--- /dev/null
+From 9f66b1a3f9080a9195fc625f7d04790325cc99a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 16:15:55 +0100
+Subject: ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
+
+From: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+
+[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ]
+
+Add a PCI quirk to enable microphone detection on the headphone jack of
+TongFang X6AR55xU devices.
+
+Signed-off-by: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260119151626.35481-1-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index a8f530037033e..b8c7f4c8593ba 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10052,6 +10052,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60140},
+ {0x19, 0x04a11030},
+ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC,
++ {0x17, 0x90170110},
++ {0x19, 0x03a11030},
++ {0x21, 0x03211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT,
+ ALC282_STANDARD_PINS,
+ {0x12, 0x90a609c0},
+--
+2.51.0
+
--- /dev/null
+From 2c7936fcd9f0cc7a65ef9cdb583430bf8d146319 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 02:50:20 +0530
+Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?=
+ =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ]
+
+The variable j is set, however never used in or outside the loop, thus
+resulting in dead code.
+Building with GCC 16 results in a build error due to
+-Werror=unused-but-set-variable= enabled by default.
+This patch clean up the dead code and fixes the build error.
+
+Example build log:
+drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=]
+ 1867 | size_t i, j;
+ | ^
+
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/hdmi.c | 4 ++--
+ drivers/gpu/drm/tegra/sor.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
+index e5d2a40260288..fe700dfaaa4ce 100644
+--- a/drivers/gpu/drm/tegra/hdmi.c
++++ b/drivers/gpu/drm/tegra/hdmi.c
+@@ -635,7 +635,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -668,7 +668,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_hdmi_subpack(&ptr[i], num);
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index 9d60d1c4cfcea..345dc74795588 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -1860,7 +1860,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -1893,7 +1893,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_sor_hdmi_subpack(&ptr[i], num);
+--
+2.51.0
+
--- /dev/null
+From b23e944c451375ccf96f256698ab73012aca1c71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 17:42:09 +0800
+Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock
+
+From: Xuewen Yan <xuewen.yan@unisoc.com>
+
+[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ]
+
+There was a lockdep warning in sprd_gpio:
+
+[ 6.258269][T329@C6] [ BUG: Invalid wait context ]
+[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE
+[ 6.258272][T329@C6] -----------------------------
+[ 6.258273][T329@C6] modprobe/329 is trying to lock:
+[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd]
+[ 6.258282][T329@C6] other info that might help us debug this:
+[ 6.258283][T329@C6] context-{5:5}
+[ 6.258285][T329@C6] 3 locks held by modprobe/329:
+[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204
+[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c
+[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c
+[ 6.258313][T329@C6] stack backtrace:
+[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df
+[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT)
+[ 6.258318][T329@C6] Call trace:
+[ 6.258318][T329@C6] show_stack+0x20/0x30 (C)
+[ 6.258321][T329@C6] __dump_stack+0x28/0x3c
+[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0
+[ 6.258326][T329@C6] dump_stack+0x18/0x3c
+[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28
+[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc
+[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4
+[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487]
+[ 6.258337][T329@C6] irq_startup+0x238/0x350
+[ 6.258340][T329@C6] __setup_irq+0x504/0x82c
+[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184
+[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120
+[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350
+[ 6.258361][T329@C6] really_probe+0x1a8/0x46c
+[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c
+[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4
+[ 6.258369][T329@C6] __driver_attach+0xd0/0x204
+[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168
+[ 6.258373][T329@C6] driver_attach+0x2c/0x3c
+[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c
+[ 6.258378][T329@C6] driver_register+0x70/0x10c
+[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8
+[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c
+[ 6.258392][T329@C6] do_init_module+0x60/0x254
+[ 6.258395][T329@C6] load_module+0x1054/0x1220
+[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c
+[ 6.258400][T329@C6] invoke_syscall+0x60/0xec
+[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4
+[ 6.258405][T329@C6] do_el0_svc+0x24/0x30
+[ 6.258407][T329@C6] el0_svc+0x54/0x1c4
+[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc
+[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8
+
+This is because the spin_lock would change to rt_mutex in PREEMPT_RT,
+however the sprd_gpio->lock would use in hard-irq, this is unsafe.
+
+So change the spin_lock_t to raw_spin_lock_t to use the spinlock
+in hard-irq.
+
+Signed-off-by: Xuewen Yan <xuewen.yan@unisoc.com>
+Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com
+[Bartosz: tweaked the commit message]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-sprd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c
+index 36ea8a3bd4510..49b8e148328a0 100644
+--- a/drivers/gpio/gpio-sprd.c
++++ b/drivers/gpio/gpio-sprd.c
+@@ -35,7 +35,7 @@
+ struct sprd_gpio {
+ struct gpio_chip chip;
+ void __iomem *base;
+- spinlock_t lock;
++ raw_spinlock_t lock;
+ int irq;
+ };
+
+@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ unsigned long flags;
+ u32 tmp;
+
+- spin_lock_irqsave(&sprd_gpio->lock, flags);
++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags);
+ tmp = readl_relaxed(base + reg);
+
+ if (val)
+@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ tmp &= ~BIT(SPRD_GPIO_BIT(offset));
+
+ writel_relaxed(tmp, base + reg);
+- spin_unlock_irqrestore(&sprd_gpio->lock, flags);
++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags);
+ }
+
+ static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg)
+@@ -236,7 +236,7 @@ static int sprd_gpio_probe(struct platform_device *pdev)
+ if (IS_ERR(sprd_gpio->base))
+ return PTR_ERR(sprd_gpio->base);
+
+- spin_lock_init(&sprd_gpio->lock);
++ raw_spin_lock_init(&sprd_gpio->lock);
+
+ sprd_gpio->chip.label = dev_name(&pdev->dev);
+ sprd_gpio->chip.ngpio = SPRD_GPIO_NR;
+--
+2.51.0
+
--- /dev/null
+From c3c4598c5cf62dc5abc2aeafbbe963ba4476f60e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 15:59:44 +0100
+Subject: gpiolib: acpi: Fix gpio count with string references
+
+From: Alban Bedel <alban.bedel@lht.dlh.de>
+
+[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ]
+
+Since commit 9880702d123f2 ("ACPI: property: Support using strings in
+reference properties") it is possible to use strings instead of local
+references. This work fine with single GPIO but not with arrays as
+acpi_gpio_package_count() didn't handle this case. Update it to handle
+strings like local references to cover this case as well.
+
+Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-acpi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 12012e1645d7b..f03a7199fd58e 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -1276,6 +1276,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj)
+ while (element < end) {
+ switch (element->type) {
+ case ACPI_TYPE_LOCAL_REFERENCE:
++ case ACPI_TYPE_STRING:
+ element += 3;
+ fallthrough;
+ case ACPI_TYPE_INTEGER:
+--
+2.51.0
+
--- /dev/null
+From 363cbde715a8aad5252e28c165828656dbfb59d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 21:02:40 +0100
+Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ]
+
+In a few places in the Classmate laptop driver, code using the accel
+object may run before that object's address is stored in the driver
+data of the input device using it.
+
+For example, cmpc_accel_sensitivity_store_v4() is the "show" method
+of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(),
+before calling dev_set_drvdata() for inputdev->dev. If the sysfs
+attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev)
+call in in cmpc_accel_sensitivity_store_v4() returns NULL which
+leads to a NULL pointer dereference going forward.
+
+Moreover, sysfs attributes using the input device are added before
+initializing that device by cmpc_add_acpi_notify_device() and if one
+of them is accessed before running that function, a NULL pointer
+dereference will occur.
+
+For example, cmpc_accel_sensitivity_attr_v4 is added before calling
+cmpc_add_acpi_notify_device() and if it is read prematurely, the
+dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4()
+returns NULL which leads to a NULL pointer dereference going forward.
+
+Fix this by adding NULL pointer checks in all of the relevant places.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c
+index af063f6908460..2012085882f8b 100644
+--- a/drivers/platform/x86/classmate-laptop.c
++++ b/drivers/platform/x86/classmate-laptop.c
+@@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->sensitivity);
+ }
+@@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+@@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->g_select);
+ }
+@@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &g_select);
+ if (r)
+@@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input)
+
+ acpi = to_acpi_device(input->dev.parent);
+ accel = dev_get_drvdata(&input->dev);
++ if (!accel)
++ return -ENXIO;
+
+ cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity);
+ cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select);
+@@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->sensitivity);
+ }
+@@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+--
+2.51.0
+
--- /dev/null
+From a6804d01c64295ad72967c41590caffaa859ca60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:10:37 +0530
+Subject: romfs: check sb_set_blocksize() return value
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ]
+
+romfs_fill_super() ignores the return value of sb_set_blocksize(), which
+can fail if the requested block size is incompatible with the block
+device's configuration.
+
+This can be triggered by setting a loop device's block size larger than
+PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs
+filesystem on that device.
+
+When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the
+device has logical_block_size=32768, bdev_validate_blocksize() fails
+because the requested size is smaller than the device's logical block
+size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and
+continues mounting.
+
+The superblock's block size remains at the device's logical block size
+(32768). Later, when sb_bread() attempts I/O with this oversized block
+size, it triggers a kernel BUG in folio_set_bh():
+
+ kernel BUG at fs/buffer.c:1582!
+ BUG_ON(size > PAGE_SIZE);
+
+Fix by checking the return value of sb_set_blocksize() and failing the
+mount with -EINVAL if it returns 0.
+
+Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/romfs/super.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/romfs/super.c b/fs/romfs/super.c
+index 259f684d9236e..6f31e720c9561 100644
+--- a/fs/romfs/super.c
++++ b/fs/romfs/super.c
+@@ -467,7 +467,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc)
+
+ #ifdef CONFIG_BLOCK
+ if (!sb->s_mtd) {
+- sb_set_blocksize(sb, ROMBSIZE);
++ if (!sb_set_blocksize(sb, ROMBSIZE)) {
++ errorf(fc, "romfs: unable to set blocksize\n");
++ return -EINVAL;
++ }
+ } else {
+ sb->s_blocksize = ROMBSIZE;
+ sb->s_blocksize_bits = blksize_bits(ROMBSIZE);
+--
+2.51.0
+
scsi-qla2xxx-delay-module-unload-while-fabric-scan-in-progress.patch
scsi-qla2xxx-query-fw-again-before-proceeding-with-login.patch
gpio-omap-do-not-register-driver-in-probe.patch
+alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch
+gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch
+romfs-check-sb_set_blocksize-return-value.patch
+drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch
+platform-x86-classmate-laptop-add-missing-null-point.patch
+gpiolib-acpi-fix-gpio-count-with-string-references.patch
--- /dev/null
+From 2d9972692525c0fe4b66b92375edeeb8dba0d203 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 16:15:55 +0100
+Subject: ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
+
+From: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+
+[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ]
+
+Add a PCI quirk to enable microphone detection on the headphone jack of
+TongFang X6AR55xU devices.
+
+Signed-off-by: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260119151626.35481-1-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 839a7e957d42a..72d9ea5171bbd 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10133,6 +10133,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60140},
+ {0x19, 0x04a11030},
+ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC,
++ {0x17, 0x90170110},
++ {0x19, 0x03a11030},
++ {0x21, 0x03211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT,
+ ALC282_STANDARD_PINS,
+ {0x12, 0x90a609c0},
+--
+2.51.0
+
--- /dev/null
+From 485a6299af94738982c5dbd3e2766ff6bafe2ead Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:41:12 +0000
+Subject: ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit f514248727606b9087bc38a284ff686e0093abf1 ]
+
+fsl_xcvr_activate_ctl() has
+lockdep_assert_held(&card->snd_card->controls_rwsem),
+but fsl_xcvr_mode_put() calls it without acquiring this lock.
+
+Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and
+fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read().
+
+Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl()
+in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential
+race conditions when multiple userspace threads access the control.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Link: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_xcvr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
+index ae5960b2b6a95..c4deb09c9a9bc 100644
+--- a/sound/soc/fsl/fsl_xcvr.c
++++ b/sound/soc/fsl/fsl_xcvr.c
+@@ -203,10 +203,13 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol,
+
+ xcvr->mode = snd_soc_enum_item_to_val(e, item[0]);
+
++ down_read(&card->snd_card->controls_rwsem);
+ fsl_xcvr_activate_ctl(dai, fsl_xcvr_arc_mode_kctl.name,
+ (xcvr->mode == FSL_XCVR_MODE_ARC));
+ fsl_xcvr_activate_ctl(dai, fsl_xcvr_earc_capds_kctl.name,
+ (xcvr->mode == FSL_XCVR_MODE_EARC));
++ up_read(&card->snd_card->controls_rwsem);
++
+ /* Allow playback for SPDIF only */
+ rtd = snd_soc_get_pcm_runtime(card, card->dai_link);
+ rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count =
+--
+2.51.0
+
--- /dev/null
+From 529f8d6790dff70e99b54bd0995a694d48c70c04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 02:50:20 +0530
+Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?=
+ =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ]
+
+The variable j is set, however never used in or outside the loop, thus
+resulting in dead code.
+Building with GCC 16 results in a build error due to
+-Werror=unused-but-set-variable= enabled by default.
+This patch clean up the dead code and fixes the build error.
+
+Example build log:
+drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=]
+ 1867 | size_t i, j;
+ | ^
+
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/hdmi.c | 4 ++--
+ drivers/gpu/drm/tegra/sor.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
+index e5d2a40260288..fe700dfaaa4ce 100644
+--- a/drivers/gpu/drm/tegra/hdmi.c
++++ b/drivers/gpu/drm/tegra/hdmi.c
+@@ -635,7 +635,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -668,7 +668,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_hdmi_subpack(&ptr[i], num);
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index f2f76a0897a80..31e1f9ec9fead 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -1860,7 +1860,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -1893,7 +1893,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_sor_hdmi_subpack(&ptr[i], num);
+--
+2.51.0
+
--- /dev/null
+From f2d684f6d6140c1bbda6718fc113b7bbbebf94ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 17:42:09 +0800
+Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock
+
+From: Xuewen Yan <xuewen.yan@unisoc.com>
+
+[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ]
+
+There was a lockdep warning in sprd_gpio:
+
+[ 6.258269][T329@C6] [ BUG: Invalid wait context ]
+[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE
+[ 6.258272][T329@C6] -----------------------------
+[ 6.258273][T329@C6] modprobe/329 is trying to lock:
+[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd]
+[ 6.258282][T329@C6] other info that might help us debug this:
+[ 6.258283][T329@C6] context-{5:5}
+[ 6.258285][T329@C6] 3 locks held by modprobe/329:
+[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204
+[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c
+[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c
+[ 6.258313][T329@C6] stack backtrace:
+[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df
+[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT)
+[ 6.258318][T329@C6] Call trace:
+[ 6.258318][T329@C6] show_stack+0x20/0x30 (C)
+[ 6.258321][T329@C6] __dump_stack+0x28/0x3c
+[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0
+[ 6.258326][T329@C6] dump_stack+0x18/0x3c
+[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28
+[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc
+[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4
+[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487]
+[ 6.258337][T329@C6] irq_startup+0x238/0x350
+[ 6.258340][T329@C6] __setup_irq+0x504/0x82c
+[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184
+[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120
+[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350
+[ 6.258361][T329@C6] really_probe+0x1a8/0x46c
+[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c
+[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4
+[ 6.258369][T329@C6] __driver_attach+0xd0/0x204
+[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168
+[ 6.258373][T329@C6] driver_attach+0x2c/0x3c
+[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c
+[ 6.258378][T329@C6] driver_register+0x70/0x10c
+[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8
+[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c
+[ 6.258392][T329@C6] do_init_module+0x60/0x254
+[ 6.258395][T329@C6] load_module+0x1054/0x1220
+[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c
+[ 6.258400][T329@C6] invoke_syscall+0x60/0xec
+[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4
+[ 6.258405][T329@C6] do_el0_svc+0x24/0x30
+[ 6.258407][T329@C6] el0_svc+0x54/0x1c4
+[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc
+[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8
+
+This is because the spin_lock would change to rt_mutex in PREEMPT_RT,
+however the sprd_gpio->lock would use in hard-irq, this is unsafe.
+
+So change the spin_lock_t to raw_spin_lock_t to use the spinlock
+in hard-irq.
+
+Signed-off-by: Xuewen Yan <xuewen.yan@unisoc.com>
+Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com
+[Bartosz: tweaked the commit message]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-sprd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c
+index 9dd9dabb579e2..b2b28c6877f2f 100644
+--- a/drivers/gpio/gpio-sprd.c
++++ b/drivers/gpio/gpio-sprd.c
+@@ -35,7 +35,7 @@
+ struct sprd_gpio {
+ struct gpio_chip chip;
+ void __iomem *base;
+- spinlock_t lock;
++ raw_spinlock_t lock;
+ int irq;
+ };
+
+@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ unsigned long flags;
+ u32 tmp;
+
+- spin_lock_irqsave(&sprd_gpio->lock, flags);
++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags);
+ tmp = readl_relaxed(base + reg);
+
+ if (val)
+@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ tmp &= ~BIT(SPRD_GPIO_BIT(offset));
+
+ writel_relaxed(tmp, base + reg);
+- spin_unlock_irqrestore(&sprd_gpio->lock, flags);
++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags);
+ }
+
+ static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg)
+@@ -231,7 +231,7 @@ static int sprd_gpio_probe(struct platform_device *pdev)
+ if (IS_ERR(sprd_gpio->base))
+ return PTR_ERR(sprd_gpio->base);
+
+- spin_lock_init(&sprd_gpio->lock);
++ raw_spin_lock_init(&sprd_gpio->lock);
+
+ sprd_gpio->chip.label = dev_name(&pdev->dev);
+ sprd_gpio->chip.ngpio = SPRD_GPIO_NR;
+--
+2.51.0
+
--- /dev/null
+From 2f2407808ac24b3ee5e36f5bf3167c0b9a091c39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 15:59:44 +0100
+Subject: gpiolib: acpi: Fix gpio count with string references
+
+From: Alban Bedel <alban.bedel@lht.dlh.de>
+
+[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ]
+
+Since commit 9880702d123f2 ("ACPI: property: Support using strings in
+reference properties") it is possible to use strings instead of local
+references. This work fine with single GPIO but not with arrays as
+acpi_gpio_package_count() didn't handle this case. Update it to handle
+strings like local references to cover this case as well.
+
+Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-acpi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 3e4fd028a82da..0e6a2200a5feb 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -1369,6 +1369,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj)
+ while (element < end) {
+ switch (element->type) {
+ case ACPI_TYPE_LOCAL_REFERENCE:
++ case ACPI_TYPE_STRING:
+ element += 3;
+ fallthrough;
+ case ACPI_TYPE_INTEGER:
+--
+2.51.0
+
--- /dev/null
+From d558b4eed80b99b8a99aade0b30bc60e6c5ade2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 21:02:40 +0100
+Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ]
+
+In a few places in the Classmate laptop driver, code using the accel
+object may run before that object's address is stored in the driver
+data of the input device using it.
+
+For example, cmpc_accel_sensitivity_store_v4() is the "show" method
+of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(),
+before calling dev_set_drvdata() for inputdev->dev. If the sysfs
+attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev)
+call in in cmpc_accel_sensitivity_store_v4() returns NULL which
+leads to a NULL pointer dereference going forward.
+
+Moreover, sysfs attributes using the input device are added before
+initializing that device by cmpc_add_acpi_notify_device() and if one
+of them is accessed before running that function, a NULL pointer
+dereference will occur.
+
+For example, cmpc_accel_sensitivity_attr_v4 is added before calling
+cmpc_add_acpi_notify_device() and if it is read prematurely, the
+dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4()
+returns NULL which leads to a NULL pointer dereference going forward.
+
+Fix this by adding NULL pointer checks in all of the relevant places.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c
+index 9309ab5792cbc..ac02b22154d62 100644
+--- a/drivers/platform/x86/classmate-laptop.c
++++ b/drivers/platform/x86/classmate-laptop.c
+@@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->sensitivity);
+ }
+@@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+@@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->g_select);
+ }
+@@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &g_select);
+ if (r)
+@@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input)
+
+ acpi = to_acpi_device(input->dev.parent);
+ accel = dev_get_drvdata(&input->dev);
++ if (!accel)
++ return -ENXIO;
+
+ cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity);
+ cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select);
+@@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->sensitivity);
+ }
+@@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+--
+2.51.0
+
--- /dev/null
+From 33d3ad5b24d5ce5462f5c39a382bf2bd234d9840 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 16:43:44 +0100
+Subject: platform/x86: panasonic-laptop: Fix sysfs group leak in error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 43b0b7eff4b3fb684f257d5a24376782e9663465 ]
+
+The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group
+if platform_device_register_simple() fails for the "panasonic" platform
+device.
