64 files changed, 1287 insertions, 910 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 545633d6663d..ca6f5f7a4752 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -8364,6 +8364,7 @@ F:	drivers/media/dvb-frontends/mn88473*
 MODULE SUPPORT
 M:      Jessica Yu <jeyu@redhat.com>
 M:      Rusty Russell <rusty@rustcorp.com.au>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux.git modules-next
 S:      Maintained
 F:      include/linux/module.h
 F:      kernel/module.c
@@ -9996,6 +9997,14 @@ S:	Supported
 F:      Documentation/preempt-locking.txt
 F:      include/linux/preempt.h
 
+PRINTK
+M:      Petr Mladek <pmladek@suse.com>
+M:      Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+R:      Steven Rostedt <rostedt@goodmis.org>
+S:      Maintained
+F:      kernel/printk/
+F:      include/linux/printk.h
+
 PRISM54 WIRELESS DRIVER
 M:      "Luis R. Rodriguez" <mcgrof@gmail.com>
 L:      linux-wireless@vger.kernel.org
diff --git a/fs/dax.c b/fs/dax.c
index e9cf8b4cd234..99b5b4458a78 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -1079,7 +1079,7 @@ dax_iomap_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
  */
 ssize_t
 dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
-                struct iomap_ops *ops)
+                const struct iomap_ops *ops)
 {
         struct address_space *mapping = iocb->ki_filp->f_mapping;
         struct inode *inode = mapping->host;
@@ -1127,7 +1127,7 @@ static int dax_fault_return(int error)
  * necessary locking for the page fault to proceed successfully.
  */
 int dax_iomap_fault(struct vm_area_struct *vma, struct vm_fault *vmf,
-                        struct iomap_ops *ops)
+                        const struct iomap_ops *ops)
 {
         struct address_space *mapping = vma->vm_file->f_mapping;
         struct inode *inode = mapping->host;
@@ -1326,7 +1326,7 @@ static int dax_pmd_load_hole(struct vm_area_struct *vma, pmd_t *pmd,
 }
 
 int dax_iomap_pmd_fault(struct vm_area_struct *vma, unsigned long address,
-                pmd_t *pmd, unsigned int flags, struct iomap_ops *ops)
+                pmd_t *pmd, unsigned int flags, const struct iomap_ops *ops)
 {
         struct address_space *mapping = vma->vm_file->f_mapping;
         unsigned long pmd_addr = address & PMD_MASK;
diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h
index 37e2be784ac7..5e64de9c5093 100644
--- a/fs/ext2/ext2.h
+++ b/fs/ext2/ext2.h
@@ -814,7 +814,7 @@ extern const struct file_operations ext2_file_operations;
 /* inode.c */
 extern const struct address_space_operations ext2_aops;
 extern const struct address_space_operations ext2_nobh_aops;
-extern struct iomap_ops ext2_iomap_ops;
+extern const struct iomap_ops ext2_iomap_ops;
 
 /* namei.c */
 extern const struct inode_operations ext2_dir_inode_operations;
diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
index f073bfca694b..128cce540645 100644
--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -842,13 +842,13 @@ ext2_iomap_end(struct inode *inode, loff_t offset, loff_t length,
         return 0;
 }
 
-struct iomap_ops ext2_iomap_ops = {
+const struct iomap_ops ext2_iomap_ops = {
         .iomap_begin            = ext2_iomap_begin,
         .iomap_end              = ext2_iomap_end,
 };
 #else
 /* Define empty ops for !CONFIG_FS_DAX case to avoid ugly ifdefs */
-struct iomap_ops ext2_iomap_ops;
+const struct iomap_ops ext2_iomap_ops;
 #endif /* CONFIG_FS_DAX */
 
 int ext2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 01d52b98f9a7..cee23b684f47 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -3244,7 +3244,7 @@ static inline void ext4_clear_io_unwritten_flag(ext4_io_end_t *io_end)
         }
 }
 
-extern struct iomap_ops ext4_iomap_ops;
+extern const struct iomap_ops ext4_iomap_ops;
 
 #endif  /* __KERNEL__ */
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index f622d4a577e3..75212a6e69f8 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3450,7 +3450,7 @@ orphan_del:
         return ret;
 }
 
-struct iomap_ops ext4_iomap_ops = {
+const struct iomap_ops ext4_iomap_ops = {
         .iomap_begin            = ext4_iomap_begin,
         .iomap_end              = ext4_iomap_end,
 };
diff --git a/fs/internal.h b/fs/internal.h
index b63cf3af2dc2..11c6d89dce9c 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -182,7 +182,7 @@ typedef loff_t (*iomap_actor_t)(struct inode *inode, loff_t pos, loff_t len,
                 void *data, struct iomap *iomap);
 
 loff_t iomap_apply(struct inode *inode, loff_t pos, loff_t length,
-                unsigned flags, struct iomap_ops *ops, void *data,
+                unsigned flags, const struct iomap_ops *ops, void *data,
                 iomap_actor_t actor);
 
 /* direct-io.c: */
diff --git a/fs/iomap.c b/fs/iomap.c
index a51cb4c07d4d..d89f70bbb952 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -41,7 +41,7 @@
  */
 loff_t
 iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags,
-                struct iomap_ops *ops, void *data, iomap_actor_t actor)
+                const struct iomap_ops *ops, void *data, iomap_actor_t actor)
 {
         struct iomap iomap = { 0 };
         loff_t written = 0, ret;
@@ -235,7 +235,7 @@ again:
 
 ssize_t
 iomap_file_buffered_write(struct kiocb *iocb, struct iov_iter *iter,
-                struct iomap_ops *ops)
+                const struct iomap_ops *ops)
 {
         struct inode *inode = iocb->ki_filp->f_mapping->host;
         loff_t pos = iocb->ki_pos, ret = 0, written = 0;
@@ -318,7 +318,7 @@ iomap_dirty_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
 
 int
 iomap_file_dirty(struct inode *inode, loff_t pos, loff_t len,
-                struct iomap_ops *ops)
+                const struct iomap_ops *ops)
 {
         loff_t ret;
 
@@ -398,7 +398,7 @@ iomap_zero_range_actor(struct inode *inode, loff_t pos, loff_t count,
 
 int
 iomap_zero_range(struct inode *inode, loff_t pos, loff_t len, bool *did_zero,
-                struct iomap_ops *ops)
+                const struct iomap_ops *ops)
 {
         loff_t ret;
 
@@ -418,7 +418,7 @@ EXPORT_SYMBOL_GPL(iomap_zero_range);
 
 int
 iomap_truncate_page(struct inode *inode, loff_t pos, bool *did_zero,
-                struct iomap_ops *ops)
+                const struct iomap_ops *ops)
 {
         unsigned blocksize = (1 << inode->i_blkbits);
         unsigned off = pos & (blocksize - 1);
@@ -446,7 +446,7 @@ iomap_page_mkwrite_actor(struct inode *inode, loff_t pos, loff_t length,
 }
 
 int iomap_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf,
-                struct iomap_ops *ops)
+                const struct iomap_ops *ops)
 {
         struct page *page = vmf->page;
         struct inode *inode = file_inode(vma->vm_file);
@@ -545,7 +545,7 @@ iomap_fiemap_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
 }
 
 int iomap_fiemap(struct inode *inode, struct fiemap_extent_info *fi,
-                loff_t start, loff_t len, struct iomap_ops *ops)
+                loff_t start, loff_t len, const struct iomap_ops *ops)
 {
         struct fiemap_ctx ctx;
         loff_t ret;
@@ -839,8 +839,8 @@ iomap_dio_actor(struct inode *inode, loff_t pos, loff_t length,
 }
 
 ssize_t
-iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, struct iomap_ops *ops,
-                iomap_dio_end_io_t end_io)
+iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
+                const struct iomap_ops *ops, iomap_dio_end_io_t end_io)
 {
         struct address_space *mapping = iocb->ki_filp->f_mapping;
         struct inode *inode = file_inode(iocb->ki_filp);
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index 9f06a211e157..369adcc18c02 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -221,20 +221,22 @@ xfs_alloc_get_rec(
  * Compute aligned version of the found extent.
  * Takes alignment and min length into account.
  */
-STATIC void
+STATIC bool
 xfs_alloc_compute_aligned(
         xfs_alloc_arg_t *args,          /* allocation argument structure */
         xfs_agblock_t   foundbno,       /* starting block in found extent */
         xfs_extlen_t    foundlen,       /* length in found extent */
         xfs_agblock_t   *resbno,        /* result block number */
-        xfs_extlen_t    *reslen)        /* result length */
+        xfs_extlen_t    *reslen,        /* result length */
+        unsigned        *busy_gen)
 {
-        xfs_agblock_t   bno;
-        xfs_extlen_t    len;
+        xfs_agblock_t   bno = foundbno;
+        xfs_extlen_t    len = foundlen;
         xfs_extlen_t    diff;
+        bool            busy;
 
         /* Trim busy sections out of found extent */
-        xfs_extent_busy_trim(args, foundbno, foundlen, &bno, &len);
+        busy = xfs_extent_busy_trim(args, &bno, &len, busy_gen);
 
         /*
          * If we have a largish extent that happens to start before min_agbno,
@@ -259,6 +261,8 @@ xfs_alloc_compute_aligned(
                 *resbno = bno;
                 *reslen = len;
         }
+
+        return busy;
 }
 
 /*
@@ -737,10 +741,11 @@ xfs_alloc_ag_vextent_exact(
         int             error;
         xfs_agblock_t   fbno;   /* start block of found extent */
         xfs_extlen_t    flen;   /* length of found extent */
-        xfs_agblock_t   tbno;   /* start block of trimmed extent */
-        xfs_extlen_t    tlen;   /* length of trimmed extent */
-        xfs_agblock_t   tend;   /* end block of trimmed extent */
+        xfs_agblock_t   tbno;   /* start block of busy extent */
+        xfs_extlen_t    tlen;   /* length of busy extent */
+        xfs_agblock_t   tend;   /* end block of busy extent */
         int             i;      /* success/failure of operation */
+        unsigned        busy_gen;
 
         ASSERT(args->alignment == 1);
 
@@ -773,7 +778,9 @@ xfs_alloc_ag_vextent_exact(
         /*
          * Check for overlapping busy extents.
          */
-        xfs_extent_busy_trim(args, fbno, flen, &tbno, &tlen);
+        tbno = fbno;
+        tlen = flen;
+        xfs_extent_busy_trim(args, &tbno, &tlen, &busy_gen);
 
         /*
          * Give up if the start of the extent is busy, or the freespace isn't
@@ -853,6 +860,7 @@ xfs_alloc_find_best_extent(
         xfs_agblock_t           sdiff;
         int                     error;
         int                     i;
+        unsigned                busy_gen;
 
         /* The good extent is perfect, no need to  search. */
         if (!gdiff)
@@ -866,7 +874,8 @@ xfs_alloc_find_best_extent(
                 if (error)
                         goto error0;
                 XFS_WANT_CORRUPTED_GOTO(args->mp, i == 1, error0);
-                xfs_alloc_compute_aligned(args, *sbno, *slen, sbnoa, slena);
+                xfs_alloc_compute_aligned(args, *sbno, *slen,
+                                sbnoa, slena, &busy_gen);
 
                 /*
                  * The good extent is closer than this one.
@@ -955,7 +964,8 @@ xfs_alloc_ag_vextent_near(
         xfs_extlen_t    ltlena;         /* aligned ... */
         xfs_agblock_t   ltnew;          /* useful start bno of left side */
         xfs_extlen_t    rlen;           /* length of returned extent */
-        int             forced = 0;
+        bool            busy;
+        unsigned        busy_gen;
 #ifdef DEBUG
         /*
          * Randomly don't execute the first algorithm.
@@ -982,6 +992,7 @@ restart:
         ltlen = 0;
         gtlena = 0;
         ltlena = 0;
+        busy = false;
 
         /*
          * Get a cursor for the by-size btree.
@@ -1064,8 +1075,8 @@ restart:
                         if ((error = xfs_alloc_get_rec(cnt_cur, &ltbno, &ltlen, &i)))
                                 goto error0;
                         XFS_WANT_CORRUPTED_GOTO(args->mp, i == 1, error0);
-                        xfs_alloc_compute_aligned(args, ltbno, ltlen,
-                                                  &ltbnoa, &ltlena);
+                        busy = xfs_alloc_compute_aligned(args, ltbno, ltlen,
+                                        &ltbnoa, &ltlena, &busy_gen);
                         if (ltlena < args->minlen)
                                 continue;
                         if (ltbnoa < args->min_agbno || ltbnoa > args->max_agbno)
@@ -1183,8 +1194,8 @@ restart:
                         if ((error = xfs_alloc_get_rec(bno_cur_lt, &ltbno, &ltlen, &i)))
                                 goto error0;
                         XFS_WANT_CORRUPTED_GOTO(args->mp, i == 1, error0);
-                        xfs_alloc_compute_aligned(args, ltbno, ltlen,
-                                                  &ltbnoa, &ltlena);
+                        busy |= xfs_alloc_compute_aligned(args, ltbno, ltlen,
+                                        &ltbnoa, &ltlena, &busy_gen);
                         if (ltlena >= args->minlen && ltbnoa >= args->min_agbno)
                                 break;
                         if ((error = xfs_btree_decrement(bno_cur_lt, 0, &i)))
@@ -1199,8 +1210,8 @@ restart:
                         if ((error = xfs_alloc_get_rec(bno_cur_gt, &gtbno, &gtlen, &i)))
                                 goto error0;
                         XFS_WANT_CORRUPTED_GOTO(args->mp, i == 1, error0);
-                        xfs_alloc_compute_aligned(args, gtbno, gtlen,
-                                                  &gtbnoa, &gtlena);
+                        busy |= xfs_alloc_compute_aligned(args, gtbno, gtlen,
+                                        &gtbnoa, &gtlena, &busy_gen);
                         if (gtlena >= args->minlen && gtbnoa <= args->max_agbno)
                                 break;
                         if ((error = xfs_btree_increment(bno_cur_gt, 0, &i)))
@@ -1261,9 +1272,9 @@ restart:
         if (bno_cur_lt == NULL && bno_cur_gt == NULL) {
                 xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
 
-                if (!forced++) {
+                if (busy) {
                         trace_xfs_alloc_near_busy(args);
-                        xfs_log_force(args->mp, XFS_LOG_SYNC);
+                        xfs_extent_busy_flush(args->mp, args->pag, busy_gen);
                         goto restart;
                 }
                 trace_xfs_alloc_size_neither(args);
@@ -1344,7 +1355,8 @@ xfs_alloc_ag_vextent_size(
         int             i;              /* temp status variable */
         xfs_agblock_t   rbno;           /* returned block number */
         xfs_extlen_t    rlen;           /* length of returned extent */
-        int             forced = 0;
+        bool            busy;
+        unsigned        busy_gen;
 
 restart:
         /*
@@ -1353,6 +1365,7 @@ restart:
         cnt_cur = xfs_allocbt_init_cursor(args->mp, args->tp, args->agbp,
                 args->agno, XFS_BTNUM_CNT);
         bno_cur = NULL;
+        busy = false;
 
         /*
          * Look for an entry >= maxlen+alignment-1 blocks.
@@ -1362,14 +1375,13 @@ restart:
                 goto error0;
 
