--- /dev/null
+From d05ea7da0e8f6df3c62cfee75538f347cb3d89ef Mon Sep 17 00:00:00 2001
+From: Laura Abbott <labbott@fedoraproject.org>
+Date: Fri, 2 Oct 2015 11:09:54 -0700
+Subject: ALSA: hda: Add dock support for ThinkPad T550
+
+From: Laura Abbott <labbott@fedoraproject.org>
+
+commit d05ea7da0e8f6df3c62cfee75538f347cb3d89ef upstream.
+
+Much like all the other Lenovo laptops, add a quirk to make
+sound work with docking.
+
+Reported-and-tested-by: lacknerflo@gmail.com
+Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5233,6 +5233,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad T440", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad X240", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
--- /dev/null
+From e8ff581f7ac2bc3b8886094b7ca635dcc4d1b0e9 Mon Sep 17 00:00:00 2001
+From: John Flatness <john@zerocrates.org>
+Date: Fri, 2 Oct 2015 17:07:49 -0400
+Subject: ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1
+
+From: John Flatness <john@zerocrates.org>
+
+commit e8ff581f7ac2bc3b8886094b7ca635dcc4d1b0e9 upstream.
+
+The MacBookPro 12,1 has the same setup as the 11 for controlling the
+status of the optical audio light. Simply apply the existing workaround
+to the subsystem ID for the 12,1.
+
+[sorted the fixup entry by tiwai]
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=105401
+Signed-off-by: John Flatness <john@zerocrates.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_cirrus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -634,6 +634,7 @@ static const struct snd_pci_quirk cs4208
+ SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11),
+ SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
+ SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6),
++ SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11),
+ {} /* terminator */
+ };
+
--- /dev/null
+From c7e1008048a97148d3aecae742f66fb2f944644c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sun, 4 Oct 2015 22:44:12 +0200
+Subject: ALSA: hda - Disable power_save_node for IDT 92HD73xx chips
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c7e1008048a97148d3aecae742f66fb2f944644c upstream.
+
+The recent widget power saving introduced some unavoidable click
+noises on old IDT 92HD73xx chips while it still seems working on the
+compatible new chips. In the bugzilla, we tried lots of tests and
+workarounds, but they didn't help much. So, let's disable the feature
+for these specific chips as the least (but safest) fix.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=104981
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4522,7 +4522,11 @@ static int patch_stac92hd73xx(struct hda
+ return err;
+
+ spec = codec->spec;
+- codec->power_save_node = 1;
++ /* enable power_save_node only for new 92HD89xx chips, as it causes
++ * click noises on old 92HD73xx chips.
++ */
++ if ((codec->core.vendor_id & 0xfffffff0) != 0x111d7670)
++ codec->power_save_node = 1;
+ spec->linear_tone_beep = 0;
+ spec->gen.mixer_nid = 0x1d;
+ spec->have_spdif_mux = 1;
--- /dev/null
+From 7f57d803ee03730d570dc59a9e3e4842b58dd5cc Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 24 Sep 2015 17:36:51 +0200
+Subject: ALSA: hda - Disable power_save_node for Thinkpads
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 7f57d803ee03730d570dc59a9e3e4842b58dd5cc upstream.
+
+Lenovo Thinkpads with recent Realtek codecs seem suffering from click
+noises at power transition since the introduction of widget power
+saving in 4.1 kernel. Although this might be solved by some delays in
+appropriate points, as a quick workaround, just disable the
+power_save_node feature for now. The gain it gives is relatively
+small, and this makes the situation back to pre 4.1 time.
+
+This patch ended up with a bit more code changes than usual because
+the existing fixup for Thinkpads is highly chained. Instead of adding
+yet another chain, combine a few of them into a single fixup entry, as
+a gratis cleanup.
+
+Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=943982
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 31 +++++++++++++++++++------------
+ 1 file changed, 19 insertions(+), 12 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4182,6 +4182,24 @@ static void alc_fixup_disable_aamix(stru
+ }
+ }
+
++/* fixup for Thinkpad docks: add dock pins, avoid HP parser fixup */
++static void alc_fixup_tpt440_dock(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ static const struct hda_pintbl pincfgs[] = {
++ { 0x16, 0x21211010 }, /* dock headphone */
++ { 0x19, 0x21a11010 }, /* dock mic */
++ { }
++ };
++ struct alc_spec *spec = codec->spec;
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
++ codec->power_save_node = 0; /* avoid click noises */
++ snd_hda_apply_pincfgs(codec, pincfgs);
++ }
++}
++
+ static void alc_shutup_dell_xps13(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+@@ -4507,7 +4525,6 @@ enum {
+ ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC,
+ ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC292_FIXUP_TPT440_DOCK,
+- ALC292_FIXUP_TPT440_DOCK2,
+ ALC283_FIXUP_BXBT2807_MIC,
+ ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED,
+ ALC282_FIXUP_ASPIRE_V5_PINS,
+@@ -4972,17 +4989,7 @@ static const struct hda_fixup alc269_fix
+ },
+ [ALC292_FIXUP_TPT440_DOCK] = {
+ .type = HDA_FIXUP_FUNC,
+- .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
+- .chained = true,
+- .chain_id = ALC292_FIXUP_TPT440_DOCK2
+- },
+- [ALC292_FIXUP_TPT440_DOCK2] = {
+- .type = HDA_FIXUP_PINS,
+- .v.pins = (const struct hda_pintbl[]) {
+- { 0x16, 0x21211010 }, /* dock headphone */
+- { 0x19, 0x21a11010 }, /* dock mic */
+- { }
+- },
++ .v.func = alc_fixup_tpt440_dock,
+ .chained = true,
+ .chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
+ },
--- /dev/null
+From 225db5762dc1a35b26850477ffa06e5cd0097243 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 5 Oct 2015 16:55:09 +0200
+Subject: ALSA: synth: Fix conflicting OSS device registration on AWE32
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 225db5762dc1a35b26850477ffa06e5cd0097243 upstream.