+
+Address this by making it call sysfs_remove_group() in that case for
+the group in question.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/panasonic-laptop.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
+index e412a550f0983..418cd4d781261 100644
+--- a/drivers/platform/x86/panasonic-laptop.c
++++ b/drivers/platform/x86/panasonic-laptop.c
+@@ -1073,7 +1073,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
+ -1, NULL, 0);
+ if (IS_ERR(pcc->platform)) {
+ result = PTR_ERR(pcc->platform);
+- goto out_backlight;
++ goto out_sysfs;
+ }
+ result = device_create_file(&pcc->platform->dev,
+ &dev_attr_cdpower);
+@@ -1089,6 +1089,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
+
+ out_platform:
+ platform_device_unregister(pcc->platform);
++out_sysfs:
++ sysfs_remove_group(&device->dev.kobj, &pcc_attr_group);
+ out_backlight:
+ backlight_device_unregister(pcc->backlight);
+ out_input:
+--
+2.51.0
+
--- /dev/null
+From 4535187c736f3360617ab6f0945a7933248925a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:10:37 +0530
+Subject: romfs: check sb_set_blocksize() return value
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ]
+
+romfs_fill_super() ignores the return value of sb_set_blocksize(), which
+can fail if the requested block size is incompatible with the block
+device's configuration.
+
+This can be triggered by setting a loop device's block size larger than
+PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs
+filesystem on that device.
+
+When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the
+device has logical_block_size=32768, bdev_validate_blocksize() fails
+because the requested size is smaller than the device's logical block
+size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and
+continues mounting.
+
+The superblock's block size remains at the device's logical block size
+(32768). Later, when sb_bread() attempts I/O with this oversized block
+size, it triggers a kernel BUG in folio_set_bh():
+
+ kernel BUG at fs/buffer.c:1582!
+ BUG_ON(size > PAGE_SIZE);
+
+Fix by checking the return value of sb_set_blocksize() and failing the
+mount with -EINVAL if it returns 0.
+
+Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/romfs/super.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/romfs/super.c b/fs/romfs/super.c
+index 259f684d9236e..6f31e720c9561 100644
+--- a/fs/romfs/super.c
++++ b/fs/romfs/super.c
+@@ -467,7 +467,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc)
+
+ #ifdef CONFIG_BLOCK
+ if (!sb->s_mtd) {
+- sb_set_blocksize(sb, ROMBSIZE);
++ if (!sb_set_blocksize(sb, ROMBSIZE)) {
++ errorf(fc, "romfs: unable to set blocksize\n");
++ return -EINVAL;
++ }
+ } else {
+ sb->s_blocksize = ROMBSIZE;
+ sb->s_blocksize_bits = blksize_bits(ROMBSIZE);
+--
+2.51.0
+
scsi-qla2xxx-delay-module-unload-while-fabric-scan-in-progress.patch
scsi-qla2xxx-query-fw-again-before-proceeding-with-login.patch
gpio-omap-do-not-register-driver-in-probe.patch
+alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch
+gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch
+romfs-check-sb_set_blocksize-return-value.patch
+drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch
+platform-x86-classmate-laptop-add-missing-null-point.patch
+platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch
+asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch
+gpiolib-acpi-fix-gpio-count-with-string-references.patch
--- /dev/null
+From 4a75b2945f1ce2ae2e7336670fa387550bbb1b58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 15:35:08 +0800
+Subject: ALSA: hda/realtek: Add quirk for Inspur S14-G1
+
+From: Zhang Heng <zhangheng@kylinos.cn>
+
+[ Upstream commit 9e18920e783d0bcd4c127a7adc66565243ab9655 ]
+
+Inspur S14-G1 is equipped with ALC256.
+Enable "power saving mode" and Enable "headset jack mode".
+
+Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
+Link: https://patch.msgid.link/20260126073508.3897461-2-zhangheng@kylinos.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2fd52b6b4fb57..89410d40561d7 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10454,6 +10454,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x2039, 0x0001, "Inspur S14-G1", ALC295_FIXUP_CHROME_BOOK),
+ SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13),
+ SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO),
+--
+2.51.0
+
--- /dev/null
+From 4116b106031c85c8c66890e70307d529dbcf9b9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 16:15:55 +0100
+Subject: ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
+
+From: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+
+[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ]
+
+Add a PCI quirk to enable microphone detection on the headphone jack of
+TongFang X6AR55xU devices.
+
+Signed-off-by: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260119151626.35481-1-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b45e5b268a65b..2fd52b6b4fb57 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10906,6 +10906,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60140},
+ {0x19, 0x04a11030},
+ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC,
++ {0x17, 0x90170110},
++ {0x19, 0x03a11030},
++ {0x21, 0x03211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT,
+ ALC282_STANDARD_PINS,
+ {0x12, 0x90a609c0},
+--
+2.51.0
+
--- /dev/null
+From bbc17715ed1175376df42ea5510d00d24eb8b479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 15:56:18 +0100
+Subject: ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
+
+From: Anatolii Shirykalov <pipocavsobake@gmail.com>
+
+[ Upstream commit 018b211b1d321a52ed8d8de74ce83ce52a2e1224 ]
+
+Add ASUS ExpertBook PM1503CDA to the DMI quirks table to enable
+internal DMIC support via the ACP6x machine driver.
+
+Signed-off-by: Anatolii Shirykalov <pipocavsobake@gmail.com>
+Link: https://patch.msgid.link/20260119145618.3171435-1-pipocavsobake@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index 6bbbcf77fc525..43f7f64015b25 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -451,6 +451,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "15NBC1011"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK PM1503CDA"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From a02a50f13eaa219093b82c83f9063a729115d038 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 19:25:10 +0000
+Subject: ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel
+
+From: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
+
+[ Upstream commit 6dd0fdc908c02318c28ec2c0979661846ee0a9f7 ]
+
+ASP_TX5 was incorrectly mapped to a channel value of 3 corrects,
+the channel value of 4.
+
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260115192523.1335742-2-rriveram@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l45.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs35l45.c b/sound/soc/codecs/cs35l45.c
+index d15b3b77c7eb0..29aed07443866 100644
+--- a/sound/soc/codecs/cs35l45.c
++++ b/sound/soc/codecs/cs35l45.c
+@@ -131,7 +131,7 @@ static const struct snd_soc_dapm_widget cs35l45_dapm_widgets[] = {
+ SND_SOC_DAPM_AIF_OUT("ASP_TX2", NULL, 1, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX2_EN_SHIFT, 0),
+ SND_SOC_DAPM_AIF_OUT("ASP_TX3", NULL, 2, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX3_EN_SHIFT, 0),
+ SND_SOC_DAPM_AIF_OUT("ASP_TX4", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX4_EN_SHIFT, 0),
+- SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0),
++ SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 4, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0),
+
+ SND_SOC_DAPM_MUX("ASP_TX1 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[0]),
+ SND_SOC_DAPM_MUX("ASP_TX2 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[1]),
+--
+2.51.0
+
--- /dev/null
+From 6df695f437764efd634dd2b6a918db1710f0eab6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:41:12 +0000
+Subject: ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit f514248727606b9087bc38a284ff686e0093abf1 ]
+
+fsl_xcvr_activate_ctl() has
+lockdep_assert_held(&card->snd_card->controls_rwsem),
+but fsl_xcvr_mode_put() calls it without acquiring this lock.
+
+Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and
+fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read().
+
+Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl()
+in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential
+race conditions when multiple userspace threads access the control.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Link: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_xcvr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
+index 5b61b93772d64..e6c0e6609cbe0 100644
+--- a/sound/soc/fsl/fsl_xcvr.c
++++ b/sound/soc/fsl/fsl_xcvr.c
+@@ -203,10 +203,13 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol,
+
+ xcvr->mode = snd_soc_enum_item_to_val(e, item[0]);
+
++ down_read(&card->snd_card->controls_rwsem);
+ fsl_xcvr_activate_ctl(dai, fsl_xcvr_arc_mode_kctl.name,
+ (xcvr->mode == FSL_XCVR_MODE_ARC));
+ fsl_xcvr_activate_ctl(dai, fsl_xcvr_earc_capds_kctl.name,
+ (xcvr->mode == FSL_XCVR_MODE_EARC));
++ up_read(&card->snd_card->controls_rwsem);
++
+ /* Allow playback for SPDIF only */
+ rtd = snd_soc_get_pcm_runtime(card, card->dai_link);
+ rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count =
+--
+2.51.0
+
--- /dev/null
+From 39aa02197f48fcbb6ba935136879d75ac1f8276e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Feb 2026 15:17:28 +0300
+Subject: ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
+
+From: Tagir Garaev <tgaraev653@gmail.com>
+
+[ Upstream commit 6b641122d31f9d33e7d60047ee0586d1659f3f54 ]
+
+Add DMI entry for Huawei Matebook D (BOD-WXX9) with HEADPHONE_GPIO
+and DMIC quirks.
+
+This device has ES8336 codec with:
+- GPIO 16 (headphone-enable) for headphone amplifier control
+- GPIO 17 (speakers-enable) for speaker amplifier control
+- GPIO 269 for jack detection IRQ
+- 2-channel DMIC
+
+Hardware investigation shows that both GPIO 16 and 17 are required
+for proper audio routing, as headphones and speakers share the same
+physical output (HPOL/HPOR) and are separated only via amplifier
+enable signals.
+
+RFC: Seeking advice on GPIO control issue:
+
+GPIO values change in driver (gpiod_get_value() shows logical value
+changes) but not physically (debugfs gpio shows no change). The same
+gpiod_set_value_cansleep() calls work correctly in probe context with
+msleep(), but fail when called from DAPM event callbacks.
+
+Context information from diagnostics:
+- in_atomic=0, in_interrupt=0, irqs_disabled=0
+- Process context: pipewire
+- GPIO 17 (speakers): changes in driver, no physical change
+- GPIO 16 (headphone): changes in driver, no physical change
+
+In Windows, audio switching works without visible GPIO changes,
+suggesting possible ACPI/firmware involvement.
+
+Any suggestions on how to properly control these GPIOs from DAPM
+events would be appreciated.
+
+Signed-off-by: Tagir Garaev <tgaraev653@gmail.com>
+Link: https://patch.msgid.link/20260201121728.16597-1-tgaraev653@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_es8336.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
+index 41dab5dcf79a3..1c71c23f347e7 100644
+--- a/sound/soc/intel/boards/sof_es8336.c
++++ b/sound/soc/intel/boards/sof_es8336.c
+@@ -332,6 +332,15 @@ static int sof_es8336_quirk_cb(const struct dmi_system_id *id)
+ * if the topology file is modified as well.
+ */
+ static const struct dmi_system_id sof_es8336_quirk_table[] = {
++ {
++ .callback = sof_es8336_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HUAWEI"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "BOD-WXX9"),
++ },
++ .driver_data = (void *)(SOF_ES8336_HEADPHONE_GPIO |
++ SOF_ES8336_ENABLE_DMIC)
++ },
+ {
+ .callback = sof_es8336_quirk_cb,
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 921700dc033a000c90d0d5c62aa78ef9ba2cf5d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 02:50:20 +0530
+Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?=
+ =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ]
+
+The variable j is set, however never used in or outside the loop, thus
+resulting in dead code.
+Building with GCC 16 results in a build error due to
+-Werror=unused-but-set-variable= enabled by default.
+This patch clean up the dead code and fixes the build error.
+
+Example build log:
+drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=]
+ 1867 | size_t i, j;
+ | ^
+
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/hdmi.c | 4 ++--
+ drivers/gpu/drm/tegra/sor.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
+index c66764c0bd250..47f794a367ba1 100644
+--- a/drivers/gpu/drm/tegra/hdmi.c
++++ b/drivers/gpu/drm/tegra/hdmi.c
+@@ -654,7 +654,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -687,7 +687,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_hdmi_subpack(&ptr[i], num);
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index 77723d5f1d3fd..ce8e299b6afb6 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -1860,7 +1860,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -1893,7 +1893,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_sor_hdmi_subpack(&ptr[i], num);
+--
+2.51.0
+
--- /dev/null
+From b1d51d84d957db5458e04262ecc9515ba7b6486b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 17:42:09 +0800
+Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock
+
+From: Xuewen Yan <xuewen.yan@unisoc.com>
+
+[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ]
+
+There was a lockdep warning in sprd_gpio:
+
+[ 6.258269][T329@C6] [ BUG: Invalid wait context ]
+[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE
+[ 6.258272][T329@C6] -----------------------------
+[ 6.258273][T329@C6] modprobe/329 is trying to lock:
+[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd]
+[ 6.258282][T329@C6] other info that might help us debug this:
+[ 6.258283][T329@C6] context-{5:5}
+[ 6.258285][T329@C6] 3 locks held by modprobe/329:
+[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204
+[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c
+[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c
+[ 6.258313][T329@C6] stack backtrace:
+[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df
+[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT)
+[ 6.258318][T329@C6] Call trace:
+[ 6.258318][T329@C6] show_stack+0x20/0x30 (C)
+[ 6.258321][T329@C6] __dump_stack+0x28/0x3c
+[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0
+[ 6.258326][T329@C6] dump_stack+0x18/0x3c
+[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28
+[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc
+[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4
+[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487]
+[ 6.258337][T329@C6] irq_startup+0x238/0x350
+[ 6.258340][T329@C6] __setup_irq+0x504/0x82c
+[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184
+[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120
+[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350
+[ 6.258361][T329@C6] really_probe+0x1a8/0x46c
+[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c
+[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4
+[ 6.258369][T329@C6] __driver_attach+0xd0/0x204
+[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168
+[ 6.258373][T329@C6] driver_attach+0x2c/0x3c
+[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c
+[ 6.258378][T329@C6] driver_register+0x70/0x10c
+[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8
+[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c
+[ 6.258392][T329@C6] do_init_module+0x60/0x254
+[ 6.258395][T329@C6] load_module+0x1054/0x1220
+[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c
+[ 6.258400][T329@C6] invoke_syscall+0x60/0xec
+[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4
+[ 6.258405][T329@C6] do_el0_svc+0x24/0x30
+[ 6.258407][T329@C6] el0_svc+0x54/0x1c4
+[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc
+[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8
+
+This is because the spin_lock would change to rt_mutex in PREEMPT_RT,
+however the sprd_gpio->lock would use in hard-irq, this is unsafe.
+
+So change the spin_lock_t to raw_spin_lock_t to use the spinlock
+in hard-irq.
+
+Signed-off-by: Xuewen Yan <xuewen.yan@unisoc.com>
+Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com
+[Bartosz: tweaked the commit message]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-sprd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c
+index 9bff63990eee4..2da626905798b 100644
+--- a/drivers/gpio/gpio-sprd.c
++++ b/drivers/gpio/gpio-sprd.c
+@@ -35,7 +35,7 @@
+ struct sprd_gpio {
+ struct gpio_chip chip;
+ void __iomem *base;
+- spinlock_t lock;
++ raw_spinlock_t lock;
+ int irq;
+ };
+
+@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ unsigned long flags;
+ u32 tmp;
+
+- spin_lock_irqsave(&sprd_gpio->lock, flags);
++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags);
+ tmp = readl_relaxed(base + reg);
+
+ if (val)
+@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ tmp &= ~BIT(SPRD_GPIO_BIT(offset));
+
+ writel_relaxed(tmp, base + reg);
+- spin_unlock_irqrestore(&sprd_gpio->lock, flags);
++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags);
+ }
+
+ static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg)
+@@ -231,7 +231,7 @@ static int sprd_gpio_probe(struct platform_device *pdev)
+ if (IS_ERR(sprd_gpio->base))
+ return PTR_ERR(sprd_gpio->base);
+
+- spin_lock_init(&sprd_gpio->lock);
++ raw_spin_lock_init(&sprd_gpio->lock);
+
+ sprd_gpio->chip.label = dev_name(&pdev->dev);
+ sprd_gpio->chip.ngpio = SPRD_GPIO_NR;
+--
+2.51.0
+
--- /dev/null
+From 91157d1748eb3a774534751cf04ae45fd5b5d37e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 15:59:44 +0100
+Subject: gpiolib: acpi: Fix gpio count with string references
+
+From: Alban Bedel <alban.bedel@lht.dlh.de>
+
+[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ]
+
+Since commit 9880702d123f2 ("ACPI: property: Support using strings in
+reference properties") it is possible to use strings instead of local
+references. This work fine with single GPIO but not with arrays as
+acpi_gpio_package_count() didn't handle this case. Update it to handle
+strings like local references to cover this case as well.
+
+Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-acpi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 11338f47d884d..48c9935bedffb 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -1383,6 +1383,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj)
+ while (element < end) {
+ switch (element->type) {
+ case ACPI_TYPE_LOCAL_REFERENCE:
++ case ACPI_TYPE_STRING:
+ element += 3;
+ fallthrough;
+ case ACPI_TYPE_INTEGER:
+--
+2.51.0
+
--- /dev/null
+From a89fc3129dd616ac36f744b692120abba22b9b8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 21:02:40 +0100
+Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ]
+
+In a few places in the Classmate laptop driver, code using the accel
+object may run before that object's address is stored in the driver
+data of the input device using it.
+
+For example, cmpc_accel_sensitivity_store_v4() is the "show" method
+of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(),
+before calling dev_set_drvdata() for inputdev->dev. If the sysfs
+attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev)
+call in in cmpc_accel_sensitivity_store_v4() returns NULL which
+leads to a NULL pointer dereference going forward.
+
+Moreover, sysfs attributes using the input device are added before
+initializing that device by cmpc_add_acpi_notify_device() and if one
+of them is accessed before running that function, a NULL pointer
+dereference will occur.
+
+For example, cmpc_accel_sensitivity_attr_v4 is added before calling
+cmpc_add_acpi_notify_device() and if it is read prematurely, the
+dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4()
+returns NULL which leads to a NULL pointer dereference going forward.
+
+Fix this by adding NULL pointer checks in all of the relevant places.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c
+index 9309ab5792cbc..ac02b22154d62 100644
+--- a/drivers/platform/x86/classmate-laptop.c
++++ b/drivers/platform/x86/classmate-laptop.c
+@@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->sensitivity);
+ }
+@@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+@@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->g_select);
+ }
+@@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &g_select);
+ if (r)
+@@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input)
+
+ acpi = to_acpi_device(input->dev.parent);
+ accel = dev_get_drvdata(&input->dev);
++ if (!accel)
++ return -ENXIO;
+
+ cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity);
+ cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select);
+@@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->sensitivity);
+ }
+@@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+--
+2.51.0
+
--- /dev/null
+From c9e196a8762dd71b6ecc14e0d0c5d64cc5bfc9fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 16:43:44 +0100
+Subject: platform/x86: panasonic-laptop: Fix sysfs group leak in error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 43b0b7eff4b3fb684f257d5a24376782e9663465 ]
+
+The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group
+if platform_device_register_simple() fails for the "panasonic" platform
+device.
+
+Address this by making it call sysfs_remove_group() in that case for
+the group in question.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/panasonic-laptop.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
+index e9bee5f6ec8d0..99cbacd0cbba4 100644
+--- a/drivers/platform/x86/panasonic-laptop.c
++++ b/drivers/platform/x86/panasonic-laptop.c
+@@ -1077,7 +1077,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
+ PLATFORM_DEVID_NONE, NULL, 0);
+ if (IS_ERR(pcc->platform)) {
+ result = PTR_ERR(pcc->platform);
+- goto out_backlight;
++ goto out_sysfs;
+ }
+ result = device_create_file(&pcc->platform->dev,
+ &dev_attr_cdpower);
+@@ -1093,6 +1093,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
+
+ out_platform:
+ platform_device_unregister(pcc->platform);
++out_sysfs:
++ sysfs_remove_group(&device->dev.kobj, &pcc_attr_group);
+ out_backlight:
+ backlight_device_unregister(pcc->backlight);
+ out_input:
+--
+2.51.0
+
--- /dev/null
+From 720acd1716ed2cd6b869beb91295189ac2d388d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:10:37 +0530
+Subject: romfs: check sb_set_blocksize() return value
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ]
+
+romfs_fill_super() ignores the return value of sb_set_blocksize(), which
+can fail if the requested block size is incompatible with the block
+device's configuration.
+
+This can be triggered by setting a loop device's block size larger than
+PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs
+filesystem on that device.
