From: Sasha Levin Date: Mon, 16 Feb 2026 22:39:09 +0000 (-0500) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=725d6cac158bbeca785b670c577f337ae8a2dbc7;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch b/queue-5.10/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch new file mode 100644 index 0000000000..72619aec3e --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch @@ -0,0 +1,39 @@ +From 9f66b1a3f9080a9195fc625f7d04790325cc99a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 16:15:55 +0100 +Subject: ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU + +From: Tim Guttzeit + +[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ] + +Add a PCI quirk to enable microphone detection on the headphone jack of +TongFang X6AR55xU devices. + +Signed-off-by: Tim Guttzeit +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260119151626.35481-1-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index a8f530037033e..b8c7f4c8593ba 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10052,6 +10052,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60140}, + {0x19, 0x04a11030}, + {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC, ++ {0x17, 0x90170110}, ++ {0x19, 0x03a11030}, ++ {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT, + ALC282_STANDARD_PINS, + {0x12, 0x90a609c0}, +-- +2.51.0 + diff --git a/queue-5.10/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch b/queue-5.10/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch new file mode 100644 index 0000000000..55b3ada5b6 --- /dev/null +++ b/queue-5.10/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch @@ -0,0 +1,80 @@ +From 2c7936fcd9f0cc7a65ef9cdb583430bf8d146319 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 02:50:20 +0530 +Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?= + =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ] + +The variable j is set, however never used in or outside the loop, thus +resulting in dead code. +Building with GCC 16 results in a build error due to +-Werror=unused-but-set-variable= enabled by default. +This patch clean up the dead code and fixes the build error. + +Example build log: +drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=] + 1867 | size_t i, j; + | ^ + +Signed-off-by: Brahmajit Das +Signed-off-by: Thierry Reding +Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/hdmi.c | 4 ++-- + drivers/gpu/drm/tegra/sor.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c +index e5d2a40260288..fe700dfaaa4ce 100644 +--- a/drivers/gpu/drm/tegra/hdmi.c ++++ b/drivers/gpu/drm/tegra/hdmi.c +@@ -635,7 +635,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -668,7 +668,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_hdmi_subpack(&ptr[i], num); +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index 9d60d1c4cfcea..345dc74795588 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -1860,7 +1860,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -1893,7 +1893,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_sor_hdmi_subpack(&ptr[i], num); +-- +2.51.0 + diff --git a/queue-5.10/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch b/queue-5.10/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch new file mode 100644 index 0000000000..211f51bd58 --- /dev/null +++ b/queue-5.10/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch @@ -0,0 +1,123 @@ +From b23e944c451375ccf96f256698ab73012aca1c71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 17:42:09 +0800 +Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock + +From: Xuewen Yan + +[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ] + +There was a lockdep warning in sprd_gpio: + +[ 6.258269][T329@C6] [ BUG: Invalid wait context ] +[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE +[ 6.258272][T329@C6] ----------------------------- +[ 6.258273][T329@C6] modprobe/329 is trying to lock: +[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd] +[ 6.258282][T329@C6] other info that might help us debug this: +[ 6.258283][T329@C6] context-{5:5} +[ 6.258285][T329@C6] 3 locks held by modprobe/329: +[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204 +[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c +[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c +[ 6.258313][T329@C6] stack backtrace: +[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df +[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT) +[ 6.258318][T329@C6] Call trace: +[ 6.258318][T329@C6] show_stack+0x20/0x30 (C) +[ 6.258321][T329@C6] __dump_stack+0x28/0x3c +[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0 +[ 6.258326][T329@C6] dump_stack+0x18/0x3c +[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28 +[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc +[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4 +[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487] +[ 6.258337][T329@C6] irq_startup+0x238/0x350 +[ 6.258340][T329@C6] __setup_irq+0x504/0x82c +[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184 +[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120 +[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350 +[ 6.258361][T329@C6] really_probe+0x1a8/0x46c +[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c +[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4 +[ 6.258369][T329@C6] __driver_attach+0xd0/0x204 +[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168 +[ 6.258373][T329@C6] driver_attach+0x2c/0x3c +[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c +[ 6.258378][T329@C6] driver_register+0x70/0x10c +[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8 +[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c +[ 6.258392][T329@C6] do_init_module+0x60/0x254 +[ 6.258395][T329@C6] load_module+0x1054/0x1220 +[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c +[ 6.258400][T329@C6] invoke_syscall+0x60/0xec +[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4 +[ 6.258405][T329@C6] do_el0_svc+0x24/0x30 +[ 6.258407][T329@C6] el0_svc+0x54/0x1c4 +[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc +[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8 + +This is because the spin_lock would change to rt_mutex in PREEMPT_RT, +however the sprd_gpio->lock would use in hard-irq, this is unsafe. + +So change the spin_lock_t to raw_spin_lock_t to use the spinlock +in hard-irq. + +Signed-off-by: Xuewen Yan +Reviewed-by: Baolin Wang +Reviewed-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com +[Bartosz: tweaked the commit message] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-sprd.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c +index 36ea8a3bd4510..49b8e148328a0 100644 +--- a/drivers/gpio/gpio-sprd.c ++++ b/drivers/gpio/gpio-sprd.c +@@ -35,7 +35,7 @@ + struct sprd_gpio { + struct gpio_chip chip; + void __iomem *base; +- spinlock_t lock; ++ raw_spinlock_t lock; + int irq; + }; + +@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + unsigned long flags; + u32 tmp; + +- spin_lock_irqsave(&sprd_gpio->lock, flags); ++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags); + tmp = readl_relaxed(base + reg); + + if (val) +@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + tmp &= ~BIT(SPRD_GPIO_BIT(offset)); + + writel_relaxed(tmp, base + reg); +- spin_unlock_irqrestore(&sprd_gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags); + } + + static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg) +@@ -236,7 +236,7 @@ static int sprd_gpio_probe(struct platform_device *pdev) + if (IS_ERR(sprd_gpio->base)) + return PTR_ERR(sprd_gpio->base); + +- spin_lock_init(&sprd_gpio->lock); ++ raw_spin_lock_init(&sprd_gpio->lock); + + sprd_gpio->chip.label = dev_name(&pdev->dev); + sprd_gpio->chip.ngpio = SPRD_GPIO_NR; +-- +2.51.0 + diff --git a/queue-5.10/gpiolib-acpi-fix-gpio-count-with-string-references.patch b/queue-5.10/gpiolib-acpi-fix-gpio-count-with-string-references.patch new file mode 100644 index 0000000000..59a3065985 --- /dev/null +++ b/queue-5.10/gpiolib-acpi-fix-gpio-count-with-string-references.patch @@ -0,0 +1,39 @@ +From c3c4598c5cf62dc5abc2aeafbbe963ba4476f60e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 15:59:44 +0100 +Subject: gpiolib: acpi: Fix gpio count with string references + +From: Alban Bedel + +[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ] + +Since commit 9880702d123f2 ("ACPI: property: Support using strings in +reference properties") it is possible to use strings instead of local +references. This work fine with single GPIO but not with arrays as +acpi_gpio_package_count() didn't handle this case. Update it to handle +strings like local references to cover this case as well. + +Signed-off-by: Alban Bedel +Reviewed-by: Mika Westerberg +Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-acpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 12012e1645d7b..f03a7199fd58e 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -1276,6 +1276,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj) + while (element < end) { + switch (element->type) { + case ACPI_TYPE_LOCAL_REFERENCE: ++ case ACPI_TYPE_STRING: + element += 3; + fallthrough; + case ACPI_TYPE_INTEGER: +-- +2.51.0 + diff --git a/queue-5.10/platform-x86-classmate-laptop-add-missing-null-point.patch b/queue-5.10/platform-x86-classmate-laptop-add-missing-null-point.patch new file mode 100644 index 0000000000..835093ccb4 --- /dev/null +++ b/queue-5.10/platform-x86-classmate-laptop-add-missing-null-point.patch @@ -0,0 +1,138 @@ +From 363cbde715a8aad5252e28c165828656dbfb59d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 21:02:40 +0100 +Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ] + +In a few places in the Classmate laptop driver, code using the accel +object may run before that object's address is stored in the driver +data of the input device using it. + +For example, cmpc_accel_sensitivity_store_v4() is the "show" method +of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), +before calling dev_set_drvdata() for inputdev->dev. If the sysfs +attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) +call in in cmpc_accel_sensitivity_store_v4() returns NULL which +leads to a NULL pointer dereference going forward. + +Moreover, sysfs attributes using the input device are added before +initializing that device by cmpc_add_acpi_notify_device() and if one +of them is accessed before running that function, a NULL pointer +dereference will occur. + +For example, cmpc_accel_sensitivity_attr_v4 is added before calling +cmpc_add_acpi_notify_device() and if it is read prematurely, the +dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() +returns NULL which leads to a NULL pointer dereference going forward. + +Fix this by adding NULL pointer checks in all of the relevant places. + +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c +index af063f6908460..2012085882f8b 100644 +--- a/drivers/platform/x86/classmate-laptop.c ++++ b/drivers/platform/x86/classmate-laptop.c +@@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->sensitivity); + } +@@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +@@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->g_select); + } +@@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &g_select); + if (r) +@@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input) + + acpi = to_acpi_device(input->dev.parent); + accel = dev_get_drvdata(&input->dev); ++ if (!accel) ++ return -ENXIO; + + cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity); + cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select); +@@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->sensitivity); + } +@@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +-- +2.51.0 + diff --git a/queue-5.10/romfs-check-sb_set_blocksize-return-value.patch b/queue-5.10/romfs-check-sb_set_blocksize-return-value.patch new file mode 100644 index 0000000000..cde9afea32 --- /dev/null +++ b/queue-5.10/romfs-check-sb_set_blocksize-return-value.patch @@ -0,0 +1,62 @@ +From a6804d01c64295ad72967c41590caffaa859ca60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:10:37 +0530 +Subject: romfs: check sb_set_blocksize() return value + +From: Deepanshu Kartikey + +[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ] + +romfs_fill_super() ignores the return value of sb_set_blocksize(), which +can fail if the requested block size is incompatible with the block +device's configuration. + +This can be triggered by setting a loop device's block size larger than +PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs +filesystem on that device. + +When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the +device has logical_block_size=32768, bdev_validate_blocksize() fails +because the requested size is smaller than the device's logical block +size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and +continues mounting. + +The superblock's block size remains at the device's logical block size +(32768). Later, when sb_bread() attempts I/O with this oversized block +size, it triggers a kernel BUG in folio_set_bh(): + + kernel BUG at fs/buffer.c:1582! + BUG_ON(size > PAGE_SIZE); + +Fix by checking the return value of sb_set_blocksize() and failing the +mount with -EINVAL if it returns 0. + +Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25 +Signed-off-by: Deepanshu Kartikey +Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/romfs/super.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/romfs/super.c b/fs/romfs/super.c +index 259f684d9236e..6f31e720c9561 100644 +--- a/fs/romfs/super.c ++++ b/fs/romfs/super.c +@@ -467,7 +467,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc) + + #ifdef CONFIG_BLOCK + if (!sb->s_mtd) { +- sb_set_blocksize(sb, ROMBSIZE); ++ if (!sb_set_blocksize(sb, ROMBSIZE)) { ++ errorf(fc, "romfs: unable to set blocksize\n"); ++ return -EINVAL; ++ } + } else { + sb->s_blocksize = ROMBSIZE; + sb->s_blocksize_bits = blksize_bits(ROMBSIZE); +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index a9bf60a460..680e93c23a 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -5,3 +5,9 @@ nilfs2-fix-potential-block-overflow-that-cause-system-hang.patch scsi-qla2xxx-delay-module-unload-while-fabric-scan-in-progress.patch scsi-qla2xxx-query-fw-again-before-proceeding-with-login.patch gpio-omap-do-not-register-driver-in-probe.patch +alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch +gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch +romfs-check-sb_set_blocksize-return-value.patch +drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch +platform-x86-classmate-laptop-add-missing-null-point.patch +gpiolib-acpi-fix-gpio-count-with-string-references.patch diff --git a/queue-5.15/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch b/queue-5.15/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch new file mode 100644 index 0000000000..f79408965e --- /dev/null +++ b/queue-5.15/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch @@ -0,0 +1,39 @@ +From 2d9972692525c0fe4b66b92375edeeb8dba0d203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 16:15:55 +0100 +Subject: ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU + +From: Tim Guttzeit + +[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ] + +Add a PCI quirk to enable microphone detection on the headphone jack of +TongFang X6AR55xU devices. + +Signed-off-by: Tim Guttzeit +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260119151626.35481-1-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 839a7e957d42a..72d9ea5171bbd 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10133,6 +10133,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60140}, + {0x19, 0x04a11030}, + {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC, ++ {0x17, 0x90170110}, ++ {0x19, 0x03a11030}, ++ {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT, + ALC282_STANDARD_PINS, + {0x12, 0x90a609c0}, +-- +2.51.0 + diff --git a/queue-5.15/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch b/queue-5.15/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch new file mode 100644 index 0000000000..bcbbeda22b --- /dev/null +++ b/queue-5.15/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch @@ -0,0 +1,49 @@ +From 485a6299af94738982c5dbd3e2766ff6bafe2ead Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:41:12 +0000 +Subject: ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() + +From: Ziyi Guo + +[ Upstream commit f514248727606b9087bc38a284ff686e0093abf1 ] + +fsl_xcvr_activate_ctl() has +lockdep_assert_held(&card->snd_card->controls_rwsem), +but fsl_xcvr_mode_put() calls it without acquiring this lock. + +Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and +fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read(). + +Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl() +in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential +race conditions when multiple userspace threads access the control. + +Signed-off-by: Ziyi Guo +Link: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_xcvr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c +index ae5960b2b6a95..c4deb09c9a9bc 100644 +--- a/sound/soc/fsl/fsl_xcvr.c ++++ b/sound/soc/fsl/fsl_xcvr.c +@@ -203,10 +203,13 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol, + + xcvr->mode = snd_soc_enum_item_to_val(e, item[0]); + ++ down_read(&card->snd_card->controls_rwsem); + fsl_xcvr_activate_ctl(dai, fsl_xcvr_arc_mode_kctl.name, + (xcvr->mode == FSL_XCVR_MODE_ARC)); + fsl_xcvr_activate_ctl(dai, fsl_xcvr_earc_capds_kctl.name, + (xcvr->mode == FSL_XCVR_MODE_EARC)); ++ up_read(&card->snd_card->controls_rwsem); ++ + /* Allow playback for SPDIF only */ + rtd = snd_soc_get_pcm_runtime(card, card->dai_link); + rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count = +-- +2.51.0 + diff --git a/queue-5.15/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch b/queue-5.15/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch new file mode 100644 index 0000000000..464f5e10a3 --- /dev/null +++ b/queue-5.15/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch @@ -0,0 +1,80 @@ +From 529f8d6790dff70e99b54bd0995a694d48c70c04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 02:50:20 +0530 +Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?= + =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ] + +The variable j is set, however never used in or outside the loop, thus +resulting in dead code. +Building with GCC 16 results in a build error due to +-Werror=unused-but-set-variable= enabled by default. +This patch clean up the dead code and fixes the build error. + +Example build log: +drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=] + 1867 | size_t i, j; + | ^ + +Signed-off-by: Brahmajit Das +Signed-off-by: Thierry Reding +Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/hdmi.c | 4 ++-- + drivers/gpu/drm/tegra/sor.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c +index e5d2a40260288..fe700dfaaa4ce 100644 +--- a/drivers/gpu/drm/tegra/hdmi.c ++++ b/drivers/gpu/drm/tegra/hdmi.c +@@ -635,7 +635,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -668,7 +668,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_hdmi_subpack(&ptr[i], num); +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index f2f76a0897a80..31e1f9ec9fead 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -1860,7 +1860,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -1893,7 +1893,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_sor_hdmi_subpack(&ptr[i], num); +-- +2.51.0 + diff --git a/queue-5.15/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch b/queue-5.15/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch new file mode 100644 index 0000000000..a11755f213 --- /dev/null +++ b/queue-5.15/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch @@ -0,0 +1,123 @@ +From f2d684f6d6140c1bbda6718fc113b7bbbebf94ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 17:42:09 +0800 +Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock + +From: Xuewen Yan + +[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ] + +There was a lockdep warning in sprd_gpio: + +[ 6.258269][T329@C6] [ BUG: Invalid wait context ] +[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE +[ 6.258272][T329@C6] ----------------------------- +[ 6.258273][T329@C6] modprobe/329 is trying to lock: +[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd] +[ 6.258282][T329@C6] other info that might help us debug this: +[ 6.258283][T329@C6] context-{5:5} +[ 6.258285][T329@C6] 3 locks held by modprobe/329: +[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204 +[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c +[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c +[ 6.258313][T329@C6] stack backtrace: +[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df +[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT) +[ 6.258318][T329@C6] Call trace: +[ 6.258318][T329@C6] show_stack+0x20/0x30 (C) +[ 6.258321][T329@C6] __dump_stack+0x28/0x3c +[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0 +[ 6.258326][T329@C6] dump_stack+0x18/0x3c +[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28 +[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc +[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4 +[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487] +[ 6.258337][T329@C6] irq_startup+0x238/0x350 +[ 6.258340][T329@C6] __setup_irq+0x504/0x82c +[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184 +[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120 +[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350 +[ 6.258361][T329@C6] really_probe+0x1a8/0x46c +[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c +[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4 +[ 6.258369][T329@C6] __driver_attach+0xd0/0x204 +[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168 +[ 6.258373][T329@C6] driver_attach+0x2c/0x3c +[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c +[ 6.258378][T329@C6] driver_register+0x70/0x10c +[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8 +[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c +[ 6.258392][T329@C6] do_init_module+0x60/0x254 +[ 6.258395][T329@C6] load_module+0x1054/0x1220 +[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c +[ 6.258400][T329@C6] invoke_syscall+0x60/0xec +[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4 +[ 6.258405][T329@C6] do_el0_svc+0x24/0x30 +[ 6.258407][T329@C6] el0_svc+0x54/0x1c4 +[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc +[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8 + +This is because the spin_lock would change to rt_mutex in PREEMPT_RT, +however the sprd_gpio->lock would use in hard-irq, this is unsafe. + +So change the spin_lock_t to raw_spin_lock_t to use the spinlock +in hard-irq. + +Signed-off-by: Xuewen Yan +Reviewed-by: Baolin Wang +Reviewed-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com +[Bartosz: tweaked the commit message] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-sprd.