         /*
-         * If none or we have busy extents that we cannot allocate from, then
-         * we have to settle for a smaller extent. In the case that there are
-         * no large extents, this will return the last entry in the tree unless
-         * the tree is empty. In the case that there are only busy large
-         * extents, this will return the largest small extent unless there
+         * If none then we have to settle for a smaller extent. In the case that
+         * there are no large extents, this will return the last entry in the
+         * tree unless the tree is empty. In the case that there are only busy
+         * large extents, this will return the largest small extent unless there
          * are no smaller extents available.
          */
-        if (!i || forced > 1) {
+        if (!i) {
                 error = xfs_alloc_ag_vextent_small(args, cnt_cur,
                                                    &fbno, &flen, &i);
                 if (error)
@@ -1380,13 +1392,11 @@ restart:
                         return 0;
                 }
                 ASSERT(i == 1);
-                xfs_alloc_compute_aligned(args, fbno, flen, &rbno, &rlen);
+                busy = xfs_alloc_compute_aligned(args, fbno, flen, &rbno,
+                                &rlen, &busy_gen);
         } else {
                 /*
                  * Search for a non-busy extent that is large enough.
-                 * If we are at low space, don't check, or if we fall of
-                 * the end of the btree, turn off the busy check and
-                 * restart.
                  */
                 for (;;) {
                         error = xfs_alloc_get_rec(cnt_cur, &fbno, &flen, &i);
@@ -1394,8 +1404,8 @@ restart:
                                 goto error0;
                         XFS_WANT_CORRUPTED_GOTO(args->mp, i == 1, error0);
 
-                        xfs_alloc_compute_aligned(args, fbno, flen,
-                                                  &rbno, &rlen);
+                        busy = xfs_alloc_compute_aligned(args, fbno, flen,
+                                        &rbno, &rlen, &busy_gen);
 
                         if (rlen >= args->maxlen)
                                 break;
@@ -1407,18 +1417,13 @@ restart:
                                 /*
                                  * Our only valid extents must have been busy.
                                  * Make it unbusy by forcing the log out and
-                                 * retrying. If we've been here before, forcing
-                                 * the log isn't making the extents available,
-                                 * which means they have probably been freed in
-                                 * this transaction.  In that case, we have to
-                                 * give up on them and we'll attempt a minlen
-                                 * allocation the next time around.
+                                 * retrying.
                                  */
                                 xfs_btree_del_cursor(cnt_cur,
                                                      XFS_BTREE_NOERROR);
                                 trace_xfs_alloc_size_busy(args);
-                                if (!forced++)
-                                        xfs_log_force(args->mp, XFS_LOG_SYNC);
+                                xfs_extent_busy_flush(args->mp,
+                                                        args->pag, busy_gen);
                                 goto restart;
                         }
                 }
@@ -1454,8 +1459,8 @@ restart:
                         XFS_WANT_CORRUPTED_GOTO(args->mp, i == 1, error0);
                         if (flen < bestrlen)
                                 break;
-                        xfs_alloc_compute_aligned(args, fbno, flen,
-                                                  &rbno, &rlen);
+                        busy = xfs_alloc_compute_aligned(args, fbno, flen,
+                                        &rbno, &rlen, &busy_gen);
                         rlen = XFS_EXTLEN_MIN(args->maxlen, rlen);
                         XFS_WANT_CORRUPTED_GOTO(args->mp, rlen == 0 ||
                                 (rlen <= flen && rbno + rlen <= fbno + flen),
@@ -1484,10 +1489,10 @@ restart:
          */
         args->len = rlen;
         if (rlen < args->minlen) {
-                if (!forced++) {
+                if (busy) {
                         xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
                         trace_xfs_alloc_size_busy(args);
-                        xfs_log_force(args->mp, XFS_LOG_SYNC);
+                        xfs_extent_busy_flush(args->mp, args->pag, busy_gen);
                         goto restart;
                 }
                 goto out_nominleft;
@@ -2659,21 +2664,11 @@ xfs_alloc_vextent(
                 args->agbno = XFS_FSB_TO_AGBNO(mp, args->fsbno);
                 args->type = XFS_ALLOCTYPE_NEAR_BNO;
                 /* FALLTHROUGH */
-        case XFS_ALLOCTYPE_ANY_AG:
-        case XFS_ALLOCTYPE_START_AG:
         case XFS_ALLOCTYPE_FIRST_AG:
                 /*
                  * Rotate through the allocation groups looking for a winner.
                  */
-                if (type == XFS_ALLOCTYPE_ANY_AG) {
-                        /*
-                         * Start with the last place we left off.
-                         */
-                        args->agno = sagno = (mp->m_agfrotor / rotorstep) %
-                                        mp->m_sb.sb_agcount;
-                        args->type = XFS_ALLOCTYPE_THIS_AG;
-                        flags = XFS_ALLOC_FLAG_TRYLOCK;
-                } else if (type == XFS_ALLOCTYPE_FIRST_AG) {
+                if (type == XFS_ALLOCTYPE_FIRST_AG) {
                         /*
                          * Start with allocation group given by bno.
                          */
@@ -2682,8 +2677,6 @@ xfs_alloc_vextent(
                         sagno = 0;
                         flags = 0;
                 } else {
-                        if (type == XFS_ALLOCTYPE_START_AG)
-                                args->type = XFS_ALLOCTYPE_THIS_AG;
                         /*
                          * Start with the given allocation group.
                          */
@@ -2751,7 +2744,7 @@ xfs_alloc_vextent(
                         }
                         xfs_perag_put(args->pag);
                 }
-                if (bump_rotor || (type == XFS_ALLOCTYPE_ANY_AG)) {
+                if (bump_rotor) {
                         if (args->agno == sagno)
                                 mp->m_agfrotor = (mp->m_agfrotor + 1) %
                                         (mp->m_sb.sb_agcount * rotorstep);
diff --git a/fs/xfs/libxfs/xfs_alloc.h b/fs/xfs/libxfs/xfs_alloc.h
index 1d0f48a501a3..2a8d0fa6fbbe 100644
--- a/fs/xfs/libxfs/xfs_alloc.h
+++ b/fs/xfs/libxfs/xfs_alloc.h
@@ -29,9 +29,7 @@ extern struct workqueue_struct *xfs_alloc_wq;
 /*
  * Freespace allocation types.  Argument to xfs_alloc_[v]extent.
  */
-#define XFS_ALLOCTYPE_ANY_AG    0x01    /* allocate anywhere, use rotor */
 #define XFS_ALLOCTYPE_FIRST_AG  0x02    /* ... start at ag 0 */
-#define XFS_ALLOCTYPE_START_AG  0x04    /* anywhere, start in this a.g. */
 #define XFS_ALLOCTYPE_THIS_AG   0x08    /* anywhere in this a.g. */
 #define XFS_ALLOCTYPE_START_BNO 0x10    /* near this block else anywhere */
 #define XFS_ALLOCTYPE_NEAR_BNO  0x20    /* in this a.g. and near this block */
@@ -41,9 +39,7 @@ extern struct workqueue_struct *xfs_alloc_wq;
 typedef unsigned int xfs_alloctype_t;
 
 #define XFS_ALLOC_TYPES \
-        { XFS_ALLOCTYPE_ANY_AG,         "ANY_AG" }, \
         { XFS_ALLOCTYPE_FIRST_AG,       "FIRST_AG" }, \
-        { XFS_ALLOCTYPE_START_AG,       "START_AG" }, \
         { XFS_ALLOCTYPE_THIS_AG,        "THIS_AG" }, \
         { XFS_ALLOCTYPE_START_BNO,      "START_BNO" }, \
         { XFS_ALLOCTYPE_NEAR_BNO,       "NEAR_BNO" }, \
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index bfc00de5c6f1..a9c66d47757a 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -740,15 +740,9 @@ xfs_bmap_extents_to_btree(
          * Fill in the root.
          */
         block = ifp->if_broot;
-        if (xfs_sb_version_hascrc(&mp->m_sb))
-                xfs_btree_init_block_int(mp, block, XFS_BUF_DADDR_NULL,
-                                 XFS_BMAP_CRC_MAGIC, 1, 1, ip->i_ino,
-                                 XFS_BTREE_LONG_PTRS | XFS_BTREE_CRC_BLOCKS);
-        else
-                xfs_btree_init_block_int(mp, block, XFS_BUF_DADDR_NULL,
-                                 XFS_BMAP_MAGIC, 1, 1, ip->i_ino,
+        xfs_btree_init_block_int(mp, block, XFS_BUF_DADDR_NULL,
+                                 XFS_BTNUM_BMAP, 1, 1, ip->i_ino,
                                  XFS_BTREE_LONG_PTRS);
-
         /*
          * Need a cursor.  Can't allocate until bb_level is filled in.
          */
@@ -804,9 +798,7 @@ try_another_ag:
          */
         ASSERT(args.fsbno != NULLFSBLOCK);
         ASSERT(*firstblock == NULLFSBLOCK ||
-               args.agno == XFS_FSB_TO_AGNO(mp, *firstblock) ||
-               (dfops->dop_low &&
-                args.agno > XFS_FSB_TO_AGNO(mp, *firstblock)));
+               args.agno >= XFS_FSB_TO_AGNO(mp, *firstblock));
         *firstblock = cur->bc_private.b.firstblock = args.fsbno;
         cur->bc_private.b.allocated++;
         ip->i_d.di_nblocks++;
@@ -817,13 +809,8 @@ try_another_ag:
          */
         abp->b_ops = &xfs_bmbt_buf_ops;
         ablock = XFS_BUF_TO_BLOCK(abp);
-        if (xfs_sb_version_hascrc(&mp->m_sb))
-                xfs_btree_init_block_int(mp, ablock, abp->b_bn,
-                                XFS_BMAP_CRC_MAGIC, 0, 0, ip->i_ino,
-                                XFS_BTREE_LONG_PTRS | XFS_BTREE_CRC_BLOCKS);
-        else
-                xfs_btree_init_block_int(mp, ablock, abp->b_bn,
-                                XFS_BMAP_MAGIC, 0, 0, ip->i_ino,
+        xfs_btree_init_block_int(mp, ablock, abp->b_bn,
+                                XFS_BTNUM_BMAP, 0, 0, ip->i_ino,
                                 XFS_BTREE_LONG_PTRS);
 
         arp = XFS_BMBT_REC_ADDR(mp, ablock, 1);
@@ -1278,7 +1265,6 @@ xfs_bmap_read_extents(
         /* REFERENCED */
         xfs_extnum_t            room;   /* number of entries there's room for */
 
-        bno = NULLFSBLOCK;
         mp = ip->i_mount;
         ifp = XFS_IFORK_PTR(ip, whichfork);
         exntf = (whichfork != XFS_DATA_FORK) ? XFS_EXTFMT_NOSTATE :
@@ -1291,9 +1277,7 @@ xfs_bmap_read_extents(
         ASSERT(level > 0);
         pp = XFS_BMAP_BROOT_PTR_ADDR(mp, block, 1, ifp->if_broot_bytes);
         bno = be64_to_cpu(*pp);
-        ASSERT(bno != NULLFSBLOCK);
-        ASSERT(XFS_FSB_TO_AGNO(mp, bno) < mp->m_sb.sb_agcount);
-        ASSERT(XFS_FSB_TO_AGBNO(mp, bno) < mp->m_sb.sb_agblocks);
+
         /*
          * Go down the tree until leaf level is reached, following the first
          * pointer (leftmost) at each level.
@@ -1864,6 +1848,7 @@ xfs_bmap_add_extent_delay_real(
                  */
                 trace_xfs_bmap_pre_update(bma->ip, bma->idx, state, _THIS_IP_);
                 xfs_bmbt_set_startblock(ep, new->br_startblock);
+                xfs_bmbt_set_state(ep, new->br_state);
                 trace_xfs_bmap_post_update(bma->ip, bma->idx, state, _THIS_IP_);
 
                 (*nextents)++;
@@ -2202,6 +2187,7 @@ STATIC int				/* error */
 xfs_bmap_add_extent_unwritten_real(
         struct xfs_trans        *tp,
         xfs_inode_t             *ip,    /* incore inode pointer */
+        int                     whichfork,
         xfs_extnum_t            *idx,   /* extent number to update/insert */
         xfs_btree_cur_t         **curp, /* if *curp is null, not a btree */
         xfs_bmbt_irec_t         *new,   /* new data to add to file extents */
@@ -2221,12 +2207,14 @@ xfs_bmap_add_extent_unwritten_real(
                                         /* left is 0, right is 1, prev is 2 */
         int                     rval=0; /* return value (logging flags) */
         int                     state = 0;/* state bits, accessed thru macros */
-        struct xfs_mount        *mp = tp->t_mountp;
+        struct xfs_mount        *mp = ip->i_mount;
 
         *logflagsp = 0;
 
         cur = *curp;
-        ifp = XFS_IFORK_PTR(ip, XFS_DATA_FORK);
+        ifp = XFS_IFORK_PTR(ip, whichfork);
+        if (whichfork == XFS_COW_FORK)
+                state |= BMAP_COWFORK;
 
         ASSERT(*idx >= 0);
         ASSERT(*idx <= xfs_iext_count(ifp));
@@ -2285,7 +2273,7 @@ xfs_bmap_add_extent_unwritten_real(
          * Don't set contiguous if the combined extent would be too large.
          * Also check for all-three-contiguous being too large.
          */
-        if (*idx < xfs_iext_count(&ip->i_df) - 1) {
+        if (*idx < xfs_iext_count(ifp) - 1) {
                 state |= BMAP_RIGHT_VALID;
                 xfs_bmbt_get_all(xfs_iext_get_ext(ifp, *idx + 1), &RIGHT);
                 if (isnullstartblock(RIGHT.br_startblock))
@@ -2325,7 +2313,8 @@ xfs_bmap_add_extent_unwritten_real(
                 trace_xfs_bmap_post_update(ip, *idx, state, _THIS_IP_);
 
                 xfs_iext_remove(ip, *idx + 1, 2, state);
-                ip->i_d.di_nextents -= 2;
+                XFS_IFORK_NEXT_SET(ip, whichfork,
+                                XFS_IFORK_NEXTENTS(ip, whichfork) - 2);
                 if (cur == NULL)
                         rval = XFS_ILOG_CORE | XFS_ILOG_DEXT;
                 else {
@@ -2368,7 +2357,8 @@ xfs_bmap_add_extent_unwritten_real(
                 trace_xfs_bmap_post_update(ip, *idx, state, _THIS_IP_);
 
                 xfs_iext_remove(ip, *idx + 1, 1, state);
-                ip->i_d.di_nextents--;
+                XFS_IFORK_NEXT_SET(ip, whichfork,
+                                XFS_IFORK_NEXTENTS(ip, whichfork) - 1);
                 if (cur == NULL)
                         rval = XFS_ILOG_CORE | XFS_ILOG_DEXT;
                 else {
@@ -2403,7 +2393,8 @@ xfs_bmap_add_extent_unwritten_real(
                 xfs_bmbt_set_state(ep, newext);
                 trace_xfs_bmap_post_update(ip, *idx, state, _THIS_IP_);
                 xfs_iext_remove(ip, *idx + 1, 1, state);
-                ip->i_d.di_nextents--;
+                XFS_IFORK_NEXT_SET(ip, whichfork,
+                                XFS_IFORK_NEXTENTS(ip, whichfork) - 1);
                 if (cur == NULL)
                         rval = XFS_ILOG_CORE | XFS_ILOG_DEXT;
                 else {
@@ -2515,7 +2506,8 @@ xfs_bmap_add_extent_unwritten_real(
                 trace_xfs_bmap_post_update(ip, *idx, state, _THIS_IP_);
 
                 xfs_iext_insert(ip, *idx, 1, new, state);
-                ip->i_d.di_nextents++;
+                XFS_IFORK_NEXT_SET(ip, whichfork,
+                                XFS_IFORK_NEXTENTS(ip, whichfork) + 1);
                 if (cur == NULL)
                         rval = XFS_ILOG_CORE | XFS_ILOG_DEXT;
                 else {
@@ -2593,7 +2585,8 @@ xfs_bmap_add_extent_unwritten_real(
                 ++*idx;
                 xfs_iext_insert(ip, *idx, 1, new, state);
 