+
+When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the
+device has logical_block_size=32768, bdev_validate_blocksize() fails
+because the requested size is smaller than the device's logical block
+size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and
+continues mounting.
+
+The superblock's block size remains at the device's logical block size
+(32768). Later, when sb_bread() attempts I/O with this oversized block
+size, it triggers a kernel BUG in folio_set_bh():
+
+ kernel BUG at fs/buffer.c:1582!
+ BUG_ON(size > PAGE_SIZE);
+
+Fix by checking the return value of sb_set_blocksize() and failing the
+mount with -EINVAL if it returns 0.
+
+Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/romfs/super.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/romfs/super.c b/fs/romfs/super.c
+index c59b230d55b43..3bc993634321a 100644
+--- a/fs/romfs/super.c
++++ b/fs/romfs/super.c
+@@ -468,7 +468,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc)
+
+ #ifdef CONFIG_BLOCK
+ if (!sb->s_mtd) {
+- sb_set_blocksize(sb, ROMBSIZE);
++ if (!sb_set_blocksize(sb, ROMBSIZE)) {
++ errorf(fc, "romfs: unable to set blocksize\n");
++ return -EINVAL;
++ }
+ } else {
+ sb->s_blocksize = ROMBSIZE;
+ sb->s_blocksize_bits = blksize_bits(ROMBSIZE);
+--
+2.51.0
+
scsi-qla2xxx-free-sp-in-error-path-to-fix-system-crash.patch
cacheinfo-decrement-refcount-in-cache_setup_of_node.patch
cacheinfo-remove-of_node_put-for-fw_token.patch
+alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch
+asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch
+gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch
+alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch
+asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch
+romfs-check-sb_set_blocksize-return-value.patch
+drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch
+platform-x86-classmate-laptop-add-missing-null-point.patch
+asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch
+platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch
+asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch
+gpiolib-acpi-fix-gpio-count-with-string-references.patch
--- /dev/null
+From 1c3f4fbbf2536332f9c142c8197f40ed2460fd41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 15:35:08 +0800
+Subject: ALSA: hda/realtek: Add quirk for Inspur S14-G1
+
+From: Zhang Heng <zhangheng@kylinos.cn>
+
+[ Upstream commit 9e18920e783d0bcd4c127a7adc66565243ab9655 ]
+
+Inspur S14-G1 is equipped with ALC256.
+Enable "power saving mode" and Enable "headset jack mode".
+
+Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
+Link: https://patch.msgid.link/20260126073508.3897461-2-zhangheng@kylinos.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2bdad4e518032..d9c3d1443a956 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -11379,6 +11379,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x2039, 0x0001, "Inspur S14-G1", ALC295_FIXUP_CHROME_BOOK),
+ SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13),
+ SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO),
+--
+2.51.0
+
--- /dev/null
+From 816d73f953e1cee66f61fb97b18486a2f9abd81b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 23:43:41 -0300
+Subject: ALSA: hda/realtek: Enable headset mic for Acer Nitro 5
+
+From: Breno Baptista <brenomb07@gmail.com>
+
+[ Upstream commit 51db05283f7c9c95a3e6853a3044cd04226551bf ]
+
+Add quirk to support microphone input through headphone jack on Acer Nitro 5 AN515-57 (ALC295).
+
+Signed-off-by: Breno Baptista <brenomb07@gmail.com>
+Link: https://patch.msgid.link/20260205024341.26694-1-brenomb07@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 6e7fa47741b0f..5c2f442fca79a 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10450,6 +10450,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1534, "Acer Predator PH315-54", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x1539, "Acer Nitro 5 AN515-57", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x159c, "Acer Nitro 5 AN515-58", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1597, "Acer Nitro 5 AN517-55", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x169a, "Acer Swift SFG16", ALC256_FIXUP_ACER_SFG16_MICMUTE_LED),
+--
+2.51.0
+
--- /dev/null
+From 58054d53fb3be272c43a3fa2af42677da35d834e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 16:15:55 +0100
+Subject: ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
+
+From: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+
+[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ]
+
+Add a PCI quirk to enable microphone detection on the headphone jack of
+TongFang X6AR55xU devices.
+
+Signed-off-by: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260119151626.35481-1-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 7bb2647af654a..2bdad4e518032 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -11835,6 +11835,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60140},
+ {0x19, 0x04a11030},
+ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC,
++ {0x17, 0x90170110},
++ {0x19, 0x03a11030},
++ {0x21, 0x03211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT,
+ ALC282_STANDARD_PINS,
+ {0x12, 0x90a609c0},
+--
+2.51.0
+
--- /dev/null
+From 3b5bef75983373080d139b3708adc95eb19b55a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 15:21:36 +0800
+Subject: ALSA: hda/realtek - fixed speaker no sound
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit 630fbc6e870eb06c5126cc97a3abecbe012272c8 ]
+
+If it play a 5s above silence media stream, it will cause silence
+detection trigger.
+Speaker will make no sound when you use another app to play a stream.
+Add this patch will solve this issue.
+
+GPIO2: Mute Hotkey GPIO3: Mic Mute LED
+Enable this will turn on hotkey and LED support.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Link: https://lore.kernel.org/f4929e137a7949238cc043d861a4d9f8@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index d9c3d1443a956..6e7fa47741b0f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7650,11 +7650,22 @@ static void alc287_alc1318_playback_pcm_hook(struct hda_pcm_stream *hinfo,
+ struct snd_pcm_substream *substream,
+ int action)
+ {
++ static const struct coef_fw dis_coefs[] = {
++ WRITE_COEF(0x24, 0x0013), WRITE_COEF(0x25, 0x0000), WRITE_COEF(0x26, 0xC203),
++ WRITE_COEF(0x28, 0x0004), WRITE_COEF(0x29, 0xb023),
++ }; /* Disable AMP silence detection */
++ static const struct coef_fw en_coefs[] = {
++ WRITE_COEF(0x24, 0x0013), WRITE_COEF(0x25, 0x0000), WRITE_COEF(0x26, 0xC203),
++ WRITE_COEF(0x28, 0x0084), WRITE_COEF(0x29, 0xb023),
++ }; /* Enable AMP silence detection */
++
+ switch (action) {
+ case HDA_GEN_PCM_ACT_OPEN:
++ alc_process_coef_fw(codec, dis_coefs);
+ alc_write_coefex_idx(codec, 0x5a, 0x00, 0x954f); /* write gpio3 to high */
+ break;
+ case HDA_GEN_PCM_ACT_CLOSE:
++ alc_process_coef_fw(codec, en_coefs);
+ alc_write_coefex_idx(codec, 0x5a, 0x00, 0x554f); /* write gpio3 as default value */
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From 56b78c9707a03157d03ee6eadb7a0f6d2dea49bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 15:56:18 +0100
+Subject: ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
+
+From: Anatolii Shirykalov <pipocavsobake@gmail.com>
+
+[ Upstream commit 018b211b1d321a52ed8d8de74ce83ce52a2e1224 ]
+
+Add ASUS ExpertBook PM1503CDA to the DMI quirks table to enable
+internal DMIC support via the ACP6x machine driver.
+
+Signed-off-by: Anatolii Shirykalov <pipocavsobake@gmail.com>
+Link: https://patch.msgid.link/20260119145618.3171435-1-pipocavsobake@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index 346e200613031..4f75a7d9b0e70 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -535,6 +535,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "15NBC1011"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK PM1503CDA"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From ba0b2016d230471ccfe547f6a5c1576343cfbc6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 14:50:19 +0800
+Subject: ASoC: amd: yc: Add quirk for HP 200 G2a 16
+
+From: Dirk Su <dirk.su@canonical.com>
+
+[ Upstream commit 611c7d2262d5645118e0b3a9a88475d35a8366f2 ]
+
+Fix the missing mic on HP 200 G2a 16 by adding quirk with the
+board ID 8EE4
+
+Signed-off-by: Dirk Su <dirk.su@canonical.com>
+Link: https://patch.msgid.link/20260129065038.39349-1-dirk.su@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index 4f75a7d9b0e70..6d073ecad6f02 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -633,6 +633,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "8BD6"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"),
++ DMI_MATCH(DMI_BOARD_NAME, "8EE4"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 68add73cfbcf1e2a0987744763cc14cc0b8b8868 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 19:25:10 +0000
+Subject: ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel
+
+From: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
+
+[ Upstream commit 6dd0fdc908c02318c28ec2c0979661846ee0a9f7 ]
+
+ASP_TX5 was incorrectly mapped to a channel value of 3 corrects,
+the channel value of 4.
+
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260115192523.1335742-2-rriveram@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l45.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs35l45.c b/sound/soc/codecs/cs35l45.c
+index fa1d9d9151f96..7f295c6432b20 100644
+--- a/sound/soc/codecs/cs35l45.c
++++ b/sound/soc/codecs/cs35l45.c
+@@ -455,7 +455,7 @@ static const struct snd_soc_dapm_widget cs35l45_dapm_widgets[] = {
+ SND_SOC_DAPM_AIF_OUT("ASP_TX2", NULL, 1, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX2_EN_SHIFT, 0),
+ SND_SOC_DAPM_AIF_OUT("ASP_TX3", NULL, 2, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX3_EN_SHIFT, 0),
+ SND_SOC_DAPM_AIF_OUT("ASP_TX4", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX4_EN_SHIFT, 0),
+- SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0),
++ SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 4, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0),
+
+ SND_SOC_DAPM_MUX("ASP_TX1 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[0]),
+ SND_SOC_DAPM_MUX("ASP_TX2 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[1]),
+--
+2.51.0
+
--- /dev/null
+From 658ffd613b77af606be6a069e46101aefdc4adc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 15:09:27 +0000
+Subject: ASoC: cs42l43: Correct handling of 3-pole jack load detection
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit e77a4081d7e324dfa876a9560b2a78969446ba82 ]
+
+The load detection process for 3-pole jacks requires slightly
+updated reference values to ensure an accurate result. Update
+the code to apply different tunings for the 3-pole and 4-pole
+cases. This also updates the thresholds overall so update the
+relevant comments to match.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260130150927.2964664-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l43-jack.c | 37 +++++++++++++++++++++++++++------
+ 1 file changed, 31 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/cs42l43-jack.c b/sound/soc/codecs/cs42l43-jack.c
+index 984a7f470a31f..aa0062f3aa918 100644
+--- a/sound/soc/codecs/cs42l43-jack.c
++++ b/sound/soc/codecs/cs42l43-jack.c
+@@ -508,7 +508,23 @@ void cs42l43_bias_sense_timeout(struct work_struct *work)
+ pm_runtime_put_autosuspend(priv->dev);
+ }
+
+-static void cs42l43_start_load_detect(struct cs42l43_codec *priv)
++static const struct reg_sequence cs42l43_3pole_patch[] = {
++ { 0x4000, 0x00000055 },
++ { 0x4000, 0x000000AA },
++ { 0x17420, 0x8500F300 },
++ { 0x17424, 0x36003E00 },
++ { 0x4000, 0x00000000 },
++};
++
++static const struct reg_sequence cs42l43_4pole_patch[] = {
++ { 0x4000, 0x00000055 },
++ { 0x4000, 0x000000AA },
++ { 0x17420, 0x7800E600 },
++ { 0x17424, 0x36003800 },
++ { 0x4000, 0x00000000 },
++};
++
++static void cs42l43_start_load_detect(struct cs42l43_codec *priv, bool mic)
+ {
+ struct cs42l43 *cs42l43 = priv->core;
+
+@@ -532,6 +548,15 @@ static void cs42l43_start_load_detect(struct cs42l43_codec *priv)
+ dev_err(priv->dev, "Load detect HP power down timed out\n");
+ }
+
++ if (mic)
++ regmap_multi_reg_write_bypassed(cs42l43->regmap,
++ cs42l43_4pole_patch,
++ ARRAY_SIZE(cs42l43_4pole_patch));
++ else
++ regmap_multi_reg_write_bypassed(cs42l43->regmap,
++ cs42l43_3pole_patch,
++ ARRAY_SIZE(cs42l43_3pole_patch));
++
+ regmap_update_bits(cs42l43->regmap, CS42L43_BLOCK_EN3,
+ CS42L43_ADC1_EN_MASK | CS42L43_ADC2_EN_MASK, 0);
+ regmap_update_bits(cs42l43->regmap, CS42L43_DACCNFG2, CS42L43_HP_HPF_EN_MASK, 0);
+@@ -610,7 +635,7 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic)
+
+ reinit_completion(&priv->load_detect);
+
+- cs42l43_start_load_detect(priv);
++ cs42l43_start_load_detect(priv, mic);
+ time_left = wait_for_completion_timeout(&priv->load_detect,
+ msecs_to_jiffies(CS42L43_LOAD_TIMEOUT_MS));
+ cs42l43_stop_load_detect(priv);
+@@ -634,11 +659,11 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic)
+ }
+
+ switch (val & CS42L43_AMP3_RES_DET_MASK) {
+- case 0x0: // low impedance
+- case 0x1: // high impedance
++ case 0x0: // < 22 Ohm impedance
++ case 0x1: // < 150 Ohm impedance
++ case 0x2: // < 1000 Ohm impedance
+ return CS42L43_JACK_HEADPHONE;
+- case 0x2: // lineout
+- case 0x3: // Open circuit
++ case 0x3: // > 1000 Ohm impedance
+ return CS42L43_JACK_LINEOUT;
+ default:
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 48238c93c973e665ba0df333d10ed258919327fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:41:12 +0000
+Subject: ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit f514248727606b9087bc38a284ff686e0093abf1 ]
+
+fsl_xcvr_activate_ctl() has
+lockdep_assert_held(&card->snd_card->controls_rwsem),
+but fsl_xcvr_mode_put() calls it without acquiring this lock.
+
+Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and
+fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read().
+
+Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl()
+in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential
+race conditions when multiple userspace threads access the control.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Link: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_xcvr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
+index 656a4d619cdf1..d6f00920391d1 100644
+--- a/sound/soc/fsl/fsl_xcvr.c
++++ b/sound/soc/fsl/fsl_xcvr.c
+@@ -216,10 +216,13 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol,
+
+ xcvr->mode = snd_soc_enum_item_to_val(e, item[0]);
+
++ down_read(&card->snd_card->controls_rwsem);
+ fsl_xcvr_activate_ctl(dai, fsl_xcvr_arc_mode_kctl.name,
+ (xcvr->mode == FSL_XCVR_MODE_ARC));
+ fsl_xcvr_activate_ctl(dai, fsl_xcvr_earc_capds_kctl.name,
+ (xcvr->mode == FSL_XCVR_MODE_EARC));
++ up_read(&card->snd_card->controls_rwsem);
++
+ /* Allow playback for SPDIF only */
+ rtd = snd_soc_get_pcm_runtime(card, card->dai_link);
+ rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count =
+--
+2.51.0
+
--- /dev/null
+From 6a61eaa16ba004ca144f3732541976e7e819d14d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Feb 2026 15:17:28 +0300
+Subject: ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
+
+From: Tagir Garaev <tgaraev653@gmail.com>
+
+[ Upstream commit 6b641122d31f9d33e7d60047ee0586d1659f3f54 ]
+
+Add DMI entry for Huawei Matebook D (BOD-WXX9) with HEADPHONE_GPIO
+and DMIC quirks.
+
+This device has ES8336 codec with:
+- GPIO 16 (headphone-enable) for headphone amplifier control
+- GPIO 17 (speakers-enable) for speaker amplifier control
+- GPIO 269 for jack detection IRQ
+- 2-channel DMIC
+
+Hardware investigation shows that both GPIO 16 and 17 are required
+for proper audio routing, as headphones and speakers share the same
+physical output (HPOL/HPOR) and are separated only via amplifier
+enable signals.
+
+RFC: Seeking advice on GPIO control issue:
+
+GPIO values change in driver (gpiod_get_value() shows logical value
+changes) but not physically (debugfs gpio shows no change). The same
+gpiod_set_value_cansleep() calls work correctly in probe context with
+msleep(), but fail when called from DAPM event callbacks.
+
+Context information from diagnostics:
+- in_atomic=0, in_interrupt=0, irqs_disabled=0
+- Process context: pipewire
+- GPIO 17 (speakers): changes in driver, no physical change
+- GPIO 16 (headphone): changes in driver, no physical change
+
+In Windows, audio switching works without visible GPIO changes,
+suggesting possible ACPI/firmware involvement.
+
+Any suggestions on how to properly control these GPIOs from DAPM
+events would be appreciated.
+
+Signed-off-by: Tagir Garaev <tgaraev653@gmail.com>
+Link: https://patch.msgid.link/20260201121728.16597-1-tgaraev653@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_es8336.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
+index bc27229be7c24..7c3784112ca0f 100644
+--- a/sound/soc/intel/boards/sof_es8336.c
++++ b/sound/soc/intel/boards/sof_es8336.c
+@@ -332,6 +332,15 @@ static int sof_es8336_quirk_cb(const struct dmi_system_id *id)
+ * if the topology file is modified as well.
+ */
+ static const struct dmi_system_id sof_es8336_quirk_table[] = {
++ {
++ .callback = sof_es8336_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HUAWEI"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "BOD-WXX9"),
++ },
++ .driver_data = (void *)(SOF_ES8336_HEADPHONE_GPIO |
++ SOF_ES8336_ENABLE_DMIC)
++ },
+ {
+ .callback = sof_es8336_quirk_cb,
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 5c41b23d66f48cd00a465a9e50d999cf4dbfc8a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 22:44:15 -0100
+Subject: drm/amd/display: extend delta clamping logic to CM3 LUT helper
+
+From: Melissa Wen <mwen@igalia.com>
+
+[ Upstream commit d25b32aa829a3ed5570138e541a71fb7805faec3 ]
+
+Commit 27fc10d1095f ("drm/amd/display: Fix the delta clamping for shaper
+LUT") fixed banding when using plane shaper LUT in DCN10 CM helper. The
+problem is also present in DCN30 CM helper, fix banding by extending the
+same bug delta clamping fix to CM3.
