI8, CONNECTION_DATA * psConnection)
@@ -3411,10 +3411,10 @@ PVRSRVBridgeDevmemIntMapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTMAPPMR2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnmapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psDevmemIntUnmapPMR2IN_UI8,
 			       IMG_UINT8 * psDevmemIntUnmapPMR2OUT_UI8,
@@ -3463,7 +3463,7 @@ PVRSRVBridgeDevmemIntUnmapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNMAPPMR2, eError);
 }
 
 static PVRSRV_ERROR _DevmemIntReserveRangeAndMapPMR2psReservationIntRelease(void *pvData)
@@ -3473,7 +3473,7 @@ static PVRSRV_ERROR _DevmemIntReserveRangeAndMapPMR2psReservationIntRelease(void
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntReserveRangeAndMapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 					    IMG_UINT8 * psDevmemIntReserveRangeAndMapPMR2IN_UI8,
 					    IMG_UINT8 * psDevmemIntReserveRangeAndMapPMR2OUT_UI8,
@@ -3582,10 +3582,10 @@ PVRSRVBridgeDevmemIntReserveRangeAndMapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTRESERVERANGEANDMAPPMR2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntUnreserveRangeAndUnmapPMR2(IMG_UINT32 ui32DispatchTableEntry,
 						IMG_UINT8 *
 						psDevmemIntUnreserveRangeAndUnmapPMR2IN_UI8,
@@ -3628,7 +3628,7 @@ PVRSRVBridgeDevmemIntUnreserveRangeAndUnmapPMR2(IMG_UINT32 ui32DispatchTableEntr
 
 DevmemIntUnreserveRangeAndUnmapPMR2_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTUNRESERVERANGEANDUNMAPPMR2, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/mmextmem_bridge/server_mmextmem_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/mmextmem_bridge/server_mmextmem_bridge.c
index 538d04c..9d018ff 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/mmextmem_bridge/server_mmextmem_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/mmextmem_bridge/server_mmextmem_bridge.c
@@ -76,7 +76,7 @@ static PVRSRV_ERROR _PhysmemWrapExtMempsPMRPtrIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePhysmemWrapExtMem(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psPhysmemWrapExtMemIN_UI8,
 			      IMG_UINT8 * psPhysmemWrapExtMemOUT_UI8,
@@ -131,7 +131,7 @@ PVRSRVBridgePhysmemWrapExtMem(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PHYSMEMWRAPEXTMEM, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/pdump_bridge/server_pdump_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/pdump_bridge/server_pdump_bridge.c
index 6b3baf6..8099578 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/pdump_bridge/server_pdump_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/pdump_bridge/server_pdump_bridge.c
@@ -70,7 +70,7 @@ static_assert(PVRSRV_PDUMP_MAX_FILENAME_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRV_PDUMP_MAX_FILENAME_SIZE must not be larger than IMG_UINT32_MAX");
 static_assert(4 <= IMG_UINT32_MAX, "4 must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpImageDescriptor(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psPDumpImageDescriptorIN_UI8,
 				 IMG_UINT8 * psPDumpImageDescriptorOUT_UI8,
@@ -241,13 +241,13 @@ PVRSRVBridgePDumpImageDescriptor(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPIMAGEDESCRIPTOR, eError);
 }
 
 static_assert(PVRSRV_PDUMP_MAX_COMMENT_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRV_PDUMP_MAX_COMMENT_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpComment(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psPVRSRVPDumpCommentIN_UI8,
 			       IMG_UINT8 * psPVRSRVPDumpCommentOUT_UI8,
@@ -349,10 +349,10 @@ PVRSRVBridgePVRSRVPDumpComment(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPCOMMENT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpSetFrame(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPVRSRVPDumpSetFrameIN_UI8,
 				IMG_UINT8 * psPVRSRVPDumpSetFrameOUT_UI8,
@@ -369,13 +369,13 @@ PVRSRVBridgePVRSRVPDumpSetFrame(IMG_UINT32 ui32DispatchTableEntry,
 	    PDumpSetFrameKM(psConnection, OSGetDevNode(psConnection),
 			    psPVRSRVPDumpSetFrameIN->ui32Frame);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPSETFRAME, eError);
 }
 
 static_assert(PVRSRV_PDUMP_MAX_FILENAME_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRV_PDUMP_MAX_FILENAME_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpDataDescriptor(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPDumpDataDescriptorIN_UI8,
 				IMG_UINT8 * psPDumpDataDescriptorOUT_UI8,
@@ -515,7 +515,7 @@ PVRSRVBridgePDumpDataDescriptor(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPDATADESCRIPTOR, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/pdumpctrl_bridge/server_pdumpctrl_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/pdumpctrl_bridge/server_pdumpctrl_bridge.c
index 2d5578c..1d25737 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/pdumpctrl_bridge/server_pdumpctrl_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/pdumpctrl_bridge/server_pdumpctrl_bridge.c
@@ -67,7 +67,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpGetState(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPVRSRVPDumpGetStateIN_UI8,
 				IMG_UINT8 * psPVRSRVPDumpGetStateOUT_UI8,
@@ -85,10 +85,10 @@ PVRSRVBridgePVRSRVPDumpGetState(IMG_UINT32 ui32DispatchTableEntry,
 
 	psPVRSRVPDumpGetStateOUT->eError = PDumpGetStateKM(&psPVRSRVPDumpGetStateOUT->ui64State);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPGETSTATE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpGetFrame(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psPVRSRVPDumpGetFrameIN_UI8,
 				IMG_UINT8 * psPVRSRVPDumpGetFrameOUT_UI8,
@@ -107,10 +107,10 @@ PVRSRVBridgePVRSRVPDumpGetFrame(IMG_UINT32 ui32DispatchTableEntry,
 	    PDumpGetFrameKM(psConnection, OSGetDevNode(psConnection),
 			    &psPVRSRVPDumpGetFrameOUT->ui32Frame);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPGETFRAME, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpSetDefaultCaptureParams(IMG_UINT32 ui32DispatchTableEntry,
 					       IMG_UINT8 *
 					       psPVRSRVPDumpSetDefaultCaptureParamsIN_UI8,
@@ -138,10 +138,10 @@ PVRSRVBridgePVRSRVPDumpSetDefaultCaptureParams(IMG_UINT32 ui32DispatchTableEntry
 					   psPVRSRVPDumpSetDefaultCaptureParamsIN->
 					   ui32AutoTermTimeout);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPSETDEFAULTCAPTUREPARAMS, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpIsLastCaptureFrame(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psPVRSRVPDumpIsLastCaptureFrameIN_UI8,
 					  IMG_UINT8 * psPVRSRVPDumpIsLastCaptureFrameOUT_UI8,
@@ -160,10 +160,10 @@ PVRSRVBridgePVRSRVPDumpIsLastCaptureFrame(IMG_UINT32 ui32DispatchTableEntry,
 	psPVRSRVPDumpIsLastCaptureFrameOUT->eError =
 	    PDumpIsLastCaptureFrameKM(&psPVRSRVPDumpIsLastCaptureFrameOUT->bpbIsLastCaptureFrame);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPISLASTCAPTUREFRAME, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePVRSRVPDumpForceCaptureStop(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psPVRSRVPDumpForceCaptureStopIN_UI8,
 					IMG_UINT8 * psPVRSRVPDumpForceCaptureStopOUT_UI8,
@@ -181,7 +181,7 @@ PVRSRVBridgePVRSRVPDumpForceCaptureStop(IMG_UINT32 ui32DispatchTableEntry,
 	psPVRSRVPDumpForceCaptureStopOUT->eError =
 	    PDumpForceCaptureStopKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PVRSRVPDUMPFORCECAPTURESTOP, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/pdumpmm_bridge/server_pdumpmm_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/pdumpmm_bridge/server_pdumpmm_bridge.c
index 38e1a66..8fc3b7d 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/pdumpmm_bridge/server_pdumpmm_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/pdumpmm_bridge/server_pdumpmm_bridge.c
@@ -68,7 +68,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpLoadMem(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psPMRPDumpLoadMemIN_UI8,
 			    IMG_UINT8 * psPMRPDumpLoadMemOUT_UI8, CONNECTION_DATA * psConnection)
@@ -117,10 +117,10 @@ PVRSRVBridgePMRPDumpLoadMem(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPLOADMEM, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpLoadMemValue32(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psPMRPDumpLoadMemValue32IN_UI8,
 				   IMG_UINT8 * psPMRPDumpLoadMemValue32OUT_UI8,
@@ -172,10 +172,10 @@ PVRSRVBridgePMRPDumpLoadMemValue32(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPLOADMEMVALUE32, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpLoadMemValue64(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psPMRPDumpLoadMemValue64IN_UI8,
 				   IMG_UINT8 * psPMRPDumpLoadMemValue64OUT_UI8,
@@ -227,13 +227,13 @@ PVRSRVBridgePMRPDumpLoadMemValue64(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPLOADMEMVALUE64, eError);
 }
 
 static_assert(PVRSRV_PDUMP_MAX_FILENAME_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRV_PDUMP_MAX_FILENAME_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpSaveToFile(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psPMRPDumpSaveToFileIN_UI8,
 			       IMG_UINT8 * psPMRPDumpSaveToFileOUT_UI8,
@@ -367,7 +367,7 @@ PVRSRVBridgePMRPDumpSaveToFile(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPSAVETOFILE, eError);
 }
 
 static_assert(PHYSMEM_PDUMP_MEMSPACE_MAX_LENGTH <= IMG_UINT32_MAX,
@@ -375,7 +375,7 @@ static_assert(PHYSMEM_PDUMP_MEMSPACE_MAX_LENGTH <= IMG_UINT32_MAX,
 static_assert(PHYSMEM_PDUMP_SYMNAME_MAX_LENGTH <= IMG_UINT32_MAX,
 	      "PHYSMEM_PDUMP_SYMNAME_MAX_LENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpSymbolicAddr(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psPMRPDumpSymbolicAddrIN_UI8,
 				 IMG_UINT8 * psPMRPDumpSymbolicAddrOUT_UI8,
@@ -553,10 +553,10 @@ PVRSRVBridgePMRPDumpSymbolicAddr(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPSYMBOLICADDR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpPol32(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psPMRPDumpPol32IN_UI8,
 			  IMG_UINT8 * psPMRPDumpPol32OUT_UI8, CONNECTION_DATA * psConnection)
@@ -606,10 +606,10 @@ PVRSRVBridgePMRPDumpPol32(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPPOL32, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpCheck32(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psPMRPDumpCheck32IN_UI8,
 			    IMG_UINT8 * psPMRPDumpCheck32OUT_UI8, CONNECTION_DATA * psConnection)
@@ -659,10 +659,10 @@ PVRSRVBridgePMRPDumpCheck32(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPCHECK32, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePMRPDumpCBP(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psPMRPDumpCBPIN_UI8,
 			IMG_UINT8 * psPMRPDumpCBPOUT_UI8, CONNECTION_DATA * psConnection)
@@ -711,13 +711,13 @@ PVRSRVBridgePMRPDumpCBP(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PMRPDUMPCBP, eError);
 }
 
 static_assert(PVRSRV_PDUMP_MAX_FILENAME_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRV_PDUMP_MAX_FILENAME_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDevmemIntPDumpSaveToFileVirtual(IMG_UINT32 ui32DispatchTableEntry,
 					    IMG_UINT8 * psDevmemIntPDumpSaveToFileVirtualIN_UI8,
 					    IMG_UINT8 * psDevmemIntPDumpSaveToFileVirtualOUT_UI8,
@@ -864,7 +864,7 @@ PVRSRVBridgeDevmemIntPDumpSaveToFileVirtual(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DEVMEMINTPDUMPSAVETOFILEVIRTUAL, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/pvrtl_bridge/server_pvrtl_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/pvrtl_bridge/server_pvrtl_bridge.c
index 9facf79..0693d57 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/pvrtl_bridge/server_pvrtl_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/pvrtl_bridge/server_pvrtl_bridge.c
@@ -75,7 +75,7 @@ static PVRSRV_ERROR _TLOpenStreampsSDIntRelease(void *pvData)
 static_assert(PRVSRVTL_MAX_STREAM_NAME_SIZE <= IMG_UINT32_MAX,
 	      "PRVSRVTL_MAX_STREAM_NAME_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLOpenStream(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psTLOpenStreamIN_UI8,
 			 IMG_UINT8 * psTLOpenStreamOUT_UI8, CONNECTION_DATA * psConnection)
@@ -238,10 +238,10 @@ PVRSRVBridgeTLOpenStream(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLOPENSTREAM, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLCloseStream(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psTLCloseStreamIN_UI8,
 			  IMG_UINT8 * psTLCloseStreamOUT_UI8, CONNECTION_DATA * psConnection)
@@ -273,10 +273,10 @@ PVRSRVBridgeTLCloseStream(IMG_UINT32 ui32DispatchTableEntry,
 
 TLCloseStream_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLCLOSESTREAM, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLAcquireData(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psTLAcquireDataIN_UI8,
 			  IMG_UINT8 * psTLAcquireDataOUT_UI8, CONNECTION_DATA * psConnection)
@@ -324,10 +324,10 @@ PVRSRVBridgeTLAcquireData(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLACQUIREDATA, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLReleaseData(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psTLReleaseDataIN_UI8,
 			  IMG_UINT8 * psTLReleaseDataOUT_UI8, CONNECTION_DATA * psConnection)
@@ -375,7 +375,7 @@ PVRSRVBridgeTLReleaseData(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLRELEASEDATA, eError);
 }
 
 static_assert(PRVSRVTL_MAX_STREAM_NAME_SIZE <= IMG_UINT32_MAX,
@@ -383,7 +383,7 @@ static_assert(PRVSRVTL_MAX_STREAM_NAME_SIZE <= IMG_UINT32_MAX,
 static_assert(PVRSRVTL_MAX_DISCOVERABLE_STREAMS_BUFFER <= IMG_UINT32_MAX,
 	      "PVRSRVTL_MAX_DISCOVERABLE_STREAMS_BUFFER must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLDiscoverStreams(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psTLDiscoverStreamsIN_UI8,
 			      IMG_UINT8 * psTLDiscoverStreamsOUT_UI8,
@@ -513,10 +513,10 @@ PVRSRVBridgeTLDiscoverStreams(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLDISCOVERSTREAMS, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLReserveStream(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psTLReserveStreamIN_UI8,
 			    IMG_UINT8 * psTLReserveStreamOUT_UI8, CONNECTION_DATA * psConnection)
@@ -566,10 +566,10 @@ PVRSRVBridgeTLReserveStream(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLRESERVESTREAM, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLCommitStream(IMG_UINT32 ui32DispatchTableEntry,
 			   IMG_UINT8 * psTLCommitStreamIN_UI8,
 			   IMG_UINT8 * psTLCommitStreamOUT_UI8, CONNECTION_DATA * psConnection)
@@ -615,13 +615,13 @@ PVRSRVBridgeTLCommitStream(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLCOMMITSTREAM, eError);
 }
 
 static_assert(PVRSRVTL_MAX_PACKET_SIZE <= IMG_UINT32_MAX,
 	      "PVRSRVTL_MAX_PACKET_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeTLWriteData(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psTLWriteDataIN_UI8,
 			IMG_UINT8 * psTLWriteDataOUT_UI8, CONNECTION_DATA * psConnection)
@@ -745,7 +745,7 @@ PVRSRVBridgeTLWriteData(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_TLWRITEDATA, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxcmp_bridge/server_rgxcmp_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxcmp_bridge/server_rgxcmp_bridge.c
index a8d284e..111268c 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxcmp_bridge/server_rgxcmp_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxcmp_bridge/server_rgxcmp_bridge.c
@@ -79,7 +79,7 @@ static_assert(RGXFWIF_RF_CMD_SIZE <= IMG_UINT32_MAX,
 static_assert(RGXFWIF_STATIC_COMPUTECONTEXT_SIZE <= IMG_UINT32_MAX,
 	      "RGXFWIF_STATIC_COMPUTECONTEXT_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateComputeContext(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psRGXCreateComputeContextIN_UI8,
 				    IMG_UINT8 * psRGXCreateComputeContextOUT_UI8,
@@ -306,10 +306,10 @@ PVRSRVBridgeRGXCreateComputeContext(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATECOMPUTECONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyComputeContext(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRGXDestroyComputeContextIN_UI8,
 				     IMG_UINT8 * psRGXDestroyComputeContextOUT_UI8,
@@ -361,10 +361,10 @@ PVRSRVBridgeRGXDestroyComputeContext(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyComputeContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYCOMPUTECONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFlushComputeData(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRGXFlushComputeDataIN_UI8,
 				IMG_UINT8 * psRGXFlushComputeDataOUT_UI8,
@@ -428,10 +428,10 @@ PVRSRVBridgeRGXFlushComputeData(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFLUSHCOMPUTEDATA, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetComputeContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psRGXSetComputeContextPriorityIN_UI8,
 					 IMG_UINT8 * psRGXSetComputeContextPriorityOUT_UI8,
@@ -498,10 +498,10 @@ PVRSRVBridgeRGXSetComputeContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETCOMPUTECONTEXTPRIORITY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXNotifyComputeWriteOffsetUpdate(IMG_UINT32 ui32DispatchTableEntry,
 					      IMG_UINT8 * psRGXNotifyComputeWriteOffsetUpdateIN_UI8,
 					      IMG_UINT8 *
@@ -568,7 +568,7 @@ PVRSRVBridgeRGXNotifyComputeWriteOffsetUpdate(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXNOTIFYCOMPUTEWRITEOFFSETUPDATE, eError);
 }
 
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
@@ -580,7 +580,7 @@ static_assert(RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE <= IMG_UINT32_MAX,
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
 	      "PVRSRV_MAX_SYNCS must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXKickCDM2(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psRGXKickCDM2IN_UI8,
 			IMG_UINT8 * psRGXKickCDM2OUT_UI8, CONNECTION_DATA * psConnection)
@@ -972,10 +972,10 @@ PVRSRVBridgeRGXKickCDM2(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXKICKCDM2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetComputeContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psRGXSetComputeContextPropertyIN_UI8,
 					 IMG_UINT8 * psRGXSetComputeContextPropertyOUT_UI8,
@@ -1043,10 +1043,10 @@ PVRSRVBridgeRGXSetComputeContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETCOMPUTECONTEXTPROPERTY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXGetLastDeviceError(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXGetLastDeviceErrorIN_UI8,
 				  IMG_UINT8 * psRGXGetLastDeviceErrorOUT_UI8,
@@ -1081,13 +1081,13 @@ PVRSRVBridgeRGXGetLastDeviceError(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXGetLastDeviceError_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXGETLASTDEVICEERROR, eError);
 }
 
 static_assert(RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE <= IMG_UINT32_MAX,
 	      "RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXKickTimestampQuery(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXKickTimestampQueryIN_UI8,
 				  IMG_UINT8 * psRGXKickTimestampQueryOUT_UI8,
@@ -1234,7 +1234,7 @@ PVRSRVBridgeRGXKickTimestampQuery(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXKICKTIMESTAMPQUERY, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxfwdbg_bridge/server_rgxfwdbg_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxfwdbg_bridge/server_rgxfwdbg_bridge.c
index 597949b..5d7d921 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxfwdbg_bridge/server_rgxfwdbg_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxfwdbg_bridge/server_rgxfwdbg_bridge.c
@@ -68,7 +68,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetFWLog(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXFWDebugSetFWLogIN_UI8,
 			       IMG_UINT8 * psRGXFWDebugSetFWLogOUT_UI8,
@@ -84,10 +84,10 @@ PVRSRVBridgeRGXFWDebugSetFWLog(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXFWDebugSetFWLogKM(psConnection, OSGetDevNode(psConnection),
 				       psRGXFWDebugSetFWLogIN->ui32RGXFWLogType);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETFWLOG, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugDumpFreelistPageList(IMG_UINT32 ui32DispatchTableEntry,
 					   IMG_UINT8 * psRGXFWDebugDumpFreelistPageListIN_UI8,
 					   IMG_UINT8 * psRGXFWDebugDumpFreelistPageListOUT_UI8,
@@ -105,10 +105,10 @@ PVRSRVBridgeRGXFWDebugDumpFreelistPageList(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXFWDebugDumpFreelistPageListOUT->eError =
 	    PVRSRVRGXFWDebugDumpFreelistPageListKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGDUMPFREELISTPAGELIST, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSuspendDevice(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psRGXFWDebugSuspendDeviceIN_UI8,
 				    IMG_UINT8 * psRGXFWDebugSuspendDeviceOUT_UI8,
@@ -126,10 +126,10 @@ PVRSRVBridgeRGXFWDebugSuspendDevice(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXFWDebugSuspendDeviceOUT->eError =
 	    PVRSRVRGXFWDebugSuspendDeviceKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSUSPENDDEVICE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugResumeDevice(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXFWDebugResumeDeviceIN_UI8,
 				   IMG_UINT8 * psRGXFWDebugResumeDeviceOUT_UI8,
@@ -147,10 +147,10 @@ PVRSRVBridgeRGXFWDebugResumeDevice(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXFWDebugResumeDeviceOUT->eError =
 	    PVRSRVRGXFWDebugResumeDeviceKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGRESUMEDEVICE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetVzConnectionCooldownPeriodInSec(IMG_UINT32 ui32DispatchTableEntry,
 							 IMG_UINT8 *
 							 psRGXFWDebugSetVzConnectionCooldownPeriodInSecIN_UI8,
@@ -173,10 +173,10 @@ PVRSRVBridgeRGXFWDebugSetVzConnectionCooldownPeriodInSec(IMG_UINT32 ui32Dispatch
 								 psRGXFWDebugSetVzConnectionCooldownPeriodInSecIN->
 								 ui32VzConnectionCooldownPeriodInSec);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETVZCONNECTIONCOOLDOWNPERIODINSEC, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetHCSDeadline(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRGXFWDebugSetHCSDeadlineIN_UI8,
 				     IMG_UINT8 * psRGXFWDebugSetHCSDeadlineOUT_UI8,
@@ -193,10 +193,10 @@ PVRSRVBridgeRGXFWDebugSetHCSDeadline(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXFWDebugSetHCSDeadlineKM(psConnection, OSGetDevNode(psConnection),
 					     psRGXFWDebugSetHCSDeadlineIN->ui32RGXHCSDeadline);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETHCSDEADLINE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetDriverPriority(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psRGXFWDebugSetDriverPriorityIN_UI8,
 					IMG_UINT8 * psRGXFWDebugSetDriverPriorityOUT_UI8,
@@ -214,10 +214,10 @@ PVRSRVBridgeRGXFWDebugSetDriverPriority(IMG_UINT32 ui32DispatchTableEntry,
 						psRGXFWDebugSetDriverPriorityIN->ui32DriverID,
 						psRGXFWDebugSetDriverPriorityIN->ui32Priority);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETDRIVERPRIORITY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetDriverTimeSlice(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psRGXFWDebugSetDriverTimeSliceIN_UI8,
 					 IMG_UINT8 * psRGXFWDebugSetDriverTimeSliceOUT_UI8,
@@ -235,10 +235,10 @@ PVRSRVBridgeRGXFWDebugSetDriverTimeSlice(IMG_UINT32 ui32DispatchTableEntry,
 						 psRGXFWDebugSetDriverTimeSliceIN->ui32DriverID,
 						 psRGXFWDebugSetDriverTimeSliceIN->ui32TimeSlice);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETDRIVERTIMESLICE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetDriverTimeSliceInterval(IMG_UINT32 ui32DispatchTableEntry,
 						 IMG_UINT8 *
 						 psRGXFWDebugSetDriverTimeSliceIntervalIN_UI8,
@@ -260,10 +260,10 @@ PVRSRVBridgeRGXFWDebugSetDriverTimeSliceInterval(IMG_UINT32 ui32DispatchTableEnt
 							 psRGXFWDebugSetDriverTimeSliceIntervalIN->
 							 ui32TimeSliceInterval);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETDRIVERTIMESLICEINTERVAL, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetDriverIsolationGroup(IMG_UINT32 ui32DispatchTableEntry,
 					      IMG_UINT8 * psRGXFWDebugSetDriverIsolationGroupIN_UI8,
 					      IMG_UINT8 *
@@ -285,10 +285,10 @@ PVRSRVBridgeRGXFWDebugSetDriverIsolationGroup(IMG_UINT32 ui32DispatchTableEntry,
 						      psRGXFWDebugSetDriverIsolationGroupIN->
 						      ui32IsolationGroup);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETDRIVERISOLATIONGROUP, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugSetOSNewOnlineState(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psRGXFWDebugSetOSNewOnlineStateIN_UI8,
 					  IMG_UINT8 * psRGXFWDebugSetOSNewOnlineStateOUT_UI8,
@@ -307,10 +307,10 @@ PVRSRVBridgeRGXFWDebugSetOSNewOnlineState(IMG_UINT32 ui32DispatchTableEntry,
 						  psRGXFWDebugSetOSNewOnlineStateIN->
 						  ui32OSNewState);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGSETOSNEWONLINESTATE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugMapGuestHeap(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXFWDebugMapGuestHeapIN_UI8,
 				   IMG_UINT8 * psRGXFWDebugMapGuestHeapOUT_UI8,
@@ -328,10 +328,10 @@ PVRSRVBridgeRGXFWDebugMapGuestHeap(IMG_UINT32 ui32DispatchTableEntry,
 					   psRGXFWDebugMapGuestHeapIN->ui32DriverID,
 					   psRGXFWDebugMapGuestHeapIN->ui64ui64GuestHeapBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGMAPGUESTHEAP, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugPHRConfigure(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXFWDebugPHRConfigureIN_UI8,
 				   IMG_UINT8 * psRGXFWDebugPHRConfigureOUT_UI8,
@@ -348,10 +348,10 @@ PVRSRVBridgeRGXFWDebugPHRConfigure(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXFWDebugPHRConfigureKM(psConnection, OSGetDevNode(psConnection),
 					   psRGXFWDebugPHRConfigureIN->ui32ui32PHRMode);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGPHRCONFIGURE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugWdgConfigure(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXFWDebugWdgConfigureIN_UI8,
 				   IMG_UINT8 * psRGXFWDebugWdgConfigureOUT_UI8,
@@ -368,10 +368,10 @@ PVRSRVBridgeRGXFWDebugWdgConfigure(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXFWDebugWdgConfigureKM(psConnection, OSGetDevNode(psConnection),
 					   psRGXFWDebugWdgConfigureIN->ui32ui32WdgPeriodUs);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGWDGCONFIGURE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCurrentTime(IMG_UINT32 ui32DispatchTableEntry,
 			   IMG_UINT8 * psRGXCurrentTimeIN_UI8,
 			   IMG_UINT8 * psRGXCurrentTimeOUT_UI8, CONNECTION_DATA * psConnection)
@@ -387,12 +387,12 @@ PVRSRVBridgeRGXCurrentTime(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXCurrentTime(psConnection, OSGetDevNode(psConnection),
 				 &psRGXCurrentTimeOUT->ui64Time);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCURRENTTIME, eError);
 }
 
 #if defined(SUPPORT_VALIDATION)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXFWDebugInjectFault(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXFWDebugInjectFaultIN_UI8,
 				  IMG_UINT8 * psRGXFWDebugInjectFaultOUT_UI8,
@@ -410,7 +410,7 @@ PVRSRVBridgeRGXFWDebugInjectFault(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXFWDebugInjectFaultOUT->eError =
 	    PVRSRVRGXFWDebugInjectFaultKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXFWDEBUGINJECTFAULT, eError);
 }
 
 #else
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxhwperf_bridge/server_rgxhwperf_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxhwperf_bridge/server_rgxhwperf_bridge.c
index bae7d88..95433cb 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxhwperf_bridge/server_rgxhwperf_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxhwperf_bridge/server_rgxhwperf_bridge.c
@@ -66,7 +66,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCtrlHWPerf(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psRGXCtrlHWPerfIN_UI8,
 			  IMG_UINT8 * psRGXCtrlHWPerfOUT_UI8, CONNECTION_DATA * psConnection)
@@ -81,13 +81,13 @@ PVRSRVBridgeRGXCtrlHWPerf(IMG_UINT32 ui32DispatchTableEntry,
 				  psRGXCtrlHWPerfIN->ui32StreamId,
 				  psRGXCtrlHWPerfIN->bToggle, psRGXCtrlHWPerfIN->ui64Mask);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCTRLHWPERF, eError);
 }
 
 static_assert(RGXFWIF_HWPERF_CTRL_BLKS_MAX + 3 <= IMG_UINT32_MAX,
 	      "RGXFWIF_HWPERF_CTRL_BLKS_MAX+3 must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXConfigureHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRGXConfigureHWPerfBlocksIN_UI8,
 				     IMG_UINT8 * psRGXConfigureHWPerfBlocksOUT_UI8,
@@ -193,10 +193,10 @@ PVRSRVBridgeRGXConfigureHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCONFIGUREHWPERFBLOCKS, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXGetHWPerfBvncFeatureFlags(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psRGXGetHWPerfBvncFeatureFlagsIN_UI8,
 					 IMG_UINT8 * psRGXGetHWPerfBvncFeatureFlagsOUT_UI8,
@@ -215,13 +215,13 @@ PVRSRVBridgeRGXGetHWPerfBvncFeatureFlags(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXGetHWPerfBvncFeatureFlagsKM(psConnection, OSGetDevNode(psConnection),
 						 &psRGXGetHWPerfBvncFeatureFlagsOUT->sBVNC);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXGETHWPERFBVNCFEATUREFLAGS, eError);
 }
 
 static_assert(RGXFWIF_HWPERF_CTRL_BLKS_MAX <= IMG_UINT32_MAX,
 	      "RGXFWIF_HWPERF_CTRL_BLKS_MAX must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXControlHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXControlHWPerfBlocksIN_UI8,
 				   IMG_UINT8 * psRGXControlHWPerfBlocksOUT_UI8,
@@ -323,12 +323,12 @@ PVRSRVBridgeRGXControlHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCONTROLHWPERFBLOCKS, eError);
 }
 
 static_assert(1 <= IMG_UINT32_MAX, "1 must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXGetConfiguredHWPerfCounters(IMG_UINT32 ui32DispatchTableEntry,
 					   IMG_UINT8 * psRGXGetConfiguredHWPerfCountersIN_UI8,
 					   IMG_UINT8 * psRGXGetConfiguredHWPerfCountersOUT_UI8,
@@ -435,10 +435,13 @@ PVRSRVBridgeRGXGetConfiguredHWPerfCounters(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXGETCONFIGUREDHWPERFCOUNTERS, eError);
 }
 
-static IMG_INT
+static_assert(RGXFWIF_HWPERF_CTRL_BLKS_MAX <= IMG_UINT32_MAX,
+	      "RGXFWIF_HWPERF_CTRL_BLKS_MAX must not be larger than IMG_UINT32_MAX");
+
+static size_t
 PVRSRVBridgeRGXGetEnabledHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psRGXGetEnabledHWPerfBlocksIN_UI8,
 				      IMG_UINT8 * psRGXGetEnabledHWPerfBlocksOUT_UI8,
@@ -461,6 +464,12 @@ PVRSRVBridgeRGXGetEnabledHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 	IMG_UINT64 ui64BufferSize =
 	    ((IMG_UINT64) psRGXGetEnabledHWPerfBlocksIN->ui32ArrayLen * sizeof(IMG_UINT32)) + 0;
 
+	if (psRGXGetEnabledHWPerfBlocksIN->ui32ArrayLen > RGXFWIF_HWPERF_CTRL_BLKS_MAX)
+	{
+		psRGXGetEnabledHWPerfBlocksOUT->eError = PVRSRV_ERROR_BRIDGE_ARRAY_SIZE_TOO_BIG;
+		goto RGXGetEnabledHWPerfBlocks_exit;
+	}
+
 	psRGXGetEnabledHWPerfBlocksOUT->pui32EnabledBlockIDs =
 	    psRGXGetEnabledHWPerfBlocksIN->pui32EnabledBlockIDs;
 
@@ -546,12 +555,12 @@ PVRSRVBridgeRGXGetEnabledHWPerfBlocks(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXGETENABLEDHWPERFBLOCKS, eError);
 }
 
 #if defined(PVRSRV_FORCE_HWPERF_TO_SCHED_CLK)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXGetHWPerfTimeStamp(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXGetHWPerfTimeStampIN_UI8,
 				  IMG_UINT8 * psRGXGetHWPerfTimeStampOUT_UI8,
@@ -570,7 +579,7 @@ PVRSRVBridgeRGXGetHWPerfTimeStamp(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXGetHWPerfTimeStampKM(psConnection, OSGetDevNode(psConnection),
 					  &psRGXGetHWPerfTimeStampOUT->ui64TimeStamp);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXGETHWPERFTIMESTAMP, eError);
 }
 
