diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c
index 5fdd69044425..3a2a4164b4e4 100644
--- a/drivers/char/adsprpc.c
+++ b/drivers/char/adsprpc.c
@@ -118,6 +118,9 @@
 #define GET_TABLE_IDX_FROM_CTXID(ctxid) \
 	((ctxid & FASTRPC_CTX_TABLE_IDX_MASK) >> FASTRPC_CTX_TABLE_IDX_POS)
 
+#define VALID_FASTRPC_CID(cid) \
+	(cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS)
+
 /* Reserve few entries in context table for critical kernel and static RPC
  * calls to avoid user invocations from exhausting all entries.
  */
@@ -2066,7 +2069,11 @@ static int context_alloc(struct fastrpc_file *fl, uint32_t kernel,
 		if (err)
 			goto bail;
 	}
-
+	VERIFY(err, VALID_FASTRPC_CID(cid));
+	if (err) {
+		err = -ECHRNG;
+		goto bail;
+	}
 	chan = &me->channel[cid];
 
 	spin_lock_irqsave(&chan->ctxlock, irq_flags);
diff --git a/drivers/clk/qcom/gcc-sdxlemur.c b/drivers/clk/qcom/gcc-sdxlemur.c
index 5cdb1df841d6..3be58820d8ff 100644
--- a/drivers/clk/qcom/gcc-sdxlemur.c
+++ b/drivers/clk/qcom/gcc-sdxlemur.c
@@ -764,7 +764,7 @@ static const struct freq_tbl ftbl_gcc_sdcc1_apps_clk_src[] = {
 	F(25000000, P_GPLL0_OUT_EVEN, 12, 0, 0),
 	F(50000000, P_GPLL0_OUT_EVEN, 6, 0, 0),
 	F(100000000, P_GPLL0_OUT_MAIN, 6, 0, 0),
-	F(171428571, P_GPLL0_OUT_MAIN, 3.5, 0, 0),
+	F(200000000, P_GPLL0_OUT_MAIN, 3, 0, 0),
 	{ }
 };
 
diff --git a/drivers/i2c/busses/i2c-msm-geni.c b/drivers/i2c/busses/i2c-msm-geni.c
index 7c5f298db44f..3a1964dfaac1 100644
--- a/drivers/i2c/busses/i2c-msm-geni.c
+++ b/drivers/i2c/busses/i2c-msm-geni.c
@@ -513,6 +513,13 @@ static void gi2c_gsi_rx_cb(void *ptr)
 	struct msm_gpi_dma_async_tx_cb_param *rx_cb = ptr;
 	struct geni_i2c_dev *gi2c = rx_cb->userdata;
 
+	if (gi2c->cur == NULL) {
+		GENI_SE_ERR(gi2c->ipcl, true, gi2c->dev,
+			"%s: Error: unexpected callback\n", __func__);
+		WARN_ON(1);
+		return;
+	}
+
 	if (gi2c->cur->flags & I2C_M_RD) {
 		gi2c_gsi_cb_err(rx_cb, "RX");
 		complete(&gi2c->xfer);
diff --git a/drivers/pci/controller/pci-msm.c b/drivers/pci/controller/pci-msm.c
index c39798777d4b..f27e6e68ed24 100644
--- a/drivers/pci/controller/pci-msm.c
+++ b/drivers/pci/controller/pci-msm.c
@@ -72,6 +72,7 @@
 #define PCIE20_PARF_PHY_CTRL (0x40)
 #define PCIE20_PARF_TEST_BUS (0xe4)
 #define PCIE20_PARF_MHI_CLOCK_RESET_CTRL (0x174)
+#define PCIE20_PARF_AXI_MSTR_RD_ADDR_HALT (0x1a4)
 #define PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT (0x1a8)
 #define PCIE20_PARF_LTSSM (0x1b0)
 #define PCIE20_PARF_INT_ALL_STATUS (0x224)
@@ -845,6 +846,7 @@ struct msm_pcie_dev_t {
 	uint32_t aux_clk_freq;
 	bool linkdown_panic;
 	uint32_t boot_option;
+	bool pcie_halt_feature_dis;
 