+
+When OSS emulation is loaded on ISA SB AWE32 chip, we get now kernel
+warnings like:
+ WARNING: CPU: 0 PID: 2791 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x51/0x80()
+ sysfs: cannot create duplicate filename '/devices/isa/sbawe.0/sound/card0/seq-oss-0-0'
+
+It's because both emux synth and opl3 drivers try to register their
+OSS device object with the same static index number 0. This hasn't
+been a big problem until the recent rewrite of device management code
+(that exposes sysfs at the same time), but it's been an obvious bug.
+
+This patch works around it just by using a different index number of
+emux synth object. There can be a more elegant way to fix, but it's
+enough for now, as this code won't be touched so often, in anyway.
+
+Reported-and-tested-by: Michael Shell <list1@michaelshell.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/synth/emux/emux_oss.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/synth/emux/emux_oss.c
++++ b/sound/synth/emux/emux_oss.c
+@@ -69,7 +69,8 @@ snd_emux_init_seq_oss(struct snd_emux *e
+ struct snd_seq_oss_reg *arg;
+ struct snd_seq_device *dev;
+
+- if (snd_seq_device_new(emu->card, 0, SNDRV_SEQ_DEV_ID_OSS,
++ /* using device#1 here for avoiding conflicts with OPL3 */
++ if (snd_seq_device_new(emu->card, 1, SNDRV_SEQ_DEV_ID_OSS,
+ sizeof(struct snd_seq_oss_reg), &dev) < 0)
+ return;
+
--- /dev/null
+From e74679b38c9417c1c524081121cdcdb36f82264d Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Fri, 25 Sep 2015 11:07:04 +0200
+Subject: ASoC: db1200: Fix DAI link format for db1300 and db1550
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit e74679b38c9417c1c524081121cdcdb36f82264d upstream.
+
+Commit b4508d0f95fa ("ASoC: db1200: Use static DAI format setup") switched
+the db1200 driver over to using static DAI format setup instead of a
+callback function. But the commit only added the dai_fmt field to one of
+the three DAI links in the driver. This breaks audio on db1300 and db1550.
+
+Add the two missing dai_fmt settings to fix the issue.
+
+Fixes: b4508d0f95fa ("ASoC: db1200: Use static DAI format setup")
+Reported-by: Manuel Lauss <manuel.lauss@gmail.com>
+Tested-by: Manuel Lauss <manuel.lauss@gmail.com>
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/au1x/db1200.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/soc/au1x/db1200.c
++++ b/sound/soc/au1x/db1200.c
+@@ -129,6 +129,8 @@ static struct snd_soc_dai_link db1300_i2
+ .cpu_dai_name = "au1xpsc_i2s.2",
+ .platform_name = "au1xpsc-pcm.2",
+ .codec_name = "wm8731.0-001b",
++ .dai_fmt = SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_NB_NF |
++ SND_SOC_DAIFMT_CBM_CFM,
+ .ops = &db1200_i2s_wm8731_ops,
+ };
+
+@@ -146,6 +148,8 @@ static struct snd_soc_dai_link db1550_i2
+ .cpu_dai_name = "au1xpsc_i2s.3",
+ .platform_name = "au1xpsc-pcm.3",
+ .codec_name = "wm8731.0-001b",
++ .dai_fmt = SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_NB_NF |
++ SND_SOC_DAIFMT_CBM_CFM,
+ .ops = &db1200_i2s_wm8731_ops,
+ };
+
--- /dev/null
+From 4873867e5f2bd90faad861dd94865099fc3140f3 Mon Sep 17 00:00:00 2001
+From: Yitian Bu <buyitian@gmail.com>
+Date: Fri, 2 Oct 2015 15:18:41 +0800
+Subject: ASoC: dwc: correct irq clear method
+
+From: Yitian Bu <buyitian@gmail.com>
+
+commit 4873867e5f2bd90faad861dd94865099fc3140f3 upstream.
+
+from Designware I2S datasheet, tx/rx XRUN irq is cleared by
+reading register TOR/ROR, rather than by writing into them.
+
+Signed-off-by: Yitian Bu <yitian.bu@tangramtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/dwc/designware_i2s.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/dwc/designware_i2s.c
++++ b/sound/soc/dwc/designware_i2s.c
+@@ -131,10 +131,10 @@ static inline void i2s_clear_irqs(struct
+
+ if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ for (i = 0; i < 4; i++)
+- i2s_write_reg(dev->i2s_base, TOR(i), 0);
++ i2s_read_reg(dev->i2s_base, TOR(i));
+ } else {
+ for (i = 0; i < 4; i++)
+- i2s_write_reg(dev->i2s_base, ROR(i), 0);
++ i2s_read_reg(dev->i2s_base, ROR(i));
+ }
+ }
+
--- /dev/null
+From 3c8f7710c1c44fb650bc29b6ef78ed8b60cfaa28 Mon Sep 17 00:00:00 2001
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+Date: Tue, 15 Sep 2015 20:51:31 +0200
+Subject: ASoC: fix broken pxa SoC support
+
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+
+commit 3c8f7710c1c44fb650bc29b6ef78ed8b60cfaa28 upstream.
+
+The previous fix of pxa library support, which was introduced to fix the
+library dependency, broke the previous SoC behavior, where a machine
+code binding pxa2xx-ac97 with a coded relied on :
+ - sound/soc/pxa/pxa2xx-ac97.c
+ - sound/soc/codecs/XXX.c
+
+For example, the mioa701_wm9713.c machine code is currently broken. The
+"select ARM" statement wrongly selects the soc/arm/pxa2xx-ac97 for
+compilation, as per an unfortunate fate SND_PXA2XX_AC97 is both declared
+in sound/arm/Kconfig and sound/soc/pxa/Kconfig.
