diff -u linux-oem-6.5-6.5.0/debian.master/abi/abiname linux-oem-6.5-6.5.0/debian.master/abi/abiname
--- linux-oem-6.5-6.5.0/debian.master/abi/abiname
+++ linux-oem-6.5-6.5.0/debian.master/abi/abiname
@@ -1 +1 @@
-12
+14
diff -u linux-oem-6.5-6.5.0/debian.master/abi/version linux-oem-6.5-6.5.0/debian.master/abi/version
--- linux-oem-6.5-6.5.0/debian.master/abi/version
+++ linux-oem-6.5-6.5.0/debian.master/abi/version
@@ -1 +1 @@
-6.5.0-12.12
+6.5.0-14.14
diff -u linux-oem-6.5-6.5.0/debian.master/changelog linux-oem-6.5-6.5.0/debian.master/changelog
--- linux-oem-6.5-6.5.0/debian.master/changelog
+++ linux-oem-6.5-6.5.0/debian.master/changelog
@@ -1,3 +1,25 @@
+linux (6.5.0-15.15) mantic; urgency=medium
+
+  * mantic/linux: 6.5.0-15.15 -proposed tracker (LP: #2048549)
+
+  * CVE-2024-0193
+    - netfilter: nf_tables: skip set commit for deleted/destroyed sets
+
+  * CVE-2023-6606
+    - smb: client: fix OOB in smbCalcSize()
+
+  * CVE-2023-6817
+    - netfilter: nft_set_pipapo: skip inactive elements during set walk
+
+  * CVE-2023-6932
+    - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
+
+  * CVE-2023-6931
+    - perf: Fix perf_event_validate_size()
+    - perf: Fix perf_event_validate_size() lockdep splat
+
+ -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 09 Jan 2024 09:25:08 -0300
+
 linux (6.5.0-14.14) mantic; urgency=medium
 
   * mantic/linux: 6.5.0-14.14 -proposed tracker (LP: #2042660)
diff -u linux-oem-6.5-6.5.0/debian.master/tracking-bug linux-oem-6.5-6.5.0/debian.master/tracking-bug
--- linux-oem-6.5-6.5.0/debian.master/tracking-bug
+++ linux-oem-6.5-6.5.0/debian.master/tracking-bug
@@ -1 +1 @@
-2042660 2023.10.30-2
+2048549 s2023.10.30-1
diff -u linux-oem-6.5-6.5.0/debian.oem/abi/abiname linux-oem-6.5-6.5.0/debian.oem/abi/abiname
--- linux-oem-6.5-6.5.0/debian.oem/abi/abiname
+++ linux-oem-6.5-6.5.0/debian.oem/abi/abiname
@@ -1 +1 @@
-1010
+1011
diff -u linux-oem-6.5-6.5.0/debian.oem/abi/version linux-oem-6.5-6.5.0/debian.oem/abi/version
--- linux-oem-6.5-6.5.0/debian.oem/abi/version
+++ linux-oem-6.5-6.5.0/debian.oem/abi/version
@@ -1 +1 @@
-6.5.0-1010.11
+6.5.0-1011.12
diff -u linux-oem-6.5-6.5.0/debian.oem/changelog linux-oem-6.5-6.5.0/debian.oem/changelog
--- linux-oem-6.5-6.5.0/debian.oem/changelog
+++ linux-oem-6.5-6.5.0/debian.oem/changelog
@@ -1,3 +1,59 @@
+linux-oem-6.5 (6.5.0-1013.14) jammy; urgency=medium
+
+  * jammy/linux-oem-6.5: 6.5.0-1013.14 -proposed tracker (LP: #2049407)
+
+  * Mute/mic LEDs no function on HP ZBook (LP: #2048729)
+    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ZBook
+
+  * iwlwifi leads to system randomly hangs after suspend  (LP: #2049184)
+    - SAUCE: wifi: iwlwifi: fix a memory corruption
+
+  * Fix BCM57416 lost after resume (LP: #2047518)
+    - bnxt_en: Clear resource reservation during resume
+
+  * Mute/mic LEDs and speaker no function on some HP platforms (LP: #2047504)
+    - ALSA: hda/realtek: Add quirks for HP Laptops
+
+  * drm: Update file owner during use (LP: #2047461)
+    - drm: Update file owner during use
+
+  * Add missing RPL P/U CPU IDs (LP: #2047398)
+    - drm/i915/rpl: Update pci ids for RPL P/U
+
+  * Fix AMDGPU crash on 6.5 kernel (LP: #2047389)
+    - drm/amdgpu: disable MCBP by default
+
+  * Audio device is not available, instead it shows dummy output in the settings
+    (LP: #2047184)
+    - ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format
+
+  * Fix AMDGPU display on lower resolution modes (LP: #2046504)
+    - drm/amd/display: fix mode scaling (RMX_.*)
+    - drm/amd/display: fix the ability to use lower resolution modes on eDP
+
+  * RTL8852CE WIFI read country list supporting 6 GHz from BIOS (LP: #2045622)
+    - wifi: rtw89: Introduce Time Averaged SAR (TAS) feature
+    - wifi: rtw89: acpi: process 6 GHz band policy from DSM
+    - wifi: rtw89: regd: handle policy of 6 GHz according to BIOS
+    - wifi: rtw89: regd: update regulatory map to R65-R44
+
+  [ Ubuntu: 6.5.0-15.15 ]
+
+  * mantic/linux: 6.5.0-15.15 -proposed tracker (LP: #2048549)
+  * CVE-2024-0193
+    - netfilter: nf_tables: skip set commit for deleted/destroyed sets
+  * CVE-2023-6606
+    - smb: client: fix OOB in smbCalcSize()
+  * CVE-2023-6817
+    - netfilter: nft_set_pipapo: skip inactive elements during set walk
+  * CVE-2023-6932
+    - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
+  * CVE-2023-6931
+    - perf: Fix perf_event_validate_size()
+    - perf: Fix perf_event_validate_size() lockdep splat
+
+ -- Timo Aaltonen <timo.aaltonen@canonical.com>  Tue, 16 Jan 2024 09:45:28 +0200
+
 linux-oem-6.5 (6.5.0-1011.12) jammy; urgency=medium
 
   * jammy/linux-oem-6.5: 6.5.0-1011.12 -proposed tracker (LP: #2047946)
diff -u linux-oem-6.5-6.5.0/debian.oem/tracking-bug linux-oem-6.5-6.5.0/debian.oem/tracking-bug
--- linux-oem-6.5-6.5.0/debian.oem/tracking-bug
+++ linux-oem-6.5-6.5.0/debian.oem/tracking-bug
@@ -1 +1 @@
-2047946 2023.10.30-8
+2049407 s2023.10.30-1
diff -u linux-oem-6.5-6.5.0/debian/changelog linux-oem-6.5-6.5.0/debian/changelog
--- linux-oem-6.5-6.5.0/debian/changelog
+++ linux-oem-6.5-6.5.0/debian/changelog
@@ -1,3 +1,59 @@
+linux-oem-6.5 (6.5.0-1013.14) jammy; urgency=medium
+
+  * jammy/linux-oem-6.5: 6.5.0-1013.14 -proposed tracker (LP: #2049407)
+
+  * Mute/mic LEDs no function on HP ZBook (LP: #2048729)
+    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ZBook
+
+  * iwlwifi leads to system randomly hangs after suspend  (LP: #2049184)
+    - SAUCE: wifi: iwlwifi: fix a memory corruption
+
+  * Fix BCM57416 lost after resume (LP: #2047518)
+    - bnxt_en: Clear resource reservation during resume
+
+  * Mute/mic LEDs and speaker no function on some HP platforms (LP: #2047504)
+    - ALSA: hda/realtek: Add quirks for HP Laptops
+
+  * drm: Update file owner during use (LP: #2047461)
+    - drm: Update file owner during use
+
+  * Add missing RPL P/U CPU IDs (LP: #2047398)
+    - drm/i915/rpl: Update pci ids for RPL P/U
+
+  * Fix AMDGPU crash on 6.5 kernel (LP: #2047389)
+    - drm/amdgpu: disable MCBP by default
+
+  * Audio device is not available, instead it shows dummy output in the settings
+    (LP: #2047184)
+    - ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format
+
+  * Fix AMDGPU display on lower resolution modes (LP: #2046504)
+    - drm/amd/display: fix mode scaling (RMX_.*)
+    - drm/amd/display: fix the ability to use lower resolution modes on eDP
+
+  * RTL8852CE WIFI read country list supporting 6 GHz from BIOS (LP: #2045622)
+    - wifi: rtw89: Introduce Time Averaged SAR (TAS) feature
+    - wifi: rtw89: acpi: process 6 GHz band policy from DSM
+    - wifi: rtw89: regd: handle policy of 6 GHz according to BIOS
+    - wifi: rtw89: regd: update regulatory map to R65-R44
+
+  [ Ubuntu: 6.5.0-15.15 ]
+
+  * mantic/linux: 6.5.0-15.15 -proposed tracker (LP: #2048549)
+  * CVE-2024-0193
+    - netfilter: nf_tables: skip set commit for deleted/destroyed sets
+  * CVE-2023-6606
+    - smb: client: fix OOB in smbCalcSize()
+  * CVE-2023-6817
+    - netfilter: nft_set_pipapo: skip inactive elements during set walk
+  * CVE-2023-6932
+    - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
+  * CVE-2023-6931
+    - perf: Fix perf_event_validate_size()
+    - perf: Fix perf_event_validate_size() lockdep splat
+
+ -- Timo Aaltonen <timo.aaltonen@canonical.com>  Tue, 16 Jan 2024 09:45:28 +0200
+
 linux-oem-6.5 (6.5.0-1011.12) jammy; urgency=medium
 
   * jammy/linux-oem-6.5: 6.5.0-1011.12 -proposed tracker (LP: #2047946)
diff -u linux-oem-6.5-6.5.0/debian/control linux-oem-6.5-6.5.0/debian/control
--- linux-oem-6.5-6.5.0/debian/control
+++ linux-oem-6.5-6.5.0/debian/control
@@ -70,7 +70,7 @@
 XS-Testsuite: autopkgtest
 #XS-Testsuite-Depends: gcc-4.7 binutils
 
-Package: linux-oem-6.5-headers-6.5.0-1011
+Package: linux-oem-6.5-headers-6.5.0-1013
 Build-Profiles: <!stage1>
 Architecture: all
 Multi-Arch: foreign
@@ -80,20 +80,20 @@
 Description: Header files related to Linux kernel version 6.5.0
  This package provides kernel header files for version 6.5.0, for sites
  that want the latest kernel headers. Please read
- /usr/share/doc/linux-oem-6.5-headers-6.5.0-1011/debian.README.gz for details
+ /usr/share/doc/linux-oem-6.5-headers-6.5.0-1013/debian.README.gz for details
 
-Package: linux-oem-6.5-tools-6.5.0-1011
+Package: linux-oem-6.5-tools-6.5.0-1013
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: devel
 Priority: optional
 Depends: ${misc:Depends}, ${shlibs:Depends}, linux-tools-common
-Description: Linux kernel version specific tools for version 6.5.0-1011
+Description: Linux kernel version specific tools for version 6.5.0-1013
  This package provides the architecture dependant parts for kernel
  version locked tools (such as perf and x86_energy_perf_policy) for
- version 6.5.0-1011 on
+ version 6.5.0-1013 on
  64 bit x86.
- You probably want to install linux-tools-6.5.0-1011-<flavour>.
+ You probably want to install linux-tools-6.5.0-1013-<flavour>.
 