 	uint32_t rc_idx;
 	uint32_t phy_ver;
@@ -1680,6 +1682,8 @@ static void msm_pcie_show_status(struct msm_pcie_dev_t *dev)
 		dev->wr_halt_size);
 	PCIE_DBG_FS(dev, "slv_addr_space_size: 0x%x\n",
 		dev->slv_addr_space_size);
+	PCIE_DBG_FS(dev, "PCIe: halt_feature_dis is %d\n",
+		dev->pcie_halt_feature_dis);
 	PCIE_DBG_FS(dev, "phy_status_offset: 0x%x\n",
 		dev->phy_status_offset);
 	PCIE_DBG_FS(dev, "phy_status_bit: %u\n",
@@ -4740,10 +4744,22 @@ static int msm_pcie_enable(struct msm_pcie_dev_t *dev)
 	msm_pcie_write_reg(dev->parf, PCIE20_PARF_SLV_ADDR_SPACE_SIZE,
 				dev->slv_addr_space_size);
 
-	val = dev->wr_halt_size ? dev->wr_halt_size :
-		readl_relaxed(dev->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT);
-	msm_pcie_write_reg(dev->parf, PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT,
+	if (dev->pcie_halt_feature_dis) {
+		/* Disable PCIe Wr halt window */
+		val = readl_relaxed(dev->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT);
+		msm_pcie_write_reg(dev->parf, PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT,
+				(~BIT(31)) & val);
+
+		/* Disable PCIe Rd halt window */
+		val = readl_relaxed(dev->parf + PCIE20_PARF_AXI_MSTR_RD_ADDR_HALT);
+		msm_pcie_write_reg(dev->parf, PCIE20_PARF_AXI_MSTR_RD_ADDR_HALT,
+			(~BIT(0)) & val);
+	} else {
+		val = dev->wr_halt_size ? dev->wr_halt_size :
+			readl_relaxed(dev->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT);
+		msm_pcie_write_reg(dev->parf, PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT,
 				BIT(31) | val);
+	}
 
 	/* init tcsr */
 	if (dev->tcsr_config)
@@ -6291,6 +6307,11 @@ static int msm_pcie_probe(struct platform_device *pdev)
 	PCIE_DBG(pcie_dev, "RC%d: num-parf-testbus-sel: 0x%x.\n",
 		pcie_dev->rc_idx, pcie_dev->num_parf_testbus_sel);
 
+	pcie_dev->pcie_halt_feature_dis = of_property_read_bool(of_node,
+			"qcom,pcie-halt-feature-dis");
+	PCIE_DBG(pcie_dev, "PCIe halt feature is %s enabled.\n",
+			pcie_dev->pcie_halt_feature_dis ? "not" : "");
+
 	of_property_read_u32(of_node, "qcom,phy-status-offset",
 				&pcie_dev->phy_status_offset);
 	PCIE_DBG(pcie_dev, "RC%d: phy-status-offset: 0x%x.\n", pcie_dev->rc_idx,
diff --git a/drivers/platform/msm/ep_pcie/ep_pcie_com.h b/drivers/platform/msm/ep_pcie/ep_pcie_com.h
index 9e740d21f82f..00f5e42ebb24 100644
--- a/drivers/platform/msm/ep_pcie/ep_pcie_com.h
+++ b/drivers/platform/msm/ep_pcie/ep_pcie_com.h
@@ -393,6 +393,7 @@ struct ep_pcie_dev_t {
 	ulong                        wake_counter;
 	ulong                        msi_counter;
 	ulong                        global_irq_counter;
+	ulong                        perst_ast_in_enum_counter;
 
