--- /dev/null
+From 12c91a5c2d2a8e8cc40a9552313e1e7b0a2d9ee3 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Tue, 7 Jan 2014 15:47:59 +0000
+Subject: dm space map common: make sure new space is used during extend
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 12c91a5c2d2a8e8cc40a9552313e1e7b0a2d9ee3 upstream.
+
+When extending a low level space map we should update nr_blocks at
+the start so the new space is used for the index entries.
+
+Otherwise extend can fail, e.g.: sm_metadata_extend call sequence
+that fails:
+ -> sm_ll_extend
+ -> dm_tm_new_block -> dm_sm_new_block -> sm_bootstrap_new_block
+ => returns -ENOSPC because smm->begin == smm->ll.nr_blocks
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-space-map-common.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/persistent-data/dm-space-map-common.c
++++ b/drivers/md/persistent-data/dm-space-map-common.c
+@@ -245,6 +245,10 @@ int sm_ll_extend(struct ll_disk *ll, dm_
+ return -EINVAL;
+ }
+
++ /*
++ * We need to set this before the dm_tm_new_block() call below.
++ */
++ ll->nr_blocks = nr_blocks;
+ for (i = old_blocks; i < blocks; i++) {
+ struct dm_block *b;
+ struct disk_index_entry idx;
+@@ -252,6 +256,7 @@ int sm_ll_extend(struct ll_disk *ll, dm_
+ r = dm_tm_new_block(ll->tm, &dm_sm_bitmap_validator, &b);
+ if (r < 0)
+ return r;
++
+ idx.blocknr = cpu_to_le64(dm_block_location(b));
+
+ r = dm_tm_unlock(ll->tm, b);
+@@ -266,7 +271,6 @@ int sm_ll_extend(struct ll_disk *ll, dm_
+ return r;
+ }
+
+- ll->nr_blocks = nr_blocks;
+ return 0;
+ }
+
--- /dev/null
+From fca028438fb903852beaf7c3fe1cd326651af57d Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Tue, 21 Jan 2014 11:07:32 +0000
+Subject: dm space map metadata: fix bug in resizing of thin metadata
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit fca028438fb903852beaf7c3fe1cd326651af57d upstream.
+
+This bug was introduced in commit 7e664b3dec431e ("dm space map metadata:
+fix extending the space map").
+
+When extending a dm-thin metadata volume we:
+
+- Switch the space map into a simple bootstrap mode, which allocates
+ all space linearly from the newly added space.
+- Add new bitmap entries for the new space
+- Increment the reference counts for those newly allocated bitmap
+ entries
+- Commit changes to disk
+- Switch back out of bootstrap mode.
+
+But, the disk commit may allocate space itself, if so this fact will be
+lost when switching out of bootstrap mode.
+
+The bug exhibited itself as an error when the bitmap_root, with an
+erroneous ref count of 0, was subsequently decremented as part of a
+later disk commit. This would cause the disk commit to fail, and thinp
+to enter read_only mode. The metadata was not damaged (thin_check
+passed).
+
+The fix is to put the increments + commit into a loop, running until
+the commit has not allocated extra space. In practise this loop only
+runs twice.
+
+With this fix the following device mapper testsuite test passes:
+ dmtest run --suite thin-provisioning -n thin_remove_works_after_resize
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-space-map-metadata.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -617,13 +617,23 @@ static int sm_metadata_extend(struct dm_
+ if (r)
+ goto out;
+
+- for (i = old_len; !r && i < smm->begin; i++) {
+- r = sm_ll_inc(&smm->ll, i, &ev);
++ /*
++ * We repeatedly increment then commit until the commit doesn't
++ * allocate any new blocks.
++ */
++ do {
++ for (i = old_len; !r && i < smm->begin; i++) {
++ r = sm_ll_inc(&smm->ll, i, &ev);
++ if (r)
++ goto out;
++ }
++ old_len = smm->begin;
++
++ r = sm_ll_commit(&smm->ll);
+ if (r)
+ goto out;
+- }
+
+- r = sm_metadata_commit(sm);
++ } while (old_len != smm->begin);
+
+ out:
+ /*
--- /dev/null
+From 7e664b3dec431eebf0c5df5ff704d6197634cf35 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Tue, 7 Jan 2014 15:49:02 +0000
+Subject: dm space map metadata: fix extending the space map
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 7e664b3dec431eebf0c5df5ff704d6197634cf35 upstream.
+
+When extending a metadata space map we should do the first commit whilst
+still in bootstrap mode -- a mode where all blocks get allocated in the
+new area.
+
+That way the commit overhead is allocated from the newly added space.