 #else
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxkicksync_bridge/server_rgxkicksync_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxkicksync_bridge/server_rgxkicksync_bridge.c
index 8d943cd..dfa3f9a 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxkicksync_bridge/server_rgxkicksync_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxkicksync_bridge/server_rgxkicksync_bridge.c
@@ -74,7 +74,7 @@ static PVRSRV_ERROR _RGXCreateKickSyncContextpsKickSyncContextIntRelease(void *p
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateKickSyncContext(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRGXCreateKickSyncContextIN_UI8,
 				     IMG_UINT8 * psRGXCreateKickSyncContextOUT_UI8,
@@ -161,10 +161,10 @@ PVRSRVBridgeRGXCreateKickSyncContext(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEKICKSYNCCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyKickSyncContext(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psRGXDestroyKickSyncContextIN_UI8,
 				      IMG_UINT8 * psRGXDestroyKickSyncContextOUT_UI8,
@@ -202,7 +202,7 @@ PVRSRVBridgeRGXDestroyKickSyncContext(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyKickSyncContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYKICKSYNCCONTEXT, eError);
 }
 
 static_assert(PVRSRV_MAX_DEV_VARS <= IMG_UINT32_MAX,
@@ -210,7 +210,7 @@ static_assert(PVRSRV_MAX_DEV_VARS <= IMG_UINT32_MAX,
 static_assert(PVRSRV_SYNC_NAME_LENGTH <= IMG_UINT32_MAX,
 	      "PVRSRV_SYNC_NAME_LENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXKickSync2(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psRGXKickSync2IN_UI8,
 			 IMG_UINT8 * psRGXKickSync2OUT_UI8, CONNECTION_DATA * psConnection)
@@ -462,10 +462,10 @@ PVRSRVBridgeRGXKickSync2(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXKICKSYNC2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetKickSyncContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psRGXSetKickSyncContextPropertyIN_UI8,
 					  IMG_UINT8 * psRGXSetKickSyncContextPropertyOUT_UI8,
@@ -519,7 +519,7 @@ PVRSRVBridgeRGXSetKickSyncContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETKICKSYNCCONTEXTPROPERTY, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxpdump_bridge/server_rgxpdump_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxpdump_bridge/server_rgxpdump_bridge.c
index 6a52346..a7366f0 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxpdump_bridge/server_rgxpdump_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxpdump_bridge/server_rgxpdump_bridge.c
@@ -65,7 +65,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpTraceBuffer(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psPDumpTraceBufferIN_UI8,
 			     IMG_UINT8 * psPDumpTraceBufferOUT_UI8, CONNECTION_DATA * psConnection)
@@ -79,10 +79,10 @@ PVRSRVBridgePDumpTraceBuffer(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVPDumpTraceBufferKM(psConnection, OSGetDevNode(psConnection),
 				     psPDumpTraceBufferIN->ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPTRACEBUFFER, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpSignatureBuffer(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psPDumpSignatureBufferIN_UI8,
 				 IMG_UINT8 * psPDumpSignatureBufferOUT_UI8,
@@ -99,12 +99,12 @@ PVRSRVBridgePDumpSignatureBuffer(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVPDumpSignatureBufferKM(psConnection, OSGetDevNode(psConnection),
 					 psPDumpSignatureBufferIN->ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPSIGNATUREBUFFER, eError);
 }
 
 #if defined(SUPPORT_VALIDATION)
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpComputeCRCSignatureCheck(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psPDumpComputeCRCSignatureCheckIN_UI8,
 					  IMG_UINT8 * psPDumpComputeCRCSignatureCheckOUT_UI8,
@@ -122,14 +122,14 @@ PVRSRVBridgePDumpComputeCRCSignatureCheck(IMG_UINT32 ui32DispatchTableEntry,
 						  psPDumpComputeCRCSignatureCheckIN->
 						  ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPCOMPUTECRCSIGNATURECHECK, eError);
 }
 
 #else
 #define PVRSRVBridgePDumpComputeCRCSignatureCheck NULL
 #endif
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpCRCSignatureCheck(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psPDumpCRCSignatureCheckIN_UI8,
 				   IMG_UINT8 * psPDumpCRCSignatureCheckOUT_UI8,
@@ -146,10 +146,10 @@ PVRSRVBridgePDumpCRCSignatureCheck(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVPDumpCRCSignatureCheckKM(psConnection, OSGetDevNode(psConnection),
 					   psPDumpCRCSignatureCheckIN->ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPCRCSIGNATURECHECK, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpValCheckPreCommand(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psPDumpValCheckPreCommandIN_UI8,
 				    IMG_UINT8 * psPDumpValCheckPreCommandOUT_UI8,
@@ -166,10 +166,10 @@ PVRSRVBridgePDumpValCheckPreCommand(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVPDumpValCheckPreCommandKM(psConnection, OSGetDevNode(psConnection),
 					    psPDumpValCheckPreCommandIN->ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPVALCHECKPRECOMMAND, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgePDumpValCheckPostCommand(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psPDumpValCheckPostCommandIN_UI8,
 				     IMG_UINT8 * psPDumpValCheckPostCommandOUT_UI8,
@@ -186,7 +186,7 @@ PVRSRVBridgePDumpValCheckPostCommand(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVPDumpValCheckPostCommandKM(psConnection, OSGetDevNode(psConnection),
 					     psPDumpValCheckPostCommandIN->ui32PDumpFlags);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_PDUMPVALCHECKPOSTCOMMAND, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxray_bridge/server_rgxray_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxray_bridge/server_rgxray_bridge.c
index c537779..996a4c6 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxray_bridge/server_rgxray_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxray_bridge/server_rgxray_bridge.c
@@ -75,7 +75,7 @@ static PVRSRV_ERROR _RGXCreateRayContextpsRayContextIntRelease(void *pvData)
 static_assert(RGXFWIF_STATIC_RAYCONTEXT_SIZE <= IMG_UINT32_MAX,
 	      "RGXFWIF_STATIC_RAYCONTEXT_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateRayContext(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRGXCreateRayContextIN_UI8,
 				IMG_UINT8 * psRGXCreateRayContextOUT_UI8,
@@ -252,10 +252,10 @@ PVRSRVBridgeRGXCreateRayContext(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATERAYCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyRayContext(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psRGXDestroyRayContextIN_UI8,
 				 IMG_UINT8 * psRGXDestroyRayContextOUT_UI8,
@@ -291,7 +291,7 @@ PVRSRVBridgeRGXDestroyRayContext(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyRayContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYRAYCONTEXT, eError);
 }
 
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
@@ -301,7 +301,7 @@ static_assert(PVRSRV_SYNC_NAME_LENGTH <= IMG_UINT32_MAX,
 static_assert(RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE <= IMG_UINT32_MAX,
 	      "RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXKickRDM(IMG_UINT32 ui32DispatchTableEntry,
 		       IMG_UINT8 * psRGXKickRDMIN_UI8,
 		       IMG_UINT8 * psRGXKickRDMOUT_UI8, CONNECTION_DATA * psConnection)
@@ -586,7 +586,7 @@ PVRSRVBridgeRGXKickRDM(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXKICKRDM, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxregconfig_bridge/server_rgxregconfig_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxregconfig_bridge/server_rgxregconfig_bridge.c
index 5484014..7802ff2 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxregconfig_bridge/server_rgxregconfig_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxregconfig_bridge/server_rgxregconfig_bridge.c
@@ -67,7 +67,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetRegConfigType(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRGXSetRegConfigTypeIN_UI8,
 				IMG_UINT8 * psRGXSetRegConfigTypeOUT_UI8,
@@ -84,10 +84,10 @@ PVRSRVBridgeRGXSetRegConfigType(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXSetRegConfigTypeKM(psConnection, OSGetDevNode(psConnection),
 					psRGXSetRegConfigTypeIN->ui8RegPowerIsland);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETREGCONFIGTYPE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXAddRegconfig(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psRGXAddRegconfigIN_UI8,
 			    IMG_UINT8 * psRGXAddRegconfigOUT_UI8, CONNECTION_DATA * psConnection)
@@ -103,10 +103,10 @@ PVRSRVBridgeRGXAddRegconfig(IMG_UINT32 ui32DispatchTableEntry,
 				    psRGXAddRegconfigIN->ui64RegValue,
 				    psRGXAddRegconfigIN->ui64RegMask);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXADDREGCONFIG, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXClearRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psRGXClearRegConfigIN_UI8,
 			      IMG_UINT8 * psRGXClearRegConfigOUT_UI8,
@@ -122,10 +122,10 @@ PVRSRVBridgeRGXClearRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXClearRegConfigOUT->eError =
 	    PVRSRVRGXClearRegConfigKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCLEARREGCONFIG, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXEnableRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXEnableRegConfigIN_UI8,
 			       IMG_UINT8 * psRGXEnableRegConfigOUT_UI8,
@@ -142,10 +142,10 @@ PVRSRVBridgeRGXEnableRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXEnableRegConfigOUT->eError =
 	    PVRSRVRGXEnableRegConfigKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXENABLEREGCONFIG, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDisableRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRGXDisableRegConfigIN_UI8,
 				IMG_UINT8 * psRGXDisableRegConfigOUT_UI8,
@@ -163,7 +163,7 @@ PVRSRVBridgeRGXDisableRegConfig(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXDisableRegConfigOUT->eError =
 	    PVRSRVRGXDisableRegConfigKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDISABLEREGCONFIG, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxta3d_bridge/common_rgxta3d_bridge.h b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxta3d_bridge/common_rgxta3d_bridge.h
index 82771d3..90e5e43 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxta3d_bridge/common_rgxta3d_bridge.h
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxta3d_bridge/common_rgxta3d_bridge.h
@@ -74,7 +74,8 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define PVRSRV_BRIDGE_RGXTA3D_RGXSETRENDERCONTEXTPROPERTY			PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+14
 #define PVRSRV_BRIDGE_RGXTA3D_RGXCREATEZSBUFFER2			PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+15
 #define PVRSRV_BRIDGE_RGXTA3D_RGXCREATEFREELIST2			PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+16
-#define PVRSRV_BRIDGE_RGXTA3D_CMD_LAST			(PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+16)
+#define PVRSRV_BRIDGE_RGXTA3D_RGXCREATEHWRTDATASET2			PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+17
+#define PVRSRV_BRIDGE_RGXTA3D_CMD_LAST			(PVRSRV_BRIDGE_RGXTA3D_CMD_FIRST+17)
 
 /*******************************************
             RGXCreateHWRTDataSet
@@ -447,4 +448,28 @@ typedef struct PVRSRV_BRIDGE_OUT_RGXCREATEFREELIST2_TAG
 	PVRSRV_ERROR eError;
 } __packed PVRSRV_BRIDGE_OUT_RGXCREATEFREELIST2;
 
+/*******************************************
+            RGXCreateHWRTDataSet2
+ *******************************************/
+
+/* Bridge in structure for RGXCreateHWRTDataSet2 */
+typedef struct PVRSRV_BRIDGE_IN_RGXCREATEHWRTDATASET2_TAG
+{
+	IMG_DEV_VIRTADDR sVHeapTableDevVAddr;
+	IMG_HANDLE hMListsReservation;
+	IMG_HANDLE hPMSecureStatesReservation;
+	IMG_HANDLE hPMStatesReservation;
+	IMG_DEV_VIRTADDR *psTailPtrsDevVAddr;
+	IMG_HANDLE *phKmHwRTDataSet;
+	IMG_HANDLE *phapsFreeLists;
+	IMG_UINT16 ui16MaxRTs;
+} __packed PVRSRV_BRIDGE_IN_RGXCREATEHWRTDATASET2;
+
+/* Bridge out structure for RGXCreateHWRTDataSet2 */
+typedef struct PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2_TAG
+{
+	IMG_HANDLE *phKmHwRTDataSet;
+	PVRSRV_ERROR eError;
+} __packed PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2;
+
 #endif /* COMMON_RGXTA3D_BRIDGE_H */
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxta3d_bridge/server_rgxta3d_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxta3d_bridge/server_rgxta3d_bridge.c
index 568303e..61de029 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxta3d_bridge/server_rgxta3d_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxta3d_bridge/server_rgxta3d_bridge.c
@@ -83,7 +83,7 @@ static_assert(RGXMKIF_NUM_GEOMDATAS <= IMG_UINT32_MAX,
 static_assert(RGXMKIF_NUM_RTDATAS <= IMG_UINT32_MAX,
 	      "RGXMKIF_NUM_RTDATAS must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateHWRTDataSet(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psRGXCreateHWRTDataSetIN_UI8,
 				 IMG_UINT8 * psRGXCreateHWRTDataSetOUT_UI8,
@@ -439,10 +439,10 @@ PVRSRVBridgeRGXCreateHWRTDataSet(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyHWRTDataSet(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXDestroyHWRTDataSetIN_UI8,
 				  IMG_UINT8 * psRGXDestroyHWRTDataSetOUT_UI8,
@@ -480,7 +480,7 @@ PVRSRVBridgeRGXDestroyHWRTDataSet(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyHWRTDataSet_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYHWRTDATASET, eError);
 }
 
 static PVRSRV_ERROR _RGXCreateZSBufferpssZSBufferKMIntRelease(void *pvData)
@@ -490,7 +490,7 @@ static PVRSRV_ERROR _RGXCreateZSBufferpssZSBufferKMIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psRGXCreateZSBufferIN_UI8,
 			      IMG_UINT8 * psRGXCreateZSBufferOUT_UI8,
@@ -594,10 +594,10 @@ PVRSRVBridgeRGXCreateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEZSBUFFER, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXDestroyZSBufferIN_UI8,
 			       IMG_UINT8 * psRGXDestroyZSBufferOUT_UI8,
@@ -634,7 +634,7 @@ PVRSRVBridgeRGXDestroyZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyZSBuffer_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYZSBUFFER, eError);
 }
 
 static PVRSRV_ERROR _RGXPopulateZSBufferpssPopulationIntRelease(void *pvData)
@@ -644,7 +644,7 @@ static PVRSRV_ERROR _RGXPopulateZSBufferpssPopulationIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXPopulateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRGXPopulateZSBufferIN_UI8,
 				IMG_UINT8 * psRGXPopulateZSBufferOUT_UI8,
@@ -728,10 +728,10 @@ PVRSRVBridgeRGXPopulateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXPOPULATEZSBUFFER, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXUnpopulateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXUnpopulateZSBufferIN_UI8,
 				  IMG_UINT8 * psRGXUnpopulateZSBufferOUT_UI8,
@@ -767,7 +767,7 @@ PVRSRVBridgeRGXUnpopulateZSBuffer(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXUnpopulateZSBuffer_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXUNPOPULATEZSBUFFER, eError);
 }
 
 static PVRSRV_ERROR _RGXCreateFreeListpsCleanupCookieIntRelease(void *pvData)
@@ -777,7 +777,7 @@ static PVRSRV_ERROR _RGXCreateFreeListpsCleanupCookieIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateFreeList(IMG_UINT32 ui32DispatchTableEntry,
 			      IMG_UINT8 * psRGXCreateFreeListIN_UI8,
 			      IMG_UINT8 * psRGXCreateFreeListOUT_UI8,
@@ -941,10 +941,10 @@ PVRSRVBridgeRGXCreateFreeList(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEFREELIST, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyFreeList(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXDestroyFreeListIN_UI8,
 			       IMG_UINT8 * psRGXDestroyFreeListOUT_UI8,
@@ -979,7 +979,7 @@ PVRSRVBridgeRGXDestroyFreeList(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyFreeList_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYFREELIST, eError);
 }
 
 static PVRSRV_ERROR _RGXCreateRenderContextpsRenderContextIntRelease(void *pvData)
@@ -994,7 +994,7 @@ static_assert(RGXFWIF_RF_CMD_SIZE <= IMG_UINT32_MAX,
 static_assert(RGXFWIF_STATIC_RENDERCONTEXT_SIZE <= IMG_UINT32_MAX,
 	      "RGXFWIF_STATIC_RENDERCONTEXT_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateRenderContext(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psRGXCreateRenderContextIN_UI8,
 				   IMG_UINT8 * psRGXCreateRenderContextOUT_UI8,
@@ -1205,10 +1205,10 @@ PVRSRVBridgeRGXCreateRenderContext(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATERENDERCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXDestroyRenderContext(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psRGXDestroyRenderContextIN_UI8,
 				    IMG_UINT8 * psRGXDestroyRenderContextOUT_UI8,
@@ -1246,10 +1246,10 @@ PVRSRVBridgeRGXDestroyRenderContext(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXDestroyRenderContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXDESTROYRENDERCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSendZSStoreDisable(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXSendZSStoreDisableIN_UI8,
 				  IMG_UINT8 * psRGXSendZSStoreDisableOUT_UI8,
@@ -1304,10 +1304,10 @@ PVRSRVBridgeRGXSendZSStoreDisable(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSENDZSSTOREDISABLE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetRenderContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psRGXSetRenderContextPriorityIN_UI8,
 					IMG_UINT8 * psRGXSetRenderContextPriorityOUT_UI8,
@@ -1360,10 +1360,10 @@ PVRSRVBridgeRGXSetRenderContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETRENDERCONTEXTPRIORITY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXRenderContextStalled(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psRGXRenderContextStalledIN_UI8,
 				    IMG_UINT8 * psRGXRenderContextStalledOUT_UI8,
@@ -1413,7 +1413,7 @@ PVRSRVBridgeRGXRenderContextStalled(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXRENDERCONTEXTSTALLED, eError);
 }
 
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
@@ -1435,7 +1435,7 @@ static_assert(RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE <= IMG_UINT32_MAX,
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
 	      "PVRSRV_MAX_SYNCS must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXKickTA3D2(IMG_UINT32 ui32DispatchTableEntry,
 			 IMG_UINT8 * psRGXKickTA3D2IN_UI8,
 			 IMG_UINT8 * psRGXKickTA3D2OUT_UI8, CONNECTION_DATA * psConnection)
@@ -2265,10 +2265,10 @@ PVRSRVBridgeRGXKickTA3D2(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXKICKTA3D2, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXSetRenderContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psRGXSetRenderContextPropertyIN_UI8,
 					IMG_UINT8 * psRGXSetRenderContextPropertyOUT_UI8,
@@ -2322,7 +2322,7 @@ PVRSRVBridgeRGXSetRenderContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXSETRENDERCONTEXTPROPERTY, eError);
 }
 
 static PVRSRV_ERROR _RGXCreateZSBuffer2pssZSBufferKMIntRelease(void *pvData)
@@ -2332,7 +2332,7 @@ static PVRSRV_ERROR _RGXCreateZSBuffer2pssZSBufferKMIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateZSBuffer2(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXCreateZSBuffer2IN_UI8,
 			       IMG_UINT8 * psRGXCreateZSBuffer2OUT_UI8,
@@ -2438,7 +2438,7 @@ PVRSRVBridgeRGXCreateZSBuffer2(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEZSBUFFER2, eError);
 }
 
 static PVRSRV_ERROR _RGXCreateFreeList2psCleanupCookieIntRelease(void *pvData)
@@ -2448,7 +2448,7 @@ static PVRSRV_ERROR _RGXCreateFreeList2psCleanupCookieIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXCreateFreeList2(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXCreateFreeList2IN_UI8,
 			       IMG_UINT8 * psRGXCreateFreeList2OUT_UI8,
@@ -2590,7 +2590,404 @@ PVRSRVBridgeRGXCreateFreeList2(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEFREELIST2, eError);
+}
+
+static PVRSRV_ERROR _RGXCreateHWRTDataSet2psKmHwRTDataSetIntRelease(void *pvData)
+{
+	PVRSRV_ERROR eError;
+	eError = RGXDestroyHWRTDataSet((RGX_KM_HW_RT_DATASET *) pvData);
+	return eError;
+}
+
+static_assert(RGXMKIF_NUM_RTDATA_FREELISTS <= IMG_UINT32_MAX,
+	      "RGXMKIF_NUM_RTDATA_FREELISTS must not be larger than IMG_UINT32_MAX");
+static_assert(RGXMKIF_NUM_GEOMDATAS <= IMG_UINT32_MAX,
+	      "RGXMKIF_NUM_GEOMDATAS must not be larger than IMG_UINT32_MAX");
+static_assert(RGXMKIF_NUM_RTDATAS <= IMG_UINT32_MAX,
+	      "RGXMKIF_NUM_RTDATAS must not be larger than IMG_UINT32_MAX");
+
+static size_t
+PVRSRVBridgeRGXCreateHWRTDataSet2(IMG_UINT32 ui32DispatchTableEntry,
+				  IMG_UINT8 * psRGXCreateHWRTDataSet2IN_UI8,
+				  IMG_UINT8 * psRGXCreateHWRTDataSet2OUT_UI8,
+				  CONNECTION_DATA * psConnection)
+{
+	PVRSRV_BRIDGE_IN_RGXCREATEHWRTDATASET2 *psRGXCreateHWRTDataSet2IN =
+	    (PVRSRV_BRIDGE_IN_RGXCREATEHWRTDATASET2 *)
+	    IMG_OFFSET_ADDR(psRGXCreateHWRTDataSet2IN_UI8, 0);
+	PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2 *psRGXCreateHWRTDataSet2OUT =
+	    (PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2 *)
+	    IMG_OFFSET_ADDR(psRGXCreateHWRTDataSet2OUT_UI8, 0);
+
+	IMG_HANDLE hMListsReservation = psRGXCreateHWRTDataSet2IN->hMListsReservation;
+	DEVMEMINT_RESERVATION2 *psMListsReservationInt = NULL;
+	IMG_HANDLE hPMStatesReservation = psRGXCreateHWRTDataSet2IN->hPMStatesReservation;
+	DEVMEMINT_RESERVATION2 *psPMStatesReservationInt = NULL;
+	IMG_HANDLE hPMSecureStatesReservation =
+	    psRGXCreateHWRTDataSet2IN->hPMSecureStatesReservation;
+	DEVMEMINT_RESERVATION2 *psPMSecureStatesReservationInt = NULL;
+	RGX_FREELIST **psapsFreeListsInt = NULL;
+	IMG_HANDLE *hapsFreeListsInt2 = NULL;
+	IMG_DEV_VIRTADDR *sTailPtrsDevVAddrInt = NULL;
+	RGX_KM_HW_RT_DATASET **psKmHwRTDataSetInt = NULL;
+	IMG_HANDLE *hKmHwRTDataSetInt2 = NULL;
+
+	IMG_UINT32 ui32NextOffset = 0;
+	IMG_BYTE *pArrayArgsBuffer = NULL;
+	IMG_BOOL bHaveEnoughSpace = IMG_FALSE;
+
+	IMG_UINT32 ui32BufferSize = 0;
+	IMG_UINT64 ui64BufferSize =
+	    ((IMG_UINT64) RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(RGX_FREELIST *)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(IMG_HANDLE)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_RTDATAS * sizeof(RGX_KM_HW_RT_DATASET *)) +
+	    ((IMG_UINT64) RGXMKIF_NUM_RTDATAS * sizeof(IMG_HANDLE)) + 0;
+
+	psRGXCreateHWRTDataSet2OUT->phKmHwRTDataSet = psRGXCreateHWRTDataSet2IN->phKmHwRTDataSet;
+
+	if (ui64BufferSize > IMG_UINT32_MAX)
+	{
+		psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_BRIDGE_BUFFER_TOO_SMALL;
+		goto RGXCreateHWRTDataSet2_exit;
+	}
+
+	ui32BufferSize = (IMG_UINT32) ui64BufferSize;
+
+	if (ui32BufferSize != 0)
+	{
+		/* Try to use remainder of input buffer for copies if possible, word-aligned for safety. */
+		IMG_UINT32 ui32InBufferOffset =
+		    PVR_ALIGN(sizeof(*psRGXCreateHWRTDataSet2IN), sizeof(unsigned long));
+		IMG_UINT32 ui32InBufferExcessSize =
+		    ui32InBufferOffset >=
+		    PVRSRV_MAX_BRIDGE_IN_SIZE ? 0 : PVRSRV_MAX_BRIDGE_IN_SIZE - ui32InBufferOffset;
+
+		bHaveEnoughSpace = ui32BufferSize <= ui32InBufferExcessSize;
+		if (bHaveEnoughSpace)
+		{
+			IMG_BYTE *pInputBuffer = (IMG_BYTE *) (void *)psRGXCreateHWRTDataSet2IN;
+
+			pArrayArgsBuffer = &pInputBuffer[ui32InBufferOffset];
+		}
+		else
+		{
+			pArrayArgsBuffer = OSAllocMemNoStats(ui32BufferSize);
+
+			if (!pArrayArgsBuffer)
+			{
+				psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_OUT_OF_MEMORY;
+				goto RGXCreateHWRTDataSet2_exit;
+			}
+		}
+	}
+
+	{
+		psapsFreeListsInt =
+		    (RGX_FREELIST **) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		OSCachedMemSet(psapsFreeListsInt, 0,
+			       RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(RGX_FREELIST *));
+		ui32NextOffset += RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(RGX_FREELIST *);
+		hapsFreeListsInt2 =
+		    (IMG_HANDLE *) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		ui32NextOffset += RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(IMG_HANDLE);
+	}
+
+	/* Copy the data over */
+	if (RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(IMG_HANDLE) > 0)
+	{
+		if (OSCopyFromUser
+		    (NULL, hapsFreeListsInt2,
+		     (const void __user *)psRGXCreateHWRTDataSet2IN->phapsFreeLists,
+		     RGXMKIF_NUM_RTDATA_FREELISTS * sizeof(IMG_HANDLE)) != PVRSRV_OK)
+		{
+			psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
+
+			goto RGXCreateHWRTDataSet2_exit;
+		}
+	}
+
+	{
+		sTailPtrsDevVAddrInt =
+		    (IMG_DEV_VIRTADDR *) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		ui32NextOffset += RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR);
+	}
+
+	/* Copy the data over */
+	if (RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR) > 0)
+	{
+		if (OSCopyFromUser
+		    (NULL, sTailPtrsDevVAddrInt,
+		     (const void __user *)psRGXCreateHWRTDataSet2IN->psTailPtrsDevVAddr,
+		     RGXMKIF_NUM_GEOMDATAS * sizeof(IMG_DEV_VIRTADDR)) != PVRSRV_OK)
+		{
+			psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
+
+			goto RGXCreateHWRTDataSet2_exit;
+		}
+	}
+	if (IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset) != NULL)
+	{
+		psKmHwRTDataSetInt =
+		    (RGX_KM_HW_RT_DATASET **) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		OSCachedMemSet(psKmHwRTDataSetInt, 0,
+			       RGXMKIF_NUM_RTDATAS * sizeof(RGX_KM_HW_RT_DATASET *));
+		ui32NextOffset += RGXMKIF_NUM_RTDATAS * sizeof(RGX_KM_HW_RT_DATASET *);
+		hKmHwRTDataSetInt2 =
+		    (IMG_HANDLE *) IMG_OFFSET_ADDR(pArrayArgsBuffer, ui32NextOffset);
+		ui32NextOffset += RGXMKIF_NUM_RTDATAS * sizeof(IMG_HANDLE);
+	}
+
+	/* Lock over handle lookup. */
+	LockHandle(psConnection->psHandleBase);
+
+	/* Look up the address from the handle */
+	psRGXCreateHWRTDataSet2OUT->eError =
+	    PVRSRVLookupHandleUnlocked(psConnection->psHandleBase,
+				       (void **)&psMListsReservationInt,
+				       hMListsReservation,
+				       PVRSRV_HANDLE_TYPE_DEVMEMINT_RESERVATION2, IMG_TRUE);
+	if (unlikely(psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK))
+	{
+		UnlockHandle(psConnection->psHandleBase);
+		goto RGXCreateHWRTDataSet2_exit;
+	}
+
+	/* Look up the address from the handle */
+	psRGXCreateHWRTDataSet2OUT->eError =
+	    PVRSRVLookupHandleUnlocked(psConnection->psHandleBase,
+				       (void **)&psPMStatesReservationInt,
+				       hPMStatesReservation,
+				       PVRSRV_HANDLE_TYPE_DEVMEMINT_RESERVATION2, IMG_TRUE);
+	if (unlikely(psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK))
+	{
+		UnlockHandle(psConnection->psHandleBase);
+		goto RGXCreateHWRTDataSet2_exit;
+	}
+
+	/* Look up the address from the handle */
+	psRGXCreateHWRTDataSet2OUT->eError =
+	    PVRSRVLookupHandleUnlocked(psConnection->psHandleBase,
+				       (void **)&psPMSecureStatesReservationInt,
+				       hPMSecureStatesReservation,
+				       PVRSRV_HANDLE_TYPE_DEVMEMINT_RESERVATION2, IMG_TRUE);
+	if (unlikely(psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK))
+	{
+		UnlockHandle(psConnection->psHandleBase);
+		goto RGXCreateHWRTDataSet2_exit;
+	}
+
+	{
+		IMG_UINT32 i;
+
+		for (i = 0; i < RGXMKIF_NUM_RTDATA_FREELISTS; i++)
+		{
+			/* Look up the address from the handle */
+			psRGXCreateHWRTDataSet2OUT->eError =
+			    PVRSRVLookupHandleUnlocked(psConnection->psHandleBase,
+						       (void **)&psapsFreeListsInt[i],
+						       hapsFreeListsInt2[i],
+						       PVRSRV_HANDLE_TYPE_RGX_FREELIST, IMG_TRUE);
+			if (unlikely(psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK))
+			{
+				UnlockHandle(psConnection->psHandleBase);
+				goto RGXCreateHWRTDataSet2_exit;
+			}
+		}
+	}
+	/* Release now we have looked up handles. */
+	UnlockHandle(psConnection->psHandleBase);
+
+	psRGXCreateHWRTDataSet2OUT->eError =
+	    RGXCreateHWRTDataSet2(psConnection, OSGetDevNode(psConnection),
+				  psRGXCreateHWRTDataSet2IN->sVHeapTableDevVAddr,
+				  psMListsReservationInt,
+				  psPMStatesReservationInt,
+				  psPMSecureStatesReservationInt,
+				  psapsFreeListsInt,
+				  sTailPtrsDevVAddrInt,
+				  psRGXCreateHWRTDataSet2IN->ui16MaxRTs, psKmHwRTDataSetInt);
+	/* Exit early if bridged call fails */
+	if (unlikely(psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK))
+	{
+		goto RGXCreateHWRTDataSet2_exit;
+	}
+
+	/* Lock over handle creation. */
+	LockHandle(psConnection->psHandleBase);
+	if (hKmHwRTDataSetInt2)
+	{
+		IMG_UINT32 i;
+
+		for (i = 0; i < RGXMKIF_NUM_RTDATAS; i++)
+		{
+
+			psRGXCreateHWRTDataSet2OUT->eError =
+			    PVRSRVAllocHandleUnlocked(psConnection->psHandleBase,
+						      &hKmHwRTDataSetInt2[i],
+						      (void *)psKmHwRTDataSetInt[i],
+						      PVRSRV_HANDLE_TYPE_RGX_KM_HW_RT_DATASET,
+						      PVRSRV_HANDLE_ALLOC_FLAG_MULTI,
+						      (PFN_HANDLE_RELEASE) &
+						      _RGXCreateHWRTDataSet2psKmHwRTDataSetIntRelease);
+			if (unlikely(psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK))
+			{
+				IMG_UINT32 j;
+				/* Ensure the remaining handles are set to NULL. hKmHwRTDataSetInt2[i] was
+				 * zeroed when calling PVRSRVAllocHandleUnlocked, so we start at the next
+				 * element. If it was the last iteration, the loop doesn't run.
+				 */
+				for (j = i + 1; j < RGXMKIF_NUM_RTDATAS; j++)
+				{
+					hKmHwRTDataSetInt2[j] = NULL;
+				}
+				UnlockHandle(psConnection->psHandleBase);
+				goto RGXCreateHWRTDataSet2_exit;
+			}
+
+		}
+	}
+	/* Release now we have created handles. */
+	UnlockHandle(psConnection->psHandleBase);
+
+	/* If dest ptr is non-null and we have data to copy */
+	if ((hKmHwRTDataSetInt2) && ((RGXMKIF_NUM_RTDATAS * sizeof(RGX_KM_HW_RT_DATASET *)) > 0))
+	{
+		if (unlikely
+		    (OSCopyToUser
+		     (NULL, (void __user *)psRGXCreateHWRTDataSet2OUT->phKmHwRTDataSet,
+		      hKmHwRTDataSetInt2,
+		      (RGXMKIF_NUM_RTDATAS * sizeof(RGX_KM_HW_RT_DATASET *))) != PVRSRV_OK))
+		{
+			psRGXCreateHWRTDataSet2OUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
+
+			goto RGXCreateHWRTDataSet2_exit;
+		}
+	}
+
+RGXCreateHWRTDataSet2_exit:
+
+	/* Lock over handle lookup cleanup. */
+	LockHandle(psConnection->psHandleBase);
+
+	/* Unreference the previously looked up handle */
+	if (psMListsReservationInt)
+	{
+		PVRSRVReleaseHandleUnlocked(psConnection->psHandleBase,
+					    hMListsReservation,
+					    PVRSRV_HANDLE_TYPE_DEVMEMINT_RESERVATION2);
+	}
+
+	/* Unreference the previously looked up handle */
+	if (psPMStatesReservationInt)
+	{
+		PVRSRVReleaseHandleUnlocked(psConnection->psHandleBase,
+					    hPMStatesReservation,
+					    PVRSRV_HANDLE_TYPE_DEVMEMINT_RESERVATION2);
+	}
+
+	/* Unreference the previously looked up handle */
+	if (psPMSecureStatesReservationInt)
+	{
+		PVRSRVReleaseHandleUnlocked(psConnection->psHandleBase,
+					    hPMSecureStatesReservation,
+					    PVRSRV_HANDLE_TYPE_DEVMEMINT_RESERVATION2);
+	}
+
+	if (hapsFreeListsInt2)
+	{
+		IMG_UINT32 i;
+
+		for (i = 0; i < RGXMKIF_NUM_RTDATA_FREELISTS; i++)
+		{
+
+			/* Unreference the previously looked up handle */
+			if (psapsFreeListsInt && psapsFreeListsInt[i])
+			{
+				PVRSRVReleaseHandleUnlocked(psConnection->psHandleBase,
+							    hapsFreeListsInt2[i],
+							    PVRSRV_HANDLE_TYPE_RGX_FREELIST);
+			}
+		}
+	}
+	/* Release now we have cleaned up look up handles. */
+	UnlockHandle(psConnection->psHandleBase);
+
+	if (psRGXCreateHWRTDataSet2OUT->eError != PVRSRV_OK)
+	{
+		if (hKmHwRTDataSetInt2)
+		{
+			PVRSRV_ERROR eError;
+
+			/* Lock over handle creation cleanup. */
+			LockHandle(psConnection->psHandleBase);
+
+			{
+				IMG_UINT32 idx;
+				for (idx = 0; idx < RGXMKIF_NUM_RTDATAS; idx++)
+				{
+					if (hKmHwRTDataSetInt2[idx])
+					{
+
+						eError =
+						    PVRSRVDestroyHandleUnlocked(psConnection->
+										psHandleBase,
+										hKmHwRTDataSetInt2
+										[idx],
+										PVRSRV_HANDLE_TYPE_RGX_KM_HW_RT_DATASET);
+						if (unlikely
+						    ((eError != PVRSRV_OK)
+						     && (eError != PVRSRV_ERROR_RETRY)))
+						{
+							PVR_DPF((PVR_DBG_ERROR,
+								 "%s: %s",
+								 __func__,
+								 PVRSRVGetErrorString(eError)));
+						}
+						/* Releasing the handle should free/destroy/release the resource.
+						 * This should never fail... */
+						PVR_ASSERT((eError == PVRSRV_OK)
+							   || (eError == PVRSRV_ERROR_RETRY));
+
+					}
+					else
+					{
+						/* Free/Destroy/Release the resource */
+						RGXDestroyHWRTDataSet(psKmHwRTDataSetInt[idx]);
+					}
+				}
+			}
+
+			/* Release now we have cleaned up creation handles. */
+			UnlockHandle(psConnection->psHandleBase);
+
+		}
+
+		else if (psKmHwRTDataSetInt)
+		{
+			IMG_UINT32 i;
+			for (i = 0; i < RGXMKIF_NUM_RTDATAS; i++)
+			{
+				if (psKmHwRTDataSetInt[i])
+				{
+					RGXDestroyHWRTDataSet(psKmHwRTDataSetInt[i]);
+				}
+			}
+		}
+
+	}
+
+	/* Allocated space should be equal to the last updated offset */
+#ifdef PVRSRV_NEED_PVR_ASSERT
+	if (psRGXCreateHWRTDataSet2OUT->eError == PVRSRV_OK)
+		PVR_ASSERT(ui32BufferSize == ui32NextOffset);
+#endif /* PVRSRV_NEED_PVR_ASSERT */
+
+	if (!bHaveEnoughSpace && pArrayArgsBuffer)
+		OSFreeMemNoStats(pArrayArgsBuffer);
+
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2, eError);
 }
 