 	bool                         dump_conf;
 	bool                         config_mmio_init;
diff --git a/drivers/platform/msm/ep_pcie/ep_pcie_core.c b/drivers/platform/msm/ep_pcie/ep_pcie_core.c
index 13b055c808cb..671063b7dd63 100644
--- a/drivers/platform/msm/ep_pcie/ep_pcie_core.c
+++ b/drivers/platform/msm/ep_pcie/ep_pcie_core.c
@@ -1681,6 +1681,7 @@ int ep_pcie_core_enable_endpoint(enum ep_pcie_options opt)
 	u32 val = 0;
 	u32 retries = 0;
 	u32 bme = 0;
+	bool perst = true;
 	bool ltssm_en = false;
 	struct ep_pcie_dev_t *dev = &ep_pcie_dev;
 
@@ -1921,11 +1922,19 @@ int ep_pcie_core_enable_endpoint(enum ep_pcie_options opt)
 		if (retries % 100 == 0)
 			EP_PCIE_DBG(dev, "PCIe V%d: LTSSM_STATE:0x%x\n",
 					dev->rev, (val >> 0xC) & 0x3f);
+		perst = atomic_read(&dev->perst_deast) ? 1 : 0;
 	} while ((!(val & XMLH_LINK_UP) ||
 		!ep_pcie_confirm_linkup(dev, false))
-		&& (retries < LINK_UP_CHECK_MAX_COUNT));
+		&& (retries < LINK_UP_CHECK_MAX_COUNT) && perst);
 
-	if (retries == LINK_UP_CHECK_MAX_COUNT) {
+	if (!perst) {
+		dev->perst_ast_in_enum_counter++;
+		EP_PCIE_ERR(dev,
+				"PCIe V%d: Perst asserted No. %ld while waiting for link to be up\n",
+				dev->rev, dev->perst_ast_in_enum_counter);
+		ret = EP_PCIE_ERROR;
+		goto link_fail;
+	} else if (retries == LINK_UP_CHECK_MAX_COUNT) {
 		EP_PCIE_ERR(dev, "PCIe V%d: link initialization failed\n",
 			dev->rev);
 		ret = EP_PCIE_ERROR;
diff --git a/drivers/soc/qcom/mem-buf.c b/drivers/soc/qcom/mem-buf.c
index 92bf52b7e7ce..5857e965f590 100644
--- a/drivers/soc/qcom/mem-buf.c
+++ b/drivers/soc/qcom/mem-buf.c
@@ -529,12 +529,19 @@ struct mem_buf_xfer_mem *mem_buf_prep_xfer_mem(void *req_msg)
 	int ret;
 	struct mem_buf_xfer_mem *xfer_mem;
 	struct mem_buf_alloc_req *req = req_msg;
-	u32 nr_acl_entries = req->acl_desc.n_acl_entries;
-	size_t alloc_req_msg_size = offsetof(struct mem_buf_alloc_req,
-					acl_desc.acl_entries[nr_acl_entries]);
-	void *arb_payload = req_msg + alloc_req_msg_size;
+	u32 nr_acl_entries;
+	size_t alloc_req_msg_size;
+	void *arb_payload;
 	void *mem_type_data;
 
+	nr_acl_entries = req->acl_desc.n_acl_entries;
+	if (nr_acl_entries != 1)
+		return ERR_PTR(-EINVAL);
+
+	alloc_req_msg_size = offsetof(struct mem_buf_alloc_req,
+					acl_desc.acl_entries[nr_acl_entries]);
+	arb_payload = req_msg + alloc_req_msg_size;
+
 	xfer_mem = kzalloc(sizeof(*xfer_mem), GFP_KERNEL);
 	if (!xfer_mem)
 		return ERR_PTR(-ENOMEM);
diff --git a/drivers/thermal/qcom/cpu_isolate.c b/drivers/thermal/qcom/cpu_isolate.c
index ff2621df8003..0e3821c258bf 100644
--- a/drivers/thermal/qcom/cpu_isolate.c
+++ b/drivers/thermal/qcom/cpu_isolate.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/module.h>
 #include <linux/thermal.h>
@@ -320,6 +321,12 @@ static int cpu_isolate_probe(struct platform_device *pdev)
 				break;
 			}
 		}
+
+		if (cpu_isolate_cdev->cpu_id == -1) {
+			dev_err(&pdev->dev, "Invalid CPU phandle\n");
+			continue;
+		}
+
 		INIT_WORK(&cpu_isolate_cdev->reg_work,
 				cpu_isolate_register_cdev);
 		list_add(&cpu_isolate_cdev->node, &cpu_isolate_cdev_list);
diff --git a/drivers/thermal/qcom/cpu_voltage_cooling.c b/drivers/thermal/qcom/cpu_voltage_cooling.c
index d0c235e5ce6d..54402dcf024b 100644
--- a/drivers/thermal/qcom/cpu_voltage_cooling.c
+++ b/drivers/thermal/qcom/cpu_voltage_cooling.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #define pr_fmt(fmt) "%s:%s " fmt, KBUILD_MODNAME, __func__
 