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c +index 9dd9dabb579e2..b2b28c6877f2f 100644 +--- a/drivers/gpio/gpio-sprd.c ++++ b/drivers/gpio/gpio-sprd.c +@@ -35,7 +35,7 @@ + struct sprd_gpio { + struct gpio_chip chip; + void __iomem *base; +- spinlock_t lock; ++ raw_spinlock_t lock; + int irq; + }; + +@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + unsigned long flags; + u32 tmp; + +- spin_lock_irqsave(&sprd_gpio->lock, flags); ++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags); + tmp = readl_relaxed(base + reg); + + if (val) +@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + tmp &= ~BIT(SPRD_GPIO_BIT(offset)); + + writel_relaxed(tmp, base + reg); +- spin_unlock_irqrestore(&sprd_gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags); + } + + static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg) +@@ -231,7 +231,7 @@ static int sprd_gpio_probe(struct platform_device *pdev) + if (IS_ERR(sprd_gpio->base)) + return PTR_ERR(sprd_gpio->base); + +- spin_lock_init(&sprd_gpio->lock); ++ raw_spin_lock_init(&sprd_gpio->lock); + + sprd_gpio->chip.label = dev_name(&pdev->dev); + sprd_gpio->chip.ngpio = SPRD_GPIO_NR; +-- +2.51.0 + diff --git a/queue-5.15/gpiolib-acpi-fix-gpio-count-with-string-references.patch b/queue-5.15/gpiolib-acpi-fix-gpio-count-with-string-references.patch new file mode 100644 index 0000000000..00781e8de0 --- /dev/null +++ b/queue-5.15/gpiolib-acpi-fix-gpio-count-with-string-references.patch @@ -0,0 +1,39 @@ +From 2f2407808ac24b3ee5e36f5bf3167c0b9a091c39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 15:59:44 +0100 +Subject: gpiolib: acpi: Fix gpio count with string references + +From: Alban Bedel + +[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ] + +Since commit 9880702d123f2 ("ACPI: property: Support using strings in +reference properties") it is possible to use strings instead of local +references. This work fine with single GPIO but not with arrays as +acpi_gpio_package_count() didn't handle this case. Update it to handle +strings like local references to cover this case as well. + +Signed-off-by: Alban Bedel +Reviewed-by: Mika Westerberg +Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-acpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 3e4fd028a82da..0e6a2200a5feb 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -1369,6 +1369,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj) + while (element < end) { + switch (element->type) { + case ACPI_TYPE_LOCAL_REFERENCE: ++ case ACPI_TYPE_STRING: + element += 3; + fallthrough; + case ACPI_TYPE_INTEGER: +-- +2.51.0 + diff --git a/queue-5.15/platform-x86-classmate-laptop-add-missing-null-point.patch b/queue-5.15/platform-x86-classmate-laptop-add-missing-null-point.patch new file mode 100644 index 0000000000..7bdcecc467 --- /dev/null +++ b/queue-5.15/platform-x86-classmate-laptop-add-missing-null-point.patch @@ -0,0 +1,138 @@ +From d558b4eed80b99b8a99aade0b30bc60e6c5ade2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 21:02:40 +0100 +Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ] + +In a few places in the Classmate laptop driver, code using the accel +object may run before that object's address is stored in the driver +data of the input device using it. + +For example, cmpc_accel_sensitivity_store_v4() is the "show" method +of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), +before calling dev_set_drvdata() for inputdev->dev. If the sysfs +attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) +call in in cmpc_accel_sensitivity_store_v4() returns NULL which +leads to a NULL pointer dereference going forward. + +Moreover, sysfs attributes using the input device are added before +initializing that device by cmpc_add_acpi_notify_device() and if one +of them is accessed before running that function, a NULL pointer +dereference will occur. + +For example, cmpc_accel_sensitivity_attr_v4 is added before calling +cmpc_add_acpi_notify_device() and if it is read prematurely, the +dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() +returns NULL which leads to a NULL pointer dereference going forward. + +Fix this by adding NULL pointer checks in all of the relevant places. + +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c +index 9309ab5792cbc..ac02b22154d62 100644 +--- a/drivers/platform/x86/classmate-laptop.c ++++ b/drivers/platform/x86/classmate-laptop.c +@@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->sensitivity); + } +@@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +@@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->g_select); + } +@@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &g_select); + if (r) +@@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input) + + acpi = to_acpi_device(input->dev.parent); + accel = dev_get_drvdata(&input->dev); ++ if (!accel) ++ return -ENXIO; + + cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity); + cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select); +@@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->sensitivity); + } +@@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +-- +2.51.0 + diff --git a/queue-5.15/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch b/queue-5.15/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch new file mode 100644 index 0000000000..9946353dac --- /dev/null +++ b/queue-5.15/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch @@ -0,0 +1,53 @@ +From 33d3ad5b24d5ce5462f5c39a382bf2bd234d9840 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 16:43:44 +0100 +Subject: platform/x86: panasonic-laptop: Fix sysfs group leak in error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +[ Upstream commit 43b0b7eff4b3fb684f257d5a24376782e9663465 ] + +The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group +if platform_device_register_simple() fails for the "panasonic" platform +device. + +Address this by making it call sysfs_remove_group() in that case for +the group in question. + +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/panasonic-laptop.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c +index e412a550f0983..418cd4d781261 100644 +--- a/drivers/platform/x86/panasonic-laptop.c ++++ b/drivers/platform/x86/panasonic-laptop.c +@@ -1073,7 +1073,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) + -1, NULL, 0); + if (IS_ERR(pcc->platform)) { + result = PTR_ERR(pcc->platform); +- goto out_backlight; ++ goto out_sysfs; + } + result = device_create_file(&pcc->platform->dev, + &dev_attr_cdpower); +@@ -1089,6 +1089,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) + + out_platform: + platform_device_unregister(pcc->platform); ++out_sysfs: ++ sysfs_remove_group(&device->dev.kobj, &pcc_attr_group); + out_backlight: + backlight_device_unregister(pcc->backlight); + out_input: +-- +2.51.0 + diff --git a/queue-5.15/romfs-check-sb_set_blocksize-return-value.patch b/queue-5.15/romfs-check-sb_set_blocksize-return-value.patch new file mode 100644 index 0000000000..b2560874b0 --- /dev/null +++ b/queue-5.15/romfs-check-sb_set_blocksize-return-value.patch @@ -0,0 +1,62 @@ +From 4535187c736f3360617ab6f0945a7933248925a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:10:37 +0530 +Subject: romfs: check sb_set_blocksize() return value + +From: Deepanshu Kartikey + +[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ] + +romfs_fill_super() ignores the return value of sb_set_blocksize(), which +can fail if the requested block size is incompatible with the block +device's configuration. + +This can be triggered by setting a loop device's block size larger than +PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs +filesystem on that device. + +When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the +device has logical_block_size=32768, bdev_validate_blocksize() fails +because the requested size is smaller than the device's logical block +size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and +continues mounting. + +The superblock's block size remains at the device's logical block size +(32768). Later, when sb_bread() attempts I/O with this oversized block +size, it triggers a kernel BUG in folio_set_bh(): + + kernel BUG at fs/buffer.c:1582! + BUG_ON(size > PAGE_SIZE); + +Fix by checking the return value of sb_set_blocksize() and failing the +mount with -EINVAL if it returns 0. + +Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25 +Signed-off-by: Deepanshu Kartikey +Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/romfs/super.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/romfs/super.c b/fs/romfs/super.c +index 259f684d9236e..6f31e720c9561 100644 +--- a/fs/romfs/super.c ++++ b/fs/romfs/super.c +@@ -467,7 +467,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc) + + #ifdef CONFIG_BLOCK + if (!sb->s_mtd) { +- sb_set_blocksize(sb, ROMBSIZE); ++ if (!sb_set_blocksize(sb, ROMBSIZE)) { ++ errorf(fc, "romfs: unable to set blocksize\n"); ++ return -EINVAL; ++ } + } else { + sb->s_blocksize = ROMBSIZE; + sb->s_blocksize_bits = blksize_bits(ROMBSIZE); +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 5572bd4e2e..6e5a0b9e61 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -6,3 +6,11 @@ scsi-qla2xxx-validate-sp-before-freeing-associated-memory.patch scsi-qla2xxx-delay-module-unload-while-fabric-scan-in-progress.patch scsi-qla2xxx-query-fw-again-before-proceeding-with-login.patch gpio-omap-do-not-register-driver-in-probe.patch +alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch +gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch +romfs-check-sb_set_blocksize-return-value.patch +drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch +platform-x86-classmate-laptop-add-missing-null-point.patch +platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch +asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch +gpiolib-acpi-fix-gpio-count-with-string-references.patch diff --git a/queue-6.1/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch b/queue-6.1/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch new file mode 100644 index 0000000000..900161f09a --- /dev/null +++ b/queue-6.1/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch @@ -0,0 +1,35 @@ +From 4a75b2945f1ce2ae2e7336670fa387550bbb1b58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 15:35:08 +0800 +Subject: ALSA: hda/realtek: Add quirk for Inspur S14-G1 + +From: Zhang Heng + +[ Upstream commit 9e18920e783d0bcd4c127a7adc66565243ab9655 ] + +Inspur S14-G1 is equipped with ALC256. +Enable "power saving mode" and Enable "headset jack mode". + +Signed-off-by: Zhang Heng +Link: https://patch.msgid.link/20260126073508.3897461-2-zhangheng@kylinos.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 2fd52b6b4fb57..89410d40561d7 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10454,6 +10454,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x2039, 0x0001, "Inspur S14-G1", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13), + SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), +-- +2.51.0 + diff --git a/queue-6.1/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch b/queue-6.1/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch new file mode 100644 index 0000000000..678db9382f --- /dev/null +++ b/queue-6.1/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch @@ -0,0 +1,39 @@ +From 4116b106031c85c8c66890e70307d529dbcf9b9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 16:15:55 +0100 +Subject: ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU + +From: Tim Guttzeit + +[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ] + +Add a PCI quirk to enable microphone detection on the headphone jack of +TongFang X6AR55xU devices. + +Signed-off-by: Tim Guttzeit +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260119151626.35481-1-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b45e5b268a65b..2fd52b6b4fb57 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10906,6 +10906,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60140}, + {0x19, 0x04a11030}, + {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC, ++ {0x17, 0x90170110}, ++ {0x19, 0x03a11030}, ++ {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT, + ALC282_STANDARD_PINS, + {0x12, 0x90a609c0}, +-- +2.51.0 + diff --git a/queue-6.1/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch b/queue-6.1/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch new file mode 100644 index 0000000000..66f3189c1b --- /dev/null +++ b/queue-6.1/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch @@ -0,0 +1,41 @@ +From bbc17715ed1175376df42ea5510d00d24eb8b479 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 15:56:18 +0100 +Subject: ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list + +From: Anatolii Shirykalov + +[ Upstream commit 018b211b1d321a52ed8d8de74ce83ce52a2e1224 ] + +Add ASUS ExpertBook PM1503CDA to the DMI quirks table to enable +internal DMIC support via the ACP6x machine driver. + +Signed-off-by: Anatolii Shirykalov +Link: https://patch.msgid.link/20260119145618.3171435-1-pipocavsobake@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 6bbbcf77fc525..43f7f64015b25 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -451,6 +451,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "15NBC1011"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK PM1503CDA"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.51.0 + diff --git a/queue-6.1/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch b/queue-6.1/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch new file mode 100644 index 0000000000..1ccad3a150 --- /dev/null +++ b/queue-6.1/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch @@ -0,0 +1,37 @@ +From a02a50f13eaa219093b82c83f9063a729115d038 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 19:25:10 +0000 +Subject: ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel + +From: Ricardo Rivera-Matos + +[ Upstream commit 6dd0fdc908c02318c28ec2c0979661846ee0a9f7 ] + +ASP_TX5 was incorrectly mapped to a channel value of 3 corrects, +the channel value of 4. + +Reviewed-by: Charles Keepax +Signed-off-by: Ricardo Rivera-Matos +Link: https://patch.msgid.link/20260115192523.1335742-2-rriveram@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l45.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs35l45.c b/sound/soc/codecs/cs35l45.c +index d15b3b77c7eb0..29aed07443866 100644 +--- a/sound/soc/codecs/cs35l45.c ++++ b/sound/soc/codecs/cs35l45.c +@@ -131,7 +131,7 @@ static const struct snd_soc_dapm_widget cs35l45_dapm_widgets[] = { + SND_SOC_DAPM_AIF_OUT("ASP_TX2", NULL, 1, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX2_EN_SHIFT, 0), + SND_SOC_DAPM_AIF_OUT("ASP_TX3", NULL, 2, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX3_EN_SHIFT, 0), + SND_SOC_DAPM_AIF_OUT("ASP_TX4", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX4_EN_SHIFT, 0), +- SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0), ++ SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 4, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0), + + SND_SOC_DAPM_MUX("ASP_TX1 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[0]), + SND_SOC_DAPM_MUX("ASP_TX2 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[1]), +-- +2.51.0 + diff --git a/queue-6.1/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch b/queue-6.1/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch new file mode 100644 index 0000000000..ab973d260c --- /dev/null +++ b/queue-6.1/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch @@ -0,0 +1,49 @@ +From 6df695f437764efd634dd2b6a918db1710f0eab6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:41:12 +0000 +Subject: ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() + +From: Ziyi Guo + +[ Upstream commit f514248727606b9087bc38a284ff686e0093abf1 ] + +fsl_xcvr_activate_ctl() has +lockdep_assert_held(&card->snd_card->controls_rwsem), +but fsl_xcvr_mode_put() calls it without acquiring this lock. + +Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and +fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read(). + +Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl() +in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential +race conditions when multiple userspace threads access the control. + +Signed-off-by: Ziyi Guo +Link: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_xcvr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c +index 5b61b93772d64..e6c0e6609cbe0 100644 +--- a/sound/soc/fsl/fsl_xcvr.c ++++ b/sound/soc/fsl/fsl_xcvr.c +@@ -203,10 +203,13 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol, + + xcvr->mode = snd_soc_enum_item_to_val(e, item[0]); + ++ down_read(&card->snd_card->controls_rwsem); + fsl_xcvr_activate_ctl(dai, fsl_xcvr_arc_mode_kctl.name, + (xcvr->mode == FSL_XCVR_MODE_ARC)); + fsl_xcvr_activate_ctl(dai, fsl_xcvr_earc_capds_kctl.name, + (xcvr->mode == FSL_XCVR_MODE_EARC)); ++ up_read(&card->snd_card->controls_rwsem); ++ + /* Allow playback for SPDIF only */ + rtd = snd_soc_get_pcm_runtime(card, card->dai_link); + rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count = +-- +2.51.0 + diff --git a/queue-6.1/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch b/queue-6.1/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch new file mode 100644 index 0000000000..f3bcf0edd6 --- /dev/null +++ b/queue-6.1/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch @@ -0,0 +1,73 @@ +From 39aa02197f48fcbb6ba935136879d75ac1f8276e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Feb 2026 15:17:28 +0300 +Subject: ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 + +From: Tagir Garaev + +[ Upstream commit 6b641122d31f9d33e7d60047ee0586d1659f3f54 ] + +Add DMI entry for Huawei Matebook D (BOD-WXX9) with HEADPHONE_GPIO +and DMIC quirks. + +This device has ES8336 codec with: +- GPIO 16 (headphone-enable) for headphone amplifier control +- GPIO 17 (speakers-enable) for speaker amplifier control +- GPIO 269 for jack detection IRQ +- 2-channel DMIC + +Hardware investigation shows that both GPIO 16 and 17 are required +for proper audio routing, as headphones and speakers share the same +physical output (HPOL/HPOR) and are separated only via amplifier +enable signals. + +RFC: Seeking advice on GPIO control issue: + +GPIO values change in driver (gpiod_get_value() shows logical value +changes) but not physically (debugfs gpio shows no change). The same +gpiod_set_value_cansleep() calls work correctly in probe context with +msleep(), but fail when called from DAPM event callbacks. + +Context information from diagnostics: +- in_atomic=0, in_interrupt=0, irqs_disabled=0 +- Process context: pipewire +- GPIO 17 (speakers): changes in driver, no physical change +- GPIO 16 (headphone): changes in driver, no physical change + +In Windows, audio switching works without visible GPIO changes, +suggesting possible ACPI/firmware involvement. + +Any suggestions on how to properly control these GPIOs from DAPM +events would be appreciated. + +Signed-off-by: Tagir Garaev +Link: https://patch.msgid.link/20260201121728.16597-1-tgaraev653@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_es8336.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c +index 41dab5dcf79a3..1c71c23f347e7 100644 +--- a/sound/soc/intel/boards/sof_es8336.c ++++ b/sound/soc/intel/boards/sof_es8336.c +@@ -332,6 +332,15 @@ static int sof_es8336_quirk_cb(const struct dmi_system_id *id) + * if the topology file is modified as well. + */ + static const struct dmi_system_id sof_es8336_quirk_table[] = { ++ { ++ .callback = sof_es8336_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HUAWEI"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "BOD-WXX9"), ++ }, ++ .driver_data = (void *)(SOF_ES8336_HEADPHONE_GPIO | ++ SOF_ES8336_ENABLE_DMIC) ++ }, + { + .callback = sof_es8336_quirk_cb, + .matches = { +-- +2.51.0 + diff --git a/queue-6.1/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch b/queue-6.1/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch new file mode 100644 index 0000000000..bdb6c29eb8 --- /dev/null +++ b/queue-6.1/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch @@ -0,0 +1,80 @@ +From 921700dc033a000c90d0d5c62aa78ef9ba2cf5d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 02:50:20 +0530 +Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?= + =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ] + +The variable j is set, however never used in or outside the loop, thus +resulting in dead code. +Building with GCC 16 results in a build error due to +-Werror=unused-but-set-variable= enabled by default. +This patch clean up the dead code and fixes the build error. + +Example build log: +drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=] + 1867 | size_t i, j; + | ^ + +Signed-off-by: Brahmajit Das +Signed-off-by: Thierry Reding +Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/hdmi.c | 4 ++-- + drivers/gpu/drm/tegra/sor.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c +index c66764c0bd250..47f794a367ba1 100644 +--- a/drivers/gpu/drm/tegra/hdmi.c ++++ b/drivers/gpu/drm/tegra/hdmi.c +@@ -654,7 +654,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -687,7 +687,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_hdmi_subpack(&ptr[i], num); +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index 77723d5f1d3fd..ce8e299b6afb6 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -1860,7 +1860,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -1893,7 +1893,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_sor_hdmi_subpack(&ptr[i], num); +-- +2.51.0 + diff --git a/queue-6.1/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch b/queue-6.1/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch new file mode 100644 index 0000000000..6cab9f5f46 --- /dev/null +++ b/queue-6.1/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch @@ -0,0 +1,123 @@ +From b1d51d84d957db5458e04262ecc9515ba7b6486b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 17:42:09 +0800 +Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock + +From: Xuewen Yan + +[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ] + +There was a lockdep warning in sprd_gpio: + +[ 6.258269][T329@C6] [ BUG: Invalid wait context ] +[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE +[ 6.258272][T329@C6] ----------------------------- +[ 6.258273][T329@C6] modprobe/329 is trying to lock: +[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd] +[ 6.258282][T329@C6] other info that might help us debug this: +[ 6.258283][T329@C6] context-{5:5} +[ 6.258285][T329@C6] 3 locks held by modprobe/329: +[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204 +[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c +[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c +[ 6.258313][T329@C6] stack backtrace: +[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df +[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT) +[ 6.258318][T329@C6] Call trace: +[ 6.258318][T329@C6] show_stack+0x20/0x30 (C) +[ 6.258321][T329@C6] __dump_stack+0x28/0x3c +[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0 +[ 6.258326][T329@C6] dump_stack+0x18/0x3c +[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28 +[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc +[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4 +[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487] +[ 6.258337][T329@C6] irq_startup+0x238/0x350 +[ 6.258340][T329@C6] __setup_irq+0x504/0x82c +[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184 +[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120 +[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350 +[ 6.258361][T329@C6] really_probe+0x1a8/0x46c +[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c +[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4 +[ 6.258369][T329@C6] __driver_attach+0xd0/0x204 +[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168 +[ 6.258373][T329@C6] driver_attach+0x2c/0x3c +[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c +[ 6.258378][T329@C6] driver_register+0x70/0x10c +[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8 +[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c +[ 6.258392][T329@C6] do_init_module+0x60/0x254 +[ 6.258395][T329@C6] load_module+0x1054/0x1220 +[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c +[ 6.258400][T329@C6] invoke_syscall+0x60/0xec +[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4 +[ 6.258405][T329@C6] do_el0_svc+0x24/0x30 +[ 6.258407][T329@C6] el0_svc+0x54/0x1c4 +[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc +[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8 + +This is because the spin_lock would change to rt_mutex in PREEMPT_RT, +however the sprd_gpio->lock would use in hard-irq, this is unsafe. + +So change the spin_lock_t to raw_spin_lock_t to use the spinlock +in hard-irq. + +Signed-off-by: Xuewen Yan +Reviewed-by: Baolin Wang +Reviewed-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com +[Bartosz: tweaked the commit message] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-sprd.