+
+Fix this by ensuring that SND_PXA2XX_SOC correctly triggers the correct
+pxa2xx-ac97 compilation.
+
+Fixes: 846172dfe33c ("ASoC: fix SND_PXA2XX_LIB Kconfig warning")
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/arm/Kconfig | 15 ++++++++-------
+ sound/soc/pxa/Kconfig | 2 --
+ 2 files changed, 8 insertions(+), 9 deletions(-)
+
+--- a/sound/arm/Kconfig
++++ b/sound/arm/Kconfig
+@@ -9,6 +9,14 @@ menuconfig SND_ARM
+ Drivers that are implemented on ASoC can be found in
+ "ALSA for SoC audio support" section.
+
++config SND_PXA2XX_LIB
++ tristate
++ select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97
++ select SND_DMAENGINE_PCM
++
++config SND_PXA2XX_LIB_AC97
++ bool
++
+ if SND_ARM
+
+ config SND_ARMAACI
+@@ -21,13 +29,6 @@ config SND_PXA2XX_PCM
+ tristate
+ select SND_PCM
+
+-config SND_PXA2XX_LIB
+- tristate
+- select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97
+-
+-config SND_PXA2XX_LIB_AC97
+- bool
+-
+ config SND_PXA2XX_AC97
+ tristate "AC97 driver for the Intel PXA2xx chip"
+ depends on ARCH_PXA
+--- a/sound/soc/pxa/Kconfig
++++ b/sound/soc/pxa/Kconfig
+@@ -1,7 +1,6 @@
+ config SND_PXA2XX_SOC
+ tristate "SoC Audio for the Intel PXA2xx chip"
+ depends on ARCH_PXA
+- select SND_ARM
+ select SND_PXA2XX_LIB
+ help
+ Say Y or M if you want to add support for codecs attached to
+@@ -25,7 +24,6 @@ config SND_PXA2XX_AC97
+ config SND_PXA2XX_SOC_AC97
+ tristate
+ select AC97_BUS
+- select SND_ARM
+ select SND_PXA2XX_LIB_AC97
+ select SND_SOC_AC97_BUS
+
--- /dev/null
+From 8811191fdf7ed02ee07cb8469428158572d355a2 Mon Sep 17 00:00:00 2001
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+Date: Tue, 22 Sep 2015 21:20:22 +0200
+Subject: ASoC: pxa: pxa2xx-ac97: fix dma requestor lines
+
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+
+commit 8811191fdf7ed02ee07cb8469428158572d355a2 upstream.
+
+PCM receive and transmit DMA requestor lines were reverted, breaking the
+PCM playback interface for PXA platforms using the sound/soc/ variant
+instead of the sound/arm variant.
+
+The commit below shows the inversion in the requestor lines.
+
+Fixes: d65a14587a9b ("ASoC: pxa: use snd_dmaengine_dai_dma_data")
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/pxa/pxa2xx-ac97.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/pxa/pxa2xx-ac97.c
++++ b/sound/soc/pxa/pxa2xx-ac97.c
+@@ -49,7 +49,7 @@ static struct snd_ac97_bus_ops pxa2xx_ac
+ .reset = pxa2xx_ac97_cold_reset,
+ };
+
+-static unsigned long pxa2xx_ac97_pcm_stereo_in_req = 12;
++static unsigned long pxa2xx_ac97_pcm_stereo_in_req = 11;
+ static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_in = {
+ .addr = __PREG(PCDR),
+ .addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
+@@ -57,7 +57,7 @@ static struct snd_dmaengine_dai_dma_data
+ .filter_data = &pxa2xx_ac97_pcm_stereo_in_req,
+ };
+
+-static unsigned long pxa2xx_ac97_pcm_stereo_out_req = 11;
++static unsigned long pxa2xx_ac97_pcm_stereo_out_req = 12;
+ static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_out = {
+ .addr = __PREG(PCDR),
+ .addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
--- /dev/null
+From e256da84a04ea31c3c215997c847609af224e8f4 Mon Sep 17 00:00:00 2001
+From: Gianluca Renzi <gianlucarenzi@eurekelettronica.it>
+Date: Fri, 25 Sep 2015 21:33:41 +0200
+Subject: ASoC: sgtl5000: fix wrong register MIC_BIAS_VOLTAGE setup on probe
+
+From: Gianluca Renzi <gianlucarenzi@eurekelettronica.it>
+
+commit e256da84a04ea31c3c215997c847609af224e8f4 upstream.
+
+Signed-off-by: Gianluca Renzi <gianlucarenzi@eurekelettronica.it>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/sgtl5000.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1339,8 +1339,8 @@ static int sgtl5000_probe(struct snd_soc
+ sgtl5000->micbias_resistor << SGTL5000_BIAS_R_SHIFT);
+
+ snd_soc_update_bits(codec, SGTL5000_CHIP_MIC_CTRL,
+- SGTL5000_BIAS_R_MASK,
+- sgtl5000->micbias_voltage << SGTL5000_BIAS_R_SHIFT);
++ SGTL5000_BIAS_VOLT_MASK,
++ sgtl5000->micbias_voltage << SGTL5000_BIAS_VOLT_SHIFT);
+ /*
+ * disable DAP
+ * TODO:
--- /dev/null
+From 005efedf2c7d0a270ffbe28d8997b03844f3e3e7 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 14 Sep 2015 09:09:31 +0100
+Subject: Btrfs: fix read corruption of compressed and shared extents
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit 005efedf2c7d0a270ffbe28d8997b03844f3e3e7 upstream.
+
+If a file has a range pointing to a compressed extent, followed by
+another range that points to the same compressed extent and a read
+operation attempts to read both ranges (either completely or part of
+them), the pages that correspond to the second range are incorrectly
+filled with zeroes.
