--- /dev/null
+From 15bfd21fbc5d35834b9ea383dc458a1f0c9e3434 Mon Sep 17 00:00:00 2001
+From: Keith Busch <keith.busch@intel.com>
+Date: Tue, 26 Jun 2018 09:14:58 -0600
+Subject: block: Fix transfer when chunk sectors exceeds max
+
+From: Keith Busch <keith.busch@intel.com>
+
+commit 15bfd21fbc5d35834b9ea383dc458a1f0c9e3434 upstream.
+
+A device may have boundary restrictions where the number of sectors
+between boundaries exceeds its max transfer size. In this case, we need
+to cap the max size to the smaller of the two limits.
+
+Reported-by: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+Tested-by: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/blkdev.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -901,8 +901,8 @@ static inline unsigned int blk_max_size_
+ if (!q->limits.chunk_sectors)
+ return q->limits.max_sectors;
+
+- return q->limits.chunk_sectors -
+- (offset & (q->limits.chunk_sectors - 1));
++ return min(q->limits.max_sectors, (unsigned int)(q->limits.chunk_sectors -
++ (offset & (q->limits.chunk_sectors - 1))));
+ }
+
+ static inline unsigned int blk_rq_get_max_sectors(struct request *rq,
--- /dev/null
+From a685557fbbc3122ed11e8ad3fa63a11ebc5de8c3 Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Tue, 26 Jun 2018 12:04:23 -0400
+Subject: dm thin: handle running out of data space vs concurrent discard
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit a685557fbbc3122ed11e8ad3fa63a11ebc5de8c3 upstream.
+
+Discards issued to a DM thin device can complete to userspace (via
+fstrim) _before_ the metadata changes associated with the discards is
+reflected in the thinp superblock (e.g. free blocks). As such, if a
+user constructs a test that loops repeatedly over these steps, block
+allocation can fail due to discards not having completed yet:
+1) fill thin device via filesystem file
+2) remove file
+3) fstrim
+
+From initial report, here:
+https://www.redhat.com/archives/dm-devel/2018-April/msg00022.html
+
+"The root cause of this issue is that dm-thin will first remove
+mapping and increase corresponding blocks' reference count to prevent
+them from being reused before DISCARD bios get processed by the
+underlying layers. However. increasing blocks' reference count could
+also increase the nr_allocated_this_transaction in struct sm_disk
+which makes smd->old_ll.nr_allocated +
+smd->nr_allocated_this_transaction bigger than smd->old_ll.nr_blocks.
+In this case, alloc_data_block() will never commit metadata to reset
+the begin pointer of struct sm_disk, because sm_disk_get_nr_free()
+always return an underflow value."
+
+While there is room for improvement to the space-map accounting that
+thinp is making use of: the reality is this test is inherently racey and
+will result in the previous iteration's fstrim's discard(s) completing
+vs concurrent block allocation, via dd, in the next iteration of the
+loop.
+
+No amount of space map accounting improvements will be able to allow
+user's to use a block before a discard of that block has completed.
+
+So the best we can really do is allow DM thinp to gracefully handle such
+aggressive use of all the pool's data by degrading the pool into
+out-of-data-space (OODS) mode. We _should_ get that behaviour already
+(if space map accounting didn't falsely cause alloc_data_block() to
+believe free space was available).. but short of that we handle the
+current reality that dm_pool_alloc_data_block() can return -ENOSPC.