 Package: linux-oem-6.5-tools-host
 Build-Profiles: <!stage1>
@@ -107,17 +107,17 @@
 
 
 
-Package: linux-image-unsigned-6.5.0-1011-oem
+Package: linux-image-unsigned-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: kernel
 Priority: optional
 Provides: linux-image, fuse-module, kvm-api-4, redhat-cluster-modules, ivtv-modules, virtualbox-guest-modules [amd64], ${linux:rprovides}
-Depends: ${misc:Depends}, ${shlibs:Depends}, kmod, linux-base (>= 4.5ubuntu1~16.04.1), linux-modules-6.5.0-1011-oem
+Depends: ${misc:Depends}, ${shlibs:Depends}, kmod, linux-base (>= 4.5ubuntu1~16.04.1), linux-modules-6.5.0-1013-oem
 Recommends: grub-pc [amd64] | grub-efi-amd64 [amd64] | grub-efi-ia32 [amd64] | grub [amd64] | lilo [amd64] | flash-kernel [armhf arm64] | grub-efi-arm64 [arm64] | grub-efi-arm [armhf] | grub-ieee1275 [ppc64el], initramfs-tools | linux-initramfs-tool
 Breaks: flash-kernel (<< 3.90ubuntu2) [arm64 armhf], s390-tools (<< 2.3.0-0ubuntu3) [s390x]
-Conflicts: linux-image-6.5.0-1011-oem
-Suggests: fdutils, linux-oem-6.5-tools, linux-headers-6.5.0-1011-oem
+Conflicts: linux-image-6.5.0-1013-oem
+Suggests: fdutils, linux-oem-6.5-tools, linux-headers-6.5.0-1013-oem
 Description: Linux kernel image for version 6.5.0 on 64 bit x86 SMP
  This package contains the unsigned Linux kernel image for version 6.5.0 on
  64 bit x86 SMP.
@@ -130,7 +130,7 @@
  the linux-oem meta-package, which will ensure that upgrades work
  correctly, and that supporting packages are also installed.
 
-Package: linux-modules-6.5.0-1011-oem
+Package: linux-modules-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: kernel
@@ -150,12 +150,12 @@
  the linux-oem meta-package, which will ensure that upgrades work
  correctly, and that supporting packages are also installed.
 
-Package: linux-modules-extra-6.5.0-1011-oem
+Package: linux-modules-extra-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: kernel
 Priority: optional
-Depends: ${misc:Depends}, ${shlibs:Depends}, linux-modules-6.5.0-1011-oem, wireless-regdb
+Depends: ${misc:Depends}, ${shlibs:Depends}, linux-modules-6.5.0-1013-oem, wireless-regdb
 Description: Linux kernel extra modules for version 6.5.0 on 64 bit x86 SMP
  This package contains the Linux kernel extra modules for version 6.5.0 on
  64 bit x86 SMP.
@@ -172,21 +172,21 @@
  the linux-oem meta-package, which will ensure that upgrades work
  correctly, and that supporting packages are also installed.
 
-Package: linux-headers-6.5.0-1011-oem
+Package: linux-headers-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: devel
 Priority: optional
-Depends: ${misc:Depends}, linux-oem-6.5-headers-6.5.0-1011, ${shlibs:Depends}
+Depends: ${misc:Depends}, linux-oem-6.5-headers-6.5.0-1013, ${shlibs:Depends}
 Provides: linux-headers, linux-headers-3.0
 Description: Linux kernel headers for version 6.5.0 on 64 bit x86 SMP
  This package provides kernel header files for version 6.5.0 on
  64 bit x86 SMP.
  .
  This is for sites that want the latest kernel headers.  Please read
- /usr/share/doc/linux-headers-6.5.0-1011/debian.README.gz for details.
+ /usr/share/doc/linux-headers-6.5.0-1013/debian.README.gz for details.
 
-Package: linux-oem-6.5-lib-rust-6.5.0-1011-oem
+Package: linux-oem-6.5-lib-rust-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Multi-Arch: foreign
@@ -197,7 +197,7 @@
  This package provides kernel library files for version 6.5.0, that allow to
  compile out-of-tree kernel modules written in Rust.
 
-Package: linux-image-unsigned-6.5.0-1011-oem-dbgsym
+Package: linux-image-unsigned-6.5.0-1013-oem-dbgsym
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: devel
@@ -214,31 +214,31 @@
  is uncompressed, and unstripped. This package also includes the
  unstripped modules.
 
-Package: linux-tools-6.5.0-1011-oem
+Package: linux-tools-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: devel
 Priority: optional
-Depends: ${misc:Depends}, linux-oem-6.5-tools-6.5.0-1011
-Description: Linux kernel version specific tools for version 6.5.0-1011
+Depends: ${misc:Depends}, linux-oem-6.5-tools-6.5.0-1013
+Description: Linux kernel version specific tools for version 6.5.0-1013
  This package provides the architecture dependant parts for kernel
  version locked tools (such as perf and x86_energy_perf_policy) for
- version 6.5.0-1011 on
+ version 6.5.0-1013 on
  64 bit x86.
 
-Package: linux-cloud-tools-6.5.0-1011-oem
+Package: linux-cloud-tools-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: devel
 Priority: optional
-Depends: ${misc:Depends}, linux-oem-6.5-cloud-tools-6.5.0-1011
-Description: Linux kernel version specific cloud tools for version 6.5.0-1011
+Depends: ${misc:Depends}, linux-oem-6.5-cloud-tools-6.5.0-1013
+Description: Linux kernel version specific cloud tools for version 6.5.0-1013
  This package provides the architecture dependant parts for kernel
- version locked tools for cloud for version 6.5.0-1011 on
+ version locked tools for cloud for version 6.5.0-1013 on
  64 bit x86.
 
 
-Package: linux-buildinfo-6.5.0-1011-oem
+Package: linux-buildinfo-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: kernel
@@ -252,18 +252,18 @@
  You likely do not want to install this package.
 
 
-Package: linux-modules-ipu6-6.5.0-1011-oem
+Package: linux-modules-ipu6-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: kernel
 Priority: optional
 Depends:
  ${misc:Depends},
- linux-image-6.5.0-1011-oem | linux-image-unsigned-6.5.0-1011-oem,
+ linux-image-6.5.0-1013-oem | linux-image-unsigned-6.5.0-1013-oem,
 Built-Using: ${linux:BuiltUsing}
-Description: Linux kernel ipu6 modules for version 6.5.0-1011
+Description: Linux kernel ipu6 modules for version 6.5.0-1013
  This package provides the Linux kernel ipu6 modules for version
- 6.5.0-1011.
+ 6.5.0-1013.
  .
  You likely do not want to install this package directly. Instead, install the
  one of the linux-modules-ipu6-oem* meta-packages,
@@ -271,18 +271,18 @@
  also installed.
 
 
-Package: linux-modules-ivsc-6.5.0-1011-oem
+Package: linux-modules-ivsc-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: kernel
 Priority: optional
 Depends:
  ${misc:Depends},
- linux-image-6.5.0-1011-oem | linux-image-unsigned-6.5.0-1011-oem,
+ linux-image-6.5.0-1013-oem | linux-image-unsigned-6.5.0-1013-oem,
 Built-Using: ${linux:BuiltUsing}
-Description: Linux kernel ivsc modules for version 6.5.0-1011
+Description: Linux kernel ivsc modules for version 6.5.0-1013
  This package provides the Linux kernel ivsc modules for version
- 6.5.0-1011.
+ 6.5.0-1013.
  .
  You likely do not want to install this package directly. Instead, install the
  one of the linux-modules-ivsc-oem* meta-packages,
@@ -290,18 +290,18 @@
  also installed.
 
 
-Package: linux-modules-usbio-6.5.0-1011-oem
+Package: linux-modules-usbio-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: kernel
 Priority: optional
 Depends:
  ${misc:Depends},
- linux-image-6.5.0-1011-oem | linux-image-unsigned-6.5.0-1011-oem,
+ linux-image-6.5.0-1013-oem | linux-image-unsigned-6.5.0-1013-oem,
 Built-Using: ${linux:BuiltUsing}
-Description: Linux kernel usbio modules for version 6.5.0-1011
+Description: Linux kernel usbio modules for version 6.5.0-1013
  This package provides the Linux kernel usbio modules for version
- 6.5.0-1011.
+ 6.5.0-1013.
  .
  You likely do not want to install this package directly. Instead, install the
  one of the linux-modules-usbio-oem* meta-packages,
@@ -309,18 +309,18 @@
  also installed.
 