+
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 0274a54897f356f9c78767c4a2a5863f7dde90c6)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/dcn30/dcn30_cm_common.c | 30 +++++++++++++++----
+ .../display/dc/dwb/dcn30/dcn30_cm_common.h | 2 +-
+ .../amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 9 +++---
+ .../amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 17 ++++++-----
+ .../amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 16 +++++-----
+ 5 files changed, 49 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
+index f299d9455f510..4d53b17300d01 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
+@@ -105,9 +105,12 @@ void cm_helper_program_gamcor_xfer_func(
+ #define NUMBER_REGIONS 32
+ #define NUMBER_SW_SEGMENTS 16
+
+-bool cm3_helper_translate_curve_to_hw_format(
+- const struct dc_transfer_func *output_tf,
+- struct pwl_params *lut_params, bool fixpoint)
++#define DC_LOGGER \
++ ctx->logger
++
++bool cm3_helper_translate_curve_to_hw_format(struct dc_context *ctx,
++ const struct dc_transfer_func *output_tf,
++ struct pwl_params *lut_params, bool fixpoint)
+ {
+ struct curve_points3 *corner_points;
+ struct pwl_result_data *rgb_resulted;
+@@ -256,6 +259,10 @@ bool cm3_helper_translate_curve_to_hw_format(
+ if (fixpoint == true) {
+ i = 1;
+ while (i != hw_points + 2) {
++ uint32_t red_clamp;
++ uint32_t green_clamp;
++ uint32_t blue_clamp;
++
+ if (i >= hw_points) {
+ if (dc_fixpt_lt(rgb_plus_1->red, rgb->red))
+ rgb_plus_1->red = dc_fixpt_add(rgb->red,
+@@ -268,9 +275,20 @@ bool cm3_helper_translate_curve_to_hw_format(
+ rgb_minus_1->delta_blue);
+ }
+
+- rgb->delta_red_reg = dc_fixpt_clamp_u0d10(rgb->delta_red);
+- rgb->delta_green_reg = dc_fixpt_clamp_u0d10(rgb->delta_green);
+- rgb->delta_blue_reg = dc_fixpt_clamp_u0d10(rgb->delta_blue);
++ rgb->delta_red = dc_fixpt_sub(rgb_plus_1->red, rgb->red);
++ rgb->delta_green = dc_fixpt_sub(rgb_plus_1->green, rgb->green);
++ rgb->delta_blue = dc_fixpt_sub(rgb_plus_1->blue, rgb->blue);
++
++ red_clamp = dc_fixpt_clamp_u0d14(rgb->delta_red);
++ green_clamp = dc_fixpt_clamp_u0d14(rgb->delta_green);
++ blue_clamp = dc_fixpt_clamp_u0d14(rgb->delta_blue);
++
++ if (red_clamp >> 10 || green_clamp >> 10 || blue_clamp >> 10)
++ DC_LOG_ERROR("Losing delta precision while programming shaper LUT.");
++
++ rgb->delta_red_reg = red_clamp & 0x3ff;
++ rgb->delta_green_reg = green_clamp & 0x3ff;
++ rgb->delta_blue_reg = blue_clamp & 0x3ff;
+ rgb->red_reg = dc_fixpt_clamp_u0d14(rgb->red);
+ rgb->green_reg = dc_fixpt_clamp_u0d14(rgb->green);
+ rgb->blue_reg = dc_fixpt_clamp_u0d14(rgb->blue);
+diff --git a/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h b/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h
+index bd98b327a6c70..c23dc1bb29bf8 100644
+--- a/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h
++++ b/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h
+@@ -59,7 +59,7 @@ void cm_helper_program_gamcor_xfer_func(
+ const struct pwl_params *params,
+ const struct dcn3_xfer_func_reg *reg);
+
+-bool cm3_helper_translate_curve_to_hw_format(
++bool cm3_helper_translate_curve_to_hw_format(struct dc_context *ctx,
+ const struct dc_transfer_func *output_tf,
+ struct pwl_params *lut_params, bool fixpoint);
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
+index bded33575493b..de4282a986269 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
+@@ -228,7 +228,7 @@ bool dcn30_set_blend_lut(
+ if (plane_state->blend_tf.type == TF_TYPE_HWPWL)
+ blend_lut = &plane_state->blend_tf.pwl;
+ else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) {
+- result = cm3_helper_translate_curve_to_hw_format(
++ result = cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
+ &plane_state->blend_tf, &dpp_base->regamma_params, false);
+ if (!result)
+ return result;
+@@ -316,8 +316,9 @@ bool dcn30_set_input_transfer_func(struct dc *dc,
+ if (plane_state->in_transfer_func.type == TF_TYPE_HWPWL)
+ params = &plane_state->in_transfer_func.pwl;
+ else if (plane_state->in_transfer_func.type == TF_TYPE_DISTRIBUTED_POINTS &&
+- cm3_helper_translate_curve_to_hw_format(&plane_state->in_transfer_func,
+- &dpp_base->degamma_params, false))
++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->in_transfer_func,
++ &dpp_base->degamma_params, false))
+ params = &dpp_base->degamma_params;
+
+ result = dpp_base->funcs->dpp_program_gamcor_lut(dpp_base, params);
+@@ -388,7 +389,7 @@ bool dcn30_set_output_transfer_func(struct dc *dc,
+ params = &stream->out_transfer_func.pwl;
+ else if (pipe_ctx->stream->out_transfer_func.type ==
+ TF_TYPE_DISTRIBUTED_POINTS &&
+- cm3_helper_translate_curve_to_hw_format(
++ cm3_helper_translate_curve_to_hw_format(stream->ctx,
+ &stream->out_transfer_func,
+ &mpc->blender_params, false))
+ params = &mpc->blender_params;
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+index 2e8c9f7382596..17b6eebadef69 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+@@ -483,8 +483,9 @@ bool dcn32_set_mcm_luts(
+ if (plane_state->blend_tf.type == TF_TYPE_HWPWL)
+ lut_params = &plane_state->blend_tf.pwl;
+ else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) {
+- result = cm3_helper_translate_curve_to_hw_format(&plane_state->blend_tf,
+- &dpp_base->regamma_params, false);
++ result = cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->blend_tf,
++ &dpp_base->regamma_params, false);
+ if (!result)
+ return result;
+
+@@ -499,8 +500,9 @@ bool dcn32_set_mcm_luts(
+ else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) {
+ // TODO: dpp_base replace
+ ASSERT(false);
+- cm3_helper_translate_curve_to_hw_format(&plane_state->in_shaper_func,
+- &dpp_base->shaper_params, true);
++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->in_shaper_func,
++ &dpp_base->shaper_params, true);
+ lut_params = &dpp_base->shaper_params;
+ }
+
+@@ -540,8 +542,9 @@ bool dcn32_set_input_transfer_func(struct dc *dc,
+ if (plane_state->in_transfer_func.type == TF_TYPE_HWPWL)
+ params = &plane_state->in_transfer_func.pwl;
+ else if (plane_state->in_transfer_func.type == TF_TYPE_DISTRIBUTED_POINTS &&
+- cm3_helper_translate_curve_to_hw_format(&plane_state->in_transfer_func,
+- &dpp_base->degamma_params, false))
++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->in_transfer_func,
++ &dpp_base->degamma_params, false))
+ params = &dpp_base->degamma_params;
+
+ dpp_base->funcs->dpp_program_gamcor_lut(dpp_base, params);
+@@ -572,7 +575,7 @@ bool dcn32_set_output_transfer_func(struct dc *dc,
+ params = &stream->out_transfer_func.pwl;
+ else if (pipe_ctx->stream->out_transfer_func.type ==
+ TF_TYPE_DISTRIBUTED_POINTS &&
+- cm3_helper_translate_curve_to_hw_format(
++ cm3_helper_translate_curve_to_hw_format(stream->ctx,
+ &stream->out_transfer_func,
+ &mpc->blender_params, false))
+ params = &mpc->blender_params;
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index bcb296a954f2b..f805803be55e4 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -514,7 +514,7 @@ void dcn401_populate_mcm_luts(struct dc *dc,
+ if (mcm_luts.lut1d_func->type == TF_TYPE_HWPWL)
+ m_lut_params.pwl = &mcm_luts.lut1d_func->pwl;
+ else if (mcm_luts.lut1d_func->type == TF_TYPE_DISTRIBUTED_POINTS) {
+- rval = cm3_helper_translate_curve_to_hw_format(
++ rval = cm3_helper_translate_curve_to_hw_format(mpc->ctx,
+ mcm_luts.lut1d_func,
+ &dpp_base->regamma_params, false);
+ m_lut_params.pwl = rval ? &dpp_base->regamma_params : NULL;
+@@ -534,7 +534,7 @@ void dcn401_populate_mcm_luts(struct dc *dc,
+ m_lut_params.pwl = &mcm_luts.shaper->pwl;
+ else if (mcm_luts.shaper->type == TF_TYPE_DISTRIBUTED_POINTS) {
+ ASSERT(false);
+- rval = cm3_helper_translate_curve_to_hw_format(
++ rval = cm3_helper_translate_curve_to_hw_format(mpc->ctx,
+ mcm_luts.shaper,
+ &dpp_base->regamma_params, true);
+ m_lut_params.pwl = rval ? &dpp_base->regamma_params : NULL;
+@@ -683,8 +683,9 @@ bool dcn401_set_mcm_luts(struct pipe_ctx *pipe_ctx,
+ if (plane_state->blend_tf.type == TF_TYPE_HWPWL)
+ lut_params = &plane_state->blend_tf.pwl;
+ else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) {
+- rval = cm3_helper_translate_curve_to_hw_format(&plane_state->blend_tf,
+- &dpp_base->regamma_params, false);
++ rval = cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->blend_tf,
++ &dpp_base->regamma_params, false);
+ lut_params = rval ? &dpp_base->regamma_params : NULL;
+ }
+ result = mpc->funcs->program_1dlut(mpc, lut_params, mpcc_id);
+@@ -695,8 +696,9 @@ bool dcn401_set_mcm_luts(struct pipe_ctx *pipe_ctx,
+ lut_params = &plane_state->in_shaper_func.pwl;
+ else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) {
+ // TODO: dpp_base replace
+- rval = cm3_helper_translate_curve_to_hw_format(&plane_state->in_shaper_func,
+- &dpp_base->shaper_params, true);
++ rval = cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->in_shaper_func,
++ &dpp_base->shaper_params, true);
+ lut_params = rval ? &dpp_base->shaper_params : NULL;
+ }
+ result &= mpc->funcs->program_shaper(mpc, lut_params, mpcc_id);
+@@ -730,7 +732,7 @@ bool dcn401_set_output_transfer_func(struct dc *dc,
+ params = &stream->out_transfer_func.pwl;
+ else if (pipe_ctx->stream->out_transfer_func.type ==
+ TF_TYPE_DISTRIBUTED_POINTS &&
+- cm3_helper_translate_curve_to_hw_format(
++ cm3_helper_translate_curve_to_hw_format(stream->ctx,
+ &stream->out_transfer_func,
+ &mpc->blender_params, false))
+ params = &mpc->blender_params;
+--
+2.51.0
+
--- /dev/null
+From 3f15b36e60eadca9a3f3310937018e2853a23c1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 12:50:49 -0300
+Subject: drm/amd/display: remove assert around dpp_base replacement
+
+From: Melissa Wen <mwen@igalia.com>
+
+[ Upstream commit 84962445cd8a83dc5bed4c8ad5bbb2c1cdb249a0 ]
+
+There is nothing wrong if in_shaper_func type is DISTRIBUTED POINTS.
+Remove the assert placed for a TODO to avoid misinterpretations.
+
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1714dcc4c2c53e41190896eba263ed6328bcf415)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+index 17b6eebadef69..39cc924463502 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+@@ -499,7 +499,6 @@ bool dcn32_set_mcm_luts(
+ lut_params = &plane_state->in_shaper_func.pwl;
+ else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) {
+ // TODO: dpp_base replace
+- ASSERT(false);
+ cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
+ &plane_state->in_shaper_func,
+ &dpp_base->shaper_params, true);
+--
+2.51.0
+
--- /dev/null
+From c9c3ef023e10f19d586104561d2866740daf8fb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 02:50:20 +0530
+Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?=
+ =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ]
+
+The variable j is set, however never used in or outside the loop, thus
+resulting in dead code.
+Building with GCC 16 results in a build error due to
+-Werror=unused-but-set-variable= enabled by default.
+This patch clean up the dead code and fixes the build error.
+
+Example build log:
+drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=]
+ 1867 | size_t i, j;
+ | ^
+
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/hdmi.c | 4 ++--
+ drivers/gpu/drm/tegra/sor.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
+index 09987e372e3ef..02b260cbbf0c8 100644
+--- a/drivers/gpu/drm/tegra/hdmi.c
++++ b/drivers/gpu/drm/tegra/hdmi.c
+@@ -658,7 +658,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -691,7 +691,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_hdmi_subpack(&ptr[i], num);
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index bad3b8fcc7269..c2a57f85051ae 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -1864,7 +1864,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -1897,7 +1897,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_sor_hdmi_subpack(&ptr[i], num);
+--
+2.51.0
+
--- /dev/null
+From 11234258a8c4810374a14a9ed0fde32ea543f160 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 17:42:09 +0800
+Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock
+
+From: Xuewen Yan <xuewen.yan@unisoc.com>
+
+[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ]
+
+There was a lockdep warning in sprd_gpio:
+
+[ 6.258269][T329@C6] [ BUG: Invalid wait context ]
+[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE
+[ 6.258272][T329@C6] -----------------------------
+[ 6.258273][T329@C6] modprobe/329 is trying to lock:
+[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd]
+[ 6.258282][T329@C6] other info that might help us debug this:
+[ 6.258283][T329@C6] context-{5:5}
+[ 6.258285][T329@C6] 3 locks held by modprobe/329:
+[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204
+[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c
+[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c
+[ 6.258313][T329@C6] stack backtrace:
+[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df
+[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT)
+[ 6.258318][T329@C6] Call trace:
+[ 6.258318][T329@C6] show_stack+0x20/0x30 (C)
+[ 6.258321][T329@C6] __dump_stack+0x28/0x3c
+[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0
+[ 6.258326][T329@C6] dump_stack+0x18/0x3c
+[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28
+[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc
+[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4
+[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487]
+[ 6.258337][T329@C6] irq_startup+0x238/0x350
+[ 6.258340][T329@C6] __setup_irq+0x504/0x82c
+[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184
+[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120
+[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350
+[ 6.258361][T329@C6] really_probe+0x1a8/0x46c
+[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c
+[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4
+[ 6.258369][T329@C6] __driver_attach+0xd0/0x204
+[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168
+[ 6.258373][T329@C6] driver_attach+0x2c/0x3c
+[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c
+[ 6.258378][T329@C6] driver_register+0x70/0x10c
+[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8
+[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c
+[ 6.258392][T329@C6] do_init_module+0x60/0x254
+[ 6.258395][T329@C6] load_module+0x1054/0x1220
+[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c
+[ 6.258400][T329@C6] invoke_syscall+0x60/0xec
+[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4
+[ 6.258405][T329@C6] do_el0_svc+0x24/0x30
+[ 6.258407][T329@C6] el0_svc+0x54/0x1c4
+[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc
+[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8
+
+This is because the spin_lock would change to rt_mutex in PREEMPT_RT,
+however the sprd_gpio->lock would use in hard-irq, this is unsafe.
+
+So change the spin_lock_t to raw_spin_lock_t to use the spinlock
+in hard-irq.
+
+Signed-off-by: Xuewen Yan <xuewen.yan@unisoc.com>
+Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com
+[Bartosz: tweaked the commit message]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-sprd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c
+index c117c11bfb29a..192f05a2c19c1 100644
+--- a/drivers/gpio/gpio-sprd.c
++++ b/drivers/gpio/gpio-sprd.c
+@@ -35,7 +35,7 @@
+ struct sprd_gpio {
+ struct gpio_chip chip;
+ void __iomem *base;
+- spinlock_t lock;
++ raw_spinlock_t lock;
+ int irq;
+ };
+
+@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ unsigned long flags;
+ u32 tmp;
+
+- spin_lock_irqsave(&sprd_gpio->lock, flags);
++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags);
+ tmp = readl_relaxed(base + reg);
+
+ if (val)
+@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ tmp &= ~BIT(SPRD_GPIO_BIT(offset));
+
+ writel_relaxed(tmp, base + reg);
+- spin_unlock_irqrestore(&sprd_gpio->lock, flags);
++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags);
+ }
+
+ static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg)
+@@ -234,7 +234,7 @@ static int sprd_gpio_probe(struct platform_device *pdev)
+ if (IS_ERR(sprd_gpio->base))
+ return PTR_ERR(sprd_gpio->base);
+
+- spin_lock_init(&sprd_gpio->lock);
++ raw_spin_lock_init(&sprd_gpio->lock);
+
+ sprd_gpio->chip.label = dev_name(&pdev->dev);
+ sprd_gpio->chip.ngpio = SPRD_GPIO_NR;
+--
+2.51.0
+
--- /dev/null
+From 4c27e26b58f822ac3dcdcc6bef64ae9b2fc71320 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 15:59:44 +0100
+Subject: gpiolib: acpi: Fix gpio count with string references
+
+From: Alban Bedel <alban.bedel@lht.dlh.de>
+
+[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ]
+
+Since commit 9880702d123f2 ("ACPI: property: Support using strings in
+reference properties") it is possible to use strings instead of local
+references. This work fine with single GPIO but not with arrays as
+acpi_gpio_package_count() didn't handle this case. Update it to handle
+strings like local references to cover this case as well.
+
+Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-acpi-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpiolib-acpi-core.c b/drivers/gpio/gpiolib-acpi-core.c
+index fc2033f2cf258..f6bec9d2fd265 100644
+--- a/drivers/gpio/gpiolib-acpi-core.c
++++ b/drivers/gpio/gpiolib-acpi-core.c
+@@ -1351,6 +1351,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj)
+ while (element < end) {
+ switch (element->type) {
+ case ACPI_TYPE_LOCAL_REFERENCE:
++ case ACPI_TYPE_STRING:
+ element += 3;
+ fallthrough;
+ case ACPI_TYPE_INTEGER:
+--
+2.51.0
+
--- /dev/null
+From eee15415497125f08d6a907fe2aad777897cb99b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 23:55:00 +0800
+Subject: platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: gongqi <550230171hxy@gmail.com>
+
+[ Upstream commit 2b4e00d8e70ca8736fda82447be6a4e323c6d1f5 ]
+
+The MECHREVO Wujie 15X Pro suffers from spurious IRQ issues related to
+the AMD PMC. Add it to the quirk list to use the spurious_8042 fix.
+
+Signed-off-by: gongqi <550230171hxy@gmail.com>
+Link: https://patch.msgid.link/20260122155501.376199-4-550230171hxy@gmail.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index a5031339dac8c..a6006b4ec2cc0 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -296,6 +296,13 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "XxKK4NAx_XxSP4NAx"),
+ }
+ },
++ {
++ .ident = "MECHREVO Wujie 15X Pro",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"),
++ }
++ },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 397bccfeb4872067ab14312ac3abb05c38db89f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 21:02:40 +0100
+Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ]
+
+In a few places in the Classmate laptop driver, code using the accel
+object may run before that object's address is stored in the driver
+data of the input device using it.
+
+For example, cmpc_accel_sensitivity_store_v4() is the "show" method
+of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(),
+before calling dev_set_drvdata() for inputdev->dev. If the sysfs
+attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev)
+call in in cmpc_accel_sensitivity_store_v4() returns NULL which
+leads to a NULL pointer dereference going forward.
+
+Moreover, sysfs attributes using the input device are added before
+initializing that device by cmpc_add_acpi_notify_device() and if one
+of them is accessed before running that function, a NULL pointer
+dereference will occur.
+
+For example, cmpc_accel_sensitivity_attr_v4 is added before calling
+cmpc_add_acpi_notify_device() and if it is read prematurely, the
+dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4()
+returns NULL which leads to a NULL pointer dereference going forward.
+
+Fix this by adding NULL pointer checks in all of the relevant places.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c
+index cb6fce655e35b..452cdec11e3db 100644
+--- a/drivers/platform/x86/classmate-laptop.c
++++ b/drivers/platform/x86/classmate-laptop.c
+@@ -206,7 +206,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->sensitivity);
+ }
+@@ -223,7 +228,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+@@ -255,7 +265,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->g_select);
+ }
+@@ -272,7 +287,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &g_select);
+ if (r)
+@@ -301,6 +321,8 @@ static int cmpc_accel_open_v4(struct input_dev *input)
+
+ acpi = to_acpi_device(input->dev.parent);
+ accel = dev_get_drvdata(&input->dev);
++ if (!accel)
++ return -ENXIO;
+
+ cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity);
+ cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select);
+@@ -548,7 +570,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->sensitivity);
+ }
+@@ -565,7 +592,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+--
+2.51.0
+
--- /dev/null
+From 177bdcac4ad2d652120b9fc0f6fb110770ba87c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 16:43:44 +0100
+Subject: platform/x86: panasonic-laptop: Fix sysfs group leak in error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 43b0b7eff4b3fb684f257d5a24376782e9663465 ]
+
+The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group
+if platform_device_register_simple() fails for the "panasonic" platform
+device.
+
+Address this by making it call sysfs_remove_group() in that case for
+the group in question.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/panasonic-laptop.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
+index 22ca70eb82271..851f0f92219dd 100644
+--- a/drivers/platform/x86/panasonic-laptop.c
++++ b/drivers/platform/x86/panasonic-laptop.c
+@@ -1089,7 +1089,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
+ PLATFORM_DEVID_NONE, NULL, 0);
+ if (IS_ERR(pcc->platform)) {
+ result = PTR_ERR(pcc->platform);
+- goto out_backlight;
++ goto out_sysfs;
+ }
+ result = device_create_file(&pcc->platform->dev,
+ &dev_attr_cdpower);
+@@ -1105,6 +1105,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
+
+ out_platform:
+ platform_device_unregister(pcc->platform);
++out_sysfs:
++ sysfs_remove_group(&device->dev.kobj, &pcc_attr_group);
+ out_backlight:
+ backlight_device_unregister(pcc->backlight);
+ out_input:
+--
+2.51.0
+
--- /dev/null
+From 4e5ed102021de1e1cafd59f937b48dd1ac4d19b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:10:37 +0530
+Subject: romfs: check sb_set_blocksize() return value
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ]
+
+romfs_fill_super() ignores the return value of sb_set_blocksize(), which
+can fail if the requested block size is incompatible with the block
+device's configuration.
+
+This can be triggered by setting a loop device's block size larger than
+PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs
+filesystem on that device.
+
+When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the
+device has logical_block_size=32768, bdev_validate_blocksize() fails
+because the requested size is smaller than the device's logical block
+size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and
+continues mounting.
+
+The superblock's block size remains at the device's logical block size
+(32768). Later, when sb_bread() attempts I/O with this oversized block
+size, it triggers a kernel BUG in folio_set_bh():
+
+ kernel BUG at fs/buffer.c:1582!