+
+Reported-by: Dennis Yang <dennisyang@qnap.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -1384,6 +1384,8 @@ static void schedule_external_copy(struc
+
+ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
+
++static void requeue_bios(struct pool *pool);
++
+ static void check_for_space(struct pool *pool)
+ {
+ int r;
+@@ -1396,8 +1398,10 @@ static void check_for_space(struct pool
+ if (r)
+ return;
+
+- if (nr_free)
++ if (nr_free) {
+ set_pool_mode(pool, PM_WRITE);
++ requeue_bios(pool);
++ }
+ }
+
+ /*
+@@ -1474,7 +1478,10 @@ static int alloc_data_block(struct thin_
+
+ r = dm_pool_alloc_data_block(pool->pmd, result);
+ if (r) {
+- metadata_operation_failed(pool, "dm_pool_alloc_data_block", r);
++ if (r == -ENOSPC)
++ set_pool_mode(pool, PM_OUT_OF_DATA_SPACE);
++ else
++ metadata_operation_failed(pool, "dm_pool_alloc_data_block", r);
+ return r;
+ }
+
+++ /dev/null
-From 3cedc8797b9c0f2222fd45a01f849c57c088828b Mon Sep 17 00:00:00 2001
-From: Anil Gurumurthy <anil.gurumurthy@cavium.com>
-Date: Wed, 6 Jun 2018 08:41:42 -0700
-Subject: scsi: qla2xxx: Mask off Scope bits in retry delay
-
-From: Anil Gurumurthy <anil.gurumurthy@cavium.com>
-
-commit 3cedc8797b9c0f2222fd45a01f849c57c088828b upstream.
-
-Some newer target uses "Status Qualifier" response in a returned "Busy
-Status". This new response code of 0x4001, which is "Scope" bits,
-translates to "Affects all units accessible by target". Due to this new
-value returned in the Scope bits, driver was using that value as timeout
-value which resulted into driver waiting for 27min timeout.
-
-This patch masks off this Scope bits so that driver does not use this
-value as retry delay time.
-
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Anil Gurumurthy <anil.gurumurthy@cavium.com>
-Signed-off-by: Giridhar Malavali <giridhar.malavali@cavium.com>
-Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
-Reviewed-by: Ewan D. Milne <emilne@redhat.com>
-Reviewed-by: Martin Wilck <mwilck@suse.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/scsi/qla2xxx/qla_isr.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
---- a/drivers/scsi/qla2xxx/qla_isr.c
-+++ b/drivers/scsi/qla2xxx/qla_isr.c
-@@ -2168,8 +2168,12 @@ qla2x00_status_entry(scsi_qla_host_t *vh
- ox_id = le16_to_cpu(sts24->ox_id);
- par_sense_len = sizeof(sts24->data);
- /* Valid values of the retry delay timer are 0x1-0xffef */
-- if (sts24->retry_delay > 0 && sts24->retry_delay < 0xfff1)
-- retry_delay = sts24->retry_delay;
-+ if (sts24->retry_delay > 0 && sts24->retry_delay < 0xfff1) {
-+ retry_delay = sts24->retry_delay & 0x3fff;
-+ ql_dbg(ql_dbg_io, sp->vha, 0x3033,
-+ "%s: scope=%#x retry_delay=%#x\n", __func__,
-+ sts24->retry_delay >> 14, retry_delay);
-+ }
- } else {
- if (scsi_status & SS_SENSE_LEN_VALID)
- sense_len = le16_to_cpu(sts->req_sense_length);
btrfs-fix-unexpected-cow-in-run_delalloc_nocow.patch
iio-buffer-make-length-types-match-kfifo-types.patch
scsi-qla2xxx-fix-setting-lower-transfer-speed-if-gpsc-fails.patch
-scsi-qla2xxx-mask-off-scope-bits-in-retry-delay.patch
scsi-zfcp-fix-missing-scsi-trace-for-result-of-eh_host_reset_handler.patch
scsi-zfcp-fix-missing-scsi-trace-for-retry-of-abort-scsi_eh-tmf.patch
scsi-zfcp-fix-misleading-rec-trigger-trace-where-erp_action-setup-failed.patch
input-elantech-fix-v4-report-decoding-for-module-with-middle-key.patch
alsa-hda-realtek-fix-pop-noise-on-lenovo-p50-co.patch
alsa-hda-realtek-add-a-quirk-for-fsc-esprimo-u9210.patch
+block-fix-transfer-when-chunk-sectors-exceeds-max.patch
+dm-thin-handle-running-out-of-data-space-vs-concurrent-discard.patch