 
-Package: linux-modules-iwlwifi-6.5.0-1011-oem
+Package: linux-modules-iwlwifi-6.5.0-1013-oem
 Build-Profiles: <!stage1>
 Architecture: amd64
 Section: kernel
 Priority: optional
 Depends:
  ${misc:Depends},
- linux-image-6.5.0-1011-oem | linux-image-unsigned-6.5.0-1011-oem,
+ linux-image-6.5.0-1013-oem | linux-image-unsigned-6.5.0-1013-oem,
 Built-Using: ${linux:BuiltUsing}
-Description: Linux kernel iwlwifi modules for version 6.5.0-1011
+Description: Linux kernel iwlwifi modules for version 6.5.0-1013
  This package provides the Linux kernel iwlwifi modules for version
- 6.5.0-1011.
+ 6.5.0-1013.
  .
  You likely do not want to install this package directly. Instead, install the
  one of the linux-modules-iwlwifi-oem* meta-packages,
diff -u linux-oem-6.5-6.5.0/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c linux-oem-6.5-6.5.0/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
--- linux-oem-6.5-6.5.0/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ linux-oem-6.5-6.5.0/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3727,10 +3727,6 @@
 		adev->gfx.mcbp = true;
 	else if (amdgpu_mcbp == 0)
 		adev->gfx.mcbp = false;
-	else if ((adev->ip_versions[GC_HWIP][0] >= IP_VERSION(9, 0, 0)) &&
-		 (adev->ip_versions[GC_HWIP][0] < IP_VERSION(10, 0, 0)) &&
-		 adev->gfx.num_gfx_rings)
-		adev->gfx.mcbp = true;
 
 	if (amdgpu_sriov_vf(adev))
 		adev->gfx.mcbp = true;
diff -u linux-oem-6.5-6.5.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c linux-oem-6.5-6.5.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
--- linux-oem-6.5-6.5.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ linux-oem-6.5-6.5.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5993,8 +5993,6 @@
 
 	if (recalculate_timing)
 		drm_mode_set_crtcinfo(&saved_mode, 0);
-	else
-		drm_mode_set_crtcinfo(&mode, 0);
 
 	/*
 	 * If scaling is enabled and refresh rate didn't change
@@ -6556,6 +6554,8 @@
 		goto fail;
 	}
 
+	drm_mode_set_crtcinfo(mode, 0);
+
 	stream = create_validate_stream_for_sink(aconnector, mode,
 						 to_dm_connector_state(connector->state),
 						 NULL);
diff -u linux-oem-6.5-6.5.0/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c linux-oem-6.5-6.5.0/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
--- linux-oem-6.5-6.5.0/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
+++ linux-oem-6.5-6.5.0/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
@@ -244,6 +244,7 @@
 	list_for_each_entry(file, &dev->filelist, lhead) {
 		struct task_struct *task;
 		struct drm_gem_object *gobj;
+		struct pid *pid;
 		int id;
 
 		/*
@@ -253,8 +254,9 @@
 		 * Therefore, we need to protect this ->comm access using RCU.
 		 */
 		rcu_read_lock();
-		task = pid_task(file->pid, PIDTYPE_TGID);
-		seq_printf(m, "pid %8d command %s:\n", pid_nr(file->pid),
+		pid = rcu_dereference(file->pid);
+		task = pid_task(pid, PIDTYPE_TGID);
+		seq_printf(m, "pid %8d command %s:\n", pid_nr(pid),
 			   task ? task->comm : "<unknown>");
 		rcu_read_unlock();
 
diff -u linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/core.c linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/core.c
--- linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/core.c
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/core.c
@@ -2682,6 +2682,7 @@
 	rtw89_phy_tx_path_div_track(rtwdev);
 	rtw89_phy_antdiv_track(rtwdev);
 	rtw89_phy_ul_tb_ctrl_track(rtwdev);
+	rtw89_tas_track(rtwdev);
 
 	if (rtwdev->lps_enabled && !rtwdev->btc.lps)
 		rtw89_enter_lps_track(rtwdev);
@@ -3496,6 +3497,8 @@
 	rtw89_mac_cfg_ppdu_status(rtwdev, RTW89_MAC_0, true);
 	rtw89_mac_update_rts_threshold(rtwdev, RTW89_MAC_0);
 
+	rtw89_tas_reset(rtwdev);
+
 	ret = rtw89_hci_start(rtwdev);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to start hci\n");
@@ -3612,6 +3615,7 @@
 
 	rtw89_ser_init(rtwdev);
 	rtw89_entity_init(rtwdev);
+	rtw89_tas_init(rtwdev);
 
 	return 0;
 }
diff -u linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/core.h linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/core.h
--- linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/core.h
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/core.h
@@ -3504,6 +3504,23 @@
 	};
 };
 
+enum rtw89_tas_state {
+	RTW89_TAS_STATE_DPR_OFF,
+	RTW89_TAS_STATE_DPR_ON,
+	RTW89_TAS_STATE_DPR_FORBID,
+};
+
+#define RTW89_TAS_MAX_WINDOW 50
+struct rtw89_tas_info {
+	s16 txpwr_history[RTW89_TAS_MAX_WINDOW];
+	s32 total_txpwr;
+	u8 cur_idx;
+	s8 dpr_gap;
+	s8 delta;
+	enum rtw89_tas_state state;
+	bool enable;
+};
+
 struct rtw89_chanctx_cfg {
 	enum rtw89_sub_entity_idx idx;
 };
@@ -3859,9 +3876,12 @@
 	u8 txpwr_regd[RTW89_BAND_NUM];
 };
 
+#define RTW89_REGD_MAX_COUNTRY_NUM U8_MAX
+
 struct rtw89_regulatory_info {
 	const struct rtw89_regd *regd;
 	enum rtw89_reg_6ghz_power reg_6ghz_power;
+	DECLARE_BITMAP(block_6ghz, RTW89_REGD_MAX_COUNTRY_NUM);
 };
 
 enum rtw89_ifs_clm_application {
@@ -4179,6 +4199,7 @@
 
 	struct rtw89_regulatory_info regulatory;
 	struct rtw89_sar_info sar;
+	struct rtw89_tas_info tas;
 
 	struct rtw89_btc btc;
 	enum rtw89_ps_mode ps_mode;
diff -u linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/debug.c linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/debug.c
--- linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/debug.c
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/debug.c
@@ -572,9 +572,9 @@
 		seq_puts(m, #_regd "\n"); \
 		break
 
-static void __print_regd(struct seq_file *m, struct rtw89_dev *rtwdev)
+static void __print_regd(struct seq_file *m, struct rtw89_dev *rtwdev,
+			 const struct rtw89_chan *chan)
 {
-	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 	u8 band = chan->band_type;
 	u8 regd = rtw89_regd_get(rtwdev, band);
 
@@ -604,16 +604,21 @@
 {
 	struct rtw89_debugfs_priv *debugfs_priv = m->private;
 	struct rtw89_dev *rtwdev = debugfs_priv->rtwdev;
+	const struct rtw89_chan *chan;
 	int ret = 0;
 
 	mutex_lock(&rtwdev->mutex);
 	rtw89_leave_ps_mode(rtwdev);
+	chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 
 	seq_puts(m, "[Regulatory] ");
-	__print_regd(m, rtwdev);
+	__print_regd(m, rtwdev, chan);
 
 	seq_puts(m, "[SAR]\n");
-	rtw89_print_sar(m, rtwdev);
+	rtw89_print_sar(m, rtwdev, chan->freq);
+
+	seq_puts(m, "[TAS]\n");
+	rtw89_print_tas(m, rtwdev);
 
 	seq_puts(m, "\n[TX power byrate]\n");
 	ret = __print_txpwr_map(m, rtwdev, &__txpwr_map_byr);
diff -u linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/phy.c linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/phy.c
--- linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/phy.c
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/phy.c
@@ -1634,6 +1634,8 @@
 	const struct rtw89_txpwr_rule_5ghz *rule_5ghz = &rfe_parms->rule_5ghz;
 	const struct rtw89_txpwr_rule_6ghz *rule_6ghz = &rfe_parms->rule_6ghz;
 	struct rtw89_regulatory_info *regulatory = &rtwdev->regulatory;
+	enum nl80211_band nl_band = rtw89_hw_to_nl80211_band(band);
+	u32 freq = ieee80211_channel_to_frequency(ch, nl_band);
 	u8 ch_idx = rtw89_channel_to_idx(rtwdev, band, ch);
 	u8 regd = rtw89_regd_get(rtwdev, band);
 	u8 reg6 = regulatory->reg_6ghz_power;
@@ -1669,7 +1671,7 @@
 	}
 
 	lmt = rtw89_phy_txpwr_rf_to_mac(rtwdev, lmt);
-	sar = rtw89_query_sar(rtwdev);
+	sar = rtw89_query_sar(rtwdev, freq);
 
 	return min(lmt, sar);
 }
@@ -1889,6 +1891,8 @@
 	const struct rtw89_txpwr_rule_5ghz *rule_5ghz = &rfe_parms->rule_5ghz;
 	const struct rtw89_txpwr_rule_6ghz *rule_6ghz = &rfe_parms->rule_6ghz;
 	struct rtw89_regulatory_info *regulatory = &rtwdev->regulatory;
+	enum nl80211_band nl_band = rtw89_hw_to_nl80211_band(band);
+	u32 freq = ieee80211_channel_to_frequency(ch, nl_band);
 	u8 ch_idx = rtw89_channel_to_idx(rtwdev, band, ch);
 	u8 regd = rtw89_regd_get(rtwdev, band);
 	u8 reg6 = regulatory->reg_6ghz_power;
@@ -1924,7 +1928,7 @@
 	}
 
 	lmt_ru = rtw89_phy_txpwr_rf_to_mac(rtwdev, lmt_ru);
-	sar = rtw89_query_sar(rtwdev);
+	sar = rtw89_query_sar(rtwdev, freq);
 
 	return min(lmt_ru, sar);
 }
diff -u linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/regd.c linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/regd.c
--- linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/regd.c
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/regd.c
@@ -112,9 +112,9 @@
 	COUNTRY_REGD("MY", RTW89_ETSI, RTW89_ETSI, RTW89_ETSI),
 	COUNTRY_REGD("PK", RTW89_ETSI, RTW89_ETSI, RTW89_NA),
 	COUNTRY_REGD("PH", RTW89_ETSI, RTW89_ETSI, RTW89_NA),
-	COUNTRY_REGD("SG", RTW89_ETSI, RTW89_ETSI, RTW89_NA),
+	COUNTRY_REGD("SG", RTW89_ETSI, RTW89_ETSI, RTW89_ETSI),
 	COUNTRY_REGD("LK", RTW89_ETSI, RTW89_ETSI, RTW89_NA),
-	COUNTRY_REGD("TW", RTW89_FCC, RTW89_FCC, RTW89_NA),
+	COUNTRY_REGD("TW", RTW89_FCC, RTW89_FCC, RTW89_ETSI),
 	COUNTRY_REGD("TH", RTW89_ETSI, RTW89_ETSI, RTW89_THAILAND),
 	COUNTRY_REGD("VN", RTW89_ETSI, RTW89_ETSI, RTW89_NA),
 	COUNTRY_REGD("AU", RTW89_ACMA, RTW89_ACMA, RTW89_ACMA),
@@ -179,7 +179,7 @@
 	COUNTRY_REGD("GE", RTW89_ETSI, RTW89_ETSI, RTW89_NA),
 	COUNTRY_REGD("GI", RTW89_ETSI, RTW89_ETSI, RTW89_NA),
 	COUNTRY_REGD("GL", RTW89_ETSI, RTW89_ETSI, RTW89_NA),
-	COUNTRY_REGD("GD", RTW89_FCC, RTW89_FCC, RTW89_NA),
+	COUNTRY_REGD("GD", RTW89_FCC, RTW89_FCC, RTW89_FCC),
 	COUNTRY_REGD("GP", RTW89_ETSI, RTW89_ETSI, RTW89_NA),
 	COUNTRY_REGD("GU", RTW89_FCC, RTW89_FCC, RTW89_NA),
 	COUNTRY_REGD("GG", RTW89_ETSI, RTW89_ETSI, RTW89_NA),
@@ -257,7 +257,42 @@
 	COUNTRY_REGD("PS", RTW89_ETSI, RTW89_ETSI, RTW89_NA),
 };
 