+ BUG_ON(size > PAGE_SIZE);
+
+Fix by checking the return value of sb_set_blocksize() and failing the
+mount with -EINVAL if it returns 0.
+
+Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/romfs/super.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/romfs/super.c b/fs/romfs/super.c
+index 0addcc849ff2c..e83f9b78d7a16 100644
+--- a/fs/romfs/super.c
++++ b/fs/romfs/super.c
+@@ -458,7 +458,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc)
+
+ #ifdef CONFIG_BLOCK
+ if (!sb->s_mtd) {
+- sb_set_blocksize(sb, ROMBSIZE);
++ if (!sb_set_blocksize(sb, ROMBSIZE)) {
++ errorf(fc, "romfs: unable to set blocksize\n");
++ return -EINVAL;
++ }
+ } else {
+ sb->s_blocksize = ROMBSIZE;
+ sb->s_blocksize_bits = blksize_bits(ROMBSIZE);
+--
+2.51.0
+
--- /dev/null
+alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch
+asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch
+gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch
+alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch
+asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch
+alsa-hda-realtek-fixed-speaker-no-sound.patch
+romfs-check-sb_set_blocksize-return-value.patch
+drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch
+platform-x86-classmate-laptop-add-missing-null-point.patch
+asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch
+asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch
+alsa-hda-realtek-enable-headset-mic-for-acer-nitro-5.patch
+platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch
+platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch
+asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch
+tracing-dma-cap-dma_map_sg-tracepoint-arrays-to-prev.patch
+drm-amd-display-extend-delta-clamping-logic-to-cm3-l.patch
+drm-amd-display-remove-assert-around-dpp_base-replac.patch
+asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch
+gpiolib-acpi-fix-gpio-count-with-string-references.patch
--- /dev/null
+From fd1eef39b1b5b5ce8aa3d7f77fe858ef10b44e2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 21:22:15 +0530
+Subject: tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer
+ overflow
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit daafcc0ef0b358d9d622b6e3b7c43767aa3814ee ]
+
+The dma_map_sg tracepoint can trigger a perf buffer overflow when
+tracing large scatter-gather lists. With devices like virtio-gpu
+creating large DRM buffers, nents can exceed 1000 entries, resulting
+in:
+
+ phys_addrs: 1000 * 8 bytes = 8,000 bytes
+ dma_addrs: 1000 * 8 bytes = 8,000 bytes
+ lengths: 1000 * 4 bytes = 4,000 bytes
+ Total: ~20,000 bytes
+
+This exceeds PERF_MAX_TRACE_SIZE (8192 bytes), causing:
+
+ WARNING: CPU: 0 PID: 5497 at kernel/trace/trace_event_perf.c:405
+ perf buffer not large enough, wanted 24620, have 8192
+
+Cap all three dynamic arrays at 128 entries using min() in the array
+size calculation. This ensures arrays are only as large as needed
+(up to the cap), avoiding unnecessary memory allocation for small
+operations while preventing overflow for large ones.
+
+The tracepoint now records the full nents/ents counts and a truncated
+flag so users can see when data has been capped.
+
+Changes in v2:
+- Use min(nents, DMA_TRACE_MAX_ENTRIES) for dynamic array sizing
+ instead of fixed DMA_TRACE_MAX_ENTRIES allocation (feedback from
+ Steven Rostedt)
+- This allocates only what's needed up to the cap, avoiding waste
+ for small operations
+
+Reported-by: syzbot+28cea38c382fd15e751a@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=28cea38c382fd15e751a
+Tested-by: syzbot+28cea38c382fd15e751a@syzkaller.appspotmail.com
+Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
+Reviwed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20260130155215.69737-1-kartikey406@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/dma.h | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/include/trace/events/dma.h b/include/trace/events/dma.h
+index e5187144c91b7..705363b228a40 100644
+--- a/include/trace/events/dma.h
++++ b/include/trace/events/dma.h
+@@ -278,6 +278,8 @@ TRACE_EVENT(dma_free_sgt,
+ sizeof(u64), sizeof(u64)))
+ );
+
++#define DMA_TRACE_MAX_ENTRIES 128
++
+ TRACE_EVENT(dma_map_sg,
+ TP_PROTO(struct device *dev, struct scatterlist *sgl, int nents,
+ int ents, enum dma_data_direction dir, unsigned long attrs),
+@@ -285,9 +287,12 @@ TRACE_EVENT(dma_map_sg,
+
+ TP_STRUCT__entry(
+ __string(device, dev_name(dev))
+- __dynamic_array(u64, phys_addrs, nents)
+- __dynamic_array(u64, dma_addrs, ents)
+- __dynamic_array(unsigned int, lengths, ents)
++ __field(int, full_nents)
++ __field(int, full_ents)
++ __field(bool, truncated)
++ __dynamic_array(u64, phys_addrs, min(nents, DMA_TRACE_MAX_ENTRIES))
++ __dynamic_array(u64, dma_addrs, min(ents, DMA_TRACE_MAX_ENTRIES))
++ __dynamic_array(unsigned int, lengths, min(ents, DMA_TRACE_MAX_ENTRIES))
+ __field(enum dma_data_direction, dir)
+ __field(unsigned long, attrs)
+ ),
+@@ -295,11 +300,16 @@ TRACE_EVENT(dma_map_sg,
+ TP_fast_assign(
+ struct scatterlist *sg;
+ int i;
++ int traced_nents = min_t(int, nents, DMA_TRACE_MAX_ENTRIES);
++ int traced_ents = min_t(int, ents, DMA_TRACE_MAX_ENTRIES);
+
+ __assign_str(device);
+- for_each_sg(sgl, sg, nents, i)
++ __entry->full_nents = nents;
++ __entry->full_ents = ents;
++ __entry->truncated = (nents > DMA_TRACE_MAX_ENTRIES) || (ents > DMA_TRACE_MAX_ENTRIES);
++ for_each_sg(sgl, sg, traced_nents, i)
+ ((u64 *)__get_dynamic_array(phys_addrs))[i] = sg_phys(sg);
+- for_each_sg(sgl, sg, ents, i) {
++ for_each_sg(sgl, sg, traced_ents, i) {
+ ((u64 *)__get_dynamic_array(dma_addrs))[i] =
+ sg_dma_address(sg);
+ ((unsigned int *)__get_dynamic_array(lengths))[i] =
+@@ -309,9 +319,12 @@ TRACE_EVENT(dma_map_sg,
+ __entry->attrs = attrs;
+ ),
+
+- TP_printk("%s dir=%s dma_addrs=%s sizes=%s phys_addrs=%s attrs=%s",
++ TP_printk("%s dir=%s nents=%d/%d ents=%d/%d%s dma_addrs=%s sizes=%s phys_addrs=%s attrs=%s",
+ __get_str(device),
+ decode_dma_data_direction(__entry->dir),
++ min_t(int, __entry->full_nents, DMA_TRACE_MAX_ENTRIES), __entry->full_nents,
++ min_t(int, __entry->full_ents, DMA_TRACE_MAX_ENTRIES), __entry->full_ents,
++ __entry->truncated ? " [TRUNCATED]" : "",
+ __print_array(__get_dynamic_array(dma_addrs),
+ __get_dynamic_array_len(dma_addrs) /
+ sizeof(u64), sizeof(u64)),
+--
+2.51.0
+
--- /dev/null
+From 0b6bfe976f77e3585fc4010e842890fd2f24b2ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 15:35:08 +0800
+Subject: ALSA: hda/realtek: Add quirk for Inspur S14-G1
+
+From: Zhang Heng <zhangheng@kylinos.cn>
+
+[ Upstream commit 9e18920e783d0bcd4c127a7adc66565243ab9655 ]
+
+Inspur S14-G1 is equipped with ALC256.
+Enable "power saving mode" and Enable "headset jack mode".
+
+Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
+Link: https://patch.msgid.link/20260126073508.3897461-2-zhangheng@kylinos.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 2e9efafa732fe..a77f16abc6df0 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -7243,6 +7243,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x2039, 0x0001, "Inspur S14-G1", ALC295_FIXUP_CHROME_BOOK),
+ SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13),
+ SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO),
+--
+2.51.0
+
--- /dev/null
+From af517b4bb48f107e7e8d503f2130e1fda2855151 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 23:43:41 -0300
+Subject: ALSA: hda/realtek: Enable headset mic for Acer Nitro 5
+
+From: Breno Baptista <brenomb07@gmail.com>
+
+[ Upstream commit 51db05283f7c9c95a3e6853a3044cd04226551bf ]
+
+Add quirk to support microphone input through headphone jack on Acer Nitro 5 AN515-57 (ALC295).
+
+Signed-off-by: Breno Baptista <brenomb07@gmail.com>
+Link: https://patch.msgid.link/20260205024341.26694-1-brenomb07@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 55ef52fefaef4..a16cb45ac59e3 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -6271,6 +6271,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1534, "Acer Predator PH315-54", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x1539, "Acer Nitro 5 AN515-57", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x159c, "Acer Nitro 5 AN515-58", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1597, "Acer Nitro 5 AN517-55", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x169a, "Acer Swift SFG16", ALC256_FIXUP_ACER_SFG16_MICMUTE_LED),
+--
+2.51.0
+
--- /dev/null
+From f7101c12318a52a0642203802910ca3786da778b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 15:21:36 +0800
+Subject: ALSA: hda/realtek - fixed speaker no sound
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit 630fbc6e870eb06c5126cc97a3abecbe012272c8 ]
+
+If it play a 5s above silence media stream, it will cause silence
+detection trigger.
+Speaker will make no sound when you use another app to play a stream.
+Add this patch will solve this issue.
+
+GPIO2: Mute Hotkey GPIO3: Mic Mute LED
+Enable this will turn on hotkey and LED support.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Link: https://lore.kernel.org/f4929e137a7949238cc043d861a4d9f8@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index a77f16abc6df0..55ef52fefaef4 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -3371,11 +3371,22 @@ static void alc287_alc1318_playback_pcm_hook(struct hda_pcm_stream *hinfo,
+ struct snd_pcm_substream *substream,
+ int action)
+ {
++ static const struct coef_fw dis_coefs[] = {
++ WRITE_COEF(0x24, 0x0013), WRITE_COEF(0x25, 0x0000), WRITE_COEF(0x26, 0xC203),
++ WRITE_COEF(0x28, 0x0004), WRITE_COEF(0x29, 0xb023),
++ }; /* Disable AMP silence detection */
++ static const struct coef_fw en_coefs[] = {
++ WRITE_COEF(0x24, 0x0013), WRITE_COEF(0x25, 0x0000), WRITE_COEF(0x26, 0xC203),
++ WRITE_COEF(0x28, 0x0084), WRITE_COEF(0x29, 0xb023),
++ }; /* Enable AMP silence detection */
++
+ switch (action) {
+ case HDA_GEN_PCM_ACT_OPEN:
++ alc_process_coef_fw(codec, dis_coefs);
+ alc_write_coefex_idx(codec, 0x5a, 0x00, 0x954f); /* write gpio3 to high */
+ break;
+ case HDA_GEN_PCM_ACT_CLOSE:
++ alc_process_coef_fw(codec, en_coefs);
+ alc_write_coefex_idx(codec, 0x5a, 0x00, 0x554f); /* write gpio3 as default value */
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From 2fd105a4cf11ddbc6a238f191f05d2c43e2d3c39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 15:56:18 +0100
+Subject: ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
+
+From: Anatolii Shirykalov <pipocavsobake@gmail.com>
+
+[ Upstream commit 018b211b1d321a52ed8d8de74ce83ce52a2e1224 ]
+
+Add ASUS ExpertBook PM1503CDA to the DMI quirks table to enable
+internal DMIC support via the ACP6x machine driver.
+
+Signed-off-by: Anatolii Shirykalov <pipocavsobake@gmail.com>
+Link: https://patch.msgid.link/20260119145618.3171435-1-pipocavsobake@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index c4a4a06528b45..c18da0915baad 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -542,6 +542,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "15NBC1011"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK PM1503CDA"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 8c96c955b30211ed7a0ce47bde212f4421b50da2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 14:50:19 +0800
+Subject: ASoC: amd: yc: Add quirk for HP 200 G2a 16
+
+From: Dirk Su <dirk.su@canonical.com>
+
+[ Upstream commit 611c7d2262d5645118e0b3a9a88475d35a8366f2 ]
+
+Fix the missing mic on HP 200 G2a 16 by adding quirk with the
+board ID 8EE4
+
+Signed-off-by: Dirk Su <dirk.su@canonical.com>
+Link: https://patch.msgid.link/20260129065038.39349-1-dirk.su@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index c18da0915baad..67f2fee193980 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -640,6 +640,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "8BD6"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"),
++ DMI_MATCH(DMI_BOARD_NAME, "8EE4"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 53296ae824bc43913e74ef3bbafa61eefcaa86e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 19:25:10 +0000
+Subject: ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel
+
+From: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
+
+[ Upstream commit 6dd0fdc908c02318c28ec2c0979661846ee0a9f7 ]
+
+ASP_TX5 was incorrectly mapped to a channel value of 3 corrects,
+the channel value of 4.
+
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260115192523.1335742-2-rriveram@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l45.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs35l45.c b/sound/soc/codecs/cs35l45.c
+index d4dcdf37bb709..9b1eff4e9bb71 100644
+--- a/sound/soc/codecs/cs35l45.c
++++ b/sound/soc/codecs/cs35l45.c
+@@ -455,7 +455,7 @@ static const struct snd_soc_dapm_widget cs35l45_dapm_widgets[] = {
+ SND_SOC_DAPM_AIF_OUT("ASP_TX2", NULL, 1, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX2_EN_SHIFT, 0),
+ SND_SOC_DAPM_AIF_OUT("ASP_TX3", NULL, 2, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX3_EN_SHIFT, 0),
+ SND_SOC_DAPM_AIF_OUT("ASP_TX4", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX4_EN_SHIFT, 0),
+- SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0),
++ SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 4, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0),
+
+ SND_SOC_DAPM_MUX("ASP_TX1 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[0]),
+ SND_SOC_DAPM_MUX("ASP_TX2 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[1]),
+--
+2.51.0
+
--- /dev/null
+From de054a5ab2f0099e166b439e012ac9fb8cc1a4c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 15:09:27 +0000
+Subject: ASoC: cs42l43: Correct handling of 3-pole jack load detection
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit e77a4081d7e324dfa876a9560b2a78969446ba82 ]
+
+The load detection process for 3-pole jacks requires slightly
+updated reference values to ensure an accurate result. Update
+the code to apply different tunings for the 3-pole and 4-pole
+cases. This also updates the thresholds overall so update the
+relevant comments to match.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260130150927.2964664-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l43-jack.c | 37 +++++++++++++++++++++++++++------
+ 1 file changed, 31 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/cs42l43-jack.c b/sound/soc/codecs/cs42l43-jack.c
+index 867e23d4fb8d8..744488f371ea4 100644
+--- a/sound/soc/codecs/cs42l43-jack.c
++++ b/sound/soc/codecs/cs42l43-jack.c
+@@ -496,7 +496,23 @@ void cs42l43_bias_sense_timeout(struct work_struct *work)
+ pm_runtime_put_autosuspend(priv->dev);
+ }
+
+-static void cs42l43_start_load_detect(struct cs42l43_codec *priv)
++static const struct reg_sequence cs42l43_3pole_patch[] = {
++ { 0x4000, 0x00000055 },
++ { 0x4000, 0x000000AA },
++ { 0x17420, 0x8500F300 },
++ { 0x17424, 0x36003E00 },
++ { 0x4000, 0x00000000 },
++};
++
++static const struct reg_sequence cs42l43_4pole_patch[] = {
++ { 0x4000, 0x00000055 },
++ { 0x4000, 0x000000AA },
++ { 0x17420, 0x7800E600 },
++ { 0x17424, 0x36003800 },
++ { 0x4000, 0x00000000 },
++};
++
++static void cs42l43_start_load_detect(struct cs42l43_codec *priv, bool mic)
+ {
+ struct cs42l43 *cs42l43 = priv->core;
+
+@@ -520,6 +536,15 @@ static void cs42l43_start_load_detect(struct cs42l43_codec *priv)
+ dev_err(priv->dev, "Load detect HP power down timed out\n");
+ }
+
++ if (mic)
++ regmap_multi_reg_write_bypassed(cs42l43->regmap,
++ cs42l43_4pole_patch,
++ ARRAY_SIZE(cs42l43_4pole_patch));
++ else
++ regmap_multi_reg_write_bypassed(cs42l43->regmap,
++ cs42l43_3pole_patch,
++ ARRAY_SIZE(cs42l43_3pole_patch));
++
+ regmap_update_bits(cs42l43->regmap, CS42L43_BLOCK_EN3,
+ CS42L43_ADC1_EN_MASK | CS42L43_ADC2_EN_MASK, 0);
+ regmap_update_bits(cs42l43->regmap, CS42L43_DACCNFG2, CS42L43_HP_HPF_EN_MASK, 0);
+@@ -598,7 +623,7 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic)
+
+ reinit_completion(&priv->load_detect);
+
+- cs42l43_start_load_detect(priv);
++ cs42l43_start_load_detect(priv, mic);
+ time_left = wait_for_completion_timeout(&priv->load_detect,
+ msecs_to_jiffies(CS42L43_LOAD_TIMEOUT_MS));
+ cs42l43_stop_load_detect(priv);
+@@ -622,11 +647,11 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic)
+ }
+
+ switch (val & CS42L43_AMP3_RES_DET_MASK) {
+- case 0x0: // low impedance
+- case 0x1: // high impedance
++ case 0x0: // < 22 Ohm impedance
++ case 0x1: // < 150 Ohm impedance
++ case 0x2: // < 1000 Ohm impedance
+ return CS42L43_JACK_HEADPHONE;
+- case 0x2: // lineout
+- case 0x3: // Open circuit
++ case 0x3: // > 1000 Ohm impedance
+ return CS42L43_JACK_LINEOUT;
+ default:
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 479e30f9c04689f8da3a603f4ab596e731531d45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:41:12 +0000
+Subject: ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit f514248727606b9087bc38a284ff686e0093abf1 ]
+
+fsl_xcvr_activate_ctl() has
+lockdep_assert_held(&card->snd_card->controls_rwsem),
+but fsl_xcvr_mode_put() calls it without acquiring this lock.
+
+Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and
+fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read().
+
+Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl()
+in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential
+race conditions when multiple userspace threads access the control.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Link: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_xcvr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
+index 58db4906a01d5..51669e5fe8888 100644
+--- a/sound/soc/fsl/fsl_xcvr.c
++++ b/sound/soc/fsl/fsl_xcvr.c
+@@ -223,10 +223,13 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol,
+
+ xcvr->mode = snd_soc_enum_item_to_val(e, item[0]);
+
++ down_read(&card->snd_card->controls_rwsem);
+ fsl_xcvr_activate_ctl(dai, fsl_xcvr_arc_mode_kctl.name,
+ (xcvr->mode == FSL_XCVR_MODE_ARC));
+ fsl_xcvr_activate_ctl(dai, fsl_xcvr_earc_capds_kctl.name,
+ (xcvr->mode == FSL_XCVR_MODE_EARC));
++ up_read(&card->snd_card->controls_rwsem);
++
+ /* Allow playback for SPDIF only */
+ rtd = snd_soc_get_pcm_runtime(card, card->dai_link);
+ rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count =
+--
+2.51.0
+
--- /dev/null
+From 78ce4ec46be5f27ae03229705be94d128077f49d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Feb 2026 15:17:28 +0300
+Subject: ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
+
+From: Tagir Garaev <tgaraev653@gmail.com>
+
+[ Upstream commit 6b641122d31f9d33e7d60047ee0586d1659f3f54 ]
+
+Add DMI entry for Huawei Matebook D (BOD-WXX9) with HEADPHONE_GPIO
+and DMIC quirks.
+
+This device has ES8336 codec with:
+- GPIO 16 (headphone-enable) for headphone amplifier control
+- GPIO 17 (speakers-enable) for speaker amplifier control
+- GPIO 269 for jack detection IRQ
+- 2-channel DMIC
+
+Hardware investigation shows that both GPIO 16 and 17 are required
+for proper audio routing, as headphones and speakers share the same
+physical output (HPOL/HPOR) and are separated only via amplifier
+enable signals.
+
+RFC: Seeking advice on GPIO control issue:
+
+GPIO values change in driver (gpiod_get_value() shows logical value
+changes) but not physically (debugfs gpio shows no change). The same
+gpiod_set_value_cansleep() calls work correctly in probe context with
+msleep(), but fail when called from DAPM event callbacks.