+
+Consider the following example:
+
+ File layout
+ [0 - 8K] [8K - 24K]
+ | |
+ | |
+ points to extent X, points to extent X,
+ offset 4K, length of 8K offset 0, length 16K
+
+ [extent X, compressed length = 4K uncompressed length = 16K]
+
+If a readpages() call spans the 2 ranges, a single bio to read the extent
+is submitted - extent_io.c:submit_extent_page() would only create a new
+bio to cover the second range pointing to the extent if the extent it
+points to had a different logical address than the extent associated with
+the first range. This has a consequence of the compressed read end io
+handler (compression.c:end_compressed_bio_read()) finish once the extent
+is decompressed into the pages covering the first range, leaving the
+remaining pages (belonging to the second range) filled with zeroes (done
+by compression.c:btrfs_clear_biovec_end()).
+
+So fix this by submitting the current bio whenever we find a range
+pointing to a compressed extent that was preceded by a range with a
+different extent map. This is the simplest solution for this corner
+case. Making the end io callback populate both ranges (or more, if we
+have multiple pointing to the same extent) is a much more complex
+solution since each bio is tightly coupled with a single extent map and
+the extent maps associated to the ranges pointing to the shared extent
+can have different offsets and lengths.
+
+The following test case for fstests triggers the issue:
+
+ seq=`basename $0`
+ seqres=$RESULT_DIR/$seq
+ echo "QA output created by $seq"
+ tmp=/tmp/$$
+ status=1 # failure is the default!
+ trap "_cleanup; exit \$status" 0 1 2 3 15
+
+ _cleanup()
+ {
+ rm -f $tmp.*
+ }
+
+ # get standard environment, filters and checks
+ . ./common/rc
+ . ./common/filter
+
+ # real QA test starts here
+ _need_to_be_root
+ _supported_fs btrfs
+ _supported_os Linux
+ _require_scratch
+ _require_cloner
+
+ rm -f $seqres.full
+
+ test_clone_and_read_compressed_extent()
+ {
+ local mount_opts=$1
+
+ _scratch_mkfs >>$seqres.full 2>&1
+ _scratch_mount $mount_opts
+
+ # Create a test file with a single extent that is compressed (the
+ # data we write into it is highly compressible no matter which
+ # compression algorithm is used, zlib or lzo).
+ $XFS_IO_PROG -f -c "pwrite -S 0xaa 0K 4K" \
+ -c "pwrite -S 0xbb 4K 8K" \
+ -c "pwrite -S 0xcc 12K 4K" \
+ $SCRATCH_MNT/foo | _filter_xfs_io
+
+ # Now clone our extent into an adjacent offset.
+ $CLONER_PROG -s $((4 * 1024)) -d $((16 * 1024)) -l $((8 * 1024)) \
+ $SCRATCH_MNT/foo $SCRATCH_MNT/foo
+
+ # Same as before but for this file we clone the extent into a lower
+ # file offset.
+ $XFS_IO_PROG -f -c "pwrite -S 0xaa 8K 4K" \
+ -c "pwrite -S 0xbb 12K 8K" \
+ -c "pwrite -S 0xcc 20K 4K" \
+ $SCRATCH_MNT/bar | _filter_xfs_io
+
+ $CLONER_PROG -s $((12 * 1024)) -d 0 -l $((8 * 1024)) \
+ $SCRATCH_MNT/bar $SCRATCH_MNT/bar
+
+ echo "File digests before unmounting filesystem:"
+ md5sum $SCRATCH_MNT/foo | _filter_scratch
+ md5sum $SCRATCH_MNT/bar | _filter_scratch
+
+ # Evicting the inode or clearing the page cache before reading
+ # again the file would also trigger the bug - reads were returning
+ # all bytes in the range corresponding to the second reference to
+ # the extent with a value of 0, but the correct data was persisted
+ # (it was a bug exclusively in the read path). The issue happened
+ # only if the same readpages() call targeted pages belonging to the
+ # first and second ranges that point to the same compressed extent.
+ _scratch_remount
+
+ echo "File digests after mounting filesystem again:"
+ # Must match the same digests we got before.
+ md5sum $SCRATCH_MNT/foo | _filter_scratch
+ md5sum $SCRATCH_MNT/bar | _filter_scratch
+ }
+
+ echo -e "\nTesting with zlib compression..."
+ test_clone_and_read_compressed_extent "-o compress=zlib"
+
+ _scratch_unmount
+
+ echo -e "\nTesting with lzo compression..."
+ test_clone_and_read_compressed_extent "-o compress=lzo"
+
+ status=0
+ exit
+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: Qu Wenruo<quwenruo@cn.fujitsu.com>
+Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/extent_io.c | 65 ++++++++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 57 insertions(+), 8 deletions(-)
+
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -2795,7 +2795,8 @@ static int submit_extent_page(int rw, st
+ bio_end_io_t end_io_func,
+ int mirror_num,
+ unsigned long prev_bio_flags,
+- unsigned long bio_flags)
++ unsigned long bio_flags,
++ bool force_bio_submit)
+ {
+ int ret = 0;
+ struct bio *bio;
+@@ -2813,6 +2814,7 @@ static int submit_extent_page(int rw, st
+ contig = bio_end_sector(bio) == sector;
+
+ if (prev_bio_flags != bio_flags || !contig ||
++ force_bio_submit ||
+ merge_bio(rw, tree, page, offset, page_size, bio, bio_flags) ||
+ bio_add_page(bio, page, page_size, offset) < page_size) {
+ ret = submit_one_bio(rw, bio, mirror_num,
+@@ -2906,7 +2908,8 @@ static int __do_readpage(struct extent_i
+ get_extent_t *get_extent,
+ struct extent_map **em_cached,
+ struct bio **bio, int mirror_num,
+- unsigned long *bio_flags, int rw)
++ unsigned long *bio_flags, int rw,
++ u64 *prev_em_start)
+ {
+ struct inode *inode = page->mapping->host;
+ u64 start = page_offset(page);
+@@ -2954,6 +2957,7 @@ static int __do_readpage(struct extent_i
+ }
+ while (cur <= end) {
+ unsigned long pnr = (last_byte >> PAGE_CACHE_SHIFT) + 1;
++ bool force_bio_submit = false;
+
+ if (cur >= last_byte) {
+ char *userpage;
+@@ -3004,6 +3008,49 @@ static int __do_readpage(struct extent_i
+ block_start = em->block_start;
+ if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
+ block_start = EXTENT_MAP_HOLE;
++
++ /*
++ * If we have a file range that points to a compressed extent
++ * and it's followed by a consecutive file range that points to
++ * to the same compressed extent (possibly with a different
++ * offset and/or length, so it either points to the whole extent
++ * or only part of it), we must make sure we do not submit a
++ * single bio to populate the pages for the 2 ranges because
++ * this makes the compressed extent read zero out the pages
++ * belonging to the 2nd range. Imagine the following scenario:
++ *
++ * File layout
++ * [0 - 8K] [8K - 24K]
++ * | |
++ * | |
++ * points to extent X, points to extent X,
++ * offset 4K, length of 8K offset 0, length 16K
++ *
++ * [extent X, compressed length = 4K uncompressed length = 16K]
++ *
++ * If the bio to read the compressed extent covers both ranges,
++ * it will decompress extent X into the pages belonging to the
++ * first range and then it will stop, zeroing out the remaining
++ * pages that belong to the other range that points to extent X.