+Otherwise we risk running out of space.
+
+With this fix, and the previous commit "dm space map common: make sure
+new space is used during extend", the following device mapper testsuite
+test passes:
+ dmtest run --suite thin-provisioning -n /resize_metadata_no_io/
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-space-map-metadata.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -608,20 +608,28 @@ static int sm_metadata_extend(struct dm_
+ * Flick into a mode where all blocks get allocated in the new area.
+ */
+ smm->begin = old_len;
+- memcpy(&smm->sm, &bootstrap_ops, sizeof(smm->sm));
++ memcpy(sm, &bootstrap_ops, sizeof(*sm));
+
+ /*
+ * Extend.
+ */
+ r = sm_ll_extend(&smm->ll, extra_blocks);
++ if (r)
++ goto out;
+
++ for (i = old_len; !r && i < smm->begin; i++) {
++ r = sm_ll_inc(&smm->ll, i, &ev);
++ if (r)
++ goto out;
++ }
++
++ r = sm_metadata_commit(sm);
++
++out:
+ /*
+ * Switch back to normal behaviour.
+ */
+- memcpy(&smm->sm, &ops, sizeof(smm->sm));
+- for (i = old_len; !r && i < smm->begin; i++)
+- r = sm_ll_inc(&smm->ll, i, &ev);
+-
++ memcpy(sm, &ops, sizeof(*sm));
+ return r;
+ }
+
--- /dev/null
+From 19fa1a6756ed9e92daa9537c03b47d6b55cc2316 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Tue, 17 Dec 2013 12:09:40 -0500
+Subject: dm thin: fix discard support to a previously shared block
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 19fa1a6756ed9e92daa9537c03b47d6b55cc2316 upstream.
+
+If a snapshot is created and later deleted the origin dm_thin_device's
+snapshotted_time will have been updated to reflect the snapshot's
+creation time. The 'shared' flag in the dm_thin_lookup_result struct
+returned from dm_thin_find_block() is an approximation based on
+snapshotted_time -- this is done to avoid 0(n), or worse, time
+complexity. In this case, the shared flag would be true.
+
+But because the 'shared' flag reflects an approximation a block can be
+incorrectly assumed to be shared (e.g. false positive for 'shared'
+because the snapshot no longer exists). This could result in discards
+issued to a thin device not being passed down to the pool's underlying
+data device.
+
+To fix this we double check that a thin block is really still in-use
+after a mapping is removed using dm_pool_block_is_used(). If the
+reference count for a block is now zero the discard is allowed to be
+passed down.
+
+Also add a 'definitely_not_shared' member to the dm_thin_new_mapping
+structure -- reflects that the 'shared' flag in the response from
+dm_thin_find_block() can only be held as definitive if false is
+returned.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1043527
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin-metadata.c | 20 ++++++++++++++++++++
+ drivers/md/dm-thin-metadata.h | 2 ++
+ drivers/md/dm-thin.c | 14 ++++++++++++--
+ 3 files changed, 34 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -1349,6 +1349,12 @@ dm_thin_id dm_thin_dev_id(struct dm_thin
+ return td->id;
+ }
+
++/*
++ * Check whether @time (of block creation) is older than @td's last snapshot.
++ * If so then the associated block is shared with the last snapshot device.
++ * Any block on a device created *after* the device last got snapshotted is
++ * necessarily not shared.
++ */
+ static bool __snapshotted_since(struct dm_thin_device *td, uint32_t time)
+ {
+ return td->snapshotted_time > time;
+@@ -1457,6 +1463,20 @@ int dm_thin_remove_block(struct dm_thin_
+
+ return r;
+ }
++
++int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result)
++{
++ int r;
++ uint32_t ref_count;
++
++ down_read(&pmd->root_lock);
++ r = dm_sm_get_count(pmd->data_sm, b, &ref_count);
++ if (!r)
++ *result = (ref_count != 0);
++ up_read(&pmd->root_lock);
++
++ return r;
++}
+
+ bool dm_thin_changed_this_transaction(struct dm_thin_device *td)
+ {
+--- a/drivers/md/dm-thin-metadata.h
++++ b/drivers/md/dm-thin-metadata.h
+@@ -181,6 +181,8 @@ int dm_pool_get_data_block_size(struct d
+
+ int dm_pool_get_data_dev_size(struct dm_pool_metadata *pmd, dm_block_t *result);
+
++int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result);
++
+ /*
+ * Returns -ENOSPC if the new size is too small and already allocated
+ * blocks would be lost.