+
+Context information from diagnostics:
+- in_atomic=0, in_interrupt=0, irqs_disabled=0
+- Process context: pipewire
+- GPIO 17 (speakers): changes in driver, no physical change
+- GPIO 16 (headphone): changes in driver, no physical change
+
+In Windows, audio switching works without visible GPIO changes,
+suggesting possible ACPI/firmware involvement.
+
+Any suggestions on how to properly control these GPIOs from DAPM
+events would be appreciated.
+
+Signed-off-by: Tagir Garaev <tgaraev653@gmail.com>
+Link: https://patch.msgid.link/20260201121728.16597-1-tgaraev653@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_es8336.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
+index 09acd80d23e0f..cf50de5c2edd8 100644
+--- a/sound/soc/intel/boards/sof_es8336.c
++++ b/sound/soc/intel/boards/sof_es8336.c
+@@ -332,6 +332,15 @@ static int sof_es8336_quirk_cb(const struct dmi_system_id *id)
+ * if the topology file is modified as well.
+ */
+ static const struct dmi_system_id sof_es8336_quirk_table[] = {
++ {
++ .callback = sof_es8336_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HUAWEI"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "BOD-WXX9"),
++ },
++ .driver_data = (void *)(SOF_ES8336_HEADPHONE_GPIO |
++ SOF_ES8336_ENABLE_DMIC)
++ },
+ {
+ .callback = sof_es8336_quirk_cb,
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From aa73d4a8b8199aef11d872822602166367d77773 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 09:24:05 +0000
+Subject: ASoC: sof_sdw: Add a quirk for Lenovo laptop using sidecar amps with
+ cs42l43
+
+From: Maciej Strozek <mstrozek@opensource.cirrus.com>
+
+[ Upstream commit 1425900231372acf870dd89e8d3bb4935f7f0c81 ]
+
+Add a quirk for a Lenovo laptop (SSID: 0x17aa3821) to allow using sidecar
+CS35L57 amps with CS42L43 codec.
+
+Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://patch.msgid.link/20260128092410.1540583-1-mstrozek@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 92fac7ed782f7..6c95b1f8fc1a5 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -802,6 +802,7 @@ static const struct snd_pci_quirk sof_sdw_ssid_quirk_table[] = {
+ SND_PCI_QUIRK(0x17aa, 0x2347, "Lenovo P16", SOC_SDW_CODEC_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x2348, "Lenovo P16", SOC_SDW_CODEC_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x2349, "Lenovo P1", SOC_SDW_CODEC_MIC),
++ SND_PCI_QUIRK(0x17aa, 0x3821, "Lenovo 0x3821", SOC_SDW_SIDECAR_AMPS),
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 46395bc327b47bc519b1d4fdb3a28e501626f59e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 22:44:15 -0100
+Subject: drm/amd/display: extend delta clamping logic to CM3 LUT helper
+
+From: Melissa Wen <mwen@igalia.com>
+
+[ Upstream commit d25b32aa829a3ed5570138e541a71fb7805faec3 ]
+
+Commit 27fc10d1095f ("drm/amd/display: Fix the delta clamping for shaper
+LUT") fixed banding when using plane shaper LUT in DCN10 CM helper. The
+problem is also present in DCN30 CM helper, fix banding by extending the
+same bug delta clamping fix to CM3.
+
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 0274a54897f356f9c78767c4a2a5863f7dde90c6)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/dcn30/dcn30_cm_common.c | 30 +++++++++++++++----
+ .../display/dc/dwb/dcn30/dcn30_cm_common.h | 2 +-
+ .../amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 9 +++---
+ .../amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 17 ++++++-----
+ .../amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 16 +++++-----
+ 5 files changed, 49 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
+index a4f14b16564c2..227aa8672d17b 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c
+@@ -105,9 +105,12 @@ void cm_helper_program_gamcor_xfer_func(
+ #define NUMBER_REGIONS 32
+ #define NUMBER_SW_SEGMENTS 16
+
+-bool cm3_helper_translate_curve_to_hw_format(
+- const struct dc_transfer_func *output_tf,
+- struct pwl_params *lut_params, bool fixpoint)
++#define DC_LOGGER \
++ ctx->logger
++
++bool cm3_helper_translate_curve_to_hw_format(struct dc_context *ctx,
++ const struct dc_transfer_func *output_tf,
++ struct pwl_params *lut_params, bool fixpoint)
+ {
+ struct curve_points3 *corner_points;
+ struct pwl_result_data *rgb_resulted;
+@@ -251,6 +254,10 @@ bool cm3_helper_translate_curve_to_hw_format(
+ if (fixpoint == true) {
+ i = 1;
+ while (i != hw_points + 2) {
++ uint32_t red_clamp;
++ uint32_t green_clamp;
++ uint32_t blue_clamp;
++
+ if (i >= hw_points) {
+ if (dc_fixpt_lt(rgb_plus_1->red, rgb->red))
+ rgb_plus_1->red = dc_fixpt_add(rgb->red,
+@@ -263,9 +270,20 @@ bool cm3_helper_translate_curve_to_hw_format(
+ rgb_minus_1->delta_blue);
+ }
+
+- rgb->delta_red_reg = dc_fixpt_clamp_u0d10(rgb->delta_red);
+- rgb->delta_green_reg = dc_fixpt_clamp_u0d10(rgb->delta_green);
+- rgb->delta_blue_reg = dc_fixpt_clamp_u0d10(rgb->delta_blue);
++ rgb->delta_red = dc_fixpt_sub(rgb_plus_1->red, rgb->red);
++ rgb->delta_green = dc_fixpt_sub(rgb_plus_1->green, rgb->green);
++ rgb->delta_blue = dc_fixpt_sub(rgb_plus_1->blue, rgb->blue);
++
++ red_clamp = dc_fixpt_clamp_u0d14(rgb->delta_red);
++ green_clamp = dc_fixpt_clamp_u0d14(rgb->delta_green);
++ blue_clamp = dc_fixpt_clamp_u0d14(rgb->delta_blue);
++
++ if (red_clamp >> 10 || green_clamp >> 10 || blue_clamp >> 10)
++ DC_LOG_ERROR("Losing delta precision while programming shaper LUT.");
++
++ rgb->delta_red_reg = red_clamp & 0x3ff;
++ rgb->delta_green_reg = green_clamp & 0x3ff;
++ rgb->delta_blue_reg = blue_clamp & 0x3ff;
+ rgb->red_reg = dc_fixpt_clamp_u0d14(rgb->red);
+ rgb->green_reg = dc_fixpt_clamp_u0d14(rgb->green);
+ rgb->blue_reg = dc_fixpt_clamp_u0d14(rgb->blue);
+diff --git a/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h b/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h
+index b86347c9b0389..95f9318a54efc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h
++++ b/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h
+@@ -59,7 +59,7 @@ void cm_helper_program_gamcor_xfer_func(
+ const struct pwl_params *params,
+ const struct dcn3_xfer_func_reg *reg);
+
+-bool cm3_helper_translate_curve_to_hw_format(
++bool cm3_helper_translate_curve_to_hw_format(struct dc_context *ctx,
+ const struct dc_transfer_func *output_tf,
+ struct pwl_params *lut_params, bool fixpoint);
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
+index e47ed5571dfdd..731645a2ab9aa 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
+@@ -238,7 +238,7 @@ bool dcn30_set_blend_lut(
+ if (plane_state->blend_tf.type == TF_TYPE_HWPWL)
+ blend_lut = &plane_state->blend_tf.pwl;
+ else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) {
+- result = cm3_helper_translate_curve_to_hw_format(
++ result = cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
+ &plane_state->blend_tf, &dpp_base->regamma_params, false);
+ if (!result)
+ return result;
+@@ -333,8 +333,9 @@ bool dcn30_set_input_transfer_func(struct dc *dc,
+ if (plane_state->in_transfer_func.type == TF_TYPE_HWPWL)
+ params = &plane_state->in_transfer_func.pwl;
+ else if (plane_state->in_transfer_func.type == TF_TYPE_DISTRIBUTED_POINTS &&
+- cm3_helper_translate_curve_to_hw_format(&plane_state->in_transfer_func,
+- &dpp_base->degamma_params, false))
++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->in_transfer_func,
++ &dpp_base->degamma_params, false))
+ params = &dpp_base->degamma_params;
+
+ result = dpp_base->funcs->dpp_program_gamcor_lut(dpp_base, params);
+@@ -405,7 +406,7 @@ bool dcn30_set_output_transfer_func(struct dc *dc,
+ params = &stream->out_transfer_func.pwl;
+ else if (pipe_ctx->stream->out_transfer_func.type ==
+ TF_TYPE_DISTRIBUTED_POINTS &&
+- cm3_helper_translate_curve_to_hw_format(
++ cm3_helper_translate_curve_to_hw_format(stream->ctx,
+ &stream->out_transfer_func,
+ &mpc->blender_params, false))
+ params = &mpc->blender_params;
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+index f39292952702f..30bb5d8d85dc2 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+@@ -486,8 +486,9 @@ bool dcn32_set_mcm_luts(
+ if (plane_state->blend_tf.type == TF_TYPE_HWPWL)
+ lut_params = &plane_state->blend_tf.pwl;
+ else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) {
+- result = cm3_helper_translate_curve_to_hw_format(&plane_state->blend_tf,
+- &dpp_base->regamma_params, false);
++ result = cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->blend_tf,
++ &dpp_base->regamma_params, false);
+ if (!result)
+ return result;
+
+@@ -502,8 +503,9 @@ bool dcn32_set_mcm_luts(
+ else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) {
+ // TODO: dpp_base replace
+ ASSERT(false);
+- cm3_helper_translate_curve_to_hw_format(&plane_state->in_shaper_func,
+- &dpp_base->shaper_params, true);
++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->in_shaper_func,
++ &dpp_base->shaper_params, true);
+ lut_params = &dpp_base->shaper_params;
+ }
+
+@@ -543,8 +545,9 @@ bool dcn32_set_input_transfer_func(struct dc *dc,
+ if (plane_state->in_transfer_func.type == TF_TYPE_HWPWL)
+ params = &plane_state->in_transfer_func.pwl;
+ else if (plane_state->in_transfer_func.type == TF_TYPE_DISTRIBUTED_POINTS &&
+- cm3_helper_translate_curve_to_hw_format(&plane_state->in_transfer_func,
+- &dpp_base->degamma_params, false))
++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->in_transfer_func,
++ &dpp_base->degamma_params, false))
+ params = &dpp_base->degamma_params;
+
+ dpp_base->funcs->dpp_program_gamcor_lut(dpp_base, params);
+@@ -575,7 +578,7 @@ bool dcn32_set_output_transfer_func(struct dc *dc,
+ params = &stream->out_transfer_func.pwl;
+ else if (pipe_ctx->stream->out_transfer_func.type ==
+ TF_TYPE_DISTRIBUTED_POINTS &&
+- cm3_helper_translate_curve_to_hw_format(
++ cm3_helper_translate_curve_to_hw_format(stream->ctx,
+ &stream->out_transfer_func,
+ &mpc->blender_params, false))
+ params = &mpc->blender_params;
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index 68e48a2492c9e..77cdd02a41bdd 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -427,7 +427,7 @@ void dcn401_populate_mcm_luts(struct dc *dc,
+ if (mcm_luts.lut1d_func->type == TF_TYPE_HWPWL)
+ m_lut_params.pwl = &mcm_luts.lut1d_func->pwl;
+ else if (mcm_luts.lut1d_func->type == TF_TYPE_DISTRIBUTED_POINTS) {
+- rval = cm3_helper_translate_curve_to_hw_format(
++ rval = cm3_helper_translate_curve_to_hw_format(mpc->ctx,
+ mcm_luts.lut1d_func,
+ &dpp_base->regamma_params, false);
+ m_lut_params.pwl = rval ? &dpp_base->regamma_params : NULL;
+@@ -447,7 +447,7 @@ void dcn401_populate_mcm_luts(struct dc *dc,
+ m_lut_params.pwl = &mcm_luts.shaper->pwl;
+ else if (mcm_luts.shaper->type == TF_TYPE_DISTRIBUTED_POINTS) {
+ ASSERT(false);
+- rval = cm3_helper_translate_curve_to_hw_format(
++ rval = cm3_helper_translate_curve_to_hw_format(mpc->ctx,
+ mcm_luts.shaper,
+ &dpp_base->regamma_params, true);
+ m_lut_params.pwl = rval ? &dpp_base->regamma_params : NULL;
+@@ -624,8 +624,9 @@ bool dcn401_set_mcm_luts(struct pipe_ctx *pipe_ctx,
+ if (plane_state->blend_tf.type == TF_TYPE_HWPWL)
+ lut_params = &plane_state->blend_tf.pwl;
+ else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) {
+- rval = cm3_helper_translate_curve_to_hw_format(&plane_state->blend_tf,
+- &dpp_base->regamma_params, false);
++ rval = cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->blend_tf,
++ &dpp_base->regamma_params, false);
+ lut_params = rval ? &dpp_base->regamma_params : NULL;
+ }
+ result = mpc->funcs->program_1dlut(mpc, lut_params, mpcc_id);
+@@ -636,8 +637,9 @@ bool dcn401_set_mcm_luts(struct pipe_ctx *pipe_ctx,
+ lut_params = &plane_state->in_shaper_func.pwl;
+ else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) {
+ // TODO: dpp_base replace
+- rval = cm3_helper_translate_curve_to_hw_format(&plane_state->in_shaper_func,
+- &dpp_base->shaper_params, true);
++ rval = cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
++ &plane_state->in_shaper_func,
++ &dpp_base->shaper_params, true);
+ lut_params = rval ? &dpp_base->shaper_params : NULL;
+ }
+ result &= mpc->funcs->program_shaper(mpc, lut_params, mpcc_id);
+@@ -671,7 +673,7 @@ bool dcn401_set_output_transfer_func(struct dc *dc,
+ params = &stream->out_transfer_func.pwl;
+ else if (pipe_ctx->stream->out_transfer_func.type ==
+ TF_TYPE_DISTRIBUTED_POINTS &&
+- cm3_helper_translate_curve_to_hw_format(
++ cm3_helper_translate_curve_to_hw_format(stream->ctx,
+ &stream->out_transfer_func,
+ &mpc->blender_params, false))
+ params = &mpc->blender_params;
+--
+2.51.0
+
--- /dev/null
+From fb093781cddecda2bcbc315ec0d4c136512ea1cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 12:50:49 -0300
+Subject: drm/amd/display: remove assert around dpp_base replacement
+
+From: Melissa Wen <mwen@igalia.com>
+
+[ Upstream commit 84962445cd8a83dc5bed4c8ad5bbb2c1cdb249a0 ]
+
+There is nothing wrong if in_shaper_func type is DISTRIBUTED POINTS.
+Remove the assert placed for a TODO to avoid misinterpretations.
+
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1714dcc4c2c53e41190896eba263ed6328bcf415)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+index 30bb5d8d85dc2..c6fde355ac823 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+@@ -502,7 +502,6 @@ bool dcn32_set_mcm_luts(
+ lut_params = &plane_state->in_shaper_func.pwl;
+ else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) {
+ // TODO: dpp_base replace
+- ASSERT(false);
+ cm3_helper_translate_curve_to_hw_format(plane_state->ctx,
+ &plane_state->in_shaper_func,
+ &dpp_base->shaper_params, true);
+--
+2.51.0
+
--- /dev/null
+From fafdbb84e207df6f7b3cb02535c763f89bec9a12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 02:50:20 +0530
+Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?=
+ =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ]
+
+The variable j is set, however never used in or outside the loop, thus
+resulting in dead code.
+Building with GCC 16 results in a build error due to
+-Werror=unused-but-set-variable= enabled by default.
+This patch clean up the dead code and fixes the build error.
+
+Example build log:
+drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=]
+ 1867 | size_t i, j;
+ | ^
+
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/hdmi.c | 4 ++--
+ drivers/gpu/drm/tegra/sor.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
+index 8cd2969e7d4bf..c4820f5e76581 100644
+--- a/drivers/gpu/drm/tegra/hdmi.c
++++ b/drivers/gpu/drm/tegra/hdmi.c
+@@ -658,7 +658,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -691,7 +691,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_hdmi_subpack(&ptr[i], num);
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index 21f3dfdcc5c95..bc7dd562cf6b6 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -1864,7 +1864,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -1897,7 +1897,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_sor_hdmi_subpack(&ptr[i], num);
+--
+2.51.0
+
--- /dev/null
+From e87a21da5ad98b2c15339f6b574284a5aa225a3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 17:42:09 +0800
+Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock
+
+From: Xuewen Yan <xuewen.yan@unisoc.com>
+
+[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ]
+
+There was a lockdep warning in sprd_gpio:
+
+[ 6.258269][T329@C6] [ BUG: Invalid wait context ]
+[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE
+[ 6.258272][T329@C6] -----------------------------
+[ 6.258273][T329@C6] modprobe/329 is trying to lock:
+[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd]
+[ 6.258282][T329@C6] other info that might help us debug this:
+[ 6.258283][T329@C6] context-{5:5}
+[ 6.258285][T329@C6] 3 locks held by modprobe/329:
+[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204
+[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c
+[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c
+[ 6.258313][T329@C6] stack backtrace:
+[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df
+[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT)
+[ 6.258318][T329@C6] Call trace:
+[ 6.258318][T329@C6] show_stack+0x20/0x30 (C)
+[ 6.258321][T329@C6] __dump_stack+0x28/0x3c
+[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0
+[ 6.258326][T329@C6] dump_stack+0x18/0x3c
+[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28
+[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc
+[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4
+[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487]
+[ 6.258337][T329@C6] irq_startup+0x238/0x350
+[ 6.258340][T329@C6] __setup_irq+0x504/0x82c
+[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184
+[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120
+[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350
+[ 6.258361][T329@C6] really_probe+0x1a8/0x46c
+[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c
+[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4
+[ 6.258369][T329@C6] __driver_attach+0xd0/0x204
+[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168
+[ 6.258373][T329@C6] driver_attach+0x2c/0x3c
+[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c
+[ 6.258378][T329@C6] driver_register+0x70/0x10c
+[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8
+[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c
+[ 6.258392][T329@C6] do_init_module+0x60/0x254
+[ 6.258395][T329@C6] load_module+0x1054/0x1220
+[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c
+[ 6.258400][T329@C6] invoke_syscall+0x60/0xec
+[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4
+[ 6.258405][T329@C6] do_el0_svc+0x24/0x30
+[ 6.258407][T329@C6] el0_svc+0x54/0x1c4
+[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc
+[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8
+
+This is because the spin_lock would change to rt_mutex in PREEMPT_RT,
+however the sprd_gpio->lock would use in hard-irq, this is unsafe.
+
+So change the spin_lock_t to raw_spin_lock_t to use the spinlock
+in hard-irq.
+
+Signed-off-by: Xuewen Yan <xuewen.yan@unisoc.com>
+Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com
+[Bartosz: tweaked the commit message]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-sprd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c
+index 413bcd0a42405..2cc8abe705cdb 100644
+--- a/drivers/gpio/gpio-sprd.c
++++ b/drivers/gpio/gpio-sprd.c
+@@ -35,7 +35,7 @@
+ struct sprd_gpio {
+ struct gpio_chip chip;
+ void __iomem *base;
+- spinlock_t lock;
++ raw_spinlock_t lock;
+ int irq;
+ };
+
+@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ unsigned long flags;
+ u32 tmp;
+
+- spin_lock_irqsave(&sprd_gpio->lock, flags);
++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags);
+ tmp = readl_relaxed(base + reg);
+
+ if (val)
+@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ tmp &= ~BIT(SPRD_GPIO_BIT(offset));
+
+ writel_relaxed(tmp, base + reg);
+- spin_unlock_irqrestore(&sprd_gpio->lock, flags);
++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags);
+ }
+
+ static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg)
+@@ -236,7 +236,7 @@ static int sprd_gpio_probe(struct platform_device *pdev)
+ if (IS_ERR(sprd_gpio->base))
+ return PTR_ERR(sprd_gpio->base);
+
+- spin_lock_init(&sprd_gpio->lock);
++ raw_spin_lock_init(&sprd_gpio->lock);
+
+ sprd_gpio->chip.label = dev_name(&pdev->dev);
+ sprd_gpio->chip.ngpio = SPRD_GPIO_NR;
+--
+2.51.0
+
--- /dev/null
+From 6ee63d16b3758c268d7cf0044585b61f62af1673 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 15:59:44 +0100
+Subject: gpiolib: acpi: Fix gpio count with string references
+
+From: Alban Bedel <alban.bedel@lht.dlh.de>
+
+[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ]
+
+Since commit 9880702d123f2 ("ACPI: property: Support using strings in
+reference properties") it is possible to use strings instead of local
+references. This work fine with single GPIO but not with arrays as
+acpi_gpio_package_count() didn't handle this case. Update it to handle
+strings like local references to cover this case as well.