@@ -282,8 +283,7 @@ static int cc_init(struct device_node *np, int *cpus)
 		}
 	}
 	snprintf(cc_cdev->cdev_name, THERMAL_NAME_LENGTH,
-			"thermal-cluster-%d-%d", cc_cdev->cpu_map[0],
-			cc_cdev->cpu_map[1]);
+			np->name);
 	cc_cdev->cdev = thermal_of_cooling_device_register(
 					np, cc_cdev->cdev_name, cc_cdev,
 					&cc_cooling_ops);
@@ -307,21 +307,53 @@ static int cc_cooling_probe(struct platform_device *pdev)
 	struct device_node *np = dev->of_node;
 	struct device_node *dev_phandle, *subsys_np = NULL;
 	struct device *cpu_dev;
-	int ret = 0, idx = 0, cpu;
+	int ret = 0, idx = 0, count = 0, cpu;
+	int cpu_count = 0;
 	u32 cpu_map[CPU_MAP_CT];
 
 	for_each_available_child_of_node(np, subsys_np) {
-		for (idx = 0; idx < CPU_MAP_CT; idx++) {
-			dev_phandle = of_parse_phandle(subsys_np, "qcom,cpus",
+		cpu_count = of_count_phandle_with_args(subsys_np, "qcom,cluster0",
+							NULL);
+		for (idx = 0; idx < cpu_count; idx++) {
+			dev_phandle = of_parse_phandle(subsys_np, "qcom,cluster0",
 							idx);
 			for_each_possible_cpu(cpu) {
 				cpu_dev = get_cpu_device(cpu);
 				if (cpu_dev && cpu_dev->of_node ==
 						dev_phandle) {
-					cpu_map[idx] = cpu;
+					cpu_map[count] = cpu;
+					count++;
 					break;
 				}
 			}
+			if (count)
+				break;
+		}
+		if (!count) {
+			pr_debug("Disabled as no core on cluster 0\n");
+			return ret;
+		}
+
+		cpu_count = of_count_phandle_with_args(subsys_np, "qcom,cluster1",
+							NULL);
+		for (idx = 0; idx < cpu_count; idx++) {
+			dev_phandle = of_parse_phandle(subsys_np, "qcom,cluster1",
+							idx);
+			for_each_possible_cpu(cpu) {
+				cpu_dev = get_cpu_device(cpu);
+				if (cpu_dev && cpu_dev->of_node ==
+						dev_phandle) {
+					cpu_map[count] = cpu;
+					count++;
+					break;
+				}
+			}
+			if (count == 2)
+				break;
+		}
+		if (count != 2) {
+			pr_debug("Disabled as no core on cluster 1\n");
+			return ret;
 		}
 		ret = cc_init(subsys_np, cpu_map);
 	}
diff --git a/drivers/usb/gadget/function/f_cdev.c b/drivers/usb/gadget/function/f_cdev.c
index 33d3a37dafd9..bef28623462d 100644
--- a/drivers/usb/gadget/function/f_cdev.c
+++ b/drivers/usb/gadget/function/f_cdev.c
@@ -138,6 +138,7 @@ struct f_cdev {
 	unsigned long		nbytes_from_port_bridge;
 
 	struct dentry		*debugfs_root;
+	bool			setup_pending;
 