-static const struct rtw89_regd *rtw89_regd_find_reg_by_name(char *alpha2)
+static const char rtw89_alpha2_list_eu[][3] = {
+	"AT",
+	"BE",
+	"CY",
+	"CZ",
+	"DK",
+	"EE",
+	"FI",
+	"FR",
+	"DE",
+	"GR",
+	"HU",
+	"IS",
+	"IE",
+	"IT",
+	"LV",
+	"LI",
+	"LT",
+	"LU",
+	"MT",
+	"MC",
+	"NL",
+	"NO",
+	"PL",
+	"PT",
+	"SK",
+	"SI",
+	"ES",
+	"SE",
+	"CH",
+	"BG",
+	"HR",
+	"RO",
+};
+
+static const struct rtw89_regd *rtw89_regd_find_reg_by_name(const char *alpha2)
 {
 	u32 i;
 
@@ -274,6 +309,24 @@
 	return regd == &rtw89_ww_regd;
 }
 
+static u8 rtw89_regd_get_index(const struct rtw89_regd *regd)
+{
+	BUILD_BUG_ON(ARRAY_SIZE(rtw89_regd_map) > RTW89_REGD_MAX_COUNTRY_NUM);
+
+	if (rtw89_regd_is_ww(regd))
+		return RTW89_REGD_MAX_COUNTRY_NUM;
+
+	return regd - rtw89_regd_map;
+}
+
+static u8 rtw89_regd_get_index_by_name(const char *alpha2)
+{
+	const struct rtw89_regd *regd;
+
+	regd = rtw89_regd_find_reg_by_name(alpha2);
+	return rtw89_regd_get_index(regd);
+}
+
 #define rtw89_debug_regd(_dev, _regd, _desc, _argv...) \
 do { \
 	typeof(_regd) __r = _regd; \
@@ -291,19 +344,22 @@
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	bool regd_allow_unii_4 = chip->support_unii4;
 	struct ieee80211_supported_band *sband;
+	struct rtw89_acpi_dsm_result res = {};
 	int ret;
 	u8 val;
 
 	if (!chip->support_unii4)
 		goto bottom;
 
-	ret = rtw89_acpi_evaluate_dsm(rtwdev, RTW89_ACPI_DSM_FUNC_59G_EN, &val);
+	ret = rtw89_acpi_evaluate_dsm(rtwdev, RTW89_ACPI_DSM_FUNC_59G_EN, &res);
 	if (ret) {
 		rtw89_debug(rtwdev, RTW89_DBG_REGD,
 			    "acpi: cannot eval unii 4: %d\n", ret);
 		goto bottom;
 	}
 
+	val = res.u.value;
+
 	rtw89_debug(rtwdev, RTW89_DBG_REGD,
 		    "acpi: eval if allow unii 4: %d\n", val);
 
@@ -332,25 +388,99 @@
 	sband->n_channels -= 3;
 }
 
+static void __rtw89_regd_setup_policy_6ghz(struct rtw89_dev *rtwdev, bool block,
+					   const char *alpha2)
+{
+	struct rtw89_regulatory_info *regulatory = &rtwdev->regulatory;
+	u8 index;
+
+	index = rtw89_regd_get_index_by_name(alpha2);
+	if (index == RTW89_REGD_MAX_COUNTRY_NUM) {
+		rtw89_debug(rtwdev, RTW89_DBG_REGD, "%s: unknown alpha2 %c%c\n",
+			    __func__, alpha2[0], alpha2[1]);
+		return;
+	}
+
+	if (block)
+		set_bit(index, regulatory->block_6ghz);
+	else
+		clear_bit(index, regulatory->block_6ghz);
+}
+
+static void rtw89_regd_setup_policy_6ghz(struct rtw89_dev *rtwdev)
+{
+	struct rtw89_regulatory_info *regulatory = &rtwdev->regulatory;
+	const struct rtw89_acpi_country_code *country;
+	const struct rtw89_acpi_policy_6ghz *ptr;
+	struct rtw89_acpi_dsm_result res = {};
+	bool to_block;
+	int i, j;
+	int ret;
+
+	ret = rtw89_acpi_evaluate_dsm(rtwdev, RTW89_ACPI_DSM_FUNC_6G_BP, &res);
+	if (ret) {
+		rtw89_debug(rtwdev, RTW89_DBG_REGD,
+			    "acpi: cannot eval policy 6ghz: %d\n", ret);
+		return;
+	}
+
+	ptr = res.u.policy_6ghz;
+
+	switch (ptr->policy_mode) {
+	case RTW89_ACPI_POLICY_BLOCK:
+		to_block = true;
+		break;
+	case RTW89_ACPI_POLICY_ALLOW:
+		to_block = false;
+		/* only below list is allowed; block all first */
+		bitmap_fill(regulatory->block_6ghz, RTW89_REGD_MAX_COUNTRY_NUM);
+		break;
+	default:
+		rtw89_debug(rtwdev, RTW89_DBG_REGD,
+			    "%s: unknown policy mode: %d\n", __func__,
+			    ptr->policy_mode);
+		goto out;
+	}
+
+	for (i = 0; i < ptr->country_count; i++) {
+		country = &ptr->country_list[i];
+		if (memcmp("EU", country->alpha2, 2) != 0) {
+			__rtw89_regd_setup_policy_6ghz(rtwdev, to_block,
+						       country->alpha2);
+			continue;
+		}
+
+		for (j = 0; j < ARRAY_SIZE(rtw89_alpha2_list_eu); j++)
+			__rtw89_regd_setup_policy_6ghz(rtwdev, to_block,
+						       rtw89_alpha2_list_eu[j]);
+	}
+
+out:
+	kfree(ptr);
+}
+
 static void rtw89_regd_setup_6ghz(struct rtw89_dev *rtwdev, struct wiphy *wiphy)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	bool chip_support_6ghz = chip->support_bands & BIT(NL80211_BAND_6GHZ);
 	bool regd_allow_6ghz = chip_support_6ghz;
 	struct ieee80211_supported_band *sband;
+	struct rtw89_acpi_dsm_result res = {};
 	int ret;
 	u8 val;
 
 	if (!chip_support_6ghz)
 		goto bottom;
 
-	ret = rtw89_acpi_evaluate_dsm(rtwdev, RTW89_ACPI_DSM_FUNC_6G_DIS, &val);
+	ret = rtw89_acpi_evaluate_dsm(rtwdev, RTW89_ACPI_DSM_FUNC_6G_DIS, &res);
 	if (ret) {
 		rtw89_debug(rtwdev, RTW89_DBG_REGD,
 			    "acpi: cannot eval 6ghz: %d\n", ret);
 		goto bottom;
 	}
 
+	val = res.u.value;
+
 	rtw89_debug(rtwdev, RTW89_DBG_REGD,
 		    "acpi: eval if disallow 6ghz: %d\n", val);
 
@@ -369,8 +499,10 @@
 	rtw89_debug(rtwdev, RTW89_DBG_REGD, "regd: allow 6ghz: %d\n",
 		    regd_allow_6ghz);
 
-	if (regd_allow_6ghz)
+	if (regd_allow_6ghz) {
+		rtw89_regd_setup_policy_6ghz(rtwdev);
 		return;
+	}
 
 	sband = wiphy->bands[NL80211_BAND_6GHZ];
 	if (!sband)
@@ -430,6 +562,33 @@
 	return 0;
 }
 
+static void rtw89_regd_apply_policy_6ghz(struct rtw89_dev *rtwdev,
+					 struct wiphy *wiphy)
+{
+	struct rtw89_regulatory_info *regulatory = &rtwdev->regulatory;
+	const struct rtw89_regd *regd = regulatory->regd;
+	struct ieee80211_supported_band *sband;
+	u8 index;
+	int i;
+
+	index = rtw89_regd_get_index(regd);
+	if (index == RTW89_REGD_MAX_COUNTRY_NUM)
+		return;
+
+	if (!test_bit(index, regulatory->block_6ghz))
+		return;
+
+	rtw89_debug(rtwdev, RTW89_DBG_REGD, "%c%c 6 GHz is blocked by policy\n",
+		    regd->alpha2[0], regd->alpha2[1]);
+
+	sband = wiphy->bands[NL80211_BAND_6GHZ];
+	if (!sband)
+		return;
+
+	for (i = 0; i < sband->n_channels; i++)
+		sband->channels[i].flags |= IEEE80211_CHAN_DISABLED;
+}
+
 static void rtw89_regd_notifier_apply(struct rtw89_dev *rtwdev,
 				      struct wiphy *wiphy,
 				      struct regulatory_request *request)
@@ -444,6 +603,8 @@
 		wiphy->regulatory_flags |= REGULATORY_COUNTRY_IE_IGNORE;
 	else
 		wiphy->regulatory_flags &= ~REGULATORY_COUNTRY_IE_IGNORE;
+
+	rtw89_regd_apply_policy_6ghz(rtwdev, wiphy);
 }
 
 void rtw89_regd_notifier(struct wiphy *wiphy, struct regulatory_request *request)
diff -u linux-oem-6.5-6.5.0/kernel/events/core.c linux-oem-6.5-6.5.0/kernel/events/core.c
--- linux-oem-6.5-6.5.0/kernel/events/core.c
+++ linux-oem-6.5-6.5.0/kernel/events/core.c
@@ -1808,31 +1808,34 @@
 					      PERF_EVENT_STATE_INACTIVE;
 }
 
