--- /dev/null
+From 1e7bbdba68baf6af7500dd636f18b6fcce58e945 Mon Sep 17 00:00:00 2001
+From: Jack Xiao <Jack.Xiao@amd.com>
+Date: Tue, 29 Nov 2022 11:12:08 +0800
+Subject: drm/amd/amdgpu: update mes11 api def
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+commit 1e7bbdba68baf6af7500dd636f18b6fcce58e945 upstream.
+
+Update the api def of mes11.
+
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Tested-and-acked-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: "Gong, Richard" <richard.gong@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/include/mes_v11_api_def.h | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/include/mes_v11_api_def.h
++++ b/drivers/gpu/drm/amd/include/mes_v11_api_def.h
+@@ -222,7 +222,11 @@ union MESAPI_SET_HW_RESOURCES {
+ uint32_t apply_grbm_remote_register_dummy_read_wa : 1;
+ uint32_t second_gfx_pipe_enabled : 1;
+ uint32_t enable_level_process_quantum_check : 1;
+- uint32_t reserved : 25;
++ uint32_t legacy_sch_mode : 1;
++ uint32_t disable_add_queue_wptr_mc_addr : 1;
++ uint32_t enable_mes_event_int_logging : 1;
++ uint32_t enable_reg_active_poll : 1;
++ uint32_t reserved : 21;
+ };
+ uint32_t uint32_t_all;
+ };
--- /dev/null
+From a6b3b618c0f7abc3f543dd0c57b2b19a770bffec Mon Sep 17 00:00:00 2001
+From: Jack Xiao <Jack.Xiao@amd.com>
+Date: Tue, 29 Nov 2022 11:12:32 +0800
+Subject: drm/amdgpu/mes11: enable reg active poll
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+commit a6b3b618c0f7abc3f543dd0c57b2b19a770bffec upstream.
+
+Enable reg active poll in mes11.
+
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Tested-and-acked-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: "Gong, Richard" <richard.gong@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c
+@@ -390,6 +390,7 @@ static int mes_v11_0_set_hw_resources(st
+ mes_set_hw_res_pkt.disable_reset = 1;
+ mes_set_hw_res_pkt.disable_mes_log = 1;
+ mes_set_hw_res_pkt.use_different_vmid_compute = 1;
++ mes_set_hw_res_pkt.enable_reg_active_poll = 1;
+ mes_set_hw_res_pkt.oversubscription_timer = 50;
+
+ return mes_v11_0_submit_pkt_and_poll_completion(mes,
--- /dev/null
+From 12d6c1d3a2ad0c199ec57c201cdc71e8e157a232 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Tue, 25 Oct 2022 15:39:35 -0700
+Subject: skbuff: Proactively round up to kmalloc bucket size
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 12d6c1d3a2ad0c199ec57c201cdc71e8e157a232 upstream.
+
+Instead of discovering the kmalloc bucket size _after_ allocation, round
+up proactively so the allocation is explicitly made for the full size,
+allowing the compiler to correctly reason about the resulting size of
+the buffer through the existing __alloc_size() hint.
+
+This will allow for kernels built with CONFIG_UBSAN_BOUNDS or the
+coming dynamic bounds checking under CONFIG_FORTIFY_SOURCE to gain
+back the __alloc_size() hints that were temporarily reverted in commit
+93dd04ab0b2b ("slab: remove __alloc_size attribute from __kmalloc_track_caller")
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: netdev@vger.kernel.org
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: David Rientjes <rientjes@google.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Link: https://patchwork.kernel.org/project/netdevbpf/patch/20221021234713.you.031-kees@kernel.org/
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20221025223811.up.360-kees@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Cc: Daniel Díaz <daniel.diaz@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/skbuff.c | 52 ++++++++++++++++++++++++++--------------------------
+ 1 file changed, 26 insertions(+), 26 deletions(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -506,14 +506,14 @@ struct sk_buff *__alloc_skb(unsigned int
+ */
+ size = SKB_DATA_ALIGN(size);
+ size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+- data = kmalloc_reserve(size, gfp_mask, node, &pfmemalloc);
++ osize = kmalloc_size_roundup(size);
++ data = kmalloc_reserve(osize, gfp_mask, node, &pfmemalloc);
+ if (unlikely(!data))
+ goto nodata;
+- /* kmalloc(size) might give us more room than requested.