 /* ***************************************************************************
@@ -2692,6 +3089,11 @@ PVRSRV_ERROR InitRGXTA3DBridge(void)
 			      sizeof(PVRSRV_BRIDGE_IN_RGXCREATEFREELIST2),
 			      sizeof(PVRSRV_BRIDGE_OUT_RGXCREATEFREELIST2));
 
+	SetDispatchTableEntry(PVRSRV_BRIDGE_RGXTA3D, PVRSRV_BRIDGE_RGXTA3D_RGXCREATEHWRTDATASET2,
+			      PVRSRVBridgeRGXCreateHWRTDataSet2, NULL,
+			      sizeof(PVRSRV_BRIDGE_IN_RGXCREATEHWRTDATASET2),
+			      sizeof(PVRSRV_BRIDGE_OUT_RGXCREATEHWRTDATASET2));
+
 	return PVRSRV_OK;
 }
 
@@ -2740,4 +3142,6 @@ void DeinitRGXTA3DBridge(void)
 
 	UnsetDispatchTableEntry(PVRSRV_BRIDGE_RGXTA3D, PVRSRV_BRIDGE_RGXTA3D_RGXCREATEFREELIST2);
 
+	UnsetDispatchTableEntry(PVRSRV_BRIDGE_RGXTA3D, PVRSRV_BRIDGE_RGXTA3D_RGXCREATEHWRTDATASET2);
+
 }
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxtimerquery_bridge/server_rgxtimerquery_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxtimerquery_bridge/server_rgxtimerquery_bridge.c
index 4af3cfc..22f2810 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxtimerquery_bridge/server_rgxtimerquery_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxtimerquery_bridge/server_rgxtimerquery_bridge.c
@@ -65,7 +65,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXBeginTimerQuery(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psRGXBeginTimerQueryIN_UI8,
 			       IMG_UINT8 * psRGXBeginTimerQueryOUT_UI8,
@@ -81,10 +81,10 @@ PVRSRVBridgeRGXBeginTimerQuery(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVRGXBeginTimerQueryKM(psConnection, OSGetDevNode(psConnection),
 				       psRGXBeginTimerQueryIN->ui32QueryId);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXBEGINTIMERQUERY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXEndTimerQuery(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psRGXEndTimerQueryIN_UI8,
 			     IMG_UINT8 * psRGXEndTimerQueryOUT_UI8, CONNECTION_DATA * psConnection)
@@ -99,10 +99,10 @@ PVRSRVBridgeRGXEndTimerQuery(IMG_UINT32 ui32DispatchTableEntry,
 	psRGXEndTimerQueryOUT->eError =
 	    PVRSRVRGXEndTimerQueryKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXENDTIMERQUERY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXQueryTimer(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psRGXQueryTimerIN_UI8,
 			  IMG_UINT8 * psRGXQueryTimerOUT_UI8, CONNECTION_DATA * psConnection)
@@ -118,7 +118,7 @@ PVRSRVBridgeRGXQueryTimer(IMG_UINT32 ui32DispatchTableEntry,
 				  &psRGXQueryTimerOUT->ui64StartTime,
 				  &psRGXQueryTimerOUT->ui64EndTime);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXQUERYTIMER, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxtq2_bridge/server_rgxtq2_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxtq2_bridge/server_rgxtq2_bridge.c
index 8dfc01b..bccd646 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxtq2_bridge/server_rgxtq2_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/rgxtq2_bridge/server_rgxtq2_bridge.c
@@ -77,7 +77,7 @@ static PVRSRV_ERROR _RGXTDMCreateTransferContextpsTransferContextIntRelease(void
 static_assert(RGXFWIF_RF_CMD_SIZE <= IMG_UINT32_MAX,
 	      "RGXFWIF_RF_CMD_SIZE must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMCreateTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 					IMG_UINT8 * psRGXTDMCreateTransferContextIN_UI8,
 					IMG_UINT8 * psRGXTDMCreateTransferContextOUT_UI8,
@@ -268,10 +268,10 @@ PVRSRVBridgeRGXTDMCreateTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMCREATETRANSFERCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMDestroyTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 					 IMG_UINT8 * psRGXTDMDestroyTransferContextIN_UI8,
 					 IMG_UINT8 * psRGXTDMDestroyTransferContextOUT_UI8,
@@ -324,10 +324,10 @@ PVRSRVBridgeRGXTDMDestroyTransferContext(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXTDMDestroyTransferContext_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMDESTROYTRANSFERCONTEXT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMSetTransferContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 					     IMG_UINT8 * psRGXTDMSetTransferContextPriorityIN_UI8,
 					     IMG_UINT8 * psRGXTDMSetTransferContextPriorityOUT_UI8,
@@ -395,10 +395,10 @@ PVRSRVBridgeRGXTDMSetTransferContextPriority(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMSETTRANSFERCONTEXTPRIORITY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMNotifyWriteOffsetUpdate(IMG_UINT32 ui32DispatchTableEntry,
 					  IMG_UINT8 * psRGXTDMNotifyWriteOffsetUpdateIN_UI8,
 					  IMG_UINT8 * psRGXTDMNotifyWriteOffsetUpdateOUT_UI8,
@@ -465,7 +465,7 @@ PVRSRVBridgeRGXTDMNotifyWriteOffsetUpdate(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMNOTIFYWRITEOFFSETUPDATE, eError);
 }
 
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
@@ -477,7 +477,7 @@ static_assert(RGXFWIF_DM_INDEPENDENT_KICK_CMD_SIZE <= IMG_UINT32_MAX,
 static_assert(PVRSRV_MAX_SYNCS <= IMG_UINT32_MAX,
 	      "PVRSRV_MAX_SYNCS must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMSubmitTransfer2(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXTDMSubmitTransfer2IN_UI8,
 				  IMG_UINT8 * psRGXTDMSubmitTransfer2OUT_UI8,
@@ -882,7 +882,7 @@ PVRSRVBridgeRGXTDMSubmitTransfer2(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMSUBMITTRANSFER2, eError);
 }
 
 static PVRSRV_ERROR _RGXTDMGetSharedMemorypsCLIPMRMemIntRelease(void *pvData)
@@ -899,7 +899,7 @@ static PVRSRV_ERROR _RGXTDMGetSharedMemorypsUSCPMRMemIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMGetSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 				  IMG_UINT8 * psRGXTDMGetSharedMemoryIN_UI8,
 				  IMG_UINT8 * psRGXTDMGetSharedMemoryOUT_UI8,
@@ -988,10 +988,10 @@ PVRSRVBridgeRGXTDMGetSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMGETSHAREDMEMORY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMReleaseSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 				      IMG_UINT8 * psRGXTDMReleaseSharedMemoryIN_UI8,
 				      IMG_UINT8 * psRGXTDMReleaseSharedMemoryOUT_UI8,
@@ -1041,10 +1041,10 @@ PVRSRVBridgeRGXTDMReleaseSharedMemory(IMG_UINT32 ui32DispatchTableEntry,
 
 RGXTDMReleaseSharedMemory_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMRELEASESHAREDMEMORY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRGXTDMSetTransferContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 					     IMG_UINT8 * psRGXTDMSetTransferContextPropertyIN_UI8,
 					     IMG_UINT8 * psRGXTDMSetTransferContextPropertyOUT_UI8,
@@ -1115,7 +1115,7 @@ PVRSRVBridgeRGXTDMSetTransferContextProperty(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RGXTDMSETTRANSFERCONTEXTPROPERTY, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/ri_bridge/server_ri_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/ri_bridge/server_ri_bridge.c
index 1f9db7d..940f942 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/ri_bridge/server_ri_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/ri_bridge/server_ri_bridge.c
@@ -65,7 +65,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIWritePMREntry(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psRIWritePMREntryIN_UI8,
 			    IMG_UINT8 * psRIWritePMREntryOUT_UI8, CONNECTION_DATA * psConnection)
@@ -110,7 +110,7 @@ PVRSRVBridgeRIWritePMREntry(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIWRITEPMRENTRY, eError);
 }
 
 static PVRSRV_ERROR _RIWriteMEMDESCEntrypsRIHandleIntRelease(void *pvData)
@@ -123,7 +123,7 @@ static PVRSRV_ERROR _RIWriteMEMDESCEntrypsRIHandleIntRelease(void *pvData)
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIWriteMEMDESCEntry(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRIWriteMEMDESCEntryIN_UI8,
 				IMG_UINT8 * psRIWriteMEMDESCEntryOUT_UI8,
@@ -294,7 +294,7 @@ PVRSRVBridgeRIWriteMEMDESCEntry(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIWRITEMEMDESCENTRY, eError);
 }
 
 static PVRSRV_ERROR _RIWriteProcListEntrypsRIHandleIntRelease(void *pvData)
@@ -307,7 +307,7 @@ static PVRSRV_ERROR _RIWriteProcListEntrypsRIHandleIntRelease(void *pvData)
 static_assert(DEVMEM_ANNOTATION_MAX_LEN <= IMG_UINT32_MAX,
 	      "DEVMEM_ANNOTATION_MAX_LEN must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIWriteProcListEntry(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psRIWriteProcListEntryIN_UI8,
 				 IMG_UINT8 * psRIWriteProcListEntryOUT_UI8,
@@ -446,10 +446,10 @@ PVRSRVBridgeRIWriteProcListEntry(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIWRITEPROCLISTENTRY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIUpdateMEMDESCAddr(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psRIUpdateMEMDESCAddrIN_UI8,
 				IMG_UINT8 * psRIUpdateMEMDESCAddrOUT_UI8,
@@ -498,10 +498,10 @@ PVRSRVBridgeRIUpdateMEMDESCAddr(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIUPDATEMEMDESCADDR, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIDeleteMEMDESCEntry(IMG_UINT32 ui32DispatchTableEntry,
 				 IMG_UINT8 * psRIDeleteMEMDESCEntryIN_UI8,
 				 IMG_UINT8 * psRIDeleteMEMDESCEntryOUT_UI8,
@@ -537,10 +537,10 @@ PVRSRVBridgeRIDeleteMEMDESCEntry(IMG_UINT32 ui32DispatchTableEntry,
 
 RIDeleteMEMDESCEntry_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIDELETEMEMDESCENTRY, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIDumpList(IMG_UINT32 ui32DispatchTableEntry,
 		       IMG_UINT8 * psRIDumpListIN_UI8,
 		       IMG_UINT8 * psRIDumpListOUT_UI8, CONNECTION_DATA * psConnection)
@@ -585,10 +585,10 @@ PVRSRVBridgeRIDumpList(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIDUMPLIST, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIDumpAll(IMG_UINT32 ui32DispatchTableEntry,
 		      IMG_UINT8 * psRIDumpAllIN_UI8,
 		      IMG_UINT8 * psRIDumpAllOUT_UI8, CONNECTION_DATA * psConnection)
@@ -603,10 +603,10 @@ PVRSRVBridgeRIDumpAll(IMG_UINT32 ui32DispatchTableEntry,
 
 	psRIDumpAllOUT->eError = RIDumpAllKM();
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIDUMPALL, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIDumpProcess(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psRIDumpProcessIN_UI8,
 			  IMG_UINT8 * psRIDumpProcessOUT_UI8, CONNECTION_DATA * psConnection)
@@ -620,10 +620,10 @@ PVRSRVBridgeRIDumpProcess(IMG_UINT32 ui32DispatchTableEntry,
 
 	psRIDumpProcessOUT->eError = RIDumpProcessKM(psRIDumpProcessIN->ui32Pid);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIDUMPPROCESS, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeRIWritePMREntryWithOwner(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psRIWritePMREntryWithOwnerIN_UI8,
 				     IMG_UINT8 * psRIWritePMREntryWithOwnerOUT_UI8,
@@ -672,7 +672,7 @@ PVRSRVBridgeRIWritePMREntryWithOwner(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RIWRITEPMRENTRYWITHOWNER, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/srvcore_bridge/server_srvcore_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/srvcore_bridge/server_srvcore_bridge.c
index d40e53b..06d2b1d 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/srvcore_bridge/server_srvcore_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/srvcore_bridge/server_srvcore_bridge.c
@@ -68,7 +68,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeConnect(IMG_UINT32 ui32DispatchTableEntry,
 		    IMG_UINT8 * psConnectIN_UI8,
 		    IMG_UINT8 * psConnectOUT_UI8, CONNECTION_DATA * psConnection)
@@ -87,10 +87,10 @@ PVRSRVBridgeConnect(IMG_UINT32 ui32DispatchTableEntry,
 			    &psConnectOUT->ui8KernelArch,
 			    &psConnectOUT->ui32CapabilityFlags, &psConnectOUT->ui64PackedBvnc);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_CONNECT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDisconnect(IMG_UINT32 ui32DispatchTableEntry,
 		       IMG_UINT8 * psDisconnectIN_UI8,
 		       IMG_UINT8 * psDisconnectOUT_UI8, CONNECTION_DATA * psConnection)
@@ -105,7 +105,7 @@ PVRSRVBridgeDisconnect(IMG_UINT32 ui32DispatchTableEntry,
 
 	psDisconnectOUT->eError = PVRSRVDisconnectKM();
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DISCONNECT, eError);
 }
 
 static PVRSRV_ERROR _AcquireGlobalEventObjecthGlobalEventObjectIntRelease(void *pvData)
@@ -115,7 +115,7 @@ static PVRSRV_ERROR _AcquireGlobalEventObjecthGlobalEventObjectIntRelease(void *
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeAcquireGlobalEventObject(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psAcquireGlobalEventObjectIN_UI8,
 				     IMG_UINT8 * psAcquireGlobalEventObjectOUT_UI8,
@@ -170,10 +170,10 @@ PVRSRVBridgeAcquireGlobalEventObject(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_ACQUIREGLOBALEVENTOBJECT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeReleaseGlobalEventObject(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psReleaseGlobalEventObjectIN_UI8,
 				     IMG_UINT8 * psReleaseGlobalEventObjectOUT_UI8,
@@ -211,7 +211,7 @@ PVRSRVBridgeReleaseGlobalEventObject(IMG_UINT32 ui32DispatchTableEntry,
 
 ReleaseGlobalEventObject_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RELEASEGLOBALEVENTOBJECT, eError);
 }
 
 static PVRSRV_ERROR _EventObjectOpenhOSEventIntRelease(void *pvData)
@@ -221,7 +221,7 @@ static PVRSRV_ERROR _EventObjectOpenhOSEventIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeEventObjectOpen(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psEventObjectOpenIN_UI8,
 			    IMG_UINT8 * psEventObjectOpenOUT_UI8, CONNECTION_DATA * psConnection)
@@ -300,10 +300,10 @@ PVRSRVBridgeEventObjectOpen(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_EVENTOBJECTOPEN, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeEventObjectWait(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psEventObjectWaitIN_UI8,
 			    IMG_UINT8 * psEventObjectWaitOUT_UI8, CONNECTION_DATA * psConnection)
@@ -349,10 +349,10 @@ PVRSRVBridgeEventObjectWait(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_EVENTOBJECTWAIT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeEventObjectClose(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psEventObjectCloseIN_UI8,
 			     IMG_UINT8 * psEventObjectCloseOUT_UI8, CONNECTION_DATA * psConnection)
@@ -384,10 +384,10 @@ PVRSRVBridgeEventObjectClose(IMG_UINT32 ui32DispatchTableEntry,
 
 EventObjectClose_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_EVENTOBJECTCLOSE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeDumpDebugInfo(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psDumpDebugInfoIN_UI8,
 			  IMG_UINT8 * psDumpDebugInfoOUT_UI8, CONNECTION_DATA * psConnection)
@@ -401,10 +401,10 @@ PVRSRVBridgeDumpDebugInfo(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVDumpDebugInfoKM(psConnection, OSGetDevNode(psConnection),
 				  psDumpDebugInfoIN->ui32VerbLevel);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_DUMPDEBUGINFO, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeGetDevClockSpeed(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psGetDevClockSpeedIN_UI8,
 			     IMG_UINT8 * psGetDevClockSpeedOUT_UI8, CONNECTION_DATA * psConnection)
@@ -420,10 +420,10 @@ PVRSRVBridgeGetDevClockSpeed(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVGetDevClockSpeedKM(psConnection, OSGetDevNode(psConnection),
 				     &psGetDevClockSpeedOUT->ui32ClockSpeed);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_GETDEVCLOCKSPEED, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeHWOpTimeout(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psHWOpTimeoutIN_UI8,
 			IMG_UINT8 * psHWOpTimeoutOUT_UI8, CONNECTION_DATA * psConnection)
@@ -437,13 +437,13 @@ PVRSRVBridgeHWOpTimeout(IMG_UINT32 ui32DispatchTableEntry,
 
 	psHWOpTimeoutOUT->eError = PVRSRVHWOpTimeoutKM(psConnection, OSGetDevNode(psConnection));
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_HWOPTIMEOUT, eError);
 }
 
 static_assert(RGXFW_ALIGN_CHECKS_UM_MAX <= IMG_UINT32_MAX,
 	      "RGXFW_ALIGN_CHECKS_UM_MAX must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeAlignmentCheck(IMG_UINT32 ui32DispatchTableEntry,
 			   IMG_UINT8 * psAlignmentCheckIN_UI8,
 			   IMG_UINT8 * psAlignmentCheckOUT_UI8, CONNECTION_DATA * psConnection)
@@ -541,10 +541,10 @@ PVRSRVBridgeAlignmentCheck(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_ALIGNMENTCHECK, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeGetDeviceStatus(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psGetDeviceStatusIN_UI8,
 			    IMG_UINT8 * psGetDeviceStatusOUT_UI8, CONNECTION_DATA * psConnection)
@@ -560,12 +560,12 @@ PVRSRVBridgeGetDeviceStatus(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVGetDeviceStatusKM(psConnection, OSGetDevNode(psConnection),
 				    &psGetDeviceStatusOUT->ui32DeviceSatus);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_GETDEVICESTATUS, eError);
 }
 
 static_assert(8 <= IMG_UINT32_MAX, "8 must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeGetMultiCoreInfo(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psGetMultiCoreInfoIN_UI8,
 			     IMG_UINT8 * psGetMultiCoreInfoOUT_UI8, CONNECTION_DATA * psConnection)
@@ -670,10 +670,10 @@ PVRSRVBridgeGetMultiCoreInfo(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_GETMULTICOREINFO, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeEventObjectWaitTimeout(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psEventObjectWaitTimeoutIN_UI8,
 				   IMG_UINT8 * psEventObjectWaitTimeoutOUT_UI8,
@@ -723,13 +723,13 @@ PVRSRVBridgeEventObjectWaitTimeout(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_EVENTOBJECTWAITTIMEOUT, eError);
 }
 
 static_assert(PVRSRV_PROCESS_STAT_TYPE_COUNT <= IMG_UINT32_MAX,
 	      "PVRSRV_PROCESS_STAT_TYPE_COUNT must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeFindProcessMemStats(IMG_UINT32 ui32DispatchTableEntry,
 				IMG_UINT8 * psFindProcessMemStatsIN_UI8,
 				IMG_UINT8 * psFindProcessMemStatsOUT_UI8,
@@ -843,7 +843,7 @@ PVRSRVBridgeFindProcessMemStats(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_FINDPROCESSMEMSTATS, eError);
 }
 
 static PVRSRV_ERROR _AcquireInfoPagepsPMRIntRelease(void *pvData)
@@ -853,7 +853,7 @@ static PVRSRV_ERROR _AcquireInfoPagepsPMRIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeAcquireInfoPage(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psAcquireInfoPageIN_UI8,
 			    IMG_UINT8 * psAcquireInfoPageOUT_UI8, CONNECTION_DATA * psConnection)
@@ -902,10 +902,10 @@ PVRSRVBridgeAcquireInfoPage(IMG_UINT32 ui32DispatchTableEntry,
 		}
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_ACQUIREINFOPAGE, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeReleaseInfoPage(IMG_UINT32 ui32DispatchTableEntry,
 			    IMG_UINT8 * psReleaseInfoPageIN_UI8,
 			    IMG_UINT8 * psReleaseInfoPageOUT_UI8, CONNECTION_DATA * psConnection)
@@ -937,7 +937,7 @@ PVRSRVBridgeReleaseInfoPage(IMG_UINT32 ui32DispatchTableEntry,
 
 ReleaseInfoPage_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_RELEASEINFOPAGE, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/sync_bridge/server_sync_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/sync_bridge/server_sync_bridge.c
index a0d9210..a54f23f 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/sync_bridge/server_sync_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/sync_bridge/server_sync_bridge.c
@@ -77,7 +77,7 @@ static PVRSRV_ERROR _AllocSyncPrimitiveBlockpsSyncHandleIntRelease(void *pvData)
 	return eError;
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeAllocSyncPrimitiveBlock(IMG_UINT32 ui32DispatchTableEntry,
 				    IMG_UINT8 * psAllocSyncPrimitiveBlockIN_UI8,
 				    IMG_UINT8 * psAllocSyncPrimitiveBlockOUT_UI8,
@@ -179,10 +179,10 @@ PVRSRVBridgeAllocSyncPrimitiveBlock(IMG_UINT32 ui32DispatchTableEntry,
 
 	}
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_ALLOCSYNCPRIMITIVEBLOCK, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeFreeSyncPrimitiveBlock(IMG_UINT32 ui32DispatchTableEntry,
 				   IMG_UINT8 * psFreeSyncPrimitiveBlockIN_UI8,
 				   IMG_UINT8 * psFreeSyncPrimitiveBlockOUT_UI8,
@@ -218,10 +218,10 @@ PVRSRVBridgeFreeSyncPrimitiveBlock(IMG_UINT32 ui32DispatchTableEntry,
 
 FreeSyncPrimitiveBlock_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_FREESYNCPRIMITIVEBLOCK, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncPrimSet(IMG_UINT32 ui32DispatchTableEntry,
 			IMG_UINT8 * psSyncPrimSetIN_UI8,
 			IMG_UINT8 * psSyncPrimSetOUT_UI8, CONNECTION_DATA * psConnection)
@@ -269,12 +269,12 @@ PVRSRVBridgeSyncPrimSet(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCPRIMSET, eError);
 }
 
 #if defined(PDUMP)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncPrimPDump(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psSyncPrimPDumpIN_UI8,
 			  IMG_UINT8 * psSyncPrimPDumpOUT_UI8, CONNECTION_DATA * psConnection)
@@ -321,7 +321,7 @@ PVRSRVBridgeSyncPrimPDump(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCPRIMPDUMP, eError);
 }
 
 #else
@@ -330,7 +330,7 @@ PVRSRVBridgeSyncPrimPDump(IMG_UINT32 ui32DispatchTableEntry,
 
 #if defined(PDUMP)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncPrimPDumpValue(IMG_UINT32 ui32DispatchTableEntry,
 			       IMG_UINT8 * psSyncPrimPDumpValueIN_UI8,
 			       IMG_UINT8 * psSyncPrimPDumpValueOUT_UI8,
@@ -381,7 +381,7 @@ PVRSRVBridgeSyncPrimPDumpValue(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCPRIMPDUMPVALUE, eError);
 }
 
 #else
@@ -390,7 +390,7 @@ PVRSRVBridgeSyncPrimPDumpValue(IMG_UINT32 ui32DispatchTableEntry,
 
 #if defined(PDUMP)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncPrimPDumpPol(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psSyncPrimPDumpPolIN_UI8,
 			     IMG_UINT8 * psSyncPrimPDumpPolOUT_UI8, CONNECTION_DATA * psConnection)
@@ -442,7 +442,7 @@ PVRSRVBridgeSyncPrimPDumpPol(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCPRIMPDUMPPOL, eError);
 }
 
 #else
@@ -451,7 +451,7 @@ PVRSRVBridgeSyncPrimPDumpPol(IMG_UINT32 ui32DispatchTableEntry,
 
 #if defined(PDUMP)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncPrimPDumpCBP(IMG_UINT32 ui32DispatchTableEntry,
 			     IMG_UINT8 * psSyncPrimPDumpCBPIN_UI8,
 			     IMG_UINT8 * psSyncPrimPDumpCBPOUT_UI8, CONNECTION_DATA * psConnection)
@@ -502,7 +502,7 @@ PVRSRVBridgeSyncPrimPDumpCBP(IMG_UINT32 ui32DispatchTableEntry,
 	/* Release now we have cleaned up look up handles. */
 	UnlockHandle(psConnection->psHandleBase);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCPRIMPDUMPCBP, eError);
 }
 
 #else
@@ -512,7 +512,7 @@ PVRSRVBridgeSyncPrimPDumpCBP(IMG_UINT32 ui32DispatchTableEntry,
 static_assert(PVRSRV_SYNC_NAME_LENGTH <= IMG_UINT32_MAX,
 	      "PVRSRV_SYNC_NAME_LENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncAllocEvent(IMG_UINT32 ui32DispatchTableEntry,
 			   IMG_UINT8 * psSyncAllocEventIN_UI8,
 			   IMG_UINT8 * psSyncAllocEventOUT_UI8, CONNECTION_DATA * psConnection)
@@ -613,10 +613,10 @@ PVRSRVBridgeSyncAllocEvent(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCALLOCEVENT, eError);
 }
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncFreeEvent(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psSyncFreeEventIN_UI8,
 			  IMG_UINT8 * psSyncFreeEventOUT_UI8, CONNECTION_DATA * psConnection)
@@ -630,12 +630,12 @@ PVRSRVBridgeSyncFreeEvent(IMG_UINT32 ui32DispatchTableEntry,
 	    PVRSRVSyncFreeEventKM(psConnection, OSGetDevNode(psConnection),
 				  psSyncFreeEventIN->ui32FWAddr);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCFREEEVENT, eError);
 }
 
 #if defined(PDUMP)
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncCheckpointSignalledPDumpPol(IMG_UINT32 ui32DispatchTableEntry,
 					    IMG_UINT8 * psSyncCheckpointSignalledPDumpPolIN_UI8,
 					    IMG_UINT8 * psSyncCheckpointSignalledPDumpPolOUT_UI8,
@@ -653,7 +653,7 @@ PVRSRVBridgeSyncCheckpointSignalledPDumpPol(IMG_UINT32 ui32DispatchTableEntry,
 	psSyncCheckpointSignalledPDumpPolOUT->eError =
 	    PVRSRVSyncCheckpointSignalledPDumpPolKM(psSyncCheckpointSignalledPDumpPolIN->hFence);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCCHECKPOINTSIGNALLEDPDUMPPOL, eError);
 }
 
 #else
diff --git a/drivers/gpu/img-rogue/23.2/generated/volcanic/synctracking_bridge/server_synctracking_bridge.c b/drivers/gpu/img-rogue/23.2/generated/volcanic/synctracking_bridge/server_synctracking_bridge.c
index 06757e5..1c2136a 100644
--- a/drivers/gpu/img-rogue/23.2/generated/volcanic/synctracking_bridge/server_synctracking_bridge.c
+++ b/drivers/gpu/img-rogue/23.2/generated/volcanic/synctracking_bridge/server_synctracking_bridge.c
@@ -66,7 +66,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Server-side bridge entry points
  */
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncRecordRemoveByHandle(IMG_UINT32 ui32DispatchTableEntry,
 				     IMG_UINT8 * psSyncRecordRemoveByHandleIN_UI8,
 				     IMG_UINT8 * psSyncRecordRemoveByHandleOUT_UI8,
@@ -102,7 +102,7 @@ PVRSRVBridgeSyncRecordRemoveByHandle(IMG_UINT32 ui32DispatchTableEntry,
 
 SyncRecordRemoveByHandle_exit:
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCRECORDREMOVEBYHANDLE, eError);
 }
 
 static PVRSRV_ERROR _SyncRecordAddpshRecordIntRelease(void *pvData)
@@ -115,7 +115,7 @@ static PVRSRV_ERROR _SyncRecordAddpshRecordIntRelease(void *pvData)
 static_assert(PVRSRV_SYNC_NAME_LENGTH <= IMG_UINT32_MAX,
 	      "PVRSRV_SYNC_NAME_LENGTH must not be larger than IMG_UINT32_MAX");
 
-static IMG_INT
+static size_t
 PVRSRVBridgeSyncRecordAdd(IMG_UINT32 ui32DispatchTableEntry,
 			  IMG_UINT8 * psSyncRecordAddIN_UI8,
 			  IMG_UINT8 * psSyncRecordAddOUT_UI8, CONNECTION_DATA * psConnection)
@@ -284,7 +284,7 @@ PVRSRVBridgeSyncRecordAdd(IMG_UINT32 ui32DispatchTableEntry,
 	if (!bHaveEnoughSpace && pArrayArgsBuffer)
 		OSFreeMemNoStats(pArrayArgsBuffer);
 
-	return 0;
+	return offsetof(PVRSRV_BRIDGE_OUT_SYNCRECORDADD, eError);
 }
 
 /* ***************************************************************************
diff --git a/drivers/gpu/img-rogue/23.2/hwdefs/rogue/km/rgxdefs_km.h b/drivers/gpu/img-rogue/23.2/hwdefs/rogue/km/rgxdefs_km.h
index 31a550a..81eacfe 100644
--- a/drivers/gpu/img-rogue/23.2/hwdefs/rogue/km/rgxdefs_km.h
+++ b/drivers/gpu/img-rogue/23.2/hwdefs/rogue/km/rgxdefs_km.h
@@ -222,6 +222,10 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
 
+#define RGX_MLIST_ENTRY_STRIDE	(4U) /* 4 bytes */
+#define RGX_NUM_PM_ADDR_SPACES	(2U) /* VCE & TE share virtual space and Alist */
+#define RGX_PM_MAX_PB_VIRT_ADDR_SPACE  (IMG_UINT64_C(0x400000000)) /* PM Maximum addressable limit */
+
 #define RGX_BIF_PM_PHYSICAL_PAGE_ALIGNSHIFT		(12U)
 #define RGX_BIF_PM_PHYSICAL_PAGE_SIZE			(1UL << RGX_BIF_PM_PHYSICAL_PAGE_ALIGNSHIFT)
 
diff --git a/drivers/gpu/img-rogue/23.2/hwdefs/volcanic/km/rgxdefs_km.h b/drivers/gpu/img-rogue/23.2/hwdefs/volcanic/km/rgxdefs_km.h
index 717fcb8..00968c5 100644
--- a/drivers/gpu/img-rogue/23.2/hwdefs/volcanic/km/rgxdefs_km.h
+++ b/drivers/gpu/img-rogue/23.2/hwdefs/volcanic/km/rgxdefs_km.h
@@ -281,6 +281,20 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
                                            RGX_CR_SOFT_RESET_BIF_JONES_EN | \
                                            RGX_CR_SOFT_RESET_SLC_EN))
 
