diff --git a/Makefile.rhelver b/Makefile.rhelver
index 0b1fd1d..6e23c69 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 2
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 223
+RHEL_RELEASE = 224
 
 #
 # ZSTREAM
@@ -66,4 +66,4 @@ ifneq ("$(ZSTREAM)", "yes")
   endif
 endif
 
-RTBUILD:=.224
+RTBUILD:=.225
diff --git a/kernel-rt-x86_64-debug-rhel.config b/kernel-rt-x86_64-debug-rhel.config
index 484a16d..501b6a8 100644
--- a/kernel-rt-x86_64-debug-rhel.config
+++ b/kernel-rt-x86_64-debug-rhel.config
@@ -1045,6 +1045,7 @@ CONFIG_DEBUG_LOCK_ALLOC=y
 # CONFIG_DEBUG_MEMORY_INIT is not set
 CONFIG_DEBUG_MISC=y
 CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_NET=y
 # CONFIG_DEBUG_NMI_SELFTEST is not set
 CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
diff --git a/kernel-rt-x86_64-rhel.config b/kernel-rt-x86_64-rhel.config
index 7ecff93..10220c1 100644
--- a/kernel-rt-x86_64-rhel.config
+++ b/kernel-rt-x86_64-rhel.config
@@ -1044,6 +1044,7 @@ CONFIG_DEBUG_LIST=y
 # CONFIG_DEBUG_MEMORY_INIT is not set
 CONFIG_DEBUG_MISC=y
 # CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_NET is not set
 # CONFIG_DEBUG_NMI_SELFTEST is not set
 # CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_DEBUG_OBJECTS is not set
diff --git a/kernel.spec b/kernel.spec
index 7800c46..84be5df 100755
--- a/kernel.spec
+++ b/kernel.spec
@@ -119,15 +119,15 @@ Summary: The Linux kernel
 # define buildid .local
 %define specversion 5.14.0
 %define patchversion 5.14
-%define pkgrelease 223.rt14.224
+%define pkgrelease 224.rt14.225
 %define kversion 5
-%define tarfile_release 5.14.0-223.rt14.224.el9
+%define tarfile_release 5.14.0-224.rt14.225.el9
 # This is needed to do merge window version magic
 %define patchlevel 14
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 223.rt14.224%{?buildid}%{?dist}
+%define specrelease 224.rt14.225%{?buildid}%{?dist}
 # This defines the kabi tarball version
-%define kabiversion 5.14.0-223.rt14.224.el9
+%define kabiversion 5.14.0-224.rt14.225.el9
 
 #
 # End of genspec.sh variables
@@ -3240,6 +3240,115 @@ fi
 #
 #
 %changelog
+* Fri Dec 23 2022 Luis Claudio R. Goncalves <lgoncalv@redhat.com> [5.14.0-224.rt14.225.el9]
+- [rt] build kernel-rt-5.14.0-224.rt14.225.el9 [2125474]
+- tls: strp: make sure the TCP skbs do not have overlapping data (Sabrina Dubroca) [2143700]
+- selftests: tls: handful of memrnd() and length checks (Sabrina Dubroca) [2143700]
+- selftests: tls: add a test for timeo vs lock (Sabrina Dubroca) [2143700]
+- selftests: tls: add test for NoPad getsockopt (Sabrina Dubroca) [2143700]
+- selftests: tls: add selftest variant for pad (Sabrina Dubroca) [2143700]
+- selftests: tls: skip cmsg_to_pipe tests with TLS=n (Sabrina Dubroca) [2143700]
+- selftests: tls: test for correct proto_ops (Sabrina Dubroca) [2143700]
+- selftests: tls: test splicing decrypted records (Sabrina Dubroca) [2143700]
+- selftests: tls: test splicing cmsgs (Sabrina Dubroca) [2143700]
+- tls: rx: react to strparser initialization errors (Sabrina Dubroca) [2143700]
