diff --git a/arch/arm/configs/vendor/sdxlemur.config b/arch/arm/configs/vendor/sdxlemur.config
index 6f909a87bf87..bb8a79c004d9 100644
--- a/arch/arm/configs/vendor/sdxlemur.config
+++ b/arch/arm/configs/vendor/sdxlemur.config
@@ -364,6 +364,7 @@ CONFIG_AQFWD_IOSS=m
 CONFIG_R8125=y
 CONFIG_R8125_IOSS=m
 CONFIG_R8168=y
+CONFIG_R8168_IOSS=m
 CONFIG_QCOM_SHOW_RESUME_IRQ=y
 CONFIG_HARDENED_USERCOPY=y
 # CONFIG_HARDENED_USERCOPY_FALLBACK is not set
diff --git a/drivers/platform/msm/Kconfig b/drivers/platform/msm/Kconfig
index 98d2ae6d8f16..c6a38ba5686f 100644
--- a/drivers/platform/msm/Kconfig
+++ b/drivers/platform/msm/Kconfig
@@ -190,6 +190,18 @@ config R8125_IOSS
 	  To compile this driver as a module, choose M here. Module will be
 	  called r8125_ioss. If unsure, say N.
 
+config R8168_IOSS
+	tristate "Realtek R8168 IOSS glue driver"
+	depends on R8168
+	depends on IOSS
+	help
+	  Enables IPA Ethernet Offload path on Realtek R8168 NIC. It is
+	  designed to support generic HW processing of UL/DL IP packets for
+	  various use cases to reduce the CPU load during E2E IP traffic.
+
+	  To compile this driver as a module, choose M here. Module will be
+	  called r8168_ioss. If unsure, say N.
+
 config AQFWD_IOSS
 	tristate "AQC glue driver for IOSS v2"
 	depends on AQFWD
diff --git a/drivers/platform/msm/ep_pcie/ep_pcie_core.c b/drivers/platform/msm/ep_pcie/ep_pcie_core.c
index 7e81a80905b9..dcbee0bd18f7 100644
--- a/drivers/platform/msm/ep_pcie/ep_pcie_core.c
+++ b/drivers/platform/msm/ep_pcie/ep_pcie_core.c
@@ -828,6 +828,9 @@ static void ep_pcie_core_init(struct ep_pcie_dev_t *dev, bool configured)
 		ep_pcie_write_mask(dev->dm_core + PCIE20_L1SUB_CAPABILITY, 0,
 			0x1f);
 
+		/* Set CLK_PM_EN which allows to configure the clock-power-man bit below for EP */
+		ep_pcie_write_mask(dev->elbi + PCIE20_ELBI_SYS_CTRL, 1, BIT(7));
+
 		/* Enable Clock Power Management */
 		ep_pcie_write_reg_field(dev->dm_core, PCIE20_LINK_CAPABILITIES,
 			PCIE20_MASK_CLOCK_POWER_MAN, 0x1);
diff --git a/drivers/soc/qcom/memshare/msm_memshare.c b/drivers/soc/qcom/memshare/msm_memshare.c
index 6d1badcf1afd..43ca69072932 100644
--- a/drivers/soc/qcom/memshare/msm_memshare.c
+++ b/drivers/soc/qcom/memshare/msm_memshare.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/err.h>
@@ -104,7 +104,7 @@ static int check_client(int client_id, int proc, int request)
 	int i = 0, rc;
 	int found = DHMS_MEM_CLIENT_INVALID;
 
-	for (i = 0; i < MAX_CLIENTS; i++) {
+	for (i = 0; i < num_clients; i++) {
 		if (memblock[i].client_id == client_id &&
 				memblock[i].peripheral == proc) {
 			found = i;
@@ -484,7 +484,7 @@ static void handle_alloc_generic_req(struct qmi_handle *handle,
 		return;
 	}
 
-	for (i = 0; i < MAX_CLIENTS; i++) {
+	for (i = 0; i < num_clients; i++) {
 		if (memsh_child[i]->client_id == alloc_req->client_id) {
 			client_node = memsh_child[i];
 			dev_info(memsh_drv->dev,
@@ -577,7 +577,7 @@ static void handle_free_generic_req(struct qmi_handle *handle,
 		flag = 1;
 	}
 
-	for (i = 0; i < MAX_CLIENTS; i++) {
+	for (i = 0; i < num_clients; i++) {
 		if (memsh_child[i]->client_id == free_req->client_id) {
 			client_node = memsh_child[i];
 			dev_info(memsh_drv->dev,
diff --git a/drivers/soc/qcom/msm_minidump.c b/drivers/soc/qcom/msm_minidump.c
index ac4c3b08e5b5..4b4b81647688 100644
--- a/drivers/soc/qcom/msm_minidump.c
+++ b/drivers/soc/qcom/msm_minidump.c
@@ -561,7 +561,7 @@ static int __init msm_minidump_init(void)
 	}
 
 	/*Check global minidump support initialization */
-	if (!md_global_toc->md_toc_init) {
+	if (size < sizeof(*md_global_toc) || !md_global_toc->md_toc_init) {
 		pr_err("System Minidump TOC not initialized\n");
 		return -ENODEV;
 	}
diff --git a/drivers/soc/qcom/msm_subsystem_restart.c b/drivers/soc/qcom/msm_subsystem_restart.c
index 69ab25363295..f115e25fa5cd 100644
--- a/drivers/soc/qcom/msm_subsystem_restart.c
+++ b/drivers/soc/qcom/msm_subsystem_restart.c
@@ -652,6 +652,11 @@ static int subsystem_shutdown(struct subsys_device *dev, void *data)
 	dev->crash_count++;
 	subsys_set_state(dev, SUBSYS_OFFLINE);
 