-static void __perf_event_read_size(struct perf_event *event, int nr_siblings)
+static int __perf_event_read_size(u64 read_format, int nr_siblings)
 {
 	int entry = sizeof(u64); /* value */
 	int size = 0;
 	int nr = 1;
 
-	if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
+	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
 		size += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
+	if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
 		size += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_ID)
+	if (read_format & PERF_FORMAT_ID)
 		entry += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_LOST)
+	if (read_format & PERF_FORMAT_LOST)
 		entry += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_GROUP) {
+	if (read_format & PERF_FORMAT_GROUP) {
 		nr += nr_siblings;
 		size += sizeof(u64);
 	}
 
-	size += entry * nr;
-	event->read_size = size;
+	/*
+	 * Since perf_event_validate_size() limits this to 16k and inhibits
+	 * adding more siblings, this will never overflow.
+	 */
+	return size + nr * entry;
 }
 
 static void __perf_event_header_size(struct perf_event *event, u64 sample_type)
@@ -1882,8 +1885,9 @@
  */
 static void perf_event__header_size(struct perf_event *event)
 {
-	__perf_event_read_size(event,
-			       event->group_leader->nr_siblings);
+	event->read_size =
+		__perf_event_read_size(event->attr.read_format,
+				       event->group_leader->nr_siblings);
 	__perf_event_header_size(event, event->attr.sample_type);
 }
 
@@ -1914,23 +1918,44 @@
 	event->id_header_size = size;
 }
 
+/*
+ * Check that adding an event to the group does not result in anybody
+ * overflowing the 64k event limit imposed by the output buffer.
+ *
+ * Specifically, check that the read_size for the event does not exceed 16k,
+ * read_size being the one term that grows with groups size. Since read_size
+ * depends on per-event read_format, also (re)check the existing events.
+ *
+ * This leaves 48k for the constant size fields and things like callchains,
+ * branch stacks and register sets.
+ */
 static bool perf_event_validate_size(struct perf_event *event)
 {
-	/*
-	 * The values computed here will be over-written when we actually
-	 * attach the event.
-	 */
-	__perf_event_read_size(event, event->group_leader->nr_siblings + 1);
-	__perf_event_header_size(event, event->attr.sample_type & ~PERF_SAMPLE_READ);
-	perf_event__id_header_size(event);
+	struct perf_event *sibling, *group_leader = event->group_leader;
+
+	if (__perf_event_read_size(event->attr.read_format,
+				   group_leader->nr_siblings + 1) > 16*1024)
+		return false;
+
+	if (__perf_event_read_size(group_leader->attr.read_format,
+				   group_leader->nr_siblings + 1) > 16*1024)
+		return false;
 
 	/*
-	 * Sum the lot; should not exceed the 64k limit we have on records.
-	 * Conservative limit to allow for callchains and other variable fields.
+	 * When creating a new group leader, group_leader->ctx is initialized
+	 * after the size has been validated, but we cannot safely use
+	 * for_each_sibling_event() until group_leader->ctx is set. A new group
+	 * leader cannot have any siblings yet, so we can safely skip checking
+	 * the non-existent siblings.
 	 */
-	if (event->read_size + event->header_size +
-	    event->id_header_size + sizeof(struct perf_event_header) >= 16*1024)
-		return false;
+	if (event == group_leader)
+		return true;
+
+	for_each_sibling_event(sibling, group_leader) {
+		if (__perf_event_read_size(sibling->attr.read_format,
+					   group_leader->nr_siblings + 1) > 16*1024)
+			return false;
+	}
 
 	return true;
 }
diff -u linux-oem-6.5-6.5.0/net/ipv4/igmp.c linux-oem-6.5-6.5.0/net/ipv4/igmp.c
--- linux-oem-6.5-6.5.0/net/ipv4/igmp.c
+++ linux-oem-6.5-6.5.0/net/ipv4/igmp.c
@@ -216,8 +216,10 @@
 	int tv = get_random_u32_below(max_delay);
 
 	im->tm_running = 1;
-	if (!mod_timer(&im->timer, jiffies+tv+2))
-		refcount_inc(&im->refcnt);
+	if (refcount_inc_not_zero(&im->refcnt)) {
+		if (mod_timer(&im->timer, jiffies + tv + 2))
+			ip_ma_put(im);
+	}
 }
 
 static void igmp_gq_start_timer(struct in_device *in_dev)
diff -u linux-oem-6.5-6.5.0/net/netfilter/nf_tables_api.c linux-oem-6.5-6.5.0/net/netfilter/nf_tables_api.c
--- linux-oem-6.5-6.5.0/net/netfilter/nf_tables_api.c
+++ linux-oem-6.5-6.5.0/net/netfilter/nf_tables_api.c
@@ -9744,7 +9744,7 @@
 	list_for_each_entry_safe(set, next, set_update_list, pending_update) {
 		list_del_init(&set->pending_update);
 
-		if (!set->ops->commit)
+		if (!set->ops->commit || set->dead)
 			continue;
 
 		set->ops->commit(set);
diff -u linux-oem-6.5-6.5.0/sound/pci/hda/patch_realtek.c linux-oem-6.5-6.5.0/sound/pci/hda/patch_realtek.c
--- linux-oem-6.5-6.5.0/sound/pci/hda/patch_realtek.c
+++ linux-oem-6.5-6.5.0/sound/pci/hda/patch_realtek.c
@@ -9764,6 +9764,10 @@
 	SND_PCI_QUIRK(0x103c, 0x8c70, "HP EliteBook 835 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c71, "HP EliteBook 845 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c72, "HP EliteBook 865 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8c96, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+	SND_PCI_QUIRK(0x103c, 0x8ca4, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8ca7, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8cf5, "HP ZBook Studio 16", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
 	SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ linux-oem-6.5-6.5.0/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -963,6 +963,7 @@
 	list_for_each_entry(file, &dev->filelist, lhead) {
 		struct task_struct *task;
 		struct drm_gem_object *gobj;
+		struct pid *pid;
 		int id;
 
 		/*
@@ -972,8 +973,9 @@
 		 * Therefore, we need to protect this ->comm access using RCU.
 		 */
 		rcu_read_lock();
-		task = pid_task(file->pid, PIDTYPE_TGID);
-		seq_printf(m, "pid %8d command %s:\n", pid_nr(file->pid),
+		pid = rcu_dereference(file->pid);
+		task = pid_task(pid, PIDTYPE_TGID);
+		seq_printf(m, "pid %8d command %s:\n", pid_nr(pid),
 			   task ? task->comm : "<unknown>");
 		rcu_read_unlock();
 
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/gpu/drm/drm_auth.c
+++ linux-oem-6.5-6.5.0/drivers/gpu/drm/drm_auth.c
@@ -235,7 +235,8 @@
 static int
 drm_master_check_perm(struct drm_device *dev, struct drm_file *file_priv)
 {
-	if (file_priv->pid == task_pid(current) && file_priv->was_master)
+	if (file_priv->was_master &&
+	    rcu_access_pointer(file_priv->pid) == task_pid(current))
 		return 0;
 
 	if (!capable(CAP_SYS_ADMIN))
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/gpu/drm/drm_debugfs.c
+++ linux-oem-6.5-6.5.0/drivers/gpu/drm/drm_debugfs.c
@@ -90,15 +90,17 @@
 	 */
 	mutex_lock(&dev->filelist_mutex);
 	list_for_each_entry_reverse(priv, &dev->filelist, lhead) {
-		struct task_struct *task;
 		bool is_current_master = drm_is_current_master(priv);
+		struct task_struct *task;
+		struct pid *pid;
 
-		rcu_read_lock(); /* locks pid_task()->comm */
-		task = pid_task(priv->pid, PIDTYPE_TGID);
+		rcu_read_lock(); /* Locks priv->pid and pid_task()->comm! */
+		pid = rcu_dereference(priv->pid);
+		task = pid_task(pid, PIDTYPE_TGID);
 		uid = task ? __task_cred(task)->euid : GLOBAL_ROOT_UID;
 		seq_printf(m, "%20s %5d %3d   %c    %c %5d %10u\n",
 			   task ? task->comm : "<unknown>",
-			   pid_vnr(priv->pid),
+			   pid_vnr(pid),
 			   priv->minor->index,
 			   is_current_master ? 'y' : 'n',
 			   priv->authenticated ? 'y' : 'n',
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/gpu/drm/drm_file.c
+++ linux-oem-6.5-6.5.0/drivers/gpu/drm/drm_file.c
@@ -160,7 +160,7 @@
 
 	/* Get a unique identifier for fdinfo: */
 	file->client_id = atomic64_inc_return(&ident);
-	file->pid = get_pid(task_tgid(current));
+	rcu_assign_pointer(file->pid, get_pid(task_tgid(current)));
 	file->minor = minor;
 
 	/* for compatibility root is always authenticated */
@@ -200,7 +200,7 @@
 		drm_syncobj_release(file);
 	if (drm_core_check_feature(dev, DRIVER_GEM))
 		drm_gem_release(dev, file);
-	put_pid(file->pid);
+	put_pid(rcu_access_pointer(file->pid));
 	kfree(file);
 
 	return ERR_PTR(ret);
@@ -291,7 +291,7 @@
 
 	WARN_ON(!list_empty(&file->event_list));
 
-	put_pid(file->pid);
+	put_pid(rcu_access_pointer(file->pid));
 	kfree(file);
 }
 
@@ -505,6 +505,40 @@
 }
 EXPORT_SYMBOL(drm_release);
 