++ /* kmalloc_size_roundup() might give us more room than requested.
+ * Put skb_shared_info exactly at the end of allocated zone,
+ * to allow max possible filling before reallocation.
+ */
+- osize = ksize(data);
+ size = SKB_WITH_OVERHEAD(osize);
+ prefetchw(data + size);
+
+@@ -1822,10 +1822,11 @@ EXPORT_SYMBOL(__pskb_copy_fclone);
+ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
+ gfp_t gfp_mask)
+ {
+- int i, osize = skb_end_offset(skb);
+- int size = osize + nhead + ntail;
++ unsigned int osize = skb_end_offset(skb);
++ unsigned int size = osize + nhead + ntail;
+ long off;
+ u8 *data;
++ int i;
+
+ BUG_ON(nhead < 0);
+
+@@ -1833,15 +1834,16 @@ int pskb_expand_head(struct sk_buff *skb
+
+ skb_zcopy_downgrade_managed(skb);
+
+- size = SKB_DATA_ALIGN(size);
+-
+ if (skb_pfmemalloc(skb))
+ gfp_mask |= __GFP_MEMALLOC;
+- data = kmalloc_reserve(size + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),
+- gfp_mask, NUMA_NO_NODE, NULL);
++
++ size = SKB_DATA_ALIGN(size);
++ size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++ size = kmalloc_size_roundup(size);
++ data = kmalloc_reserve(size, gfp_mask, NUMA_NO_NODE, NULL);
+ if (!data)
+ goto nodata;
+- size = SKB_WITH_OVERHEAD(ksize(data));
++ size = SKB_WITH_OVERHEAD(size);
+
+ /* Copy only real data... and, alas, header. This should be
+ * optimized for the cases when header is void.
+@@ -6182,21 +6184,20 @@ static int pskb_carve_inside_header(stru
+ const int headlen, gfp_t gfp_mask)
+ {
+ int i;
+- int size = skb_end_offset(skb);
++ unsigned int size = skb_end_offset(skb);
+ int new_hlen = headlen - off;
+ u8 *data;
+
+- size = SKB_DATA_ALIGN(size);
+-
+ if (skb_pfmemalloc(skb))
+ gfp_mask |= __GFP_MEMALLOC;
+- data = kmalloc_reserve(size +
+- SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),
+- gfp_mask, NUMA_NO_NODE, NULL);
++
++ size = SKB_DATA_ALIGN(size);
++ size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++ size = kmalloc_size_roundup(size);
++ data = kmalloc_reserve(size, gfp_mask, NUMA_NO_NODE, NULL);
+ if (!data)
+ return -ENOMEM;
+-
+- size = SKB_WITH_OVERHEAD(ksize(data));
++ size = SKB_WITH_OVERHEAD(size);
+
+ /* Copy real data, and all frags */
+ skb_copy_from_linear_data_offset(skb, off, data, new_hlen);
+@@ -6301,22 +6302,21 @@ static int pskb_carve_inside_nonlinear(s
+ int pos, gfp_t gfp_mask)
+ {
+ int i, k = 0;
+- int size = skb_end_offset(skb);
++ unsigned int size = skb_end_offset(skb);
+ u8 *data;
+ const int nfrags = skb_shinfo(skb)->nr_frags;
+ struct skb_shared_info *shinfo;
+
+- size = SKB_DATA_ALIGN(size);
+-
+ if (skb_pfmemalloc(skb))
+ gfp_mask |= __GFP_MEMALLOC;
+- data = kmalloc_reserve(size +
+- SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),
+- gfp_mask, NUMA_NO_NODE, NULL);
++
++ size = SKB_DATA_ALIGN(size);
++ size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++ size = kmalloc_size_roundup(size);
++ data = kmalloc_reserve(size, gfp_mask, NUMA_NO_NODE, NULL);
+ if (!data)
+ return -ENOMEM;
+-
+- size = SKB_WITH_OVERHEAD(ksize(data));
++ size = SKB_WITH_OVERHEAD(size);
+
+ memcpy((struct skb_shared_info *)(data + size),
+ skb_shinfo(skb), offsetof(struct skb_shared_info, frags[0]));