-                ip->i_d.di_nextents++;
+                XFS_IFORK_NEXT_SET(ip, whichfork,
+                                XFS_IFORK_NEXTENTS(ip, whichfork) + 1);
                 if (cur == NULL)
                         rval = XFS_ILOG_CORE | XFS_ILOG_DEXT;
                 else {
@@ -2641,7 +2634,8 @@ xfs_bmap_add_extent_unwritten_real(
                 ++*idx;
                 xfs_iext_insert(ip, *idx, 2, &r[0], state);
 
-                ip->i_d.di_nextents += 2;
+                XFS_IFORK_NEXT_SET(ip, whichfork,
+                                XFS_IFORK_NEXTENTS(ip, whichfork) + 2);
                 if (cur == NULL)
                         rval = XFS_ILOG_CORE | XFS_ILOG_DEXT;
                 else {
@@ -2695,17 +2689,17 @@ xfs_bmap_add_extent_unwritten_real(
         }
 
         /* update reverse mappings */
-        error = xfs_rmap_convert_extent(mp, dfops, ip, XFS_DATA_FORK, new);
+        error = xfs_rmap_convert_extent(mp, dfops, ip, whichfork, new);
         if (error)
                 goto done;
 
         /* convert to a btree if necessary */
-        if (xfs_bmap_needs_btree(ip, XFS_DATA_FORK)) {
+        if (xfs_bmap_needs_btree(ip, whichfork)) {
                 int     tmp_logflags;   /* partial log flag return val */
 
                 ASSERT(cur == NULL);
                 error = xfs_bmap_extents_to_btree(tp, ip, first, dfops, &cur,
-                                0, &tmp_logflags, XFS_DATA_FORK);
+                                0, &tmp_logflags, whichfork);
                 *logflagsp |= tmp_logflags;
                 if (error)
                         goto done;
@@ -2717,7 +2711,7 @@ xfs_bmap_add_extent_unwritten_real(
                 *curp = cur;
         }
 
-        xfs_bmap_check_leaf_extents(*curp, ip, XFS_DATA_FORK);
+        xfs_bmap_check_leaf_extents(*curp, ip, whichfork);
 done:
         *logflagsp |= rval;
         return error;
@@ -2809,7 +2803,8 @@ xfs_bmap_add_extent_hole_delay(
                 oldlen = startblockval(left.br_startblock) +
                         startblockval(new->br_startblock) +
                         startblockval(right.br_startblock);
-                newlen = xfs_bmap_worst_indlen(ip, temp);
+                newlen = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(ip, temp),
+                                         oldlen);
                 xfs_bmbt_set_startblock(xfs_iext_get_ext(ifp, *idx),
                         nullstartblock((int)newlen));
                 trace_xfs_bmap_post_update(ip, *idx, state, _THIS_IP_);
@@ -2830,7 +2825,8 @@ xfs_bmap_add_extent_hole_delay(
                 xfs_bmbt_set_blockcount(xfs_iext_get_ext(ifp, *idx), temp);
                 oldlen = startblockval(left.br_startblock) +
                         startblockval(new->br_startblock);
-                newlen = xfs_bmap_worst_indlen(ip, temp);
+                newlen = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(ip, temp),
+                                         oldlen);
                 xfs_bmbt_set_startblock(xfs_iext_get_ext(ifp, *idx),
                         nullstartblock((int)newlen));
                 trace_xfs_bmap_post_update(ip, *idx, state, _THIS_IP_);
@@ -2846,7 +2842,8 @@ xfs_bmap_add_extent_hole_delay(
                 temp = new->br_blockcount + right.br_blockcount;
                 oldlen = startblockval(new->br_startblock) +
                         startblockval(right.br_startblock);
-                newlen = xfs_bmap_worst_indlen(ip, temp);
+                newlen = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(ip, temp),
+                                         oldlen);
                 xfs_bmbt_set_allf(xfs_iext_get_ext(ifp, *idx),
                         new->br_startoff,
                         nullstartblock((int)newlen), temp, right.br_state);
@@ -2899,13 +2896,14 @@ xfs_bmap_add_extent_hole_real(
         ASSERT(!isnullstartblock(new->br_startblock));
         ASSERT(!bma->cur ||
                !(bma->cur->bc_private.b.flags & XFS_BTCUR_BPRV_WASDEL));
-        ASSERT(whichfork != XFS_COW_FORK);
 
         XFS_STATS_INC(mp, xs_add_exlist);
 
         state = 0;
         if (whichfork == XFS_ATTR_FORK)
                 state |= BMAP_ATTRFORK;
+        if (whichfork == XFS_COW_FORK)
+                state |= BMAP_COWFORK;
 
         /*
          * Check and set flags if this segment has a left neighbor.
@@ -3822,17 +3820,13 @@ xfs_bmap_btalloc(
                  * the first block that was allocated.
                  */
                 ASSERT(*ap->firstblock == NULLFSBLOCK ||
-                       XFS_FSB_TO_AGNO(mp, *ap->firstblock) ==
-                       XFS_FSB_TO_AGNO(mp, args.fsbno) ||
-                       (ap->dfops->dop_low &&
-                        XFS_FSB_TO_AGNO(mp, *ap->firstblock) <
-                        XFS_FSB_TO_AGNO(mp, args.fsbno)));
+                       XFS_FSB_TO_AGNO(mp, *ap->firstblock) <=
+                       XFS_FSB_TO_AGNO(mp, args.fsbno));
 
                 ap->blkno = args.fsbno;
                 if (*ap->firstblock == NULLFSBLOCK)
                         *ap->firstblock = args.fsbno;
-                ASSERT(nullfb || fb_agno == args.agno ||
-                       (ap->dfops->dop_low && fb_agno < args.agno));
+                ASSERT(nullfb || fb_agno <= args.agno);
                 ap->length = args.len;
                 if (!(ap->flags & XFS_BMAPI_COWFORK))
                         ap->ip->i_d.di_nblocks += args.len;
@@ -4368,10 +4362,16 @@ xfs_bmapi_allocate(
         bma->got.br_state = XFS_EXT_NORM;
 
         /*
-         * A wasdelay extent has been initialized, so shouldn't be flagged
-         * as unwritten.
+         * In the data fork, a wasdelay extent has been initialized, so
+         * shouldn't be flagged as unwritten.
+         *
+         * For the cow fork, however, we convert delalloc reservations
+         * (extents allocated for speculative preallocation) to
+         * allocated unwritten extents, and only convert the unwritten
+         * extents to real extents when we're about to write the data.
          */
-        if (!bma->wasdel && (bma->flags & XFS_BMAPI_PREALLOC) &&
+        if ((!bma->wasdel || (bma->flags & XFS_BMAPI_COWFORK)) &&
+            (bma->flags & XFS_BMAPI_PREALLOC) &&
             xfs_sb_version_hasextflgbit(&mp->m_sb))
                 bma->got.br_state = XFS_EXT_UNWRITTEN;
 
@@ -4422,8 +4422,6 @@ xfs_bmapi_convert_unwritten(
                         (XFS_BMAPI_PREALLOC | XFS_BMAPI_CONVERT))
                 return 0;
 
-        ASSERT(whichfork != XFS_COW_FORK);
-
         /*
          * Modify (by adding) the state flag, if writing.
          */
@@ -4448,8 +4446,8 @@ xfs_bmapi_convert_unwritten(
                         return error;
         }
 
-        error = xfs_bmap_add_extent_unwritten_real(bma->tp, bma->ip, &bma->idx,
-                        &bma->cur, mval, bma->firstblock, bma->dfops,
+        error = xfs_bmap_add_extent_unwritten_real(bma->tp, bma->ip, whichfork,
+                        &bma->idx, &bma->cur, mval, bma->firstblock, bma->dfops,
                         &tmp_logflags);
         /*
          * Log the inode core unconditionally in the unwritten extent conversion
@@ -4458,8 +4456,12 @@ xfs_bmapi_convert_unwritten(
          * in the transaction for the sake of fsync(), even if nothing has
          * changed, because fsync() will not force the log for this transaction
          * unless it sees the inode pinned.
+         *
+         * Note: If we're only converting cow fork extents, there aren't
+         * any on-disk updates to make, so we don't need to log anything.
          */
-        bma->logflags |= tmp_logflags | XFS_ILOG_CORE;
+        if (whichfork != XFS_COW_FORK)
+                bma->logflags |= tmp_logflags | XFS_ILOG_CORE;
         if (error)
                 return error;
 
@@ -4533,15 +4535,15 @@ xfs_bmapi_write(
         ASSERT(*nmap >= 1);
         ASSERT(*nmap <= XFS_BMAP_MAX_NMAP);
         ASSERT(!(flags & XFS_BMAPI_IGSTATE));
-        ASSERT(tp != NULL);
+        ASSERT(tp != NULL ||
+               (flags & (XFS_BMAPI_CONVERT | XFS_BMAPI_COWFORK)) ==
+                        (XFS_BMAPI_CONVERT | XFS_BMAPI_COWFORK));
         ASSERT(len > 0);
         ASSERT(XFS_IFORK_FORMAT(ip, whichfork) != XFS_DINODE_FMT_LOCAL);
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
         ASSERT(!(flags & XFS_BMAPI_REMAP) || whichfork == XFS_DATA_FORK);
         ASSERT(!(flags & XFS_BMAPI_PREALLOC) || !(flags & XFS_BMAPI_REMAP));
         ASSERT(!(flags & XFS_BMAPI_CONVERT) || !(flags & XFS_BMAPI_REMAP));
-        ASSERT(!(flags & XFS_BMAPI_PREALLOC) || whichfork != XFS_COW_FORK);
-        ASSERT(!(flags & XFS_BMAPI_CONVERT) || whichfork != XFS_COW_FORK);
 
         /* zeroing is for currently only for data extents, not metadata */
         ASSERT((flags & (XFS_BMAPI_METADATA | XFS_BMAPI_ZERO)) !=
@@ -4746,13 +4748,9 @@ error0:
         if (bma.cur) {
                 if (!error) {
                         ASSERT(*firstblock == NULLFSBLOCK ||
-                               XFS_FSB_TO_AGNO(mp, *firstblock) ==
+                               XFS_FSB_TO_AGNO(mp, *firstblock) <=
                                XFS_FSB_TO_AGNO(mp,
-                                       bma.cur->bc_private.b.firstblock) ||
-                               (dfops->dop_low &&
-                                XFS_FSB_TO_AGNO(mp, *firstblock) <
-                                XFS_FSB_TO_AGNO(mp,
-                                        bma.cur->bc_private.b.firstblock)));
+                                       bma.cur->bc_private.b.firstblock));
                         *firstblock = bma.cur->bc_private.b.firstblock;
                 }
                 xfs_btree_del_cursor(bma.cur,
@@ -4787,34 +4785,59 @@ xfs_bmap_split_indlen(
         xfs_filblks_t                   len2 = *indlen2;
         xfs_filblks_t                   nres = len1 + len2; /* new total res. */
         xfs_filblks_t                   stolen = 0;
+        xfs_filblks_t                   resfactor;
 
         /*
          * Steal as many blocks as we can to try and satisfy the worst case
          * indlen for both new extents.
          */
-        while (nres > ores && avail) {
-                nres--;
-                avail--;
-                stolen++;
-        }
+        if (ores < nres && avail)
+                stolen = XFS_FILBLKS_MIN(nres - ores, avail);
+        ores += stolen;
+
+         /* nothing else to do if we've satisfied the new reservation */
+        if (ores >= nres)
+                return stolen;
+
+        /*
+         * We can't meet the total required reservation for the two extents.
+         * Calculate the percent of the overall shortage between both extents
+         * and apply this percentage to each of the requested indlen values.
+         * This distributes the shortage fairly and reduces the chances that one
+         * of the two extents is left with nothing when extents are repeatedly
+         * split.
+         */
+        resfactor = (ores * 100);
+        do_div(resfactor, nres);
+        len1 *= resfactor;
+        do_div(len1, 100);
+        len2 *= resfactor;
+        do_div(len2, 100);
+        ASSERT(len1 + len2 <= ores);
+        ASSERT(len1 < *indlen1 && len2 < *indlen2);
 
         /*
-         * The only blocks available are those reserved for the original
-         * extent and what we can steal from the extent being removed.
-         * If this still isn't enough to satisfy the combined
-         * requirements for the two new extents, skim blocks off of each
-         * of the new reservations until they match what is available.
+         * Hand out the remainder to each extent. If one of the two reservations
+         * is zero, we want to make sure that one gets a block first. The loop
+         * below starts with len1, so hand len2 a block right off the bat if it
+         * is zero.
          */
-        while (nres > ores) {
-                if (len1) {
-                        len1--;
-                        nres--;
+        ores -= (len1 + len2);
+        ASSERT((*indlen1 - len1) + (*indlen2 - len2) >= ores);
+        if (ores && !len2 && *indlen2) {
+                len2++;
+                ores--;
+        }
+        while (ores) {
+                if (len1 < *indlen1) {
+                        len1++;
+                        ores--;
                 }
-                if (nres == ores)
+                if (!ores)
                         break;
-                if (len2) {
-                        len2--;
-                        nres--;
+                if (len2 < *indlen2) {
+                        len2++;
+                        ores--;
                 }
         }
 
@@ -5556,8 +5579,8 @@ __xfs_bunmapi(
                         }
                         del.br_state = XFS_EXT_UNWRITTEN;
                         error = xfs_bmap_add_extent_unwritten_real(tp, ip,
-                                        &lastx, &cur, &del, firstblock, dfops,
-                                        &logflags);
+                                        whichfork, &lastx, &cur, &del,
+                                        firstblock, dfops, &logflags);
                         if (error)
                                 goto error0;
                         goto nodelete;
@@ -5610,8 +5633,9 @@ __xfs_bunmapi(
                                 prev.br_state = XFS_EXT_UNWRITTEN;
                                 lastx--;
                                 error = xfs_bmap_add_extent_unwritten_real(tp,
-                                                ip, &lastx, &cur, &prev,
-                                                firstblock, dfops, &logflags);
+                                                ip, whichfork, &lastx, &cur,
+                                                &prev, firstblock, dfops,
+                                                &logflags);
                                 if (error)
                                         goto error0;
                                 goto nodelete;
@@ -5619,8 +5643,9 @@ __xfs_bunmapi(
                                 ASSERT(del.br_state == XFS_EXT_NORM);
                                 del.br_state = XFS_EXT_UNWRITTEN;
                                 error = xfs_bmap_add_extent_unwritten_real(tp,
-                                                ip, &lastx, &cur, &del,
-                                                firstblock, dfops, &logflags);
+                                                ip, whichfork, &lastx, &cur,
+                                                &del, firstblock, dfops,
+                                                &logflags);
                                 if (error)
                                         goto error0;
                                 goto nodelete;
diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
index d9be241fc86f..f93072b58a58 100644
--- a/fs/xfs/libxfs/xfs_bmap_btree.c
+++ b/fs/xfs/libxfs/xfs_bmap_btree.c
@@ -71,15 +71,9 @@ xfs_bmdr_to_bmbt(
         xfs_bmbt_key_t          *tkp;
         __be64                  *tpp;
 