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c +index 9bff63990eee4..2da626905798b 100644 +--- a/drivers/gpio/gpio-sprd.c ++++ b/drivers/gpio/gpio-sprd.c +@@ -35,7 +35,7 @@ + struct sprd_gpio { + struct gpio_chip chip; + void __iomem *base; +- spinlock_t lock; ++ raw_spinlock_t lock; + int irq; + }; + +@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + unsigned long flags; + u32 tmp; + +- spin_lock_irqsave(&sprd_gpio->lock, flags); ++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags); + tmp = readl_relaxed(base + reg); + + if (val) +@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + tmp &= ~BIT(SPRD_GPIO_BIT(offset)); + + writel_relaxed(tmp, base + reg); +- spin_unlock_irqrestore(&sprd_gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags); + } + + static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg) +@@ -231,7 +231,7 @@ static int sprd_gpio_probe(struct platform_device *pdev) + if (IS_ERR(sprd_gpio->base)) + return PTR_ERR(sprd_gpio->base); + +- spin_lock_init(&sprd_gpio->lock); ++ raw_spin_lock_init(&sprd_gpio->lock); + + sprd_gpio->chip.label = dev_name(&pdev->dev); + sprd_gpio->chip.ngpio = SPRD_GPIO_NR; +-- +2.51.0 + diff --git a/queue-6.1/gpiolib-acpi-fix-gpio-count-with-string-references.patch b/queue-6.1/gpiolib-acpi-fix-gpio-count-with-string-references.patch new file mode 100644 index 0000000000..88654a2725 --- /dev/null +++ b/queue-6.1/gpiolib-acpi-fix-gpio-count-with-string-references.patch @@ -0,0 +1,39 @@ +From 91157d1748eb3a774534751cf04ae45fd5b5d37e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 15:59:44 +0100 +Subject: gpiolib: acpi: Fix gpio count with string references + +From: Alban Bedel + +[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ] + +Since commit 9880702d123f2 ("ACPI: property: Support using strings in +reference properties") it is possible to use strings instead of local +references. This work fine with single GPIO but not with arrays as +acpi_gpio_package_count() didn't handle this case. Update it to handle +strings like local references to cover this case as well. + +Signed-off-by: Alban Bedel +Reviewed-by: Mika Westerberg +Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-acpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 11338f47d884d..48c9935bedffb 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -1383,6 +1383,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj) + while (element < end) { + switch (element->type) { + case ACPI_TYPE_LOCAL_REFERENCE: ++ case ACPI_TYPE_STRING: + element += 3; + fallthrough; + case ACPI_TYPE_INTEGER: +-- +2.51.0 + diff --git a/queue-6.1/platform-x86-classmate-laptop-add-missing-null-point.patch b/queue-6.1/platform-x86-classmate-laptop-add-missing-null-point.patch new file mode 100644 index 0000000000..cc7a6e5ea8 --- /dev/null +++ b/queue-6.1/platform-x86-classmate-laptop-add-missing-null-point.patch @@ -0,0 +1,138 @@ +From a89fc3129dd616ac36f744b692120abba22b9b8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 21:02:40 +0100 +Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ] + +In a few places in the Classmate laptop driver, code using the accel +object may run before that object's address is stored in the driver +data of the input device using it. + +For example, cmpc_accel_sensitivity_store_v4() is the "show" method +of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), +before calling dev_set_drvdata() for inputdev->dev. If the sysfs +attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) +call in in cmpc_accel_sensitivity_store_v4() returns NULL which +leads to a NULL pointer dereference going forward. + +Moreover, sysfs attributes using the input device are added before +initializing that device by cmpc_add_acpi_notify_device() and if one +of them is accessed before running that function, a NULL pointer +dereference will occur. + +For example, cmpc_accel_sensitivity_attr_v4 is added before calling +cmpc_add_acpi_notify_device() and if it is read prematurely, the +dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() +returns NULL which leads to a NULL pointer dereference going forward. + +Fix this by adding NULL pointer checks in all of the relevant places. + +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c +index 9309ab5792cbc..ac02b22154d62 100644 +--- a/drivers/platform/x86/classmate-laptop.c ++++ b/drivers/platform/x86/classmate-laptop.c +@@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->sensitivity); + } +@@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +@@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->g_select); + } +@@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &g_select); + if (r) +@@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input) + + acpi = to_acpi_device(input->dev.parent); + accel = dev_get_drvdata(&input->dev); ++ if (!accel) ++ return -ENXIO; + + cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity); + cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select); +@@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->sensitivity); + } +@@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +-- +2.51.0 + diff --git a/queue-6.1/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch b/queue-6.1/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch new file mode 100644 index 0000000000..3eedef54ed --- /dev/null +++ b/queue-6.1/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch @@ -0,0 +1,53 @@ +From c9e196a8762dd71b6ecc14e0d0c5d64cc5bfc9fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 16:43:44 +0100 +Subject: platform/x86: panasonic-laptop: Fix sysfs group leak in error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +[ Upstream commit 43b0b7eff4b3fb684f257d5a24376782e9663465 ] + +The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group +if platform_device_register_simple() fails for the "panasonic" platform +device. + +Address this by making it call sysfs_remove_group() in that case for +the group in question. + +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/panasonic-laptop.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c +index e9bee5f6ec8d0..99cbacd0cbba4 100644 +--- a/drivers/platform/x86/panasonic-laptop.c ++++ b/drivers/platform/x86/panasonic-laptop.c +@@ -1077,7 +1077,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) + PLATFORM_DEVID_NONE, NULL, 0); + if (IS_ERR(pcc->platform)) { + result = PTR_ERR(pcc->platform); +- goto out_backlight; ++ goto out_sysfs; + } + result = device_create_file(&pcc->platform->dev, + &dev_attr_cdpower); +@@ -1093,6 +1093,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) + + out_platform: + platform_device_unregister(pcc->platform); ++out_sysfs: ++ sysfs_remove_group(&device->dev.kobj, &pcc_attr_group); + out_backlight: + backlight_device_unregister(pcc->backlight); + out_input: +-- +2.51.0 + diff --git a/queue-6.1/romfs-check-sb_set_blocksize-return-value.patch b/queue-6.1/romfs-check-sb_set_blocksize-return-value.patch new file mode 100644 index 0000000000..d66ed3d0b8 --- /dev/null +++ b/queue-6.1/romfs-check-sb_set_blocksize-return-value.patch @@ -0,0 +1,62 @@ +From 720acd1716ed2cd6b869beb91295189ac2d388d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:10:37 +0530 +Subject: romfs: check sb_set_blocksize() return value + +From: Deepanshu Kartikey + +[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ] + +romfs_fill_super() ignores the return value of sb_set_blocksize(), which +can fail if the requested block size is incompatible with the block +device's configuration. + +This can be triggered by setting a loop device's block size larger than +PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs +filesystem on that device. + +When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the +device has logical_block_size=32768, bdev_validate_blocksize() fails +because the requested size is smaller than the device's logical block +size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and +continues mounting. + +The superblock's block size remains at the device's logical block size +(32768). Later, when sb_bread() attempts I/O with this oversized block +size, it triggers a kernel BUG in folio_set_bh(): + + kernel BUG at fs/buffer.c:1582! + BUG_ON(size > PAGE_SIZE); + +Fix by checking the return value of sb_set_blocksize() and failing the +mount with -EINVAL if it returns 0. + +Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25 +Signed-off-by: Deepanshu Kartikey +Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/romfs/super.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/romfs/super.c b/fs/romfs/super.c +index c59b230d55b43..3bc993634321a 100644 +--- a/fs/romfs/super.c ++++ b/fs/romfs/super.c +@@ -468,7 +468,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc) + + #ifdef CONFIG_BLOCK + if (!sb->s_mtd) { +- sb_set_blocksize(sb, ROMBSIZE); ++ if (!sb_set_blocksize(sb, ROMBSIZE)) { ++ errorf(fc, "romfs: unable to set blocksize\n"); ++ return -EINVAL; ++ } + } else { + sb->s_blocksize = ROMBSIZE; + sb->s_blocksize_bits = blksize_bits(ROMBSIZE); +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 69c467a62f..ed520e8c36 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -25,3 +25,15 @@ scsi-qla2xxx-reduce-fabric-scan-duplicate-code.patch scsi-qla2xxx-free-sp-in-error-path-to-fix-system-crash.patch cacheinfo-decrement-refcount-in-cache_setup_of_node.patch cacheinfo-remove-of_node_put-for-fw_token.patch +alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch +asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch +gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch +alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch +asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch +romfs-check-sb_set_blocksize-return-value.patch +drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch +platform-x86-classmate-laptop-add-missing-null-point.patch +asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch +platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch +asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch +gpiolib-acpi-fix-gpio-count-with-string-references.patch diff --git a/queue-6.12/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch b/queue-6.12/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch new file mode 100644 index 0000000000..48377a2fcf --- /dev/null +++ b/queue-6.12/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch @@ -0,0 +1,35 @@ +From 1c3f4fbbf2536332f9c142c8197f40ed2460fd41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 15:35:08 +0800 +Subject: ALSA: hda/realtek: Add quirk for Inspur S14-G1 + +From: Zhang Heng + +[ Upstream commit 9e18920e783d0bcd4c127a7adc66565243ab9655 ] + +Inspur S14-G1 is equipped with ALC256. +Enable "power saving mode" and Enable "headset jack mode". + +Signed-off-by: Zhang Heng +Link: https://patch.msgid.link/20260126073508.3897461-2-zhangheng@kylinos.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 2bdad4e518032..d9c3d1443a956 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -11379,6 +11379,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x2039, 0x0001, "Inspur S14-G1", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13), + SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), +-- +2.51.0 + diff --git a/queue-6.12/alsa-hda-realtek-enable-headset-mic-for-acer-nitro-5.patch b/queue-6.12/alsa-hda-realtek-enable-headset-mic-for-acer-nitro-5.patch new file mode 100644 index 0000000000..c196171271 --- /dev/null +++ b/queue-6.12/alsa-hda-realtek-enable-headset-mic-for-acer-nitro-5.patch @@ -0,0 +1,34 @@ +From 816d73f953e1cee66f61fb97b18486a2f9abd81b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 23:43:41 -0300 +Subject: ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 + +From: Breno Baptista + +[ Upstream commit 51db05283f7c9c95a3e6853a3044cd04226551bf ] + +Add quirk to support microphone input through headphone jack on Acer Nitro 5 AN515-57 (ALC295). + +Signed-off-by: Breno Baptista +Link: https://patch.msgid.link/20260205024341.26694-1-brenomb07@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 6e7fa47741b0f..5c2f442fca79a 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10450,6 +10450,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC), + SND_PCI_QUIRK(0x1025, 0x1534, "Acer Predator PH315-54", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1539, "Acer Nitro 5 AN515-57", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x159c, "Acer Nitro 5 AN515-58", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1597, "Acer Nitro 5 AN517-55", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x169a, "Acer Swift SFG16", ALC256_FIXUP_ACER_SFG16_MICMUTE_LED), +-- +2.51.0 + diff --git a/queue-6.12/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch b/queue-6.12/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch new file mode 100644 index 0000000000..11abae3aac --- /dev/null +++ b/queue-6.12/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch @@ -0,0 +1,39 @@ +From 58054d53fb3be272c43a3fa2af42677da35d834e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 16:15:55 +0100 +Subject: ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU + +From: Tim Guttzeit + +[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ] + +Add a PCI quirk to enable microphone detection on the headphone jack of +TongFang X6AR55xU devices. + +Signed-off-by: Tim Guttzeit +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260119151626.35481-1-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 7bb2647af654a..2bdad4e518032 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -11835,6 +11835,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60140}, + {0x19, 0x04a11030}, + {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC, ++ {0x17, 0x90170110}, ++ {0x19, 0x03a11030}, ++ {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT, + ALC282_STANDARD_PINS, + {0x12, 0x90a609c0}, +-- +2.51.0 + diff --git a/queue-6.12/alsa-hda-realtek-fixed-speaker-no-sound.patch b/queue-6.12/alsa-hda-realtek-fixed-speaker-no-sound.patch new file mode 100644 index 0000000000..936769d5a1 --- /dev/null +++ b/queue-6.12/alsa-hda-realtek-fixed-speaker-no-sound.patch @@ -0,0 +1,55 @@ +From 3b5bef75983373080d139b3708adc95eb19b55a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 15:21:36 +0800 +Subject: ALSA: hda/realtek - fixed speaker no sound + +From: Kailang Yang + +[ Upstream commit 630fbc6e870eb06c5126cc97a3abecbe012272c8 ] + +If it play a 5s above silence media stream, it will cause silence +detection trigger. +Speaker will make no sound when you use another app to play a stream. +Add this patch will solve this issue. + +GPIO2: Mute Hotkey GPIO3: Mic Mute LED +Enable this will turn on hotkey and LED support. + +Signed-off-by: Kailang Yang +Link: https://lore.kernel.org/f4929e137a7949238cc043d861a4d9f8@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index d9c3d1443a956..6e7fa47741b0f 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7650,11 +7650,22 @@ static void alc287_alc1318_playback_pcm_hook(struct hda_pcm_stream *hinfo, + struct snd_pcm_substream *substream, + int action) + { ++ static const struct coef_fw dis_coefs[] = { ++ WRITE_COEF(0x24, 0x0013), WRITE_COEF(0x25, 0x0000), WRITE_COEF(0x26, 0xC203), ++ WRITE_COEF(0x28, 0x0004), WRITE_COEF(0x29, 0xb023), ++ }; /* Disable AMP silence detection */ ++ static const struct coef_fw en_coefs[] = { ++ WRITE_COEF(0x24, 0x0013), WRITE_COEF(0x25, 0x0000), WRITE_COEF(0x26, 0xC203), ++ WRITE_COEF(0x28, 0x0084), WRITE_COEF(0x29, 0xb023), ++ }; /* Enable AMP silence detection */ ++ + switch (action) { + case HDA_GEN_PCM_ACT_OPEN: ++ alc_process_coef_fw(codec, dis_coefs); + alc_write_coefex_idx(codec, 0x5a, 0x00, 0x954f); /* write gpio3 to high */ + break; + case HDA_GEN_PCM_ACT_CLOSE: ++ alc_process_coef_fw(codec, en_coefs); + alc_write_coefex_idx(codec, 0x5a, 0x00, 0x554f); /* write gpio3 as default value */ + break; + } +-- +2.51.0 + diff --git a/queue-6.12/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch b/queue-6.12/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch new file mode 100644 index 0000000000..93040bc550 --- /dev/null +++ b/queue-6.12/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch @@ -0,0 +1,41 @@ +From 56b78c9707a03157d03ee6eadb7a0f6d2dea49bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 15:56:18 +0100 +Subject: ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list + +From: Anatolii Shirykalov + +[ Upstream commit 018b211b1d321a52ed8d8de74ce83ce52a2e1224 ] + +Add ASUS ExpertBook PM1503CDA to the DMI quirks table to enable +internal DMIC support via the ACP6x machine driver. + +Signed-off-by: Anatolii Shirykalov +Link: https://patch.msgid.link/20260119145618.3171435-1-pipocavsobake@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 346e200613031..4f75a7d9b0e70 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -535,6 +535,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "15NBC1011"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK PM1503CDA"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.51.0 + diff --git a/queue-6.12/asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch b/queue-6.12/asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch new file mode 100644 index 0000000000..497518c595 --- /dev/null +++ b/queue-6.12/asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch @@ -0,0 +1,41 @@ +From ba0b2016d230471ccfe547f6a5c1576343cfbc6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 14:50:19 +0800 +Subject: ASoC: amd: yc: Add quirk for HP 200 G2a 16 + +From: Dirk Su + +[ Upstream commit 611c7d2262d5645118e0b3a9a88475d35a8366f2 ] + +Fix the missing mic on HP 200 G2a 16 by adding quirk with the +board ID 8EE4 + +Signed-off-by: Dirk Su +Link: https://patch.msgid.link/20260129065038.39349-1-dirk.su@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 4f75a7d9b0e70..6d073ecad6f02 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -633,6 +633,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "8BD6"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), ++ DMI_MATCH(DMI_BOARD_NAME, "8EE4"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.51.0 + diff --git a/queue-6.12/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch b/queue-6.12/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch new file mode 100644 index 0000000000..cf7aa5fd7d --- /dev/null +++ b/queue-6.12/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch @@ -0,0 +1,37 @@ +From 68add73cfbcf1e2a0987744763cc14cc0b8b8868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 19:25:10 +0000 +Subject: ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel + +From: Ricardo Rivera-Matos + +[ Upstream commit 6dd0fdc908c02318c28ec2c0979661846ee0a9f7 ] + +ASP_TX5 was incorrectly mapped to a channel value of 3 corrects, +the channel value of 4. + +Reviewed-by: Charles Keepax +Signed-off-by: Ricardo Rivera-Matos +Link: https://patch.msgid.link/20260115192523.1335742-2-rriveram@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l45.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs35l45.c b/sound/soc/codecs/cs35l45.c +index fa1d9d9151f96..7f295c6432b20 100644 +--- a/sound/soc/codecs/cs35l45.c ++++ b/sound/soc/codecs/cs35l45.c +@@ -455,7 +455,7 @@ static const struct snd_soc_dapm_widget cs35l45_dapm_widgets[] = { + SND_SOC_DAPM_AIF_OUT("ASP_TX2", NULL, 1, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX2_EN_SHIFT, 0), + SND_SOC_DAPM_AIF_OUT("ASP_TX3", NULL, 2, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX3_EN_SHIFT, 0), + SND_SOC_DAPM_AIF_OUT("ASP_TX4", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX4_EN_SHIFT, 0), +- SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0), ++ SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 4, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0), + + SND_SOC_DAPM_MUX("ASP_TX1 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[0]), + SND_SOC_DAPM_MUX("ASP_TX2 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[1]), +-- +2.51.0 + diff --git a/queue-6.12/asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch b/queue-6.12/asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch new file mode 100644 index 0000000000..28ce3f46f9 --- /dev/null +++ b/queue-6.12/asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch @@ -0,0 +1,96 @@ +From 658ffd613b77af606be6a069e46101aefdc4adc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 15:09:27 +0000 +Subject: ASoC: cs42l43: Correct handling of 3-pole jack load detection + +From: Charles Keepax + +[ Upstream commit e77a4081d7e324dfa876a9560b2a78969446ba82 ] + +The load detection process for 3-pole jacks requires slightly +updated reference values to ensure an accurate result. Update +the code to apply different tunings for the 3-pole and 4-pole +cases. This also updates the thresholds overall so update the +relevant comments to match. + +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20260130150927.2964664-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l43-jack.c | 37 +++++++++++++++++++++++++++------ + 1 file changed, 31 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/cs42l43-jack.c b/sound/soc/codecs/cs42l43-jack.c +index 984a7f470a31f..aa0062f3aa918 100644 +--- a/sound/soc/codecs/cs42l43-jack.c ++++ b/sound/soc/codecs/cs42l43-jack.c +@@ -508,7 +508,23 @@ void cs42l43_bias_sense_timeout(struct work_struct *work) + pm_runtime_put_autosuspend(priv->dev); + } + +-static void cs42l43_start_load_detect(struct cs42l43_codec *priv) ++static const struct reg_sequence cs42l43_3pole_patch[] = { ++ { 0x4000, 0x00000055 }, ++ { 0x4000, 0x000000AA }, ++ { 0x17420, 0x8500F300 }, ++ { 0x17424, 0x36003E00 }, ++ { 0x4000, 0x00000000 }, ++}; ++ ++static const struct reg_sequence cs42l43_4pole_patch[] = { ++ { 0x4000, 0x00000055 }, ++ { 0x4000, 0x000000AA }, ++ { 0x17420, 0x7800E600 }, ++ { 0x17424, 0x36003800 }, ++ { 0x4000, 0x00000000 }, ++}; ++ ++static void cs42l43_start_load_detect(struct cs42l43_codec *priv, bool mic) + { + struct cs42l43 *cs42l43 = priv->core; + +@@ -532,6 +548,15 @@ static void cs42l43_start_load_detect(struct cs42l43_codec *priv) + dev_err(priv->dev, "Load detect HP power down timed out\n"); + } + ++ if (mic) ++ regmap_multi_reg_write_bypassed(cs42l43->regmap, ++ cs42l43_4pole_patch, ++ ARRAY_SIZE(cs42l43_4pole_patch)); ++ else ++ regmap_multi_reg_write_bypassed(cs42l43->regmap, ++ cs42l43_3pole_patch, ++ ARRAY_SIZE(cs42l43_3pole_patch)); ++ + regmap_update_bits(cs42l43->regmap, CS42L43_BLOCK_EN3, + CS42L43_ADC1_EN_MASK | CS42L43_ADC2_EN_MASK, 0); + regmap_update_bits(cs42l43->regmap, CS42L43_DACCNFG2, CS42L43_HP_HPF_EN_MASK, 0); +@@ -610,7 +635,7 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic) + + reinit_completion(&priv->load_detect); + +- cs42l43_start_load_detect(priv); ++ cs42l43_start_load_detect(priv, mic); + time_left = wait_for_completion_timeout(&priv->load_detect, + msecs_to_jiffies(CS42L43_LOAD_TIMEOUT_MS)); + cs42l43_stop_load_detect(priv); +@@ -634,11 +659,11 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic) + } + + switch (val & CS42L43_AMP3_RES_DET_MASK) { +- case 0x0: // low impedance +- case 0x1: // high impedance ++ case 0x0: // < 22 Ohm impedance ++ case 0x1: // < 150 Ohm impedance ++ case 0x2: // < 1000 Ohm impedance + return CS42L43_JACK_HEADPHONE; +- case 0x2: // lineout +- case 0x3: // Open circuit ++ case 0x3: // > 1000 Ohm impedance + return CS42L43_JACK_LINEOUT; + default: + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.12/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch b/queue-6.12/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch new file mode 100644 index 0000000000..70b529703d --- /dev/null +++ b/queue-6.12/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch @@ -0,0 +1,49 @@ +From 48238c93c973e665ba0df333d10ed258919327fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:41:12 +0000 +Subject: ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() + +From: Ziyi Guo + +[ Upstream commit f514248727606b9087bc38a284ff686e0093abf1 ] + +fsl_xcvr_activate_ctl() has +lockdep_assert_held(&card->snd_card->controls_rwsem), +but fsl_xcvr_mode_put() calls it without acquiring this lock. + +Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and +fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read(). + +Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl() +in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential +race conditions when multiple userspace threads access the control. + +Signed-off-by: Ziyi Guo +Link: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_xcvr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c +index 656a4d619cdf1..d6f00920391d1 100644 +--- a/sound/soc/fsl/fsl_xcvr.c ++++ b/sound/soc/fsl/fsl_xcvr.c +@@ -216,10 +216,13 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol, + + xcvr->mode = snd_soc_enum_item_to_val(e, item[0]); + ++ down_read(&card->snd_card->controls_rwsem); + fsl_xcvr_activate_ctl(dai, fsl_xcvr_arc_mode_kctl.name, + (xcvr->mode == FSL_XCVR_MODE_ARC)); + fsl_xcvr_activate_ctl(dai, fsl_xcvr_earc_capds_kctl.name, + (xcvr->mode == FSL_XCVR_MODE_EARC)); ++ up_read(&card->snd_card->controls_rwsem); ++ + /* Allow playback for SPDIF only */ + rtd = snd_soc_get_pcm_runtime(card, card->dai_link); + rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count = +-- +2.51.0 + diff --git a/queue-6.12/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch b/queue-6.12/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch new file mode 100644 index 0000000000..024ac29500 --- /dev/null +++ b/queue-6.12/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch @@ -0,0 +1,73 @@ +From 6a61eaa16ba004ca144f3732541976e7e819d14d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Feb 2026 15:17:28 +0300 +Subject: ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 + +From: Tagir Garaev + +[ Upstream commit 6b641122d31f9d33e7d60047ee0586d1659f3f54 ] + +Add DMI entry for Huawei Matebook D (BOD-WXX9) with HEADPHONE_GPIO +and DMIC quirks. + +This device has ES8336 codec with: +- GPIO 16 (headphone-enable) for headphone amplifier control +- GPIO 17 (speakers-enable) for speaker amplifier control +- GPIO 269 for jack detection IRQ +- 2-channel DMIC + +Hardware investigation shows that both GPIO 16 and 17 are required +for proper audio routing, as headphones and speakers share the same +physical output (HPOL/HPOR) and are separated only via amplifier +enable signals. + +RFC: Seeking advice on GPIO control issue: + +GPIO values change in driver (gpiod_get_value() shows logical value +changes) but not physically (debugfs gpio shows no change). The same +gpiod_set_value_cansleep() calls work correctly in probe context with +msleep(), but fail when called from DAPM event callbacks. + +Context information from diagnostics: +- in_atomic=0, in_interrupt=0, irqs_disabled=0 +- Process context: pipewire +- GPIO 17 (speakers): changes in driver, no physical change +- GPIO 16 (headphone): changes in driver, no physical change + +In Windows, audio switching works without visible GPIO changes, +suggesting possible ACPI/firmware involvement. + +Any suggestions on how to properly control these GPIOs from DAPM +events would be appreciated. + +Signed-off-by: Tagir Garaev +Link: https://patch.msgid.link/20260201121728.16597-1-tgaraev653@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_es8336.