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -512,6 +512,7 @@ struct dm_thin_new_mapping {
+ unsigned quiesced:1;
+ unsigned prepared:1;
+ unsigned pass_discard:1;
++ unsigned definitely_not_shared:1;
+
+ struct thin_c *tc;
+ dm_block_t virt_block;
+@@ -683,7 +684,15 @@ static void process_prepared_discard_pas
+ cell_defer_no_holder(tc, m->cell2);
+
+ if (m->pass_discard)
+- remap_and_issue(tc, m->bio, m->data_block);
++ if (m->definitely_not_shared)
++ remap_and_issue(tc, m->bio, m->data_block);
++ else {
++ bool used = false;
++ if (dm_pool_block_is_used(tc->pool->pmd, m->data_block, &used) || used)
++ bio_endio(m->bio, 0);
++ else
++ remap_and_issue(tc, m->bio, m->data_block);
++ }
+ else
+ bio_endio(m->bio, 0);
+
+@@ -1032,7 +1041,8 @@ static void process_discard(struct thin_
+ */
+ m = get_next_mapping(pool);
+ m->tc = tc;
+- m->pass_discard = (!lookup_result.shared) && pool->pf.discard_passdown;
++ m->pass_discard = pool->pf.discard_passdown;
++ m->definitely_not_shared = !lookup_result.shared;
+ m->virt_block = block;
+ m->data_block = lookup_result.block;
+ m->cell = cell;
--- /dev/null
+From 16961b042db8cc5cf75d782b4255193ad56e1d4f Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Tue, 17 Dec 2013 13:19:11 -0500
+Subject: dm thin: initialize dm_thin_new_mapping returned by get_next_mapping
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 16961b042db8cc5cf75d782b4255193ad56e1d4f upstream.
+
+As additional members are added to the dm_thin_new_mapping structure
+care should be taken to make sure they get initialized before use.
+
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Acked-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -760,13 +760,17 @@ static int ensure_next_mapping(struct po
+
+ static struct dm_thin_new_mapping *get_next_mapping(struct pool *pool)
+ {
+- struct dm_thin_new_mapping *r = pool->next_mapping;
++ struct dm_thin_new_mapping *m = pool->next_mapping;
+
+ BUG_ON(!pool->next_mapping);
+
++ memset(m, 0, sizeof(struct dm_thin_new_mapping));
++ INIT_LIST_HEAD(&m->list);
++ m->bio = NULL;
++
+ pool->next_mapping = NULL;
+
+- return r;
++ return m;
+ }
+
+ static void schedule_copy(struct thin_c *tc, dm_block_t virt_block,
+@@ -778,15 +782,10 @@ static void schedule_copy(struct thin_c
+ struct pool *pool = tc->pool;
+ struct dm_thin_new_mapping *m = get_next_mapping(pool);
+
+- INIT_LIST_HEAD(&m->list);
+- m->quiesced = 0;
+- m->prepared = 0;
+ m->tc = tc;
+ m->virt_block = virt_block;
+ m->data_block = data_dest;
+ m->cell = cell;
+- m->err = 0;
+- m->bio = NULL;
+
+ if (!dm_deferred_set_add_work(pool->shared_read_ds, &m->list))
+ m->quiesced = 1;
+@@ -849,15 +848,12 @@ static void schedule_zero(struct thin_c
+ struct pool *pool = tc->pool;
+ struct dm_thin_new_mapping *m = get_next_mapping(pool);
+
+- INIT_LIST_HEAD(&m->list);
+ m->quiesced = 1;
+ m->prepared = 0;
+ m->tc = tc;
+ m->virt_block = virt_block;
+ m->data_block = data_block;
+ m->cell = cell;
+- m->err = 0;
+- m->bio = NULL;
+
+ /*
+ * If the whole block of data is being overwritten or we are not
+@@ -1047,7 +1043,6 @@ static void process_discard(struct thin_
+ m->data_block = lookup_result.block;
+ m->cell = cell;
+ m->cell2 = cell2;
+- m->err = 0;
+ m->bio = bio;
+
+ if (!dm_deferred_set_add_work(pool->all_io_ds, &m->list)) {
--- /dev/null
+From be35f486108227e10fe5d96fd42fb2b344c59983 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 6 Jan 2014 23:01:22 -0500
+Subject: dm: wait until embedded kobject is released before destroying a device
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit be35f486108227e10fe5d96fd42fb2b344c59983 upstream.
+
+There may be other parts of the kernel holding a reference on the dm
+kobject. We must wait until all references are dropped before
+deallocating the mapped_device structure.
+
+The dm_kobject_release method signals that all references are dropped
+via completion. But dm_kobject_release doesn't free the kobject (which
+is embedded in the mapped_device structure).