-        if (xfs_sb_version_hascrc(&mp->m_sb))
-                xfs_btree_init_block_int(mp, rblock, XFS_BUF_DADDR_NULL,
-                                 XFS_BMAP_CRC_MAGIC, 0, 0, ip->i_ino,
-                                 XFS_BTREE_LONG_PTRS | XFS_BTREE_CRC_BLOCKS);
-        else
-                xfs_btree_init_block_int(mp, rblock, XFS_BUF_DADDR_NULL,
-                                 XFS_BMAP_MAGIC, 0, 0, ip->i_ino,
+        xfs_btree_init_block_int(mp, rblock, XFS_BUF_DADDR_NULL,
+                                 XFS_BTNUM_BMAP, 0, 0, ip->i_ino,
                                  XFS_BTREE_LONG_PTRS);
-
         rblock->bb_level = dblock->bb_level;
         ASSERT(be16_to_cpu(rblock->bb_level) > 0);
         rblock->bb_numrecs = dblock->bb_numrecs;
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index 21e6a6ab6b9a..c3decedc9455 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -50,8 +50,18 @@ static const __uint32_t xfs_magics[2][XFS_BTNUM_MAX] = {
           XFS_BMAP_CRC_MAGIC, XFS_IBT_CRC_MAGIC, XFS_FIBT_CRC_MAGIC,
           XFS_REFC_CRC_MAGIC }
 };
-#define xfs_btree_magic(cur) \
-        xfs_magics[!!((cur)->bc_flags & XFS_BTREE_CRC_BLOCKS)][cur->bc_btnum]
+
+__uint32_t
+xfs_btree_magic(
+        int                     crc,
+        xfs_btnum_t             btnum)
+{
+        __uint32_t              magic = xfs_magics[crc][btnum];
+
+        /* Ensure we asked for crc for crc-only magics. */
+        ASSERT(magic != 0);
+        return magic;
+}
 
 STATIC int                              /* error (0 or EFSCORRUPTED) */
 xfs_btree_check_lblock(
@@ -62,10 +72,13 @@ xfs_btree_check_lblock(
 {
         int                     lblock_ok = 1; /* block passes checks */
         struct xfs_mount        *mp;    /* file system mount point */
+        xfs_btnum_t             btnum = cur->bc_btnum;
+        int                     crc;
 
         mp = cur->bc_mp;
+        crc = xfs_sb_version_hascrc(&mp->m_sb);
 
-        if (xfs_sb_version_hascrc(&mp->m_sb)) {
+        if (crc) {
                 lblock_ok = lblock_ok &&
                         uuid_equal(&block->bb_u.l.bb_uuid,
                                    &mp->m_sb.sb_meta_uuid) &&
@@ -74,7 +87,7 @@ xfs_btree_check_lblock(
         }
 
         lblock_ok = lblock_ok &&
-                be32_to_cpu(block->bb_magic) == xfs_btree_magic(cur) &&
+                be32_to_cpu(block->bb_magic) == xfs_btree_magic(crc, btnum) &&
                 be16_to_cpu(block->bb_level) == level &&
                 be16_to_cpu(block->bb_numrecs) <=
                         cur->bc_ops->get_maxrecs(cur, level) &&
@@ -110,13 +123,16 @@ xfs_btree_check_sblock(
         struct xfs_agf          *agf;   /* ag. freespace structure */
         xfs_agblock_t           agflen; /* native ag. freespace length */
         int                     sblock_ok = 1; /* block passes checks */
+        xfs_btnum_t             btnum = cur->bc_btnum;
+        int                     crc;
 
         mp = cur->bc_mp;
+        crc = xfs_sb_version_hascrc(&mp->m_sb);
         agbp = cur->bc_private.a.agbp;
         agf = XFS_BUF_TO_AGF(agbp);
         agflen = be32_to_cpu(agf->agf_length);
 
-        if (xfs_sb_version_hascrc(&mp->m_sb)) {
+        if (crc) {
                 sblock_ok = sblock_ok &&
                         uuid_equal(&block->bb_u.s.bb_uuid,
                                    &mp->m_sb.sb_meta_uuid) &&
@@ -125,7 +141,7 @@ xfs_btree_check_sblock(
         }
 
         sblock_ok = sblock_ok &&
-                be32_to_cpu(block->bb_magic) == xfs_btree_magic(cur) &&
+                be32_to_cpu(block->bb_magic) == xfs_btree_magic(crc, btnum) &&
                 be16_to_cpu(block->bb_level) == level &&
                 be16_to_cpu(block->bb_numrecs) <=
                         cur->bc_ops->get_maxrecs(cur, level) &&
@@ -810,7 +826,8 @@ xfs_btree_read_bufl(
         xfs_daddr_t             d;              /* real disk block address */
         int                     error;
 
-        ASSERT(fsbno != NULLFSBLOCK);
+        if (!XFS_FSB_SANITY_CHECK(mp, fsbno))
+                return -EFSCORRUPTED;
         d = XFS_FSB_TO_DADDR(mp, fsbno);
         error = xfs_trans_read_buf(mp, tp, mp->m_ddev_targp, d,
                                    mp->m_bsize, lock, &bp, ops);
@@ -1084,12 +1101,15 @@ xfs_btree_init_block_int(
         struct xfs_mount        *mp,
         struct xfs_btree_block  *buf,
         xfs_daddr_t             blkno,
-        __u32                   magic,
+        xfs_btnum_t             btnum,
         __u16                   level,
         __u16                   numrecs,
         __u64                   owner,
         unsigned int            flags)
 {
+        int                     crc = xfs_sb_version_hascrc(&mp->m_sb);
+        __u32                   magic = xfs_btree_magic(crc, btnum);
+
         buf->bb_magic = cpu_to_be32(magic);
         buf->bb_level = cpu_to_be16(level);
         buf->bb_numrecs = cpu_to_be16(numrecs);
@@ -1097,7 +1117,7 @@ xfs_btree_init_block_int(
         if (flags & XFS_BTREE_LONG_PTRS) {
                 buf->bb_u.l.bb_leftsib = cpu_to_be64(NULLFSBLOCK);
                 buf->bb_u.l.bb_rightsib = cpu_to_be64(NULLFSBLOCK);
-                if (flags & XFS_BTREE_CRC_BLOCKS) {
+                if (crc) {
                         buf->bb_u.l.bb_blkno = cpu_to_be64(blkno);
                         buf->bb_u.l.bb_owner = cpu_to_be64(owner);
                         uuid_copy(&buf->bb_u.l.bb_uuid, &mp->m_sb.sb_meta_uuid);
@@ -1110,7 +1130,7 @@ xfs_btree_init_block_int(
 
                 buf->bb_u.s.bb_leftsib = cpu_to_be32(NULLAGBLOCK);
                 buf->bb_u.s.bb_rightsib = cpu_to_be32(NULLAGBLOCK);
-                if (flags & XFS_BTREE_CRC_BLOCKS) {
+                if (crc) {
                         buf->bb_u.s.bb_blkno = cpu_to_be64(blkno);
                         buf->bb_u.s.bb_owner = cpu_to_be32(__owner);
                         uuid_copy(&buf->bb_u.s.bb_uuid, &mp->m_sb.sb_meta_uuid);
@@ -1123,14 +1143,14 @@ void
 xfs_btree_init_block(
         struct xfs_mount *mp,
         struct xfs_buf  *bp,
-        __u32           magic,
+        xfs_btnum_t     btnum,
         __u16           level,
         __u16           numrecs,
         __u64           owner,
         unsigned int    flags)
 {
         xfs_btree_init_block_int(mp, XFS_BUF_TO_BLOCK(bp), bp->b_bn,
-                                 magic, level, numrecs, owner, flags);
+                                 btnum, level, numrecs, owner, flags);
 }
 
 STATIC void
@@ -1140,7 +1160,7 @@ xfs_btree_init_block_cur(
         int                     level,
         int                     numrecs)
 {
-        __u64 owner;
+        __u64                   owner;
 
         /*
          * we can pull the owner from the cursor right now as the different
@@ -1154,7 +1174,7 @@ xfs_btree_init_block_cur(
                 owner = cur->bc_private.a.agno;
 
         xfs_btree_init_block_int(cur->bc_mp, XFS_BUF_TO_BLOCK(bp), bp->b_bn,
-                                 xfs_btree_magic(cur), level, numrecs,
+                                 cur->bc_btnum, level, numrecs,
                                  owner, cur->bc_flags);
 }
 
diff --git a/fs/xfs/libxfs/xfs_btree.h b/fs/xfs/libxfs/xfs_btree.h
index b69b947c4c1b..4bb62580a7fd 100644
--- a/fs/xfs/libxfs/xfs_btree.h
+++ b/fs/xfs/libxfs/xfs_btree.h
@@ -76,6 +76,8 @@ union xfs_btree_rec {
 #define XFS_BTNUM_RMAP  ((xfs_btnum_t)XFS_BTNUM_RMAPi)
 #define XFS_BTNUM_REFC  ((xfs_btnum_t)XFS_BTNUM_REFCi)
 
+__uint32_t xfs_btree_magic(int crc, xfs_btnum_t btnum);
+
 /*
  * For logging record fields.
  */
@@ -378,7 +380,7 @@ void
 xfs_btree_init_block(
         struct xfs_mount *mp,
         struct xfs_buf  *bp,
-        __u32           magic,
+        xfs_btnum_t     btnum,
         __u16           level,
         __u16           numrecs,
         __u64           owner,
@@ -389,7 +391,7 @@ xfs_btree_init_block_int(
         struct xfs_mount        *mp,
         struct xfs_btree_block  *buf,
         xfs_daddr_t             blkno,
-        __u32                   magic,
+        xfs_btnum_t             btnum,
         __u16                   level,
         __u16                   numrecs,
         __u64                   owner,
@@ -456,7 +458,7 @@ static inline int xfs_btree_get_level(struct xfs_btree_block *block)
 #define XFS_FILBLKS_MAX(a,b)    max_t(xfs_filblks_t, (a), (b))
 
 #define XFS_FSB_SANITY_CHECK(mp,fsb)    \
-        (XFS_FSB_TO_AGNO(mp, fsb) < mp->m_sb.sb_agcount && \
+        (fsb && XFS_FSB_TO_AGNO(mp, fsb) < mp->m_sb.sb_agcount && \
                 XFS_FSB_TO_AGBNO(mp, fsb) < mp->m_sb.sb_agblocks)
 
 /*
diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c
index f2dc1a950c85..1bdf2888295b 100644
--- a/fs/xfs/libxfs/xfs_da_btree.c
+++ b/fs/xfs/libxfs/xfs_da_btree.c
@@ -2633,7 +2633,7 @@ out_free:
 /*
  * Readahead the dir/attr block.
  */
-xfs_daddr_t
+int
 xfs_da_reada_buf(
         struct xfs_inode        *dp,
         xfs_dablk_t             bno,
@@ -2664,7 +2664,5 @@ out_free:
         if (mapp != &map)
                 kmem_free(mapp);
 
-        if (error)
-                return -1;
-        return mappedbno;
+        return error;
 }
diff --git a/fs/xfs/libxfs/xfs_da_btree.h b/fs/xfs/libxfs/xfs_da_btree.h
index 98c75cbe6ac2..4e29cb6a3627 100644
--- a/fs/xfs/libxfs/xfs_da_btree.h
+++ b/fs/xfs/libxfs/xfs_da_btree.h
@@ -201,7 +201,7 @@ int	xfs_da_read_buf(struct xfs_trans *trans, struct xfs_inode *dp,
                                xfs_dablk_t bno, xfs_daddr_t mappedbno,
                                struct xfs_buf **bpp, int whichfork,
                                const struct xfs_buf_ops *ops);
-xfs_daddr_t     xfs_da_reada_buf(struct xfs_inode *dp, xfs_dablk_t bno,
+int     xfs_da_reada_buf(struct xfs_inode *dp, xfs_dablk_t bno,
                                 xfs_daddr_t mapped_bno, int whichfork,
                                 const struct xfs_buf_ops *ops);
 int     xfs_da_shrink_inode(xfs_da_args_t *args, xfs_dablk_t dead_blkno,
diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
index 75a557432d0f..bbd1238852b3 100644
--- a/fs/xfs/libxfs/xfs_dir2_node.c
+++ b/fs/xfs/libxfs/xfs_dir2_node.c
@@ -155,6 +155,42 @@ const struct xfs_buf_ops xfs_dir3_free_buf_ops = {
         .verify_write = xfs_dir3_free_write_verify,
 };
 
+/* Everything ok in the free block header? */
+static bool
+xfs_dir3_free_header_check(
+        struct xfs_inode        *dp,
+        xfs_dablk_t             fbno,
+        struct xfs_buf          *bp)
+{
+        struct xfs_mount        *mp = dp->i_mount;
+        unsigned int            firstdb;
+        int                     maxbests;
+
+        maxbests = dp->d_ops->free_max_bests(mp->m_dir_geo);
+        firstdb = (xfs_dir2_da_to_db(mp->m_dir_geo, fbno) -
+                   xfs_dir2_byte_to_db(mp->m_dir_geo, XFS_DIR2_FREE_OFFSET)) *
+                        maxbests;
+        if (xfs_sb_version_hascrc(&mp->m_sb)) {
+                struct xfs_dir3_free_hdr *hdr3 = bp->b_addr;
+
+                if (be32_to_cpu(hdr3->firstdb) != firstdb)
+                        return false;
+                if (be32_to_cpu(hdr3->nvalid) > maxbests)
+                        return false;
+                if (be32_to_cpu(hdr3->nvalid) < be32_to_cpu(hdr3->nused))
+                        return false;
+        } else {
+                struct xfs_dir2_free_hdr *hdr = bp->b_addr;
+
+                if (be32_to_cpu(hdr->firstdb) != firstdb)
+                        return false;
+                if (be32_to_cpu(hdr->nvalid) > maxbests)
+                        return false;
+                if (be32_to_cpu(hdr->nvalid) < be32_to_cpu(hdr->nused))
+                        return false;
+        }
+        return true;
+}
 
 static int
 __xfs_dir3_free_read(
@@ -168,11 +204,22 @@ __xfs_dir3_free_read(
 
         err = xfs_da_read_buf(tp, dp, fbno, mappedbno, bpp,
                                 XFS_DATA_FORK, &xfs_dir3_free_buf_ops);
+        if (err || !*bpp)
+                return err;
+
+        /* Check things that we can't do in the verifier. */
+        if (!xfs_dir3_free_header_check(dp, fbno, *bpp)) {
+                xfs_buf_ioerror(*bpp, -EFSCORRUPTED);
+                xfs_verifier_error(*bpp);
+                xfs_trans_brelse(tp, *bpp);
+                return -EFSCORRUPTED;
+        }
 
         /* try read returns without an error or *bpp if it lands in a hole */
-        if (!err && tp && *bpp)
+        if (tp)
                 xfs_trans_buf_set_type(tp, *bpp, XFS_BLFT_DIR_FREE_BUF);
-        return err;
+
+        return 0;
 }
 
 int
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index f272abff11e1..d41ade5d293e 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -51,8 +51,7 @@ xfs_ialloc_cluster_alignment(
         struct xfs_mount        *mp)
 {
         if (xfs_sb_version_hasalign(&mp->m_sb) &&
-            mp->m_sb.sb_inoalignmt >=
-                        XFS_B_TO_FSBT(mp, mp->m_inode_cluster_size))
+            mp->m_sb.sb_inoalignmt >= xfs_icluster_size_fsb(mp))
                 return mp->m_sb.sb_inoalignmt;
         return 1;
 }
diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c
index 222e103356c6..25c1e078aef6 100644
--- a/fs/xfs/libxfs/xfs_inode_fork.c
+++ b/fs/xfs/libxfs/xfs_inode_fork.c
@@ -26,6 +26,7 @@
 #include "xfs_inode.h"
 #include "xfs_trans.h"
 #include "xfs_inode_item.h"
+#include "xfs_btree.h"
 #include "xfs_bmap_btree.h"
 #include "xfs_bmap.h"
 #include "xfs_error.h"
@@ -429,11 +430,13 @@ xfs_iformat_btree(
         /* REFERENCED */
         int                     nrecs;
         int                     size;
+        int                     level;
 
         ifp = XFS_IFORK_PTR(ip, whichfork);
         dfp = (xfs_bmdr_block_t *)XFS_DFORK_PTR(dip, whichfork);
         size = XFS_BMAP_BROOT_SPACE(mp, dfp);
         nrecs = be16_to_cpu(dfp->bb_numrecs);
+        level = be16_to_cpu(dfp->bb_level);
 