+#define RGX_MLIST_ENTRY_STRIDE	(4U) /* 4 bytes */
+#define RGX_NUM_PM_ADDR_SPACES	(2U) /* VCE & TE share virtual space and Alist */
+#define RGX_PM_MAX_PB_VIRT_ADDR_SPACE  (IMG_UINT64_C(0x400000000)) /* PM Maximum addressable limit */
+
+
+#define RGX_PM_MAX_RSTATE_SIZE_DWORDS (46U)
+#define RGX_PM_MLIST_BASE_ADDR_MAX_ALIGNSIZE (32U)
+#define RGX_PM_VHEAP_BASE_ADDR_MAX_ALIGNSIZE (32U)
+#define _RGX_PM_RENDERSTATE_BUFFER_SET_MLIST_BASE_ADDR(_ft_,_x_) { ((_ft_)[2] = ((_x_) & (IMG_UINT64_C(0x00000000fffffff0)))); \
+                                                          ((_ft_)[3] = (((_x_) & (IMG_UINT64_C(0xffffffff00000000)))  >>  32)); }
+#define _RGX_PM_RENDERSTATE_BUFFER_SET_VHEAP_BASE_ADDR(_ft_,_x_) { ((_ft_)[6] = ((_x_) & (IMG_UINT64_C(0x00000000fffffff0)))); \
+                                                          ((_ft_)[7] = (((_x_) & (IMG_UINT64_C(0xffffffff00000000)))  >>  32)); }
+
+#define RGX_PM_RENDERSTATE_BASE_ADDR_ALIGNSIZE (32U)
 
 #define RGX_BIF_PM_PHYSICAL_PAGE_ALIGNSHIFT		(12U)
 #define RGX_BIF_PM_PHYSICAL_PAGE_SIZE			(1U << RGX_BIF_PM_PHYSICAL_PAGE_ALIGNSHIFT)
diff --git a/drivers/gpu/img-rogue/23.2/include/img_defs.h b/drivers/gpu/img-rogue/23.2/include/img_defs.h
index 0a755ae..217711f 100644
--- a/drivers/gpu/img-rogue/23.2/include/img_defs.h
+++ b/drivers/gpu/img-rogue/23.2/include/img_defs.h
@@ -494,6 +494,13 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define IMG_OFFSET_ADDR(addr, offset_in_bytes) \
 	(void*)&(((IMG_UINT8*)(void*)(addr))[offset_in_bytes])
 
+/* Get a new pointer (user space) with an offset (in bytes) from a base address,
+ * useful when traversing byte buffers and accessing data in buffers through
+ * struct pointers.
+ * Note, this macro is not equivalent to or replacing offsetof() */
+#define IMG_OFFSET_ADDR_USER(addr, offset_in_bytes) \
+	(void __user*)&(((IMG_UINT8 __user*)(void __user*)(addr))[offset_in_bytes])
+
 /* Get a new pointer with an offset (in bytes) from a base address, version
  * for volatile memory.
  */
diff --git a/drivers/gpu/img-rogue/23.2/include/pvrsrv_memallocflags.h b/drivers/gpu/img-rogue/23.2/include/pvrsrv_memallocflags.h
index 1e96035..9de6ed6 100644
--- a/drivers/gpu/img-rogue/23.2/include/pvrsrv_memallocflags.h
+++ b/drivers/gpu/img-rogue/23.2/include/pvrsrv_memallocflags.h
@@ -1013,6 +1013,8 @@ typedef IMG_UINT64 PVRSRV_MEMALLOCFLAGS_T;
 #if defined(DEBUG)
 #define PVRSRV_MEMALLOCFLAGS_DEVMEMX_PHYSICAL_MASK (PVRSRV_MEMALLOCFLAGS_CPU_MMUFLAGSMASK | \
                                                     PVRSRV_MEMALLOCFLAG_GPU_CACHE_MODE_MASK | \
+                                                    PVRSRV_MEMALLOCFLAG_GPU_WRITEABLE | \
+                                                    PVRSRV_MEMALLOCFLAG_GPU_READABLE | \
                                                     PVRSRV_MEMALLOCFLAG_CPU_READ_PERMITTED | \
                                                     PVRSRV_MEMALLOCFLAG_CPU_WRITE_PERMITTED | \
                                                     PVRSRV_MEMALLOCFLAG_CPU_CACHE_CLEAN | \
@@ -1026,6 +1028,8 @@ typedef IMG_UINT64 PVRSRV_MEMALLOCFLAGS_T;
 #else
 #define PVRSRV_MEMALLOCFLAGS_DEVMEMX_PHYSICAL_MASK (PVRSRV_MEMALLOCFLAGS_CPU_MMUFLAGSMASK | \
                                                     PVRSRV_MEMALLOCFLAG_GPU_CACHE_MODE_MASK | \
+                                                    PVRSRV_MEMALLOCFLAG_GPU_WRITEABLE | \
+                                                    PVRSRV_MEMALLOCFLAG_GPU_READABLE | \
                                                     PVRSRV_MEMALLOCFLAG_CPU_READ_PERMITTED | \
                                                     PVRSRV_MEMALLOCFLAG_CPU_WRITE_PERMITTED | \
                                                     PVRSRV_MEMALLOCFLAG_CPU_CACHE_CLEAN | \
diff --git a/drivers/gpu/img-rogue/23.2/services/server/common/devicemem_server.c b/drivers/gpu/img-rogue/23.2/services/server/common/devicemem_server.c
index b9035b1..3aec956 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/common/devicemem_server.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/common/devicemem_server.c
@@ -594,7 +594,7 @@ DevmemIntCtxCreate(CONNECTION_DATA *psConnection,
 
 	if (psDeviceNode->pfnRegisterMemoryContext)
 	{
-		eError = psDeviceNode->pfnRegisterMemoryContext(psDeviceNode, psDevmemCtx->psMMUContext, &hPrivDataInt);
+		eError = psDeviceNode->pfnRegisterMemoryContext(psDeviceNode, psDevmemCtx->psMMUContext, psDevmemCtx, &hPrivDataInt);
 		PVR_LOG_GOTO_IF_ERROR(eError, "pfnRegisterMemoryContext", fail_register);
 	}
 
@@ -630,6 +630,16 @@ DevmemIntCtxCreate(CONNECTION_DATA *psConnection,
 	return eError;
 }
 
+PVRSRV_ERROR DevmemIntCtxRef(DEVMEMINT_CTX *psDevmemCtx)
+{
+	return DevmemIntCtxAcquire(psDevmemCtx) ? PVRSRV_OK : PVRSRV_ERROR_REFCOUNT_OVERFLOW;
+}
+
+void DevmemIntCtxUnref(DEVMEMINT_CTX *psDevmemCtx)
+{
+	DevmemIntCtxRelease(psDevmemCtx);
+}
+
 /*************************************************************************/ /*!
 @Function       DevmemIntHeapCreate
 @Description    Creates and initialises a device memory heap.
@@ -1203,7 +1213,6 @@ DevmemIntMapPMR2(DEVMEMINT_HEAP *psDevmemHeap,
 
 	PMR_LogicalSize(psPMR, &ui64PMRLogicalSize);
 
-	PVR_LOG_RETURN_IF_INVALID_PARAM(psReservation->psMappedPMR == NULL, "psReservation");
 	PVR_LOG_RETURN_IF_INVALID_PARAM(ui64PMRLogicalSize == psReservation->uiLength, "psPMR logical size");
 
 	if (uiLog2HeapContiguity > PMR_GetLog2Contiguity(psPMR))
@@ -1222,13 +1231,14 @@ DevmemIntMapPMR2(DEVMEMINT_HEAP *psDevmemHeap,
 
 	OSLockAcquire(psReservation->hLock);
 
+	PVR_LOG_GOTO_IF_INVALID_PARAM(psReservation->psMappedPMR == NULL, eError, ErrorReleaseResLock);
+
 	if (!DevmemIntReservationAcquireUnlocked(psReservation))
 	{
 		PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_REFCOUNT_OVERFLOW, ErrorReleaseResLock);
 	}
 
 	uiAllocationSize = psReservation->uiLength;
-
 	ui32NumDevPages = 0xffffffffU & ( ( (uiAllocationSize - 1) >> uiLog2HeapContiguity) + 1);
 	PVR_ASSERT((IMG_DEVMEM_SIZE_T) ui32NumDevPages << uiLog2HeapContiguity == uiAllocationSize);
 
@@ -1454,12 +1464,13 @@ DevmemIntUnmapPMR2(DEVMEMINT_RESERVATION2 *psReservation)
 	IMG_BOOL bIsSparse = IMG_FALSE;
 	IMG_UINT32 i;
 
-	PVR_RETURN_IF_INVALID_PARAM(psReservation->psMappedPMR != NULL);
-
 	ui32NumDevPages = _DevmemReservationPageCount(psReservation);
 	sAllocationDevVAddr = psReservation->sBase;
 
 	OSLockAcquire(psReservation->hLock);
+
+	PVR_GOTO_IF_INVALID_PARAM(psReservation->psMappedPMR != NULL, eError, ErrUnlockRes);
+
 	PMRLockPMR(psReservation->psMappedPMR);
 
 	bIsSparse = PMR_IsSparse(psReservation->psMappedPMR);
@@ -1514,6 +1525,7 @@ DevmemIntUnmapPMR2(DEVMEMINT_RESERVATION2 *psReservation)
 
 ErrUnlock:
 	PMRUnlockPMR(psReservation->psMappedPMR);
+ErrUnlockRes:
 	OSLockRelease(psReservation->hLock);
 
 	return eError;
diff --git a/drivers/gpu/img-rogue/23.2/services/server/common/physmem.c b/drivers/gpu/img-rogue/23.2/services/server/common/physmem.c
index e729683..2bc4b8b 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/common/physmem.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/common/physmem.c
@@ -535,6 +535,23 @@ static PVRSRV_ERROR _DevPhysHeapFromFlags(PVRSRV_MEMALLOCFLAGS_T uiFlags,
 	return PVRSRV_OK;
 }
 
+static INLINE void _PromoteToCpuCached(PVRSRV_MEMALLOCFLAGS_T *puiFlags)
+{
+	if ((*puiFlags & (PVRSRV_MEMALLOCFLAG_CPU_READABLE |
+	                  PVRSRV_MEMALLOCFLAG_CPU_WRITEABLE |
+	                  PVRSRV_MEMALLOCFLAG_KERNEL_CPU_MAPPABLE)) == 0)
+	{
+		/* We don't need to upgrade if we don't map into the CPU */
+		return;
+	}
+
+	/* Clear the existing CPU cache flags */
+	*puiFlags &= ~(PVRSRV_MEMALLOCFLAG_CPU_CACHE_MODE_MASK);
+
+	/* Add CPU cached flags */
+	*puiFlags |= PVRSRV_MEMALLOCFLAG_CPU_CACHE_INCOHERENT;
+}
+
 PVRSRV_ERROR
 PhysmemNewRamBackedPMR_direct(CONNECTION_DATA *psConnection,
                        PVRSRV_DEVICE_NODE *psDevNode,
@@ -566,6 +583,12 @@ PhysmemNewRamBackedPMR_direct(CONNECTION_DATA *psConnection,
 	 */
 	PVR_UNREFERENCED_PARAMETER(uiAnnotationLength);
 
+	if (PVRSRVSystemSnoopingOfCPUCache(psDevNode->psDevConfig) &&
+		psDevNode->pfnGetDeviceSnoopMode(psDevNode) == PVRSRV_DEVICE_SNOOP_CPU_ONLY)
+	{
+		_PromoteToCpuCached(&uiPMRFlags);
+	}
+
 	eError = PhysMemValidateParams(ui32NumPhysChunks,
 	                               ui32NumVirtChunks,
 								   pui32MappingTable,
diff --git a/drivers/gpu/img-rogue/23.2/services/server/common/pmr.c b/drivers/gpu/img-rogue/23.2/services/server/common/pmr.c
index 3126fd1..d5f616f 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/common/pmr.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/common/pmr.c
@@ -100,7 +100,11 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #if defined(SUPPORT_PMR_DEFERRED_FREE)
 #define PMR_FLAG_INTERNAL_DEFER_FREE       (1 << 2)
 #define PMR_FLAG_INTERNAL_IS_ZOMBIE        (1 << 3)
+#endif /* defined(SUPPORT_PMR_DEFERRED_FREE) */
+#define PMR_FLAG_INTERNAL_IS_EXCLUSIVE     (1 << 4)
 
+
+#if defined(SUPPORT_PMR_DEFERRED_FREE)
 /* Indicates PMR should be destroyed immediately and not deferred. */
 #define PMR_NO_ZOMBIE_FENCE IMG_UINT64_MAX
 #endif /* defined(SUPPORT_PMR_DEFERRED_FREE) */
@@ -671,6 +675,22 @@ static INLINE IMG_BOOL _IntFlagIsSet(const PMR *psPMR, const IMG_UINT32 uiValue)
 	return bIsSet;
 }
 
+static INLINE IMG_BOOL _IntFlagSetIfNotSet(PMR *psPMR, const IMG_UINT32 uiValue)
+{
+	OS_SPINLOCK_FLAGS uiLockingFlags;
+	IMG_BOOL bIsSet;
+
+	OSSpinLockAcquire(psPMR->hBitmapLock, uiLockingFlags);
+	bIsSet = BITMASK_HAS(psPMR->uiInternalFlags, uiValue);
+	if (!bIsSet)
+	{
+		BITMASK_SET(psPMR->uiInternalFlags, uiValue);
+	}
+	OSSpinLockRelease(psPMR->hBitmapLock, uiLockingFlags);
+
+	return !bIsSet;
+}
+
 static INLINE void
 _FactoryLock(const PMR_IMPL_FUNCTAB *psFuncTable)
 {
@@ -1690,6 +1710,13 @@ PMRLocalImportPMR(PMR *psPMR,
 	return PVRSRV_OK;
 }
 
+#if defined(PVRSRV_ENABLE_GPU_MEMORY_INFO)
+IMG_UINT64 PMRGetSerialNum(PMR *psPMR)
+{
+	return psPMR != NULL ? psPMR->uiSerialNum : (IMG_UINT64) -1ULL;
+}
+#endif
+
 PVRSRV_ERROR
 PMRGetUID(PMR *psPMR,
           IMG_UINT64 *pui64UID)
@@ -2428,6 +2455,11 @@ PMRMMapPMR(PMR *psPMR, PMR_MMAP_DATA pOSMMapData, PVRSRV_MEMALLOCFLAGS_T uiFlags
 	                    !PVRSRV_CHECK_CPU_WRITEABLE(uiFlags),
 	                    PVRSRV_ERROR_PMR_NOT_PERMITTED);
 
+	/* if readable mapping is requested on non-readable PMR then fail */
+	PVR_RETURN_IF_FALSE(PVRSRV_CHECK_CPU_READABLE(psPMR->uiFlags) ||
+	                    !PVRSRV_CHECK_CPU_READABLE(uiFlags),
+	                    PVRSRV_ERROR_PMR_NOT_PERMITTED);
+
 	if (psPMR->psFuncTab->pfnMMap)
 	{
 		return psPMR->psFuncTab->pfnMMap(psPMR->pvFlavourData, psPMR, pOSMMapData);
@@ -2598,6 +2630,27 @@ PMR_IsZombie(const PMR *psPMR)
 }
 #endif /* defined(SUPPORT_PMR_DEFERRED_FREE) */
 
+/* Exclusive flag tracks if the PMR is supporting or is used by another bridge resource */
+
+/* Function to set the exclusive use flag.
+   Returns IMG_FALSE if flag couldn't be set because it is already set.
+   IMG_TRUE otherwise. */
+IMG_BOOL
+PMR_SetExclusiveUse(PMR *psPMR, IMG_BOOL bFlag)
+{
+	PVR_ASSERT(psPMR != NULL);
+
+	if (bFlag)
+	{
+		return _IntFlagSetIfNotSet(psPMR, PMR_FLAG_INTERNAL_IS_EXCLUSIVE);
+	}
+	else
+	{
+		_IntFlagClr(psPMR, PMR_FLAG_INTERNAL_IS_EXCLUSIVE);
+		return IMG_TRUE;
+	}
+}
+
 /* Function that alters the mutability property
  * of the PMR
  * Setting it to TRUE makes sure the PMR memory layout
@@ -2772,6 +2825,19 @@ PMR_GetRefCount(const PMR *psPMR)
 	return OSAtomicRead(&psPMR->iRefCount);
 }
 
+PVRSRV_ERROR
+PMR_IsExportable(const PMR *psPMR)
+{
+	PVR_ASSERT(psPMR != NULL);
+
+	if (!PMR_DeviceNode(psPMR)->pfnValidateExportableFlags(psPMR->uiFlags))
+	{
+		return PVRSRV_ERROR_INVALID_FLAGS;
+	}
+
+	return PVRSRV_OK;
+}
+
 #if defined(PVRSRV_INTERNAL_IPA_FEATURE_TESTING)
 PVRSRV_ERROR
 PMRGetIPAPolicy(PMR *psPMR,
@@ -4319,7 +4385,6 @@ PMRWritePMPageList(/* Target PMR, offset, and length */
 	IMG_DEVMEM_SIZE_T uiWordSize;
 	IMG_UINT32 uiNumPages;
 	IMG_UINT32 uiPageIndex;
-	PMR_FLAGS_T uiFlags = psPageListPMR->uiFlags;
 	PMR_PAGELIST *psPageList;
 #if defined(PDUMP)
 	IMG_CHAR aszTableEntryMemspaceName[PHYSMEM_PDUMP_MEMSPACE_MAX_LENGTH];
@@ -4368,37 +4433,6 @@ PMRWritePMPageList(/* Target PMR, offset, and length */
 	/* Check we're not being asked to write off the end of the PMR */
 	PVR_GOTO_IF_INVALID_PARAM(uiTableOffset + uiTableLength <= psPageListPMR->uiLogicalSize, eError, return_error);
 
-	/* the PMR into which we are writing must not be user CPU mappable: */
-	if (PVRSRV_CHECK_CPU_READABLE(uiFlags) || PVRSRV_CHECK_CPU_WRITEABLE(uiFlags))
-	{
-		PVR_DPF((PVR_DBG_ERROR,
-		         "Masked flags = 0x%" PVRSRV_MEMALLOCFLAGS_FMTSPEC,
-		         (PMR_FLAGS_T)(uiFlags & (PVRSRV_MEMALLOCFLAG_CPU_READABLE | PVRSRV_MEMALLOCFLAG_CPU_WRITEABLE))));
-		PVR_DPF((PVR_DBG_ERROR,
-		         "Page list PMR allows CPU mapping (0x%" PVRSRV_MEMALLOCFLAGS_FMTSPEC ")",
-		         uiFlags));
-		PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_DEVICEMEM_INVALID_PMR_FLAGS, return_error);
-	}
-
-	/* the PMR into which we are writing must not be user CPU cacheable: */
-	if (PVRSRV_CHECK_CPU_CACHE_INCOHERENT(uiFlags) ||
-		PVRSRV_CHECK_CPU_CACHE_COHERENT(uiFlags) ||
-		PVRSRV_CHECK_CPU_CACHED(uiFlags))
-	{
-		PVR_DPF((PVR_DBG_ERROR,
-		         "Masked flags = 0x%" PVRSRV_MEMALLOCFLAGS_FMTSPEC,
-		         (PMR_FLAGS_T)(uiFlags &  PVRSRV_MEMALLOCFLAG_CPU_CACHE_MODE_MASK)));
-		PVR_DPF((PVR_DBG_ERROR,
-		         "Page list PMR allows CPU caching (0x%" PVRSRV_MEMALLOCFLAGS_FMTSPEC ")",
-		         uiFlags));
-		PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_DEVICEMEM_INVALID_PMR_FLAGS, return_error);
-	}
-
-	if (_PMRIsSparse(psPageListPMR))
-	{
-		PVR_LOG_GOTO_WITH_ERROR("psPageListPMR", eError, PVRSRV_ERROR_INVALID_PARAMS, return_error);
-	}
-
 	if (_PMRIsSparse(psReferencePMR))
 	{
 		PVR_LOG_GOTO_WITH_ERROR("psReferencePMR", eError, PVRSRV_ERROR_INVALID_PARAMS, return_error);
diff --git a/drivers/gpu/img-rogue/23.2/services/server/common/pvrsrv.c b/drivers/gpu/img-rogue/23.2/services/server/common/pvrsrv.c
index 86be6ff..f9ac513 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/common/pvrsrv.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/common/pvrsrv.c
@@ -2390,6 +2390,9 @@ PVRSRV_ERROR PVRSRVCommonDeviceCreate(void *pvOSDevice,
 	OSLockCreateNoStats(&psDeviceNode->hValidationLock);
 #endif
 
+#if defined(PVRSRV_MAX_REAL_TIME_CONTEXTS) && (PVRSRV_MAX_REAL_TIME_CONTEXTS > 1)
+	psDeviceNode->pui32RTContextCount = OSAllocZMem(sizeof(IMG_UINT32) * REQ_TYPE_TOTAL_COUNT);
+#endif
 	PVRSRVDeviceSetState(psDeviceNode, PVRSRV_DEVICE_STATE_CREATED);
 
 	return PVRSRV_OK;
@@ -2890,6 +2893,10 @@ void PVRSRVCommonDeviceDestroy(PVRSRV_DEVICE_NODE *psDeviceNode)
 	}
 	SysDevDeInit(psDeviceNode->psDevConfig);
 
+#if defined(PVRSRV_MAX_REAL_TIME_CONTEXTS) && (PVRSRV_MAX_REAL_TIME_CONTEXTS > 1)
+	OSFreeMem(psDeviceNode->pui32RTContextCount);
+#endif
+
 	PVRSRVCleanupThreadWaitForDevice(psDeviceNode);
 
 	OSWRLockAcquireWrite(psPVRSRVData->hDeviceNodeListLock);
diff --git a/drivers/gpu/img-rogue/23.2/services/server/common/ri_server.c b/drivers/gpu/img-rogue/23.2/services/server/common/ri_server.c
index 82a26cb..7c64880 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/common/ri_server.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/common/ri_server.c
@@ -126,7 +126,7 @@ typedef IMG_UINT64 _RI_BASE_T;
                                         "[Physical: 0x%010" IMG_UINT64_FMTSPECx ", %" IMG_UINT64_FMTSPEC "K]\n"
 #define RI_PMR_SUM_BUF_SIZE (sizeof(RI_PMR_SUM_FRMT)+(20+40))
 
-#define RI_PMR_ENTRY_FRMT      "%%sPID:%%-5d DEV:%%s <%%p>\t%%-%ds\t%%-%ds\t0x%%010" IMG_UINT64_FMTSPECx "\t[0x%%010" IMG_UINT64_FMTSPECx "]\t%%c"
+#define RI_PMR_ENTRY_FRMT      "%%sPID:%%-5d DEV:%%s <%%016" IMG_UINT64_FMTSPECx ">\t%%-%ds\t%%-%ds\t0x%%010" IMG_UINT64_FMTSPECx "\t[0x%%010" IMG_UINT64_FMTSPECx "]\t%%c"
 #define RI_PMR_ENTRY_BUF_SIZE  (sizeof(RI_PMR_ENTRY_FRMT)+(3+5+RI_DEV_ID_BUF_SIZE+16+(PVR_ANNOTATION_MAX_LEN/2)+PHYS_HEAP_NAME_SIZE+10+10))
 #define RI_PMR_ENTRY_FRMT_SIZE (sizeof(RI_PMR_ENTRY_FRMT))
 
@@ -1574,7 +1574,7 @@ static void _GeneratePMREntryString(RI_LIST_ENTRY *psRIEntry,
 	           (bDebugFs ? "" : "   "),
 	           psRIEntry->pid,
 	           (bHostDevice ? "-  " : szDeviceID),
-	           (void*)psRIEntry->psPMR,
+	           PMRGetSerialNum(psRIEntry->psPMR),
 	           pszAnnotationText,
 	           pszHeapText,
 	           uiLogicalSize,
diff --git a/drivers/gpu/img-rogue/23.2/services/server/common/srvcore.c b/drivers/gpu/img-rogue/23.2/services/server/common/srvcore.c
index 1571cfc..3566530 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/common/srvcore.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/common/srvcore.c
@@ -959,7 +959,7 @@ PVRSRVHWOpTimeoutKM(CONNECTION_DATA *psConnection,
 }
 
 
-IMG_INT
+size_t
 DummyBW(IMG_UINT32 ui32DispatchTableEntry,
 		IMG_UINT8 *psBridgeIn,
 		IMG_UINT8 *psBridgeOut,
@@ -1332,6 +1332,7 @@ PVRSRV_ERROR BridgedDispatchKM(CONNECTION_DATA * psConnection,
 	BridgeWrapperFunction pfBridgeHandler;
 	IMG_UINT32   ui32DispatchTableEntry, ui32GroupBoundary;
 	PVRSRV_ERROR err = PVRSRV_OK;
+	size_t       uiOutErrorOffset;
 #if !defined(INTEGRITY_OS)
 	PVRSRV_POOL_TOKEN hBridgeBufferPoolToken = NULL;
 #endif
@@ -1481,35 +1482,49 @@ PVRSRV_ERROR BridgedDispatchKM(CONNECTION_DATA * psConnection,
 		PVR_GOTO_WITH_ERROR(err, PVRSRV_ERROR_BRIDGE_EFAULT, unlock_and_return_error);
 	}
 
-	/* pfBridgeHandler functions do not fail and return an IMG_INT.
-	 * The value returned is either 0 or PVRSRV_OK (0).
-	 * In the event this changes an error may be +ve or -ve,
-	 * so try to return something consistent here.
+	/* pfBridgeHandler return an size_t containing the offset to the error code
+	 * in the output buffer.
 	 */
-	if (0 != pfBridgeHandler(ui32DispatchTableEntryIndex,
-						  psBridgeIn,
-						  psBridgeOut,
-						  psConnection)
-		)
-	{
-		PVR_LOG_GOTO_WITH_ERROR("pfBridgeHandler", err, PVRSRV_ERROR_BRIDGE_EPERM, unlock_and_return_error);
-	}
+	uiOutErrorOffset = pfBridgeHandler(ui32DispatchTableEntryIndex,
+							psBridgeIn,
+							psBridgeOut,
+							psConnection);
+
+#if !defined(INTEGRITY_OS)
+	/* The returned offset is expected to be within the range */
+	PVR_ASSERT(uiOutErrorOffset + sizeof(PVRSRV_ERROR) <= psBridgePackageKM->ui32OutBufferSize);
 
 	/*
 	   This should always be true as a.t.m. all bridge calls have to
 	   return an error message, but this could change so we do this
 	   check to be safe.
 	*/
-#if !defined(INTEGRITY_OS)
 	if (psBridgePackageKM->ui32OutBufferSize > 0)
 	{
-		if (CopyToUserWrapper (psConnection,
-						ui32DispatchTableEntryIndex,
-						psBridgePackageKM->pvParamOut,
-						psBridgeOut,
-						psBridgePackageKM->ui32OutBufferSize) != PVRSRV_OK)
+		PVRSRV_ERROR * peHandlerError = (PVRSRV_ERROR *) IMG_OFFSET_ADDR(psBridgeOut, uiOutErrorOffset);
+		if (*peHandlerError != PVRSRV_OK)
 		{
-			PVR_GOTO_WITH_ERROR(err, PVRSRV_ERROR_BRIDGE_EFAULT, unlock_and_return_error);
+			/* Only copy error code to user when pfBridgeHandler fails */
+			if (CopyToUserWrapper (psConnection,
+							ui32DispatchTableEntryIndex,
+							IMG_OFFSET_ADDR_USER(psBridgePackageKM->pvParamOut, uiOutErrorOffset),
+							peHandlerError,
+							sizeof(PVRSRV_ERROR)) != PVRSRV_OK)
+			{
+				PVR_GOTO_WITH_ERROR(err, PVRSRV_ERROR_BRIDGE_EFAULT, unlock_and_return_error);
+			}
+		}
+		else
+		{
+			/* Copy whole output to user when pfBridgeHandler succeeds */
+			if (CopyToUserWrapper (psConnection,
+							ui32DispatchTableEntryIndex,
+							psBridgePackageKM->pvParamOut,
+							psBridgeOut,
+							psBridgePackageKM->ui32OutBufferSize) != PVRSRV_OK)
+			{
+				PVR_GOTO_WITH_ERROR(err, PVRSRV_ERROR_BRIDGE_EFAULT, unlock_and_return_error);
+			}
 		}
 	}
 #endif
diff --git a/drivers/gpu/img-rogue/23.2/services/server/common/sync_checkpoint.c b/drivers/gpu/img-rogue/23.2/services/server/common/sync_checkpoint.c
index 7a22411..2cc6ce7 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/common/sync_checkpoint.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/common/sync_checkpoint.c
@@ -677,6 +677,7 @@ SyncCheckpointResolveFence(PSYNC_CHECKPOINT_CONTEXT psSyncCheckpointContext,
 			}
 
 			SyncCheckpointFreeCheckpointListMem(*papsSyncCheckpoints);
+			*papsSyncCheckpoints = NULL;
 		}
 
 		return PVRSRV_ERROR_INVALID_PARAMS;
diff --git a/drivers/gpu/img-rogue/23.2/services/server/common/tlserver.c b/drivers/gpu/img-rogue/23.2/services/server/common/tlserver.c
index 1a16ed5..85b9e5f 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/common/tlserver.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/common/tlserver.c
@@ -337,8 +337,6 @@ TLServerCloseStreamKM(PTL_STREAM_DESC psSD)
 		psStream->pfOnReaderCloseCallback(psStream->pvOnReaderCloseUserData);
 	}
 
-	OSLockRelease (psGD->hTLGDLock);
-
 	/* Destroy the stream if its TL_SNODE was removed from TL_GLOBAL_DATA */
 	if (bDestroyStream)
 	{
@@ -355,6 +353,8 @@ TLServerCloseStreamKM(PTL_STREAM_DESC psSD)
 		OSFreeMem(psSD);
 	}
 
+	OSLockRelease (psGD->hTLGDLock);
+
 	PVR_DPF_RETURN_RC(eError);
 }
 
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/rgxfwcmnctx.c b/drivers/gpu/img-rogue/23.2/services/server/devices/rgxfwcmnctx.c
index dc39be0..12424d0 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/rgxfwcmnctx.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/rgxfwcmnctx.c
@@ -96,11 +96,15 @@ static PVRSRV_ERROR _CheckPriority(PVRSRV_RGXDEV_INFO *psDevInfo,
 								   IMG_INT32 i32Priority,
 								   RGX_CCB_REQUESTOR_TYPE eRequestor)
 {
+	PVRSRV_ERROR eError = PVRSRV_OK;
+
 	/* Only contexts from a single PID allowed with real time priority (highest priority) */
 	if (i32Priority == RGX_CTX_PRIORITY_REALTIME)
 	{
 		DLLIST_NODE *psNode, *psNext;
 
+		OSWRLockAcquireRead(psDevInfo->hCommonCtxtListLock);
+
 		dllist_foreach_node(&psDevInfo->sCommonCtxtListHead, psNode, psNext)
 		{
 			RGX_SERVER_COMMON_CONTEXT *psThisContext =
@@ -108,15 +112,28 @@ static PVRSRV_ERROR _CheckPriority(PVRSRV_RGXDEV_INFO *psDevInfo,
 
 			if (psThisContext->i32Priority == RGX_CTX_PRIORITY_REALTIME &&
 				psThisContext->eRequestor == eRequestor &&
+#if defined(PVRSRV_MAX_REAL_TIME_CONTEXTS) && (PVRSRV_MAX_REAL_TIME_CONTEXTS > 1)
+				(psDevInfo->psDeviceNode->pui32RTContextCount == NULL ||
+				 psDevInfo->psDeviceNode->pui32RTContextCount[eRequestor] >= PVRSRV_MAX_REAL_TIME_CONTEXTS) &&
+#endif
 				RGXGetPIDFromServerMMUContext(psThisContext->psServerMMUContext) != OSGetCurrentClientProcessIDKM())
 			{
+#if defined(PVRSRV_MAX_REAL_TIME_CONTEXTS) && (PVRSRV_MAX_REAL_TIME_CONTEXTS > 1)
+				PVR_LOG(("Only %d process can have contexts with real time priority", PVRSRV_MAX_REAL_TIME_CONTEXTS));
+#else
 				PVR_LOG(("Only one process can have contexts with real time priority"));
-				return PVRSRV_ERROR_INVALID_PARAMS;
+#endif
+				eError = PVRSRV_ERROR_INVALID_PARAMS;
+				break;
 			}
 		}
+#if defined(PVRSRV_MAX_REAL_TIME_CONTEXTS) && (PVRSRV_MAX_REAL_TIME_CONTEXTS > 1)
+		psDevInfo->psDeviceNode->pui32RTContextCount[eRequestor]++;
+#endif
+		OSWRLockReleaseRead(psDevInfo->hCommonCtxtListLock);
 	}
 
-	return PVRSRV_OK;
+	return eError;
 }
 
 PVRSRV_ERROR FWCommonContextAllocate(CONNECTION_DATA *psConnection,
@@ -155,7 +172,19 @@ PVRSRV_ERROR FWCommonContextAllocate(CONNECTION_DATA *psConnection,
 	}
 
 	psServerCommonContext->psDevInfo = psDevInfo;
-	psServerCommonContext->psServerMMUContext = psServerMMUContext;
+
+	if (psServerMMUContext != NULL)
+	{
+		eError = RGXServerMMUContextRef(psServerMMUContext);
+		PVR_LOG_GOTO_IF_ERROR(eError, "RGXServerMMUContextRef", fail_contextalloc);
+
+		psServerCommonContext->psServerMMUContext = psServerMMUContext;
+	}
+	else
+	{
+		psServerCommonContext->psServerMMUContext = NULL;
+	}
+
 
 	if (psAllocatedMemDesc)
 	{
@@ -403,6 +432,12 @@ void FWCommonContextFree(RGX_SERVER_COMMON_CONTEXT *psServerCommonContext)
 	OSWRLockAcquireWrite(psServerCommonContext->psDevInfo->hCommonCtxtListLock);
 	/* Remove the context from the list of all contexts. */
 	dllist_remove_node(&psServerCommonContext->sListNode);
+#if defined(PVRSRV_MAX_REAL_TIME_CONTEXTS) && (PVRSRV_MAX_REAL_TIME_CONTEXTS > 1)
+	if (psServerCommonContext->i32Priority == RGX_CTX_PRIORITY_REALTIME)
+	{
+		psServerCommonContext->psDevInfo->psDeviceNode->pui32RTContextCount[psServerCommonContext->eRequestor]--;
+	}
+#endif
 	OSWRLockReleaseWrite(psServerCommonContext->psDevInfo->hCommonCtxtListLock);
 