+- net/tls: Use RCU API to access tls_ctx->netdev (Sabrina Dubroca) [2143700]
+- tls: rx: device: don't try to copy too much on detach (Sabrina Dubroca) [2143700]
+- tls: rx: device: bound the frag walk (Sabrina Dubroca) [2143700]
+- net/tls: Remove redundant workqueue flush before destroy (Sabrina Dubroca) [2143700]
+- net/tls: Multi-threaded calls to TX tls_dev_del (Sabrina Dubroca) [2143700]
+- net/tls: Perform immediate device ctx cleanup when possible (Sabrina Dubroca) [2143700]
+- tls: rx: fix the false positive warning (Sabrina Dubroca) [2143700]
+- tls: strp: rename and multithread the workqueue (Sabrina Dubroca) [2143700]
+- tls: rx: don't consider sock_rcvtimeo() cumulative (Sabrina Dubroca) [2143700]
+- tls: rx: Fix unsigned comparison with less than zero (Sabrina Dubroca) [2143700]
+- tls: rx: do not use the standard strparser (Sabrina Dubroca) [2143700]
+- tls: rx: device: add input CoW helper (Sabrina Dubroca) [2143700]
+- tcp: allow tls to decrypt directly from the tcp rcv queue (Sabrina Dubroca) [2143700]
+- tcp: avoid indirect calls to sock_rfree (Sabrina Dubroca) [2143700]
+- tls: rx: device: keep the zero copy status with offload (Sabrina Dubroca) [2143700]
+- tls: rx: don't free the output in case of zero-copy (Sabrina Dubroca) [2143700]
+- redhat/configs: enable CONFIG_DEBUG_NET for debug kernel (Sabrina Dubroca) [2143700]
+- net: add CONFIG_DEBUG_NET (Sabrina Dubroca) [2143700]
+- net: add include/net/net_debug.h (Sabrina Dubroca) [2143700]
+- tls: rx: factor SW handling out of tls_rx_one_record() (Sabrina Dubroca) [2143700]
+- tls: rx: wrap recv_pkt accesses in helpers (Sabrina Dubroca) [2143700]
+- net/tls: Remove the context from the list in tls_device_down (Sabrina Dubroca) [2143700]
+- tls: rx: release the sock lock on locking timeout (Sabrina Dubroca) [2143700]
+- tls: rx: decrypt into a fresh skb (Sabrina Dubroca) [2143700]
+- tls: rx: async: don't put async zc on the list (Sabrina Dubroca) [2143700]
+- tls: rx: async: hold onto the input skb (Sabrina Dubroca) [2143700]
+- tls: rx: async: adjust record geometry immediately (Sabrina Dubroca) [2143700]
+- tls: rx: return the decrypted skb via darg (Sabrina Dubroca) [2143700]
+- tls: rx: read the input skb from ctx->recv_pkt (Sabrina Dubroca) [2143700]
+- tls: rx: factor out device darg update (Sabrina Dubroca) [2143700]
+- tls: rx: remove the message decrypted tracking (Sabrina Dubroca) [2143700]
+- tls: rx: don't keep decrypted skbs on ctx->recv_pkt (Sabrina Dubroca) [2143700]
+- tls: rx: don't try to keep the skbs always on the list (Sabrina Dubroca) [2143700]
+- tls: rx: allow only one reader at a time (Sabrina Dubroca) [2143700]
+- net/tls: Fix race in TLS device down flow (Sabrina Dubroca) [2143700]
+- net/tls: Check for errors in tls_device_init (Sabrina Dubroca) [2143700]
+- tls: rx: fix the NoPad getsockopt (Sabrina Dubroca) [2143700]
+- tls: rx: add counter for NoPad violations (Sabrina Dubroca) [2143700]
+- tls: fix spelling of MIB (Sabrina Dubroca) [2143700]
+- tls: rx: make tls_wait_data() return an recvmsg retcode (Sabrina Dubroca) [2143700]