 	/* To test remote wakeup using debugfs */
 	u8 debugfs_rw_enable;
@@ -548,6 +549,7 @@ static int usb_cser_set_alt(struct usb_function *f, unsigned int intf,
 }
 
 static int port_notify_serial_state(struct cserial *cser);
+static void usb_cser_start_rx(struct f_cdev *port);
 
 static void usb_cser_resume(struct usb_function *f)
 {
@@ -566,6 +568,13 @@ static void usb_cser_resume(struct usb_function *f)
 		port_notify_serial_state(&port->port_usb);
 
 	spin_lock_irqsave(&port->port_lock, flags);
+
+	/* process pending read request */
+	if (port->setup_pending) {
+		pr_info("%s: start_rx called due to rx_out error.\n", __func__);
+		port->setup_pending = false;
+		usb_cser_start_rx(port);
+	}
 	in = port->port_usb.in;
 	/* process any pending requests */
 	list_for_each_entry_safe(req, t, &port->write_pending, list) {
@@ -1055,7 +1064,10 @@ static void usb_cser_start_rx(struct f_cdev *port)
 			pr_err("port(%d):%pK usb ep(%s) queue failed\n",
 					port->port_num, port, ep->name);
 			list_add(&req->list, pool);
+			port->setup_pending = true;
 			break;
+		} else {
+			port->setup_pending = false;
 		}
 	}
 
diff --git a/include/linux/ipa_wdi3.h b/include/linux/ipa_wdi3.h
index 73fe15e78fb1..38465301fab3 100644
--- a/include/linux/ipa_wdi3.h
+++ b/include/linux/ipa_wdi3.h
@@ -130,7 +130,7 @@ struct ipa_wdi_hdr_info {
  */
 struct ipa_wdi_reg_intf_in_params {
 	const char *netdev_name;
-	struct ipa_wdi_hdr_info hdr_info[IPA_IP_MAX];
+	struct ipa_wdi_hdr_info hdr_info[IPA_IP_MAX_WLAN];
 	enum ipa_client_type alt_dst_pipe;
 	u8 is_meta_data_valid;
 	u32 meta_data;
diff --git a/include/uapi/linux/msm_ipa.h b/include/uapi/linux/msm_ipa.h
index 60c5f5af8069..fa89b514d224 100644
--- a/include/uapi/linux/msm_ipa.h
+++ b/include/uapi/linux/msm_ipa.h
@@ -698,7 +698,10 @@ enum ipa3_nat_mem_in {
 enum ipa_ip_type {
 	IPA_IP_v4,
 	IPA_IP_v6,
-	IPA_IP_MAX
+	IPA_IP_MAX,
+	IPA_IP_v4_VLAN = IPA_IP_MAX,
+	IPA_IP_v6_VLAN,
+	IPA_IP_MAX_WLAN
 };
 
 #define VALID_IPA_IP_TYPE(t) \
@@ -3179,11 +3182,13 @@ enum ipa_vlan_ifaces {
 	IPA_VLAN_IF_ETH0,
 	IPA_VLAN_IF_ETH1,
 	IPA_VLAN_IF_RNDIS,
-	IPA_VLAN_IF_ECM
+	IPA_VLAN_IF_ECM,
+	IPA_VLAN_IF_WLAN
 };
 
 #define IPA_VLAN_IF_EMAC IPA_VLAN_IF_ETH
-#define IPA_VLAN_IF_MAX (IPA_VLAN_IF_ECM + 1)
+#define IPA_VLAN_IF_WLAN IPA_VLAN_IF_WLAN
+#define IPA_VLAN_IF_MAX (IPA_VLAN_IF_WLAN + 1)
 
 /**
  * struct ipa_get_vlan_mode - get vlan mode of a Lan interface