+
+This is the sequence of operations:
+* when destroying a DM device, call kobject_put from dm_sysfs_exit
+* wait until all users stop using the kobject, when it happens the
+ release method is called
+* the release method signals the completion and should return without
+ delay
+* the dm device removal code that waits on the completion continues
+* the dm device removal code drops the dm_mod reference the device had
+* the dm device removal code frees the mapped_device structure that
+ contains the kobject
+
+Using kobject this way should avoid the module unload race that was
+mentioned at the beginning of this thread:
+https://lkml.org/lkml/2014/1/4/83
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-sysfs.c | 10 +++++++++-
+ drivers/md/dm.c | 11 +++++++++++
+ drivers/md/dm.h | 2 ++
+ 3 files changed, 22 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-sysfs.c
++++ b/drivers/md/dm-sysfs.c
+@@ -79,6 +79,11 @@ static const struct sysfs_ops dm_sysfs_o
+ .show = dm_attr_show,
+ };
+
++static void dm_kobject_release(struct kobject *kobj)
++{
++ complete(dm_get_completion_from_kobject(kobj));
++}
++
+ /*
+ * dm kobject is embedded in mapped_device structure
+ * no need to define release function here
+@@ -86,6 +91,7 @@ static const struct sysfs_ops dm_sysfs_o
+ static struct kobj_type dm_ktype = {
+ .sysfs_ops = &dm_sysfs_ops,
+ .default_attrs = dm_attrs,
++ .release = dm_kobject_release,
+ };
+
+ /*
+@@ -104,5 +110,7 @@ int dm_sysfs_init(struct mapped_device *
+ */
+ void dm_sysfs_exit(struct mapped_device *md)
+ {
+- kobject_put(dm_kobject(md));
++ struct kobject *kobj = dm_kobject(md);
++ kobject_put(kobj);
++ wait_for_completion(dm_get_completion_from_kobject(kobj));
+ }
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -187,6 +187,9 @@ struct mapped_device {
+ /* sysfs handle */
+ struct kobject kobj;
+
++ /* wait until the kobject is released */
++ struct completion kobj_completion;
++
+ /* zero-length flush that will be cloned and submitted to targets */
+ struct bio flush_bio;
+ };
+@@ -1904,6 +1907,7 @@ static struct mapped_device *alloc_dev(i
+ init_waitqueue_head(&md->wait);
+ INIT_WORK(&md->work, dm_wq_work);
+ init_waitqueue_head(&md->eventq);
++ init_completion(&md->kobj_completion);
+
+ md->disk->major = _major;
+ md->disk->first_minor = minor;
+@@ -2758,6 +2762,13 @@ struct mapped_device *dm_get_from_kobjec
+ return md;
+ }
+
++struct completion *dm_get_completion_from_kobject(struct kobject *kobj)
++{
++ struct mapped_device *md = container_of(kobj, struct mapped_device, kobj);
++
++ return &md->kobj_completion;
++}
++
+ int dm_suspended_md(struct mapped_device *md)
+ {
+ return test_bit(DMF_SUSPENDED, &md->flags);
+--- a/drivers/md/dm.h
++++ b/drivers/md/dm.h
+@@ -15,6 +15,7 @@
+ #include <linux/list.h>
+ #include <linux/blkdev.h>
+ #include <linux/hdreg.h>
++#include <linux/completion.h>
+
+ /*
+ * Suspend feature flags
+@@ -129,6 +130,7 @@ int dm_sysfs_init(struct mapped_device *
+ void dm_sysfs_exit(struct mapped_device *md);
+ struct kobject *dm_kobject(struct mapped_device *md);
+ struct mapped_device *dm_get_from_kobject(struct kobject *kobj);
++struct completion *dm_get_completion_from_kobject(struct kobject *kobj);
+
+ /*
+ * Targets for linear and striped mappings
nfs4-fix-discover_server_trunking-use-after-free.patch
pnfs-proper-delay-for-nfs4err_recallconflict-in-layout_get_done.patch
sunrpc-fix-infinite-loop-in-rpc-state-machine.patch
+dm-thin-fix-discard-support-to-a-previously-shared-block.patch
+dm-thin-initialize-dm_thin_new_mapping-returned-by-get_next_mapping.patch
+dm-wait-until-embedded-kobject-is-released-before-destroying-a-device.patch
+dm-space-map-common-make-sure-new-space-is-used-during-extend.patch
+dm-space-map-metadata-fix-extending-the-space-map.patch
+dm-space-map-metadata-fix-bug-in-resizing-of-thin-metadata.patch