         /*
          * blow out if -- fork has less extents than can fit in
@@ -446,7 +449,8 @@ xfs_iformat_btree(
                                         XFS_IFORK_MAXEXT(ip, whichfork) ||
                      XFS_BMDR_SPACE_CALC(nrecs) >
                                         XFS_DFORK_SIZE(dip, mp, whichfork) ||
-                     XFS_IFORK_NEXTENTS(ip, whichfork) > ip->i_d.di_nblocks)) {
+                     XFS_IFORK_NEXTENTS(ip, whichfork) > ip->i_d.di_nblocks) ||
+                     level == 0 || level > XFS_BTREE_MAXLEVELS) {
                 xfs_warn(mp, "corrupt inode %Lu (btree).",
                                         (unsigned long long) ip->i_ino);
                 XFS_CORRUPTION_ERROR("xfs_iformat_btree", XFS_ERRLEVEL_LOW,
@@ -497,15 +501,14 @@ xfs_iread_extents(
          * We know that the size is valid (it's checked in iformat_btree)
          */
         ifp->if_bytes = ifp->if_real_bytes = 0;
-        ifp->if_flags |= XFS_IFEXTENTS;
         xfs_iext_add(ifp, 0, nextents);
         error = xfs_bmap_read_extents(tp, ip, whichfork);
         if (error) {
                 xfs_iext_destroy(ifp);
-                ifp->if_flags &= ~XFS_IFEXTENTS;
                 return error;
         }
         xfs_validate_extents(ifp, nextents, XFS_EXTFMT_INODE(ip));
+        ifp->if_flags |= XFS_IFEXTENTS;
         return 0;
 }
 /*
diff --git a/fs/xfs/libxfs/xfs_log_recover.h b/fs/xfs/libxfs/xfs_log_recover.h
index d9f65e2d5cc8..29a01ec89dd0 100644
--- a/fs/xfs/libxfs/xfs_log_recover.h
+++ b/fs/xfs/libxfs/xfs_log_recover.h
@@ -42,7 +42,6 @@ typedef struct xlog_recover_item {
         xfs_log_iovec_t         *ri_buf;        /* ptr to regions buffer */
 } xlog_recover_item_t;
 
-struct xlog_tid;
 typedef struct xlog_recover {
         struct hlist_node       r_list;
         xlog_tid_t              r_log_tid;      /* log's transaction id */
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 631e7c0e0a29..1ff9df7a3ce8 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -481,6 +481,12 @@ xfs_submit_ioend(
         struct xfs_ioend        *ioend,
         int                     status)
 {
+        /* Convert CoW extents to regular */
+        if (!status && ioend->io_type == XFS_IO_COW) {
+                status = xfs_reflink_convert_cow(XFS_I(ioend->io_inode),
+                                ioend->io_offset, ioend->io_size);
+        }
+
         /* Reserve log space if we might write beyond the on-disk inode size. */
         if (!status &&
             ioend->io_type != XFS_IO_UNWRITTEN &&
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index c1417919ab0a..8b75dcea5966 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -88,7 +88,6 @@ int
 xfs_bmap_rtalloc(
         struct xfs_bmalloca     *ap)    /* bmap alloc argument struct */
 {
-        xfs_alloctype_t atype = 0;      /* type for allocation routines */
         int             error;          /* error return value */
         xfs_mount_t     *mp;            /* mount point structure */
         xfs_extlen_t    prod = 0;       /* product factor for allocators */
@@ -155,18 +154,14 @@ xfs_bmap_rtalloc(
         /*
          * Realtime allocation, done through xfs_rtallocate_extent.
          */
-        atype = ap->blkno == 0 ?  XFS_ALLOCTYPE_ANY_AG : XFS_ALLOCTYPE_NEAR_BNO;
         do_div(ap->blkno, mp->m_sb.sb_rextsize);
         rtb = ap->blkno;
         ap->length = ralen;
-        if ((error = xfs_rtallocate_extent(ap->tp, ap->blkno, 1, ap->length,
-                                &ralen, atype, ap->wasdel, prod, &rtb)))
-                return error;
-        if (rtb == NULLFSBLOCK && prod > 1 &&
-            (error = xfs_rtallocate_extent(ap->tp, ap->blkno, 1,
-                                           ap->length, &ralen, atype,
-                                           ap->wasdel, 1, &rtb)))
+        error = xfs_rtallocate_extent(ap->tp, ap->blkno, 1, ap->length,
+                                &ralen, ap->wasdel, prod, &rtb);
+        if (error)
                 return error;
+
         ap->blkno = rtb;
         if (ap->blkno != NULLFSBLOCK) {
                 ap->blkno *= mp->m_sb.sb_rextsize;
@@ -787,11 +782,9 @@ xfs_getbmap(
         xfs_iunlock(ip, XFS_IOLOCK_SHARED);
 
         for (i = 0; i < cur_ext; i++) {
-                int full = 0;   /* user array is full */
-
                 /* format results & advance arg */
-                error = formatter(&arg, &out[i], &full);
-                if (error || full)
+                error = formatter(&arg, &out[i]);
+                if (error)
                         break;
         }
 
@@ -917,17 +910,18 @@ xfs_can_free_eofblocks(struct xfs_inode *ip, bool force)
  */
 int
 xfs_free_eofblocks(
-        xfs_mount_t     *mp,
-        xfs_inode_t     *ip,
-        bool            need_iolock)
+        struct xfs_inode        *ip)
 {
-        xfs_trans_t     *tp;
-        int             error;
-        xfs_fileoff_t   end_fsb;
-        xfs_fileoff_t   last_fsb;
-        xfs_filblks_t   map_len;
-        int             nimaps;
-        xfs_bmbt_irec_t imap;
+        struct xfs_trans        *tp;
+        int                     error;
+        xfs_fileoff_t           end_fsb;
+        xfs_fileoff_t           last_fsb;
+        xfs_filblks_t           map_len;
+        int                     nimaps;
+        struct xfs_bmbt_irec    imap;
+        struct xfs_mount        *mp = ip->i_mount;
+
+        ASSERT(xfs_isilocked(ip, XFS_IOLOCK_EXCL));
 
         /*
          * Figure out if there are any blocks beyond the end
@@ -944,6 +938,10 @@ xfs_free_eofblocks(
         error = xfs_bmapi_read(ip, end_fsb, map_len, &imap, &nimaps, 0);
         xfs_iunlock(ip, XFS_ILOCK_SHARED);
 
+        /*
+         * If there are blocks after the end of file, truncate the file to its
+         * current size to free them up.
+         */
         if (!error && (nimaps != 0) &&
             (imap.br_startblock != HOLESTARTBLOCK ||
              ip->i_delayed_blks)) {
@@ -954,22 +952,13 @@ xfs_free_eofblocks(
                 if (error)
                         return error;
 
-                /*
-                 * There are blocks after the end of file.
-                 * Free them up now by truncating the file to
-                 * its current size.
-                 */
-                if (need_iolock) {
-                        if (!xfs_ilock_nowait(ip, XFS_IOLOCK_EXCL))
-                                return -EAGAIN;
-                }
+                /* wait on dio to ensure i_size has settled */
+                inode_dio_wait(VFS_I(ip));
 
                 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate, 0, 0, 0,
                                 &tp);
                 if (error) {
                         ASSERT(XFS_FORCED_SHUTDOWN(mp));
-                        if (need_iolock)
-                                xfs_iunlock(ip, XFS_IOLOCK_EXCL);
                         return error;
                 }
 
@@ -997,8 +986,6 @@ xfs_free_eofblocks(
                 }
 
                 xfs_iunlock(ip, XFS_ILOCK_EXCL);
-                if (need_iolock)
-                        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
         }
         return error;
 }
@@ -1393,10 +1380,16 @@ xfs_shift_file_space(
         xfs_fileoff_t           stop_fsb;
         xfs_fileoff_t           next_fsb;
         xfs_fileoff_t           shift_fsb;
+        uint                    resblks;
 
         ASSERT(direction == SHIFT_LEFT || direction == SHIFT_RIGHT);
 
         if (direction == SHIFT_LEFT) {
+                /*
+                 * Reserve blocks to cover potential extent merges after left
+                 * shift operations.
+                 */
+                resblks = XFS_DIOSTRAT_SPACE_RES(mp, 0);
                 next_fsb = XFS_B_TO_FSB(mp, offset + len);
                 stop_fsb = XFS_B_TO_FSB(mp, VFS_I(ip)->i_size);
         } else {
@@ -1404,6 +1397,7 @@ xfs_shift_file_space(
                  * If right shift, delegate the work of initialization of
                  * next_fsb to xfs_bmap_shift_extent as it has ilock held.
                  */
+                resblks = 0;
                 next_fsb = NULLFSBLOCK;
                 stop_fsb = XFS_B_TO_FSB(mp, offset);
         }
@@ -1415,7 +1409,7 @@ xfs_shift_file_space(
          * into the accessible region of the file.
          */
         if (xfs_can_free_eofblocks(ip, true)) {
-                error = xfs_free_eofblocks(mp, ip, false);
+                error = xfs_free_eofblocks(ip);
                 if (error)
                         return error;
         }
@@ -1445,21 +1439,14 @@ xfs_shift_file_space(
         }
 
         while (!error && !done) {
-                /*
-                 * We would need to reserve permanent block for transaction.
-                 * This will come into picture when after shifting extent into
-                 * hole we found that adjacent extents can be merged which
-                 * may lead to freeing of a block during record update.
-                 */
-                error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write,
-                                XFS_DIOSTRAT_SPACE_RES(mp, 0), 0, 0, &tp);
+                error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, resblks, 0, 0,
+                                        &tp);
                 if (error)
                         break;
 
                 xfs_ilock(ip, XFS_ILOCK_EXCL);
                 error = xfs_trans_reserve_quota(tp, mp, ip->i_udquot,
-                                ip->i_gdquot, ip->i_pdquot,
-                                XFS_DIOSTRAT_SPACE_RES(mp, 0), 0,
+                                ip->i_gdquot, ip->i_pdquot, resblks, 0,
                                 XFS_QMOPT_RES_REGBLKS);
                 if (error)
                         goto out_trans_cancel;
diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h
index 68a621a8e0c0..135d8267e284 100644
--- a/fs/xfs/xfs_bmap_util.h
+++ b/fs/xfs/xfs_bmap_util.h
@@ -35,7 +35,7 @@ int	xfs_bmap_punch_delalloc_range(struct xfs_inode *ip,
                 xfs_fileoff_t start_fsb, xfs_fileoff_t length);
 
 /* bmap to userspace formatter - copy to user & advance pointer */
-typedef int (*xfs_bmap_format_t)(void **, struct getbmapx *, int *);
+typedef int (*xfs_bmap_format_t)(void **, struct getbmapx *);
 int     xfs_getbmap(struct xfs_inode *ip, struct getbmapx *bmv,
                 xfs_bmap_format_t formatter, void *arg);
 
@@ -63,8 +63,7 @@ int	xfs_insert_file_space(struct xfs_inode *, xfs_off_t offset,
 
 /* EOF block manipulation functions */
 bool    xfs_can_free_eofblocks(struct xfs_inode *ip, bool force);
-int     xfs_free_eofblocks(struct xfs_mount *mp, struct xfs_inode *ip,
-                           bool need_iolock);
+int     xfs_free_eofblocks(struct xfs_inode *ip);
 
 int     xfs_swap_extents(struct xfs_inode *ip, struct xfs_inode *tip,
                          struct xfs_swapext *sx);
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 2975cb2319f4..0306168af332 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -1162,6 +1162,7 @@ xfs_buf_iodone_callbacks(
          */
         bp->b_last_error = 0;
         bp->b_retries = 0;
+        bp->b_first_retry_time = 0;
 
         xfs_buf_do_callbacks(bp);
         bp->b_fspriv = NULL;
diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
index 4ff499aa7338..d796ffac7296 100644
--- a/fs/xfs/xfs_discard.c
+++ b/fs/xfs/xfs_discard.c
@@ -208,32 +208,3 @@ xfs_ioc_trim(
                 return -EFAULT;
         return 0;
 }
-
-int
-xfs_discard_extents(
-        struct xfs_mount        *mp,
-        struct list_head        *list)
-{
-        struct xfs_extent_busy  *busyp;
-        int                     error = 0;
-
-        list_for_each_entry(busyp, list, list) {
-                trace_xfs_discard_extent(mp, busyp->agno, busyp->bno,
-                                         busyp->length);
-
-                error = blkdev_issue_discard(mp->m_ddev_targp->bt_bdev,
-                                XFS_AGB_TO_DADDR(mp, busyp->agno, busyp->bno),
-                                XFS_FSB_TO_BB(mp, busyp->length),
-                                GFP_NOFS, 0);
-                if (error && error != -EOPNOTSUPP) {
-                        xfs_info(mp,
-         "discard failed for extent [0x%llx,%u], error %d",
-                                 (unsigned long long)busyp->bno,
-                                 busyp->length,
-                                 error);
-                        return error;
-                }
-        }
-
-        return 0;
-}
diff --git a/fs/xfs/xfs_discard.h b/fs/xfs/xfs_discard.h
index 344879aea646..0f070f9e44e1 100644
--- a/fs/xfs/xfs_discard.h
+++ b/fs/xfs/xfs_discard.h
@@ -5,6 +5,5 @@ struct fstrim_range;
 struct list_head;
 
 extern int      xfs_ioc_trim(struct xfs_mount *, struct fstrim_range __user *);
-extern int      xfs_discard_extents(struct xfs_mount *, struct list_head *);
 
 #endif /* XFS_DISCARD_H */
diff --git a/fs/xfs/xfs_extent_busy.c b/fs/xfs/xfs_extent_busy.c
index 162dc186cf04..77760dbf0242 100644
--- a/fs/xfs/xfs_extent_busy.c
+++ b/fs/xfs/xfs_extent_busy.c
@@ -45,18 +45,7 @@ xfs_extent_busy_insert(
         struct rb_node          **rbp;
         struct rb_node          *parent = NULL;
 
-        new = kmem_zalloc(sizeof(struct xfs_extent_busy), KM_MAYFAIL);
-        if (!new) {
-                /*
-                 * No Memory!  Since it is now not possible to track the free
-                 * block, make this a synchronous transaction to insure that
-                 * the block is not reused before this transaction commits.
-                 */
-                trace_xfs_extent_busy_enomem(tp->t_mountp, agno, bno, len);
-                xfs_trans_set_sync(tp);
-                return;
-        }
-
+        new = kmem_zalloc(sizeof(struct xfs_extent_busy), KM_SLEEP);
         new->agno = agno;
         new->bno = bno;
         new->length = len;
@@ -345,25 +334,31 @@ restart:
  * subset of the extent that is not busy.  If *rlen is smaller than
  * args->minlen no suitable extent could be found, and the higher level
  * code needs to force out the log and retry the allocation.
+ *
+ * Return the current busy generation for the AG if the extent is busy. This
+ * value can be used to wait for at least one of the currently busy extents
+ * to be cleared. Note that the busy list is not guaranteed to be empty after
+ * the gen is woken. The state of a specific extent must always be confirmed
+ * with another call to xfs_extent_busy_trim() before it can be used.
  */
-void
+bool
 xfs_extent_busy_trim(
         struct xfs_alloc_arg    *args,
-        xfs_agblock_t           bno,
-        xfs_extlen_t            len,
-        xfs_agblock_t           *rbno,
-        xfs_extlen_t            *rlen)
+        xfs_agblock_t           *bno,
+        xfs_extlen_t            *len,
+        unsigned                *busy_gen)
 {
         xfs_agblock_t           fbno;
         xfs_extlen_t            flen;
         struct rb_node          *rbp;
+        bool                    ret = false;
 
-        ASSERT(len > 0);
+        ASSERT(*len > 0);
 
         spin_lock(&args->pag->pagb_lock);
 restart:
-        fbno = bno;
-        flen = len;
+        fbno = *bno;
+        flen = *len;
         rbp = args->pag->pagb_tree.rb_node;
         while (rbp && flen >= args->minlen) {
                 struct xfs_extent_busy *busyp =
@@ -515,24 +510,25 @@ restart:
 
                 flen = fend - fbno;
         }
-        spin_unlock(&args->pag->pagb_lock);
+out:
 