+- tls: create an internal header (Sabrina Dubroca) [2143700]
+- tls: rx: coalesce exit paths in tls_decrypt_sg() (Sabrina Dubroca) [2143700]
+- tls: rx: wrap decrypt params in a struct (Sabrina Dubroca) [2143700]
+- tls: rx: always allocate max possible aad size for decrypt (Sabrina Dubroca) [2143700]
+- strparser: pad sk_skb_cb to avoid straddling cachelines (Sabrina Dubroca) [2143700]
+- tls: rx: periodically flush socket backlog (Sabrina Dubroca) [2143700]
+- tls: rx: add sockopt for enabling optimistic decrypt with TLS 1.3 (Sabrina Dubroca) [2143700]
+- docs: tls: document the TLS_TX_ZEROCOPY_RO (Sabrina Dubroca) [2143700]
+- tls: rx: support optimistic decrypt to user buffer with TLS 1.3 (Sabrina Dubroca) [2143700]
+- tls: rx: don't include tail size in data_len (Sabrina Dubroca) [2143700]
+- Revert "tls: rx: move counting TlsDecryptErrors for sync" (Sabrina Dubroca) [2143700]
+- tls: Rename TLS_INFO_ZC_SENDFILE to TLS_INFO_ZC_TX (Sabrina Dubroca) [2143700]
+- net: tls: fix messing up lists when bpf enabled (Sabrina Dubroca) [2143700]
+- tls: Add opt-in zerocopy mode of sendfile() (Sabrina Dubroca) [2143700]
+- tls: Fix context leak on tls_device_down (Sabrina Dubroca) [2143700]
+- tls: Skip tls_append_frag on zero copy size (Sabrina Dubroca) [2143700]
+- net: tls: fix async vs NIC crypto offload (Sabrina Dubroca) [2143700]
+- tls: rx: only copy IV from the packet for TLS 1.2 (Sabrina Dubroca) [2143700]
+- tls: rx: use MAX_IV_SIZE for allocations (Sabrina Dubroca) [2143700]
+- tls: rx: use async as an in-out argument (Sabrina Dubroca) [2143700]
+- tls: rx: return the already-copied data on crypto error (Sabrina Dubroca) [2143700]
+- tls: rx: treat process_rx_list() errors as transient (Sabrina Dubroca) [2143700]
+- tls: rx: assume crypto always calls our callback (Sabrina Dubroca) [2143700]
+- tls: rx: don't handle TLS 1.3 in the async crypto callback (Sabrina Dubroca) [2143700]
+- tls: rx: move counting TlsDecryptErrors for sync (Sabrina Dubroca) [2143700]
+- tls: rx: reuse leave_on_list label for psock (Sabrina Dubroca) [2143700]
+- tls: rx: consistently use unlocked accessors for rx_list (Sabrina Dubroca) [2143700]
+- tls: rx: jump out for cases which need to leave skb on list (Sabrina Dubroca) [2143700]
+- tls: rx: clear ctx->recv_pkt earlier (Sabrina Dubroca) [2143700]
+- tls: rx: inline consuming the skb at the end of the loop (Sabrina Dubroca) [2143700]
+- tls: rx: pull most of zc check out of the loop (Sabrina Dubroca) [2143700]
+- tls: rx: don't track the async count (Sabrina Dubroca) [2143700]
+- tls: rx: don't handle async in tls_sw_advance_skb() (Sabrina Dubroca) [2143700]
+- tls: rx: factor out writing ContentType to cmsg (Sabrina Dubroca) [2143700]
+- tls: rx: simplify async wait (Sabrina Dubroca) [2143700]
+- tls: rx: wrap decryption arguments in a structure (Sabrina Dubroca) [2143700]
+- tls: rx: don't report text length from the bowels of decrypt (Sabrina Dubroca) [2143700]
+- tls: rx: drop unnecessary arguments from tls_setup_from_iter() (Sabrina Dubroca) [2143700]
+- tls: hw: rx: use return value of tls_device_decrypted() to carry status (Sabrina Dubroca) [2143700]