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c +index bc27229be7c24..7c3784112ca0f 100644 +--- a/sound/soc/intel/boards/sof_es8336.c ++++ b/sound/soc/intel/boards/sof_es8336.c +@@ -332,6 +332,15 @@ static int sof_es8336_quirk_cb(const struct dmi_system_id *id) + * if the topology file is modified as well. + */ + static const struct dmi_system_id sof_es8336_quirk_table[] = { ++ { ++ .callback = sof_es8336_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HUAWEI"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "BOD-WXX9"), ++ }, ++ .driver_data = (void *)(SOF_ES8336_HEADPHONE_GPIO | ++ SOF_ES8336_ENABLE_DMIC) ++ }, + { + .callback = sof_es8336_quirk_cb, + .matches = { +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-extend-delta-clamping-logic-to-cm3-l.patch b/queue-6.12/drm-amd-display-extend-delta-clamping-logic-to-cm3-l.patch new file mode 100644 index 0000000000..6f173762b4 --- /dev/null +++ b/queue-6.12/drm-amd-display-extend-delta-clamping-logic-to-cm3-l.patch @@ -0,0 +1,236 @@ +From 5c41b23d66f48cd00a465a9e50d999cf4dbfc8a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 22:44:15 -0100 +Subject: drm/amd/display: extend delta clamping logic to CM3 LUT helper + +From: Melissa Wen + +[ Upstream commit d25b32aa829a3ed5570138e541a71fb7805faec3 ] + +Commit 27fc10d1095f ("drm/amd/display: Fix the delta clamping for shaper +LUT") fixed banding when using plane shaper LUT in DCN10 CM helper. The +problem is also present in DCN30 CM helper, fix banding by extending the +same bug delta clamping fix to CM3. + +Signed-off-by: Melissa Wen +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +(cherry picked from commit 0274a54897f356f9c78767c4a2a5863f7dde90c6) +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/dcn30/dcn30_cm_common.c | 30 +++++++++++++++---- + .../display/dc/dwb/dcn30/dcn30_cm_common.h | 2 +- + .../amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 9 +++--- + .../amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 17 ++++++----- + .../amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 16 +++++----- + 5 files changed, 49 insertions(+), 25 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c +index f299d9455f510..4d53b17300d01 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c +@@ -105,9 +105,12 @@ void cm_helper_program_gamcor_xfer_func( + #define NUMBER_REGIONS 32 + #define NUMBER_SW_SEGMENTS 16 + +-bool cm3_helper_translate_curve_to_hw_format( +- const struct dc_transfer_func *output_tf, +- struct pwl_params *lut_params, bool fixpoint) ++#define DC_LOGGER \ ++ ctx->logger ++ ++bool cm3_helper_translate_curve_to_hw_format(struct dc_context *ctx, ++ const struct dc_transfer_func *output_tf, ++ struct pwl_params *lut_params, bool fixpoint) + { + struct curve_points3 *corner_points; + struct pwl_result_data *rgb_resulted; +@@ -256,6 +259,10 @@ bool cm3_helper_translate_curve_to_hw_format( + if (fixpoint == true) { + i = 1; + while (i != hw_points + 2) { ++ uint32_t red_clamp; ++ uint32_t green_clamp; ++ uint32_t blue_clamp; ++ + if (i >= hw_points) { + if (dc_fixpt_lt(rgb_plus_1->red, rgb->red)) + rgb_plus_1->red = dc_fixpt_add(rgb->red, +@@ -268,9 +275,20 @@ bool cm3_helper_translate_curve_to_hw_format( + rgb_minus_1->delta_blue); + } + +- rgb->delta_red_reg = dc_fixpt_clamp_u0d10(rgb->delta_red); +- rgb->delta_green_reg = dc_fixpt_clamp_u0d10(rgb->delta_green); +- rgb->delta_blue_reg = dc_fixpt_clamp_u0d10(rgb->delta_blue); ++ rgb->delta_red = dc_fixpt_sub(rgb_plus_1->red, rgb->red); ++ rgb->delta_green = dc_fixpt_sub(rgb_plus_1->green, rgb->green); ++ rgb->delta_blue = dc_fixpt_sub(rgb_plus_1->blue, rgb->blue); ++ ++ red_clamp = dc_fixpt_clamp_u0d14(rgb->delta_red); ++ green_clamp = dc_fixpt_clamp_u0d14(rgb->delta_green); ++ blue_clamp = dc_fixpt_clamp_u0d14(rgb->delta_blue); ++ ++ if (red_clamp >> 10 || green_clamp >> 10 || blue_clamp >> 10) ++ DC_LOG_ERROR("Losing delta precision while programming shaper LUT."); ++ ++ rgb->delta_red_reg = red_clamp & 0x3ff; ++ rgb->delta_green_reg = green_clamp & 0x3ff; ++ rgb->delta_blue_reg = blue_clamp & 0x3ff; + rgb->red_reg = dc_fixpt_clamp_u0d14(rgb->red); + rgb->green_reg = dc_fixpt_clamp_u0d14(rgb->green); + rgb->blue_reg = dc_fixpt_clamp_u0d14(rgb->blue); +diff --git a/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h b/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h +index bd98b327a6c70..c23dc1bb29bf8 100644 +--- a/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h ++++ b/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h +@@ -59,7 +59,7 @@ void cm_helper_program_gamcor_xfer_func( + const struct pwl_params *params, + const struct dcn3_xfer_func_reg *reg); + +-bool cm3_helper_translate_curve_to_hw_format( ++bool cm3_helper_translate_curve_to_hw_format(struct dc_context *ctx, + const struct dc_transfer_func *output_tf, + struct pwl_params *lut_params, bool fixpoint); + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c +index bded33575493b..de4282a986269 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c +@@ -228,7 +228,7 @@ bool dcn30_set_blend_lut( + if (plane_state->blend_tf.type == TF_TYPE_HWPWL) + blend_lut = &plane_state->blend_tf.pwl; + else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) { +- result = cm3_helper_translate_curve_to_hw_format( ++ result = cm3_helper_translate_curve_to_hw_format(plane_state->ctx, + &plane_state->blend_tf, &dpp_base->regamma_params, false); + if (!result) + return result; +@@ -316,8 +316,9 @@ bool dcn30_set_input_transfer_func(struct dc *dc, + if (plane_state->in_transfer_func.type == TF_TYPE_HWPWL) + params = &plane_state->in_transfer_func.pwl; + else if (plane_state->in_transfer_func.type == TF_TYPE_DISTRIBUTED_POINTS && +- cm3_helper_translate_curve_to_hw_format(&plane_state->in_transfer_func, +- &dpp_base->degamma_params, false)) ++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->in_transfer_func, ++ &dpp_base->degamma_params, false)) + params = &dpp_base->degamma_params; + + result = dpp_base->funcs->dpp_program_gamcor_lut(dpp_base, params); +@@ -388,7 +389,7 @@ bool dcn30_set_output_transfer_func(struct dc *dc, + params = &stream->out_transfer_func.pwl; + else if (pipe_ctx->stream->out_transfer_func.type == + TF_TYPE_DISTRIBUTED_POINTS && +- cm3_helper_translate_curve_to_hw_format( ++ cm3_helper_translate_curve_to_hw_format(stream->ctx, + &stream->out_transfer_func, + &mpc->blender_params, false)) + params = &mpc->blender_params; +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +index 2e8c9f7382596..17b6eebadef69 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +@@ -483,8 +483,9 @@ bool dcn32_set_mcm_luts( + if (plane_state->blend_tf.type == TF_TYPE_HWPWL) + lut_params = &plane_state->blend_tf.pwl; + else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) { +- result = cm3_helper_translate_curve_to_hw_format(&plane_state->blend_tf, +- &dpp_base->regamma_params, false); ++ result = cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->blend_tf, ++ &dpp_base->regamma_params, false); + if (!result) + return result; + +@@ -499,8 +500,9 @@ bool dcn32_set_mcm_luts( + else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) { + // TODO: dpp_base replace + ASSERT(false); +- cm3_helper_translate_curve_to_hw_format(&plane_state->in_shaper_func, +- &dpp_base->shaper_params, true); ++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->in_shaper_func, ++ &dpp_base->shaper_params, true); + lut_params = &dpp_base->shaper_params; + } + +@@ -540,8 +542,9 @@ bool dcn32_set_input_transfer_func(struct dc *dc, + if (plane_state->in_transfer_func.type == TF_TYPE_HWPWL) + params = &plane_state->in_transfer_func.pwl; + else if (plane_state->in_transfer_func.type == TF_TYPE_DISTRIBUTED_POINTS && +- cm3_helper_translate_curve_to_hw_format(&plane_state->in_transfer_func, +- &dpp_base->degamma_params, false)) ++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->in_transfer_func, ++ &dpp_base->degamma_params, false)) + params = &dpp_base->degamma_params; + + dpp_base->funcs->dpp_program_gamcor_lut(dpp_base, params); +@@ -572,7 +575,7 @@ bool dcn32_set_output_transfer_func(struct dc *dc, + params = &stream->out_transfer_func.pwl; + else if (pipe_ctx->stream->out_transfer_func.type == + TF_TYPE_DISTRIBUTED_POINTS && +- cm3_helper_translate_curve_to_hw_format( ++ cm3_helper_translate_curve_to_hw_format(stream->ctx, + &stream->out_transfer_func, + &mpc->blender_params, false)) + params = &mpc->blender_params; +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index bcb296a954f2b..f805803be55e4 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -514,7 +514,7 @@ void dcn401_populate_mcm_luts(struct dc *dc, + if (mcm_luts.lut1d_func->type == TF_TYPE_HWPWL) + m_lut_params.pwl = &mcm_luts.lut1d_func->pwl; + else if (mcm_luts.lut1d_func->type == TF_TYPE_DISTRIBUTED_POINTS) { +- rval = cm3_helper_translate_curve_to_hw_format( ++ rval = cm3_helper_translate_curve_to_hw_format(mpc->ctx, + mcm_luts.lut1d_func, + &dpp_base->regamma_params, false); + m_lut_params.pwl = rval ? &dpp_base->regamma_params : NULL; +@@ -534,7 +534,7 @@ void dcn401_populate_mcm_luts(struct dc *dc, + m_lut_params.pwl = &mcm_luts.shaper->pwl; + else if (mcm_luts.shaper->type == TF_TYPE_DISTRIBUTED_POINTS) { + ASSERT(false); +- rval = cm3_helper_translate_curve_to_hw_format( ++ rval = cm3_helper_translate_curve_to_hw_format(mpc->ctx, + mcm_luts.shaper, + &dpp_base->regamma_params, true); + m_lut_params.pwl = rval ? &dpp_base->regamma_params : NULL; +@@ -683,8 +683,9 @@ bool dcn401_set_mcm_luts(struct pipe_ctx *pipe_ctx, + if (plane_state->blend_tf.type == TF_TYPE_HWPWL) + lut_params = &plane_state->blend_tf.pwl; + else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) { +- rval = cm3_helper_translate_curve_to_hw_format(&plane_state->blend_tf, +- &dpp_base->regamma_params, false); ++ rval = cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->blend_tf, ++ &dpp_base->regamma_params, false); + lut_params = rval ? &dpp_base->regamma_params : NULL; + } + result = mpc->funcs->program_1dlut(mpc, lut_params, mpcc_id); +@@ -695,8 +696,9 @@ bool dcn401_set_mcm_luts(struct pipe_ctx *pipe_ctx, + lut_params = &plane_state->in_shaper_func.pwl; + else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) { + // TODO: dpp_base replace +- rval = cm3_helper_translate_curve_to_hw_format(&plane_state->in_shaper_func, +- &dpp_base->shaper_params, true); ++ rval = cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->in_shaper_func, ++ &dpp_base->shaper_params, true); + lut_params = rval ? &dpp_base->shaper_params : NULL; + } + result &= mpc->funcs->program_shaper(mpc, lut_params, mpcc_id); +@@ -730,7 +732,7 @@ bool dcn401_set_output_transfer_func(struct dc *dc, + params = &stream->out_transfer_func.pwl; + else if (pipe_ctx->stream->out_transfer_func.type == + TF_TYPE_DISTRIBUTED_POINTS && +- cm3_helper_translate_curve_to_hw_format( ++ cm3_helper_translate_curve_to_hw_format(stream->ctx, + &stream->out_transfer_func, + &mpc->blender_params, false)) + params = &mpc->blender_params; +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-remove-assert-around-dpp_base-replac.patch b/queue-6.12/drm-amd-display-remove-assert-around-dpp_base-replac.patch new file mode 100644 index 0000000000..ff1986d536 --- /dev/null +++ b/queue-6.12/drm-amd-display-remove-assert-around-dpp_base-replac.patch @@ -0,0 +1,36 @@ +From 3f15b36e60eadca9a3f3310937018e2853a23c1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 12:50:49 -0300 +Subject: drm/amd/display: remove assert around dpp_base replacement + +From: Melissa Wen + +[ Upstream commit 84962445cd8a83dc5bed4c8ad5bbb2c1cdb249a0 ] + +There is nothing wrong if in_shaper_func type is DISTRIBUTED POINTS. +Remove the assert placed for a TODO to avoid misinterpretations. + +Signed-off-by: Melissa Wen +Reviewed-by: Alex Hung +Signed-off-by: Alex Deucher +(cherry picked from commit 1714dcc4c2c53e41190896eba263ed6328bcf415) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +index 17b6eebadef69..39cc924463502 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +@@ -499,7 +499,6 @@ bool dcn32_set_mcm_luts( + lut_params = &plane_state->in_shaper_func.pwl; + else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) { + // TODO: dpp_base replace +- ASSERT(false); + cm3_helper_translate_curve_to_hw_format(plane_state->ctx, + &plane_state->in_shaper_func, + &dpp_base->shaper_params, true); +-- +2.51.0 + diff --git a/queue-6.12/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch b/queue-6.12/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch new file mode 100644 index 0000000000..74ef24c2b7 --- /dev/null +++ b/queue-6.12/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch @@ -0,0 +1,80 @@ +From c9c3ef023e10f19d586104561d2866740daf8fb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 02:50:20 +0530 +Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?= + =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ] + +The variable j is set, however never used in or outside the loop, thus +resulting in dead code. +Building with GCC 16 results in a build error due to +-Werror=unused-but-set-variable= enabled by default. +This patch clean up the dead code and fixes the build error. + +Example build log: +drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=] + 1867 | size_t i, j; + | ^ + +Signed-off-by: Brahmajit Das +Signed-off-by: Thierry Reding +Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/hdmi.c | 4 ++-- + drivers/gpu/drm/tegra/sor.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c +index 09987e372e3ef..02b260cbbf0c8 100644 +--- a/drivers/gpu/drm/tegra/hdmi.c ++++ b/drivers/gpu/drm/tegra/hdmi.c +@@ -658,7 +658,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -691,7 +691,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_hdmi_subpack(&ptr[i], num); +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index bad3b8fcc7269..c2a57f85051ae 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -1864,7 +1864,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -1897,7 +1897,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_sor_hdmi_subpack(&ptr[i], num); +-- +2.51.0 + diff --git a/queue-6.12/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch b/queue-6.12/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch new file mode 100644 index 0000000000..5c1661dc28 --- /dev/null +++ b/queue-6.12/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch @@ -0,0 +1,123 @@ +From 11234258a8c4810374a14a9ed0fde32ea543f160 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 17:42:09 +0800 +Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock + +From: Xuewen Yan + +[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ] + +There was a lockdep warning in sprd_gpio: + +[ 6.258269][T329@C6] [ BUG: Invalid wait context ] +[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE +[ 6.258272][T329@C6] ----------------------------- +[ 6.258273][T329@C6] modprobe/329 is trying to lock: +[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd] +[ 6.258282][T329@C6] other info that might help us debug this: +[ 6.258283][T329@C6] context-{5:5} +[ 6.258285][T329@C6] 3 locks held by modprobe/329: +[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204 +[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c +[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c +[ 6.258313][T329@C6] stack backtrace: +[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df +[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT) +[ 6.258318][T329@C6] Call trace: +[ 6.258318][T329@C6] show_stack+0x20/0x30 (C) +[ 6.258321][T329@C6] __dump_stack+0x28/0x3c +[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0 +[ 6.258326][T329@C6] dump_stack+0x18/0x3c +[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28 +[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc +[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4 +[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487] +[ 6.258337][T329@C6] irq_startup+0x238/0x350 +[ 6.258340][T329@C6] __setup_irq+0x504/0x82c +[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184 +[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120 +[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350 +[ 6.258361][T329@C6] really_probe+0x1a8/0x46c +[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c +[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4 +[ 6.258369][T329@C6] __driver_attach+0xd0/0x204 +[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168 +[ 6.258373][T329@C6] driver_attach+0x2c/0x3c +[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c +[ 6.258378][T329@C6] driver_register+0x70/0x10c +[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8 +[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c +[ 6.258392][T329@C6] do_init_module+0x60/0x254 +[ 6.258395][T329@C6] load_module+0x1054/0x1220 +[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c +[ 6.258400][T329@C6] invoke_syscall+0x60/0xec +[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4 +[ 6.258405][T329@C6] do_el0_svc+0x24/0x30 +[ 6.258407][T329@C6] el0_svc+0x54/0x1c4 +[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc +[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8 + +This is because the spin_lock would change to rt_mutex in PREEMPT_RT, +however the sprd_gpio->lock would use in hard-irq, this is unsafe. + +So change the spin_lock_t to raw_spin_lock_t to use the spinlock +in hard-irq. + +Signed-off-by: Xuewen Yan +Reviewed-by: Baolin Wang +Reviewed-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com +[Bartosz: tweaked the commit message] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-sprd.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c +index c117c11bfb29a..192f05a2c19c1 100644 +--- a/drivers/gpio/gpio-sprd.c ++++ b/drivers/gpio/gpio-sprd.c +@@ -35,7 +35,7 @@ + struct sprd_gpio { + struct gpio_chip chip; + void __iomem *base; +- spinlock_t lock; ++ raw_spinlock_t lock; + int irq; + }; + +@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + unsigned long flags; + u32 tmp; + +- spin_lock_irqsave(&sprd_gpio->lock, flags); ++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags); + tmp = readl_relaxed(base + reg); + + if (val) +@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + tmp &= ~BIT(SPRD_GPIO_BIT(offset)); + + writel_relaxed(tmp, base + reg); +- spin_unlock_irqrestore(&sprd_gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags); + } + + static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg) +@@ -234,7 +234,7 @@ static int sprd_gpio_probe(struct platform_device *pdev) + if (IS_ERR(sprd_gpio->base)) + return PTR_ERR(sprd_gpio->base); + +- spin_lock_init(&sprd_gpio->lock); ++ raw_spin_lock_init(&sprd_gpio->lock); + + sprd_gpio->chip.label = dev_name(&pdev->dev); + sprd_gpio->chip.ngpio = SPRD_GPIO_NR; +-- +2.51.0 + diff --git a/queue-6.12/gpiolib-acpi-fix-gpio-count-with-string-references.patch b/queue-6.12/gpiolib-acpi-fix-gpio-count-with-string-references.patch new file mode 100644 index 0000000000..afe775dd57 --- /dev/null +++ b/queue-6.12/gpiolib-acpi-fix-gpio-count-with-string-references.patch @@ -0,0 +1,39 @@ +From 4c27e26b58f822ac3dcdcc6bef64ae9b2fc71320 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 15:59:44 +0100 +Subject: gpiolib: acpi: Fix gpio count with string references + +From: Alban Bedel + +[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ] + +Since commit 9880702d123f2 ("ACPI: property: Support using strings in +reference properties") it is possible to use strings instead of local +references. This work fine with single GPIO but not with arrays as +acpi_gpio_package_count() didn't handle this case. Update it to handle +strings like local references to cover this case as well. + +Signed-off-by: Alban Bedel +Reviewed-by: Mika Westerberg +Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-acpi-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpio/gpiolib-acpi-core.c b/drivers/gpio/gpiolib-acpi-core.c +index fc2033f2cf258..f6bec9d2fd265 100644 +--- a/drivers/gpio/gpiolib-acpi-core.c ++++ b/drivers/gpio/gpiolib-acpi-core.c +@@ -1351,6 +1351,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj) + while (element < end) { + switch (element->type) { + case ACPI_TYPE_LOCAL_REFERENCE: ++ case ACPI_TYPE_STRING: + element += 3; + fallthrough; + case ACPI_TYPE_INTEGER: +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch b/queue-6.12/platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch new file mode 100644 index 0000000000..9f15645d8b --- /dev/null +++ b/queue-6.12/platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch @@ -0,0 +1,44 @@ +From eee15415497125f08d6a907fe2aad777897cb99b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 23:55:00 +0800 +Subject: platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: gongqi <550230171hxy@gmail.com> + +[ Upstream commit 2b4e00d8e70ca8736fda82447be6a4e323c6d1f5 ] + +The MECHREVO Wujie 15X Pro suffers from spurious IRQ issues related to +the AMD PMC. Add it to the quirk list to use the spurious_8042 fix. + +Signed-off-by: gongqi <550230171hxy@gmail.com> +Link: https://patch.msgid.link/20260122155501.376199-4-550230171hxy@gmail.