+
+Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-acpi-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpiolib-acpi-core.c b/drivers/gpio/gpiolib-acpi-core.c
+index e64e21fd6bbaa..8110690ea69d0 100644
+--- a/drivers/gpio/gpiolib-acpi-core.c
++++ b/drivers/gpio/gpiolib-acpi-core.c
+@@ -1359,6 +1359,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj)
+ while (element < end) {
+ switch (element->type) {
+ case ACPI_TYPE_LOCAL_REFERENCE:
++ case ACPI_TYPE_STRING:
+ element += 3;
+ fallthrough;
+ case ACPI_TYPE_INTEGER:
+--
+2.51.0
+
--- /dev/null
+From 920a7cd7e57c7a1b52932e6a2129c752a712cfbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 09:56:55 -0700
+Subject: io_uring/fdinfo: be a bit nicer when looping a lot of SQEs/CQEs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 38cfdd9dd279473a73814df9fd7e6e716951d361 ]
+
+Add cond_resched() in those dump loops, just in case a lot of entries
+are being dumped. And detect invalid CQ ring head/tail entries, to avoid
+iterating more than what is necessary. Generally not an issue, but can be
+if things like KASAN or other debugging metrics are enabled.
+
+Reported-by: 是参差 <shicenci@gmail.com>
+Link: https://lore.kernel.org/all/PS1PPF7E1D7501FE5631002D242DD89403FAB9BA@PS1PPF7E1D7501F.apcprd02.prod.outlook.com/
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/fdinfo.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
+index 294c75a8a3bdb..3585ad8308504 100644
+--- a/io_uring/fdinfo.c
++++ b/io_uring/fdinfo.c
+@@ -65,7 +65,7 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
+ unsigned int cq_head = READ_ONCE(r->cq.head);
+ unsigned int cq_tail = READ_ONCE(r->cq.tail);
+ unsigned int sq_shift = 0;
+- unsigned int sq_entries;
++ unsigned int cq_entries, sq_entries;
+ int sq_pid = -1, sq_cpu = -1;
+ u64 sq_total_time = 0, sq_work_time = 0;
+ unsigned int i;
+@@ -119,9 +119,11 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
+ }
+ }
+ seq_printf(m, "\n");
++ cond_resched();
+ }
+ seq_printf(m, "CQEs:\t%u\n", cq_tail - cq_head);
+- while (cq_head < cq_tail) {
++ cq_entries = min(cq_tail - cq_head, ctx->cq_entries);
++ for (i = 0; i < cq_entries; i++) {
+ struct io_uring_cqe *cqe;
+ bool cqe32 = false;
+
+@@ -136,8 +138,11 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
+ cqe->big_cqe[0], cqe->big_cqe[1]);
+ seq_printf(m, "\n");
+ cq_head++;
+- if (cqe32)
++ if (cqe32) {
+ cq_head++;
++ i++;
++ }
++ cond_resched();
+ }
+
+ if (ctx->flags & IORING_SETUP_SQPOLL) {
+--
+2.51.0
+
--- /dev/null
+From 4c258258b4135777af1a8860cd258b56754b0ad0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 23:55:00 +0800
+Subject: platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: gongqi <550230171hxy@gmail.com>
+
+[ Upstream commit 2b4e00d8e70ca8736fda82447be6a4e323c6d1f5 ]
+
+The MECHREVO Wujie 15X Pro suffers from spurious IRQ issues related to
+the AMD PMC. Add it to the quirk list to use the spurious_8042 fix.
+
+Signed-off-by: gongqi <550230171hxy@gmail.com>
+Link: https://patch.msgid.link/20260122155501.376199-4-550230171hxy@gmail.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index 404e62ad293a9..ed285afaf9b0d 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -302,6 +302,13 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "XxKK4NAx_XxSP4NAx"),
+ }
+ },
++ {
++ .ident = "MECHREVO Wujie 15X Pro",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"),
++ }
++ },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 4f0d5726c042fc458509e6dcfacb3b6946d96425 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 21:02:40 +0100
+Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ]
+
+In a few places in the Classmate laptop driver, code using the accel
+object may run before that object's address is stored in the driver
+data of the input device using it.
+
+For example, cmpc_accel_sensitivity_store_v4() is the "show" method
+of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(),
+before calling dev_set_drvdata() for inputdev->dev. If the sysfs
+attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev)
+call in in cmpc_accel_sensitivity_store_v4() returns NULL which
+leads to a NULL pointer dereference going forward.
+
+Moreover, sysfs attributes using the input device are added before
+initializing that device by cmpc_add_acpi_notify_device() and if one
+of them is accessed before running that function, a NULL pointer
+dereference will occur.
+
+For example, cmpc_accel_sensitivity_attr_v4 is added before calling
+cmpc_add_acpi_notify_device() and if it is read prematurely, the
+dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4()
+returns NULL which leads to a NULL pointer dereference going forward.
+
+Fix this by adding NULL pointer checks in all of the relevant places.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c
+index 6b1b8e444e241..74d3eb83f56a6 100644
+--- a/drivers/platform/x86/classmate-laptop.c
++++ b/drivers/platform/x86/classmate-laptop.c
+@@ -207,7 +207,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sysfs_emit(buf, "%d\n", accel->sensitivity);
+ }
+@@ -224,7 +229,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+@@ -256,7 +266,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sysfs_emit(buf, "%d\n", accel->g_select);
+ }
+@@ -273,7 +288,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &g_select);
+ if (r)
+@@ -302,6 +322,8 @@ static int cmpc_accel_open_v4(struct input_dev *input)
+
+ acpi = to_acpi_device(input->dev.parent);
+ accel = dev_get_drvdata(&input->dev);
++ if (!accel)
++ return -ENXIO;
+
+ cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity);
+ cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select);
+@@ -549,7 +571,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sysfs_emit(buf, "%d\n", accel->sensitivity);
+ }
+@@ -566,7 +593,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+--
+2.51.0
+
--- /dev/null
+From df8e97a1b8952a6bf1fbabef9c0defdfcf625b9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 16:43:44 +0100
+Subject: platform/x86: panasonic-laptop: Fix sysfs group leak in error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 43b0b7eff4b3fb684f257d5a24376782e9663465 ]
+
+The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group
+if platform_device_register_simple() fails for the "panasonic" platform
+device.
+
+Address this by making it call sysfs_remove_group() in that case for
+the group in question.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/panasonic-laptop.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
+index 255317e6fec88..937f1a5b78edf 100644
+--- a/drivers/platform/x86/panasonic-laptop.c
++++ b/drivers/platform/x86/panasonic-laptop.c
+@@ -1089,7 +1089,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
+ PLATFORM_DEVID_NONE, NULL, 0);
+ if (IS_ERR(pcc->platform)) {
+ result = PTR_ERR(pcc->platform);
+- goto out_backlight;
++ goto out_sysfs;
+ }
+ result = device_create_file(&pcc->platform->dev,
+ &dev_attr_cdpower);
+@@ -1105,6 +1105,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
+
+ out_platform:
+ platform_device_unregister(pcc->platform);
++out_sysfs:
++ sysfs_remove_group(&device->dev.kobj, &pcc_attr_group);
+ out_backlight:
+ backlight_device_unregister(pcc->backlight);
+ out_input:
+--
+2.51.0
+
--- /dev/null
+From c17f576c03fbe15031d5e494c10bdec2881a7bc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:10:37 +0530
+Subject: romfs: check sb_set_blocksize() return value
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ]
+
+romfs_fill_super() ignores the return value of sb_set_blocksize(), which
+can fail if the requested block size is incompatible with the block
+device's configuration.
+
+This can be triggered by setting a loop device's block size larger than
+PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs
+filesystem on that device.
+
+When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the
+device has logical_block_size=32768, bdev_validate_blocksize() fails
+because the requested size is smaller than the device's logical block
+size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and
+continues mounting.
+
+The superblock's block size remains at the device's logical block size
+(32768). Later, when sb_bread() attempts I/O with this oversized block
+size, it triggers a kernel BUG in folio_set_bh():
+
+ kernel BUG at fs/buffer.c:1582!
+ BUG_ON(size > PAGE_SIZE);
+
+Fix by checking the return value of sb_set_blocksize() and failing the
+mount with -EINVAL if it returns 0.
+
+Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/romfs/super.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/romfs/super.c b/fs/romfs/super.c
+index 0addcc849ff2c..e83f9b78d7a16 100644
+--- a/fs/romfs/super.c
++++ b/fs/romfs/super.c
+@@ -458,7 +458,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc)
+
+ #ifdef CONFIG_BLOCK
+ if (!sb->s_mtd) {
+- sb_set_blocksize(sb, ROMBSIZE);
++ if (!sb_set_blocksize(sb, ROMBSIZE)) {
++ errorf(fc, "romfs: unable to set blocksize\n");
++ return -EINVAL;
++ }
+ } else {
+ sb->s_blocksize = ROMBSIZE;
+ sb->s_blocksize_bits = blksize_bits(ROMBSIZE);
+--
+2.51.0
+
--- /dev/null
+asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch
+gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch
+alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch
+asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch
+alsa-hda-realtek-fixed-speaker-no-sound.patch
+romfs-check-sb_set_blocksize-return-value.patch
+drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch
+platform-x86-classmate-laptop-add-missing-null-point.patch
+asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch
+asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch
+alsa-hda-realtek-enable-headset-mic-for-acer-nitro-5.patch
+platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch
+asoc-sof_sdw-add-a-quirk-for-lenovo-laptop-using-sid.patch
+platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch
+asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch
+tracing-dma-cap-dma_map_sg-tracepoint-arrays-to-prev.patch
+drm-amd-display-extend-delta-clamping-logic-to-cm3-l.patch
+drm-amd-display-remove-assert-around-dpp_base-replac.patch
+asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch
+io_uring-fdinfo-be-a-bit-nicer-when-looping-a-lot-of.patch
+gpiolib-acpi-fix-gpio-count-with-string-references.patch
--- /dev/null
+From 941a3f6cd3596661e8ee7b9085461220640d2608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 21:22:15 +0530
+Subject: tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer
+ overflow
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit daafcc0ef0b358d9d622b6e3b7c43767aa3814ee ]
+
+The dma_map_sg tracepoint can trigger a perf buffer overflow when
+tracing large scatter-gather lists. With devices like virtio-gpu
+creating large DRM buffers, nents can exceed 1000 entries, resulting
+in:
+
+ phys_addrs: 1000 * 8 bytes = 8,000 bytes
+ dma_addrs: 1000 * 8 bytes = 8,000 bytes
+ lengths: 1000 * 4 bytes = 4,000 bytes
+ Total: ~20,000 bytes
+
+This exceeds PERF_MAX_TRACE_SIZE (8192 bytes), causing:
+
+ WARNING: CPU: 0 PID: 5497 at kernel/trace/trace_event_perf.c:405
+ perf buffer not large enough, wanted 24620, have 8192
+
+Cap all three dynamic arrays at 128 entries using min() in the array
+size calculation. This ensures arrays are only as large as needed
+(up to the cap), avoiding unnecessary memory allocation for small
+operations while preventing overflow for large ones.
+
+The tracepoint now records the full nents/ents counts and a truncated
+flag so users can see when data has been capped.
+
+Changes in v2:
+- Use min(nents, DMA_TRACE_MAX_ENTRIES) for dynamic array sizing
+ instead of fixed DMA_TRACE_MAX_ENTRIES allocation (feedback from
+ Steven Rostedt)
+- This allocates only what's needed up to the cap, avoiding waste
+ for small operations
+
+Reported-by: syzbot+28cea38c382fd15e751a@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=28cea38c382fd15e751a
+Tested-by: syzbot+28cea38c382fd15e751a@syzkaller.appspotmail.com
+Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
+Reviwed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20260130155215.69737-1-kartikey406@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/dma.h | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/include/trace/events/dma.h b/include/trace/events/dma.h
+index b3fef140ae155..33e99e792f1aa 100644
+--- a/include/trace/events/dma.h
++++ b/include/trace/events/dma.h
+@@ -275,6 +275,8 @@ TRACE_EVENT(dma_free_sgt,
+ sizeof(u64), sizeof(u64)))
+ );
+
++#define DMA_TRACE_MAX_ENTRIES 128
++
+ TRACE_EVENT(dma_map_sg,
+ TP_PROTO(struct device *dev, struct scatterlist *sgl, int nents,
+ int ents, enum dma_data_direction dir, unsigned long attrs),
+@@ -282,9 +284,12 @@ TRACE_EVENT(dma_map_sg,
+
+ TP_STRUCT__entry(
+ __string(device, dev_name(dev))
+- __dynamic_array(u64, phys_addrs, nents)
+- __dynamic_array(u64, dma_addrs, ents)
+- __dynamic_array(unsigned int, lengths, ents)
++ __field(int, full_nents)
++ __field(int, full_ents)
++ __field(bool, truncated)
++ __dynamic_array(u64, phys_addrs, min(nents, DMA_TRACE_MAX_ENTRIES))
++ __dynamic_array(u64, dma_addrs, min(ents, DMA_TRACE_MAX_ENTRIES))
++ __dynamic_array(unsigned int, lengths, min(ents, DMA_TRACE_MAX_ENTRIES))
+ __field(enum dma_data_direction, dir)
+ __field(unsigned long, attrs)
+ ),
+@@ -292,11 +297,16 @@ TRACE_EVENT(dma_map_sg,
+ TP_fast_assign(
+ struct scatterlist *sg;
+ int i;
++ int traced_nents = min_t(int, nents, DMA_TRACE_MAX_ENTRIES);
++ int traced_ents = min_t(int, ents, DMA_TRACE_MAX_ENTRIES);
+
+ __assign_str(device);
+- for_each_sg(sgl, sg, nents, i)
++ __entry->full_nents = nents;
++ __entry->full_ents = ents;
++ __entry->truncated = (nents > DMA_TRACE_MAX_ENTRIES) || (ents > DMA_TRACE_MAX_ENTRIES);
++ for_each_sg(sgl, sg, traced_nents, i)
+ ((u64 *)__get_dynamic_array(phys_addrs))[i] = sg_phys(sg);
+- for_each_sg(sgl, sg, ents, i) {
++ for_each_sg(sgl, sg, traced_ents, i) {
+ ((u64 *)__get_dynamic_array(dma_addrs))[i] =
+ sg_dma_address(sg);
+ ((unsigned int *)__get_dynamic_array(lengths))[i] =
+@@ -306,9 +316,12 @@ TRACE_EVENT(dma_map_sg,
+ __entry->attrs = attrs;
+ ),
+
+- TP_printk("%s dir=%s dma_addrs=%s sizes=%s phys_addrs=%s attrs=%s",
++ TP_printk("%s dir=%s nents=%d/%d ents=%d/%d%s dma_addrs=%s sizes=%s phys_addrs=%s attrs=%s",
+ __get_str(device),
+ decode_dma_data_direction(__entry->dir),
++ min_t(int, __entry->full_nents, DMA_TRACE_MAX_ENTRIES), __entry->full_nents,
++ min_t(int, __entry->full_ents, DMA_TRACE_MAX_ENTRIES), __entry->full_ents,
++ __entry->truncated ? " [TRUNCATED]" : "",
+ __print_array(__get_dynamic_array(dma_addrs),
+ __get_dynamic_array_len(dma_addrs) /
+ sizeof(u64), sizeof(u64)),
+--
+2.51.0
+
--- /dev/null
+From d9abe35e7ae5566756f28bc4ca97afbd8a41dcb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 15:35:08 +0800
+Subject: ALSA: hda/realtek: Add quirk for Inspur S14-G1
+
+From: Zhang Heng <zhangheng@kylinos.cn>
+
+[ Upstream commit 9e18920e783d0bcd4c127a7adc66565243ab9655 ]
+
+Inspur S14-G1 is equipped with ALC256.
+Enable "power saving mode" and Enable "headset jack mode".
+
+Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
+Link: https://patch.msgid.link/20260126073508.3897461-2-zhangheng@kylinos.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 95e650493dc5b..5b836a91135cc 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10650,6 +10650,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x2039, 0x0001, "Inspur S14-G1", ALC295_FIXUP_CHROME_BOOK),
+ SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13),
+ SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO),
+--
+2.51.0
+
--- /dev/null
+From a12da3fbfa1440eb141709daf703c14db8285072 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 16:15:55 +0100
+Subject: ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
+
+From: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+
+[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ]
+
+Add a PCI quirk to enable microphone detection on the headphone jack of
+TongFang X6AR55xU devices.
+
+Signed-off-by: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260119151626.35481-1-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c60358a4a7572..95e650493dc5b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -11102,6 +11102,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60140},
+ {0x19, 0x04a11030},
+ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC,
++ {0x17, 0x90170110},
++ {0x19, 0x03a11030},
++ {0x21, 0x03211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT,
+ ALC282_STANDARD_PINS,
+ {0x12, 0x90a609c0},
+--
+2.51.0
+
--- /dev/null
+From ac28dac04a3e3654777d7dd6ce90ee54fd9e3928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 15:56:18 +0100
+Subject: ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
+
+From: Anatolii Shirykalov <pipocavsobake@gmail.com>
+
+[ Upstream commit 018b211b1d321a52ed8d8de74ce83ce52a2e1224 ]
+
+Add ASUS ExpertBook PM1503CDA to the DMI quirks table to enable
+internal DMIC support via the ACP6x machine driver.
+
+Signed-off-by: Anatolii Shirykalov <pipocavsobake@gmail.com>
+Link: https://patch.msgid.link/20260119145618.3171435-1-pipocavsobake@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index b0456be5d921a..92d0d39d39d9a 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -535,6 +535,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "15NBC1011"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK PM1503CDA"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 16941b333621c03f5b579beaac30660372b46be9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 14:50:19 +0800
+Subject: ASoC: amd: yc: Add quirk for HP 200 G2a 16
+
+From: Dirk Su <dirk.su@canonical.com>
+
+[ Upstream commit 611c7d2262d5645118e0b3a9a88475d35a8366f2 ]
+
+Fix the missing mic on HP 200 G2a 16 by adding quirk with the
+board ID 8EE4
+
+Signed-off-by: Dirk Su <dirk.su@canonical.com>
+Link: https://patch.msgid.link/20260129065038.39349-1-dirk.su@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index 92d0d39d39d9a..b6068d289f5f9 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -633,6 +633,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "8BD6"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"),
++ DMI_MATCH(DMI_BOARD_NAME, "8EE4"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From d5b2d9f26b89b6effa9692b09fc10ecf173c6623 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 19:25:10 +0000
+Subject: ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel
+
+From: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
+
+[ Upstream commit 6dd0fdc908c02318c28ec2c0979661846ee0a9f7 ]
+
+ASP_TX5 was incorrectly mapped to a channel value of 3 corrects,
+the channel value of 4.