+- tls: rx: refactor decrypt_skb_update() (Sabrina Dubroca) [2143700]
+- tls: rx: don't issue wake ups when data is decrypted (Sabrina Dubroca) [2143700]
+- tls: rx: replace 'back' with 'offset' (Sabrina Dubroca) [2143700]
+- tls: rx: use a define for tag length (Sabrina Dubroca) [2143700]
+- tls: rx: init decrypted status in tls_read_size() (Sabrina Dubroca) [2143700]
+- tls: rx: don't store the decryption status in socket context (Sabrina Dubroca) [2143700]
+- tls: rx: don't store the record type in socket context (Sabrina Dubroca) [2143700]
+- tls: rx: drop pointless else after goto (Sabrina Dubroca) [2143700]
+- tls: rx: jump to a more appropriate label (Sabrina Dubroca) [2143700]
+- net/tls: optimize judgement processes in tls_set_device_offload() (Sabrina Dubroca) [2143700]
+- net/tls: remove unnecessary jump instructions in do_tls_setsockopt_conf() (Sabrina Dubroca) [2143700]
+- net/tls: Provide {__,}tls_driver_ctx() unconditionally (Sabrina Dubroca) [2143700]
+- net/tls: simplify the tls_set_sw_offload function (Sabrina Dubroca) [2143700]
+- net/tls: getsockopt supports complete algorithm list (Sabrina Dubroca) [2143700]
+- net/tls: tls_crypto_context add supported algorithms context (Sabrina Dubroca) [2143700]
+- net/tls: support SM4 CCM algorithm (Sabrina Dubroca) [2143700]
+- net/tls: support SM4 GCM/CCM algorithm (Sabrina Dubroca) [2143700]
+
 * Thu Dec 22 2022 Luis Claudio R. Goncalves <lgoncalv@redhat.com> [5.14.0-223.rt14.224.el9]
 - [rt] build kernel-rt-5.14.0-223.rt14.224.el9 [2125474]
 - pwm: tegra: Ensure the clock rate is not less than needed (d.marlin) [2141743]
diff --git a/sources b/sources
index 8f57fa4..5d4b0ef 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
 SHA512 (kernel-abi-whitelists-5.13.0-1.tar.bz2) = ceba454e1f590c1e4ef4115a75463ae3ac2c2aa7ec85fa14a2669d666c421483a38225ee19d7d72b4ac7032375741408b23543e43588538c80161ec0cf57051c
-SHA512 (linux-5.14.0-223.rt14.224.el9.tar.xz) = 32bf723300ef341b36d83aa535e963a9c76079fd264a2c323a1dc895a1fa734d3aee90206f9888649ae0f5509300864c65f0e1de739e59077f8b6153ff009458
-SHA512 (kernel-abi-stablelists-5.14.0-223.rt14.224.el9.tar.bz2) = ca85b3c991de507448497e281cc747774c9cceeb2bf8cafc47026e00d61f3205b95951cd1e2d9c7451930a011d8fa4ce0f53abef58513f45329c5c9fabe1b14c
-SHA512 (kernel-kabi-dw-5.14.0-223.rt14.224.el9.tar.bz2) = 565f812fa83a756ef7b91219031cfe80b1e853f22b4ed38ada76aed482caaf89df35e4d220f45728392765a757f8b0798e3b5a57fee0114e1d0379e887772578
+SHA512 (linux-5.14.0-224.rt14.225.el9.tar.xz) = e11ec1dd9e8c964c63343410b9b4ffb69317860d0a268d4487953d823afb2387ec41b035326227fb3e97d27a9c11f76dfee132fcf43ac7ac4ab0e41e176b4ad3
+SHA512 (kernel-abi-stablelists-5.14.0-224.rt14.225.el9.tar.bz2) = 599b87790ac712601303d0685ef741891fef1355b8b31bf211ca6b8aa9e30e3b8814ec7792f412916f0f7210c2219223c3020a7a138c6a517c8191a4fee8e083
+SHA512 (kernel-kabi-dw-5.14.0-224.rt14.225.el9.tar.bz2) = 565f812fa83a756ef7b91219031cfe80b1e853f22b4ed38ada76aed482caaf89df35e4d220f45728392765a757f8b0798e3b5a57fee0114e1d0379e887772578