 	/*
@@ -438,6 +473,12 @@ void FWCommonContextFree(RGX_SERVER_COMMON_CONTEXT *psServerCommonContext)
 						psServerCommonContext->psFWCommonContextMemDesc);
 		psServerCommonContext->psFWCommonContextMemDesc = NULL;
 	}
+
+	if (psServerCommonContext->psServerMMUContext != NULL)
+	{
+		RGXServerMMUContextUnref(psServerCommonContext->psServerMMUContext);
+	}
+
 	/* Free the hosts representation of the common context */
 	OSFreeMem(psServerCommonContext);
 }
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/rgxmem.c b/drivers/gpu/img-rogue/23.2/services/server/devices/rgxmem.c
index d9aa6ad..1478847 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/rgxmem.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/rgxmem.c
@@ -47,6 +47,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "devicemem.h"
 #include "devicemem_server_utils.h"
 #include "devicemem_pdump.h"
+#include "pvrsrv_memallocflags.h"
 #include "rgxdevice.h"
 #include "rgx_fwif_km.h"
 #include "rgxfwutils.h"
@@ -75,6 +76,7 @@ struct SERVER_MMU_CONTEXT_TAG
 	IMG_UINT64 ui64FBSCEntryMask;
 	DLLIST_NODE sNode;
 	PVRSRV_RGXDEV_INFO *psDevInfo;
+	DEVMEMINT_CTX *psDevMemCtx;
 }; /* SERVER_MMU_CONTEXT is typedef-ed in rgxmem.h */
 
 PVRSRV_ERROR RGXInvalidateFBSCTable(PVRSRV_DEVICE_NODE *psDeviceNode,
@@ -530,12 +532,23 @@ void RGXUnregisterMemoryContext(IMG_HANDLE hPrivData)
 	OSFreeMem(psServerMMUContext);
 }
 
+IMG_BOOL RGXValidateExportableFlags(PVRSRV_MEMALLOCFLAGS_T uiFlags)
+{
+	if (uiFlags & PVRSRV_MEMALLOCFLAG_DEVICE_FLAG(PMMETA_PROTECT))
+	{
+		return IMG_FALSE;
+	}
+
+	return IMG_TRUE;
+}
+
 /*
  * RGXRegisterMemoryContext
  */
-PVRSRV_ERROR RGXRegisterMemoryContext(PVRSRV_DEVICE_NODE	*psDeviceNode,
-									  MMU_CONTEXT			*psMMUContext,
-									  IMG_HANDLE			*hPrivData)
+PVRSRV_ERROR RGXRegisterMemoryContext(PVRSRV_DEVICE_NODE *psDeviceNode,
+									  MMU_CONTEXT *psMMUContext,
+									  DEVMEMINT_CTX *psDevMemCtx,
+									  IMG_HANDLE *hPrivData)
 {
 	PVRSRV_ERROR			eError;
 	PVRSRV_RGXDEV_INFO		*psDevInfo = psDeviceNode->pvDevice;
@@ -543,6 +556,8 @@ PVRSRV_ERROR RGXRegisterMemoryContext(PVRSRV_DEVICE_NODE	*psDeviceNode,
 	DEVMEM_MEMDESC			*psFWMemContextMemDesc;
 	SERVER_MMU_CONTEXT *psServerMMUContext;
 
+	PVR_ASSERT(psDevMemCtx != NULL);
+
 	if (psDevInfo->psKernelMMUCtx == NULL)
 	{
 		/*
@@ -563,6 +578,7 @@ PVRSRV_ERROR RGXRegisterMemoryContext(PVRSRV_DEVICE_NODE	*psDeviceNode,
 		psServerMMUContext->psDevInfo = psDevInfo;
 		psServerMMUContext->ui64FBSCEntryMask = 0;
 		psServerMMUContext->sFWMemContextDevVirtAddr.ui32Addr = 0;
+		psServerMMUContext->psDevMemCtx = psDevMemCtx;
 
 		/*
 			Allocate device memory for the firmware memory context for the new
@@ -732,6 +748,18 @@ PVRSRV_ERROR RGXRegisterMemoryContext(PVRSRV_DEVICE_NODE	*psDeviceNode,
 	return eError;
 }
 
+PVRSRV_ERROR RGXServerMMUContextRef(SERVER_MMU_CONTEXT *psServerMMUContext)
+{
+	PVR_ASSERT(psServerMMUContext != NULL);
+	return DevmemIntCtxRef(psServerMMUContext->psDevMemCtx);
+}
+
+void RGXServerMMUContextUnref(SERVER_MMU_CONTEXT *psServerMMUContext)
+{
+	PVR_ASSERT(psServerMMUContext != NULL);
+	DevmemIntCtxUnref(psServerMMUContext->psDevMemCtx);
+}
+
 DEVMEM_MEMDESC *RGXGetFWMemDescFromMemoryContextHandle(IMG_HANDLE hPriv)
 {
 	SERVER_MMU_CONTEXT *psMMUContext = (SERVER_MMU_CONTEXT *) hPriv;
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/rgxmem.h b/drivers/gpu/img-rogue/23.2/services/server/devices/rgxmem.h
index 2e959fc..595e181 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/rgxmem.h
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/rgxmem.h
@@ -47,6 +47,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "pvrsrv_error.h"
 #include "device.h"
 #include "mmu_common.h"
+#include "devicemem_server.h"
 #include "rgxdevice.h"
 
 #define RGXMEM_SERVER_MMU_CONTEXT_MAX_NAME 16
@@ -66,6 +67,43 @@ typedef struct _RGXMEM_PROCESS_INFO_
 
 typedef struct SERVER_MMU_CONTEXT_TAG SERVER_MMU_CONTEXT;
 
+/*************************************************************************/ /*!
+@Function       RGXServerMMUContextRef
+
+@Description    Increments the reference count on the SERVER_MMU_CONTEXT by one.
+
+                Use this function to prevent the SERVER_MMU_CONTEXT being freed
+                until RGXServerMMUContextUnref is called.
+
+                You should call this function if:
+                 1. You are making use of the SERVER_MMU_CONTEXT and this function
+                    hasn't been called previously in the callstack.
+                 2. You are setting pointer to a SERVER_MMU_CONTEXT into another
+                    object.
+
+                RGXServerMMUContextUnref must be called once the object is no
+                longer going to be read or written to in the current callstack.
+
+@Input          psServerMMUContext  The SERVER_MMU_CONTEXT to be reference counted.
+
+@Return         PVRSRV_ERROR
+*/ /**************************************************************************/
+PVRSRV_ERROR RGXServerMMUContextRef(SERVER_MMU_CONTEXT *psServerMMUContext);
+
+/*************************************************************************/ /*!
+@Function       RGXServerMMUContextUnref
+
+@Description    Decreases the reference count on the SERVER_MMU_CONTEXT by one.
+
+                This should be always called after RGXServerMMUContextRef, once
+                the SERVER_MMU_CONTEXT is no longer being read from or written to.
+
+@Input          psServerMMUContext  The SERVER_MMU_CONTEXT to be reference counted.
+
+@Return         PVRSRV_ERROR
+*/ /**************************************************************************/
+void RGXServerMMUContextUnref(SERVER_MMU_CONTEXT *psServerMMUContext);
+
 IMG_DEV_PHYADDR GetPC(MMU_CONTEXT * psContext);
 
 void RGXSetFWMemContextDevVirtAddr(SERVER_MMU_CONTEXT *psServerMMUContext,
@@ -135,12 +173,25 @@ void RGXMMUTweakProtFlags(struct _PVRSRV_DEVICE_NODE_ *psDevNode,
 #endif
 
 void RGXUnregisterMemoryContext(IMG_HANDLE hPrivData);
-PVRSRV_ERROR RGXRegisterMemoryContext(PVRSRV_DEVICE_NODE	*psDevNode,
-									  MMU_CONTEXT			*psMMUContext,
-									  IMG_HANDLE			*hPrivData);
+PVRSRV_ERROR RGXRegisterMemoryContext(PVRSRV_DEVICE_NODE *psDevNode,
+									  MMU_CONTEXT *psMMUContext,
+									  DEVMEMINT_CTX *psDevMemCtx,
+									  IMG_HANDLE *hPrivData);
 
 DEVMEM_MEMDESC *RGXGetFWMemDescFromMemoryContextHandle(IMG_HANDLE hPriv);
 
+/*************************************************************************/ /*!
+@Function       RGXValidateExportableFlags
+
+@Description    Checks if a memory resource with the given flags can be exported
+                out of the driver and/or process.
+
+@Input          uiFlags      Memory allocation flags.
+
+@Return         IMG_TRUE if export is allowed, IMG_FALSE otherwise.
+*/ /**************************************************************************/
+IMG_BOOL RGXValidateExportableFlags(PVRSRV_MEMALLOCFLAGS_T uiFlags);
+
 void RGXCheckFaultAddress(PVRSRV_RGXDEV_INFO *psDevInfo,
 				IMG_DEV_VIRTADDR *psDevVAddr,
 				IMG_DEV_PHYADDR *psDevPAddr,
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/rgxutils.c b/drivers/gpu/img-rogue/23.2/services/server/devices/rgxutils.c
index 75222ae..f0b85cb 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/rgxutils.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/rgxutils.c
@@ -52,6 +52,8 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "sync_internal.h"
 #include "rgxfwutils.h"
 #include "rgxlayer.h"
+#include "rgxmmudefs_km.h"
+#include "rgxta3d.h"
 
 PVRSRV_ERROR RGXQueryAPMState(const PVRSRV_DEVICE_NODE *psDeviceNode,
 	const void *pvPrivateData,
@@ -301,6 +303,272 @@ IMG_BOOL RGXIsErrorAndDeviceRecoverable(PVRSRV_DEVICE_NODE *psDeviceNode, PVRSRV
 	return bRecoverable;
 }
 
+/*
+ *  Function that returns the MList Size required for a given max PB size.
+ *
+ *  The maximum MList size required always depends on the maximum PB Size
+ *  chosen and must also take into account the additional pages that will
+ *  be provided by a local PB.
+ */
+IMG_UINT32 RGXCalcMListSize(PVRSRV_DEVICE_NODE *psDeviceNode,
+                            IMG_UINT64 ui64MaxLocalPBSize,
+                            IMG_UINT64 ui64MaxGlobalPBSize)
+{
+	IMG_UINT32  ui32PTEPages = 0, ui32PDEPages = 0, ui32PCEPages = 0, ui32MListSize = 0;
+	IMG_UINT32  ui32NumOfPipes = 1;
+	IMG_UINT64  ui64TotalPages = 0;
+	PVRSRV_RGXDEV_INFO *psDevInfo = psDeviceNode->pvDevice;
+	PVR_UNREFERENCED_PARAMETER(psDevInfo);
+	/*
+	 *  Assert if Size of PB exceeds maximum theoretical limit
+	 *  RGX_PM_MAX_PB_VIRT_ADDR_SPACE represents the 16G address space#
+	 */
+	PVR_ASSERT(ui64MaxLocalPBSize+ui64MaxGlobalPBSize <= RGX_PM_MAX_PB_VIRT_ADDR_SPACE);
+
+	/* Calculate the total number of pages which is the number of Page table entries */
+	ui64TotalPages = ((ui64MaxLocalPBSize+ui64MaxGlobalPBSize)/RGX_BIF_PM_PHYSICAL_PAGE_SIZE);
+
+	/* Calculate the total number of pages required for the PTE's (minimum of 1) */
+	ui32PTEPages = (IMG_UINT32)(ui64TotalPages/RGX_MMUCTRL_ENTRIES_PT_VALUE);
+	if (ui32PTEPages == 0U)
+	{
+		ui32PTEPages = 1;
+	}
+
+	/* Calculate the total number of pages required to hold the PDE's (minimum of 1) */
+	ui32PDEPages = ui32PTEPages/RGX_MMUCTRL_ENTRIES_PD_VALUE;
+	if (ui32PDEPages == 0U)
+	{
+		ui32PDEPages = 1;
+	}
+
+	/* Calculate the total number of pages required to hold the PCE's (minimum of 1) */
+	ui32PCEPages = ui32PDEPages/RGX_MMUCTRL_ENTRIES_PC_VALUE;
+	if (ui32PCEPages == 0U)
+	{
+		ui32PCEPages = 1;
+	}
+
+	/* Calculate the maximum number of TA/VCE pipes */
+#if defined(RGX_FEATURE_SCALABLE_TE_ARCH_IDX)
+	{
+		IMG_UINT32 ui32Val = RGX_GET_FEATURE_VALUE(psDevInfo, RGX_FEATURE_SCALABLE_TE_ARCH);
+		if (ui32Val > ui32NumOfPipes)
+		{
+			ui32NumOfPipes = ui32Val;
+		}
+	}
+#endif
+
+#if defined(RGX_FEATURE_SCALABLE_TE_ARCH_IDX)
+	{
+		IMG_UINT32 ui32Val = RGX_GET_FEATURE_VALUE(psDevInfo, RGX_FEATURE_SCALABLE_VCE);
+		if (ui32Val > ui32NumOfPipes)
+		{
+			ui32NumOfPipes = ui32Val;
+		}
+	}
+#endif
+
+	/*
+	 *  Calculate the MList size considering the total number of pages in PB are shared
+	 *  among all the PM address spaces...
+	 */
+	ui32MListSize = (ui32PCEPages + ui32PDEPages + ui32PTEPages) *
+					RGX_NUM_PM_ADDR_SPACES * ui32NumOfPipes * RGX_MLIST_ENTRY_STRIDE;
+
+	/* Round it off to the nearest page granularity */
+	ui32MListSize = PVR_ALIGN(ui32MListSize, RGX_BIF_PM_PHYSICAL_PAGE_SIZE);
+
+	return ui32MListSize;
+}
+
+/*
+ * Critical PMRs are PMRs that are created by client that might contain physical page addresses.
+ * We need to validate if they were allocated with proper flags. 
+ */
+static PVRSRV_ERROR
+_ValidateCriticalPMR(PMR* psPMR, IMG_DEVMEM_SIZE_T ui64MinSize)
+{
+	PVRSRV_ERROR eError;
+	PVRSRV_DEVICE_NODE *psDevNode = PMR_DeviceNode(psPMR);
+
+	IMG_BOOL bCPUCacheSnoop =
+		(PVRSRVSystemSnoopingOfCPUCache(psDevNode->psDevConfig) &&
+		 psDevNode->pfnGetDeviceSnoopMode(psDevNode) == PVRSRV_DEVICE_SNOOP_CPU_ONLY);
+
+	PMR_FLAGS_T uiFlags = PMR_Flags(psPMR);
+
+	if (PMR_IsSparse(psPMR))
+	{
+		PVR_DPF((PVR_DBG_ERROR,
+		         "%s: Critical PMR cannot be sparse!",
+		         __func__));
+		PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_INVALID_PARAMS, return_error);
+	}
+
+	/* Critical PMR cannot be user CPU mappable */
+	if (PVRSRV_CHECK_CPU_READABLE(uiFlags) ||
+	    PVRSRV_CHECK_CPU_WRITEABLE(uiFlags))
+	{
+		PVR_DPF((PVR_DBG_ERROR,
+		         "%s: Critical PMR allows CPU mapping (0x%" PVRSRV_MEMALLOCFLAGS_FMTSPEC ")",
+		         __func__, uiFlags));
+		PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_DEVICEMEM_INVALID_PMR_FLAGS, return_error);
+	}
+
+	/* Critical PMR must not be user CPU cacheable (unless snooping is on) */
+	if (!bCPUCacheSnoop &&
+	    (PVRSRV_CHECK_CPU_CACHE_INCOHERENT(uiFlags) ||
+	     PVRSRV_CHECK_CPU_CACHE_COHERENT(uiFlags) ||
+	     PVRSRV_CHECK_CPU_CACHED(uiFlags)))
+	{
+		PVR_DPF((PVR_DBG_ERROR,
+		         "%s: Critical PMR allows CPU caching (0x%" PVRSRV_MEMALLOCFLAGS_FMTSPEC ")",
+		         __func__, uiFlags));
+		PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_DEVICEMEM_INVALID_PMR_FLAGS, return_error);
+	}
+
+	/* Critical PMRs must be allocated with PMMETA_PROTECT */
+	if ((uiFlags & PVRSRV_MEMALLOCFLAG_DEVICE_FLAG(PMMETA_PROTECT)) == 0)
+	{
+		PVR_DPF((PVR_DBG_ERROR,
+		        "%s: Critical PMR must have PMMETA_PROTECT set",
+		        __func__));
+		PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_DEVICEMEM_INVALID_PMR_FLAGS, return_error);
+	}
+
+#if defined(SUPPORT_LINUX_OSPAGE_MIGRATION)
+	if (PVRSRV_CHECK_OS_LINUX_MOVABLE(uiFlags))
+	{
+		PVR_DPF((PVR_DBG_ERROR,
+		        "%s: Critical PMR must not have OS_LINUX_MOVABLE set",
+		        __func__));
+		PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_DEVICEMEM_INVALID_PMR_FLAGS, return_error);
+	}
+#endif
+
+	{
+		IMG_DEVMEM_SIZE_T uiPMRSize;
+		PMR_LogicalSize(psPMR, &uiPMRSize);
+		if (uiPMRSize < ui64MinSize)
+		{
+			PVR_DPF((PVR_DBG_ERROR,
+					"%s: Critical PMR doesn't have sufficient size",
+					__func__));
+			PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_INVALID_PARAMS, return_error);
+		}
+	}
+	return PVRSRV_OK;
+return_error:
+	return eError;
+}
+
+/* Check if all global freelists have the same size and if all local freelists have the same size.*/
+PVRSRV_ERROR ValidateFreeListSizes(RGX_FREELIST* apsFreeLists[RGXMKIF_NUM_RTDATA_FREELISTS],
+                                   IMG_UINT32*   pui32LocalFLMaxPages,
+                                   IMG_UINT32*   pui32GlobalFLMaxPages)
+{
+	IMG_UINT32 i,j;
+	PVRSRV_ERROR eError = PVRSRV_OK;
+	IMG_UINT32 ui32GlobalFLMaxPages = apsFreeLists[RGXFW_GLOBAL_FREELIST]->ui32MaxFLPages;
+	IMG_UINT32 ui32LocalFLMaxPages = apsFreeLists[RGXFW_LOCAL_FREELIST]->ui32MaxFLPages;
+	IMG_UINT32 ui32NumFLPerGD = RGXMKIF_NUM_RTDATA_FREELISTS/RGXMKIF_NUM_GEOMDATAS;
+
+	for (i=0; i<RGXMKIF_NUM_GEOMDATAS; i++)
+	{
+		/* Check if all local freelists have the same size */
+		if (apsFreeLists[ui32NumFLPerGD * i + RGXFW_LOCAL_FREELIST]->ui32MaxFLPages != ui32LocalFLMaxPages)
+		{
+			eError = PVRSRV_ERROR_INVALID_PARAMS;
+		}
+
+		/* Check if all global freelists have the same size */
+		for (j=RGXFW_GLOBAL_FREELIST; j<ui32NumFLPerGD; j++)
+		{
+			if (apsFreeLists[ui32NumFLPerGD * i + j]->ui32MaxFLPages != ui32GlobalFLMaxPages)
+			{
+				eError = PVRSRV_ERROR_INVALID_PARAMS;
+			}
+		}
+	}
+
+	*pui32LocalFLMaxPages = ui32LocalFLMaxPages;
+	*pui32GlobalFLMaxPages = ui32GlobalFLMaxPages;
+
+	return eError;
+}
+
+PVRSRV_ERROR
+AcquireValidateRefCriticalBuffer(PVRSRV_DEVICE_NODE*     psDevNode,
+                                 DEVMEMINT_RESERVATION2* psReservation,
+                                 IMG_DEVMEM_SIZE_T       ui64MinSize,
+                                 PMR**                   ppsPMR,
+                                 IMG_DEV_VIRTADDR*       psDevVAddr)
+{
+	PVRSRV_ERROR eError;
+
+	/* Obtain reference to reservation object */
+	if (!DevmemIntReservationAcquire(psReservation))
+	{
+		eError = PVRSRV_ERROR_REFCOUNT_OVERFLOW;
+		PVR_LOG_GOTO_IF_ERROR_VA(eError, ReturnError,
+		    "%s: Failed to acquire reservation for critical buffer", __func__);
+	}
+
+	eError = DevmemIntGetReservationData(psReservation, ppsPMR, psDevVAddr);
+	PVR_LOG_GOTO_IF_ERROR_VA(eError, RollbackReservation,
+	    "%s: Error from DevmemIntGetReservationData for critical buffer: %s",
+	    __func__, PVRSRVGetErrorString(eError));
+
+
+	/* Check buffer sizes and flags are as required */
+	eError = _ValidateCriticalPMR(*ppsPMR, ui64MinSize);
+	PVR_LOG_GOTO_IF_ERROR_VA(eError, RollbackReservation,
+	    "%s: Validation of critical PMR failed: %s",
+	    __func__, PVRSRVGetErrorString(eError));
+
+	/* Check exclusive flag and set if possible */
+	if (!PMR_SetExclusiveUse(*ppsPMR, IMG_TRUE))
+	{
+		PVR_DPF((PVR_DBG_ERROR,
+		     "%s: Critical PMR already in use (exclusive flag)!",
+		     __func__));
+		PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_INVALID_PARAMS, RollbackReservation);
+	}
+
+	/* If no error on validation ref the PMR */
+	(void) PMRRefPMR(*ppsPMR);
+
+	return PVRSRV_OK;
+
+RollbackReservation:
+	DevmemIntReservationRelease(psReservation);
+ReturnError:
+	return eError;
+}
+
+void UnrefAndReleaseCriticalBuffer(DEVMEMINT_RESERVATION2* psReservation)
+{
+	PVRSRV_ERROR eError;
+	PMR* psPMR;
+	IMG_DEV_VIRTADDR sDummy;
+	/* Skip error check. If this function is called it means we already
+	   Acquired a reservation and confirmed that mapping exists. */
+	eError = DevmemIntGetReservationData(psReservation, &psPMR, &sDummy);
+	PVR_LOG_IF_ERROR_VA(PVR_DBG_ERROR, eError,
+	    "Error when trying to obtain reservation data in %s", __func__);
+
+	/* Ignore return value. Clearing the flag cannot fail. */
+	PMR_SetExclusiveUse(psPMR, IMG_FALSE);
+
+	eError = PMRUnrefPMR(psPMR);
+	PVR_LOG_IF_ERROR_VA(PVR_DBG_ERROR, eError, 
+	    "Error on PMR unref in %s", __func__);
+
+	DevmemIntReservationRelease(psReservation);
+}
+
 /******************************************************************************
  End of file (rgxutils.c)
 ******************************************************************************/
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/rgxutils.h b/drivers/gpu/img-rogue/23.2/services/server/devices/rgxutils.h
index 67d4bb8..6454970 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/rgxutils.h
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/rgxutils.h
@@ -46,6 +46,8 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "rgxdebug_common.h"
 #include "pvr_notifier.h"
 #include "pvrsrv.h"
+#include "pvrsrv_error.h"
+#include "rgxta3d.h"
 
 /*!
 ******************************************************************************
@@ -206,6 +208,68 @@ PHYS_HEAP_POLICY RGXPhysHeapGetLMAPolicy(PHYS_HEAP_USAGE_FLAGS ui32UsageFlags);
 */ /**************************************************************************/
 IMG_BOOL RGXIsErrorAndDeviceRecoverable(PVRSRV_DEVICE_NODE *psDeviceNode, PVRSRV_ERROR *peError);
 
+/*************************************************************************/ /*!
+@Function       RGXCalcMListSize
+@Description    Function that calculates the MList Size required for
+                given local and global PB sizes.
+@Input          psDeviceNode The device node.
+@Input          ui64MaxLocalPBSize Maximum local PB size in bytes
+@Input          ui64MaxGlobalPBSize Maximum global PB size in bytes
+
+@Return         IMG_UINT32 Returns size of the mlist in bytes aligned to
+                RGX_BIF_PM_PHYSICAL_PAGE_SIZE.
+*/ /**************************************************************************/
+IMG_UINT32 RGXCalcMListSize(PVRSRV_DEVICE_NODE *psDeviceNode,
+                            IMG_UINT64 ui64MaxLocalPBSize,
+                            IMG_UINT64 ui64MaxGlobalPBSize);
+
+/*************************************************************************/ /*!
+@Function       ValidateFreeListSizes
+@Description    Helper function for RGXCreateHWRTDataSet
+                For the freelist array passed to RGXCreateHWRTDataSet, validate
+                if all global freelists have the same size and if all local
+                freelists have the same size. Return the sizes in output params.
+
+@Output         pui32LocalFLMaxPages Max number of pages for local freelist
+@Output         pui32GlobalFLMaxPages Max number of pages for global freelist
+
+@Return         PVRSRV_ERROR PVRSRV_OK if validation successful.
+                Appropriate error otherwise.
+*/ /**************************************************************************/
+PVRSRV_ERROR ValidateFreeListSizes(RGX_FREELIST* apsFreeLists[RGXMKIF_NUM_RTDATA_FREELISTS],
+                                   IMG_UINT32*   pui32LocalFLMaxPages,
+                                   IMG_UINT32*   pui32GlobalFLMaxPages);
+
+/*************************************************************************/ /*!
+@Function       AcquireValidateRefCriticalBuffer
+@Description    Helper function for RGXCreateHWRTDataSet
+                Acquire the reservation validate if the underlying PMR is
+                appropriate for use as critical buffer and ref it.
+@Input          psDevNode The device node.
+@Input          psReservation The reservation describing the critical buffer
+@Input          ui64MinSize Minimum size that buffer needs to have
+@Output         ppsPMR Pointer to be written with the PMR on success.
+@Output         psDevVAddr The device vaddress to be written on success.
+
+@Return         PVRSRV_ERROR PVRSRV_OK if validation successful.
+                Appropriate error otherwise.
+*/ /**************************************************************************/
+PVRSRV_ERROR AcquireValidateRefCriticalBuffer(PVRSRV_DEVICE_NODE*     psDevNode,
+                                              DEVMEMINT_RESERVATION2* psReservation,
+                                              IMG_DEVMEM_SIZE_T       ui64MinSize,
+                                              PMR**                   ppsPMR,
+                                              IMG_DEV_VIRTADDR*       psDevVAddr);
+
+
+/*************************************************************************/ /*!
+@Function       UnrefAndReleaseCriticalBuffer
+@Description    Helper function for RGXCreateHWRTDataSet
+                Unref the critical buffer and release the reservation object.
+@Input          psReservation The reservation describing the critical buffer
+
+*/ /**************************************************************************/
+void UnrefAndReleaseCriticalBuffer(DEVMEMINT_RESERVATION2* psReservation);
+
 /******************************************************************************
  End of file (rgxutils.h)
 ******************************************************************************/
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxhwperf.c b/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxhwperf.c
index 1bb4e42..1515c72 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxhwperf.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxhwperf.c
@@ -1015,7 +1015,7 @@ PVRSRV_ERROR PVRSRVRGXGetEnabledHWPerfBlocks(PVRSRV_DEVICE_NODE *psDevNode,
 				continue;
 			}
 
-			if (ui32LastIdx > ui32ArrayLen)
+			if (ui32LastIdx + 1 > ui32ArrayLen)
 			{
 				PVR_DPF((PVR_DBG_ERROR, "ui32ArrayLen less than the number of enabled blocks."));
 				PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_OUT_OF_MEMORY, Error);
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxinit.c b/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxinit.c
index b10712b..fec3f2a 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxinit.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxinit.c
@@ -1310,6 +1310,26 @@ static MMU_DEVICEATTRIBS *RGXDevMMUAttributes(PVRSRV_DEVICE_NODE *psDeviceNode,
 }
 
 /*
+	RGXDevSnoopMode
+*/
+static PVRSRV_DEVICE_SNOOP_MODE RGXDevSnoopMode(PVRSRV_DEVICE_NODE *psDeviceNode)
+{
+	PVRSRV_RGXDEV_INFO *psDevInfo;
+
+	PVR_ASSERT(psDeviceNode != NULL);
+	PVR_ASSERT(psDeviceNode->pvDevice != NULL);
+
+	psDevInfo = (PVRSRV_RGXDEV_INFO *) psDeviceNode->pvDevice;
+
+	if (RGX_IS_FEATURE_SUPPORTED(psDevInfo, AXI_ACELITE))
+	{
+		return PVRSRV_DEVICE_SNOOP_CPU_ONLY;
+	}
+
+	return PVRSRV_DEVICE_SNOOP_NONE;
+}
+
+/*
  * RGXInitDevPart2
  */
 PVRSRV_ERROR RGXInitDevPart2(PVRSRV_DEVICE_NODE	*psDeviceNode,
@@ -1775,6 +1795,7 @@ PVRSRV_ERROR RGXInitCreateFWKernelMemoryContext(PVRSRV_DEVICE_NODE *psDeviceNode
 	/* Register callbacks for creation of device memory contexts */
 	psDeviceNode->pfnRegisterMemoryContext = RGXRegisterMemoryContext;
 	psDeviceNode->pfnUnregisterMemoryContext = RGXUnregisterMemoryContext;
+	psDeviceNode->pfnValidateExportableFlags = RGXValidateExportableFlags;
 
 	RGXFwSharedMemCheckSnoopMode(psDevInfo->psDeviceNode->psDevConfig);
 
@@ -4600,6 +4621,7 @@ PVRSRV_ERROR RGXRegisterDevice(PVRSRV_DEVICE_NODE *psDeviceNode)
 
 	/* Callback for getting the MMU device attributes */
 	psDeviceNode->pfnGetMMUDeviceAttributes = RGXDevMMUAttributes;
+	psDeviceNode->pfnGetDeviceSnoopMode = RGXDevSnoopMode;
 	psDeviceNode->pfnMMUCacheInvalidate = RGXMMUCacheInvalidate;
 	psDeviceNode->pfnMMUCacheInvalidateKick = RGXMMUCacheInvalidateKick;
 	psDeviceNode->pfnMMUTopLevelPxWorkarounds = NULL;
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxta3d.c b/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxta3d.c
index 615ab5f..828a26e 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxta3d.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxta3d.c
@@ -90,10 +90,11 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 #if defined(SUPPORT_WORKLOAD_ESTIMATION)
 #include "rgxworkest.h"
-
 #define HASH_CLEAN_LIMIT 6
 #endif
 
+#include "rgxmmudefs_km.h"
+
 /* Enable this to dump the compiled list of UFOs prior to kick call */
 #define ENABLE_TA3D_UFO_DUMP	0
 