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index a5031339dac8c..a6006b4ec2cc0 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -296,6 +296,13 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_BOARD_NAME, "XxKK4NAx_XxSP4NAx"), + } + }, ++ { ++ .ident = "MECHREVO Wujie 15X Pro", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"), ++ } ++ }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-classmate-laptop-add-missing-null-point.patch b/queue-6.12/platform-x86-classmate-laptop-add-missing-null-point.patch new file mode 100644 index 0000000000..30e79d9a2a --- /dev/null +++ b/queue-6.12/platform-x86-classmate-laptop-add-missing-null-point.patch @@ -0,0 +1,138 @@ +From 397bccfeb4872067ab14312ac3abb05c38db89f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 21:02:40 +0100 +Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ] + +In a few places in the Classmate laptop driver, code using the accel +object may run before that object's address is stored in the driver +data of the input device using it. + +For example, cmpc_accel_sensitivity_store_v4() is the "show" method +of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), +before calling dev_set_drvdata() for inputdev->dev. If the sysfs +attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) +call in in cmpc_accel_sensitivity_store_v4() returns NULL which +leads to a NULL pointer dereference going forward. + +Moreover, sysfs attributes using the input device are added before +initializing that device by cmpc_add_acpi_notify_device() and if one +of them is accessed before running that function, a NULL pointer +dereference will occur. + +For example, cmpc_accel_sensitivity_attr_v4 is added before calling +cmpc_add_acpi_notify_device() and if it is read prematurely, the +dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() +returns NULL which leads to a NULL pointer dereference going forward. + +Fix this by adding NULL pointer checks in all of the relevant places. + +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c +index cb6fce655e35b..452cdec11e3db 100644 +--- a/drivers/platform/x86/classmate-laptop.c ++++ b/drivers/platform/x86/classmate-laptop.c +@@ -206,7 +206,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->sensitivity); + } +@@ -223,7 +228,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +@@ -255,7 +265,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->g_select); + } +@@ -272,7 +287,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &g_select); + if (r) +@@ -301,6 +321,8 @@ static int cmpc_accel_open_v4(struct input_dev *input) + + acpi = to_acpi_device(input->dev.parent); + accel = dev_get_drvdata(&input->dev); ++ if (!accel) ++ return -ENXIO; + + cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity); + cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select); +@@ -548,7 +570,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->sensitivity); + } +@@ -565,7 +592,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch b/queue-6.12/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch new file mode 100644 index 0000000000..e561216acf --- /dev/null +++ b/queue-6.12/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch @@ -0,0 +1,53 @@ +From 177bdcac4ad2d652120b9fc0f6fb110770ba87c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 16:43:44 +0100 +Subject: platform/x86: panasonic-laptop: Fix sysfs group leak in error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +[ Upstream commit 43b0b7eff4b3fb684f257d5a24376782e9663465 ] + +The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group +if platform_device_register_simple() fails for the "panasonic" platform +device. + +Address this by making it call sysfs_remove_group() in that case for +the group in question. + +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/panasonic-laptop.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c +index 22ca70eb82271..851f0f92219dd 100644 +--- a/drivers/platform/x86/panasonic-laptop.c ++++ b/drivers/platform/x86/panasonic-laptop.c +@@ -1089,7 +1089,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) + PLATFORM_DEVID_NONE, NULL, 0); + if (IS_ERR(pcc->platform)) { + result = PTR_ERR(pcc->platform); +- goto out_backlight; ++ goto out_sysfs; + } + result = device_create_file(&pcc->platform->dev, + &dev_attr_cdpower); +@@ -1105,6 +1105,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) + + out_platform: + platform_device_unregister(pcc->platform); ++out_sysfs: ++ sysfs_remove_group(&device->dev.kobj, &pcc_attr_group); + out_backlight: + backlight_device_unregister(pcc->backlight); + out_input: +-- +2.51.0 + diff --git a/queue-6.12/romfs-check-sb_set_blocksize-return-value.patch b/queue-6.12/romfs-check-sb_set_blocksize-return-value.patch new file mode 100644 index 0000000000..4ae1630fd2 --- /dev/null +++ b/queue-6.12/romfs-check-sb_set_blocksize-return-value.patch @@ -0,0 +1,62 @@ +From 4e5ed102021de1e1cafd59f937b48dd1ac4d19b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:10:37 +0530 +Subject: romfs: check sb_set_blocksize() return value + +From: Deepanshu Kartikey + +[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ] + +romfs_fill_super() ignores the return value of sb_set_blocksize(), which +can fail if the requested block size is incompatible with the block +device's configuration. + +This can be triggered by setting a loop device's block size larger than +PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs +filesystem on that device. + +When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the +device has logical_block_size=32768, bdev_validate_blocksize() fails +because the requested size is smaller than the device's logical block +size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and +continues mounting. + +The superblock's block size remains at the device's logical block size +(32768). Later, when sb_bread() attempts I/O with this oversized block +size, it triggers a kernel BUG in folio_set_bh(): + + kernel BUG at fs/buffer.c:1582! + BUG_ON(size > PAGE_SIZE); + +Fix by checking the return value of sb_set_blocksize() and failing the +mount with -EINVAL if it returns 0. + +Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25 +Signed-off-by: Deepanshu Kartikey +Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/romfs/super.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/romfs/super.c b/fs/romfs/super.c +index 0addcc849ff2c..e83f9b78d7a16 100644 +--- a/fs/romfs/super.c ++++ b/fs/romfs/super.c +@@ -458,7 +458,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc) + + #ifdef CONFIG_BLOCK + if (!sb->s_mtd) { +- sb_set_blocksize(sb, ROMBSIZE); ++ if (!sb_set_blocksize(sb, ROMBSIZE)) { ++ errorf(fc, "romfs: unable to set blocksize\n"); ++ return -EINVAL; ++ } + } else { + sb->s_blocksize = ROMBSIZE; + sb->s_blocksize_bits = blksize_bits(ROMBSIZE); +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series new file mode 100644 index 0000000000..d1911609bf --- /dev/null +++ b/queue-6.12/series @@ -0,0 +1,20 @@ +alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch +asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch +gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch +alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch +asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch +alsa-hda-realtek-fixed-speaker-no-sound.patch +romfs-check-sb_set_blocksize-return-value.patch +drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch +platform-x86-classmate-laptop-add-missing-null-point.patch +asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch +asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch +alsa-hda-realtek-enable-headset-mic-for-acer-nitro-5.patch +platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch +platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch +asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch +tracing-dma-cap-dma_map_sg-tracepoint-arrays-to-prev.patch +drm-amd-display-extend-delta-clamping-logic-to-cm3-l.patch +drm-amd-display-remove-assert-around-dpp_base-replac.patch +asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch +gpiolib-acpi-fix-gpio-count-with-string-references.patch diff --git a/queue-6.12/tracing-dma-cap-dma_map_sg-tracepoint-arrays-to-prev.patch b/queue-6.12/tracing-dma-cap-dma_map_sg-tracepoint-arrays-to-prev.patch new file mode 100644 index 0000000000..39b99512ee --- /dev/null +++ b/queue-6.12/tracing-dma-cap-dma_map_sg-tracepoint-arrays-to-prev.patch @@ -0,0 +1,117 @@ +From fd1eef39b1b5b5ce8aa3d7f77fe858ef10b44e2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 21:22:15 +0530 +Subject: tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer + overflow + +From: Deepanshu Kartikey + +[ Upstream commit daafcc0ef0b358d9d622b6e3b7c43767aa3814ee ] + +The dma_map_sg tracepoint can trigger a perf buffer overflow when +tracing large scatter-gather lists. With devices like virtio-gpu +creating large DRM buffers, nents can exceed 1000 entries, resulting +in: + + phys_addrs: 1000 * 8 bytes = 8,000 bytes + dma_addrs: 1000 * 8 bytes = 8,000 bytes + lengths: 1000 * 4 bytes = 4,000 bytes + Total: ~20,000 bytes + +This exceeds PERF_MAX_TRACE_SIZE (8192 bytes), causing: + + WARNING: CPU: 0 PID: 5497 at kernel/trace/trace_event_perf.c:405 + perf buffer not large enough, wanted 24620, have 8192 + +Cap all three dynamic arrays at 128 entries using min() in the array +size calculation. This ensures arrays are only as large as needed +(up to the cap), avoiding unnecessary memory allocation for small +operations while preventing overflow for large ones. + +The tracepoint now records the full nents/ents counts and a truncated +flag so users can see when data has been capped. + +Changes in v2: +- Use min(nents, DMA_TRACE_MAX_ENTRIES) for dynamic array sizing + instead of fixed DMA_TRACE_MAX_ENTRIES allocation (feedback from + Steven Rostedt) +- This allocates only what's needed up to the cap, avoiding waste + for small operations + +Reported-by: syzbot+28cea38c382fd15e751a@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=28cea38c382fd15e751a +Tested-by: syzbot+28cea38c382fd15e751a@syzkaller.appspotmail.com +Signed-off-by: Deepanshu Kartikey +Reviwed-by: Sean Anderson +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20260130155215.69737-1-kartikey406@gmail.com +Signed-off-by: Sasha Levin +--- + include/trace/events/dma.h | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +diff --git a/include/trace/events/dma.h b/include/trace/events/dma.h +index e5187144c91b7..705363b228a40 100644 +--- a/include/trace/events/dma.h ++++ b/include/trace/events/dma.h +@@ -278,6 +278,8 @@ TRACE_EVENT(dma_free_sgt, + sizeof(u64), sizeof(u64))) + ); + ++#define DMA_TRACE_MAX_ENTRIES 128 ++ + TRACE_EVENT(dma_map_sg, + TP_PROTO(struct device *dev, struct scatterlist *sgl, int nents, + int ents, enum dma_data_direction dir, unsigned long attrs), +@@ -285,9 +287,12 @@ TRACE_EVENT(dma_map_sg, + + TP_STRUCT__entry( + __string(device, dev_name(dev)) +- __dynamic_array(u64, phys_addrs, nents) +- __dynamic_array(u64, dma_addrs, ents) +- __dynamic_array(unsigned int, lengths, ents) ++ __field(int, full_nents) ++ __field(int, full_ents) ++ __field(bool, truncated) ++ __dynamic_array(u64, phys_addrs, min(nents, DMA_TRACE_MAX_ENTRIES)) ++ __dynamic_array(u64, dma_addrs, min(ents, DMA_TRACE_MAX_ENTRIES)) ++ __dynamic_array(unsigned int, lengths, min(ents, DMA_TRACE_MAX_ENTRIES)) + __field(enum dma_data_direction, dir) + __field(unsigned long, attrs) + ), +@@ -295,11 +300,16 @@ TRACE_EVENT(dma_map_sg, + TP_fast_assign( + struct scatterlist *sg; + int i; ++ int traced_nents = min_t(int, nents, DMA_TRACE_MAX_ENTRIES); ++ int traced_ents = min_t(int, ents, DMA_TRACE_MAX_ENTRIES); + + __assign_str(device); +- for_each_sg(sgl, sg, nents, i) ++ __entry->full_nents = nents; ++ __entry->full_ents = ents; ++ __entry->truncated = (nents > DMA_TRACE_MAX_ENTRIES) || (ents > DMA_TRACE_MAX_ENTRIES); ++ for_each_sg(sgl, sg, traced_nents, i) + ((u64 *)__get_dynamic_array(phys_addrs))[i] = sg_phys(sg); +- for_each_sg(sgl, sg, ents, i) { ++ for_each_sg(sgl, sg, traced_ents, i) { + ((u64 *)__get_dynamic_array(dma_addrs))[i] = + sg_dma_address(sg); + ((unsigned int *)__get_dynamic_array(lengths))[i] = +@@ -309,9 +319,12 @@ TRACE_EVENT(dma_map_sg, + __entry->attrs = attrs; + ), + +- TP_printk("%s dir=%s dma_addrs=%s sizes=%s phys_addrs=%s attrs=%s", ++ TP_printk("%s dir=%s nents=%d/%d ents=%d/%d%s dma_addrs=%s sizes=%s phys_addrs=%s attrs=%s", + __get_str(device), + decode_dma_data_direction(__entry->dir), ++ min_t(int, __entry->full_nents, DMA_TRACE_MAX_ENTRIES), __entry->full_nents, ++ min_t(int, __entry->full_ents, DMA_TRACE_MAX_ENTRIES), __entry->full_ents, ++ __entry->truncated ? " [TRUNCATED]" : "", + __print_array(__get_dynamic_array(dma_addrs), + __get_dynamic_array_len(dma_addrs) / + sizeof(u64), sizeof(u64)), +-- +2.51.0 + diff --git a/queue-6.18/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch b/queue-6.18/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch new file mode 100644 index 0000000000..f02821de66 --- /dev/null +++ b/queue-6.18/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch @@ -0,0 +1,35 @@ +From 0b6bfe976f77e3585fc4010e842890fd2f24b2ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 15:35:08 +0800 +Subject: ALSA: hda/realtek: Add quirk for Inspur S14-G1 + +From: Zhang Heng + +[ Upstream commit 9e18920e783d0bcd4c127a7adc66565243ab9655 ] + +Inspur S14-G1 is equipped with ALC256. +Enable "power saving mode" and Enable "headset jack mode". + +Signed-off-by: Zhang Heng +Link: https://patch.msgid.link/20260126073508.3897461-2-zhangheng@kylinos.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 2e9efafa732fe..a77f16abc6df0 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -7243,6 +7243,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x2039, 0x0001, "Inspur S14-G1", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13), + SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), +-- +2.51.0 + diff --git a/queue-6.18/alsa-hda-realtek-enable-headset-mic-for-acer-nitro-5.patch b/queue-6.18/alsa-hda-realtek-enable-headset-mic-for-acer-nitro-5.patch new file mode 100644 index 0000000000..27f2824a30 --- /dev/null +++ b/queue-6.18/alsa-hda-realtek-enable-headset-mic-for-acer-nitro-5.patch @@ -0,0 +1,34 @@ +From af517b4bb48f107e7e8d503f2130e1fda2855151 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Feb 2026 23:43:41 -0300 +Subject: ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 + +From: Breno Baptista + +[ Upstream commit 51db05283f7c9c95a3e6853a3044cd04226551bf ] + +Add quirk to support microphone input through headphone jack on Acer Nitro 5 AN515-57 (ALC295). + +Signed-off-by: Breno Baptista +Link: https://patch.msgid.link/20260205024341.26694-1-brenomb07@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index 55ef52fefaef4..a16cb45ac59e3 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -6271,6 +6271,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC), + SND_PCI_QUIRK(0x1025, 0x1534, "Acer Predator PH315-54", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1539, "Acer Nitro 5 AN515-57", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x159c, "Acer Nitro 5 AN515-58", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1597, "Acer Nitro 5 AN517-55", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x169a, "Acer Swift SFG16", ALC256_FIXUP_ACER_SFG16_MICMUTE_LED), +-- +2.51.0 + diff --git a/queue-6.18/alsa-hda-realtek-fixed-speaker-no-sound.patch b/queue-6.18/alsa-hda-realtek-fixed-speaker-no-sound.patch new file mode 100644 index 0000000000..55bbde9d36 --- /dev/null +++ b/queue-6.18/alsa-hda-realtek-fixed-speaker-no-sound.patch @@ -0,0 +1,55 @@ +From f7101c12318a52a0642203802910ca3786da778b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jan 2026 15:21:36 +0800 +Subject: ALSA: hda/realtek - fixed speaker no sound + +From: Kailang Yang + +[ Upstream commit 630fbc6e870eb06c5126cc97a3abecbe012272c8 ] + +If it play a 5s above silence media stream, it will cause silence +detection trigger. +Speaker will make no sound when you use another app to play a stream. +Add this patch will solve this issue. + +GPIO2: Mute Hotkey GPIO3: Mic Mute LED +Enable this will turn on hotkey and LED support. + +Signed-off-by: Kailang Yang +Link: https://lore.kernel.org/f4929e137a7949238cc043d861a4d9f8@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index a77f16abc6df0..55ef52fefaef4 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -3371,11 +3371,22 @@ static void alc287_alc1318_playback_pcm_hook(struct hda_pcm_stream *hinfo, + struct snd_pcm_substream *substream, + int action) + { ++ static const struct coef_fw dis_coefs[] = { ++ WRITE_COEF(0x24, 0x0013), WRITE_COEF(0x25, 0x0000), WRITE_COEF(0x26, 0xC203), ++ WRITE_COEF(0x28, 0x0004), WRITE_COEF(0x29, 0xb023), ++ }; /* Disable AMP silence detection */ ++ static const struct coef_fw en_coefs[] = { ++ WRITE_COEF(0x24, 0x0013), WRITE_COEF(0x25, 0x0000), WRITE_COEF(0x26, 0xC203), ++ WRITE_COEF(0x28, 0x0084), WRITE_COEF(0x29, 0xb023), ++ }; /* Enable AMP silence detection */ ++ + switch (action) { + case HDA_GEN_PCM_ACT_OPEN: ++ alc_process_coef_fw(codec, dis_coefs); + alc_write_coefex_idx(codec, 0x5a, 0x00, 0x954f); /* write gpio3 to high */ + break; + case HDA_GEN_PCM_ACT_CLOSE: ++ alc_process_coef_fw(codec, en_coefs); + alc_write_coefex_idx(codec, 0x5a, 0x00, 0x554f); /* write gpio3 as default value */ + break; + } +-- +2.51.0 + diff --git a/queue-6.18/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch b/queue-6.18/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch new file mode 100644 index 0000000000..b6cdfa4251 --- /dev/null +++ b/queue-6.18/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch @@ -0,0 +1,41 @@ +From 2fd105a4cf11ddbc6a238f191f05d2c43e2d3c39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 15:56:18 +0100 +Subject: ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list + +From: Anatolii Shirykalov + +[ Upstream commit 018b211b1d321a52ed8d8de74ce83ce52a2e1224 ] + +Add ASUS ExpertBook PM1503CDA to the DMI quirks table to enable +internal DMIC support via the ACP6x machine driver. + +Signed-off-by: Anatolii Shirykalov +Link: https://patch.msgid.link/20260119145618.3171435-1-pipocavsobake@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index c4a4a06528b45..c18da0915baad 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -542,6 +542,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "15NBC1011"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK PM1503CDA"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.51.0 + diff --git a/queue-6.18/asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch b/queue-6.18/asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch new file mode 100644 index 0000000000..0ece31b911 --- /dev/null +++ b/queue-6.18/asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch @@ -0,0 +1,41 @@ +From 8c96c955b30211ed7a0ce47bde212f4421b50da2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 14:50:19 +0800 +Subject: ASoC: amd: yc: Add quirk for HP 200 G2a 16 + +From: Dirk Su + +[ Upstream commit 611c7d2262d5645118e0b3a9a88475d35a8366f2 ] + +Fix the missing mic on HP 200 G2a 16 by adding quirk with the +board ID 8EE4 + +Signed-off-by: Dirk Su +Link: https://patch.msgid.link/20260129065038.39349-1-dirk.su@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index c18da0915baad..67f2fee193980 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -640,6 +640,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "8BD6"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), ++ DMI_MATCH(DMI_BOARD_NAME, "8EE4"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.51.0 + diff --git a/queue-6.18/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch b/queue-6.18/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch new file mode 100644 index 0000000000..fe8df6a00d --- /dev/null +++ b/queue-6.18/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch @@ -0,0 +1,37 @@ +From 53296ae824bc43913e74ef3bbafa61eefcaa86e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 19:25:10 +0000 +Subject: ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel + +From: Ricardo Rivera-Matos + +[ Upstream commit 6dd0fdc908c02318c28ec2c0979661846ee0a9f7 ] + +ASP_TX5 was incorrectly mapped to a channel value of 3 corrects, +the channel value of 4. + +Reviewed-by: Charles Keepax +Signed-off-by: Ricardo Rivera-Matos +Link: https://patch.msgid.link/20260115192523.1335742-2-rriveram@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l45.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs35l45.c b/sound/soc/codecs/cs35l45.c +index d4dcdf37bb709..9b1eff4e9bb71 100644 +--- a/sound/soc/codecs/cs35l45.c ++++ b/sound/soc/codecs/cs35l45.c +@@ -455,7 +455,7 @@ static const struct snd_soc_dapm_widget cs35l45_dapm_widgets[] = { + SND_SOC_DAPM_AIF_OUT("ASP_TX2", NULL, 1, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX2_EN_SHIFT, 0), + SND_SOC_DAPM_AIF_OUT("ASP_TX3", NULL, 2, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX3_EN_SHIFT, 0), + SND_SOC_DAPM_AIF_OUT("ASP_TX4", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX4_EN_SHIFT, 0), +- SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0), ++ SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 4, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0), + + SND_SOC_DAPM_MUX("ASP_TX1 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[0]), + SND_SOC_DAPM_MUX("ASP_TX2 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[1]), +-- +2.51.0 + diff --git a/queue-6.18/asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch b/queue-6.18/asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch new file mode 100644 index 0000000000..534703d011 --- /dev/null +++ b/queue-6.18/asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch @@ -0,0 +1,96 @@ +From de054a5ab2f0099e166b439e012ac9fb8cc1a4c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 15:09:27 +0000 +Subject: ASoC: cs42l43: Correct handling of 3-pole jack load detection + +From: Charles Keepax + +[ Upstream commit e77a4081d7e324dfa876a9560b2a78969446ba82 ] + +The load detection process for 3-pole jacks requires slightly +updated reference values to ensure an accurate result. Update +the code to apply different tunings for the 3-pole and 4-pole +cases. This also updates the thresholds overall so update the +relevant comments to match. + +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20260130150927.2964664-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l43-jack.c | 37 +++++++++++++++++++++++++++------ + 1 file changed, 31 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/cs42l43-jack.c b/sound/soc/codecs/cs42l43-jack.c +index 867e23d4fb8d8..744488f371ea4 100644 +--- a/sound/soc/codecs/cs42l43-jack.c ++++ b/sound/soc/codecs/cs42l43-jack.c +@@ -496,7 +496,23 @@ void cs42l43_bias_sense_timeout(struct work_struct *work) + pm_runtime_put_autosuspend(priv->dev); + } + +-static void cs42l43_start_load_detect(struct cs42l43_codec *priv) ++static const struct reg_sequence cs42l43_3pole_patch[] = { ++ { 0x4000, 0x00000055 }, ++ { 0x4000, 0x000000AA }, ++ { 0x17420, 0x8500F300 }, ++ { 0x17424, 0x36003E00 }, ++ { 0x4000, 0x00000000 }, ++}; ++ ++static const struct reg_sequence cs42l43_4pole_patch[] = { ++ { 0x4000, 0x00000055 }, ++ { 0x4000, 0x000000AA }, ++ { 0x17420, 0x7800E600 }, ++ { 0x17424, 0x36003800 }, ++ { 0x4000, 0x00000000 }, ++}; ++ ++static void cs42l43_start_load_detect(struct cs42l43_codec *priv, bool mic) + { + struct cs42l43 *cs42l43 = priv->core; + +@@ -520,6 +536,15 @@ static void cs42l43_start_load_detect(struct cs42l43_codec *priv) + dev_err(priv->dev, "Load detect HP power down timed out\n"); + } + ++ if (mic) ++ regmap_multi_reg_write_bypassed(cs42l43->regmap, ++ cs42l43_4pole_patch, ++ ARRAY_SIZE(cs42l43_4pole_patch)); ++ else ++ regmap_multi_reg_write_bypassed(cs42l43->regmap, ++ cs42l43_3pole_patch, ++ ARRAY_SIZE(cs42l43_3pole_patch)); ++ + regmap_update_bits(cs42l43->regmap, CS42L43_BLOCK_EN3, + CS42L43_ADC1_EN_MASK | CS42L43_ADC2_EN_MASK, 0); + regmap_update_bits(cs42l43->regmap, CS42L43_DACCNFG2, CS42L43_HP_HPF_EN_MASK, 0); +@@ -598,7 +623,7 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic) + + reinit_completion(&priv->load_detect); + +- cs42l43_start_load_detect(priv); ++ cs42l43_start_load_detect(priv, mic); + time_left = wait_for_completion_timeout(&priv->load_detect, + msecs_to_jiffies(CS42L43_LOAD_TIMEOUT_MS)); + cs42l43_stop_load_detect(priv); +@@ -622,11 +647,11 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic) + } + + switch (val & CS42L43_AMP3_RES_DET_MASK) { +- case 0x0: // low impedance +- case 0x1: // high impedance ++ case 0x0: // < 22 Ohm impedance ++ case 0x1: // < 150 Ohm impedance ++ case 0x2: // < 1000 Ohm impedance + return CS42L43_JACK_HEADPHONE; +- case 0x2: // lineout +- case 0x3: // Open circuit ++ case 0x3: // > 1000 Ohm impedance + return CS42L43_JACK_LINEOUT; + default: + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.18/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch b/queue-6.18/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch new file mode 100644 index 0000000000..89ae24e6f7 --- /dev/null +++ b/queue-6.18/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch @@ -0,0 +1,49 @@ +From 479e30f9c04689f8da3a603f4ab596e731531d45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:41:12 +0000 +Subject: ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() + +From: Ziyi Guo + +[ Upstream commit f514248727606b9087bc38a284ff686e0093abf1 ] + +fsl_xcvr_activate_ctl() has +lockdep_assert_held(&card->snd_card->controls_rwsem), +but fsl_xcvr_mode_put() calls it without acquiring this lock. + +Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and +fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read(). + +Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl() +in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential +race conditions when multiple userspace threads access the control. + +Signed-off-by: Ziyi Guo +Link: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_xcvr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c +index 58db4906a01d5..51669e5fe8888 100644 +--- a/sound/soc/fsl/fsl_xcvr.c ++++ b/sound/soc/fsl/fsl_xcvr.c +@@ -223,10 +223,13 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol, + + xcvr->mode = snd_soc_enum_item_to_val(e, item[0]); + ++ down_read(&card->snd_card->controls_rwsem); + fsl_xcvr_activate_ctl(dai, fsl_xcvr_arc_mode_kctl.name, + (xcvr->mode == FSL_XCVR_MODE_ARC)); + fsl_xcvr_activate_ctl(dai, fsl_xcvr_earc_capds_kctl.name, + (xcvr->mode == FSL_XCVR_MODE_EARC)); ++ up_read(&card->snd_card->controls_rwsem); ++ + /* Allow playback for SPDIF only */ + rtd = snd_soc_get_pcm_runtime(card, card->dai_link); + rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count = +-- +2.51.0 + diff --git a/queue-6.18/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch b/queue-6.18/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch new file mode 100644 index 0000000000..118d05d5a1 --- /dev/null +++ b/queue-6.18/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch @@ -0,0 +1,73 @@ +From 78ce4ec46be5f27ae03229705be94d128077f49d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Feb 2026 15:17:28 +0300 +Subject: ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 + +From: Tagir Garaev + +[ Upstream commit 6b641122d31f9d33e7d60047ee0586d1659f3f54 ] + +Add DMI entry for Huawei Matebook D (BOD-WXX9) with HEADPHONE_GPIO +and DMIC quirks. + +This device has ES8336 codec with: +- GPIO 16 (headphone-enable) for headphone amplifier control +- GPIO 17 (speakers-enable) for speaker amplifier control +- GPIO 269 for jack detection IRQ +- 2-channel DMIC + +Hardware investigation shows that both GPIO 16 and 17 are required +for proper audio routing, as headphones and speakers share the same +physical output (HPOL/HPOR) and are separated only via amplifier +enable signals. + +RFC: Seeking advice on GPIO control issue: + +GPIO values change in driver (gpiod_get_value() shows logical value +changes) but not physically (debugfs gpio shows no change). The same +gpiod_set_value_cansleep() calls work correctly in probe context with +msleep(), but fail when called from DAPM event callbacks. + +Context information from diagnostics: +- in_atomic=0, in_interrupt=0, irqs_disabled=0 +- Process context: pipewire +- GPIO 17 (speakers): changes in driver, no physical change +- GPIO 16 (headphone): changes in driver, no physical change + +In Windows, audio switching works without visible GPIO changes, +suggesting possible ACPI/firmware involvement. + +Any suggestions on how to properly control these GPIOs from DAPM +events would be appreciated. + +Signed-off-by: Tagir Garaev +Link: https://patch.msgid.link/20260201121728.16597-1-tgaraev653@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_es8336.