+void drm_file_update_pid(struct drm_file *filp)
+{
+	struct drm_device *dev;
+	struct pid *pid, *old;
+
+	/*
+	 * Master nodes need to keep the original ownership in order for
+	 * drm_master_check_perm to keep working correctly. (See comment in
+	 * drm_auth.c.)
+	 */
+	if (filp->was_master)
+		return;
+
+	pid = task_tgid(current);
+
+	/*
+	 * Quick unlocked check since the model is a single handover followed by
+	 * exclusive repeated use.
+	 */
+	if (pid == rcu_access_pointer(filp->pid))
+		return;
+
+	dev = filp->minor->dev;
+	mutex_lock(&dev->filelist_mutex);
+	old = rcu_replace_pointer(filp->pid, pid, 1);
+	mutex_unlock(&dev->filelist_mutex);
+
+	if (pid != old) {
+		get_pid(pid);
+		synchronize_rcu();
+		put_pid(old);
+	}
+}
+
 /**
  * drm_release_noglobal - release method for DRM file
  * @inode: device inode
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/gpu/drm/drm_ioctl.c
+++ linux-oem-6.5-6.5.0/drivers/gpu/drm/drm_ioctl.c
@@ -775,6 +775,9 @@
 	struct drm_device *dev = file_priv->minor->dev;
 	int retcode;
 
+	/* Update drm_file owner if fd was passed along. */
+	drm_file_update_pid(file_priv);
+
 	if (drm_dev_is_unplugged(dev))
 		return -ENODEV;
 
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ linux-oem-6.5-6.5.0/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -1115,7 +1115,10 @@
 	}
 
 	get_task_comm(tmpname, current);
-	snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid));
+	rcu_read_lock();
+	snprintf(name, sizeof(name), "%s[%d]",
+		 tmpname, pid_nr(rcu_dereference(fpriv->pid)));
+	rcu_read_unlock();
 
 	if (!(cli = kzalloc(sizeof(*cli), GFP_KERNEL))) {
 		ret = -ENOMEM;
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ linux-oem-6.5-6.5.0/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -13901,6 +13901,8 @@
 	if (rc)
 		goto resume_exit;
 
+	bnxt_clear_reservations(bp, true);
+
 	if (bnxt_hwrm_func_drv_rgtr(bp, NULL, 0, false)) {
 		rc = -ENODEV;
 		goto resume_exit;
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2018-2023 Intel Corporation
+ * Copyright (C) 2018-2024 Intel Corporation
  */
 #include <linux/firmware.h>
 #include "iwl-drv.h"
@@ -1094,7 +1094,7 @@
 		node_trig = (void *)node_tlv->data;
 	}
 
-	memcpy(node_trig->data + offset, trig->data, trig_data_len);
+	memcpy((u8 *)node_trig->data + offset, trig->data, trig_data_len);
 	node_tlv->length = cpu_to_le32(size);
 
 	if (policy & IWL_FW_INI_APPLY_POLICY_OVERRIDE_CFG) {
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/net/wireless/realtek/rtw89/acpi.c
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/acpi.c
@@ -12,27 +12,74 @@
 					   0x82, 0xBD, 0xFE, 0x86,
 					   0x07, 0x80, 0x3A, 0xA7);
 
-static int rtw89_acpi_dsm_get(struct rtw89_dev *rtwdev, union acpi_object *obj,
-			      u8 *value)
+static
+int rtw89_acpi_dsm_get_value(struct rtw89_dev *rtwdev, union acpi_object *obj,
+			     u8 *value)
 {
-	switch (obj->type) {
-	case ACPI_TYPE_INTEGER:
-		*value = (u8)obj->integer.value;
-		break;
-	case ACPI_TYPE_BUFFER:
-		*value = obj->buffer.pointer[0];
-		break;
-	default:
-		rtw89_debug(rtwdev, RTW89_DBG_UNEXP,
-			    "acpi dsm return unhandled type: %d\n", obj->type);
+	if (obj->type != ACPI_TYPE_INTEGER) {
+		rtw89_debug(rtwdev, RTW89_DBG_ACPI,
+			    "acpi: expect integer but type: %d\n", obj->type);
 		return -EINVAL;
 	}
 
+	*value = (u8)obj->integer.value;
+	return 0;
+}
+
+static bool chk_acpi_policy_6ghz_sig(const struct rtw89_acpi_policy_6ghz *p)
+{
+	return p->signature[0] == 0x00 &&
+	       p->signature[1] == 0xE0 &&
+	       p->signature[2] == 0x4C;
+}
+
+static
+int rtw89_acpi_dsm_get_policy_6ghz(struct rtw89_dev *rtwdev,
+				   union acpi_object *obj,
+				   struct rtw89_acpi_policy_6ghz **policy_6ghz)
+{
+	const struct rtw89_acpi_policy_6ghz *ptr;
+	u32 expect_len;
+	u32 len;
+
+	if (obj->type != ACPI_TYPE_BUFFER) {
+		rtw89_debug(rtwdev, RTW89_DBG_ACPI,
+			    "acpi: expect buffer but type: %d\n", obj->type);
+		return -EINVAL;
+	}
+
+	len = obj->buffer.length;
+	if (len < sizeof(*ptr)) {
+		rtw89_debug(rtwdev, RTW89_DBG_ACPI, "%s: invalid buffer length: %u\n",
+			    __func__, len);
+		return -EINVAL;
+	}
+
+	ptr = (typeof(ptr))obj->buffer.pointer;
+	if (!chk_acpi_policy_6ghz_sig(ptr)) {
+		rtw89_debug(rtwdev, RTW89_DBG_ACPI, "%s: bad signature\n", __func__);
+		return -EINVAL;
+	}
+
+	expect_len = struct_size(ptr, country_list, ptr->country_count);
+	if (len < expect_len) {
+		rtw89_debug(rtwdev, RTW89_DBG_ACPI, "%s: expect %u but length: %u\n",
+			    __func__, expect_len, len);
+		return -EINVAL;
+	}
+
+	*policy_6ghz = kmemdup(ptr, expect_len, GFP_KERNEL);
+	if (!*policy_6ghz)
+		return -ENOMEM;
+
+	rtw89_hex_dump(rtwdev, RTW89_DBG_ACPI, "policy_6ghz: ", *policy_6ghz,
+		       expect_len);
 	return 0;
 }
 
 int rtw89_acpi_evaluate_dsm(struct rtw89_dev *rtwdev,
-			    enum rtw89_acpi_dsm_func func, u8 *value)
+			    enum rtw89_acpi_dsm_func func,
+			    struct rtw89_acpi_dsm_result *res)
 {
 	union acpi_object *obj;
 	int ret;
@@ -40,12 +87,16 @@
 	obj = acpi_evaluate_dsm(ACPI_HANDLE(rtwdev->dev), &rtw89_guid,
 				0, func, NULL);
 	if (!obj) {
-		rtw89_debug(rtwdev, RTW89_DBG_UNEXP,
+		rtw89_debug(rtwdev, RTW89_DBG_ACPI,
 			    "acpi dsm fail to evaluate func: %d\n", func);
 		return -ENOENT;
 	}
 
-	ret = rtw89_acpi_dsm_get(rtwdev, obj, value);
+	if (func == RTW89_ACPI_DSM_FUNC_6G_BP)
+		ret = rtw89_acpi_dsm_get_policy_6ghz(rtwdev, obj,
+						     &res->u.policy_6ghz);
+	else
+		ret = rtw89_acpi_dsm_get_value(rtwdev, obj, &res->u.value);
 
 	ACPI_FREE(obj);
 	return ret;
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/net/wireless/realtek/rtw89/acpi.h
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/acpi.h
@@ -15,7 +15,37 @@
 	RTW89_ACPI_DSM_FUNC_59G_EN = 6,
 };
 
+enum rtw89_acpi_policy_mode {
+	RTW89_ACPI_POLICY_BLOCK = 0,
+	RTW89_ACPI_POLICY_ALLOW = 1,
+};
+
+struct rtw89_acpi_country_code {
+	/* below are allowed:
+	 * * ISO alpha2 country code
+	 * * EU for countries in Europe
+	 */
+	char alpha2[2];
+} __packed;
+
+struct rtw89_acpi_policy_6ghz {
+	u8 signature[3];
+	u8 rsvd;
+	u8 policy_mode;
+	u8 country_count;
+	struct rtw89_acpi_country_code country_list[] __counted_by(country_count);
+} __packed;
+
+struct rtw89_acpi_dsm_result {
+	union {
+		u8 value;
+		/* caller needs to free it after using */
+		struct rtw89_acpi_policy_6ghz *policy_6ghz;
+	} u;
+};
+
 int rtw89_acpi_evaluate_dsm(struct rtw89_dev *rtwdev,
-			    enum rtw89_acpi_dsm_func func, u8 *value);
+			    enum rtw89_acpi_dsm_func func,
+			    struct rtw89_acpi_dsm_result *res);
 
 #endif
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/net/wireless/realtek/rtw89/debug.h
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/debug.h
@@ -29,6 +29,7 @@
 	RTW89_DBG_WOW = BIT(18),
 	RTW89_DBG_UL_TB = BIT(19),
 	RTW89_DBG_CHAN = BIT(20),
+	RTW89_DBG_ACPI = BIT(21),
 
 	RTW89_DBG_UNEXP = BIT(31),
 };
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/net/wireless/realtek/rtw89/reg.h
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/reg.h
@@ -4109,6 +4109,8 @@
 #define B_TXAGC_BB_OFT GENMASK(31, 16)
 #define B_TXAGC_BB GENMASK(31, 24)
 #define B_TXAGC_RF GENMASK(5, 0)
+#define R_PATH0_TXPWR 0x1C78
+#define B_PATH0_TXPWR GENMASK(8, 0)
 #define R_S0_ADDCK 0x1E00
 #define B_S0_ADDCK_I GENMASK(9, 0)
 #define B_S0_ADDCK_Q GENMASK(19, 10)
@@ -4184,6 +4186,8 @@
 #define R_TXAGC_BB_S1 0x3C60
 #define B_TXAGC_BB_S1_OFT GENMASK(31, 16)
 #define B_TXAGC_BB_S1 GENMASK(31, 24)
+#define R_PATH1_TXPWR 0x3C78
+#define B_PATH1_TXPWR GENMASK(8, 0)
 #define R_S1_ADDCK 0x3E00
 #define B_S1_ADDCK_I GENMASK(9, 0)
 #define B_S1_ADDCK_Q GENMASK(19, 10)
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/net/wireless/realtek/rtw89/sar.c
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/sar.c
@@ -2,9 +2,16 @@
 /* Copyright(c) 2019-2020  Realtek Corporation
  */
 
+#include "acpi.h"
 #include "debug.h"
+#include "phy.h"
+#include "reg.h"
 #include "sar.h"
 