++ * So here we make sure we submit 2 bios, one for the first
++ * range and another one for the third range. Both will target
++ * the same physical extent from disk, but we can't currently
++ * make the compressed bio endio callback populate the pages
++ * for both ranges because each compressed bio is tightly
++ * coupled with a single extent map, and each range can have
++ * an extent map with a different offset value relative to the
++ * uncompressed data of our extent and different lengths. This
++ * is a corner case so we prioritize correctness over
++ * non-optimal behavior (submitting 2 bios for the same extent).
++ */
++ if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) &&
++ prev_em_start && *prev_em_start != (u64)-1 &&
++ *prev_em_start != em->orig_start)
++ force_bio_submit = true;
++
++ if (prev_em_start)
++ *prev_em_start = em->orig_start;
++
+ free_extent_map(em);
+ em = NULL;
+
+@@ -3053,7 +3100,8 @@ static int __do_readpage(struct extent_i
+ bdev, bio, pnr,
+ end_bio_extent_readpage, mirror_num,
+ *bio_flags,
+- this_bio_flag);
++ this_bio_flag,
++ force_bio_submit);
+ if (!ret) {
+ nr++;
+ *bio_flags = this_bio_flag;
+@@ -3085,6 +3133,7 @@ static inline void __do_contiguous_readp
+ struct inode *inode;
+ struct btrfs_ordered_extent *ordered;
+ int index;
++ u64 prev_em_start = (u64)-1;
+
+ inode = pages[0]->mapping->host;
+ while (1) {
+@@ -3100,7 +3149,7 @@ static inline void __do_contiguous_readp
+
+ for (index = 0; index < nr_pages; index++) {
+ __do_readpage(tree, pages[index], get_extent, em_cached, bio,
+- mirror_num, bio_flags, rw);
++ mirror_num, bio_flags, rw, &prev_em_start);
+ page_cache_release(pages[index]);
+ }
+ }
+@@ -3168,7 +3217,7 @@ static int __extent_read_full_page(struc
+ }
+
+ ret = __do_readpage(tree, page, get_extent, NULL, bio, mirror_num,
+- bio_flags, rw);
++ bio_flags, rw, NULL);
+ return ret;
+ }
+
+@@ -3194,7 +3243,7 @@ int extent_read_full_page_nolock(struct
+ int ret;
+
+ ret = __do_readpage(tree, page, get_extent, NULL, &bio, mirror_num,
+- &bio_flags, READ);
++ &bio_flags, READ, NULL);
+ if (bio)
+ ret = submit_one_bio(READ, bio, mirror_num, bio_flags);
+ return ret;
+@@ -3447,7 +3496,7 @@ static noinline_for_stack int __extent_w
+ sector, iosize, pg_offset,
+ bdev, &epd->bio, max_nr,
+ end_bio_extent_writepage,
+- 0, 0, 0);
++ 0, 0, 0, false);
+ if (ret)
+ SetPageError(page);
+ }
+@@ -3749,7 +3798,7 @@ static noinline_for_stack int write_one_
+ ret = submit_extent_page(rw, tree, p, offset >> 9,
+ PAGE_CACHE_SIZE, 0, bdev, &epd->bio,
+ -1, end_bio_extent_buffer_writepage,
+- 0, epd->bio_flags, bio_flags);
++ 0, epd->bio_flags, bio_flags, false);
+ epd->bio_flags = bio_flags;
+ if (ret) {
+ set_btree_ioerr(p);
--- /dev/null
+From a30e577c96f59b1e1678ea5462432b09bf7d5cbc Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Fri, 11 Sep 2015 21:44:17 -0400
+Subject: btrfs: skip waiting on ordered range for special files
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit a30e577c96f59b1e1678ea5462432b09bf7d5cbc upstream.
+
+In btrfs_evict_inode, we properly truncate the page cache for evicted
+inodes but then we call btrfs_wait_ordered_range for every inode as well.
+It's the right thing to do for regular files but results in incorrect
+behavior for device inodes for block devices.
+
+filemap_fdatawrite_range gets called with inode->i_mapping which gets
+resolved to the block device inode before getting passed to
+wbc_attach_fdatawrite_inode and ultimately to inode_to_bdi. What happens
+next depends on whether there's an open file handle associated with the
+inode. If there is, we write to the block device, which is unexpected
+behavior. If there isn't, we through normally and inode->i_data is used.
+We can also end up racing against open/close which can result in crashes
+when i_mapping points to a block device inode that has been closed.