-        if (fbno != bno || flen != len) {
-                trace_xfs_extent_busy_trim(args->mp, args->agno, bno, len,
+        if (fbno != *bno || flen != *len) {
+                trace_xfs_extent_busy_trim(args->mp, args->agno, *bno, *len,
                                           fbno, flen);
+                *bno = fbno;
+                *len = flen;
+                *busy_gen = args->pag->pagb_gen;
+                ret = true;
         }
-        *rbno = fbno;
-        *rlen = flen;
-        return;
+        spin_unlock(&args->pag->pagb_lock);
+        return ret;
 fail:
         /*
          * Return a zero extent length as failure indications.  All callers
          * re-check if the trimmed extent satisfies the minlen requirement.
          */
-        spin_unlock(&args->pag->pagb_lock);
-        trace_xfs_extent_busy_trim(args->mp, args->agno, bno, len, fbno, 0);
-        *rbno = fbno;
-        *rlen = 0;
+        flen = 0;
+        goto out;
 }
 
 STATIC void
@@ -551,6 +547,21 @@ xfs_extent_busy_clear_one(
         kmem_free(busyp);
 }
 
+static void
+xfs_extent_busy_put_pag(
+        struct xfs_perag        *pag,
+        bool                    wakeup)
+                __releases(pag->pagb_lock)
+{
+        if (wakeup) {
+                pag->pagb_gen++;
+                wake_up_all(&pag->pagb_wait);
+        }
+
+        spin_unlock(&pag->pagb_lock);
+        xfs_perag_put(pag);
+}
+
 /*
  * Remove all extents on the passed in list from the busy extents tree.
  * If do_discard is set skip extents that need to be discarded, and mark
@@ -565,27 +576,76 @@ xfs_extent_busy_clear(
         struct xfs_extent_busy  *busyp, *n;
         struct xfs_perag        *pag = NULL;
         xfs_agnumber_t          agno = NULLAGNUMBER;
+        bool                    wakeup = false;
 
         list_for_each_entry_safe(busyp, n, list, list) {
                 if (busyp->agno != agno) {
-                        if (pag) {
-                                spin_unlock(&pag->pagb_lock);
-                                xfs_perag_put(pag);
-                        }
-                        pag = xfs_perag_get(mp, busyp->agno);
-                        spin_lock(&pag->pagb_lock);
+                        if (pag)
+                                xfs_extent_busy_put_pag(pag, wakeup);
                         agno = busyp->agno;
+                        pag = xfs_perag_get(mp, agno);
+                        spin_lock(&pag->pagb_lock);
+                        wakeup = false;
                 }
 
                 if (do_discard && busyp->length &&
-                    !(busyp->flags & XFS_EXTENT_BUSY_SKIP_DISCARD))
+                    !(busyp->flags & XFS_EXTENT_BUSY_SKIP_DISCARD)) {
                         busyp->flags = XFS_EXTENT_BUSY_DISCARDED;
-                else
+                } else {
                         xfs_extent_busy_clear_one(mp, pag, busyp);
+                        wakeup = true;
+                }
         }
 
-        if (pag) {
-                spin_unlock(&pag->pagb_lock);
+        if (pag)
+                xfs_extent_busy_put_pag(pag, wakeup);
+}
+
+/*
+ * Flush out all busy extents for this AG.
+ */
+void
+xfs_extent_busy_flush(
+        struct xfs_mount        *mp,
+        struct xfs_perag        *pag,
+        unsigned                busy_gen)
+{
+        DEFINE_WAIT             (wait);
+        int                     log_flushed = 0, error;
+
+        trace_xfs_log_force(mp, 0, _THIS_IP_);
+        error = _xfs_log_force(mp, XFS_LOG_SYNC, &log_flushed);
+        if (error)
+                return;
+
+        do {
+                prepare_to_wait(&pag->pagb_wait, &wait, TASK_KILLABLE);
+                if  (busy_gen != READ_ONCE(pag->pagb_gen))
+                        break;
+                schedule();
+        } while (1);
+
+        finish_wait(&pag->pagb_wait, &wait);
+}
+
+void
+xfs_extent_busy_wait_all(
+        struct xfs_mount        *mp)
+{
+        DEFINE_WAIT             (wait);
+        xfs_agnumber_t          agno;
+
+        for (agno = 0; agno < mp->m_sb.sb_agcount; agno++) {
+                struct xfs_perag *pag = xfs_perag_get(mp, agno);
+
+                do {
+                        prepare_to_wait(&pag->pagb_wait, &wait, TASK_KILLABLE);
+                        if  (RB_EMPTY_ROOT(&pag->pagb_tree))
+                                break;
+                        schedule();
+                } while (1);
+                finish_wait(&pag->pagb_wait, &wait);
+
                 xfs_perag_put(pag);
         }
 }
@@ -596,9 +656,17 @@ xfs_extent_busy_clear(
 int
 xfs_extent_busy_ag_cmp(
         void                    *priv,
-        struct list_head        *a,
-        struct list_head        *b)
+        struct list_head        *l1,
+        struct list_head        *l2)
 {
-        return container_of(a, struct xfs_extent_busy, list)->agno -
-                container_of(b, struct xfs_extent_busy, list)->agno;
+        struct xfs_extent_busy  *b1 =
+                container_of(l1, struct xfs_extent_busy, list);
+        struct xfs_extent_busy  *b2 =
+                container_of(l2, struct xfs_extent_busy, list);
+        s32 diff;
+
+        diff = b1->agno - b2->agno;
+        if (!diff)
+                diff = b1->bno - b2->bno;
+        return diff;
 }
diff --git a/fs/xfs/xfs_extent_busy.h b/fs/xfs/xfs_extent_busy.h
index bfff284d2dcc..60195ea1b84a 100644
--- a/fs/xfs/xfs_extent_busy.h
+++ b/fs/xfs/xfs_extent_busy.h
@@ -58,9 +58,16 @@ void
 xfs_extent_busy_reuse(struct xfs_mount *mp, xfs_agnumber_t agno,
         xfs_agblock_t fbno, xfs_extlen_t flen, bool userdata);
 
+bool
+xfs_extent_busy_trim(struct xfs_alloc_arg *args, xfs_agblock_t *bno,
+                xfs_extlen_t *len, unsigned *busy_gen);
+
+void
+xfs_extent_busy_flush(struct xfs_mount *mp, struct xfs_perag *pag,
+        unsigned busy_gen);
+
 void
-xfs_extent_busy_trim(struct xfs_alloc_arg *args, xfs_agblock_t bno,
-        xfs_extlen_t len, xfs_agblock_t *rbno, xfs_extlen_t *rlen);
+xfs_extent_busy_wait_all(struct xfs_mount *mp);
 
 int
 xfs_extent_busy_ag_cmp(void *priv, struct list_head *a, struct list_head *b);
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index bbb9eb6811b2..086440e79b86 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -527,6 +527,15 @@ xfs_file_dio_aio_write(
         if ((iocb->ki_pos & mp->m_blockmask) ||
             ((iocb->ki_pos + count) & mp->m_blockmask)) {
                 unaligned_io = 1;
+
+                /*
+                 * We can't properly handle unaligned direct I/O to reflink
+                 * files yet, as we can't unshare a partial block.
+                 */
+                if (xfs_is_reflink_inode(ip)) {
+                        trace_xfs_reflink_bounce_dio_write(ip, iocb->ki_pos, count);
+                        return -EREMCHG;
+                }
                 iolock = XFS_IOLOCK_EXCL;
         } else {
                 iolock = XFS_IOLOCK_SHARED;
@@ -552,14 +561,6 @@ xfs_file_dio_aio_write(
         }
 
         trace_xfs_file_direct_write(ip, count, iocb->ki_pos);
-
-        /* If this is a block-aligned directio CoW, remap immediately. */
-        if (xfs_is_reflink_inode(ip) && !unaligned_io) {
-                ret = xfs_reflink_allocate_cow_range(ip, iocb->ki_pos, count);
-                if (ret)
-                        goto out;
-        }
-
         ret = iomap_dio_rw(iocb, from, &xfs_iomap_ops, xfs_dio_write_end_io);
 out:
         xfs_iunlock(ip, iolock);
@@ -614,8 +615,10 @@ xfs_file_buffered_aio_write(
         struct xfs_inode        *ip = XFS_I(inode);
         ssize_t                 ret;
         int                     enospc = 0;
-        int                     iolock = XFS_IOLOCK_EXCL;
+        int                     iolock;
 
+write_retry:
+        iolock = XFS_IOLOCK_EXCL;
         xfs_ilock(ip, iolock);
 
         ret = xfs_file_aio_write_checks(iocb, from, &iolock);
@@ -625,7 +628,6 @@ xfs_file_buffered_aio_write(
         /* We can write back this queue in page reclaim */
         current->backing_dev_info = inode_to_bdi(inode);
 
-write_retry:
         trace_xfs_file_buffered_write(ip, iov_iter_count(from), iocb->ki_pos);
         ret = iomap_file_buffered_write(iocb, from, &xfs_iomap_ops);
         if (likely(ret >= 0))
@@ -641,18 +643,21 @@ write_retry:
          * running at the same time.
          */
         if (ret == -EDQUOT && !enospc) {
+                xfs_iunlock(ip, iolock);
                 enospc = xfs_inode_free_quota_eofblocks(ip);
                 if (enospc)
                         goto write_retry;
                 enospc = xfs_inode_free_quota_cowblocks(ip);
                 if (enospc)
                         goto write_retry;
+                iolock = 0;
         } else if (ret == -ENOSPC && !enospc) {
                 struct xfs_eofblocks eofb = {0};
 
                 enospc = 1;
                 xfs_flush_inodes(ip->i_mount);
-                eofb.eof_scan_owner = ip->i_ino; /* for locking */
+
+                xfs_iunlock(ip, iolock);
                 eofb.eof_flags = XFS_EOF_FLAGS_SYNC;
                 xfs_icache_free_eofblocks(ip->i_mount, &eofb);
                 goto write_retry;
@@ -660,7 +665,8 @@ write_retry:
 
         current->backing_dev_info = NULL;
 out:
-        xfs_iunlock(ip, iolock);
+        if (iolock)
+                xfs_iunlock(ip, iolock);
         return ret;
 }
 
@@ -908,9 +914,9 @@ xfs_dir_open(
          */
         mode = xfs_ilock_data_map_shared(ip);
         if (ip->i_d.di_nextents > 0)
-                xfs_dir3_data_readahead(ip, 0, -1);
+                error = xfs_dir3_data_readahead(ip, 0, -1);
         xfs_iunlock(ip, mode);
-        return 0;
+        return error;
 }
 
 STATIC int
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 242e8091296d..6ccaae9eb0ee 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -352,12 +352,7 @@ xfs_growfs_data_private(
                         goto error0;
                 }
 
-                if (xfs_sb_version_hascrc(&mp->m_sb))
-                        xfs_btree_init_block(mp, bp, XFS_ABTB_CRC_MAGIC, 0, 1,
-                                                agno, XFS_BTREE_CRC_BLOCKS);
-                else
-                        xfs_btree_init_block(mp, bp, XFS_ABTB_MAGIC, 0, 1,
-                                                agno, 0);
+                xfs_btree_init_block(mp, bp, XFS_BTNUM_BNO, 0, 1, agno, 0);
 
                 arec = XFS_ALLOC_REC_ADDR(mp, XFS_BUF_TO_BLOCK(bp), 1);
                 arec->ar_startblock = cpu_to_be32(mp->m_ag_prealloc_blocks);
@@ -381,12 +376,7 @@ xfs_growfs_data_private(
                         goto error0;
                 }
 
-                if (xfs_sb_version_hascrc(&mp->m_sb))
-                        xfs_btree_init_block(mp, bp, XFS_ABTC_CRC_MAGIC, 0, 1,
-                                                agno, XFS_BTREE_CRC_BLOCKS);
-                else
-                        xfs_btree_init_block(mp, bp, XFS_ABTC_MAGIC, 0, 1,
-                                                agno, 0);
+                xfs_btree_init_block(mp, bp, XFS_BTNUM_CNT, 0, 1, agno, 0);
 
                 arec = XFS_ALLOC_REC_ADDR(mp, XFS_BUF_TO_BLOCK(bp), 1);
                 arec->ar_startblock = cpu_to_be32(mp->m_ag_prealloc_blocks);
@@ -413,8 +403,8 @@ xfs_growfs_data_private(
                                 goto error0;
                         }
 
-                        xfs_btree_init_block(mp, bp, XFS_RMAP_CRC_MAGIC, 0, 0,
-                                                agno, XFS_BTREE_CRC_BLOCKS);
+                        xfs_btree_init_block(mp, bp, XFS_BTNUM_RMAP, 0, 0,
+                                                agno, 0);
                         block = XFS_BUF_TO_BLOCK(bp);
 
 
@@ -488,12 +478,7 @@ xfs_growfs_data_private(
                         goto error0;
                 }
 
-                if (xfs_sb_version_hascrc(&mp->m_sb))
-                        xfs_btree_init_block(mp, bp, XFS_IBT_CRC_MAGIC, 0, 0,
-                                                agno, XFS_BTREE_CRC_BLOCKS);
-                else
-                        xfs_btree_init_block(mp, bp, XFS_IBT_MAGIC, 0, 0,
-                                                agno, 0);
+                xfs_btree_init_block(mp, bp, XFS_BTNUM_INO , 0, 0, agno, 0);
 
                 error = xfs_bwrite(bp);
                 xfs_buf_relse(bp);
@@ -513,13 +498,8 @@ xfs_growfs_data_private(
                                 goto error0;
                         }
 
-                        if (xfs_sb_version_hascrc(&mp->m_sb))
-                                xfs_btree_init_block(mp, bp, XFS_FIBT_CRC_MAGIC,
-                                                     0, 0, agno,
-                                                     XFS_BTREE_CRC_BLOCKS);
-                        else
-                                xfs_btree_init_block(mp, bp, XFS_FIBT_MAGIC, 0,
-                                                     0, agno, 0);
+                        xfs_btree_init_block(mp, bp, XFS_BTNUM_FINO,
+                                                     0, 0, agno, 0);
 
                         error = xfs_bwrite(bp);
                         xfs_buf_relse(bp);
@@ -540,9 +520,8 @@ xfs_growfs_data_private(
                                 goto error0;
                         }
 
-                        xfs_btree_init_block(mp, bp, XFS_REFC_CRC_MAGIC,
-                                             0, 0, agno,
-                                             XFS_BTREE_CRC_BLOCKS);
+                        xfs_btree_init_block(mp, bp, XFS_BTNUM_REFC,
+                                             0, 0, agno, 0);
 
                         error = xfs_bwrite(bp);
                         xfs_buf_relse(bp);
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index 70ca4f608321..7234b9748c36 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -1322,13 +1322,10 @@ xfs_inode_free_eofblocks(
         int                     flags,
         void                    *args)
 {
-        int ret;
+        int ret = 0;
         struct xfs_eofblocks *eofb = args;
-        bool need_iolock = true;
         int match;
 
-        ASSERT(!eofb || (eofb && eofb->eof_scan_owner != 0));
-
         if (!xfs_can_free_eofblocks(ip, false)) {
                 /* inode could be preallocated or append-only */
                 trace_xfs_inode_free_eofblocks_invalid(ip);
@@ -1356,21 +1353,19 @@ xfs_inode_free_eofblocks(
                 if (eofb->eof_flags & XFS_EOF_FLAGS_MINFILESIZE &&
                     XFS_ISIZE(ip) < eofb->eof_min_file_size)
                         return 0;
-
-                /*
-                 * A scan owner implies we already hold the iolock. Skip it in
-                 * xfs_free_eofblocks() to avoid deadlock. This also eliminates
-                 * the possibility of EAGAIN being returned.
-                 */
-                if (eofb->eof_scan_owner == ip->i_ino)
-                        need_iolock = false;
         }
 