@@ -1513,21 +1514,108 @@ PVRSRV_ERROR RGXCreateHWRTDataSet(CONNECTION_DATA      *psConnection,
 		IMG_UINT16			ui16MaxRTs,
 		RGX_KM_HW_RT_DATASET *pasKMHWRTDataSet[RGXMKIF_NUM_RTDATAS])
 {
+	PVR_UNREFERENCED_PARAMETER(psConnection);
+	PVR_UNREFERENCED_PARAMETER(psDeviceNode);
+	PVR_UNREFERENCED_PARAMETER(asVHeapTableDevVAddr);
+	PVR_UNREFERENCED_PARAMETER(asPMMListDevVAddr);
+	PVR_UNREFERENCED_PARAMETER(apsFreeLists);
+	PVR_UNREFERENCED_PARAMETER(ui32ScreenPixelMax);
+	PVR_UNREFERENCED_PARAMETER(ui64MultiSampleCtl);
+	PVR_UNREFERENCED_PARAMETER(ui64FlippedMultiSampleCtl);
+	PVR_UNREFERENCED_PARAMETER(ui32TPCStride);
+	PVR_UNREFERENCED_PARAMETER(asTailPtrsDevVAddr);
+	PVR_UNREFERENCED_PARAMETER(ui32TPCSize);
+	PVR_UNREFERENCED_PARAMETER(ui32TEScreen);
+	PVR_UNREFERENCED_PARAMETER(ui32TEAA);
+	PVR_UNREFERENCED_PARAMETER(ui32TEMTILE1);
+	PVR_UNREFERENCED_PARAMETER(ui32TEMTILE2);
+	PVR_UNREFERENCED_PARAMETER(ui32MTileStride);
+	PVR_UNREFERENCED_PARAMETER(ui32ISPMergeLowerX);
+	PVR_UNREFERENCED_PARAMETER(ui32ISPMergeLowerY);
+	PVR_UNREFERENCED_PARAMETER(ui32ISPMergeUpperX);
+	PVR_UNREFERENCED_PARAMETER(ui32ISPMergeUpperY);
+	PVR_UNREFERENCED_PARAMETER(ui32ISPMergeScaleX);
+	PVR_UNREFERENCED_PARAMETER(ui32ISPMergeScaleY);
+	PVR_UNREFERENCED_PARAMETER(asMacrotileArrayDevVAddr);
+	PVR_UNREFERENCED_PARAMETER(asRgnHeaderDevVAddr);
+	PVR_UNREFERENCED_PARAMETER(asRTCDevVAddr);
+	PVR_UNREFERENCED_PARAMETER(uiRgnHeaderSize);
+	PVR_UNREFERENCED_PARAMETER(ui32ISPMtileSize);
+	PVR_UNREFERENCED_PARAMETER(ui16MaxRTs);
+	PVR_UNREFERENCED_PARAMETER(pasKMHWRTDataSet);
+
+	return PVRSRV_ERROR_NOT_IMPLEMENTED;
+}
+
+/* Create set of HWRTData(s) and bind it with a shared FW HWRTDataCommon */
+PVRSRV_ERROR RGXCreateHWRTDataSet2(
+        CONNECTION_DATA         *psConnection,
+        PVRSRV_DEVICE_NODE      *psDeviceNode,
+        IMG_DEV_VIRTADDR        asVHeapTableDevVAddr[RGXMKIF_NUM_GEOMDATAS],
+        DEVMEMINT_RESERVATION2  *psPMMListsReservation,
+        RGX_FREELIST            *apsFreeLists[RGXMKIF_NUM_RTDATA_FREELISTS],
+        IMG_UINT32              ui32ScreenPixelMax,
+        IMG_UINT64              ui64MultiSampleCtl,
+        IMG_UINT64              ui64FlippedMultiSampleCtl,
+        IMG_UINT32              ui32TPCStride,
+        IMG_DEV_VIRTADDR        asTailPtrsDevVAddr[RGXMKIF_NUM_GEOMDATAS],
+        IMG_UINT32              ui32TPCSize,
+        IMG_UINT32              ui32TEScreen,
+        IMG_UINT32              ui32TEAA,
+        IMG_UINT32              ui32TEMTILE1,
+        IMG_UINT32              ui32TEMTILE2,
+        IMG_UINT32              ui32MTileStride,
+        IMG_UINT32              ui32ISPMergeLowerX,
+        IMG_UINT32              ui32ISPMergeLowerY,
+        IMG_UINT32              ui32ISPMergeUpperX,
+        IMG_UINT32              ui32ISPMergeUpperY,
+        IMG_UINT32              ui32ISPMergeScaleX,
+        IMG_UINT32              ui32ISPMergeScaleY,
+        IMG_DEV_VIRTADDR        asMacrotileArrayDevVAddr[RGXMKIF_NUM_RTDATAS],
+        IMG_DEV_VIRTADDR        asRgnHeaderDevVAddr[RGXMKIF_NUM_RTDATAS],
+        IMG_DEV_VIRTADDR        asRTCDevVAddr[RGXMKIF_NUM_GEOMDATAS],
+        IMG_UINT32              uiRgnHeaderSize,
+        IMG_UINT32              ui32ISPMtileSize,
+        IMG_UINT16              ui16MaxRTs,
+        RGX_KM_HW_RT_DATASET    *pasKMHWRTDataSet[RGXMKIF_NUM_RTDATAS])
+{
 	PVRSRV_ERROR eError;
 	IMG_UINT32 ui32RTDataID;
-	PVRSRV_RGXDEV_INFO		*psDevInfo = psDeviceNode->pvDevice;
+	IMG_UINT32 ui32GlobalFLMaxPages, ui32LocalFLMaxPages;
+	IMG_DEVMEM_SIZE_T ui64MListSize;
+	PVRSRV_RGXDEV_INFO *psDevInfo = psDeviceNode->pvDevice;
 
-	RGX_HWRTDATA_COMMON_COOKIE	*psHWRTDataCommonCookie;
-	RGXFWIF_HWRTDATA_COMMON		*psHWRTDataCommon;
-	DEVMEM_MEMDESC				*psHWRTDataCommonFwMemDesc;
-	RGXFWIF_DEV_VIRTADDR		sHWRTDataCommonFwAddr;
+	RGX_HWRTDATA_COMMON_COOKIE *psHWRTDataCommonCookie;
+	RGXFWIF_HWRTDATA_COMMON *psHWRTDataCommon;
+	DEVMEM_MEMDESC *psHWRTDataCommonFwMemDesc;
+	RGXFWIF_DEV_VIRTADDR sHWRTDataCommonFwAddr;
+
+	PMR* psMListsPMR = NULL;
+	IMG_DEV_VIRTADDR sMListsDevVAddr;
+
+	/* Check if freelists have correct sizes */
+	eError = ValidateFreeListSizes(apsFreeLists,
+	                               &ui32LocalFLMaxPages,
+	                               &ui32GlobalFLMaxPages);
+	PVR_LOG_RETURN_IF_ERROR(eError, "Invalid freelist sizes");
+
+	ui64MListSize = RGXCalcMListSize(psDeviceNode,
+	    ui32LocalFLMaxPages * RGX_BIF_PM_PHYSICAL_PAGE_SIZE,
+	    ui32GlobalFLMaxPages * RGX_BIF_PM_PHYSICAL_PAGE_SIZE);
+
+	eError = AcquireValidateRefCriticalBuffer(psDeviceNode,
+	                                          psPMMListsReservation,
+	                                          ui64MListSize * RGXMKIF_NUM_RTDATAS,
+	                                          &psMListsPMR,
+	                                          &sMListsDevVAddr);
+	PVR_LOG_RETURN_IF_ERROR(eError, "Failed to obtain or validate MLIST buffer");
 
 	/* Prepare KM cleanup object for HWRTDataCommon FW object */
 	psHWRTDataCommonCookie = OSAllocZMem(sizeof(*psHWRTDataCommonCookie));
 	if (psHWRTDataCommonCookie == NULL)
 	{
-		eError = PVRSRV_ERROR_OUT_OF_MEMORY;
-		goto err_HWRTDataCommonCookieAlloc;
+	    eError = PVRSRV_ERROR_OUT_OF_MEMORY;
+	    goto err_HWRTDataCommonCookieAlloc;
 	}
 
 	/*
@@ -1537,15 +1625,15 @@ PVRSRV_ERROR RGXCreateHWRTDataSet(CONNECTION_DATA      *psConnection,
 	 * suffice on the CPU side (WC buffer will be flushed at the first TA-kick)
 	 */
 	eError = DevmemFwAllocate(psDevInfo,
-			sizeof(RGXFWIF_HWRTDATA_COMMON),
-			RGX_FWCOMCTX_ALLOCFLAGS,
-			"FwHWRTDataCommon",
-			&psHWRTDataCommonFwMemDesc);
+	                          sizeof(RGXFWIF_HWRTDATA_COMMON),
+	                          RGX_FWCOMCTX_ALLOCFLAGS,
+	                          "FwHWRTDataCommon",
+	                          &psHWRTDataCommonFwMemDesc);
 
 	if (eError != PVRSRV_OK)
 	{
-		PVR_DPF((PVR_DBG_ERROR, "%s: DevmemAllocate for FwHWRTDataCommon failed", __func__));
-		goto err_HWRTDataCommonAlloc;
+	    PVR_DPF((PVR_DBG_ERROR, "%s: DevmemAllocate for FwHWRTDataCommon failed", __func__));
+	    goto err_HWRTDataCommonAlloc;
 	}
 	eError = RGXSetFirmwareAddress(&sHWRTDataCommonFwAddr, psHWRTDataCommonFwMemDesc, 0, RFW_FWADDR_FLAG_NONE);
 	PVR_LOG_GOTO_IF_ERROR(eError, "RGXSetFirmwareAddress", err_HWRTDataCommonFwAddr);
@@ -1583,33 +1671,38 @@ PVRSRV_ERROR RGXCreateHWRTDataSet(CONNECTION_DATA      *psConnection,
 	psHWRTDataCommonCookie->psHWRTDataCommonFwMemDesc = psHWRTDataCommonFwMemDesc;
 	psHWRTDataCommonCookie->sHWRTDataCommonFwAddr = sHWRTDataCommonFwAddr;
 
+	psHWRTDataCommonCookie->psPMMListsReservation = psPMMListsReservation;
+
 	/* Here we are creating a set of HWRTData(s)
 	   the number of elements in the set equals RGXMKIF_NUM_RTDATAS.
 	*/
 
 	for (ui32RTDataID = 0; ui32RTDataID < RGXMKIF_NUM_RTDATAS; ui32RTDataID++)
 	{
+		IMG_DEV_VIRTADDR sMListDevVAddr;
+		sMListDevVAddr.uiAddr = sMListsDevVAddr.uiAddr + ui32RTDataID * ui64MListSize;
+
 		eError = RGXCreateHWRTData_aux(
-			psConnection,
-			psDeviceNode,
-			asVHeapTableDevVAddr[ui32RTDataID % RGXMKIF_NUM_GEOMDATAS],
-			asPMMListDevVAddr[ui32RTDataID],
-			&apsFreeLists[(ui32RTDataID % RGXMKIF_NUM_GEOMDATAS) * RGXFW_MAX_FREELISTS],
-			asTailPtrsDevVAddr[ui32RTDataID % RGXMKIF_NUM_GEOMDATAS],
-			asMacrotileArrayDevVAddr[ui32RTDataID],
-			asRgnHeaderDevVAddr[ui32RTDataID],
-			asRTCDevVAddr[ui32RTDataID % RGXMKIF_NUM_GEOMDATAS],
-			ui16MaxRTs,
-			psHWRTDataCommonCookie,
-			&pasKMHWRTDataSet[ui32RTDataID]);
+		    psConnection,
+		    psDeviceNode,
+		    asVHeapTableDevVAddr[ui32RTDataID % RGXMKIF_NUM_GEOMDATAS],
+		    sMListDevVAddr,
+		    &apsFreeLists[(ui32RTDataID % RGXMKIF_NUM_GEOMDATAS) * RGXFW_MAX_FREELISTS],
+		    asTailPtrsDevVAddr[ui32RTDataID % RGXMKIF_NUM_GEOMDATAS],
+		    asMacrotileArrayDevVAddr[ui32RTDataID],
+		    asRgnHeaderDevVAddr[ui32RTDataID],
+		    asRTCDevVAddr[ui32RTDataID % RGXMKIF_NUM_GEOMDATAS],
+		    ui16MaxRTs,
+		    psHWRTDataCommonCookie,
+		    &pasKMHWRTDataSet[ui32RTDataID]);
 
 		if (eError != PVRSRV_OK)
 		{
 			PVR_DPF((PVR_DBG_ERROR,
-					"%s: Failed to create HWRTData [slot %u] (%s)",
-					__func__,
-					ui32RTDataID,
-					PVRSRVGetErrorString(eError)));
+			        "%s: Failed to create HWRTData [slot %u] (%s)",
+			        __func__,
+			        ui32RTDataID,
+			        PVRSRVGetErrorString(eError)));
 			goto err_HWRTDataAlloc;
 		}
 		psHWRTDataCommonCookie->ui32RefCount += 1;
@@ -1638,7 +1731,7 @@ PVRSRV_ERROR RGXCreateHWRTDataSet(CONNECTION_DATA      *psConnection,
 err_HWRTDataCommonAlloc:
 	OSFreeMem(psHWRTDataCommonCookie);
 err_HWRTDataCommonCookieAlloc:
-
+	UnrefAndReleaseCriticalBuffer(psPMMListsReservation);
 	return eError;
 }
 
@@ -1710,6 +1803,7 @@ PVRSRV_ERROR RGXDestroyHWRTDataSet(RGX_KM_HW_RT_DATASET *psKMHWRTDataSet)
 
 		DevmemFwUnmapAndFree(psDevNode->pvDevice,
 		                     psCommonCookie->psHWRTDataCommonFwMemDesc);
+		UnrefAndReleaseCriticalBuffer(psCommonCookie->psPMMListsReservation);
 		OSFreeMem(psCommonCookie);
 	}
 
@@ -1767,47 +1861,12 @@ PVRSRV_ERROR RGXCreateFreeList2(CONNECTION_DATA			*psConnection,
 	IMG_DEV_VIRTADDR   sFreeListDevVAddr;
 	PMR*               psFreeListPMR = NULL;
 
-	/* Obtain reference to reservation object */
-	if (!DevmemIntReservationAcquire(psFreeListReservation))
-	{
-		PVR_DPF((PVR_DBG_ERROR,
-		        "%s: Failed to acquire reservation for freelist buffer",
-		        __func__));
-		eError = PVRSRV_ERROR_REFCOUNT_OVERFLOW;
-		goto ErrorReservationAcquire;
-	}
-
-	eError = DevmemIntGetReservationData(psFreeListReservation, &psFreeListPMR, &sFreeListDevVAddr);
-	if (eError != PVRSRV_OK)
-	{
-		PVR_DPF((PVR_DBG_ERROR,
-		        "%s: Error from DevmemIntGetReservationData: %s",
-		        __func__, PVRSRVGetErrorString(eError)));
-
-		goto ErrorAllocHost;
-	}
-
-	/* Check if client properly allocated PMMETA_PROTECT */
-	if ((PMR_Flags(psFreeListPMR) & PVRSRV_MEMALLOCFLAG_DEVICE_FLAG(PMMETA_PROTECT)) == 0)
-	{
-		PVR_DPF((PVR_DBG_ERROR,
-		        "%s: Freelist PMR must have PMMETA_PROTECT set",
-		        __func__));
-		eError = PVRSRV_ERROR_INVALID_FLAGS;
-		goto ErrorAllocHost;
-	}
-
-	if (PMR_IsSparse(psFreeListPMR))
-	{
-		PVR_DPF((PVR_DBG_ERROR,
-		        "%s: Free list PMR cannot be sparse!",
-		        __func__));
-		eError = PVRSRV_ERROR_INVALID_PARAMS;
-		goto ErrorAllocHost;
-	}
-
-	/* Ref the PMR to prevent resource being destroyed before use */
-	PMRRefPMR(psFreeListPMR);
+	eError = AcquireValidateRefCriticalBuffer(psDeviceNode,
+	                                          psFreeListReservation,
+	                                          0, /* Size is checked later after calculating initial grow size */
+	                                          &psFreeListPMR,
+	                                          &sFreeListDevVAddr);
+	PVR_LOG_RETURN_IF_ERROR(eError,  "Validation failed for Freelist reservation");
 
 	if (OSGetPageShift() > RGX_BIF_PM_PHYSICAL_PAGE_ALIGNSHIFT)
 	{
@@ -2031,10 +2090,8 @@ PVRSRV_ERROR RGXCreateFreeList2(CONNECTION_DATA			*psConnection,
 	OSFreeMem(psFreeList);
 
 ErrorAllocHost:
-	DevmemIntReservationRelease(psFreeListReservation);
+	UnrefAndReleaseCriticalBuffer(psFreeListReservation);
 
-ErrorReservationAcquire:
-	PVR_ASSERT(eError != PVRSRV_OK);
 	return eError;
 }
 
@@ -2133,9 +2190,7 @@ PVRSRV_ERROR RGXDestroyFreeList(RGX_FREELIST *psFreeList)
 	PVR_ASSERT(dllist_is_empty(&psFreeList->sMemoryBlockInitHead));
 	PVR_ASSERT(psFreeList->ui32CurrentFLPages == 0);
 
-	/* Remove reference from the PMR and reservation resources */
-	PMRUnrefPMR(psFreeList->psFreeListPMR);
-	DevmemIntReservationRelease(psFreeList->psFreeListReservation);
+	UnrefAndReleaseCriticalBuffer(psFreeList->psFreeListReservation);
 
 	/* free Freelist */
 	OSFreeMem(psFreeList);
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxta3d.h b/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxta3d.h
index a843aa3..83e8806 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxta3d.h
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/rogue/rgxta3d.h
@@ -118,6 +118,7 @@ typedef struct _RGX_HWRTDATA_COMMON_COOKIE_
 {
 	DEVMEM_MEMDESC			*psHWRTDataCommonFwMemDesc;
 	RGXFWIF_DEV_VIRTADDR	sHWRTDataCommonFwAddr;
+	DEVMEMINT_RESERVATION2	*psPMMListsReservation;
 	IMG_UINT32				ui32RefCount;
 
 } RGX_HWRTDATA_COMMON_COOKIE;
@@ -254,6 +255,36 @@ PVRSRV_ERROR RGXCreateHWRTDataSet(CONNECTION_DATA          *psConnection,
                                   IMG_UINT16                ui16MaxRTs,
                                   RGX_KM_HW_RT_DATASET     *pasKMHWRTDataSet[RGXMKIF_NUM_RTDATAS]);
 
+PVRSRV_ERROR RGXCreateHWRTDataSet2(CONNECTION_DATA          *psConnection,
+                                  PVRSRV_DEVICE_NODE        *psDeviceNode,
+                                  IMG_DEV_VIRTADDR          asVHeapTableDevVAddr[RGXMKIF_NUM_GEOMDATAS],
+                                  DEVMEMINT_RESERVATION2    *psPMMListsReservation,
+                                  RGX_FREELIST	            *apsFreeLists[RGXMKIF_NUM_RTDATA_FREELISTS],
+                                  IMG_UINT32                ui32ScreenPixelMax,
+                                  IMG_UINT64                ui64MultiSampleCtl,
+                                  IMG_UINT64                ui64FlippedMultiSampleCtl,
+                                  IMG_UINT32                ui32TPCStride,
+                                  IMG_DEV_VIRTADDR          asTailPtrsDevVAddr[RGXMKIF_NUM_GEOMDATAS],
+                                  IMG_UINT32                ui32TPCSize,
+                                  IMG_UINT32                ui32TEScreen,
+                                  IMG_UINT32                ui32TEAA,
+                                  IMG_UINT32                ui32TEMTILE1,
+                                  IMG_UINT32                ui32TEMTILE2,
+                                  IMG_UINT32                ui32MTileStride,
+                                  IMG_UINT32                ui32ISPMergeLowerX,
+                                  IMG_UINT32                ui32ISPMergeLowerY,
+                                  IMG_UINT32                ui32ISPMergeUpperX,
+                                  IMG_UINT32                ui32ISPMergeUpperY,
+                                  IMG_UINT32                ui32ISPMergeScaleX,
+                                  IMG_UINT32                ui32ISPMergeScaleY,
+                                  IMG_DEV_VIRTADDR          sMacrotileArrayDevVAddr[RGXMKIF_NUM_RTDATAS],
+                                  IMG_DEV_VIRTADDR          sRgnHeaderDevVAddr[RGXMKIF_NUM_RTDATAS],
+                                  IMG_DEV_VIRTADDR          asRTCDevVAddr[RGXMKIF_NUM_GEOMDATAS],
+                                  IMG_UINT32                uiRgnHeaderSize,
+                                  IMG_UINT32                ui32ISPMtileSize,
+                                  IMG_UINT16                ui16MaxRTs,
+                                  RGX_KM_HW_RT_DATASET     *pasKMHWRTDataSet[RGXMKIF_NUM_RTDATAS]);
+
 /* Destroy HWRTDataSet */
 PVRSRV_ERROR RGXDestroyHWRTDataSet(RGX_KM_HW_RT_DATASET *psKMHWRTDataSet);
 
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxhwperf.c b/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxhwperf.c
index da71bab..4c79706 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxhwperf.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxhwperf.c
@@ -512,7 +512,7 @@ PVRSRV_ERROR PVRSRVRGXGetEnabledHWPerfBlocks(PVRSRV_DEVICE_NODE *psDevNode,
 				continue;
 			}
 
-			if (ui32LastIdx > ui32ArrayLen)
+			if (ui32LastIdx + 1 > ui32ArrayLen)
 			{
 				PVR_DPF((PVR_DBG_ERROR, "ui32ArrayLen less than the number of enabled blocks."));
 				PVR_GOTO_WITH_ERROR(eError, PVRSRV_ERROR_OUT_OF_MEMORY, Error);
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxinit.c b/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxinit.c
index 73cb05d..97901d5 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxinit.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxinit.c
@@ -1388,6 +1388,17 @@ static MMU_DEVICEATTRIBS *RGXDevMMUAttributes(PVRSRV_DEVICE_NODE *psDeviceNode,
 	return psMMUDevAttrs;
 }
 
+
+/*
+	RGXDevSnoopMode
+*/
+static PVRSRV_DEVICE_SNOOP_MODE RGXDevSnoopMode(PVRSRV_DEVICE_NODE *psDeviceNode)
+{
+	PVR_UNREFERENCED_PARAMETER(psDeviceNode);
+
+	return PVRSRV_DEVICE_SNOOP_NONE;
+}
+
 /*
  * RGXInitDevPart2
  */
@@ -1843,6 +1854,7 @@ PVRSRV_ERROR RGXInitCreateFWKernelMemoryContext(PVRSRV_DEVICE_NODE *psDeviceNode
 	/* Register callbacks for creation of device memory contexts */
 	psDeviceNode->pfnRegisterMemoryContext = RGXRegisterMemoryContext;
 	psDeviceNode->pfnUnregisterMemoryContext = RGXUnregisterMemoryContext;
+	psDeviceNode->pfnValidateExportableFlags = RGXValidateExportableFlags;
 
 	/* Create the memory context for the firmware. */
 	eError = DevmemCreateContext(psDeviceNode, DEVMEM_HEAPCFG_FORFW,
@@ -4504,6 +4516,7 @@ PVRSRV_ERROR RGXRegisterDevice(PVRSRV_DEVICE_NODE *psDeviceNode)
 
 	/* Callback for getting the MMU device attributes */
 	psDeviceNode->pfnGetMMUDeviceAttributes = RGXDevMMUAttributes;
+	psDeviceNode->pfnGetDeviceSnoopMode = RGXDevSnoopMode;
 	psDeviceNode->pfnMMUCacheInvalidate = RGXMMUCacheInvalidate;
 	psDeviceNode->pfnMMUCacheInvalidateKick = RGXMMUCacheInvalidateKick;
 #if defined(RGX_BRN71422_TARGET_HARDWARE_PHYSICAL_ADDR)
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxta3d.c b/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxta3d.c
index 78af775..49deb13 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxta3d.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxta3d.c
@@ -1292,6 +1292,7 @@ static PVRSRV_ERROR RGXCreateHWRTData_aux(CONNECTION_DATA  *psConnection,
                                   RGX_FREELIST	           *apsFreeLists[RGXFW_MAX_FREELISTS],
                                   IMG_DEV_VIRTADDR          sTailPtrsDevVAddr,
                                   IMG_UINT16                ui16MaxRTs,
+                                  RGX_HWRTDATA_COMMON_COOKIE *psHWRTDataCommonCookie,
                                   RGX_KM_HW_RT_DATASET    **ppsKMHWRTDataSet) /* per-HWRTData */
 {
 	PVRSRV_ERROR eError;
@@ -1329,7 +1330,7 @@ static PVRSRV_ERROR RGXCreateHWRTData_aux(CONNECTION_DATA  *psConnection,
 
 	*ppsKMHWRTDataSet = psKMHWRTDataSet;
 	psKMHWRTDataSet->psDeviceNode = psDeviceNode;
-
+	psKMHWRTDataSet->psHWRTDataCommonCookie = psHWRTDataCommonCookie;
 	psDevInfo = psDeviceNode->pvDevice;
 
 	/*
@@ -1548,24 +1549,171 @@ PVRSRV_ERROR RGXCreateHWRTDataSet(CONNECTION_DATA      *psConnection,
 		IMG_UINT16                ui16MaxRTs,
 		RGX_KM_HW_RT_DATASET     *pasKMHWRTDataSet[RGXMKIF_NUM_RTDATAS])
 {
+	PVR_UNREFERENCED_PARAMETER(psConnection);
+	PVR_UNREFERENCED_PARAMETER(psDeviceNode);
+	PVR_UNREFERENCED_PARAMETER(psVHeapTableDevVAddr);
+	PVR_UNREFERENCED_PARAMETER(asPMDataDevVAddr);
+	PVR_UNREFERENCED_PARAMETER(asPMSecureDataDevVAddr);
+	PVR_UNREFERENCED_PARAMETER(apsFreeLists);
+	PVR_UNREFERENCED_PARAMETER(asTailPtrsDevVAddr);
+	PVR_UNREFERENCED_PARAMETER(ui16MaxRTs);
+	PVR_UNREFERENCED_PARAMETER(pasKMHWRTDataSet);
+
+	return PVRSRV_ERROR_NOT_IMPLEMENTED;
+}
+
+static PVRSRV_ERROR
+_WritePMStateBuffer(PMR* psRenderStatesPMR,
+                    IMG_DEVMEM_OFFSET_T ui64Offset,
+                    IMG_DEV_VIRTADDR sMListDevVAddr,
+                    IMG_DEV_VIRTADDR sVHeapTableDevVAddr)
+{
+	PVRSRV_ERROR eError;
+
+	size_t uiNbBytes;
+	IMG_UINT32 asRenderStateBuffer[RGX_PM_MAX_RSTATE_SIZE_DWORDS] = {0};
+
+	PVR_ASSERT(PVRSRV_IS_FEATURE_SUPPORTED(PMR_DeviceNode(psRenderStatesPMR), PM_BYTE_ALIGNED_BASE_ADDRESSES));
+	PVR_ASSERT((sMListDevVAddr.uiAddr & (RGX_PM_MLIST_BASE_ADDR_MAX_ALIGNSIZE - 1)) == 0);
+	PVR_ASSERT((sVHeapTableDevVAddr.uiAddr & (RGX_PM_VHEAP_BASE_ADDR_MAX_ALIGNSIZE - 1)) == 0);
+
+	/* Initialise the Mlist base and Vheap base */
+	_RGX_PM_RENDERSTATE_BUFFER_SET_MLIST_BASE_ADDR(asRenderStateBuffer, sMListDevVAddr.uiAddr);
+	_RGX_PM_RENDERSTATE_BUFFER_SET_VHEAP_BASE_ADDR(asRenderStateBuffer, sVHeapTableDevVAddr.uiAddr);
+
+	eError = PMR_WriteBytes(psRenderStatesPMR,
+	                        ui64Offset,
+	                        (IMG_UINT8*)&asRenderStateBuffer,
+	                        sizeof(asRenderStateBuffer),
+	                        &uiNbBytes);
+	if (eError != PVRSRV_OK)
+	{
+		PVR_DPF((PVR_DBG_ERROR,
+		        "%s: Error from PMR_WriteBytes: %s",
+		        __func__, PVRSRVGetErrorString(eError)));
+		goto ErrorExit;
+	}
+
+	PVR_ASSERT(uiNbBytes == sizeof(asRenderStateBuffer));
+
+	PDUMPCOMMENT(PMR_DeviceNode(psRenderStatesPMR), "PMState buffer");
+	PMRPDumpLoadMem(psRenderStatesPMR, ui64Offset, sizeof(asRenderStateBuffer), PDUMP_FLAGS_CONTINUOUS, false);
+
+	return PVRSRV_OK;
+ErrorExit:
+	return eError;
+}
+
+PVRSRV_ERROR RGXCreateHWRTDataSet2(
+        CONNECTION_DATA         *psConnection,
+        PVRSRV_DEVICE_NODE      *psDeviceNode,
+        IMG_DEV_VIRTADDR        sVHeapTableDevVAddr,
+        DEVMEMINT_RESERVATION2  *psPMMListsReservation,
+        DEVMEMINT_RESERVATION2  *psPMStateReservation,
+        DEVMEMINT_RESERVATION2  *psPMSecureStateReservation,
+        RGX_FREELIST            *apsFreeLists[RGXMKIF_NUM_RTDATA_FREELISTS],
+        IMG_DEV_VIRTADDR        asTailPtrsDevVAddr[RGXMKIF_NUM_GEOMDATAS],
+        IMG_UINT16              ui16MaxRTs,
+        RGX_KM_HW_RT_DATASET    *pasKMHWRTDataSet[RGXMKIF_NUM_RTDATAS])
+{
 	PVRSRV_ERROR eError;
 	IMG_UINT32 ui32RTDataID;
+	IMG_UINT32 ui32GlobalFLMaxPages, ui32LocalFLMaxPages;
+	IMG_DEVMEM_SIZE_T ui64MListSize, ui64AlignedRenderStateSize;
+	RGX_HWRTDATA_COMMON_COOKIE *psHWRTDataCommonCookie;
+
+	PMR *psPMStatePMR=NULL, *psPMSecureStatePMR=NULL, *psMListsPMR=NULL;
+	IMG_DEV_VIRTADDR sPMStateBaseDevVAddr, sPMSecureStateDevVAddr, sMListsDevVAddr;
+
+	ui64AlignedRenderStateSize = PVR_ALIGN(sizeof(RGX_PM_RENDERSTATE_BUFFER),
+	   MAX(RGX_PM_RENDERSTATE_BASE_ADDR_ALIGNSIZE,
+	       GET_ROGUE_CACHE_LINE_SIZE(PVRSRV_GET_DEVICE_FEATURE_VALUE(psDeviceNode, SLC_CACHE_LINE_SIZE_BITS))));
+
+	/* Check if freelists have uniform sizes */
+	eError = ValidateFreeListSizes(apsFreeLists,
+	                               &ui32LocalFLMaxPages,
+	                               &ui32GlobalFLMaxPages);
+	PVR_LOG_RETURN_IF_ERROR(eError, "Invalid freelist sizes");
+
+	ui64MListSize = RGXCalcMListSize(psDeviceNode,
+	    ui32LocalFLMaxPages * RGX_BIF_PM_PHYSICAL_PAGE_SIZE,
+	    ui32GlobalFLMaxPages * RGX_BIF_PM_PHYSICAL_PAGE_SIZE);
+
+	eError = AcquireValidateRefCriticalBuffer(psDeviceNode,
+	                                          psPMStateReservation,
+	                                          ui64AlignedRenderStateSize * RGXMKIF_NUM_RTDATAS,
+	                                          &psPMStatePMR,
+	                                          &sPMStateBaseDevVAddr);
+	PVR_LOG_GOTO_IF_ERROR(eError,
+	    "Validation failed for MListAndState reservations", err_validation_rs);
+
+	/* The following check is needed to handle cases where a secure state reservation
+	   dummy is passed through the bridge because it is not used.
+	   In that case we can't acquire and validate twice. */
+	if (psPMStateReservation != psPMSecureStateReservation)
+	{
+		eError = AcquireValidateRefCriticalBuffer(psDeviceNode,
+		                                          psPMSecureStateReservation,
+		                                          ui64AlignedRenderStateSize * RGXMKIF_NUM_RTDATAS,
+		                                          &psPMSecureStatePMR,
+		                                          &sPMSecureStateDevVAddr);
+		PVR_LOG_GOTO_IF_ERROR(eError,
+		    "Validation failed for secure data reservations", err_validation_srs);
+	}
+
+	eError = AcquireValidateRefCriticalBuffer(psDeviceNode,
+	                                          psPMMListsReservation,
+	                                          ui64MListSize * RGXMKIF_NUM_RTDATAS,
+	                                          &psMListsPMR,
+	                                          &sMListsDevVAddr);
+	PVR_LOG_GOTO_IF_ERROR(eError,
+	    "Validation failed for secure data reservations", err_validation_mlist);
+
+	/* Prepare KM cleanup object for common data */
+	psHWRTDataCommonCookie = OSAllocZMem(sizeof(*psHWRTDataCommonCookie));
+	if (psHWRTDataCommonCookie == NULL)
+	{
+		eError = PVRSRV_ERROR_OUT_OF_MEMORY;
+		goto err_common_cookie_alloc;
+	}
+
+	psHWRTDataCommonCookie->psPMStateReservation = psPMStateReservation;
+	psHWRTDataCommonCookie->psPMSecureStateReservation = psPMSecureStateReservation;
+	psHWRTDataCommonCookie->psPMMListsReservation = psPMMListsReservation;
 
 	/* Here we are creating a set of HWRTData(s)
 	   the number of elements in the set equals RGXMKIF_NUM_RTDATAS.
 	*/
-
 	for (ui32RTDataID = 0; ui32RTDataID < RGXMKIF_NUM_RTDATAS; ui32RTDataID++)
 	{
+		IMG_DEV_VIRTADDR sRenderStateDevVirtAddr;
+		IMG_DEV_VIRTADDR sSecureRenderStateDevVirtAddr;
+		IMG_DEV_VIRTADDR sMListDevVirtAddr;
+
+		sRenderStateDevVirtAddr.uiAddr =
+		    sPMStateBaseDevVAddr.uiAddr + ui64AlignedRenderStateSize * ui32RTDataID;
+		sSecureRenderStateDevVirtAddr.uiAddr =
+		    sPMSecureStateDevVAddr.uiAddr + ui64AlignedRenderStateSize * ui32RTDataID;
+		sMListDevVirtAddr.uiAddr =
+		    sMListsDevVAddr.uiAddr + ui64MListSize * ui32RTDataID;
+
+		eError = _WritePMStateBuffer(psPMStatePMR,
+		                             ui64AlignedRenderStateSize * ui32RTDataID,
+		                             sMListDevVirtAddr,
+		                             sVHeapTableDevVAddr);
+		PVR_LOG_GOTO_IF_ERROR(eError,
+		    "Failed to write PM state buffer", err_HWRTDataAlloc);
+
 		eError = RGXCreateHWRTData_aux(
 			psConnection,
 			psDeviceNode,
-			psVHeapTableDevVAddr,
-			asPMDataDevVAddr[ui32RTDataID],
-			asPMSecureDataDevVAddr[ui32RTDataID],
+			sVHeapTableDevVAddr,
+			sRenderStateDevVirtAddr,
+			sSecureRenderStateDevVirtAddr,
 			&apsFreeLists[(ui32RTDataID % RGXMKIF_NUM_GEOMDATAS) * RGXFW_MAX_FREELISTS],
 			asTailPtrsDevVAddr[ui32RTDataID % RGXMKIF_NUM_GEOMDATAS],
 			ui16MaxRTs,
+			psHWRTDataCommonCookie,
 			&pasKMHWRTDataSet[ui32RTDataID]);
 
 		if (eError != PVRSRV_OK)
@@ -1577,6 +1725,7 @@ PVRSRV_ERROR RGXCreateHWRTDataSet(CONNECTION_DATA      *psConnection,
 					PVRSRVGetErrorString(eError)));
 			goto err_HWRTDataAlloc;
 		}
+		psHWRTDataCommonCookie->ui32RefCount += 1;
 	}
 
 	return PVRSRV_OK;
@@ -1594,7 +1743,17 @@ PVRSRV_ERROR RGXCreateHWRTDataSet(CONNECTION_DATA      *psConnection,
 			}
 		}
 	}
-
+	OSFreeMem(psHWRTDataCommonCookie);
+err_common_cookie_alloc:
+	UnrefAndReleaseCriticalBuffer(psPMMListsReservation);
+err_validation_mlist:
+	if (psPMSecureStateReservation != psPMStateReservation)
+	{
+		UnrefAndReleaseCriticalBuffer(psPMSecureStateReservation);
+	}
+err_validation_srs:
+	UnrefAndReleaseCriticalBuffer(psPMStateReservation);
+err_validation_rs:
 	return eError;
 }
 