+
+Since there can't be any page cache associated with special file inodes,
+it's safe to skip the btrfs_wait_ordered_range call entirely and avoid
+the problem.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=100911
+Tested-by: Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/inode.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -5035,7 +5035,8 @@ void btrfs_evict_inode(struct inode *ino
+ goto no_delete;
+ }
+ /* do we really want it for ->i_nlink > 0 and zero btrfs_root_refs? */
+- btrfs_wait_ordered_range(inode, 0, (u64)-1);
++ if (!special_file(inode->i_mode))
++ btrfs_wait_ordered_range(inode, 0, (u64)-1);
+
+ btrfs_free_io_failure_record(inode, 0, (u64)-1);
+
--- /dev/null
+From 808f80b46790f27e145c72112189d6a3be2bc884 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 28 Sep 2015 09:56:26 +0100
+Subject: Btrfs: update fix for read corruption of compressed and shared extents
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit 808f80b46790f27e145c72112189d6a3be2bc884 upstream.
+
+My previous fix in commit 005efedf2c7d ("Btrfs: fix read corruption of
+compressed and shared extents") was effective only if the compressed
+extents cover a file range with a length that is not a multiple of 16
+pages. That's because the detection of when we reached a different range
+of the file that shares the same compressed extent as the previously
+processed range was done at extent_io.c:__do_contiguous_readpages(),
+which covers subranges with a length up to 16 pages, because
+extent_readpages() groups the pages in clusters no larger than 16 pages.
+So fix this by tracking the start of the previously processed file
+range's extent map at extent_readpages().
+
+The following test case for fstests reproduces the issue:
+
+ seq=`basename $0`
+ seqres=$RESULT_DIR/$seq
+ echo "QA output created by $seq"
+ tmp=/tmp/$$
+ status=1 # failure is the default!
+ trap "_cleanup; exit \$status" 0 1 2 3 15
+
+ _cleanup()
+ {
+ rm -f $tmp.*
+ }
+
+ # get standard environment, filters and checks
+ . ./common/rc
+ . ./common/filter
+
+ # real QA test starts here
+ _need_to_be_root
+ _supported_fs btrfs
+ _supported_os Linux
+ _require_scratch
+ _require_cloner
+
+ rm -f $seqres.full
+
+ test_clone_and_read_compressed_extent()
+ {
+ local mount_opts=$1
+
+ _scratch_mkfs >>$seqres.full 2>&1
+ _scratch_mount $mount_opts
+
+ # Create our test file with a single extent of 64Kb that is going to
+ # be compressed no matter which compression algo is used (zlib/lzo).
+ $XFS_IO_PROG -f -c "pwrite -S 0xaa 0K 64K" \
+ $SCRATCH_MNT/foo | _filter_xfs_io
+
+ # Now clone the compressed extent into an adjacent file offset.
+ $CLONER_PROG -s 0 -d $((64 * 1024)) -l $((64 * 1024)) \
+ $SCRATCH_MNT/foo $SCRATCH_MNT/foo
+
+ echo "File digest before unmount:"
+ md5sum $SCRATCH_MNT/foo | _filter_scratch
+
+ # Remount the fs or clear the page cache to trigger the bug in
+ # btrfs. Because the extent has an uncompressed length that is a
+ # multiple of 16 pages, all the pages belonging to the second range
+ # of the file (64K to 128K), which points to the same extent as the
+ # first range (0K to 64K), had their contents full of zeroes instead
+ # of the byte 0xaa. This was a bug exclusively in the read path of
+ # compressed extents, the correct data was stored on disk, btrfs
+ # just failed to fill in the pages correctly.
+ _scratch_remount
+
+ echo "File digest after remount:"
+ # Must match the digest we got before.
+ md5sum $SCRATCH_MNT/foo | _filter_scratch
+ }
+
+ echo -e "\nTesting with zlib compression..."
+ test_clone_and_read_compressed_extent "-o compress=zlib"
+
+ _scratch_unmount
+
+ echo -e "\nTesting with lzo compression..."
+ test_clone_and_read_compressed_extent "-o compress=lzo"
+
+ status=0
+ exit
+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Tested-by: Timofey Titovets <nefelim4ag@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/extent_io.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -3128,12 +3128,12 @@ static inline void __do_contiguous_readp
+ get_extent_t *get_extent,
+ struct extent_map **em_cached,
+ struct bio **bio, int mirror_num,
+- unsigned long *bio_flags, int rw)
++ unsigned long *bio_flags, int rw,
++ u64 *prev_em_start)
+ {
+ struct inode *inode;
+ struct btrfs_ordered_extent *ordered;
+ int index;
+- u64 prev_em_start = (u64)-1;
+
+ inode = pages[0]->mapping->host;
+ while (1) {
+@@ -3149,7 +3149,7 @@ static inline void __do_contiguous_readp
+
+ for (index = 0; index < nr_pages; index++) {
+ __do_readpage(tree, pages[index], get_extent, em_cached, bio,
+- mirror_num, bio_flags, rw, &prev_em_start);
++ mirror_num, bio_flags, rw, prev_em_start);
+ page_cache_release(pages[index]);
+ }
+ }
+@@ -3159,7 +3159,8 @@ static void __extent_readpages(struct ex
+ int nr_pages, get_extent_t *get_extent,
+ struct extent_map **em_cached,
+ struct bio **bio, int mirror_num,
+- unsigned long *bio_flags, int rw)
++ unsigned long *bio_flags, int rw,
++ u64 *prev_em_start)
+ {
+ u64 start = 0;
+ u64 end = 0;
+@@ -3180,7 +3181,7 @@ static void __extent_readpages(struct ex
+ index - first_index, start,
+ end, get_extent, em_cached,
+ bio, mirror_num, bio_flags,
+- rw);
++ rw, prev_em_start);
+ start = page_start;
+ end = start + PAGE_CACHE_SIZE - 1;
+ first_index = index;
+@@ -3191,7 +3192,8 @@ static void __extent_readpages(struct ex
+ __do_contiguous_readpages(tree, &pages[first_index],
+ index - first_index, start,
+ end, get_extent, em_cached, bio,
+- mirror_num, bio_flags, rw);
++ mirror_num, bio_flags, rw,
++ prev_em_start);
+ }
+