-        ret = xfs_free_eofblocks(ip->i_mount, ip, need_iolock);
-
-        /* don't revisit the inode if we're not waiting */
-        if (ret == -EAGAIN && !(flags & SYNC_WAIT))
-                ret = 0;
+        /*
+         * If the caller is waiting, return -EAGAIN to keep the background
+         * scanner moving and revisit the inode in a subsequent pass.
+         */
+        if (!xfs_ilock_nowait(ip, XFS_IOLOCK_EXCL)) {
+                if (flags & SYNC_WAIT)
+                        ret = -EAGAIN;
+                return ret;
+        }
+        ret = xfs_free_eofblocks(ip);
+        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
 
         return ret;
 }
@@ -1417,15 +1412,10 @@ __xfs_inode_free_quota_eofblocks(
         struct xfs_eofblocks eofb = {0};
         struct xfs_dquot *dq;
 
-        ASSERT(xfs_isilocked(ip, XFS_IOLOCK_EXCL));
-
         /*
-         * Set the scan owner to avoid a potential livelock. Otherwise, the scan
-         * can repeatedly trylock on the inode we're currently processing. We
-         * run a sync scan to increase effectiveness and use the union filter to
+         * Run a sync scan to increase effectiveness and use the union filter to
          * cover all applicable quotas in a single scan.
          */
-        eofb.eof_scan_owner = ip->i_ino;
         eofb.eof_flags = XFS_EOF_FLAGS_UNION|XFS_EOF_FLAGS_SYNC;
 
         if (XFS_IS_UQUOTA_ENFORCED(ip->i_mount)) {
@@ -1577,12 +1567,9 @@ xfs_inode_free_cowblocks(
 {
         int ret;
         struct xfs_eofblocks *eofb = args;
-        bool need_iolock = true;
         int match;
         struct xfs_ifork        *ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);
 
-        ASSERT(!eofb || (eofb && eofb->eof_scan_owner != 0));
-
         /*
          * Just clear the tag if we have an empty cow fork or none at all. It's
          * possible the inode was fully unshared since it was originally tagged.
@@ -1615,28 +1602,16 @@ xfs_inode_free_cowblocks(
                 if (eofb->eof_flags & XFS_EOF_FLAGS_MINFILESIZE &&
                     XFS_ISIZE(ip) < eofb->eof_min_file_size)
                         return 0;
-
-                /*
-                 * A scan owner implies we already hold the iolock. Skip it in
-                 * xfs_free_eofblocks() to avoid deadlock. This also eliminates
-                 * the possibility of EAGAIN being returned.
-                 */
-                if (eofb->eof_scan_owner == ip->i_ino)
-                        need_iolock = false;
         }
 
         /* Free the CoW blocks */
-        if (need_iolock) {
-                xfs_ilock(ip, XFS_IOLOCK_EXCL);
-                xfs_ilock(ip, XFS_MMAPLOCK_EXCL);
-        }
+        xfs_ilock(ip, XFS_IOLOCK_EXCL);
+        xfs_ilock(ip, XFS_MMAPLOCK_EXCL);
 
         ret = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF);
 
-        if (need_iolock) {
-                xfs_iunlock(ip, XFS_MMAPLOCK_EXCL);
-                xfs_iunlock(ip, XFS_IOLOCK_EXCL);
-        }
+        xfs_iunlock(ip, XFS_MMAPLOCK_EXCL);
+        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
 
         return ret;
 }
diff --git a/fs/xfs/xfs_icache.h b/fs/xfs/xfs_icache.h
index a1e02f4708ab..8a7c849b4dea 100644
--- a/fs/xfs/xfs_icache.h
+++ b/fs/xfs/xfs_icache.h
@@ -27,7 +27,6 @@ struct xfs_eofblocks {
         kgid_t          eof_gid;
         prid_t          eof_prid;
         __u64           eof_min_file_size;
-        xfs_ino_t       eof_scan_owner;
 };
 
 #define SYNC_WAIT               0x0001  /* wait for i/o to complete */
@@ -102,7 +101,6 @@ xfs_fs_eofblocks_from_user(
         dst->eof_flags = src->eof_flags;
         dst->eof_prid = src->eof_prid;
         dst->eof_min_file_size = src->eof_min_file_size;
-        dst->eof_scan_owner = NULLFSINO;
 
         dst->eof_uid = INVALID_UID;
         if (src->eof_flags & XFS_EOF_FLAGS_UID) {
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index de32f0fe47c8..edfa6a55b064 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1692,32 +1692,34 @@ xfs_release(
         if (xfs_can_free_eofblocks(ip, false)) {
 
                 /*
+                 * Check if the inode is being opened, written and closed
+                 * frequently and we have delayed allocation blocks outstanding
+                 * (e.g. streaming writes from the NFS server), truncating the
+                 * blocks past EOF will cause fragmentation to occur.
+                 *
+                 * In this case don't do the truncation, but we have to be
+                 * careful how we detect this case. Blocks beyond EOF show up as
+                 * i_delayed_blks even when the inode is clean, so we need to
+                 * truncate them away first before checking for a dirty release.
+                 * Hence on the first dirty close we will still remove the
+                 * speculative allocation, but after that we will leave it in
+                 * place.
+                 */
+                if (xfs_iflags_test(ip, XFS_IDIRTY_RELEASE))
+                        return 0;
+                /*
                  * If we can't get the iolock just skip truncating the blocks
                  * past EOF because we could deadlock with the mmap_sem
-                 * otherwise.  We'll get another chance to drop them once the
+                 * otherwise. We'll get another chance to drop them once the
                  * last reference to the inode is dropped, so we'll never leak
                  * blocks permanently.
-                 *
-                 * Further, check if the inode is being opened, written and
-                 * closed frequently and we have delayed allocation blocks
-                 * outstanding (e.g. streaming writes from the NFS server),
-                 * truncating the blocks past EOF will cause fragmentation to
-                 * occur.
-                 *
-                 * In this case don't do the truncation, either, but we have to
-                 * be careful how we detect this case. Blocks beyond EOF show
-                 * up as i_delayed_blks even when the inode is clean, so we
-                 * need to truncate them away first before checking for a dirty
-                 * release. Hence on the first dirty close we will still remove
-                 * the speculative allocation, but after that we will leave it
-                 * in place.
                  */
-                if (xfs_iflags_test(ip, XFS_IDIRTY_RELEASE))
-                        return 0;
-
-                error = xfs_free_eofblocks(mp, ip, true);
-                if (error && error != -EAGAIN)
-                        return error;
+                if (xfs_ilock_nowait(ip, XFS_IOLOCK_EXCL)) {
+                        error = xfs_free_eofblocks(ip);
+                        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
+                        if (error)
+                                return error;
+                }
 
                 /* delalloc blocks after truncation means it really is dirty */
                 if (ip->i_delayed_blks)
@@ -1904,8 +1906,11 @@ xfs_inactive(
                  * cache. Post-eof blocks must be freed, lest we end up with
                  * broken free space accounting.
                  */
-                if (xfs_can_free_eofblocks(ip, true))
-                        xfs_free_eofblocks(mp, ip, false);
+                if (xfs_can_free_eofblocks(ip, true)) {
+                        xfs_ilock(ip, XFS_IOLOCK_EXCL);
+                        xfs_free_eofblocks(ip);
+                        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
+                }
 
                 return;
         }
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index c67cfb451fd3..cf1363dbf32b 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -1524,7 +1524,7 @@ out_drop_write:
 }
 
 STATIC int
-xfs_getbmap_format(void **ap, struct getbmapx *bmv, int *full)
+xfs_getbmap_format(void **ap, struct getbmapx *bmv)
 {
         struct getbmap __user   *base = (struct getbmap __user *)*ap;
 
@@ -1567,7 +1567,7 @@ xfs_ioc_getbmap(
 }
 
 STATIC int
-xfs_getbmapx_format(void **ap, struct getbmapx *bmv, int *full)
+xfs_getbmapx_format(void **ap, struct getbmapx *bmv)
 {
         struct getbmapx __user  *base = (struct getbmapx __user *)*ap;
 
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 1aa3abd67b36..41662fb14e87 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -162,7 +162,7 @@ xfs_iomap_write_direct(
         xfs_fileoff_t   last_fsb;
         xfs_filblks_t   count_fsb, resaligned;
         xfs_fsblock_t   firstfsb;
-        xfs_extlen_t    extsz, temp;
+        xfs_extlen_t    extsz;
         int             nimaps;
         int             quota_flag;
         int             rt;
@@ -203,14 +203,7 @@ xfs_iomap_write_direct(
         }
         count_fsb = last_fsb - offset_fsb;
         ASSERT(count_fsb > 0);
-
-        resaligned = count_fsb;
-        if (unlikely(extsz)) {
-                if ((temp = do_mod(offset_fsb, extsz)))
-                        resaligned += temp;
-                if ((temp = do_mod(resaligned, extsz)))
-                        resaligned += extsz - temp;
-        }
+        resaligned = xfs_aligned_fsb_count(offset_fsb, count_fsb, extsz);
 
         if (unlikely(rt)) {
                 resrtextents = qblocks = resaligned;
@@ -685,7 +678,7 @@ xfs_iomap_write_allocate(
         int             nres;
 
         if (whichfork == XFS_COW_FORK)
-                flags |= XFS_BMAPI_COWFORK;
+                flags |= XFS_BMAPI_COWFORK | XFS_BMAPI_PREALLOC;
 
         /*
          * Make sure that the dquots are there.
@@ -1002,47 +995,31 @@ xfs_file_iomap_begin(
         offset_fsb = XFS_B_TO_FSBT(mp, offset);
         end_fsb = XFS_B_TO_FSB(mp, offset + length);
 
-        if (xfs_is_reflink_inode(ip) &&
-            (flags & IOMAP_WRITE) && (flags & IOMAP_DIRECT)) {
-                shared = xfs_reflink_find_cow_mapping(ip, offset, &imap);
-                if (shared) {
-                        xfs_iunlock(ip, lockmode);
-                        goto alloc_done;
-                }
-                ASSERT(!isnullstartblock(imap.br_startblock));
-        }
-
         error = xfs_bmapi_read(ip, offset_fsb, end_fsb - offset_fsb, &imap,
                                &nimaps, 0);
         if (error)
                 goto out_unlock;
 
-        if ((flags & IOMAP_REPORT) ||
-            (xfs_is_reflink_inode(ip) &&
-             (flags & IOMAP_WRITE) && (flags & IOMAP_DIRECT))) {
+        if (flags & IOMAP_REPORT) {
                 /* Trim the mapping to the nearest shared extent boundary. */
                 error = xfs_reflink_trim_around_shared(ip, &imap, &shared,
                                 &trimmed);
                 if (error)
                         goto out_unlock;
-
-                /*
-                 * We're here because we're trying to do a directio write to a
-                 * region that isn't aligned to a filesystem block.  If the
-                 * extent is shared, fall back to buffered mode to handle the
-                 * RMW.
-                 */
-                if (!(flags & IOMAP_REPORT) && shared) {
-                        trace_xfs_reflink_bounce_dio_write(ip, &imap);
-                        error = -EREMCHG;
-                        goto out_unlock;
-                }
         }
 
         if ((flags & (IOMAP_WRITE | IOMAP_ZERO)) && xfs_is_reflink_inode(ip)) {
-                error = xfs_reflink_reserve_cow(ip, &imap, &shared);
-                if (error)
-                        goto out_unlock;
+                if (flags & IOMAP_DIRECT) {
+                        /* may drop and re-acquire the ilock */
+                        error = xfs_reflink_allocate_cow(ip, &imap, &shared,
+                                        &lockmode);
+                        if (error)
+                                goto out_unlock;
+                } else {
+                        error = xfs_reflink_reserve_cow(ip, &imap, &shared);
+                        if (error)
+                                goto out_unlock;
+                }
 
                 end_fsb = imap.br_startoff + imap.br_blockcount;
                 length = XFS_FSB_TO_B(mp, end_fsb) - offset;
@@ -1071,7 +1048,6 @@ xfs_file_iomap_begin(
                 if (error)
                         return error;
 
-alloc_done:
                 iomap->flags = IOMAP_F_NEW;
                 trace_xfs_iomap_alloc(ip, offset, length, 0, &imap);
         } else {
@@ -1102,7 +1078,19 @@ xfs_file_iomap_end_delalloc(
         xfs_fileoff_t           end_fsb;
         int                     error = 0;
 
-        start_fsb = XFS_B_TO_FSB(mp, offset + written);
+        /* behave as if the write failed if drop writes is enabled */
+        if (xfs_mp_drop_writes(mp))
+                written = 0;
+
+        /*
+         * start_fsb refers to the first unused block after a short write. If
+         * nothing was written, round offset down to point at the first block in
+         * the range.
+         */
+        if (unlikely(!written))
+                start_fsb = XFS_B_TO_FSBT(mp, offset);
+        else
+                start_fsb = XFS_B_TO_FSB(mp, offset + written);
         end_fsb = XFS_B_TO_FSB(mp, offset + length);
 
         /*
@@ -1114,6 +1102,9 @@ xfs_file_iomap_end_delalloc(
          * blocks in the range, they are ours.
          */
         if (start_fsb < end_fsb) {
+                truncate_pagecache_range(VFS_I(ip), XFS_FSB_TO_B(mp, start_fsb),
+                                         XFS_FSB_TO_B(mp, end_fsb) - 1);
+
                 xfs_ilock(ip, XFS_ILOCK_EXCL);
                 error = xfs_bmap_punch_delalloc_range(ip, start_fsb,
                                                end_fsb - start_fsb);
@@ -1144,7 +1135,7 @@ xfs_file_iomap_end(
         return 0;
 }
 
-struct iomap_ops xfs_iomap_ops = {
+const struct iomap_ops xfs_iomap_ops = {
         .iomap_begin            = xfs_file_iomap_begin,
         .iomap_end              = xfs_file_iomap_end,
 };
@@ -1190,6 +1181,6 @@ out_unlock:
         return error;
 }
 
-struct iomap_ops xfs_xattr_iomap_ops = {
+const struct iomap_ops xfs_xattr_iomap_ops = {
         .iomap_begin            = xfs_xattr_iomap_begin,
 };
diff --git a/fs/xfs/xfs_iomap.h b/fs/xfs/xfs_iomap.h
index 6d45cf01fcff..00db3ecea084 100644
--- a/fs/xfs/xfs_iomap.h
+++ b/fs/xfs/xfs_iomap.h
@@ -33,7 +33,27 @@ void xfs_bmbt_to_iomap(struct xfs_inode *, struct iomap *,
                 struct xfs_bmbt_irec *);
 xfs_extlen_t xfs_eof_alignment(struct xfs_inode *ip, xfs_extlen_t extsize);
 
-extern struct iomap_ops xfs_iomap_ops;
-extern struct iomap_ops xfs_xattr_iomap_ops;
+static inline xfs_filblks_t
+xfs_aligned_fsb_count(
+        xfs_fileoff_t           offset_fsb,
+        xfs_filblks_t           count_fsb,
+        xfs_extlen_t            extsz)
+{
+        if (extsz) {
+                xfs_extlen_t    align;
+
+                align = do_mod(offset_fsb, extsz);
+                if (align)
+                        count_fsb += align;
+                align = do_mod(count_fsb, extsz);
+                if (align)
+                        count_fsb += extsz - align;
+        }
+
+        return count_fsb;
+}
+
+extern const struct iomap_ops xfs_iomap_ops;
+extern const struct iomap_ops xfs_xattr_iomap_ops;
 