+
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260115192523.1335742-2-rriveram@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l45.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs35l45.c b/sound/soc/codecs/cs35l45.c
+index 7e439c778c6b4..11e28c340a709 100644
+--- a/sound/soc/codecs/cs35l45.c
++++ b/sound/soc/codecs/cs35l45.c
+@@ -316,7 +316,7 @@ static const struct snd_soc_dapm_widget cs35l45_dapm_widgets[] = {
+ SND_SOC_DAPM_AIF_OUT("ASP_TX2", NULL, 1, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX2_EN_SHIFT, 0),
+ SND_SOC_DAPM_AIF_OUT("ASP_TX3", NULL, 2, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX3_EN_SHIFT, 0),
+ SND_SOC_DAPM_AIF_OUT("ASP_TX4", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX4_EN_SHIFT, 0),
+- SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0),
++ SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 4, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0),
+
+ SND_SOC_DAPM_MUX("ASP_TX1 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[0]),
+ SND_SOC_DAPM_MUX("ASP_TX2 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[1]),
+--
+2.51.0
+
--- /dev/null
+From 826fcbea5e378a3fc1171d00818d4b41b473435c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 15:09:27 +0000
+Subject: ASoC: cs42l43: Correct handling of 3-pole jack load detection
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit e77a4081d7e324dfa876a9560b2a78969446ba82 ]
+
+The load detection process for 3-pole jacks requires slightly
+updated reference values to ensure an accurate result. Update
+the code to apply different tunings for the 3-pole and 4-pole
+cases. This also updates the thresholds overall so update the
+relevant comments to match.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260130150927.2964664-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l43-jack.c | 37 +++++++++++++++++++++++++++------
+ 1 file changed, 31 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/cs42l43-jack.c b/sound/soc/codecs/cs42l43-jack.c
+index 6d8455c1bee6d..f58d55d77693f 100644
+--- a/sound/soc/codecs/cs42l43-jack.c
++++ b/sound/soc/codecs/cs42l43-jack.c
+@@ -496,7 +496,23 @@ void cs42l43_bias_sense_timeout(struct work_struct *work)
+ pm_runtime_put_autosuspend(priv->dev);
+ }
+
+-static void cs42l43_start_load_detect(struct cs42l43_codec *priv)
++static const struct reg_sequence cs42l43_3pole_patch[] = {
++ { 0x4000, 0x00000055 },
++ { 0x4000, 0x000000AA },
++ { 0x17420, 0x8500F300 },
++ { 0x17424, 0x36003E00 },
++ { 0x4000, 0x00000000 },
++};
++
++static const struct reg_sequence cs42l43_4pole_patch[] = {
++ { 0x4000, 0x00000055 },
++ { 0x4000, 0x000000AA },
++ { 0x17420, 0x7800E600 },
++ { 0x17424, 0x36003800 },
++ { 0x4000, 0x00000000 },
++};
++
++static void cs42l43_start_load_detect(struct cs42l43_codec *priv, bool mic)
+ {
+ struct cs42l43 *cs42l43 = priv->core;
+
+@@ -520,6 +536,15 @@ static void cs42l43_start_load_detect(struct cs42l43_codec *priv)
+ dev_err(priv->dev, "Load detect HP power down timed out\n");
+ }
+
++ if (mic)
++ regmap_multi_reg_write_bypassed(cs42l43->regmap,
++ cs42l43_4pole_patch,
++ ARRAY_SIZE(cs42l43_4pole_patch));
++ else
++ regmap_multi_reg_write_bypassed(cs42l43->regmap,
++ cs42l43_3pole_patch,
++ ARRAY_SIZE(cs42l43_3pole_patch));
++
+ regmap_update_bits(cs42l43->regmap, CS42L43_BLOCK_EN3,
+ CS42L43_ADC1_EN_MASK | CS42L43_ADC2_EN_MASK, 0);
+ regmap_update_bits(cs42l43->regmap, CS42L43_DACCNFG2, CS42L43_HP_HPF_EN_MASK, 0);
+@@ -598,7 +623,7 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic)
+
+ reinit_completion(&priv->load_detect);
+
+- cs42l43_start_load_detect(priv);
++ cs42l43_start_load_detect(priv, mic);
+ time_left = wait_for_completion_timeout(&priv->load_detect,
+ msecs_to_jiffies(CS42L43_LOAD_TIMEOUT_MS));
+ cs42l43_stop_load_detect(priv);
+@@ -622,11 +647,11 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic)
+ }
+
+ switch (val & CS42L43_AMP3_RES_DET_MASK) {
+- case 0x0: // low impedance
+- case 0x1: // high impedance
++ case 0x0: // < 22 Ohm impedance
++ case 0x1: // < 150 Ohm impedance
++ case 0x2: // < 1000 Ohm impedance
+ return CS42L43_JACK_HEADPHONE;
+- case 0x2: // lineout
+- case 0x3: // Open circuit
++ case 0x3: // > 1000 Ohm impedance
+ return CS42L43_JACK_LINEOUT;
+ default:
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 430b58f8482dd7cddd4fa5508cd6e321f5a4141d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:41:12 +0000
+Subject: ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit f514248727606b9087bc38a284ff686e0093abf1 ]
+
+fsl_xcvr_activate_ctl() has
+lockdep_assert_held(&card->snd_card->controls_rwsem),
+but fsl_xcvr_mode_put() calls it without acquiring this lock.
+
+Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and
+fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read().
+
+Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl()
+in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential
+race conditions when multiple userspace threads access the control.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Link: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_xcvr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
+index 90a0a24c05d84..3a5ab8b536728 100644
+--- a/sound/soc/fsl/fsl_xcvr.c
++++ b/sound/soc/fsl/fsl_xcvr.c
+@@ -206,10 +206,13 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol,
+
+ xcvr->mode = snd_soc_enum_item_to_val(e, item[0]);
+
++ down_read(&card->snd_card->controls_rwsem);
+ fsl_xcvr_activate_ctl(dai, fsl_xcvr_arc_mode_kctl.name,
+ (xcvr->mode == FSL_XCVR_MODE_ARC));
+ fsl_xcvr_activate_ctl(dai, fsl_xcvr_earc_capds_kctl.name,
+ (xcvr->mode == FSL_XCVR_MODE_EARC));
++ up_read(&card->snd_card->controls_rwsem);
++
+ /* Allow playback for SPDIF only */
+ rtd = snd_soc_get_pcm_runtime(card, card->dai_link);
+ rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count =
+--
+2.51.0
+
--- /dev/null
+From 99dc26f6a5e31ee3e1a9092a575a3e23e28f25bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Feb 2026 15:17:28 +0300
+Subject: ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
+
+From: Tagir Garaev <tgaraev653@gmail.com>
+
+[ Upstream commit 6b641122d31f9d33e7d60047ee0586d1659f3f54 ]
+
+Add DMI entry for Huawei Matebook D (BOD-WXX9) with HEADPHONE_GPIO
+and DMIC quirks.
+
+This device has ES8336 codec with:
+- GPIO 16 (headphone-enable) for headphone amplifier control
+- GPIO 17 (speakers-enable) for speaker amplifier control
+- GPIO 269 for jack detection IRQ
+- 2-channel DMIC
+
+Hardware investigation shows that both GPIO 16 and 17 are required
+for proper audio routing, as headphones and speakers share the same
+physical output (HPOL/HPOR) and are separated only via amplifier
+enable signals.
+
+RFC: Seeking advice on GPIO control issue:
+
+GPIO values change in driver (gpiod_get_value() shows logical value
+changes) but not physically (debugfs gpio shows no change). The same
+gpiod_set_value_cansleep() calls work correctly in probe context with
+msleep(), but fail when called from DAPM event callbacks.
+
+Context information from diagnostics:
+- in_atomic=0, in_interrupt=0, irqs_disabled=0
+- Process context: pipewire
+- GPIO 17 (speakers): changes in driver, no physical change
+- GPIO 16 (headphone): changes in driver, no physical change
+
+In Windows, audio switching works without visible GPIO changes,
+suggesting possible ACPI/firmware involvement.
+
+Any suggestions on how to properly control these GPIOs from DAPM
+events would be appreciated.
+
+Signed-off-by: Tagir Garaev <tgaraev653@gmail.com>
+Link: https://patch.msgid.link/20260201121728.16597-1-tgaraev653@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_es8336.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
+index c9d9381c76796..02b74ab62ff58 100644
+--- a/sound/soc/intel/boards/sof_es8336.c
++++ b/sound/soc/intel/boards/sof_es8336.c
+@@ -332,6 +332,15 @@ static int sof_es8336_quirk_cb(const struct dmi_system_id *id)
+ * if the topology file is modified as well.
+ */
+ static const struct dmi_system_id sof_es8336_quirk_table[] = {
++ {
++ .callback = sof_es8336_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HUAWEI"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "BOD-WXX9"),
++ },
++ .driver_data = (void *)(SOF_ES8336_HEADPHONE_GPIO |
++ SOF_ES8336_ENABLE_DMIC)
++ },
+ {
+ .callback = sof_es8336_quirk_cb,
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 58c643f85c8a07df90800975a857d8433d1808d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 02:50:20 +0530
+Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?=
+ =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ]
+
+The variable j is set, however never used in or outside the loop, thus
+resulting in dead code.
+Building with GCC 16 results in a build error due to
+-Werror=unused-but-set-variable= enabled by default.
+This patch clean up the dead code and fixes the build error.
+
+Example build log:
+drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=]
+ 1867 | size_t i, j;
+ | ^
+
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/hdmi.c | 4 ++--
+ drivers/gpu/drm/tegra/sor.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
+index 58c2ba94e7dd6..2451c9b67024d 100644
+--- a/drivers/gpu/drm/tegra/hdmi.c
++++ b/drivers/gpu/drm/tegra/hdmi.c
+@@ -656,7 +656,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -689,7 +689,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_hdmi_subpack(&ptr[i], num);
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index 61b437a84806e..1b03f8ca80a10 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -1861,7 +1861,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ {
+ const u8 *ptr = data;
+ unsigned long offset;
+- size_t i, j;
++ size_t i;
+ u32 value;
+
+ switch (ptr[0]) {
+@@ -1894,7 +1894,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor,
+ * - subpack_low: bytes 0 - 3
+ * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00)
+ */
+- for (i = 3, j = 0; i < size; i += 7, j += 8) {
++ for (i = 3; i < size; i += 7) {
+ size_t rem = size - i, num = min_t(size_t, rem, 4);
+
+ value = tegra_sor_hdmi_subpack(&ptr[i], num);
+--
+2.51.0
+
--- /dev/null
+From bb9ddd3829ce81028fe4db78b9b85e6238b45613 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 17:42:09 +0800
+Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock
+
+From: Xuewen Yan <xuewen.yan@unisoc.com>
+
+[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ]
+
+There was a lockdep warning in sprd_gpio:
+
+[ 6.258269][T329@C6] [ BUG: Invalid wait context ]
+[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE
+[ 6.258272][T329@C6] -----------------------------
+[ 6.258273][T329@C6] modprobe/329 is trying to lock:
+[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd]
+[ 6.258282][T329@C6] other info that might help us debug this:
+[ 6.258283][T329@C6] context-{5:5}
+[ 6.258285][T329@C6] 3 locks held by modprobe/329:
+[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204
+[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c
+[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c
+[ 6.258313][T329@C6] stack backtrace:
+[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df
+[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT)
+[ 6.258318][T329@C6] Call trace:
+[ 6.258318][T329@C6] show_stack+0x20/0x30 (C)
+[ 6.258321][T329@C6] __dump_stack+0x28/0x3c
+[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0
+[ 6.258326][T329@C6] dump_stack+0x18/0x3c
+[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28
+[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc
+[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4
+[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487]
+[ 6.258337][T329@C6] irq_startup+0x238/0x350
+[ 6.258340][T329@C6] __setup_irq+0x504/0x82c
+[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184
+[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120
+[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350
+[ 6.258361][T329@C6] really_probe+0x1a8/0x46c
+[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c
+[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4
+[ 6.258369][T329@C6] __driver_attach+0xd0/0x204
+[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168
+[ 6.258373][T329@C6] driver_attach+0x2c/0x3c
+[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c
+[ 6.258378][T329@C6] driver_register+0x70/0x10c
+[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8
+[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99]
+[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c
+[ 6.258392][T329@C6] do_init_module+0x60/0x254
+[ 6.258395][T329@C6] load_module+0x1054/0x1220
+[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c
+[ 6.258400][T329@C6] invoke_syscall+0x60/0xec
+[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4
+[ 6.258405][T329@C6] do_el0_svc+0x24/0x30
+[ 6.258407][T329@C6] el0_svc+0x54/0x1c4
+[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc
+[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8
+
+This is because the spin_lock would change to rt_mutex in PREEMPT_RT,
+however the sprd_gpio->lock would use in hard-irq, this is unsafe.
+
+So change the spin_lock_t to raw_spin_lock_t to use the spinlock
+in hard-irq.
+
+Signed-off-by: Xuewen Yan <xuewen.yan@unisoc.com>
+Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com
+[Bartosz: tweaked the commit message]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-sprd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c
+index c117c11bfb29a..192f05a2c19c1 100644
+--- a/drivers/gpio/gpio-sprd.c
++++ b/drivers/gpio/gpio-sprd.c
+@@ -35,7 +35,7 @@
+ struct sprd_gpio {
+ struct gpio_chip chip;
+ void __iomem *base;
+- spinlock_t lock;
++ raw_spinlock_t lock;
+ int irq;
+ };
+
+@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ unsigned long flags;
+ u32 tmp;
+
+- spin_lock_irqsave(&sprd_gpio->lock, flags);
++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags);
+ tmp = readl_relaxed(base + reg);
+
+ if (val)
+@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset,
+ tmp &= ~BIT(SPRD_GPIO_BIT(offset));
+
+ writel_relaxed(tmp, base + reg);
+- spin_unlock_irqrestore(&sprd_gpio->lock, flags);
++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags);
+ }
+
+ static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg)
+@@ -234,7 +234,7 @@ static int sprd_gpio_probe(struct platform_device *pdev)
+ if (IS_ERR(sprd_gpio->base))
+ return PTR_ERR(sprd_gpio->base);
+
+- spin_lock_init(&sprd_gpio->lock);
++ raw_spin_lock_init(&sprd_gpio->lock);
+
+ sprd_gpio->chip.label = dev_name(&pdev->dev);
+ sprd_gpio->chip.ngpio = SPRD_GPIO_NR;
+--
+2.51.0
+
--- /dev/null
+From 9a1ccd5ccd83ac002ef3af75945781aefa88c718 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 15:59:44 +0100
+Subject: gpiolib: acpi: Fix gpio count with string references
+
+From: Alban Bedel <alban.bedel@lht.dlh.de>
+
+[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ]
+
+Since commit 9880702d123f2 ("ACPI: property: Support using strings in
+reference properties") it is possible to use strings instead of local
+references. This work fine with single GPIO but not with arrays as
+acpi_gpio_package_count() didn't handle this case. Update it to handle
+strings like local references to cover this case as well.
+
+Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-acpi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 69d4297ae5754..4d4757eac9e5f 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -1417,6 +1417,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj)
+ while (element < end) {
+ switch (element->type) {
+ case ACPI_TYPE_LOCAL_REFERENCE:
++ case ACPI_TYPE_STRING:
+ element += 3;
+ fallthrough;
+ case ACPI_TYPE_INTEGER:
+--
+2.51.0
+
--- /dev/null
+From 676abe25816d0123a23e3e929d95a3c607b0b83f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 23:55:00 +0800
+Subject: platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: gongqi <550230171hxy@gmail.com>
+
+[ Upstream commit 2b4e00d8e70ca8736fda82447be6a4e323c6d1f5 ]
+
+The MECHREVO Wujie 15X Pro suffers from spurious IRQ issues related to
+the AMD PMC. Add it to the quirk list to use the spurious_8042 fix.
+
+Signed-off-by: gongqi <550230171hxy@gmail.com>
+Link: https://patch.msgid.link/20260122155501.376199-4-550230171hxy@gmail.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index a5031339dac8c..a6006b4ec2cc0 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -296,6 +296,13 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "XxKK4NAx_XxSP4NAx"),
+ }
+ },
++ {
++ .ident = "MECHREVO Wujie 15X Pro",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"),
++ }
++ },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 56e11b89cc11f2772476983d3e51064944a2b000 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 21:02:40 +0100
+Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ]
+
+In a few places in the Classmate laptop driver, code using the accel
+object may run before that object's address is stored in the driver
+data of the input device using it.
+
+For example, cmpc_accel_sensitivity_store_v4() is the "show" method
+of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(),
+before calling dev_set_drvdata() for inputdev->dev. If the sysfs
+attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev)
+call in in cmpc_accel_sensitivity_store_v4() returns NULL which
+leads to a NULL pointer dereference going forward.
+
+Moreover, sysfs attributes using the input device are added before
+initializing that device by cmpc_add_acpi_notify_device() and if one
+of them is accessed before running that function, a NULL pointer
+dereference will occur.
+
+For example, cmpc_accel_sensitivity_attr_v4 is added before calling
+cmpc_add_acpi_notify_device() and if it is read prematurely, the
+dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4()
+returns NULL which leads to a NULL pointer dereference going forward.
+
+Fix this by adding NULL pointer checks in all of the relevant places.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c
+index 2edaea2492df7..053c8a86d5ece 100644
+--- a/drivers/platform/x86/classmate-laptop.c
++++ b/drivers/platform/x86/classmate-laptop.c
+@@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->sensitivity);
+ }
+@@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+@@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->g_select);
+ }
+@@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &g_select);
+ if (r)
+@@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input)
+
+ acpi = to_acpi_device(input->dev.parent);
+ accel = dev_get_drvdata(&input->dev);
++ if (!accel)
++ return -ENXIO;
+
+ cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity);
+ cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select);
+@@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ return sprintf(buf, "%d\n", accel->sensitivity);
+ }
+@@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev,
+
+ acpi = to_acpi_device(dev);
+ inputdev = dev_get_drvdata(&acpi->dev);
++ if (!inputdev)
++ return -ENXIO;
++
+ accel = dev_get_drvdata(&inputdev->dev);
++ if (!accel)
++ return -ENXIO;
+
+ r = kstrtoul(buf, 0, &sensitivity);
+ if (r)
+--
+2.51.0
+
--- /dev/null
+From 3f9fece4613d75f08585d7354eb7fbcc07b70037 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 16:43:44 +0100
+Subject: platform/x86: panasonic-laptop: Fix sysfs group leak in error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 43b0b7eff4b3fb684f257d5a24376782e9663465 ]
+
+The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group
+if platform_device_register_simple() fails for the "panasonic" platform
+device.
+
+Address this by making it call sysfs_remove_group() in that case for
+the group in question.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/panasonic-laptop.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
+index 7365286f6d2dc..ad907c558997a 100644
+--- a/drivers/platform/x86/panasonic-laptop.c
++++ b/drivers/platform/x86/panasonic-laptop.c
+@@ -1077,7 +1077,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
+ PLATFORM_DEVID_NONE, NULL, 0);
+ if (IS_ERR(pcc->platform)) {
+ result = PTR_ERR(pcc->platform);
+- goto out_backlight;
++ goto out_sysfs;
+ }
+ result = device_create_file(&pcc->platform->dev,
+ &dev_attr_cdpower);
+@@ -1093,6 +1093,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
+
+ out_platform:
+ platform_device_unregister(pcc->platform);
++out_sysfs:
++ sysfs_remove_group(&device->dev.kobj, &pcc_attr_group);
+ out_backlight:
+ backlight_device_unregister(pcc->backlight);
+ out_input:
+--
+2.51.0
+
--- /dev/null
+From 338859c80d384632a10d58ea71bf68cd4a067608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:10:37 +0530
+Subject: romfs: check sb_set_blocksize() return value
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ]
+
+romfs_fill_super() ignores the return value of sb_set_blocksize(), which
+can fail if the requested block size is incompatible with the block
+device's configuration.
+
+This can be triggered by setting a loop device's block size larger than
+PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs
+filesystem on that device.
+
+When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the
+device has logical_block_size=32768, bdev_validate_blocksize() fails
+because the requested size is smaller than the device's logical block
+size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and
+continues mounting.
+
+The superblock's block size remains at the device's logical block size
+(32768). Later, when sb_bread() attempts I/O with this oversized block
+size, it triggers a kernel BUG in folio_set_bh():
+
+ kernel BUG at fs/buffer.c:1582!
+ BUG_ON(size > PAGE_SIZE);
+
+Fix by checking the return value of sb_set_blocksize() and failing the
+mount with -EINVAL if it returns 0.
+
+Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/romfs/super.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/romfs/super.c b/fs/romfs/super.c
+index b1bdfbc211c3c..82975173dcb04 100644
+--- a/fs/romfs/super.c
++++ b/fs/romfs/super.c
+@@ -467,7 +467,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc)
+
+ #ifdef CONFIG_BLOCK
+ if (!sb->s_mtd) {
+- sb_set_blocksize(sb, ROMBSIZE);
++ if (!sb_set_blocksize(sb, ROMBSIZE)) {
++ errorf(fc, "romfs: unable to set blocksize\n");
++ return -EINVAL;
++ }
+ } else {
+ sb->s_blocksize = ROMBSIZE;
+ sb->s_blocksize_bits = blksize_bits(ROMBSIZE);
+--
+2.51.0
+
revert-driver-core-enforce-device_lock-for-driver_match_device.patch
+alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch
+asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch
+gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch
+alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch
+asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch
+romfs-check-sb_set_blocksize-return-value.patch
+drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch
+platform-x86-classmate-laptop-add-missing-null-point.patch
+asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch
+asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch
+platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch
+platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch
+asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch
+asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch
+gpiolib-acpi-fix-gpio-count-with-string-references.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