+ static int __extent_read_full_page(struct extent_io_tree *tree,
+@@ -4202,6 +4204,7 @@ int extent_readpages(struct extent_io_tr
+ struct page *page;
+ struct extent_map *em_cached = NULL;
+ int nr = 0;
++ u64 prev_em_start = (u64)-1;
+
+ for (page_idx = 0; page_idx < nr_pages; page_idx++) {
+ page = list_entry(pages->prev, struct page, lru);
+@@ -4218,12 +4221,12 @@ int extent_readpages(struct extent_io_tr
+ if (nr < ARRAY_SIZE(pagepool))
+ continue;
+ __extent_readpages(tree, pagepool, nr, get_extent, &em_cached,
+- &bio, 0, &bio_flags, READ);
++ &bio, 0, &bio_flags, READ, &prev_em_start);
+ nr = 0;
+ }
+ if (nr)
+ __extent_readpages(tree, pagepool, nr, get_extent, &em_cached,
+- &bio, 0, &bio_flags, READ);
++ &bio, 0, &bio_flags, READ, &prev_em_start);
+
+ if (em_cached)
+ free_extent_map(em_cached);
--- /dev/null
+From b838b39e930aa1cfd099ea82ac40ed6d6413af26 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Tue, 22 Sep 2015 17:03:54 -0500
+Subject: PCI: Clear IORESOURCE_UNSET when clipping a bridge window
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit b838b39e930aa1cfd099ea82ac40ed6d6413af26 upstream.
+
+c770cb4cb505 ("PCI: Mark invalid BARs as unassigned") sets IORESOURCE_UNSET
+if we fail to claim a resource. If we tried to claim a bridge window,
+failed, clipped the window, and tried to claim the clipped window, we
+failed again because of IORESOURCE_UNSET:
+
+ pci_bus 0000:00: root bus resource [mem 0xc0000000-0xffffffff window]
+ pci 0000:00:01.0: can't claim BAR 15 [mem 0xbdf00000-0xddefffff 64bit pref]: no compatible bridge window
+ pci 0000:00:01.0: [mem size 0x20000000 64bit pref] clipped to [mem size 0x1df00000 64bit pref]
+ pci 0000:00:01.0: bridge window [mem size 0x1df00000 64bit pref]
+ pci 0000:00:01.0: can't claim BAR 15 [mem size 0x1df00000 64bit pref]: no address assigned
+
+The 00:01.0 window started as [mem 0xbdf00000-0xddefffff 64bit pref]. That
+starts before the host bridge window [mem 0xc0000000-0xffffffff window], so
+we clipped the 00:01.0 window to [mem 0xc0000000-0xddefffff 64bit pref].
+But we left it marked IORESOURCE_UNSET, so the second claim failed when it
+should have succeeded.
+
+This means downstream devices will also fail for lack of resources, e.g.,
+in the bugzilla below,
+
+ radeon 0000:01:00.0: Fatal error during GPU init
+
+Clear IORESOURCE_UNSET when we clip a bridge window. Also clear
+IORESOURCE_UNSET in our copy of the unclipped window so we can see exactly
+what the original window was and how it now fits inside the upstream
+window.
+
+Fixes: c770cb4cb505 ("PCI: Mark invalid BARs as unassigned")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=85491#c47
+Based-on-patch-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Based-on-patch-by: Yinghai Lu <yinghai@kernel.org>
+Tested-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/bus.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pci/bus.c
++++ b/drivers/pci/bus.c
+@@ -256,6 +256,8 @@ bool pci_bus_clip_resource(struct pci_de
+
+ res->start = start;
+ res->end = end;
++ res->flags &= ~IORESOURCE_UNSET;
++ orig_res.flags &= ~IORESOURCE_UNSET;
+ dev_printk(KERN_DEBUG, &dev->dev, "%pR clipped to %pR\n",
+ &orig_res, res);
+
--- /dev/null
+From 9d9240756e63dd87d6cbf5da8b98ceb8f8192b55 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Tue, 15 Sep 2015 11:17:21 -0600
+Subject: PCI: Fix devfn for VPD access through function 0
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+commit 9d9240756e63dd87d6cbf5da8b98ceb8f8192b55 upstream.
+
+Commit 932c435caba8 ("PCI: Add dev_flags bit to access VPD through function
+0") passes PCI_SLOT(devfn) for the devfn parameter of pci_get_slot().
+Generally this works because we're fairly well guaranteed that a PCIe
+device is at slot address 0, but for the general case, including
+conventional PCI, it's incorrect. We need to get the slot and then convert
+it back into a devfn.
+
+Fixes: 932c435caba8 ("PCI: Add dev_flags bit to access VPD through function 0")
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
+Acked-by: Myron Stowe <myron.stowe@redhat.com>
+Acked-by: Mark Rustad <mark.d.rustad@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/access.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -442,7 +442,8 @@ static const struct pci_vpd_ops pci_vpd_
+ static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count,
+ void *arg)
+ {
+- struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ struct pci_dev *tdev = pci_get_slot(dev->bus,
++ PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
+ ssize_t ret;
+
+ if (!tdev)
+@@ -456,7 +457,8 @@ static ssize_t pci_vpd_f0_read(struct pc
+ static ssize_t pci_vpd_f0_write(struct pci_dev *dev, loff_t pos, size_t count,
+ const void *arg)
+ {
+- struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ struct pci_dev *tdev = pci_get_slot(dev->bus,
++ PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
+ ssize_t ret;
+
+ if (!tdev)
+@@ -475,7 +477,8 @@ static const struct pci_vpd_ops pci_vpd_
+
+ static int pci_vpd_f0_dev_check(struct pci_dev *dev)
+ {
+- struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ struct pci_dev *tdev = pci_get_slot(dev->bus,
++ PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
+ int ret = 0;
+
+ if (!tdev)
--- /dev/null
+From da2d03ea27f6ed9d2005a67b20dd021ddacf1e4d Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Tue, 15 Sep 2015 22:24:46 -0600
+Subject: PCI: Use function 0 VPD for identical functions, regular VPD for others
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+commit da2d03ea27f6ed9d2005a67b20dd021ddacf1e4d upstream.