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c +index 09acd80d23e0f..cf50de5c2edd8 100644 +--- a/sound/soc/intel/boards/sof_es8336.c ++++ b/sound/soc/intel/boards/sof_es8336.c +@@ -332,6 +332,15 @@ static int sof_es8336_quirk_cb(const struct dmi_system_id *id) + * if the topology file is modified as well. + */ + static const struct dmi_system_id sof_es8336_quirk_table[] = { ++ { ++ .callback = sof_es8336_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HUAWEI"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "BOD-WXX9"), ++ }, ++ .driver_data = (void *)(SOF_ES8336_HEADPHONE_GPIO | ++ SOF_ES8336_ENABLE_DMIC) ++ }, + { + .callback = sof_es8336_quirk_cb, + .matches = { +-- +2.51.0 + diff --git a/queue-6.18/asoc-sof_sdw-add-a-quirk-for-lenovo-laptop-using-sid.patch b/queue-6.18/asoc-sof_sdw-add-a-quirk-for-lenovo-laptop-using-sid.patch new file mode 100644 index 0000000000..fb081f05b3 --- /dev/null +++ b/queue-6.18/asoc-sof_sdw-add-a-quirk-for-lenovo-laptop-using-sid.patch @@ -0,0 +1,37 @@ +From aa73d4a8b8199aef11d872822602166367d77773 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jan 2026 09:24:05 +0000 +Subject: ASoC: sof_sdw: Add a quirk for Lenovo laptop using sidecar amps with + cs42l43 + +From: Maciej Strozek + +[ Upstream commit 1425900231372acf870dd89e8d3bb4935f7f0c81 ] + +Add a quirk for a Lenovo laptop (SSID: 0x17aa3821) to allow using sidecar +CS35L57 amps with CS42L43 codec. + +Signed-off-by: Maciej Strozek +Reviewed-by: Cezary Rojewski +Link: https://patch.msgid.link/20260128092410.1540583-1-mstrozek@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 92fac7ed782f7..6c95b1f8fc1a5 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -802,6 +802,7 @@ static const struct snd_pci_quirk sof_sdw_ssid_quirk_table[] = { + SND_PCI_QUIRK(0x17aa, 0x2347, "Lenovo P16", SOC_SDW_CODEC_MIC), + SND_PCI_QUIRK(0x17aa, 0x2348, "Lenovo P16", SOC_SDW_CODEC_MIC), + SND_PCI_QUIRK(0x17aa, 0x2349, "Lenovo P1", SOC_SDW_CODEC_MIC), ++ SND_PCI_QUIRK(0x17aa, 0x3821, "Lenovo 0x3821", SOC_SDW_SIDECAR_AMPS), + {} + }; + +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-extend-delta-clamping-logic-to-cm3-l.patch b/queue-6.18/drm-amd-display-extend-delta-clamping-logic-to-cm3-l.patch new file mode 100644 index 0000000000..50606baaec --- /dev/null +++ b/queue-6.18/drm-amd-display-extend-delta-clamping-logic-to-cm3-l.patch @@ -0,0 +1,236 @@ +From 46395bc327b47bc519b1d4fdb3a28e501626f59e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Dec 2025 22:44:15 -0100 +Subject: drm/amd/display: extend delta clamping logic to CM3 LUT helper + +From: Melissa Wen + +[ Upstream commit d25b32aa829a3ed5570138e541a71fb7805faec3 ] + +Commit 27fc10d1095f ("drm/amd/display: Fix the delta clamping for shaper +LUT") fixed banding when using plane shaper LUT in DCN10 CM helper. The +problem is also present in DCN30 CM helper, fix banding by extending the +same bug delta clamping fix to CM3. + +Signed-off-by: Melissa Wen +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +(cherry picked from commit 0274a54897f356f9c78767c4a2a5863f7dde90c6) +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/dcn30/dcn30_cm_common.c | 30 +++++++++++++++---- + .../display/dc/dwb/dcn30/dcn30_cm_common.h | 2 +- + .../amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 9 +++--- + .../amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 17 ++++++----- + .../amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 16 +++++----- + 5 files changed, 49 insertions(+), 25 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c +index a4f14b16564c2..227aa8672d17b 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c +@@ -105,9 +105,12 @@ void cm_helper_program_gamcor_xfer_func( + #define NUMBER_REGIONS 32 + #define NUMBER_SW_SEGMENTS 16 + +-bool cm3_helper_translate_curve_to_hw_format( +- const struct dc_transfer_func *output_tf, +- struct pwl_params *lut_params, bool fixpoint) ++#define DC_LOGGER \ ++ ctx->logger ++ ++bool cm3_helper_translate_curve_to_hw_format(struct dc_context *ctx, ++ const struct dc_transfer_func *output_tf, ++ struct pwl_params *lut_params, bool fixpoint) + { + struct curve_points3 *corner_points; + struct pwl_result_data *rgb_resulted; +@@ -251,6 +254,10 @@ bool cm3_helper_translate_curve_to_hw_format( + if (fixpoint == true) { + i = 1; + while (i != hw_points + 2) { ++ uint32_t red_clamp; ++ uint32_t green_clamp; ++ uint32_t blue_clamp; ++ + if (i >= hw_points) { + if (dc_fixpt_lt(rgb_plus_1->red, rgb->red)) + rgb_plus_1->red = dc_fixpt_add(rgb->red, +@@ -263,9 +270,20 @@ bool cm3_helper_translate_curve_to_hw_format( + rgb_minus_1->delta_blue); + } + +- rgb->delta_red_reg = dc_fixpt_clamp_u0d10(rgb->delta_red); +- rgb->delta_green_reg = dc_fixpt_clamp_u0d10(rgb->delta_green); +- rgb->delta_blue_reg = dc_fixpt_clamp_u0d10(rgb->delta_blue); ++ rgb->delta_red = dc_fixpt_sub(rgb_plus_1->red, rgb->red); ++ rgb->delta_green = dc_fixpt_sub(rgb_plus_1->green, rgb->green); ++ rgb->delta_blue = dc_fixpt_sub(rgb_plus_1->blue, rgb->blue); ++ ++ red_clamp = dc_fixpt_clamp_u0d14(rgb->delta_red); ++ green_clamp = dc_fixpt_clamp_u0d14(rgb->delta_green); ++ blue_clamp = dc_fixpt_clamp_u0d14(rgb->delta_blue); ++ ++ if (red_clamp >> 10 || green_clamp >> 10 || blue_clamp >> 10) ++ DC_LOG_ERROR("Losing delta precision while programming shaper LUT."); ++ ++ rgb->delta_red_reg = red_clamp & 0x3ff; ++ rgb->delta_green_reg = green_clamp & 0x3ff; ++ rgb->delta_blue_reg = blue_clamp & 0x3ff; + rgb->red_reg = dc_fixpt_clamp_u0d14(rgb->red); + rgb->green_reg = dc_fixpt_clamp_u0d14(rgb->green); + rgb->blue_reg = dc_fixpt_clamp_u0d14(rgb->blue); +diff --git a/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h b/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h +index b86347c9b0389..95f9318a54efc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h ++++ b/drivers/gpu/drm/amd/display/dc/dwb/dcn30/dcn30_cm_common.h +@@ -59,7 +59,7 @@ void cm_helper_program_gamcor_xfer_func( + const struct pwl_params *params, + const struct dcn3_xfer_func_reg *reg); + +-bool cm3_helper_translate_curve_to_hw_format( ++bool cm3_helper_translate_curve_to_hw_format(struct dc_context *ctx, + const struct dc_transfer_func *output_tf, + struct pwl_params *lut_params, bool fixpoint); + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c +index e47ed5571dfdd..731645a2ab9aa 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c +@@ -238,7 +238,7 @@ bool dcn30_set_blend_lut( + if (plane_state->blend_tf.type == TF_TYPE_HWPWL) + blend_lut = &plane_state->blend_tf.pwl; + else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) { +- result = cm3_helper_translate_curve_to_hw_format( ++ result = cm3_helper_translate_curve_to_hw_format(plane_state->ctx, + &plane_state->blend_tf, &dpp_base->regamma_params, false); + if (!result) + return result; +@@ -333,8 +333,9 @@ bool dcn30_set_input_transfer_func(struct dc *dc, + if (plane_state->in_transfer_func.type == TF_TYPE_HWPWL) + params = &plane_state->in_transfer_func.pwl; + else if (plane_state->in_transfer_func.type == TF_TYPE_DISTRIBUTED_POINTS && +- cm3_helper_translate_curve_to_hw_format(&plane_state->in_transfer_func, +- &dpp_base->degamma_params, false)) ++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->in_transfer_func, ++ &dpp_base->degamma_params, false)) + params = &dpp_base->degamma_params; + + result = dpp_base->funcs->dpp_program_gamcor_lut(dpp_base, params); +@@ -405,7 +406,7 @@ bool dcn30_set_output_transfer_func(struct dc *dc, + params = &stream->out_transfer_func.pwl; + else if (pipe_ctx->stream->out_transfer_func.type == + TF_TYPE_DISTRIBUTED_POINTS && +- cm3_helper_translate_curve_to_hw_format( ++ cm3_helper_translate_curve_to_hw_format(stream->ctx, + &stream->out_transfer_func, + &mpc->blender_params, false)) + params = &mpc->blender_params; +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +index f39292952702f..30bb5d8d85dc2 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +@@ -486,8 +486,9 @@ bool dcn32_set_mcm_luts( + if (plane_state->blend_tf.type == TF_TYPE_HWPWL) + lut_params = &plane_state->blend_tf.pwl; + else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) { +- result = cm3_helper_translate_curve_to_hw_format(&plane_state->blend_tf, +- &dpp_base->regamma_params, false); ++ result = cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->blend_tf, ++ &dpp_base->regamma_params, false); + if (!result) + return result; + +@@ -502,8 +503,9 @@ bool dcn32_set_mcm_luts( + else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) { + // TODO: dpp_base replace + ASSERT(false); +- cm3_helper_translate_curve_to_hw_format(&plane_state->in_shaper_func, +- &dpp_base->shaper_params, true); ++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->in_shaper_func, ++ &dpp_base->shaper_params, true); + lut_params = &dpp_base->shaper_params; + } + +@@ -543,8 +545,9 @@ bool dcn32_set_input_transfer_func(struct dc *dc, + if (plane_state->in_transfer_func.type == TF_TYPE_HWPWL) + params = &plane_state->in_transfer_func.pwl; + else if (plane_state->in_transfer_func.type == TF_TYPE_DISTRIBUTED_POINTS && +- cm3_helper_translate_curve_to_hw_format(&plane_state->in_transfer_func, +- &dpp_base->degamma_params, false)) ++ cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->in_transfer_func, ++ &dpp_base->degamma_params, false)) + params = &dpp_base->degamma_params; + + dpp_base->funcs->dpp_program_gamcor_lut(dpp_base, params); +@@ -575,7 +578,7 @@ bool dcn32_set_output_transfer_func(struct dc *dc, + params = &stream->out_transfer_func.pwl; + else if (pipe_ctx->stream->out_transfer_func.type == + TF_TYPE_DISTRIBUTED_POINTS && +- cm3_helper_translate_curve_to_hw_format( ++ cm3_helper_translate_curve_to_hw_format(stream->ctx, + &stream->out_transfer_func, + &mpc->blender_params, false)) + params = &mpc->blender_params; +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index 68e48a2492c9e..77cdd02a41bdd 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -427,7 +427,7 @@ void dcn401_populate_mcm_luts(struct dc *dc, + if (mcm_luts.lut1d_func->type == TF_TYPE_HWPWL) + m_lut_params.pwl = &mcm_luts.lut1d_func->pwl; + else if (mcm_luts.lut1d_func->type == TF_TYPE_DISTRIBUTED_POINTS) { +- rval = cm3_helper_translate_curve_to_hw_format( ++ rval = cm3_helper_translate_curve_to_hw_format(mpc->ctx, + mcm_luts.lut1d_func, + &dpp_base->regamma_params, false); + m_lut_params.pwl = rval ? &dpp_base->regamma_params : NULL; +@@ -447,7 +447,7 @@ void dcn401_populate_mcm_luts(struct dc *dc, + m_lut_params.pwl = &mcm_luts.shaper->pwl; + else if (mcm_luts.shaper->type == TF_TYPE_DISTRIBUTED_POINTS) { + ASSERT(false); +- rval = cm3_helper_translate_curve_to_hw_format( ++ rval = cm3_helper_translate_curve_to_hw_format(mpc->ctx, + mcm_luts.shaper, + &dpp_base->regamma_params, true); + m_lut_params.pwl = rval ? &dpp_base->regamma_params : NULL; +@@ -624,8 +624,9 @@ bool dcn401_set_mcm_luts(struct pipe_ctx *pipe_ctx, + if (plane_state->blend_tf.type == TF_TYPE_HWPWL) + lut_params = &plane_state->blend_tf.pwl; + else if (plane_state->blend_tf.type == TF_TYPE_DISTRIBUTED_POINTS) { +- rval = cm3_helper_translate_curve_to_hw_format(&plane_state->blend_tf, +- &dpp_base->regamma_params, false); ++ rval = cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->blend_tf, ++ &dpp_base->regamma_params, false); + lut_params = rval ? &dpp_base->regamma_params : NULL; + } + result = mpc->funcs->program_1dlut(mpc, lut_params, mpcc_id); +@@ -636,8 +637,9 @@ bool dcn401_set_mcm_luts(struct pipe_ctx *pipe_ctx, + lut_params = &plane_state->in_shaper_func.pwl; + else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) { + // TODO: dpp_base replace +- rval = cm3_helper_translate_curve_to_hw_format(&plane_state->in_shaper_func, +- &dpp_base->shaper_params, true); ++ rval = cm3_helper_translate_curve_to_hw_format(plane_state->ctx, ++ &plane_state->in_shaper_func, ++ &dpp_base->shaper_params, true); + lut_params = rval ? &dpp_base->shaper_params : NULL; + } + result &= mpc->funcs->program_shaper(mpc, lut_params, mpcc_id); +@@ -671,7 +673,7 @@ bool dcn401_set_output_transfer_func(struct dc *dc, + params = &stream->out_transfer_func.pwl; + else if (pipe_ctx->stream->out_transfer_func.type == + TF_TYPE_DISTRIBUTED_POINTS && +- cm3_helper_translate_curve_to_hw_format( ++ cm3_helper_translate_curve_to_hw_format(stream->ctx, + &stream->out_transfer_func, + &mpc->blender_params, false)) + params = &mpc->blender_params; +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-remove-assert-around-dpp_base-replac.patch b/queue-6.18/drm-amd-display-remove-assert-around-dpp_base-replac.patch new file mode 100644 index 0000000000..dec275cd96 --- /dev/null +++ b/queue-6.18/drm-amd-display-remove-assert-around-dpp_base-replac.patch @@ -0,0 +1,36 @@ +From fb093781cddecda2bcbc315ec0d4c136512ea1cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jan 2026 12:50:49 -0300 +Subject: drm/amd/display: remove assert around dpp_base replacement + +From: Melissa Wen + +[ Upstream commit 84962445cd8a83dc5bed4c8ad5bbb2c1cdb249a0 ] + +There is nothing wrong if in_shaper_func type is DISTRIBUTED POINTS. +Remove the assert placed for a TODO to avoid misinterpretations. + +Signed-off-by: Melissa Wen +Reviewed-by: Alex Hung +Signed-off-by: Alex Deucher +(cherry picked from commit 1714dcc4c2c53e41190896eba263ed6328bcf415) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +index 30bb5d8d85dc2..c6fde355ac823 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +@@ -502,7 +502,6 @@ bool dcn32_set_mcm_luts( + lut_params = &plane_state->in_shaper_func.pwl; + else if (plane_state->in_shaper_func.type == TF_TYPE_DISTRIBUTED_POINTS) { + // TODO: dpp_base replace +- ASSERT(false); + cm3_helper_translate_curve_to_hw_format(plane_state->ctx, + &plane_state->in_shaper_func, + &dpp_base->shaper_params, true); +-- +2.51.0 + diff --git a/queue-6.18/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch b/queue-6.18/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch new file mode 100644 index 0000000000..3cc582f412 --- /dev/null +++ b/queue-6.18/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch @@ -0,0 +1,80 @@ +From fafdbb84e207df6f7b3cb02535c763f89bec9a12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 02:50:20 +0530 +Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?= + =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ] + +The variable j is set, however never used in or outside the loop, thus +resulting in dead code. +Building with GCC 16 results in a build error due to +-Werror=unused-but-set-variable= enabled by default. +This patch clean up the dead code and fixes the build error. + +Example build log: +drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=] + 1867 | size_t i, j; + | ^ + +Signed-off-by: Brahmajit Das +Signed-off-by: Thierry Reding +Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/hdmi.c | 4 ++-- + drivers/gpu/drm/tegra/sor.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c +index 8cd2969e7d4bf..c4820f5e76581 100644 +--- a/drivers/gpu/drm/tegra/hdmi.c ++++ b/drivers/gpu/drm/tegra/hdmi.c +@@ -658,7 +658,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -691,7 +691,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_hdmi_subpack(&ptr[i], num); +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index 21f3dfdcc5c95..bc7dd562cf6b6 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -1864,7 +1864,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -1897,7 +1897,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_sor_hdmi_subpack(&ptr[i], num); +-- +2.51.0 + diff --git a/queue-6.18/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch b/queue-6.18/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch new file mode 100644 index 0000000000..dca00d1403 --- /dev/null +++ b/queue-6.18/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch @@ -0,0 +1,123 @@ +From e87a21da5ad98b2c15339f6b574284a5aa225a3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 17:42:09 +0800 +Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock + +From: Xuewen Yan + +[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ] + +There was a lockdep warning in sprd_gpio: + +[ 6.258269][T329@C6] [ BUG: Invalid wait context ] +[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE +[ 6.258272][T329@C6] ----------------------------- +[ 6.258273][T329@C6] modprobe/329 is trying to lock: +[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd] +[ 6.258282][T329@C6] other info that might help us debug this: +[ 6.258283][T329@C6] context-{5:5} +[ 6.258285][T329@C6] 3 locks held by modprobe/329: +[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204 +[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c +[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c +[ 6.258313][T329@C6] stack backtrace: +[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df +[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT) +[ 6.258318][T329@C6] Call trace: +[ 6.258318][T329@C6] show_stack+0x20/0x30 (C) +[ 6.258321][T329@C6] __dump_stack+0x28/0x3c +[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0 +[ 6.258326][T329@C6] dump_stack+0x18/0x3c +[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28 +[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc +[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4 +[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487] +[ 6.258337][T329@C6] irq_startup+0x238/0x350 +[ 6.258340][T329@C6] __setup_irq+0x504/0x82c +[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184 +[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120 +[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350 +[ 6.258361][T329@C6] really_probe+0x1a8/0x46c +[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c +[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4 +[ 6.258369][T329@C6] __driver_attach+0xd0/0x204 +[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168 +[ 6.258373][T329@C6] driver_attach+0x2c/0x3c +[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c +[ 6.258378][T329@C6] driver_register+0x70/0x10c +[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8 +[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c +[ 6.258392][T329@C6] do_init_module+0x60/0x254 +[ 6.258395][T329@C6] load_module+0x1054/0x1220 +[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c +[ 6.258400][T329@C6] invoke_syscall+0x60/0xec +[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4 +[ 6.258405][T329@C6] do_el0_svc+0x24/0x30 +[ 6.258407][T329@C6] el0_svc+0x54/0x1c4 +[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc +[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8 + +This is because the spin_lock would change to rt_mutex in PREEMPT_RT, +however the sprd_gpio->lock would use in hard-irq, this is unsafe. + +So change the spin_lock_t to raw_spin_lock_t to use the spinlock +in hard-irq. + +Signed-off-by: Xuewen Yan +Reviewed-by: Baolin Wang +Reviewed-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com +[Bartosz: tweaked the commit message] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-sprd.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c +index 413bcd0a42405..2cc8abe705cdb 100644 +--- a/drivers/gpio/gpio-sprd.c ++++ b/drivers/gpio/gpio-sprd.c +@@ -35,7 +35,7 @@ + struct sprd_gpio { + struct gpio_chip chip; + void __iomem *base; +- spinlock_t lock; ++ raw_spinlock_t lock; + int irq; + }; + +@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + unsigned long flags; + u32 tmp; + +- spin_lock_irqsave(&sprd_gpio->lock, flags); ++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags); + tmp = readl_relaxed(base + reg); + + if (val) +@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + tmp &= ~BIT(SPRD_GPIO_BIT(offset)); + + writel_relaxed(tmp, base + reg); +- spin_unlock_irqrestore(&sprd_gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags); + } + + static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg) +@@ -236,7 +236,7 @@ static int sprd_gpio_probe(struct platform_device *pdev) + if (IS_ERR(sprd_gpio->base)) + return PTR_ERR(sprd_gpio->base); + +- spin_lock_init(&sprd_gpio->lock); ++ raw_spin_lock_init(&sprd_gpio->lock); + + sprd_gpio->chip.label = dev_name(&pdev->dev); + sprd_gpio->chip.ngpio = SPRD_GPIO_NR; +-- +2.51.0 + diff --git a/queue-6.18/gpiolib-acpi-fix-gpio-count-with-string-references.patch b/queue-6.18/gpiolib-acpi-fix-gpio-count-with-string-references.patch new file mode 100644 index 0000000000..24d0c8df45 --- /dev/null +++ b/queue-6.18/gpiolib-acpi-fix-gpio-count-with-string-references.patch @@ -0,0 +1,39 @@ +From 6ee63d16b3758c268d7cf0044585b61f62af1673 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 15:59:44 +0100 +Subject: gpiolib: acpi: Fix gpio count with string references + +From: Alban Bedel + +[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ] + +Since commit 9880702d123f2 ("ACPI: property: Support using strings in +reference properties") it is possible to use strings instead of local +references. This work fine with single GPIO but not with arrays as +acpi_gpio_package_count() didn't handle this case. Update it to handle +strings like local references to cover this case as well. + +Signed-off-by: Alban Bedel +Reviewed-by: Mika Westerberg +Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-acpi-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpio/gpiolib-acpi-core.c b/drivers/gpio/gpiolib-acpi-core.c +index e64e21fd6bbaa..8110690ea69d0 100644 +--- a/drivers/gpio/gpiolib-acpi-core.c ++++ b/drivers/gpio/gpiolib-acpi-core.c +@@ -1359,6 +1359,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj) + while (element < end) { + switch (element->type) { + case ACPI_TYPE_LOCAL_REFERENCE: ++ case ACPI_TYPE_STRING: + element += 3; + fallthrough; + case ACPI_TYPE_INTEGER: +-- +2.51.0 + diff --git a/queue-6.18/io_uring-fdinfo-be-a-bit-nicer-when-looping-a-lot-of.patch b/queue-6.18/io_uring-fdinfo-be-a-bit-nicer-when-looping-a-lot-of.patch new file mode 100644 index 0000000000..9b0efefb54 --- /dev/null +++ b/queue-6.18/io_uring-fdinfo-be-a-bit-nicer-when-looping-a-lot-of.patch @@ -0,0 +1,68 @@ +From 920a7cd7e57c7a1b52932e6a2129c752a712cfbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Feb 2026 09:56:55 -0700 +Subject: io_uring/fdinfo: be a bit nicer when looping a lot of SQEs/CQEs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jens Axboe + +[ Upstream commit 38cfdd9dd279473a73814df9fd7e6e716951d361 ] + +Add cond_resched() in those dump loops, just in case a lot of entries +are being dumped. And detect invalid CQ ring head/tail entries, to avoid +iterating more than what is necessary. Generally not an issue, but can be +if things like KASAN or other debugging metrics are enabled. + +Reported-by: 是参差 +Link: https://lore.kernel.org/all/PS1PPF7E1D7501FE5631002D242DD89403FAB9BA@PS1PPF7E1D7501F.apcprd02.prod.outlook.com/ +Reviewed-by: Keith Busch +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/fdinfo.