+#define RTW89_TAS_FACTOR 2 /* unit: 0.25 dBm */
+#define RTW89_TAS_DPR_GAP (1 << RTW89_TAS_FACTOR)
+#define RTW89_TAS_DELTA (2 << RTW89_TAS_FACTOR)
+
 static enum rtw89_sar_subband rtw89_sar_get_subband(struct rtw89_dev *rtwdev,
 						    u32 center_freq)
 {
@@ -78,17 +85,15 @@
 	RTW89_DECL_SAR_6GHZ_SPAN(6885, SUBBAND_7_H, SUBBAND_8),
 };
 
-static int rtw89_query_sar_config_common(struct rtw89_dev *rtwdev, s32 *cfg)
+static int rtw89_query_sar_config_common(struct rtw89_dev *rtwdev,
+					 u32 center_freq, s32 *cfg)
 {
 	struct rtw89_sar_cfg_common *rtwsar = &rtwdev->sar.cfg_common;
-	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
-	enum rtw89_band band = chan->band_type;
-	u32 center_freq = chan->freq;
 	const struct rtw89_sar_span *span = NULL;
 	enum rtw89_sar_subband subband_l, subband_h;
 	int idx;
 
-	if (band == RTW89_BAND_6G) {
+	if (center_freq >= RTW89_SAR_6GHZ_SPAN_HEAD) {
 		idx = RTW89_SAR_6GHZ_SPAN_IDX(center_freq);
 		/* To decrease size of rtw89_sar_overlapping_6ghz[],
 		 * RTW89_SAR_6GHZ_SPAN_IDX() truncates the leading NULLs
@@ -108,8 +113,8 @@
 	}
 
 	rtw89_debug(rtwdev, RTW89_DBG_SAR,
-		    "for {band %u, center_freq %u}, SAR subband: {%u, %u}\n",
-		    band, center_freq, subband_l, subband_h);
+		    "center_freq %u: SAR subband {%u, %u}\n",
+		    center_freq, subband_l, subband_h);
 
 	if (!rtwsar->set[subband_l] && !rtwsar->set[subband_h])
 		return -ENODATA;
@@ -157,11 +162,35 @@
 			   RTW89_SAR_TXPWR_MAC_MAX);
 }
 
-s8 rtw89_query_sar(struct rtw89_dev *rtwdev)
+static s8 rtw89_txpwr_tas_to_sar(const struct rtw89_sar_handler *sar_hdl,
+				 s8 cfg)
+{
+	const u8 fct = sar_hdl->txpwr_factor_sar;
+
+	if (fct > RTW89_TAS_FACTOR)
+		return cfg << (fct - RTW89_TAS_FACTOR);
+	else
+		return cfg >> (RTW89_TAS_FACTOR - fct);
+}
+
+static s8 rtw89_txpwr_sar_to_tas(const struct rtw89_sar_handler *sar_hdl,
+				 s8 cfg)
+{
+	const u8 fct = sar_hdl->txpwr_factor_sar;
+
+	if (fct > RTW89_TAS_FACTOR)
+		return cfg >> (fct - RTW89_TAS_FACTOR);
+	else
+		return cfg << (RTW89_TAS_FACTOR - fct);
+}
+
+s8 rtw89_query_sar(struct rtw89_dev *rtwdev, u32 center_freq)
 {
 	const enum rtw89_sar_sources src = rtwdev->sar.src;
 	/* its members are protected by rtw89_sar_set_src() */
 	const struct rtw89_sar_handler *sar_hdl = &rtw89_sar_handlers[src];
+	struct rtw89_tas_info *tas = &rtwdev->tas;
+	s8 delta;
 	int ret;
 	s32 cfg;
 	u8 fct;
@@ -171,16 +200,29 @@
 	if (src == RTW89_SAR_SOURCE_NONE)
 		return RTW89_SAR_TXPWR_MAC_MAX;
 
-	ret = sar_hdl->query_sar_config(rtwdev, &cfg);
+	ret = sar_hdl->query_sar_config(rtwdev, center_freq, &cfg);
 	if (ret)
 		return RTW89_SAR_TXPWR_MAC_MAX;
 
+	if (tas->enable) {
+		switch (tas->state) {
+		case RTW89_TAS_STATE_DPR_OFF:
+			return RTW89_SAR_TXPWR_MAC_MAX;
+		case RTW89_TAS_STATE_DPR_ON:
+			delta = rtw89_txpwr_tas_to_sar(sar_hdl, tas->delta);
+			cfg -= delta;
+		case RTW89_TAS_STATE_DPR_FORBID:
+		default:
+			break;
+		}
+	}
+
 	fct = sar_hdl->txpwr_factor_sar;
 
 	return rtw89_txpwr_sar_to_mac(rtwdev, fct, cfg);
 }
 
-void rtw89_print_sar(struct seq_file *m, struct rtw89_dev *rtwdev)
+void rtw89_print_sar(struct seq_file *m, struct rtw89_dev *rtwdev, u32 center_freq)
 {
 	const enum rtw89_sar_sources src = rtwdev->sar.src;
 	/* its members are protected by rtw89_sar_set_src() */
@@ -199,7 +241,7 @@
 
 	seq_printf(m, "source: %d (%s)\n", src, sar_hdl->descr_sar_source);
 
-	ret = sar_hdl->query_sar_config(rtwdev, &cfg);
+	ret = sar_hdl->query_sar_config(rtwdev, center_freq, &cfg);
 	if (ret) {
 		seq_printf(m, "config: return code: %d\n", ret);
 		seq_printf(m, "assign: max setting: %d (unit: 1/%lu dBm)\n",
@@ -212,6 +254,19 @@
 	seq_printf(m, "config: %d (unit: 1/%lu dBm)\n", cfg, BIT(fct));
 }
 
+void rtw89_print_tas(struct seq_file *m, struct rtw89_dev *rtwdev)
+{
+	struct rtw89_tas_info *tas = &rtwdev->tas;
+
+	if (!tas->enable) {
+		seq_puts(m, "no TAS is applied\n");
+		return;
+	}
+
+	seq_printf(m, "DPR gap: %d\n", tas->dpr_gap);
+	seq_printf(m, "TAS delta: %d\n", tas->delta);
+}
+
 static int rtw89_apply_sar_common(struct rtw89_dev *rtwdev,
 				  const struct rtw89_sar_cfg_common *sar)
 {
@@ -292,3 +347,147 @@
 
 	return rtw89_apply_sar_common(rtwdev, &sar_common);
 }
+
+static void rtw89_tas_state_update(struct rtw89_dev *rtwdev)
+{
+	const enum rtw89_sar_sources src = rtwdev->sar.src;
+	/* its members are protected by rtw89_sar_set_src() */
+	const struct rtw89_sar_handler *sar_hdl = &rtw89_sar_handlers[src];
+	struct rtw89_tas_info *tas = &rtwdev->tas;
+	s32 txpwr_avg = tas->total_txpwr / RTW89_TAS_MAX_WINDOW / PERCENT;
+	s32 dpr_on_threshold, dpr_off_threshold, cfg;
+	enum rtw89_tas_state state = tas->state;
+	const struct rtw89_chan *chan;
+	int ret;
+
+	lockdep_assert_held(&rtwdev->mutex);
+
+	if (src == RTW89_SAR_SOURCE_NONE)
+		return;
+
+	chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
+	ret = sar_hdl->query_sar_config(rtwdev, chan->freq, &cfg);
+	if (ret)
+		return;
+
+	cfg = rtw89_txpwr_sar_to_tas(sar_hdl, cfg);
+
+	if (tas->delta >= cfg) {
+		rtw89_debug(rtwdev, RTW89_DBG_SAR,
+			    "TAS delta exceed SAR limit\n");
+		state = RTW89_TAS_STATE_DPR_FORBID;
+		goto out;
+	}
+
+	dpr_on_threshold = cfg;
+	dpr_off_threshold = cfg - tas->dpr_gap;
+	rtw89_debug(rtwdev, RTW89_DBG_SAR,
+		    "DPR_ON thold: %d, DPR_OFF thold: %d, txpwr_avg: %d\n",
+		    dpr_on_threshold, dpr_off_threshold, txpwr_avg);
+
+	if (txpwr_avg >= dpr_on_threshold)
+		state = RTW89_TAS_STATE_DPR_ON;
+	else if (txpwr_avg < dpr_off_threshold)
+		state = RTW89_TAS_STATE_DPR_OFF;
+
+out:
+	if (tas->state == state)
+		return;
+
+	rtw89_debug(rtwdev, RTW89_DBG_SAR,
+		    "TAS old state: %d, new state: %d\n", tas->state, state);
+	tas->state = state;
+	rtw89_core_set_chip_txpwr(rtwdev);
+}
+
+void rtw89_tas_init(struct rtw89_dev *rtwdev)
+{
+	struct rtw89_tas_info *tas = &rtwdev->tas;
+	struct rtw89_acpi_dsm_result res = {};
+	int ret;
+	u8 val;
+
+	ret = rtw89_acpi_evaluate_dsm(rtwdev, RTW89_ACPI_DSM_FUNC_TAS_EN, &res);
+	if (ret) {
+		rtw89_debug(rtwdev, RTW89_DBG_SAR,
+			    "acpi: cannot get TAS: %d\n", ret);
+		return;
+	}
+
+	val = res.u.value;
+	switch (val) {
+	case 0:
+		tas->enable = false;
+		break;
+	case 1:
+		tas->enable = true;
+		break;
+	default:
+		break;
+	}
+
+	if (!tas->enable) {
+		rtw89_debug(rtwdev, RTW89_DBG_SAR, "TAS not enable\n");
+		return;
+	}
+
+	tas->dpr_gap = RTW89_TAS_DPR_GAP;
+	tas->delta = RTW89_TAS_DELTA;
+}
+
+void rtw89_tas_reset(struct rtw89_dev *rtwdev)
+{
+	struct rtw89_tas_info *tas = &rtwdev->tas;
+
+	if (!tas->enable)
+		return;
+
+	memset(&tas->txpwr_history, 0, sizeof(tas->txpwr_history));
+	tas->total_txpwr = 0;
+	tas->cur_idx = 0;
+	tas->state = RTW89_TAS_STATE_DPR_OFF;
+}
+
+static const struct rtw89_reg_def txpwr_regs[] = {
+	{R_PATH0_TXPWR, B_PATH0_TXPWR},
+	{R_PATH1_TXPWR, B_PATH1_TXPWR},
+};
+
+void rtw89_tas_track(struct rtw89_dev *rtwdev)
+{
+	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
+	const enum rtw89_sar_sources src = rtwdev->sar.src;
+	u8 max_nss_num = rtwdev->chip->rf_path_num;
+	struct rtw89_tas_info *tas = &rtwdev->tas;
+	s16 tmp, txpwr, instant_txpwr = 0;
+	u32 val;
+	int i;
+
+	if (!tas->enable || src == RTW89_SAR_SOURCE_NONE)
+		return;
+
+	if (env->ccx_watchdog_result != RTW89_PHY_ENV_MON_IFS_CLM)
+		return;
+
+	for (i = 0; i < max_nss_num; i++) {
+		val = rtw89_phy_read32_mask(rtwdev, txpwr_regs[i].addr,
+					    txpwr_regs[i].mask);
+		tmp = sign_extend32(val, 8);
+		if (tmp <= 0)
+			return;
+		instant_txpwr += tmp;
+	}
+
+	instant_txpwr /= max_nss_num;
+	/* in unit of 0.25 dBm multiply by percentage */
+	txpwr = instant_txpwr * env->ifs_clm_tx_ratio;
+	tas->total_txpwr += txpwr - tas->txpwr_history[tas->cur_idx];
+	tas->txpwr_history[tas->cur_idx] = txpwr;
+	rtw89_debug(rtwdev, RTW89_DBG_SAR,
+		    "instant_txpwr: %d, tx_ratio: %d, txpwr: %d\n",
+		    instant_txpwr, env->ifs_clm_tx_ratio, txpwr);
+
+	tas->cur_idx = (tas->cur_idx + 1) % RTW89_TAS_MAX_WINDOW;
+
+	rtw89_tas_state_update(rtwdev);
+}
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/drivers/net/wireless/realtek/rtw89/sar.h
+++ linux-oem-6.5-6.5.0/drivers/net/wireless/realtek/rtw89/sar.h
@@ -13,14 +13,18 @@
 struct rtw89_sar_handler {
 	const char *descr_sar_source;
 	u8 txpwr_factor_sar;
-	int (*query_sar_config)(struct rtw89_dev *rtwdev, s32 *cfg);
+	int (*query_sar_config)(struct rtw89_dev *rtwdev, u32 center_freq, s32 *cfg);
 };
 