+#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER
+	if (!strcmp(dev->desc->name, "modem"))
+		place_marker("M - Modem Stop");
+#endif
+
 	return 0;
 }
 
diff --git a/drivers/soc/qcom/peripheral-loader.c b/drivers/soc/qcom/peripheral-loader.c
index 55b2e0bad42e..95125c88f2c1 100644
--- a/drivers/soc/qcom/peripheral-loader.c
+++ b/drivers/soc/qcom/peripheral-loader.c
@@ -472,7 +472,10 @@ int pil_do_ramdump(struct pil_desc *desc,
 	if (ret)
 		pil_err(desc, "%s: Ramdump collection failed for subsys %s rc:%d\n",
 				__func__, desc->name, ret);
-
+#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER
+	if (!strcmp(desc->name, "modem"))
+		place_marker("M - Modem Dump completed");
+#endif
 	if (desc->subsys_vmid > 0)
 		ret = pil_assign_mem_to_subsys(desc, priv->region_start,
 				(priv->region_end - priv->region_start));
diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c
index 89b16a71793f..562f35ce68a4 100644
--- a/drivers/soc/qcom/socinfo.c
+++ b/drivers/soc/qcom/socinfo.c
@@ -680,6 +680,8 @@ static const struct soc_id soc_id[] = {
 	{ 450, "SHIMA" },
 	{ 454, "HOLI" },
 	{ 507, "BLAIR" },
+	{ 565, "BLAIRP" },
+	{ 628, "BLAIRP-XR" },
 	{ 486, "MONACO" },
 	{ 458, "SDXLEMUR" },
 	{ 483, "SDXLEMUR-SD"},
diff --git a/drivers/soc/qcom/subsys-pil-tz.c b/drivers/soc/qcom/subsys-pil-tz.c
index 61762f4f68d7..03e7b8fcccf8 100644
--- a/drivers/soc/qcom/subsys-pil-tz.c
+++ b/drivers/soc/qcom/subsys-pil-tz.c
@@ -871,6 +871,10 @@ static int subsys_ramdump(int enable, const struct subsys_desc *subsys)
 
 	if (!enable)
 		return 0;
+#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER
+	if (!strcmp(subsys->name, "modem"))
+		place_marker("M - Modem Dump start");
+#endif
 
 	return pil_do_ramdump(&d->desc, d->ramdump_dev, d->minidump_dev);
 }
@@ -915,6 +919,10 @@ static irqreturn_t subsys_err_fatal_intr_handler (int irq, void *drv_data)
 							d->subsys_desc.name);
 		return IRQ_HANDLED;
 	}
+#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER
+	if (!strcmp(d->subsys_desc.name, "modem"))
+		place_marker("M - Modem crash");
+#endif
 	subsys_set_crash_status(d->subsys, CRASH_STATUS_ERR_FATAL);
 	log_failure_reason(d);
 	subsystem_restart_dev(d->subsys);
diff --git a/drivers/usb/gadget/function/f_cdev.c b/drivers/usb/gadget/function/f_cdev.c
index 9357949a1525..f1044c29027a 100644
--- a/drivers/usb/gadget/function/f_cdev.c
+++ b/drivers/usb/gadget/function/f_cdev.c
@@ -1617,6 +1617,7 @@ static long f_cdev_ioctl(struct file *fp, unsigned int cmd,
 	int i = 0;
 	uint32_t val;
 	struct f_cdev *port;
+	unsigned long flags;
 
 	port = fp->private_data;
 	if (!port) {
@@ -1638,11 +1639,13 @@ static long f_cdev_ioctl(struct file *fp, unsigned int cmd,
 		break;
 	case TIOCMGET:
 		pr_debug("TIOCMGET on port(%s)%pK\n", port->name, port);
+		spin_lock_irqsave(&port->port_lock, flags);
 		ret = f_cdev_tiocmget(port);
 		if (ret >= 0) {
 			ret = put_user(ret, (uint32_t *)arg);
 			port->cbits_updated = false;
 		}
+		spin_unlock_irqrestore(&port->port_lock, flags);
 		break;
 	default:
 		pr_err("Received cmd:%d not supported\n", cmd);
@@ -1658,6 +1661,7 @@ static void usb_cser_notify_modem(void *fport, int ctrl_bits)
 	int temp;
 	struct f_cdev *port = fport;
 	struct cserial *cser;
+	unsigned long flags;
 
 	cser = &port->port_usb;
 	if (!port) {
@@ -1672,8 +1676,10 @@ static void usb_cser_notify_modem(void *fport, int ctrl_bits)
 	if (temp == port->cbits_to_modem)
 		return;
 
+	spin_lock_irqsave(&port->port_lock, flags);
 	port->cbits_to_modem = temp;
 	port->cbits_updated = true;
+	spin_unlock_irqrestore(&port->port_lock, flags);
 
 	 /* if DTR is high, update latest modem info to laptop */
 	if (port->cbits_to_modem & TIOCM_DTR) {