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c +index 294c75a8a3bdb..3585ad8308504 100644 +--- a/io_uring/fdinfo.c ++++ b/io_uring/fdinfo.c +@@ -65,7 +65,7 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m) + unsigned int cq_head = READ_ONCE(r->cq.head); + unsigned int cq_tail = READ_ONCE(r->cq.tail); + unsigned int sq_shift = 0; +- unsigned int sq_entries; ++ unsigned int cq_entries, sq_entries; + int sq_pid = -1, sq_cpu = -1; + u64 sq_total_time = 0, sq_work_time = 0; + unsigned int i; +@@ -119,9 +119,11 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m) + } + } + seq_printf(m, "\n"); ++ cond_resched(); + } + seq_printf(m, "CQEs:\t%u\n", cq_tail - cq_head); +- while (cq_head < cq_tail) { ++ cq_entries = min(cq_tail - cq_head, ctx->cq_entries); ++ for (i = 0; i < cq_entries; i++) { + struct io_uring_cqe *cqe; + bool cqe32 = false; + +@@ -136,8 +138,11 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m) + cqe->big_cqe[0], cqe->big_cqe[1]); + seq_printf(m, "\n"); + cq_head++; +- if (cqe32) ++ if (cqe32) { + cq_head++; ++ i++; ++ } ++ cond_resched(); + } + + if (ctx->flags & IORING_SETUP_SQPOLL) { +-- +2.51.0 + diff --git a/queue-6.18/platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch b/queue-6.18/platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch new file mode 100644 index 0000000000..942c38b27b --- /dev/null +++ b/queue-6.18/platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch @@ -0,0 +1,44 @@ +From 4c258258b4135777af1a8860cd258b56754b0ad0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 23:55:00 +0800 +Subject: platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: gongqi <550230171hxy@gmail.com> + +[ Upstream commit 2b4e00d8e70ca8736fda82447be6a4e323c6d1f5 ] + +The MECHREVO Wujie 15X Pro suffers from spurious IRQ issues related to +the AMD PMC. Add it to the quirk list to use the spurious_8042 fix. + +Signed-off-by: gongqi <550230171hxy@gmail.com> +Link: https://patch.msgid.link/20260122155501.376199-4-550230171hxy@gmail.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 404e62ad293a9..ed285afaf9b0d 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -302,6 +302,13 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_BOARD_NAME, "XxKK4NAx_XxSP4NAx"), + } + }, ++ { ++ .ident = "MECHREVO Wujie 15X Pro", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"), ++ } ++ }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.18/platform-x86-classmate-laptop-add-missing-null-point.patch b/queue-6.18/platform-x86-classmate-laptop-add-missing-null-point.patch new file mode 100644 index 0000000000..3f94251741 --- /dev/null +++ b/queue-6.18/platform-x86-classmate-laptop-add-missing-null-point.patch @@ -0,0 +1,138 @@ +From 4f0d5726c042fc458509e6dcfacb3b6946d96425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 21:02:40 +0100 +Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ] + +In a few places in the Classmate laptop driver, code using the accel +object may run before that object's address is stored in the driver +data of the input device using it. + +For example, cmpc_accel_sensitivity_store_v4() is the "show" method +of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), +before calling dev_set_drvdata() for inputdev->dev. If the sysfs +attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) +call in in cmpc_accel_sensitivity_store_v4() returns NULL which +leads to a NULL pointer dereference going forward. + +Moreover, sysfs attributes using the input device are added before +initializing that device by cmpc_add_acpi_notify_device() and if one +of them is accessed before running that function, a NULL pointer +dereference will occur. + +For example, cmpc_accel_sensitivity_attr_v4 is added before calling +cmpc_add_acpi_notify_device() and if it is read prematurely, the +dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() +returns NULL which leads to a NULL pointer dereference going forward. + +Fix this by adding NULL pointer checks in all of the relevant places. + +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c +index 6b1b8e444e241..74d3eb83f56a6 100644 +--- a/drivers/platform/x86/classmate-laptop.c ++++ b/drivers/platform/x86/classmate-laptop.c +@@ -207,7 +207,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sysfs_emit(buf, "%d\n", accel->sensitivity); + } +@@ -224,7 +229,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +@@ -256,7 +266,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sysfs_emit(buf, "%d\n", accel->g_select); + } +@@ -273,7 +288,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &g_select); + if (r) +@@ -302,6 +322,8 @@ static int cmpc_accel_open_v4(struct input_dev *input) + + acpi = to_acpi_device(input->dev.parent); + accel = dev_get_drvdata(&input->dev); ++ if (!accel) ++ return -ENXIO; + + cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity); + cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select); +@@ -549,7 +571,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sysfs_emit(buf, "%d\n", accel->sensitivity); + } +@@ -566,7 +593,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +-- +2.51.0 + diff --git a/queue-6.18/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch b/queue-6.18/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch new file mode 100644 index 0000000000..7406931903 --- /dev/null +++ b/queue-6.18/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch @@ -0,0 +1,53 @@ +From df8e97a1b8952a6bf1fbabef9c0defdfcf625b9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 16:43:44 +0100 +Subject: platform/x86: panasonic-laptop: Fix sysfs group leak in error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +[ Upstream commit 43b0b7eff4b3fb684f257d5a24376782e9663465 ] + +The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group +if platform_device_register_simple() fails for the "panasonic" platform +device. + +Address this by making it call sysfs_remove_group() in that case for +the group in question. + +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/panasonic-laptop.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c +index 255317e6fec88..937f1a5b78edf 100644 +--- a/drivers/platform/x86/panasonic-laptop.c ++++ b/drivers/platform/x86/panasonic-laptop.c +@@ -1089,7 +1089,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) + PLATFORM_DEVID_NONE, NULL, 0); + if (IS_ERR(pcc->platform)) { + result = PTR_ERR(pcc->platform); +- goto out_backlight; ++ goto out_sysfs; + } + result = device_create_file(&pcc->platform->dev, + &dev_attr_cdpower); +@@ -1105,6 +1105,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) + + out_platform: + platform_device_unregister(pcc->platform); ++out_sysfs: ++ sysfs_remove_group(&device->dev.kobj, &pcc_attr_group); + out_backlight: + backlight_device_unregister(pcc->backlight); + out_input: +-- +2.51.0 + diff --git a/queue-6.18/romfs-check-sb_set_blocksize-return-value.patch b/queue-6.18/romfs-check-sb_set_blocksize-return-value.patch new file mode 100644 index 0000000000..d987e1078d --- /dev/null +++ b/queue-6.18/romfs-check-sb_set_blocksize-return-value.patch @@ -0,0 +1,62 @@ +From c17f576c03fbe15031d5e494c10bdec2881a7bc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:10:37 +0530 +Subject: romfs: check sb_set_blocksize() return value + +From: Deepanshu Kartikey + +[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ] + +romfs_fill_super() ignores the return value of sb_set_blocksize(), which +can fail if the requested block size is incompatible with the block +device's configuration. + +This can be triggered by setting a loop device's block size larger than +PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs +filesystem on that device. + +When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the +device has logical_block_size=32768, bdev_validate_blocksize() fails +because the requested size is smaller than the device's logical block +size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and +continues mounting. + +The superblock's block size remains at the device's logical block size +(32768). Later, when sb_bread() attempts I/O with this oversized block +size, it triggers a kernel BUG in folio_set_bh(): + + kernel BUG at fs/buffer.c:1582! + BUG_ON(size > PAGE_SIZE); + +Fix by checking the return value of sb_set_blocksize() and failing the +mount with -EINVAL if it returns 0. + +Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25 +Signed-off-by: Deepanshu Kartikey +Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/romfs/super.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/romfs/super.c b/fs/romfs/super.c +index 0addcc849ff2c..e83f9b78d7a16 100644 +--- a/fs/romfs/super.c ++++ b/fs/romfs/super.c +@@ -458,7 +458,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc) + + #ifdef CONFIG_BLOCK + if (!sb->s_mtd) { +- sb_set_blocksize(sb, ROMBSIZE); ++ if (!sb_set_blocksize(sb, ROMBSIZE)) { ++ errorf(fc, "romfs: unable to set blocksize\n"); ++ return -EINVAL; ++ } + } else { + sb->s_blocksize = ROMBSIZE; + sb->s_blocksize_bits = blksize_bits(ROMBSIZE); +-- +2.51.0 + diff --git a/queue-6.18/series b/queue-6.18/series new file mode 100644 index 0000000000..c23dc9b406 --- /dev/null +++ b/queue-6.18/series @@ -0,0 +1,21 @@ +asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch +gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch +alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch +asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch +alsa-hda-realtek-fixed-speaker-no-sound.patch +romfs-check-sb_set_blocksize-return-value.patch +drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch +platform-x86-classmate-laptop-add-missing-null-point.patch +asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch +asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch +alsa-hda-realtek-enable-headset-mic-for-acer-nitro-5.patch +platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch +asoc-sof_sdw-add-a-quirk-for-lenovo-laptop-using-sid.patch +platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch +asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch +tracing-dma-cap-dma_map_sg-tracepoint-arrays-to-prev.patch +drm-amd-display-extend-delta-clamping-logic-to-cm3-l.patch +drm-amd-display-remove-assert-around-dpp_base-replac.patch +asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch +io_uring-fdinfo-be-a-bit-nicer-when-looping-a-lot-of.patch +gpiolib-acpi-fix-gpio-count-with-string-references.patch diff --git a/queue-6.18/tracing-dma-cap-dma_map_sg-tracepoint-arrays-to-prev.patch b/queue-6.18/tracing-dma-cap-dma_map_sg-tracepoint-arrays-to-prev.patch new file mode 100644 index 0000000000..f5ca4cc6b3 --- /dev/null +++ b/queue-6.18/tracing-dma-cap-dma_map_sg-tracepoint-arrays-to-prev.patch @@ -0,0 +1,117 @@ +From 941a3f6cd3596661e8ee7b9085461220640d2608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 21:22:15 +0530 +Subject: tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer + overflow + +From: Deepanshu Kartikey + +[ Upstream commit daafcc0ef0b358d9d622b6e3b7c43767aa3814ee ] + +The dma_map_sg tracepoint can trigger a perf buffer overflow when +tracing large scatter-gather lists. With devices like virtio-gpu +creating large DRM buffers, nents can exceed 1000 entries, resulting +in: + + phys_addrs: 1000 * 8 bytes = 8,000 bytes + dma_addrs: 1000 * 8 bytes = 8,000 bytes + lengths: 1000 * 4 bytes = 4,000 bytes + Total: ~20,000 bytes + +This exceeds PERF_MAX_TRACE_SIZE (8192 bytes), causing: + + WARNING: CPU: 0 PID: 5497 at kernel/trace/trace_event_perf.c:405 + perf buffer not large enough, wanted 24620, have 8192 + +Cap all three dynamic arrays at 128 entries using min() in the array +size calculation. This ensures arrays are only as large as needed +(up to the cap), avoiding unnecessary memory allocation for small +operations while preventing overflow for large ones. + +The tracepoint now records the full nents/ents counts and a truncated +flag so users can see when data has been capped. + +Changes in v2: +- Use min(nents, DMA_TRACE_MAX_ENTRIES) for dynamic array sizing + instead of fixed DMA_TRACE_MAX_ENTRIES allocation (feedback from + Steven Rostedt) +- This allocates only what's needed up to the cap, avoiding waste + for small operations + +Reported-by: syzbot+28cea38c382fd15e751a@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=28cea38c382fd15e751a +Tested-by: syzbot+28cea38c382fd15e751a@syzkaller.appspotmail.com +Signed-off-by: Deepanshu Kartikey +Reviwed-by: Sean Anderson +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20260130155215.69737-1-kartikey406@gmail.com +Signed-off-by: Sasha Levin +--- + include/trace/events/dma.h | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +diff --git a/include/trace/events/dma.h b/include/trace/events/dma.h +index b3fef140ae155..33e99e792f1aa 100644 +--- a/include/trace/events/dma.h ++++ b/include/trace/events/dma.h +@@ -275,6 +275,8 @@ TRACE_EVENT(dma_free_sgt, + sizeof(u64), sizeof(u64))) + ); + ++#define DMA_TRACE_MAX_ENTRIES 128 ++ + TRACE_EVENT(dma_map_sg, + TP_PROTO(struct device *dev, struct scatterlist *sgl, int nents, + int ents, enum dma_data_direction dir, unsigned long attrs), +@@ -282,9 +284,12 @@ TRACE_EVENT(dma_map_sg, + + TP_STRUCT__entry( + __string(device, dev_name(dev)) +- __dynamic_array(u64, phys_addrs, nents) +- __dynamic_array(u64, dma_addrs, ents) +- __dynamic_array(unsigned int, lengths, ents) ++ __field(int, full_nents) ++ __field(int, full_ents) ++ __field(bool, truncated) ++ __dynamic_array(u64, phys_addrs, min(nents, DMA_TRACE_MAX_ENTRIES)) ++ __dynamic_array(u64, dma_addrs, min(ents, DMA_TRACE_MAX_ENTRIES)) ++ __dynamic_array(unsigned int, lengths, min(ents, DMA_TRACE_MAX_ENTRIES)) + __field(enum dma_data_direction, dir) + __field(unsigned long, attrs) + ), +@@ -292,11 +297,16 @@ TRACE_EVENT(dma_map_sg, + TP_fast_assign( + struct scatterlist *sg; + int i; ++ int traced_nents = min_t(int, nents, DMA_TRACE_MAX_ENTRIES); ++ int traced_ents = min_t(int, ents, DMA_TRACE_MAX_ENTRIES); + + __assign_str(device); +- for_each_sg(sgl, sg, nents, i) ++ __entry->full_nents = nents; ++ __entry->full_ents = ents; ++ __entry->truncated = (nents > DMA_TRACE_MAX_ENTRIES) || (ents > DMA_TRACE_MAX_ENTRIES); ++ for_each_sg(sgl, sg, traced_nents, i) + ((u64 *)__get_dynamic_array(phys_addrs))[i] = sg_phys(sg); +- for_each_sg(sgl, sg, ents, i) { ++ for_each_sg(sgl, sg, traced_ents, i) { + ((u64 *)__get_dynamic_array(dma_addrs))[i] = + sg_dma_address(sg); + ((unsigned int *)__get_dynamic_array(lengths))[i] = +@@ -306,9 +316,12 @@ TRACE_EVENT(dma_map_sg, + __entry->attrs = attrs; + ), + +- TP_printk("%s dir=%s dma_addrs=%s sizes=%s phys_addrs=%s attrs=%s", ++ TP_printk("%s dir=%s nents=%d/%d ents=%d/%d%s dma_addrs=%s sizes=%s phys_addrs=%s attrs=%s", + __get_str(device), + decode_dma_data_direction(__entry->dir), ++ min_t(int, __entry->full_nents, DMA_TRACE_MAX_ENTRIES), __entry->full_nents, ++ min_t(int, __entry->full_ents, DMA_TRACE_MAX_ENTRIES), __entry->full_ents, ++ __entry->truncated ? " [TRUNCATED]" : "", + __print_array(__get_dynamic_array(dma_addrs), + __get_dynamic_array_len(dma_addrs) / + sizeof(u64), sizeof(u64)), +-- +2.51.0 + diff --git a/queue-6.6/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch b/queue-6.6/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch new file mode 100644 index 0000000000..f565effd92 --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch @@ -0,0 +1,35 @@ +From d9abe35e7ae5566756f28bc4ca97afbd8a41dcb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 15:35:08 +0800 +Subject: ALSA: hda/realtek: Add quirk for Inspur S14-G1 + +From: Zhang Heng + +[ Upstream commit 9e18920e783d0bcd4c127a7adc66565243ab9655 ] + +Inspur S14-G1 is equipped with ALC256. +Enable "power saving mode" and Enable "headset jack mode". + +Signed-off-by: Zhang Heng +Link: https://patch.msgid.link/20260126073508.3897461-2-zhangheng@kylinos.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 95e650493dc5b..5b836a91135cc 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10650,6 +10650,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x2039, 0x0001, "Inspur S14-G1", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13), + SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), +-- +2.51.0 + diff --git a/queue-6.6/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch b/queue-6.6/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch new file mode 100644 index 0000000000..c1e961aa9f --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch @@ -0,0 +1,39 @@ +From a12da3fbfa1440eb141709daf703c14db8285072 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 16:15:55 +0100 +Subject: ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU + +From: Tim Guttzeit + +[ Upstream commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 ] + +Add a PCI quirk to enable microphone detection on the headphone jack of +TongFang X6AR55xU devices. + +Signed-off-by: Tim Guttzeit +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260119151626.35481-1-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index c60358a4a7572..95e650493dc5b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -11102,6 +11102,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60140}, + {0x19, 0x04a11030}, + {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC, ++ {0x17, 0x90170110}, ++ {0x19, 0x03a11030}, ++ {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT, + ALC282_STANDARD_PINS, + {0x12, 0x90a609c0}, +-- +2.51.0 + diff --git a/queue-6.6/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch b/queue-6.6/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch new file mode 100644 index 0000000000..4a7784c495 --- /dev/null +++ b/queue-6.6/asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch @@ -0,0 +1,41 @@ +From ac28dac04a3e3654777d7dd6ce90ee54fd9e3928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jan 2026 15:56:18 +0100 +Subject: ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list + +From: Anatolii Shirykalov + +[ Upstream commit 018b211b1d321a52ed8d8de74ce83ce52a2e1224 ] + +Add ASUS ExpertBook PM1503CDA to the DMI quirks table to enable +internal DMIC support via the ACP6x machine driver. + +Signed-off-by: Anatolii Shirykalov +Link: https://patch.msgid.link/20260119145618.3171435-1-pipocavsobake@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index b0456be5d921a..92d0d39d39d9a 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -535,6 +535,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "15NBC1011"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK PM1503CDA"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.51.0 + diff --git a/queue-6.6/asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch b/queue-6.6/asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch new file mode 100644 index 0000000000..82ba1f21df --- /dev/null +++ b/queue-6.6/asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch @@ -0,0 +1,41 @@ +From 16941b333621c03f5b579beaac30660372b46be9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 14:50:19 +0800 +Subject: ASoC: amd: yc: Add quirk for HP 200 G2a 16 + +From: Dirk Su + +[ Upstream commit 611c7d2262d5645118e0b3a9a88475d35a8366f2 ] + +Fix the missing mic on HP 200 G2a 16 by adding quirk with the +board ID 8EE4 + +Signed-off-by: Dirk Su +Link: https://patch.msgid.link/20260129065038.39349-1-dirk.su@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 92d0d39d39d9a..b6068d289f5f9 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -633,6 +633,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "8BD6"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), ++ DMI_MATCH(DMI_BOARD_NAME, "8EE4"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.51.0 + diff --git a/queue-6.6/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch b/queue-6.6/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch new file mode 100644 index 0000000000..a9a22adca6 --- /dev/null +++ b/queue-6.6/asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch @@ -0,0 +1,37 @@ +From d5b2d9f26b89b6effa9692b09fc10ecf173c6623 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jan 2026 19:25:10 +0000 +Subject: ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel + +From: Ricardo Rivera-Matos + +[ Upstream commit 6dd0fdc908c02318c28ec2c0979661846ee0a9f7 ] + +ASP_TX5 was incorrectly mapped to a channel value of 3 corrects, +the channel value of 4. + +Reviewed-by: Charles Keepax +Signed-off-by: Ricardo Rivera-Matos +Link: https://patch.msgid.link/20260115192523.1335742-2-rriveram@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l45.