 extern const struct cfg80211_sar_capa rtw89_sar_capa;
 
-s8 rtw89_query_sar(struct rtw89_dev *rtwdev);
-void rtw89_print_sar(struct seq_file *m, struct rtw89_dev *rtwdev);
+s8 rtw89_query_sar(struct rtw89_dev *rtwdev, u32 center_freq);
+void rtw89_print_sar(struct seq_file *m, struct rtw89_dev *rtwdev, u32 center_freq);
+void rtw89_print_tas(struct seq_file *m, struct rtw89_dev *rtwdev);
 int rtw89_ops_set_sar_specs(struct ieee80211_hw *hw,
 			    const struct cfg80211_sar_specs *sar);
+void rtw89_tas_init(struct rtw89_dev *rtwdev);
+void rtw89_tas_reset(struct rtw89_dev *rtwdev);
+void rtw89_tas_track(struct rtw89_dev *rtwdev);
 
 #endif
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/fs/smb/client/misc.c
+++ linux-oem-6.5-6.5.0/fs/smb/client/misc.c
@@ -359,6 +359,10 @@
 			cifs_dbg(VFS, "Length less than smb header size\n");
 		}
 		return -EIO;
+	} else if (total_read < sizeof(*smb) + 2 * smb->WordCount) {
+		cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n",
+			 __func__, smb->WordCount);
+		return -EIO;
 	}
 
 	/* otherwise, there is enough to get to the BCC */
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/include/drm/drm_file.h
+++ linux-oem-6.5-6.5.0/include/drm/drm_file.h
@@ -256,8 +256,15 @@
 	/** @master_lookup_lock: Serializes @master. */
 	spinlock_t master_lookup_lock;
 
-	/** @pid: Process that opened this file. */
-	struct pid *pid;
+	/**
+	 * @pid: Process that is using this file.
+	 *
+	 * Must only be dereferenced under a rcu_read_lock or equivalent.
+	 *
+	 * Updates are guarded with dev->filelist_mutex and reference must be
+	 * dropped after a RCU grace period to accommodate lockless readers.
+	 */
+	struct pid __rcu *pid;
 
 	/** @client_id: A unique id for fdinfo */
 	u64 client_id;
@@ -420,6 +427,8 @@
 	return file_priv->minor->type == DRM_MINOR_ACCEL;
 }
 
+void drm_file_update_pid(struct drm_file *);
+
 int drm_open(struct inode *inode, struct file *filp);
 int drm_open_helper(struct file *filp, struct drm_minor *minor);
 ssize_t drm_read(struct file *filp, char __user *buffer,
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/include/drm/i915_pciids.h
+++ linux-oem-6.5-6.5.0/include/drm/i915_pciids.h
@@ -689,14 +689,18 @@
 #define INTEL_RPLU_IDS(info) \
 	INTEL_VGA_DEVICE(0xA721, info), \
 	INTEL_VGA_DEVICE(0xA7A1, info), \
-	INTEL_VGA_DEVICE(0xA7A9, info)
+	INTEL_VGA_DEVICE(0xA7A9, info), \
+	INTEL_VGA_DEVICE(0xA7AC, info), \
+	INTEL_VGA_DEVICE(0xA7AD, info)
 
 /* RPL-P */
 #define INTEL_RPLP_IDS(info) \
 	INTEL_RPLU_IDS(info), \
 	INTEL_VGA_DEVICE(0xA720, info), \
 	INTEL_VGA_DEVICE(0xA7A0, info), \
-	INTEL_VGA_DEVICE(0xA7A8, info)
+	INTEL_VGA_DEVICE(0xA7A8, info), \
+	INTEL_VGA_DEVICE(0xA7AA, info), \
+	INTEL_VGA_DEVICE(0xA7AB, info)
 
 /* DG2 */
 #define INTEL_DG2_G10_IDS(info) \
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/net/netfilter/nft_set_pipapo.c
+++ linux-oem-6.5-6.5.0/net/netfilter/nft_set_pipapo.c
@@ -2041,6 +2041,9 @@
 
 		e = f->mt[r].e;
 
+		if (!nft_set_elem_active(&e->ext, iter->genmask))
+			goto cont;
+
 		elem.priv = e;
 
 		iter->err = iter->fn(ctx, set, iter, &elem);
only in patch2:
unchanged:
--- linux-oem-6.5-6.5.0.orig/sound/hda/intel-nhlt.c
+++ linux-oem-6.5-6.5.0/sound/hda/intel-nhlt.c
@@ -238,7 +238,7 @@
 
 static struct nhlt_specific_cfg *
 nhlt_get_specific_cfg(struct device *dev, struct nhlt_fmt *fmt, u8 num_ch,
-		      u32 rate, u8 vbps, u8 bps)
+		      u32 rate, u8 vbps, u8 bps, bool ignore_vbps)
 {
 	struct nhlt_fmt_cfg *cfg = fmt->fmt_config;
 	struct wav_fmt *wfmt;
@@ -255,8 +255,12 @@
 		dev_dbg(dev, "Endpoint format: ch=%d fmt=%d/%d rate=%d\n",
 			wfmt->channels, _vbps, _bps, wfmt->samples_per_sec);
 
+		/*
+		 * When looking for exact match of configuration ignore the vbps
+		 * from NHLT table when ignore_vbps is true
+		 */
 		if (wfmt->channels == num_ch && wfmt->samples_per_sec == rate &&
-		    vbps == _vbps && bps == _bps)
+		    (ignore_vbps || vbps == _vbps) && bps == _bps)
 			return &cfg->config;
 
 		cfg = (struct nhlt_fmt_cfg *)(cfg->config.caps + cfg->config.size);
@@ -289,6 +293,7 @@
 {
 	struct nhlt_specific_cfg *cfg;
 	struct nhlt_endpoint *epnt;
+	bool ignore_vbps = false;
 	struct nhlt_fmt *fmt;
 	int i;
 
@@ -298,7 +303,26 @@
 	dev_dbg(dev, "Looking for configuration:\n");
 	dev_dbg(dev, "  vbus_id=%d link_type=%d dir=%d, dev_type=%d\n",
 		bus_id, link_type, dir, dev_type);
-	dev_dbg(dev, "  ch=%d fmt=%d/%d rate=%d\n", num_ch, vbps, bps, rate);
+	if (link_type == NHLT_LINK_DMIC && bps == 32 && (vbps == 24 || vbps == 32)) {
+		/*
+		 * The DMIC hardware supports only one type of 32 bits sample
+		 * size, which is 24 bit sampling on the MSB side and bits[1:0]
+		 * are used for indicating the channel number.
+		 * It has been observed that some NHLT tables have the vbps
+		 * specified as 32 while some uses 24.
+		 * The format these variations describe are identical, the
+		 * hardware is configured and behaves the same way.
+		 * Note: when the samples assumed to be vbps=32 then the 'noise'
+		 * introduced by the lower two bits (channel number) have no
+		 * real life implication on audio quality.
+		 */
+		dev_dbg(dev,
+			"  ch=%d fmt=%d rate=%d (vbps is ignored for DMIC 32bit format)\n",
+			num_ch, bps, rate);
+		ignore_vbps = true;
+	} else {
+		dev_dbg(dev, "  ch=%d fmt=%d/%d rate=%d\n", num_ch, vbps, bps, rate);
+	}
 	dev_dbg(dev, "Endpoint count=%d\n", nhlt->endpoint_count);
 
 	epnt = (struct nhlt_endpoint *)nhlt->desc;
@@ -307,7 +331,8 @@
 		if (nhlt_check_ep_match(dev, epnt, bus_id, link_type, dir, dev_type)) {
 			fmt = (struct nhlt_fmt *)(epnt->config.caps + epnt->config.size);
 
-			cfg = nhlt_get_specific_cfg(dev, fmt, num_ch, rate, vbps, bps);
+			cfg = nhlt_get_specific_cfg(dev, fmt, num_ch, rate,
+						    vbps, bps, ignore_vbps);
 			if (cfg)
 				return cfg;
 		}