@@ -1607,7 +1766,7 @@ PVRSRV_ERROR RGXDestroyHWRTDataSet(RGX_KM_HW_RT_DATASET *psKMHWRTDataSet)
 	PVRSRV_DEVICE_NODE *psDevNode;
 	PVRSRV_ERROR eError;
 	PRGXFWIF_HWRTDATA psHWRTData;
-
+	RGX_HWRTDATA_COMMON_COOKIE *psCommonCookie;
 	PVR_ASSERT(psKMHWRTDataSet);
 
 	psDevNode = psKMHWRTDataSet->psDeviceNode;
@@ -1632,6 +1791,7 @@ PVRSRV_ERROR RGXDestroyHWRTDataSet(RGX_KM_HW_RT_DATASET *psKMHWRTDataSet)
 		   This is to prevent repeated client calls to this function */
 		eError = PVRSRV_OK;
 	}
+	psCommonCookie = psKMHWRTDataSet->psHWRTDataCommonCookie;
 
 	RGXDestroyHWRTData_aux(psKMHWRTDataSet);
 
@@ -1648,7 +1808,22 @@ PVRSRV_ERROR RGXDestroyHWRTDataSet(RGX_KM_HW_RT_DATASET *psKMHWRTDataSet)
 	     objects will be destroyed after destruction of all HWRTDatas
 	     within a single pair.
 	*/
+	psCommonCookie->ui32RefCount--;
 
+	/* When ref count for HWRTDataCommonCookie hits ZERO
+	 * we have to destroy the cookie
+	 * [KM object] afterwards. */
+	if (psCommonCookie->ui32RefCount == 0)
+	{
+		UnrefAndReleaseCriticalBuffer(psCommonCookie->psPMStateReservation);
+		if (psCommonCookie->psPMSecureStateReservation != psCommonCookie->psPMStateReservation)
+		{
+			UnrefAndReleaseCriticalBuffer(psCommonCookie->psPMSecureStateReservation);
+		}
+		UnrefAndReleaseCriticalBuffer(psCommonCookie->psPMMListsReservation);
+
+		OSFreeMem(psCommonCookie);
+	}
 	return PVRSRV_OK;
 }
 
@@ -1715,47 +1890,14 @@ PVRSRV_ERROR RGXCreateFreeList2(CONNECTION_DATA       *psConnection,
 	                        sizeof(RGX_PM_FREELISTSTATE_BUFFER),
 	                        GET_ROGUE_CACHE_LINE_SIZE(PVRSRV_GET_DEVICE_FEATURE_VALUE(psDeviceNode, SLC_CACHE_LINE_SIZE_BITS)));
 
-	/* Obtain reference to reservation object */
-	if (!DevmemIntReservationAcquire(psFreeListAndStateReservation))
-	{
-		PVR_DPF((PVR_DBG_ERROR,
-		        "%s: Failed to acquire reservation for freelist buffer",
-		        __func__));
-		eError = PVRSRV_ERROR_REFCOUNT_OVERFLOW;
-		goto ErrorReservationAcquire;
-	}
+	eError = AcquireValidateRefCriticalBuffer(psDeviceNode,
+	                                          psFreeListAndStateReservation,
+	                                          0, /* Size is checked later after calculating initial grow size */
+	                                          &psFreeListAndStatePMR,
+	                                          &sFreeListStateDevVAddr);
+	PVR_LOG_GOTO_IF_ERROR(eError,
+	    "Validation failed for Freelist reservation", ErrorAcquireValidateFreeList);
 
-	eError = DevmemIntGetReservationData(psFreeListAndStateReservation, &psFreeListAndStatePMR, &sFreeListStateDevVAddr);
-	if (eError != PVRSRV_OK)
-	{
-		PVR_DPF((PVR_DBG_ERROR,
-		        "%s: Error from DevmemIntGetReservationData: %s",
-		        __func__, PVRSRVGetErrorString(eError)));
-
-		goto ErrorRefPMR;
-	}
-
-	/* Check if client properly allocated PMMETA_PROTECT */
-	if ((PMR_Flags(psFreeListAndStatePMR) & PVRSRV_MEMALLOCFLAG_DEVICE_FLAG(PMMETA_PROTECT)) == 0)
-	{
-		PVR_DPF((PVR_DBG_ERROR,
-		        "%s: Freelist PMR must have PMMETA_PROTECT set",
-		        __func__));
-		eError = PVRSRV_ERROR_INVALID_FLAGS;
-		goto ErrorRefPMR;
-	}
-
-	/* Ref the PMR to prevent resource being destroyed before use */
-	PMRRefPMR(psFreeListAndStatePMR);
-
-	if (PMR_IsSparse(psFreeListAndStatePMR))
-	{
-		PVR_DPF((PVR_DBG_ERROR,
-		        "%s: Free list PMR cannot be sparse!",
-		        __func__));
-		eError = PVRSRV_ERROR_INVALID_PARAMS;
-		goto ErrorAllocHost;
-	}
 
 	sFreeListBaseDevVAddr.uiAddr = sFreeListStateDevVAddr.uiAddr + uiFreeListOffset;
 
@@ -1891,7 +2033,7 @@ PVRSRV_ERROR RGXCreateFreeList2(CONNECTION_DATA       *psConnection,
 			PVR_DPF((PVR_DBG_ERROR,
 			        "%s: Error from PMR_WriteBytes: %s",
 			        __func__, PVRSRVGetErrorString(eError)));
-			goto FWFreeListAlloc;
+			goto ErrorWritePMR;
 		}
 		PVR_ASSERT(uiNbBytes == sizeof(sFLState));
 
@@ -2016,6 +2158,7 @@ PVRSRV_ERROR RGXCreateFreeList2(CONNECTION_DATA       *psConnection,
 
 	/* Error handling */
 FWFreeListCpuMap:
+ErrorWritePMR:
 	/* Remove freelists from list */
 	OSLockAcquire(psDevInfo->hLockFreeList);
 	dllist_remove_node(&psFreeList->sNode);
@@ -2031,10 +2174,9 @@ PVRSRV_ERROR RGXCreateFreeList2(CONNECTION_DATA       *psConnection,
 ErrorAllocHost:
 	PMRUnrefPMR(psFreeListAndStatePMR);
 
-ErrorRefPMR:
-	DevmemIntReservationRelease(psFreeListAndStateReservation);
+	UnrefAndReleaseCriticalBuffer(psFreeListAndStateReservation);
 
-ErrorReservationAcquire:
+ErrorAcquireValidateFreeList:
 	PVR_ASSERT(eError != PVRSRV_OK);
 	return eError;
 }
@@ -2133,11 +2275,8 @@ PVRSRV_ERROR RGXDestroyFreeList(RGX_FREELIST *psFreeList)
 
 	/* consistency checks */
 	PVR_ASSERT(dllist_is_empty(&psFreeList->sMemoryBlockInitHead));
-	PVR_ASSERT(psFreeList->ui32CurrentFLPages == 0);
-
-	/* Remove references from the PMR resources */
-	PMRUnrefPMR(psFreeList->psFreeListStatePMR);
-	DevmemIntReservationRelease(psFreeList->psFreeListAndStateReservation);
+	PVR_ASSERT(psFreeList->ui32CurrentFLPages == 0);;
+	UnrefAndReleaseCriticalBuffer(psFreeList->psFreeListAndStateReservation);
 
 	/* free Freelist */
 	OSFreeMem(psFreeList);
diff --git a/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxta3d.h b/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxta3d.h
index a33e5a9..83bfc42 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxta3d.h
+++ b/drivers/gpu/img-rogue/23.2/services/server/devices/volcanic/rgxta3d.h
@@ -116,16 +116,18 @@ typedef struct _RGX_PMR_NODE_ RGX_PMR_NODE;
 
 typedef struct _RGX_HWRTDATA_COMMON_COOKIE_
 {
-	DEVMEM_MEMDESC			*psHWRTDataCommonFwMemDesc;
-	RGXFWIF_DEV_VIRTADDR	sHWRTDataCommonFwAddr;
-	IMG_UINT32				ui32RefCount;
-
+	DEVMEMINT_RESERVATION2* psPMStateReservation;
+	DEVMEMINT_RESERVATION2* psPMSecureStateReservation;
+	DEVMEMINT_RESERVATION2* psPMMListsReservation;
+	IMG_UINT32              ui32RefCount;
 } RGX_HWRTDATA_COMMON_COOKIE;
 
 typedef struct _RGX_KM_HW_RT_DATASET_
 {
 	/* RGX_RTDATA_CLEANUP_DATA */
 	/* RGXMKIF_NUM_RTDATAS */
+	RGX_HWRTDATA_COMMON_COOKIE* psHWRTDataCommonCookie;
+
 	PVRSRV_DEVICE_NODE *psDeviceNode;
 	RGXFWIF_DEV_VIRTADDR sHWRTDataFwAddr;
 
@@ -231,7 +233,16 @@ typedef struct {
 /* Dump the physical pages of a freelist */
 IMG_BOOL RGXDumpFreeListPageList(RGX_FREELIST *psFreeList);
 
-
+PVRSRV_ERROR RGXCreateHWRTDataSet2(CONNECTION_DATA          *psConnection,
+                                   PVRSRV_DEVICE_NODE       *psDeviceNode,
+                                   IMG_DEV_VIRTADDR         psVHeapTableDevVAddr,
+                                   DEVMEMINT_RESERVATION2   *psPMMListsReservation,
+                                   DEVMEMINT_RESERVATION2   *psPMStateReservation,
+                                   DEVMEMINT_RESERVATION2   *psPMSecureStateReservation,
+                                   RGX_FREELIST             *apsFreeLists[RGXMKIF_NUM_RTDATA_FREELISTS],
+                                   IMG_DEV_VIRTADDR         asTailPtrsDevVAddr[RGXMKIF_NUM_GEOMDATAS],
+                                   IMG_UINT16               ui16MaxRTs,
+                                   RGX_KM_HW_RT_DATASET     *pasKMHWRTDataSet[RGXMKIF_NUM_RTDATAS]);
 
 /* Create HWRTDataSet */
 PVRSRV_ERROR RGXCreateHWRTDataSet(CONNECTION_DATA          *psConnection,
diff --git a/drivers/gpu/img-rogue/23.2/services/server/env/linux/module_common.c b/drivers/gpu/img-rogue/23.2/services/server/env/linux/module_common.c
index 4c40b8b..af54b86 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/env/linux/module_common.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/env/linux/module_common.c
@@ -497,23 +497,40 @@ int PVRSRVDeviceServicesOpen(PVRSRV_DEVICE_NODE *psDeviceNode,
 		goto out;
 	}
 
-	if (psDRMFile->driver_priv == NULL)
-	{
-		/* Allocate psConnectionPriv (stores private data and release pfn under driver_priv) */
-		psConnectionPriv = kzalloc(sizeof(*psConnectionPriv), GFP_KERNEL);
-		if (!psConnectionPriv)
-		{
-			PVR_DPF((PVR_DBG_ERROR, "%s: No memory to allocate driver_priv data", __func__));
-			iErr = -ENOMEM;
-			mutex_unlock(&sDeviceInitMutex);
-			goto fail_alloc_connection_priv;
-		}
-	}
-	else
+	if (psDRMFile->driver_priv != NULL)
 	{
 		psConnectionPriv = (PVRSRV_CONNECTION_PRIV*)psDRMFile->driver_priv;
+
+		/* If there is already a valid connection, we can reuse it */
+		if (psConnectionPriv->ui32Type & DKF_CONNECTION_FLAG_SERVICES)
+		{
+			PVR_DPF((PVR_DBG_WARNING, "%s: Reusing services connection", __func__));
+			iErr = 0;
+			mutex_unlock(&sDeviceInitMutex);
+			goto out;
+		}
+		else
+		{
+			PVR_DPF((PVR_DBG_ERROR,
+			         "%s: Connection has already been initialised",
+			         __func__));
+			iErr = -EINVAL;
+			mutex_unlock(&sDeviceInitMutex);
+			goto out;
+		}
 	}
 
+	/* Allocate psConnectionPriv (stores private data and release pfn under driver_priv) */
+	psConnectionPriv = kzalloc(sizeof(*psConnectionPriv), GFP_KERNEL);
+	if (!psConnectionPriv)
+	{
+		PVR_DPF((PVR_DBG_ERROR, "%s: No memory to allocate driver_priv data", __func__));
+		iErr = -ENOMEM;
+		mutex_unlock(&sDeviceInitMutex);
+		goto fail_alloc_connection_priv;
+	}
+	psConnectionPriv->ui32Type = DKF_CONNECTION_FLAG_SERVICES;
+
 	if (psDeviceNode->eDevState == PVRSRV_DEVICE_STATE_CREATED)
 	{
 		eError = PVRSRVCommonDeviceInitialise(psDeviceNode);
@@ -565,6 +582,7 @@ int PVRSRVDeviceServicesOpen(PVRSRV_DEVICE_NODE *psDeviceNode,
 
 fail_connect:
 fail_device_init:
+	psDRMFile->driver_priv = NULL;
 	kfree(psConnectionPriv);
 fail_alloc_connection_priv:
 out:
@@ -598,6 +616,36 @@ static int PVRSRVDeviceSyncOpen(PVRSRV_DEVICE_NODE *psDeviceNode,
 		goto out;
 	}
 
+	if (psDRMFile->driver_priv != NULL)
+	{
+		psConnectionPriv = (PVRSRV_CONNECTION_PRIV*)psDRMFile->driver_priv;
+
+		/* If there is already a valid connection, we can reuse it */
+		if (psConnectionPriv->ui32Type & DKF_CONNECTION_FLAG_SYNC)
+		{
+			PVR_DPF((PVR_DBG_WARNING, "%s: Reusing sync connection", __func__));
+			iErr = 0;
+			goto out;
+		}
+#if (PVRSRV_DEVICE_INIT_MODE == PVRSRV_LINUX_DEV_INIT_ON_CONNECT)
+		else
+		{
+			PVR_DPF((PVR_DBG_ERROR,
+			         "%s: Connection has already been initialised",
+			         __func__));
+			iErr = -EINVAL;
+			goto out;
+		}
+#endif
+	}
+
+	/* It's valid for the driver_priv to point to a services connection allocation,
+	 * when PVRSRV_DEVICE_INIT_MODE != PVRSRV_LINUX_DEV_INIT_ON_CONNECT. This
+	 * function will extend the driver_priv with further initialisation to
+	 * `psConnectionPriv->pvSyncConnectionData`.
+	 *
+	 * However, this case is invalid when PVRSRV_DEVICE_INIT_MODE == PVRSRV_LINUX_DEV_INIT_ON_CONNECT;
+	 * driver_priv should be NULL at this point and a new allocation be initialised. */
 	if (psDRMFile->driver_priv == NULL)
 	{
 		/* Allocate psConnectionPriv (stores private data and release pfn under driver_priv) */
@@ -609,10 +657,8 @@ static int PVRSRVDeviceSyncOpen(PVRSRV_DEVICE_NODE *psDeviceNode,
 			goto out;
 		}
 	}
-	else
-	{
-		psConnectionPriv = (PVRSRV_CONNECTION_PRIV*)psDRMFile->driver_priv;
-	}
+
+	psConnectionPriv->ui32Type = DKF_CONNECTION_FLAG_SYNC;
 
 	/* Allocate connection data area, no stats since process not registered yet */
 	psConnection = kzalloc(sizeof(*psConnection), GFP_KERNEL);
@@ -668,6 +714,7 @@ static int PVRSRVDeviceSyncOpen(PVRSRV_DEVICE_NODE *psDeviceNode,
 fail_private_data_init:
 	kfree(psConnection);
 fail_alloc_connection:
+	psDRMFile->driver_priv = NULL;
 	kfree(psConnectionPriv);
 out:
 	return iErr;
diff --git a/drivers/gpu/img-rogue/23.2/services/server/env/linux/module_common.h b/drivers/gpu/img-rogue/23.2/services/server/env/linux/module_common.h
index 811cacd..43588c6 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/env/linux/module_common.h
+++ b/drivers/gpu/img-rogue/23.2/services/server/env/linux/module_common.h
@@ -48,6 +48,11 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 /* DRVNAME is the name we use to register our driver. */
 #define DRVNAME PVR_LDM_DRIVER_REGISTRATION_NAME
 
+#define DKF_CONNECTION_FLAG_SYNC        BIT(0)
+#define DKF_CONNECTION_FLAG_SERVICES    BIT(1)
+
+#define DKF_CONNECTION_FLAG_INVALID     IMG_UINT32_C(0)
+
 struct _PVRSRV_DEVICE_NODE_;
 struct drm_file;
 struct drm_device;
@@ -87,6 +92,10 @@ typedef struct
 	void *pvGpuWorkPeriodEventStats;
 #endif /* defined(PVRSRV_ANDROID_TRACE_GPU_WORK_PERIOD) */
 
+	/* An integer representing the type of connection.
+	 */
+	uint32_t ui32Type;
+
 } PVRSRV_CONNECTION_PRIV;
 
 int PVRSRVDriverInit(void);
diff --git a/drivers/gpu/img-rogue/23.2/services/server/env/linux/physmem_dmabuf.c b/drivers/gpu/img-rogue/23.2/services/server/env/linux/physmem_dmabuf.c
index 1fbddd7..9c4b2b7 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/env/linux/physmem_dmabuf.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/env/linux/physmem_dmabuf.c
@@ -848,6 +848,19 @@ PhysmemExportDmaBuf(CONNECTION_DATA *psConnection,
 	IMG_DEVMEM_SIZE_T uiPMRSize;
 	PVRSRV_ERROR eError;
 	IMG_INT iFd;
+	IMG_INT iDmaBufFlags = 0;
+	PVRSRV_MEMALLOCFLAGS_T ui64Flags = 0;
+	IMG_BOOL bIsPMRReadable = IMG_FALSE;
+	IMG_BOOL bIsPMRWritable = IMG_FALSE;
+
+	/* Exporting a PMR which was originally created from an imported DmaBuf
+	 * is not supported.
+	 */
+	PVR_RETURN_IF_FALSE(PMR_GetType(psPMR) != PMR_TYPE_DMABUF,
+	                    PVRSRV_ERROR_PMR_WRONG_PMR_TYPE);
+
+	eError = PMR_IsExportable(psPMR);
+	PVR_LOG_RETURN_IF_ERROR(eError, "PMR_IsExportable");
 
 	PMRFactoryLock();
 
@@ -855,6 +868,30 @@ PhysmemExportDmaBuf(CONNECTION_DATA *psConnection,
 
 	PMR_LogicalSize(psPMR, &uiPMRSize);
 
+	ui64Flags = PMR_Flags(psPMR);
+	bIsPMRReadable = PVRSRV_CHECK_CPU_READABLE(ui64Flags)        ||
+	                 PVRSRV_CHECK_CPU_READ_PERMITTED(ui64Flags)  ||
+	                 PVRSRV_CHECK_GPU_READABLE(ui64Flags)        ||
+	                 PVRSRV_CHECK_GPU_READ_PERMITTED(ui64Flags);
+	bIsPMRWritable = PVRSRV_CHECK_CPU_WRITEABLE(ui64Flags)       ||
+	                 PVRSRV_CHECK_CPU_WRITE_PERMITTED(ui64Flags) ||
+	                 PVRSRV_CHECK_GPU_WRITEABLE(ui64Flags)       ||
+	                 PVRSRV_CHECK_GPU_WRITE_PERMITTED(ui64Flags);
+
+	if (bIsPMRReadable && bIsPMRWritable)
+
+	{
+		iDmaBufFlags = O_RDWR;
+	}
+	else if (bIsPMRWritable)
+	{
+		iDmaBufFlags = O_WRONLY;
+	}
+	else
+	{
+		iDmaBufFlags = O_RDONLY;
+	}
+
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0))
 	{
 		DEFINE_DMA_BUF_EXPORT_INFO(sDmaBufExportInfo);
@@ -862,16 +899,16 @@ PhysmemExportDmaBuf(CONNECTION_DATA *psConnection,
 		sDmaBufExportInfo.priv  = psPMR;
 		sDmaBufExportInfo.ops   = &sPVRDmaBufOps;
 		sDmaBufExportInfo.size  = uiPMRSize;
-		sDmaBufExportInfo.flags = O_RDWR;
+		sDmaBufExportInfo.flags = iDmaBufFlags;
 
 		psDmaBuf = dma_buf_export(&sDmaBufExportInfo);
 	}
 #elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 17, 0))
 	psDmaBuf = dma_buf_export(psPMR, &sPVRDmaBufOps,
-	                          uiPMRSize, O_RDWR, NULL);
+	                          uiPMRSize, iDmaBufFlags, NULL);
 #else
 	psDmaBuf = dma_buf_export(psPMR, &sPVRDmaBufOps,
-	                          uiPMRSize, O_RDWR);
+	                          uiPMRSize, iDmaBufFlags);
 #endif
 
 	if (IS_ERR_OR_NULL(psDmaBuf))
@@ -882,7 +919,7 @@ PhysmemExportDmaBuf(CONNECTION_DATA *psConnection,
 		goto fail_pmr_ref;
 	}
 
-	iFd = dma_buf_fd(psDmaBuf, O_RDWR);
+	iFd = dma_buf_fd(psDmaBuf, iDmaBufFlags);
 	if (iFd < 0)
 	{
 		PVR_DPF((PVR_DBG_ERROR, "%s: Failed to get dma-buf fd (err=%d)",
@@ -921,6 +958,62 @@ PhysmemExportDmaBuf(CONNECTION_DATA *psConnection,
 	return eError;
 }
 
+/* Validate permissions of dma_buf FD against PMR flags */
+static PVRSRV_ERROR
+ValidateDmaBufFdFlags(struct file *psFile,
+                      PVRSRV_MEMALLOCFLAGS_T uiFlags)
+{
+	PVRSRV_ERROR eError = PVRSRV_OK;
+	IMG_BOOL bIsPMRReadable = IMG_FALSE;
+	IMG_BOOL bIsPMRWritable = IMG_FALSE;
+
+	bIsPMRReadable = PVRSRV_CHECK_CPU_READABLE(uiFlags)        ||
+	                 PVRSRV_CHECK_CPU_READ_PERMITTED(uiFlags)  ||
+	                 PVRSRV_CHECK_GPU_READABLE(uiFlags)        ||
+	                 PVRSRV_CHECK_GPU_READ_PERMITTED(uiFlags);
+	bIsPMRWritable = PVRSRV_CHECK_CPU_WRITEABLE(uiFlags)       ||
+	                 PVRSRV_CHECK_CPU_WRITE_PERMITTED(uiFlags) ||
+	                 PVRSRV_CHECK_GPU_WRITEABLE(uiFlags)       ||
+	                 PVRSRV_CHECK_GPU_WRITE_PERMITTED(uiFlags);
+
+	/* Requested flags must have either READ or WRITE or both permissions */
+	if (!bIsPMRReadable && !bIsPMRWritable)
+	{
+		PVR_DPF((PVR_DBG_ERROR, "%s: Invalid flags! "
+		         "dma_buf cannot be imported to PMR without any R/W flags. "
+		         "uiFlags = 0x%" PVRSRV_MEMALLOCFLAGS_FMTSPEC,
+		         __func__,
+		         uiFlags));
+		return PVRSRV_ERROR_INVALID_FLAGS;
+	}
+
+	/* Check for read permission mismatch between DmaBuf and PMR */
+	if (!(psFile->f_mode & FMODE_READ) && bIsPMRReadable)
+	{
+		PVR_DPF((PVR_DBG_ERROR, "%s: Read permission does not match! "
+		         "psFile->f_mode = 0x%x, "
+		         "uiFlags = 0x%" PVRSRV_MEMALLOCFLAGS_FMTSPEC,
+		         __func__,
+		         psFile->f_mode,
+		         uiFlags));
+		eError = PVRSRV_ERROR_INVALID_FLAGS;
+	}
+
+	/* Check for write permission mismatch between DmaBuf and PMR */
+	if (!(psFile->f_mode & FMODE_WRITE) && bIsPMRWritable)
+	{
+		PVR_DPF((PVR_DBG_ERROR, "%s: Write permission does not match! "
+		         "psFile->f_mode = 0x%x, "
+		         "uiFlags = 0x%" PVRSRV_MEMALLOCFLAGS_FMTSPEC,
+		         __func__,
+		         psFile->f_mode,
+		         uiFlags));
+		eError = PVRSRV_ERROR_INVALID_FLAGS;
+	}
+
+	return eError;
+}
+
 PVRSRV_ERROR
 PhysmemImportDmaBuf(CONNECTION_DATA *psConnection,
                     PVRSRV_DEVICE_NODE *psDevNode,
@@ -948,6 +1041,8 @@ PhysmemImportDmaBuf(CONNECTION_DATA *psConnection,
 	}
 
 	uiSize = psDmaBuf->size;
+	eError = ValidateDmaBufFdFlags(psDmaBuf->file, uiFlags);
+	PVR_LOG_GOTO_IF_ERROR(eError, "ValidateDmaBufFdFlags", errDmaBufPut);
 
 	eError = PhysmemImportSparseDmaBuf(psConnection,
 	                                 psDevNode,
@@ -963,6 +1058,7 @@ PhysmemImportDmaBuf(CONNECTION_DATA *psConnection,
 	                                 puiSize,
 	                                 puiAlign);
 
+errDmaBufPut:
 	dma_buf_put(psDmaBuf);
 
 	return eError;
diff --git a/drivers/gpu/img-rogue/23.2/services/server/env/linux/physmem_extmem_linux.c b/drivers/gpu/img-rogue/23.2/services/server/env/linux/physmem_extmem_linux.c
index 7de1200..c01fa32 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/env/linux/physmem_extmem_linux.c
+++ b/drivers/gpu/img-rogue/23.2/services/server/env/linux/physmem_extmem_linux.c
@@ -955,6 +955,7 @@ PhysmemWrapExtMemOS(CONNECTION_DATA * psConnection,
 	PMR_WRAP_DATA *psPrivData;
 	PMR *psPMR;
 	IMG_UINT uiTotalNumPages = (uiSize >> PAGE_SHIFT);
+	IMG_BOOL bIsPMRDestroyed = IMG_FALSE;
 	IMG_UINT i = 0;
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,0,0))
@@ -1055,10 +1056,14 @@ PhysmemWrapExtMemOS(CONNECTION_DATA * psConnection,
 	return PVRSRV_OK;
 e3:
 	PMRUnrefPMR(psPMR);
+	bIsPMRDestroyed = IMG_TRUE;
 e2:
 	OSFreeMem(pui32MappingTable);
 e1:
-	_WrapExtMemReleasePages(psPrivData);
+	if (!bIsPMRDestroyed)
+	{
+		(void)_WrapExtMemReleasePages(psPrivData);
+	}
 e0:
 	return eError;
 }
diff --git a/drivers/gpu/img-rogue/23.2/services/server/include/device.h b/drivers/gpu/img-rogue/23.2/services/server/include/device.h
index e7cce64..96dd315 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/include/device.h
+++ b/drivers/gpu/img-rogue/23.2/services/server/include/device.h
@@ -69,6 +69,7 @@ typedef struct _PVRSRV_POWER_DEV_TAG_ *PPVRSRV_POWER_DEV;
 struct SYNC_RECORD;
 
 struct _CONNECTION_DATA_;
+struct _DEVMEMINT_CTX_;
 
 /*************************************************************************/ /*!
  @Function      AllocUFOBlockCallback
@@ -399,6 +400,8 @@ typedef struct _PVRSRV_DEVICE_NODE_
 
 	MMU_DEVICEATTRIBS* (*pfnGetMMUDeviceAttributes)(struct _PVRSRV_DEVICE_NODE_ *psDevNode, IMG_BOOL bKernelMemoryCtx);
 
+	PVRSRV_DEVICE_SNOOP_MODE (*pfnGetDeviceSnoopMode)(struct _PVRSRV_DEVICE_NODE_ *psDevNode);
+
 	PVRSRV_DEVICE_CONFIG	*psDevConfig;
 
 	/* device post-finalise compatibility check */
@@ -477,9 +480,13 @@ typedef struct _PVRSRV_DEVICE_NODE_
 	/* Functions for notification about memory contexts */
 	PVRSRV_ERROR			(*pfnRegisterMemoryContext)(struct _PVRSRV_DEVICE_NODE_	*psDeviceNode,
 														MMU_CONTEXT					*psMMUContext,
+														struct _DEVMEMINT_CTX_		*psDevMemCtx,
 														IMG_HANDLE					*hPrivData);
 	void					(*pfnUnregisterMemoryContext)(IMG_HANDLE hPrivData);
 
+	/* Functions for validation flags for exportable PMRs */
+	IMG_BOOL (*pfnValidateExportableFlags)(PVRSRV_MEMALLOCFLAGS_T uiFlags);
+
 	/* Functions for allocation/freeing of UFOs */
 	AllocUFOBlockCallback	pfnAllocUFOBlock;	/*!< Callback for allocation of a block of UFO memory */
 	FreeUFOBlockCallback	pfnFreeUFOBlock;	/*!< Callback for freeing of a block of UFO memory */
@@ -601,6 +608,9 @@ typedef struct _PVRSRV_DEVICE_NODE_
 	ATOMIC_T                iFreezeCount;         /*< Number of blocked on frozen tasks */
 	ATOMIC_T                iTotalFreezes;        /*< Total number of times device frozen */
 	ATOMIC_T                iThreadsActive;       /*< Number of threads active on this device */
+#if defined(PVRSRV_MAX_REAL_TIME_CONTEXTS) && (PVRSRV_MAX_REAL_TIME_CONTEXTS > 1)
+	IMG_UINT32              *pui32RTContextCount;
+#endif
 } PVRSRV_DEVICE_NODE;
 
 /*
diff --git a/drivers/gpu/img-rogue/23.2/services/server/include/devicemem_server.h b/drivers/gpu/img-rogue/23.2/services/server/include/devicemem_server.h
index 7bd8a78..f4c741d 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/include/devicemem_server.h
+++ b/drivers/gpu/img-rogue/23.2/services/server/include/devicemem_server.h
@@ -144,6 +144,20 @@ PVRSRV_ERROR
 DevmemIntCtxDestroy(DEVMEMINT_CTX *psDevmemCtx);
 
 /*
+ * DevmemIntCtxRef()
+ *
+ * Increases the reference count on the given DEVMEMINT_CTX by one.
+ */
+PVRSRV_ERROR DevmemIntCtxRef(DEVMEMINT_CTX *psDevmemCtx);
+
+/*
+ * DevmemIntCtxUnref()
+ *
+ * Decreases the reference count on the given DEVMEMINT_CTX by one.
+ */
+void DevmemIntCtxUnref(DEVMEMINT_CTX *psDevmemCtx);
+
+/*
  * DevmemIntHeapCreate()
  *
  * Creates a new heap in this device memory context.  This will cause a call
@@ -172,6 +186,7 @@ DevmemIntHeapCreate(DEVMEMINT_CTX *psDevmemCtx,
                     IMG_DEV_VIRTADDR sHeapBaseAddr,
                     IMG_UINT32 uiLog2DataPageSize,
                     DEVMEMINT_HEAP **ppsDevmemHeapPtr);
+
 /*
  * DevmemIntHeapDestroy()
  *
diff --git a/drivers/gpu/img-rogue/23.2/services/server/include/pmr.h b/drivers/gpu/img-rogue/23.2/services/server/include/pmr.h
index e4d64ea..18c77b1 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/include/pmr.h
+++ b/drivers/gpu/img-rogue/23.2/services/server/include/pmr.h
@@ -627,6 +627,9 @@ PMR_GetTypeStr(const PMR *psPMR);
 IMG_INT32
 PMR_GetRefCount(const PMR *psPMR);
 
+PVRSRV_ERROR
+PMR_IsExportable(const PMR *psPMR);
+
 /* PMR usage type for callers of PMR_DevPhysAddr() */
 typedef enum _PMR_USAGE_TYPE_
 {
@@ -683,6 +686,14 @@ PVRSRV_ERROR
 PMRGetUID(PMR *psPMR,
           IMG_UINT64 *pui64UID);
 
+#if defined(PVRSRV_ENABLE_GPU_MEMORY_INFO)
+/* PMRGetSerialNum()
+ *
+ * Used by procfs code to retrieve a PMR serial number
+ * */
+IMG_UINT64 PMRGetSerialNum(PMR *psPMR);
+#endif
+
 #if defined(SUPPORT_PMR_DEFERRED_FREE)
 /*
  * PMR_IsZombie()
@@ -722,6 +733,10 @@ void
 PMRReviveZombieAndRef(PMR *psPMR);
 #endif /* defined(SUPPORT_PMR_DEFERRED_FREE) */
 