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs35l45.c b/sound/soc/codecs/cs35l45.c +index 7e439c778c6b4..11e28c340a709 100644 +--- a/sound/soc/codecs/cs35l45.c ++++ b/sound/soc/codecs/cs35l45.c +@@ -316,7 +316,7 @@ static const struct snd_soc_dapm_widget cs35l45_dapm_widgets[] = { + SND_SOC_DAPM_AIF_OUT("ASP_TX2", NULL, 1, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX2_EN_SHIFT, 0), + SND_SOC_DAPM_AIF_OUT("ASP_TX3", NULL, 2, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX3_EN_SHIFT, 0), + SND_SOC_DAPM_AIF_OUT("ASP_TX4", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX4_EN_SHIFT, 0), +- SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 3, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0), ++ SND_SOC_DAPM_AIF_OUT("ASP_TX5", NULL, 4, CS35L45_ASP_ENABLES1, CS35L45_ASP_TX5_EN_SHIFT, 0), + + SND_SOC_DAPM_MUX("ASP_TX1 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[0]), + SND_SOC_DAPM_MUX("ASP_TX2 Source", SND_SOC_NOPM, 0, 0, &cs35l45_asp_muxes[1]), +-- +2.51.0 + diff --git a/queue-6.6/asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch b/queue-6.6/asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch new file mode 100644 index 0000000000..38a70956a3 --- /dev/null +++ b/queue-6.6/asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch @@ -0,0 +1,96 @@ +From 826fcbea5e378a3fc1171d00818d4b41b473435c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jan 2026 15:09:27 +0000 +Subject: ASoC: cs42l43: Correct handling of 3-pole jack load detection + +From: Charles Keepax + +[ Upstream commit e77a4081d7e324dfa876a9560b2a78969446ba82 ] + +The load detection process for 3-pole jacks requires slightly +updated reference values to ensure an accurate result. Update +the code to apply different tunings for the 3-pole and 4-pole +cases. This also updates the thresholds overall so update the +relevant comments to match. + +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20260130150927.2964664-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l43-jack.c | 37 +++++++++++++++++++++++++++------ + 1 file changed, 31 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/cs42l43-jack.c b/sound/soc/codecs/cs42l43-jack.c +index 6d8455c1bee6d..f58d55d77693f 100644 +--- a/sound/soc/codecs/cs42l43-jack.c ++++ b/sound/soc/codecs/cs42l43-jack.c +@@ -496,7 +496,23 @@ void cs42l43_bias_sense_timeout(struct work_struct *work) + pm_runtime_put_autosuspend(priv->dev); + } + +-static void cs42l43_start_load_detect(struct cs42l43_codec *priv) ++static const struct reg_sequence cs42l43_3pole_patch[] = { ++ { 0x4000, 0x00000055 }, ++ { 0x4000, 0x000000AA }, ++ { 0x17420, 0x8500F300 }, ++ { 0x17424, 0x36003E00 }, ++ { 0x4000, 0x00000000 }, ++}; ++ ++static const struct reg_sequence cs42l43_4pole_patch[] = { ++ { 0x4000, 0x00000055 }, ++ { 0x4000, 0x000000AA }, ++ { 0x17420, 0x7800E600 }, ++ { 0x17424, 0x36003800 }, ++ { 0x4000, 0x00000000 }, ++}; ++ ++static void cs42l43_start_load_detect(struct cs42l43_codec *priv, bool mic) + { + struct cs42l43 *cs42l43 = priv->core; + +@@ -520,6 +536,15 @@ static void cs42l43_start_load_detect(struct cs42l43_codec *priv) + dev_err(priv->dev, "Load detect HP power down timed out\n"); + } + ++ if (mic) ++ regmap_multi_reg_write_bypassed(cs42l43->regmap, ++ cs42l43_4pole_patch, ++ ARRAY_SIZE(cs42l43_4pole_patch)); ++ else ++ regmap_multi_reg_write_bypassed(cs42l43->regmap, ++ cs42l43_3pole_patch, ++ ARRAY_SIZE(cs42l43_3pole_patch)); ++ + regmap_update_bits(cs42l43->regmap, CS42L43_BLOCK_EN3, + CS42L43_ADC1_EN_MASK | CS42L43_ADC2_EN_MASK, 0); + regmap_update_bits(cs42l43->regmap, CS42L43_DACCNFG2, CS42L43_HP_HPF_EN_MASK, 0); +@@ -598,7 +623,7 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic) + + reinit_completion(&priv->load_detect); + +- cs42l43_start_load_detect(priv); ++ cs42l43_start_load_detect(priv, mic); + time_left = wait_for_completion_timeout(&priv->load_detect, + msecs_to_jiffies(CS42L43_LOAD_TIMEOUT_MS)); + cs42l43_stop_load_detect(priv); +@@ -622,11 +647,11 @@ static int cs42l43_run_load_detect(struct cs42l43_codec *priv, bool mic) + } + + switch (val & CS42L43_AMP3_RES_DET_MASK) { +- case 0x0: // low impedance +- case 0x1: // high impedance ++ case 0x0: // < 22 Ohm impedance ++ case 0x1: // < 150 Ohm impedance ++ case 0x2: // < 1000 Ohm impedance + return CS42L43_JACK_HEADPHONE; +- case 0x2: // lineout +- case 0x3: // Open circuit ++ case 0x3: // > 1000 Ohm impedance + return CS42L43_JACK_LINEOUT; + default: + return -EINVAL; +-- +2.51.0 + diff --git a/queue-6.6/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch b/queue-6.6/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch new file mode 100644 index 0000000000..6ed18782cf --- /dev/null +++ b/queue-6.6/asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch @@ -0,0 +1,49 @@ +From 430b58f8482dd7cddd4fa5508cd6e321f5a4141d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Feb 2026 17:41:12 +0000 +Subject: ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() + +From: Ziyi Guo + +[ Upstream commit f514248727606b9087bc38a284ff686e0093abf1 ] + +fsl_xcvr_activate_ctl() has +lockdep_assert_held(&card->snd_card->controls_rwsem), +but fsl_xcvr_mode_put() calls it without acquiring this lock. + +Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and +fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read(). + +Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl() +in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential +race conditions when multiple userspace threads access the control. + +Signed-off-by: Ziyi Guo +Link: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_xcvr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c +index 90a0a24c05d84..3a5ab8b536728 100644 +--- a/sound/soc/fsl/fsl_xcvr.c ++++ b/sound/soc/fsl/fsl_xcvr.c +@@ -206,10 +206,13 @@ static int fsl_xcvr_mode_put(struct snd_kcontrol *kcontrol, + + xcvr->mode = snd_soc_enum_item_to_val(e, item[0]); + ++ down_read(&card->snd_card->controls_rwsem); + fsl_xcvr_activate_ctl(dai, fsl_xcvr_arc_mode_kctl.name, + (xcvr->mode == FSL_XCVR_MODE_ARC)); + fsl_xcvr_activate_ctl(dai, fsl_xcvr_earc_capds_kctl.name, + (xcvr->mode == FSL_XCVR_MODE_EARC)); ++ up_read(&card->snd_card->controls_rwsem); ++ + /* Allow playback for SPDIF only */ + rtd = snd_soc_get_pcm_runtime(card, card->dai_link); + rtd->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream_count = +-- +2.51.0 + diff --git a/queue-6.6/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch b/queue-6.6/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch new file mode 100644 index 0000000000..a01854374b --- /dev/null +++ b/queue-6.6/asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch @@ -0,0 +1,73 @@ +From 99dc26f6a5e31ee3e1a9092a575a3e23e28f25bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Feb 2026 15:17:28 +0300 +Subject: ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 + +From: Tagir Garaev + +[ Upstream commit 6b641122d31f9d33e7d60047ee0586d1659f3f54 ] + +Add DMI entry for Huawei Matebook D (BOD-WXX9) with HEADPHONE_GPIO +and DMIC quirks. + +This device has ES8336 codec with: +- GPIO 16 (headphone-enable) for headphone amplifier control +- GPIO 17 (speakers-enable) for speaker amplifier control +- GPIO 269 for jack detection IRQ +- 2-channel DMIC + +Hardware investigation shows that both GPIO 16 and 17 are required +for proper audio routing, as headphones and speakers share the same +physical output (HPOL/HPOR) and are separated only via amplifier +enable signals. + +RFC: Seeking advice on GPIO control issue: + +GPIO values change in driver (gpiod_get_value() shows logical value +changes) but not physically (debugfs gpio shows no change). The same +gpiod_set_value_cansleep() calls work correctly in probe context with +msleep(), but fail when called from DAPM event callbacks. + +Context information from diagnostics: +- in_atomic=0, in_interrupt=0, irqs_disabled=0 +- Process context: pipewire +- GPIO 17 (speakers): changes in driver, no physical change +- GPIO 16 (headphone): changes in driver, no physical change + +In Windows, audio switching works without visible GPIO changes, +suggesting possible ACPI/firmware involvement. + +Any suggestions on how to properly control these GPIOs from DAPM +events would be appreciated. + +Signed-off-by: Tagir Garaev +Link: https://patch.msgid.link/20260201121728.16597-1-tgaraev653@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_es8336.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c +index c9d9381c76796..02b74ab62ff58 100644 +--- a/sound/soc/intel/boards/sof_es8336.c ++++ b/sound/soc/intel/boards/sof_es8336.c +@@ -332,6 +332,15 @@ static int sof_es8336_quirk_cb(const struct dmi_system_id *id) + * if the topology file is modified as well. + */ + static const struct dmi_system_id sof_es8336_quirk_table[] = { ++ { ++ .callback = sof_es8336_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HUAWEI"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "BOD-WXX9"), ++ }, ++ .driver_data = (void *)(SOF_ES8336_HEADPHONE_GPIO | ++ SOF_ES8336_ENABLE_DMIC) ++ }, + { + .callback = sof_es8336_quirk_cb, + .matches = { +-- +2.51.0 + diff --git a/queue-6.6/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch b/queue-6.6/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch new file mode 100644 index 0000000000..1770f188d6 --- /dev/null +++ b/queue-6.6/drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch @@ -0,0 +1,80 @@ +From 58c643f85c8a07df90800975a857d8433d1808d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 02:50:20 +0530 +Subject: =?UTF-8?q?drm/tegra:=20hdmi:=20sor:=20Fix=20error:=20variable=20?= + =?UTF-8?q?=E2=80=98j=E2=80=99=20set=20but=20not=20used?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 1beee8d0c263b3e239c8d6616e4f8bb700bed658 ] + +The variable j is set, however never used in or outside the loop, thus +resulting in dead code. +Building with GCC 16 results in a build error due to +-Werror=unused-but-set-variable= enabled by default. +This patch clean up the dead code and fixes the build error. + +Example build log: +drivers/gpu/drm/tegra/sor.c:1867:19: error: variable ‘j’ set but not used [-Werror=unused-but-set-variable=] + 1867 | size_t i, j; + | ^ + +Signed-off-by: Brahmajit Das +Signed-off-by: Thierry Reding +Link: https://lore.kernel.org/r/20250901212020.3757519-1-listout@listout.xyz +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/hdmi.c | 4 ++-- + drivers/gpu/drm/tegra/sor.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c +index 58c2ba94e7dd6..2451c9b67024d 100644 +--- a/drivers/gpu/drm/tegra/hdmi.c ++++ b/drivers/gpu/drm/tegra/hdmi.c +@@ -656,7 +656,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -689,7 +689,7 @@ static void tegra_hdmi_write_infopack(struct tegra_hdmi *hdmi, const void *data, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_hdmi_subpack(&ptr[i], num); +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index 61b437a84806e..1b03f8ca80a10 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -1861,7 +1861,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + { + const u8 *ptr = data; + unsigned long offset; +- size_t i, j; ++ size_t i; + u32 value; + + switch (ptr[0]) { +@@ -1894,7 +1894,7 @@ static void tegra_sor_hdmi_write_infopack(struct tegra_sor *sor, + * - subpack_low: bytes 0 - 3 + * - subpack_high: bytes 4 - 6 (with byte 7 padded to 0x00) + */ +- for (i = 3, j = 0; i < size; i += 7, j += 8) { ++ for (i = 3; i < size; i += 7) { + size_t rem = size - i, num = min_t(size_t, rem, 4); + + value = tegra_sor_hdmi_subpack(&ptr[i], num); +-- +2.51.0 + diff --git a/queue-6.6/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch b/queue-6.6/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch new file mode 100644 index 0000000000..2175c9facb --- /dev/null +++ b/queue-6.6/gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch @@ -0,0 +1,123 @@ +From bb9ddd3829ce81028fe4db78b9b85e6238b45613 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 17:42:09 +0800 +Subject: gpio: sprd: Change sprd_gpio lock to raw_spin_lock + +From: Xuewen Yan + +[ Upstream commit 96313fcc1f062ba239f4832c9eff685da6c51c99 ] + +There was a lockdep warning in sprd_gpio: + +[ 6.258269][T329@C6] [ BUG: Invalid wait context ] +[ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE +[ 6.258272][T329@C6] ----------------------------- +[ 6.258273][T329@C6] modprobe/329 is trying to lock: +[ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd] +[ 6.258282][T329@C6] other info that might help us debug this: +[ 6.258283][T329@C6] context-{5:5} +[ 6.258285][T329@C6] 3 locks held by modprobe/329: +[ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204 +[ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c +[ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c +[ 6.258313][T329@C6] stack backtrace: +[ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df +[ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE +[ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT) +[ 6.258318][T329@C6] Call trace: +[ 6.258318][T329@C6] show_stack+0x20/0x30 (C) +[ 6.258321][T329@C6] __dump_stack+0x28/0x3c +[ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0 +[ 6.258326][T329@C6] dump_stack+0x18/0x3c +[ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28 +[ 6.258331][T329@C6] lock_acquire+0x148/0x2cc +[ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4 +[ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487] +[ 6.258337][T329@C6] irq_startup+0x238/0x350 +[ 6.258340][T329@C6] __setup_irq+0x504/0x82c +[ 6.258342][T329@C6] request_threaded_irq+0x118/0x184 +[ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120 +[ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350 +[ 6.258361][T329@C6] really_probe+0x1a8/0x46c +[ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c +[ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4 +[ 6.258369][T329@C6] __driver_attach+0xd0/0x204 +[ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168 +[ 6.258373][T329@C6] driver_attach+0x2c/0x3c +[ 6.258376][T329@C6] bus_add_driver+0x154/0x29c +[ 6.258378][T329@C6] driver_register+0x70/0x10c +[ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8 +[ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] +[ 6.258389][T329@C6] do_one_initcall+0x128/0x42c +[ 6.258392][T329@C6] do_init_module+0x60/0x254 +[ 6.258395][T329@C6] load_module+0x1054/0x1220 +[ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c +[ 6.258400][T329@C6] invoke_syscall+0x60/0xec +[ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4 +[ 6.258405][T329@C6] do_el0_svc+0x24/0x30 +[ 6.258407][T329@C6] el0_svc+0x54/0x1c4 +[ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc +[ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8 + +This is because the spin_lock would change to rt_mutex in PREEMPT_RT, +however the sprd_gpio->lock would use in hard-irq, this is unsafe. + +So change the spin_lock_t to raw_spin_lock_t to use the spinlock +in hard-irq. + +Signed-off-by: Xuewen Yan +Reviewed-by: Baolin Wang +Reviewed-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com +[Bartosz: tweaked the commit message] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-sprd.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c +index c117c11bfb29a..192f05a2c19c1 100644 +--- a/drivers/gpio/gpio-sprd.c ++++ b/drivers/gpio/gpio-sprd.c +@@ -35,7 +35,7 @@ + struct sprd_gpio { + struct gpio_chip chip; + void __iomem *base; +- spinlock_t lock; ++ raw_spinlock_t lock; + int irq; + }; + +@@ -54,7 +54,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + unsigned long flags; + u32 tmp; + +- spin_lock_irqsave(&sprd_gpio->lock, flags); ++ raw_spin_lock_irqsave(&sprd_gpio->lock, flags); + tmp = readl_relaxed(base + reg); + + if (val) +@@ -63,7 +63,7 @@ static void sprd_gpio_update(struct gpio_chip *chip, unsigned int offset, + tmp &= ~BIT(SPRD_GPIO_BIT(offset)); + + writel_relaxed(tmp, base + reg); +- spin_unlock_irqrestore(&sprd_gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&sprd_gpio->lock, flags); + } + + static int sprd_gpio_read(struct gpio_chip *chip, unsigned int offset, u16 reg) +@@ -234,7 +234,7 @@ static int sprd_gpio_probe(struct platform_device *pdev) + if (IS_ERR(sprd_gpio->base)) + return PTR_ERR(sprd_gpio->base); + +- spin_lock_init(&sprd_gpio->lock); ++ raw_spin_lock_init(&sprd_gpio->lock); + + sprd_gpio->chip.label = dev_name(&pdev->dev); + sprd_gpio->chip.ngpio = SPRD_GPIO_NR; +-- +2.51.0 + diff --git a/queue-6.6/gpiolib-acpi-fix-gpio-count-with-string-references.patch b/queue-6.6/gpiolib-acpi-fix-gpio-count-with-string-references.patch new file mode 100644 index 0000000000..a1507c5a2a --- /dev/null +++ b/queue-6.6/gpiolib-acpi-fix-gpio-count-with-string-references.patch @@ -0,0 +1,39 @@ +From 9a1ccd5ccd83ac002ef3af75945781aefa88c718 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jan 2026 15:59:44 +0100 +Subject: gpiolib: acpi: Fix gpio count with string references + +From: Alban Bedel + +[ Upstream commit c62e0658d458d8f100445445c3ddb106f3824a45 ] + +Since commit 9880702d123f2 ("ACPI: property: Support using strings in +reference properties") it is possible to use strings instead of local +references. This work fine with single GPIO but not with arrays as +acpi_gpio_package_count() didn't handle this case. Update it to handle +strings like local references to cover this case as well. + +Signed-off-by: Alban Bedel +Reviewed-by: Mika Westerberg +Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-acpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 69d4297ae5754..4d4757eac9e5f 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -1417,6 +1417,7 @@ static int acpi_gpio_package_count(const union acpi_object *obj) + while (element < end) { + switch (element->type) { + case ACPI_TYPE_LOCAL_REFERENCE: ++ case ACPI_TYPE_STRING: + element += 3; + fallthrough; + case ACPI_TYPE_INTEGER: +-- +2.51.0 + diff --git a/queue-6.6/platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch b/queue-6.6/platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch new file mode 100644 index 0000000000..f758d74ac6 --- /dev/null +++ b/queue-6.6/platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch @@ -0,0 +1,44 @@ +From 676abe25816d0123a23e3e929d95a3c607b0b83f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jan 2026 23:55:00 +0800 +Subject: platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: gongqi <550230171hxy@gmail.com> + +[ Upstream commit 2b4e00d8e70ca8736fda82447be6a4e323c6d1f5 ] + +The MECHREVO Wujie 15X Pro suffers from spurious IRQ issues related to +the AMD PMC. Add it to the quirk list to use the spurious_8042 fix. + +Signed-off-by: gongqi <550230171hxy@gmail.com> +Link: https://patch.msgid.link/20260122155501.376199-4-550230171hxy@gmail.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index a5031339dac8c..a6006b4ec2cc0 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -296,6 +296,13 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_BOARD_NAME, "XxKK4NAx_XxSP4NAx"), + } + }, ++ { ++ .ident = "MECHREVO Wujie 15X Pro", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"), ++ } ++ }, + {} + }; + +-- +2.51.0 + diff --git a/queue-6.6/platform-x86-classmate-laptop-add-missing-null-point.patch b/queue-6.6/platform-x86-classmate-laptop-add-missing-null-point.patch new file mode 100644 index 0000000000..0dc2bd7691 --- /dev/null +++ b/queue-6.6/platform-x86-classmate-laptop-add-missing-null-point.patch @@ -0,0 +1,138 @@ +From 56e11b89cc11f2772476983d3e51064944a2b000 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jan 2026 21:02:40 +0100 +Subject: platform/x86: classmate-laptop: Add missing NULL pointer checks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +[ Upstream commit fe747d7112283f47169e9c16e751179a9b38611e ] + +In a few places in the Classmate laptop driver, code using the accel +object may run before that object's address is stored in the driver +data of the input device using it. + +For example, cmpc_accel_sensitivity_store_v4() is the "show" method +of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), +before calling dev_set_drvdata() for inputdev->dev. If the sysfs +attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) +call in in cmpc_accel_sensitivity_store_v4() returns NULL which +leads to a NULL pointer dereference going forward. + +Moreover, sysfs attributes using the input device are added before +initializing that device by cmpc_add_acpi_notify_device() and if one +of them is accessed before running that function, a NULL pointer +dereference will occur. + +For example, cmpc_accel_sensitivity_attr_v4 is added before calling +cmpc_add_acpi_notify_device() and if it is read prematurely, the +dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() +returns NULL which leads to a NULL pointer dereference going forward. + +Fix this by adding NULL pointer checks in all of the relevant places. + +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c +index 2edaea2492df7..053c8a86d5ece 100644 +--- a/drivers/platform/x86/classmate-laptop.c ++++ b/drivers/platform/x86/classmate-laptop.c +@@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->sensitivity); + } +@@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +@@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->g_select); + } +@@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &g_select); + if (r) +@@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input) + + acpi = to_acpi_device(input->dev.parent); + accel = dev_get_drvdata(&input->dev); ++ if (!accel) ++ return -ENXIO; + + cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity); + cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select); +@@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + return sprintf(buf, "%d\n", accel->sensitivity); + } +@@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev, + + acpi = to_acpi_device(dev); + inputdev = dev_get_drvdata(&acpi->dev); ++ if (!inputdev) ++ return -ENXIO; ++ + accel = dev_get_drvdata(&inputdev->dev); ++ if (!accel) ++ return -ENXIO; + + r = kstrtoul(buf, 0, &sensitivity); + if (r) +-- +2.51.0 + diff --git a/queue-6.6/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch b/queue-6.6/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch new file mode 100644 index 0000000000..cd4c9f322b --- /dev/null +++ b/queue-6.6/platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch @@ -0,0 +1,53 @@ +From 3f9fece4613d75f08585d7354eb7fbcc07b70037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jan 2026 16:43:44 +0100 +Subject: platform/x86: panasonic-laptop: Fix sysfs group leak in error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +[ Upstream commit 43b0b7eff4b3fb684f257d5a24376782e9663465 ] + +The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group +if platform_device_register_simple() fails for the "panasonic" platform +device. + +Address this by making it call sysfs_remove_group() in that case for +the group in question. + +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/panasonic-laptop.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c +index 7365286f6d2dc..ad907c558997a 100644 +--- a/drivers/platform/x86/panasonic-laptop.c ++++ b/drivers/platform/x86/panasonic-laptop.c +@@ -1077,7 +1077,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) + PLATFORM_DEVID_NONE, NULL, 0); + if (IS_ERR(pcc->platform)) { + result = PTR_ERR(pcc->platform); +- goto out_backlight; ++ goto out_sysfs; + } + result = device_create_file(&pcc->platform->dev, + &dev_attr_cdpower); +@@ -1093,6 +1093,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) + + out_platform: + platform_device_unregister(pcc->platform); ++out_sysfs: ++ sysfs_remove_group(&device->dev.kobj, &pcc_attr_group); + out_backlight: + backlight_device_unregister(pcc->backlight); + out_input: +-- +2.51.0 + diff --git a/queue-6.6/romfs-check-sb_set_blocksize-return-value.patch b/queue-6.6/romfs-check-sb_set_blocksize-return-value.patch new file mode 100644 index 0000000000..2490e6f923 --- /dev/null +++ b/queue-6.6/romfs-check-sb_set_blocksize-return-value.patch @@ -0,0 +1,62 @@ +From 338859c80d384632a10d58ea71bf68cd4a067608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jan 2026 14:10:37 +0530 +Subject: romfs: check sb_set_blocksize() return value + +From: Deepanshu Kartikey + +[ Upstream commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 ] + +romfs_fill_super() ignores the return value of sb_set_blocksize(), which +can fail if the requested block size is incompatible with the block +device's configuration. + +This can be triggered by setting a loop device's block size larger than +PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs +filesystem on that device. + +When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the +device has logical_block_size=32768, bdev_validate_blocksize() fails +because the requested size is smaller than the device's logical block +size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and +continues mounting. + +The superblock's block size remains at the device's logical block size +(32768). Later, when sb_bread() attempts I/O with this oversized block +size, it triggers a kernel BUG in folio_set_bh(): + + kernel BUG at fs/buffer.c:1582! + BUG_ON(size > PAGE_SIZE); + +Fix by checking the return value of sb_set_blocksize() and failing the +mount with -EINVAL if it returns 0. + +Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25 +Signed-off-by: Deepanshu Kartikey +Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/romfs/super.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/romfs/super.c b/fs/romfs/super.c +index b1bdfbc211c3c..82975173dcb04 100644 +--- a/fs/romfs/super.c ++++ b/fs/romfs/super.c +@@ -467,7 +467,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc) + + #ifdef CONFIG_BLOCK + if (!sb->s_mtd) { +- sb_set_blocksize(sb, ROMBSIZE); ++ if (!sb_set_blocksize(sb, ROMBSIZE)) { ++ errorf(fc, "romfs: unable to set blocksize\n"); ++ return -EINVAL; ++ } + } else { + sb->s_blocksize = ROMBSIZE; + sb->s_blocksize_bits = blksize_bits(ROMBSIZE); +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 838738dbd1..9ef2840689 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1 +1,16 @@ revert-driver-core-enforce-device_lock-for-driver_match_device.patch +alsa-hda-realtek-fix-headset-mic-for-tongfang-x6ar55.patch +asoc-amd-yc-add-asus-expertbook-pm1503cda-to-quirks-.patch +gpio-sprd-change-sprd_gpio-lock-to-raw_spin_lock.patch +alsa-hda-realtek-add-quirk-for-inspur-s14-g1.patch +asoc-cs35l45-corrects-asp_tx5-dapm-widget-channel.patch +romfs-check-sb_set_blocksize-return-value.patch +drm-tegra-hdmi-sor-fix-error-variable-j-set-but-not-.patch +platform-x86-classmate-laptop-add-missing-null-point.patch +asoc-intel-sof_es8336-add-dmi-quirk-for-huawei-bod-w.patch +asoc-amd-yc-add-quirk-for-hp-200-g2a-16.patch +platform-x86-amd-pmc-add-quirk-for-mechrevo-wujie-15.patch +platform-x86-panasonic-laptop-fix-sysfs-group-leak-i.patch +asoc-cs42l43-correct-handling-of-3-pole-jack-load-de.patch +asoc-fsl_xcvr-fix-missing-lock-in-fsl_xcvr_mode_put.patch +gpiolib-acpi-fix-gpio-count-with-string-references.patch