+
+932c435caba8 ("PCI: Add dev_flags bit to access VPD through function 0")
+added PCI_DEV_FLAGS_VPD_REF_F0. Previously, we set the flag on every
+non-zero function of quirked devices. If a function turned out to be
+different from function 0, i.e., it had a different class, vendor ID, or
+device ID, the flag remained set but we didn't make VPD accessible at all.
+
+Flip this around so we only set PCI_DEV_FLAGS_VPD_REF_F0 for functions that
+are identical to function 0, and allow regular VPD access for any other
+functions.
+
+[bhelgaas: changelog, stable tag]
+Fixes: 932c435caba8 ("PCI: Add dev_flags bit to access VPD through function 0")
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
+Acked-by: Myron Stowe <myron.stowe@redhat.com>
+Acked-by: Mark Rustad <mark.d.rustad@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/access.c | 22 ----------------------
+ drivers/pci/quirks.c | 20 ++++++++++++++++++--
+ 2 files changed, 18 insertions(+), 24 deletions(-)
+
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -475,23 +475,6 @@ static const struct pci_vpd_ops pci_vpd_
+ .release = pci_vpd_pci22_release,
+ };
+
+-static int pci_vpd_f0_dev_check(struct pci_dev *dev)
+-{
+- struct pci_dev *tdev = pci_get_slot(dev->bus,
+- PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
+- int ret = 0;
+-
+- if (!tdev)
+- return -ENODEV;
+- if (!tdev->vpd || !tdev->multifunction ||
+- dev->class != tdev->class || dev->vendor != tdev->vendor ||
+- dev->device != tdev->device)
+- ret = -ENODEV;
+-
+- pci_dev_put(tdev);
+- return ret;
+-}
+-
+ int pci_vpd_pci22_init(struct pci_dev *dev)
+ {
+ struct pci_vpd_pci22 *vpd;
+@@ -500,12 +483,7 @@ int pci_vpd_pci22_init(struct pci_dev *d
+ cap = pci_find_capability(dev, PCI_CAP_ID_VPD);
+ if (!cap)
+ return -ENODEV;
+- if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0) {
+- int ret = pci_vpd_f0_dev_check(dev);
+
+- if (ret)
+- return ret;
+- }
+ vpd = kzalloc(sizeof(*vpd), GFP_ATOMIC);
+ if (!vpd)
+ return -ENOMEM;
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1915,11 +1915,27 @@ static void quirk_netmos(struct pci_dev
+ DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_NETMOS, PCI_ANY_ID,
+ PCI_CLASS_COMMUNICATION_SERIAL, 8, quirk_netmos);
+
++/*
++ * Quirk non-zero PCI functions to route VPD access through function 0 for
++ * devices that share VPD resources between functions. The functions are
++ * expected to be identical devices.
++ */
+ static void quirk_f0_vpd_link(struct pci_dev *dev)
+ {
+- if (!dev->multifunction || !PCI_FUNC(dev->devfn))
++ struct pci_dev *f0;
++
++ if (!PCI_FUNC(dev->devfn))
++ return;
++
++ f0 = pci_get_slot(dev->bus, PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
++ if (!f0)
+ return;
+- dev->dev_flags |= PCI_DEV_FLAGS_VPD_REF_F0;
++
++ if (f0->vpd && dev->class == f0->class &&
++ dev->vendor == f0->vendor && dev->device == f0->device)
++ dev->dev_flags |= PCI_DEV_FLAGS_VPD_REF_F0;
++
++ pci_dev_put(f0);
+ }
+ DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID,
+ PCI_CLASS_NETWORK_ETHERNET, 8, quirk_f0_vpd_link);
lib-iommu-common.c-do-not-try-to-deref-a-null-iommu-lazy_flush-pointer-when-n-pool-hint.patch
ocfs2-dlm-fix-deadlock-when-dispatch-assert-master.patch
mm-hugetlbfs-skip-shared-vmas-when-unmapping-private-pages-to-satisfy-a-fault.patch
+alsa-hda-disable-power_save_node-for-thinkpads.patch
+alsa-synth-fix-conflicting-oss-device-registration-on-awe32.patch
+alsa-hda-add-dock-support-for-thinkpad-t550.patch
+alsa-hda-apply-spdif-pin-ctl-to-macbookpro-12-1.patch
+alsa-hda-disable-power_save_node-for-idt-92hd73xx-chips.patch
+asoc-pxa-pxa2xx-ac97-fix-dma-requestor-lines.patch
+asoc-fix-broken-pxa-soc-support.patch
+asoc-dwc-correct-irq-clear-method.patch
+asoc-db1200-fix-dai-link-format-for-db1300-and-db1550.patch
+asoc-sgtl5000-fix-wrong-register-mic_bias_voltage-setup-on-probe.patch
+btrfs-skip-waiting-on-ordered-range-for-special-files.patch
+btrfs-fix-read-corruption-of-compressed-and-shared-extents.patch
+btrfs-update-fix-for-read-corruption-of-compressed-and-shared-extents.patch
+pci-fix-devfn-for-vpd-access-through-function-0.patch
+pci-use-function-0-vpd-for-identical-functions-regular-vpd-for-others.patch
+pci-clear-ioresource_unset-when-clipping-a-bridge-window.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