+
+IMG_BOOL
+PMR_SetExclusiveUse(PMR *psPMR, IMG_BOOL bFlag);
+
 /*
  * PMR_ChangeSparseMemUnlocked()
  *
diff --git a/drivers/gpu/img-rogue/23.2/services/server/include/srvcore.h b/drivers/gpu/img-rogue/23.2/services/server/include/srvcore.h
index 3316593..cbf84e9 100644
--- a/drivers/gpu/img-rogue/23.2/services/server/include/srvcore.h
+++ b/drivers/gpu/img-rogue/23.2/services/server/include/srvcore.h
@@ -66,7 +66,7 @@ CopyToUserWrapper(CONNECTION_DATA *psConnection,
                   void *pvSrc,
                   IMG_UINT32 ui32Size);
 
-IMG_INT
+size_t
 DummyBW(IMG_UINT32 ui32DispatchTableEntry,
         IMG_UINT8 *psBridgeIn,
         IMG_UINT8 *psBridgeOut,
@@ -74,7 +74,7 @@ DummyBW(IMG_UINT32 ui32DispatchTableEntry,
 
 typedef PVRSRV_ERROR (*ServerResourceDestroyFunction)(IMG_HANDLE, IMG_HANDLE);
 
-typedef IMG_INT (*BridgeWrapperFunction)(IMG_UINT32 ui32DispatchTableEntry,
+typedef size_t (*BridgeWrapperFunction)(IMG_UINT32 ui32DispatchTableEntry,
 									 IMG_UINT8 *psBridgeIn,
 									 IMG_UINT8 *psBridgeOut,
 									 CONNECTION_DATA *psConnection);
diff --git a/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmi_ioctl.c b/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmi_ioctl.c
index c29cd68..e9b8ed7 100644
--- a/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmi_ioctl.c
+++ b/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmi_ioctl.c
@@ -34,31 +34,6 @@
 #define HDMI_DEVNAME "hdmitx"
 DEFINE_SEMAPHORE(hdmi_update_mutex);
 
-#define HDMI_EMIT_HDMISTATE_TYPE_STR(x)  (                            \
-	(x) == EMIT_HDMISTATE_EDID_I2C_ERROR  ? "EDID_I2C_ERROR" : \
-	(x) == EMIT_HDMISTATE_EDID_HEAD_ERROR  ? "EDID_HEAD_ERROR" : \
-	(x) == EMIT_HDMISTATE_EDID_CHECKSUM_ERROR  ? "EDID_CHECKSUM_ERROR" : \
-	(x) == EMIT_HDMISTATE_EDID_DVI_DEVICE  ? "EDID_DVI_DEVICE" : \
-	(x) == EMIT_HDMISTATE_EDID_HDMI_DEVICE  ? "EDID_HDMI_DEVICE" : \
-	(x) == EMIT_HDMISTATE_HDCP_SUCCESS  ? "HDCP_SUCCESS" : \
-	(x) == EMIT_HDMISTATE_HDCP_FAILURE  ? "HDCP_FAILURE" : \
-	(x) == EMIT_HDMISTATE_HDCP_R0_MISMATCH  ? "HDCP_R0_MISMATCH" : \
-	(x) == EMIT_HDMISTATE_HDCP_NO_14_KEY  ? "HDCP_NO_14_KEY" : \
-	(x) == EMIT_HDMISTATE_HDCP_NO_22_KEY  ? "HDCP_NO_22_KEY" : \
-	(x) == EMIT_HDMISTATE_HDCP_BKSV_ERROR  ? "HDCP_BKSV_ERROR" : \
-	(x) == EMIT_HDMISTATE_HDCP_V_PRIME_MISMATCH  ? "HDCP_V_PRIME_MISMATCH" : \
-	(x) == EMIT_HDMISTATE_HDCP_TOPOLOGY_ERROR  ? "HDCP_TOPOLOGY_ERROR" : \
-	(x) == EMIT_HDMISTATE_HDCP_REPEATER_DELAY_ERROR  ? "HDCP_REPEATER_DELAY_ERROR" : \
-	(x) == EMIT_HDMISTATE_HDCP_DEVICE_NOT_READY  ? "HDCP_DEVICE_NOT_READY" : \
-	(x) == EMIT_HDMISTATE_HDCP_I2C_ERROR  ? "HDCP_I2C_ERROR" : \
-	(x) == EMIT_HDMISTATE_HDCP_DISABLE  ? "HDCP_DISABLE" : \
-	(x) == EMIT_HDMISTATE_HDCP_HDCP1_ENABLE  ? "HDCP_HDCP1_ENABLE" : \
-	(x) == EMIT_HDMISTATE_HDCP_HDCP2_ENABLE  ? "HDCP_HDCP2_ENABLE" : \
-	(x) == EMIT_HDMISTATE_SCDC_CH0_ERROR  ? "SCDC_CH0_ERROR" : \
-	(x) == EMIT_HDMISTATE_SCDC_CH1_ERROR  ? "SCDC_CH1_ERROR" : \
-	(x) == EMIT_HDMISTATE_SCDC_CH2_ERROR  ? "SCDC_CH2_ERROR" : \
-	"Unknown")
-
 struct extcon_dev *hdmi_extcon;
 static const unsigned int hdmi_cable[] = {
 	EXTCON_DISP_HDMI,
@@ -1838,6 +1813,7 @@ unsigned int hdmi_common_buf_offset;
 static ssize_t hdmi_common_status_show(struct device *dev,
 	struct device_attribute *devattr, char *buf)
 {
+	hdmi_hdmistatus();
 	return snprintf(buf, sizeof(hdmi_common_status),
 		"%s\n", hdmi_common_status);
 }
diff --git a/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmicec.c b/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmicec.c
index 68432d5..ec953f1 100644
--- a/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmicec.c
+++ b/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmicec.c
@@ -2051,9 +2051,7 @@ void hdmi_cec_mainloop(unsigned char u1rxmode)
 
 	_CEC_TX_Queue_Loop(cec);
 
-	/* NOTE: the priority between tx and rx */
-	if (!IsCECStatus(STATE_TXING_FRAME))
-		CEC_rx_msg_notify(u1rxmode);
+	CEC_rx_msg_notify(u1rxmode);
 
 }
 
diff --git a/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmictrl.c b/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmictrl.c
index f98ef28..e0c2123 100644
--- a/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmictrl.c
+++ b/drivers/misc/mediatek/hdmi/hdmitx/mt8696/hdmictrl.c
@@ -2321,6 +2321,9 @@ void hdmi_hdmistatus(void)
 		u4Addr = u4Addr + 4;
 		u4Count = u4Count - 4;
 	}
+
+	vshow_hdmi_emitstate_status();
+
 	HDMI_COM_SPRINTF("End\n");
 }
 
@@ -6613,6 +6616,17 @@ void vshow_audio_status(void)
 		bReadByteHdmiGRL(AIP_STA00), bReadByteHdmiGRL(AIP_STA01));
 }
 
+void vshow_hdmi_emitstate_status(void)
+{
+	unsigned int i = 0;
+
+	/* dump hdmi_emitstate */
+	HDMI_COM_SPRINTF("Dump hdmi_emitstate Start\n");
+	for (i = 0; i < sizeof(hdmi_emitstate) / sizeof(hdmi_emitstate[0]); i++)
+		HDMI_COM_SPRINTF("%s = %d\n",
+				 HDMI_EMIT_HDMISTATE_TYPE_STR(i), hdmi_emitstate[i]);
+}
+
 void vcommon_status(char *str)
 {
 	int len;
diff --git a/drivers/misc/mediatek/hdmi/hdmitx/mt8696/inc/hdmictrl.h b/drivers/misc/mediatek/hdmi/hdmitx/mt8696/inc/hdmictrl.h
index d9ba265..71a41c0 100644
--- a/drivers/misc/mediatek/hdmi/hdmitx/mt8696/inc/hdmictrl.h
+++ b/drivers/misc/mediatek/hdmi/hdmitx/mt8696/inc/hdmictrl.h
@@ -3448,6 +3448,7 @@ extern void vcommon_status(char *str);
 void vshow_hdr_status(void);
 void vshow_hdmi21_status(void);
 void vshow_audio_status(void);
+void vshow_hdmi_emitstate_status(void);
 void vResetAudioHDMI(unsigned char bRst);
 void vResetVideoHDMI(unsigned char bRst);
 void vAudioPacketOff(unsigned char bOn);
diff --git a/drivers/misc/mediatek/hdmi/hdmitx/mt8696/inc/internal_hdmi_drv.h b/drivers/misc/mediatek/hdmi/hdmitx/mt8696/inc/internal_hdmi_drv.h
index 9850b9a..6e90371 100644
--- a/drivers/misc/mediatek/hdmi/hdmitx/mt8696/inc/internal_hdmi_drv.h
+++ b/drivers/misc/mediatek/hdmi/hdmitx/mt8696/inc/internal_hdmi_drv.h
@@ -63,6 +63,31 @@ do { \
 	} \
 } while (0)
 
+#define HDMI_EMIT_HDMISTATE_TYPE_STR(x)  (                            \
+			(x) == EMIT_HDMISTATE_EDID_I2C_ERROR  ? "EDID_I2C_ERROR" : \
+			(x) == EMIT_HDMISTATE_EDID_HEAD_ERROR  ? "EDID_HEAD_ERROR" : \
+			(x) == EMIT_HDMISTATE_EDID_CHECKSUM_ERROR  ? "EDID_CHECKSUM_ERROR" : \
+			(x) == EMIT_HDMISTATE_EDID_DVI_DEVICE  ? "EDID_DVI_DEVICE" : \
+			(x) == EMIT_HDMISTATE_EDID_HDMI_DEVICE	? "EDID_HDMI_DEVICE" : \
+			(x) == EMIT_HDMISTATE_HDCP_SUCCESS	? "HDCP_SUCCESS" : \
+			(x) == EMIT_HDMISTATE_HDCP_FAILURE	? "HDCP_FAILURE" : \
+			(x) == EMIT_HDMISTATE_HDCP_R0_MISMATCH	? "HDCP_R0_MISMATCH" : \
+			(x) == EMIT_HDMISTATE_HDCP_NO_14_KEY  ? "HDCP_NO_14_KEY" : \
+			(x) == EMIT_HDMISTATE_HDCP_NO_22_KEY  ? "HDCP_NO_22_KEY" : \
+			(x) == EMIT_HDMISTATE_HDCP_BKSV_ERROR  ? "HDCP_BKSV_ERROR" : \
+			(x) == EMIT_HDMISTATE_HDCP_V_PRIME_MISMATCH  ? "HDCP_V_PRIME_MISMATCH" : \
+			(x) == EMIT_HDMISTATE_HDCP_TOPOLOGY_ERROR  ? "HDCP_TOPOLOGY_ERROR" : \
+			(x) == EMIT_HDMISTATE_HDCP_REPEATER_DELAY_ERROR  ? "HDCP_REPEATER_DELAY_ERROR" : \
+			(x) == EMIT_HDMISTATE_HDCP_DEVICE_NOT_READY  ? "HDCP_DEVICE_NOT_READY" : \
+			(x) == EMIT_HDMISTATE_HDCP_I2C_ERROR  ? "HDCP_I2C_ERROR" : \
+			(x) == EMIT_HDMISTATE_HDCP_DISABLE	? "HDCP_DISABLE" : \
+			(x) == EMIT_HDMISTATE_HDCP_HDCP1_ENABLE  ? "HDCP_HDCP1_ENABLE" : \
+			(x) == EMIT_HDMISTATE_HDCP_HDCP2_ENABLE  ? "HDCP_HDCP2_ENABLE" : \
+			(x) == EMIT_HDMISTATE_SCDC_CH0_ERROR  ? "SCDC_CH0_ERROR" : \
+			(x) == EMIT_HDMISTATE_SCDC_CH1_ERROR  ? "SCDC_CH1_ERROR" : \
+			(x) == EMIT_HDMISTATE_SCDC_CH2_ERROR  ? "SCDC_CH2_ERROR" : \
+			"Unknown")
+
 enum HDMI_TASK_COMMAND_TYPE_T {
 	HDMI_CEC_CMD = 0,
 	HDMI_PLUG_DETECT_CMD,
diff --git a/drivers/misc/mediatek/video/mt8696/dispsys/fg/disp_fg_if.c b/drivers/misc/mediatek/video/mt8696/dispsys/fg/disp_fg_if.c
index 366d4cf..b48f81c 100644
--- a/drivers/misc/mediatek/video/mt8696/dispsys/fg/disp_fg_if.c
+++ b/drivers/misc/mediatek/video/mt8696/dispsys/fg/disp_fg_if.c
@@ -340,7 +340,9 @@ void disp_fg_config(u32 fg_hw_id, struct mtk_av1_film_grain_params *fg_param)
 			 fg_param->ar_coeff_shift,
 			 fg_param->grain_scale_shift);
 
-		if (fg_param->update_grain)
+		if (!fg_param->apply_grain)
+			goto bypass_fg;
+		else if (fg_param->update_grain)
 			memcpy(param, fg_param,
 			       sizeof(struct mtk_av1_film_grain_params));
 		else
@@ -358,6 +360,10 @@ void disp_fg_config(u32 fg_hw_id, struct mtk_av1_film_grain_params *fg_param)
 		disp_adl_cfg_client_en(adl_tbl->client, 1, 0);
 		disp_filmg_config_adl_table(adl_tbl);
 	}
+
+	return;
+bypass_fg:
+	fg_hal_bypass(fg_hw_id, true);
 }
 
 /***************** driver ************/
diff --git a/drivers/misc/mediatek/vq/mtk_di_m2m.c b/drivers/misc/mediatek/vq/mtk_di_m2m.c
index 6d5237e..92bdfb1 100644
--- a/drivers/misc/mediatek/vq/mtk_di_m2m.c
+++ b/drivers/misc/mediatek/vq/mtk_di_m2m.c
@@ -252,6 +252,8 @@ static void mtk_di_m2m_job_finish(struct mtk_di_ctx *ctx, int vb_state)
 			dst_vbuf->flags |= to_vb2_v4l2_buffer(
 				ctx->s_buf[S_IDX_CURR((ctx->s_idx_next))].vb)->flags
 				& V4L2_BUF_FLAG_LAST;
+			dst_vbuf->vb2_buf.planes[0].bytesused =
+			to_vb2_v4l2_buffer(ctx->s_buf[S_IDX_CURR((ctx->s_idx_next))].vb)->planes[0].bytesused;
 
 			DI_INFO("%s timestamp[0x%llx] flag[0x%x]\n",
 				__func__, dst_vbuf->vb2_buf.timestamp, dst_vbuf->flags);
@@ -272,9 +274,9 @@ static void mtk_di_m2m_job_finish(struct mtk_di_ctx *ctx, int vb_state)
 	}
 #endif
 
-	if ((dst_vbuf && (V4L2_BUF_FLAG_LAST & dst_vbuf->flags)) ||
-		((ctx->stop_flag == 2) && (ctx->process_idx == 0U))) {
-
+	if ((((dst_vbuf && (V4L2_BUF_FLAG_LAST & dst_vbuf->flags)) ||
+	    (ctx->stop_flag == 2)) && (ctx->process_idx == 0U)) ||
+	    (dst_vbuf->vb2_buf.planes[0].bytesused == 0)) {
 		src_vbuf = v4l2_m2m_src_buf_remove(ctx->m2m_ctx);
 		src_vb = &src_vbuf->vb2_buf;
 
@@ -700,7 +702,7 @@ static void mtk_di_m2m_worker(struct work_struct *work)
 		goto put_device;
 	}
 
-	DI_INFO("%s ok to get buf\n");
+	DI_INFO("%s ok to get buf\n", __func__);
 
 	if (!((0U ==
 	       to_vb2_v4l2_buffer(
@@ -1201,14 +1203,29 @@ static int mtk_di_m2m_qbuf(struct file *file, void *fh, struct v4l2_buffer *buf)
 {
 	int ret;
 	struct mtk_di_ctx *ctx = fh_to_ctx(fh);
+	struct vb2_queue *vq = NULL;
+	struct vb2_buffer *vb = NULL;
 
 	DI_INFO("qbuf [%d %d %d %d] [%d %d %d %d] [%d %d %d %ld]\n",
 		buf->index, buf->type, buf->bytesused, buf->flags,
 		buf->field, buf->sequence, buf->memory, buf->length,
-		buf->m.planes->bytesused, buf->m.planes->data_offset,
+		buf->m.planes[0].bytesused, buf->m.planes->data_offset,
 		buf->m.planes->length, buf->m.planes->m.userptr);
 
 	ret = v4l2_m2m_qbuf(file, ctx->m2m_ctx, buf);
+	if ((ret == 0) && (buf->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)) {
+		vq = v4l2_m2m_get_vq(ctx->m2m_ctx, buf->type);
+		if (!vq) {
+			DI_ERR("vq is NULL\n");
+			return -EINVAL;
+		}
+		if (buf->index >= vq->num_buffers) {
+			DI_ERR("out of range\n");
+			return -EINVAL;
+		}
+		vb = vq->bufs[buf->index];
+		vb->planes[0].bytesused = buf->m.planes[0].bytesused;
+	}
 
 	return ret;
 }
@@ -1221,7 +1238,7 @@ static int mtk_di_m2m_dqbuf(struct file *file, void *fh, struct v4l2_buffer *buf
 	DI_INFO("dq [%d %d %d %d] [%d %d %d %d] [%d %d %d %ld]\n",
 		buf->index, buf->type, buf->bytesused, buf->flags,
 		buf->field, buf->sequence, buf->memory, buf->length,
-		buf->m.planes->bytesused, buf->m.planes->data_offset,
+		buf->m.planes[0].bytesused, buf->m.planes->data_offset,
 		buf->m.planes->length, buf->m.planes->m.userptr);
 
 	ret = v4l2_m2m_dqbuf(file, ctx->m2m_ctx, buf);
@@ -1293,6 +1310,7 @@ static int mtk_di_m2m_queue_init(void *priv,
 	src_di->buf_struct_size = (unsigned int)sizeof(struct v4l2_m2m_buffer);
 	src_di->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
 	src_di->dev = &ctx->di_dev->pdev->dev;
+	src_di->allow_zero_bytesused = 1;
 
 	ret = vb2_queue_init(src_di);
 	if (ret)
@@ -1307,6 +1325,7 @@ static int mtk_di_m2m_queue_init(void *priv,
 	dst_di->buf_struct_size = (unsigned int)sizeof(struct v4l2_m2m_buffer);
 	dst_di->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
 	dst_di->dev = &ctx->di_dev->pdev->dev;
+	dst_di->allow_zero_bytesused = 1;
 
 	return vb2_queue_init(dst_di);
 }
diff --git a/drivers/misc/mediatek/vq/mtk_di_util.h b/drivers/misc/mediatek/vq/mtk_di_util.h
index 9ba1b68..03c4bd4 100644
--- a/drivers/misc/mediatek/vq/mtk_di_util.h
+++ b/drivers/misc/mediatek/vq/mtk_di_util.h
@@ -34,7 +34,7 @@
 #include <linux/ioctl.h>
 
 /* some define for features switch */
-#define DI_DROP_ONE_FIELD               1
+#define DI_DROP_ONE_FIELD               0
 #define DI_REDUCE_REF                   0
 
 #define DI_MVA_MAP_VA                   0
diff --git a/mgk.bzl b/mgk.bzl
index 7bbfa7c..a8df7d8 100644
--- a/mgk.bzl
+++ b/mgk.bzl
@@ -20,6 +20,7 @@
 )
 load(
     "//build/kernel/kleaf:kernel.bzl",
+    "kernel_abi",
     "kernel_build",
     "kernel_build_config",
     "kernel_images",
@@ -37,8 +38,15 @@
 
     inputs = []
     system_dlkm_archive = None
-    kernel_images = ["boot.img", "boot-lz4.img", "boot-gz.img", "Image", "Image.lz4", "Image.gz",
-                     "vmlinux"]
+    kernel_images = [
+        "boot.img",
+        "boot-lz4.img",
+        "boot-gz.img",
+        "Image",
+        "Image.lz4",
+        "Image.gz",
+        "vmlinux",
+    ]
     gki_artifacts = kernel_images + ctx.attr.gki_modules
 
     for f in ctx.files.images:
@@ -163,7 +171,7 @@
 
     for module in gki_modules:
         name = paths.basename(module).removesuffix(".ko")
-        insmod_cfg_strs += ["modprobe|system {}".format(name)]
+        insmod_cfg_strs.append("modprobe|system {}".format(name))
 
     return insmod_cfg_strs
 
@@ -175,7 +183,6 @@
         dtbo_names,
         gki_modules,
         in_tree_modules,
-        in_tree_modules_discard,
         kleaf_modules,
         insmod_cfgs = None):
     """Generates rules for building the kernel artifacts for a device.
@@ -205,9 +212,6 @@
             should not include the GKI modules required for the device.
 
 
-        in_tree_modules_discard: A list of in-tree modules that will be built
-            but are not required for the device and should be discarded.
-
         kleaf_modules: A list of labels referring to additional external
             modules that are required for the device.
 
@@ -252,8 +256,8 @@
             "arch/arm64/configs/{}_defconfig".format(name),
         ],
         module_outs = in_tree_modules,
-        module_implicit_outs = in_tree_modules_discard,
         kconfig_ext = "Kconfig.ext",
+        kmi_symbol_list = "//{}:android/abi_gki_aarch64_mtkott".format(common_kernel_dir),
         dtstree = "//kernel_device_modules-5.15/arch/arm64/boot/dts/mediatek:{}.dt".format(dtb_name),
         make_goals = [
             "modules",
@@ -293,6 +297,14 @@
         }),
     )
 
+    kernel_abi(
+        name = "{}_abi".format(name),
+        kernel_build = ":{}".format(name),
+        kernel_modules = [":{}_ext_modules".format(name)],
+        kmi_symbol_list_add_only = True,
+        module_grouping = False,
+    )
+
     kernel_modules_install(
         name = "{}_modules_install".format(name),
         kernel_modules = [":{}_ext_modules".format(name)],
diff --git a/mgk_modules.bzl b/mgk_modules.bzl
index e91d884..6bbc58e 100644
--- a/mgk_modules.bzl
+++ b/mgk_modules.bzl
@@ -27,7 +27,3 @@
     "mm/zsmalloc.ko",
     "net/rfkill/rfkill.ko",
 ]
-
-mgk_implicit_module_out = [
-    "drivers/cpufreq/mediatek-cpufreq-hw.ko",
-]
diff --git a/scripts/update_gki_kernel.sh b/scripts/update_gki_kernel.sh
index 8da64bb..7da7bf3 100755
--- a/scripts/update_gki_kernel.sh
+++ b/scripts/update_gki_kernel.sh
@@ -33,6 +33,8 @@
 KERNEL_PATCHLEVEL=""
 KERNEL_SUBLEVEL=""
 AOSP_COMMIT_INFO=""
+KERNEL_HASH=""
+KERNEL_VERSION_LABEL=""
 
 MANIFEST_DIR="../.repo/manifests"
 SDK_MANIFEST="sdk_only.xml"
@@ -107,6 +109,8 @@
   KERNEL_SUBLEVEL=$(grep -r -m 1 "SUBLEVEL =" Makefile | \
                     sed 's/.*SUBLEVEL = //g')
   AOSP_COMMIT_INFO=$(git log --pretty=format:'%h %s' -1)
+  KERNEL_HASH=$(git log --pretty=format:'%h' -1)
+  KERNEL_VERSION_LABEL=$(git tag --contains ${KERNEL_HASH})
 
   popd > /dev/null
 }
@@ -138,7 +142,14 @@
 }
 
 function commit_and_push_manifest_update() {
-  local merge_msg=$(printf "Update ${AOSP_BRANCH} sync point to (${KERNEL_VERSION}.${KERNEL_PATCHLEVEL}.${KERNEL_SUBLEVEL})\n\nSync SHA:\n${AOSP_COMMIT_INFO}\n\nBug: ${GKI_UPDATE_BUG}")
+  local merge_msg=$(printf "%s\n%s\n%s\n%s\n%s\n%s"\
+  "Update sync point to ${KERNEL_VERSION_LABEL}(${KERNEL_VERSION}.${KERNEL_PATCHLEVEL}.${KERNEL_SUBLEVEL})"\
+  ""\
+  "Sync LOG:"\
+  "${AOSP_COMMIT_INFO}"\
+  ""\
+  "Bug: ${GKI_UPDATE_BUG}"\
+  )
 
   pushd ${MANIFEST_DIR} > /dev/null
 
@@ -160,7 +171,9 @@
   echo -e "KERNEL_VERSION = [${Green}${KERNEL_VERSION}${Color_Off}]"
   echo -e "KERNEL_PATCHLEVEL = [${Green}${KERNEL_PATCHLEVEL}${Color_Off}]"
   echo -e "KERNEL_SUBLEVEL = [${Green}${KERNEL_SUBLEVEL}${Color_Off}]"
-  echo -e "AOSP_COMMIT_INFO = [${Green}${AOSP_COMMIT_INFO}${Color_Off}]\n"
+  echo -e "AOSP_COMMIT_INFO = [${Green}${AOSP_COMMIT_INFO}${Color_Off}]"
+  echo -e "KERNEL_HASH = [${Green}${KERNEL_HASH}${Color_Off}]"
+  echo -e "KERNEL_VERSION_LABEL = [${Green}${KERNEL_VERSION_LABEL}${Color_Off}]\n"
 
   update_manifest_and_sync_gki_kernel
 
@@ -170,13 +183,49 @@
   echo -e "KERNEL_PATCHLEVEL = [${Green}${KERNEL_PATCHLEVEL}${Color_Off}]"
   echo -e "KERNEL_SUBLEVEL = [${Green}${KERNEL_SUBLEVEL}${Color_Off}]"
   echo -e "AOSP_COMMIT_INFO = [${Green}${AOSP_COMMIT_INFO}${Color_Off}]"
+  echo -e "KERNEL_HASH = [${Green}${KERNEL_HASH}${Color_Off}]"
+  echo -e "KERNEL_VERSION_LABEL = [${Green}${KERNEL_VERSION_LABEL}${Color_Off}]\n"
 
   commit_and_push_manifest_update
 }
 
+function get_boot_image_build_time_info() {
+  local ci_url="https://ci.android.com/builds/submitted/${BOOT_IMAGE_BUILDID}/kernel_aarch64/latest/raw/COPIED"
+  wget ${ci_url}
+  exit_if_error $? "Unable to download COPIED"
+
+  local date_regex="([0-9]{4})-([0-9]{2})-([0-9]{2})"
+
+  local raw_content=$(grep -E "$date_regex" "COPIED" | head -n 1)
+  exit_if_error $? "Date information not found in the file."
+
+  rm COPIED
+
+  # --- Search for the date using regex ---
+  if [[ "$raw_content" =~ $date_regex ]]; then
+      local extracted_year="${BASH_REMATCH[1]}"
+      local extracted_month="${BASH_REMATCH[2]}"
+      local extracted_day="${BASH_REMATCH[3]}"
+      echo "${extracted_year}-${extracted_month}-${extracted_day}"
+  else
+      echo "NA"
+  fi
+}
+
 function update_gki_prebuilts_id() {
   local current_build_id
-  local merge_msg=$(printf "Update the GKI prebuilt build ID to ab/${BOOT_IMAGE_BUILDID}\n\nUse GKI prebuilt binaries from ab/${BOOT_IMAGE_BUILDID}\n\nBug: ${GKI_UPDATE_BUG}")
+  local boot_image_build_date=$(get_boot_image_build_time_info)
+  local merge_msg=$(printf "%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s" \
+    "Update the GKI prebuilt build ID to ${AOSP_BRANCH}-ab/${BOOT_IMAGE_BUILDID}" \
+    "" \
+    "Use GKI prebuilt binaries from ab/${BOOT_IMAGE_BUILDID}" \
+    "" \
+    "AOSP branch name: ${AOSP_BRANCH}" \
+    "Build ID: ab/${BOOT_IMAGE_BUILDID}" \
+    "Boot image build date: ${boot_image_build_date}" \
+    "" \
+    "Bug: ${GKI_UPDATE_BUG}" \
+  )
 
   echo -e "\n${Yellow}Updating GKI prebuilts build ID to: ${BOOT_IMAGE_BUILDID} with SHA: ${REV_NEW_AOSP} ...${Color_Off}"
 
diff --git a/scripts/update_symbol_list.sh b/scripts/update_symbol_list.sh
new file mode 100755
index 0000000..acaaa12
--- /dev/null
+++ b/scripts/update_symbol_list.sh
@@ -0,0 +1,156 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Update the symbol list and prepare a suitable commit message for AOSP
+# submission.
+
+readonly GKI_KERNEL_DIR="kernel-5.15"
+readonly GKI_KERNEL_REMOTE="gaosp"
+readonly GKI_KERNEL_BRANCH=$(. ${GKI_KERNEL_DIR}/build.config.constants && echo ${BRANCH})
+readonly SYMBOL_LIST="android/abi_gki_aarch64_mtkott"
+readonly SYMBOL_LIST_NAME="mtkott"
+PREPARE_AOSP_SYMLIST="0"
+BUG=""
+COMMIT_TEXT=""
+ARGS=()
+
+function usage() {
+  cat <<- EOF
+    USAGE: $0 [-p|--prepare-aosp-symlist BUG_NUMBER]
+    -p | --prepare-aosp-symlist BUG_NUMBER   Update the AOSP symbol list in ${GKI_KERNEL_DIR}/
+                                             and create a commit with the provided BUG_NUMBER.
+EOF
+}
+
+# Add a trap to remove the temporary vmlinux in case of an error occurs before
+# we finish.
+function cleanup_trap() {
+  rm -f ${COMMIT_TEXT}
+  exit $1
+}
+trap 'cleanup_trap' EXIT
+
+function exit_if_error() {
+  if [[ $1 -ne 0 ]]; then
+    echo "ERROR: $2: retval=$1" >&2
+    exit $1
+  fi
+}
+
+function verify_aosp_tree {
+  if [[ "${PREPARE_AOSP_SYMLIST}" = "0" ]]; then
+    return
+  fi
+
+  pushd ${GKI_KERNEL_DIR} > /dev/null
+
+  if ! git diff --quiet HEAD; then
+    exit_if_error 1 \
+    "Found uncommitted changes in ${GKI_KERNEL_DIR}/. Commit your changes before updating the symbol list"
+  fi
+
+  popd > /dev/null
+}
+
+function make_symbol_list_commit_text() {
+  COMMIT_TEXT=$(mktemp -t symlist_commit_text.XXXXX)
+  echo "ANDROID: GKI: Update symbol list for ${SYMBOL_LIST_NAME}" > ${COMMIT_TEXT}
+  echo >> ${COMMIT_TEXT}
+  echo "Add required symbols for mtkott." >> ${COMMIT_TEXT}
+  echo >> ${COMMIT_TEXT}
+  echo "Bug: ${BUG}" >> ${COMMIT_TEXT}
+}
+
+function commit_symbol_list_update() {
+  make_symbol_list_commit_text
+
+  pushd ${GKI_KERNEL_DIR} > /dev/null
+
+  if ! git cat-file -e \
+          ${GKI_KERNEL_REMOTE}/${GKI_KERNEL_BRANCH}:${SYMBOL_LIST} \
+          > /dev/null 2>&1; then
+    git add ${SYMBOL_LIST}
+  fi
+
+  git commit --quiet -s -F ${COMMIT_TEXT} -- android/
+  rm -f ${COMMIT_TEXT}
+
+  local curr_commit=$(git rev-parse HEAD)
+
+  git fetch -q ${GKI_KERNEL_REMOTE} ${GKI_KERNEL_BRANCH}
+  git checkout -q ${GKI_KERNEL_REMOTE}/${GKI_KERNEL_BRANCH}
+  git cherry-pick ${curr_commit}
+
+  cat <<- EOF
+    ========================================================
+    An ABI commit in ${GKI_KERNEL_DIR}/ was created for you on the tip of the
+    development branch.
+
+    Please verify your commit(s) before pushing. Here are the steps to perform:
+
+    cd ${GKI_KERNEL_DIR}
+    git log --oneline HEAD
+    git push ${GKI_KERNEL_REMOTE} HEAD:refs/for/${GKI_KERNEL_BRANCH}
+
+    To return the core kernel tree to the previous commit, use:
+    git checkout ${curr_commit}
+EOF
+
+  popd > /dev/null
+}
+
+function update_aosp_symlist() {
+  local config_parameters="--config=kirkwood_64 --config=fast"
+  local build_target="//kernel_device_modules-5.15:kirkwood_64_abi_update_symbol_list"
+
+  tools/bazel run ${config_parameters} ${build_target}
+
+  echo "========================================================"
+  echo " The symbol list has been updated locally in ${GKI_KERNEL_DIR}/."
+  echo " Compiling with BUILD_GKI_KERNEL=1 is now required until"
+  echo " the new symbol(s) are merged."
+}
+
+function read_args() {
+  local next
+
+  while [[ $# -gt 0 ]]; do
+    next="$1"
+
+    case ${next} in
+      -p|--prepare-aosp-symlist)
+        PREPARE_AOSP_SYMLIST="1"
+        BUG="$2"
+        if ! [[ "${BUG}" =~ ^[0-9]+$ ]]; then
+          exit_if_error 1 "Bug numbers should be digits."
+        fi
+        shift
+        ;;
+      -h|--help)
+        usage
+        exit 0
+        ;;
+      *)
+        ARGS+=("$1")
+        ;;
+    esac
+    shift
+  done
+}
+
+read_args "$@"
+
+# read_args() will ensure to store any arguments that should be passed on
+# to the build scripts into the $ARGS array. However, this must be done
+# outside of read_args() to affect the positional arguments for the invocation
+# of this script, and not just the invocation of read_args().
+set -- "${ARGS[@]}"
+
+# Verify the aosp tree is in a good state before compiling anything
+verify_aosp_tree
+
+update_aosp_symlist
+
+if [[ "${PREPARE_AOSP_SYMLIST}" != "0" ]]; then
+  commit_symbol_list_update
+fi