 #endif /* __XFS_IOMAP_H__*/
diff --git a/fs/xfs/xfs_log.h b/fs/xfs/xfs_log.h
index b5e71072fde5..cc5a9f1574e7 100644
--- a/fs/xfs/xfs_log.h
+++ b/fs/xfs/xfs_log.h
@@ -124,7 +124,6 @@ struct xlog_ticket;
 struct xfs_log_item;
 struct xfs_item_ops;
 struct xfs_trans;
-struct xfs_log_callback;
 
 xfs_lsn_t xfs_log_done(struct xfs_mount *mp,
                        struct xlog_ticket *ticket,
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index a4ab192e1792..82f1cbcc4de1 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -30,6 +30,9 @@
 #include "xfs_trans_priv.h"
 #include "xfs_log.h"
 #include "xfs_log_priv.h"
+#include "xfs_trace.h"
+
+struct workqueue_struct *xfs_discard_wq;
 
 /*
  * Allocate a new ticket. Failing to get a new ticket makes it really hard to
@@ -491,6 +494,75 @@ xlog_cil_free_logvec(
         }
 }
 
+static void
+xlog_discard_endio_work(
+        struct work_struct      *work)
+{
+        struct xfs_cil_ctx      *ctx =
+                container_of(work, struct xfs_cil_ctx, discard_endio_work);
+        struct xfs_mount        *mp = ctx->cil->xc_log->l_mp;
+
+        xfs_extent_busy_clear(mp, &ctx->busy_extents, false);
+        kmem_free(ctx);
+}
+
+/*
+ * Queue up the actual completion to a thread to avoid IRQ-safe locking for
+ * pagb_lock.  Note that we need a unbounded workqueue, otherwise we might
+ * get the execution delayed up to 30 seconds for weird reasons.
+ */
+static void
+xlog_discard_endio(
+        struct bio              *bio)
+{
+        struct xfs_cil_ctx      *ctx = bio->bi_private;
+
+        INIT_WORK(&ctx->discard_endio_work, xlog_discard_endio_work);
+        queue_work(xfs_discard_wq, &ctx->discard_endio_work);
+}
+
+static void
+xlog_discard_busy_extents(
+        struct xfs_mount        *mp,
+        struct xfs_cil_ctx      *ctx)
+{
+        struct list_head        *list = &ctx->busy_extents;
+        struct xfs_extent_busy  *busyp;
+        struct bio              *bio = NULL;
+        struct blk_plug         plug;
+        int                     error = 0;
+
+        ASSERT(mp->m_flags & XFS_MOUNT_DISCARD);
+
+        blk_start_plug(&plug);
+        list_for_each_entry(busyp, list, list) {
+                trace_xfs_discard_extent(mp, busyp->agno, busyp->bno,
+                                         busyp->length);
+
+                error = __blkdev_issue_discard(mp->m_ddev_targp->bt_bdev,
+                                XFS_AGB_TO_DADDR(mp, busyp->agno, busyp->bno),
+                                XFS_FSB_TO_BB(mp, busyp->length),
+                                GFP_NOFS, 0, &bio);
+                if (error && error != -EOPNOTSUPP) {
+                        xfs_info(mp,
+         "discard failed for extent [0x%llx,%u], error %d",
+                                 (unsigned long long)busyp->bno,
+                                 busyp->length,
+                                 error);
+                        break;
+                }
+        }
+
+        if (bio) {
+                bio->bi_private = ctx;
+                bio->bi_end_io = xlog_discard_endio;
+                submit_bio(bio);
+        } else {
+                xlog_discard_endio_work(&ctx->discard_endio_work);
+        }
+        blk_finish_plug(&plug);
+}
+
 /*
  * Mark all items committed and clear busy extents. We free the log vector
  * chains in a separate pass so that we unpin the log items as quickly as
@@ -525,14 +597,10 @@ xlog_cil_committed(
 
         xlog_cil_free_logvec(ctx->lv_chain);
 
-        if (!list_empty(&ctx->busy_extents)) {
-                ASSERT(mp->m_flags & XFS_MOUNT_DISCARD);
-
-                xfs_discard_extents(mp, &ctx->busy_extents);
-                xfs_extent_busy_clear(mp, &ctx->busy_extents, false);
-        }
-
-        kmem_free(ctx);
+        if (!list_empty(&ctx->busy_extents))
+                xlog_discard_busy_extents(mp, ctx);
+        else
+                kmem_free(ctx);
 }
 
 /*
diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
index 2b6eec52178e..c2604a5366f2 100644
--- a/fs/xfs/xfs_log_priv.h
+++ b/fs/xfs/xfs_log_priv.h
@@ -257,6 +257,7 @@ struct xfs_cil_ctx {
         struct xfs_log_vec      *lv_chain;      /* logvecs being pushed */
         struct xfs_log_callback log_cb;         /* completion callback hook. */
         struct list_head        committing;     /* ctx committing list */
+        struct work_struct      discard_endio_work;
 };
 
 /*
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 9b9540db17a6..450bde68bb75 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -45,6 +45,7 @@
 #include "xfs_rmap_btree.h"
 #include "xfs_refcount_btree.h"
 #include "xfs_reflink.h"
+#include "xfs_extent_busy.h"
 
 
 static DEFINE_MUTEX(xfs_uuid_table_mutex);
@@ -187,7 +188,7 @@ xfs_initialize_perag(
         xfs_agnumber_t  *maxagi)
 {
         xfs_agnumber_t  index;
-        xfs_agnumber_t  first_initialised = 0;
+        xfs_agnumber_t  first_initialised = NULLAGNUMBER;
         xfs_perag_t     *pag;
         int             error = -ENOMEM;
 
@@ -202,22 +203,21 @@ xfs_initialize_perag(
                         xfs_perag_put(pag);
                         continue;
                 }
-                if (!first_initialised)
-                        first_initialised = index;
 
                 pag = kmem_zalloc(sizeof(*pag), KM_MAYFAIL);
                 if (!pag)
-                        goto out_unwind;
+                        goto out_unwind_new_pags;
                 pag->pag_agno = index;
                 pag->pag_mount = mp;
                 spin_lock_init(&pag->pag_ici_lock);
                 mutex_init(&pag->pag_ici_reclaim_lock);
                 INIT_RADIX_TREE(&pag->pag_ici_root, GFP_ATOMIC);
                 if (xfs_buf_hash_init(pag))
-                        goto out_unwind;
+                        goto out_free_pag;
+                init_waitqueue_head(&pag->pagb_wait);
 
                 if (radix_tree_preload(GFP_NOFS))
-                        goto out_unwind;
+                        goto out_hash_destroy;
 
                 spin_lock(&mp->m_perag_lock);
                 if (radix_tree_insert(&mp->m_perag_tree, index, pag)) {
@@ -225,10 +225,13 @@ xfs_initialize_perag(
                         spin_unlock(&mp->m_perag_lock);
                         radix_tree_preload_end();
                         error = -EEXIST;
-                        goto out_unwind;
+                        goto out_hash_destroy;
                 }
                 spin_unlock(&mp->m_perag_lock);
                 radix_tree_preload_end();
+                /* first new pag is fully initialized */
+                if (first_initialised == NULLAGNUMBER)
+                        first_initialised = index;
         }
 
         index = xfs_set_inode_alloc(mp, agcount);
@@ -239,11 +242,16 @@ xfs_initialize_perag(
         mp->m_ag_prealloc_blocks = xfs_prealloc_blocks(mp);
         return 0;
 
-out_unwind:
+out_hash_destroy:
         xfs_buf_hash_destroy(pag);
+out_free_pag:
         kmem_free(pag);
-        for (; index > first_initialised; index--) {
+out_unwind_new_pags:
+        /* unwind any prior newly initialized pags */
+        for (index = first_initialised; index < agcount; index++) {
                 pag = radix_tree_delete(&mp->m_perag_tree, index);
+                if (!pag)
+                        break;
                 xfs_buf_hash_destroy(pag);
                 kmem_free(pag);
         }
@@ -1073,6 +1081,13 @@ xfs_unmountfs(
         xfs_log_force(mp, XFS_LOG_SYNC);
 
         /*
+         * Wait for all busy extents to be freed, including completion of
+         * any discard operation.
+         */
+        xfs_extent_busy_wait_all(mp);
+        flush_workqueue(xfs_discard_wq);
+
+        /*
          * We now need to tell the world we are unmounting. This will allow
          * us to detect that the filesystem is going away and we should error
          * out anything that we have been retrying in the background. This will
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index 7f351f706b7a..6db6fd6b82b0 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -200,11 +200,12 @@ typedef struct xfs_mount {
         /*
          * DEBUG mode instrumentation to test and/or trigger delayed allocation
          * block killing in the event of failed writes. When enabled, all
-         * buffered writes are forced to fail. All delalloc blocks in the range
-         * of the write (including pre-existing delalloc blocks!) are tossed as
-         * part of the write failure error handling sequence.
+         * buffered writes are silenty dropped and handled as if they failed.
+         * All delalloc blocks in the range of the write (including pre-existing
+         * delalloc blocks!) are tossed as part of the write failure error
+         * handling sequence.
          */
-        bool                    m_fail_writes;
+        bool                    m_drop_writes;
 #endif
 } xfs_mount_t;
 
@@ -325,13 +326,13 @@ xfs_daddr_to_agbno(struct xfs_mount *mp, xfs_daddr_t d)
 
 #ifdef DEBUG
 static inline bool
-xfs_mp_fail_writes(struct xfs_mount *mp)
+xfs_mp_drop_writes(struct xfs_mount *mp)
 {
-        return mp->m_fail_writes;
+        return mp->m_drop_writes;
 }
 #else
 static inline bool
-xfs_mp_fail_writes(struct xfs_mount *mp)
+xfs_mp_drop_writes(struct xfs_mount *mp)
 {
         return 0;
 }
@@ -384,6 +385,8 @@ typedef struct xfs_perag {
         xfs_agino_t     pagl_rightrec;
         spinlock_t      pagb_lock;      /* lock for pagb_tree */
         struct rb_root  pagb_tree;      /* ordered tree of busy extents */
+        unsigned int    pagb_gen;       /* generation count for pagb_tree */
+        wait_queue_head_t pagb_wait;    /* woken when pagb_gen changes */
 
         atomic_t        pagf_fstrms;    /* # of filestreams active in this AG */
 
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index 07593a362cd0..da6d08fb359c 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -82,11 +82,22 @@
  * mappings are a reservation against the free space in the filesystem;
  * adjacent mappings can also be combined into fewer larger mappings.
  *
+ * As an optimization, the CoW extent size hint (cowextsz) creates
+ * outsized aligned delalloc reservations in the hope of landing out of
+ * order nearby CoW writes in a single extent on disk, thereby reducing
+ * fragmentation and improving future performance.
+ *
+ * D: --RRRRRRSSSRRRRRRRR--- (data fork)
+ * C: ------DDDDDDD--------- (CoW fork)
+ *
  * When dirty pages are being written out (typically in writepage), the
- * delalloc reservations are converted into real mappings by allocating
- * blocks and replacing the delalloc mapping with real ones.  A delalloc
- * mapping can be replaced by several real ones if the free space is
- * fragmented.
+ * delalloc reservations are converted into unwritten mappings by
+ * allocating blocks and replacing the delalloc mapping with real ones.
+ * A delalloc mapping can be replaced by several unwritten ones if the
+ * free space is fragmented.
+ *
+ * D: --RRRRRRSSSRRRRRRRR---
+ * C: ------UUUUUUU---------
  *
  * We want to adapt the delalloc mechanism for copy-on-write, since the
  * write paths are similar.  The first two steps (creating the reservation
@@ -101,13 +112,29 @@
  * Block-aligned directio writes will use the same mechanism as buffered
  * writes.
  *
+ * Just prior to submitting the actual disk write requests, we convert
+ * the extents representing the range of the file actually being written
+ * (as opposed to extra pieces created for the cowextsize hint) to real
+ * extents.  This will become important in the next step:
+ *
+ * D: --RRRRRRSSSRRRRRRRR---
+ * C: ------UUrrUUU---------
+ *
  * CoW remapping must be done after the data block write completes,
  * because we don't want to destroy the old data fork map until we're sure
  * the new block has been written.  Since the new mappings are kept in a
  * separate fork, we can simply iterate these mappings to find the ones
  * that cover the file blocks that we just CoW'd.  For each extent, simply
  * unmap the corresponding range in the data fork, map the new range into
- * the data fork, and remove the extent from the CoW fork.
+ * the data fork, and remove the extent from the CoW fork.  Because of
+ * the presence of the cowextsize hint, however, we must be careful
+ * only to remap the blocks that we've actually written out --  we must
+ * never remap delalloc reservations nor CoW staging blocks that have
+ * yet to be written.  This corresponds exactly to the real extents in
+ * the CoW fork:
+ *
+ * D: --RRRRRRrrSRRRRRRRR---
+ * C: ------UU--UUU---------
  *
  * Since the remapping operation can be applied to an arbitrary file
  * range, we record the need for the remap step as a flag in the ioend
@@ -296,103 +323,165 @@ xfs_reflink_reserve_cow(
         return 0;
 }
 
-/* Allocate all CoW reservations covering a range of blocks in a file. */
-static int
-__xfs_reflink_allocate_cow(
-        struct xfs_inode        *ip,
-        xfs_fileoff_t           *offset_fsb,
-        xfs_fileoff_t           end_fsb)
+/* Convert part of an unwritten CoW extent to a real one. */
+STATIC int
+xfs_reflink_convert_cow_extent(
+        struct xfs_inode                *ip,
+        struct xfs_bmbt_irec            *imap,
+        xfs_fileoff_t                   offset_fsb,
+        xfs_filblks_t                   count_fsb,
+        struct xfs_defer_ops            *dfops)
 {
-        struct xfs_mount        *mp = ip->i_mount;
-        struct xfs_bmbt_irec    imap;
-        struct xfs_defer_ops    dfops;
-        struct xfs_trans        *tp;
-        xfs_fsblock_t           first_block;
-        int                     nimaps = 1, error;
-        bool                    shared;
-
-        xfs_defer_init(&dfops, &first_block);
+        xfs_fsblock_t                   first_block;
+        int                             nimaps = 1;
 
-        error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, 0, 0,
-                        XFS_TRANS_RESERVE, &tp);
-        if (error)
-                return error;
+        if (imap->br_state == XFS_EXT_NORM)
+                return 0;
 
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        xfs_trim_extent(imap, offset_fsb, count_fsb);
+        trace_xfs_reflink_convert_cow(ip, imap);
+        if (imap->br_blockcount == 0)
+                return 0;
+        return xfs_bmapi_write(NULL, ip, imap->br_startoff, imap->br_blockcount,
+                        XFS_BMAPI_COWFORK | XFS_BMAPI_CONVERT, &first_block,
+                        0, imap, &nimaps, dfops);
+}
 
-        /* Read extent from the source file. */
-        nimaps = 1;
-        error = xfs_bmapi_read(ip, *offset_fsb, end_fsb - *offset_fsb,
-                        &imap, &nimaps, 0);
-        if (error)
-                goto out_unlock;
-        ASSERT(nimaps == 1);
+/* Convert all of the unwritten CoW extents in a file's range to real ones. */
+int
+xfs_reflink_convert_cow(
+        struct xfs_inode        *ip,
+        xfs_off_t               offset,
+        xfs_off_t               count)
+{
+        struct xfs_bmbt_irec    got;
+        struct xfs_defer_ops    dfops;
+        struct xfs_mount        *mp = ip->i_mount;
+        struct xfs_ifork        *ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);
+        xfs_fileoff_t           offset_fsb = XFS_B_TO_FSBT(mp, offset);
+        xfs_fileoff_t           end_fsb = XFS_B_TO_FSB(mp, offset + count);
+        xfs_extnum_t            idx;
+        bool                    found;
+        int                     error = 0;
 
-        error = xfs_reflink_reserve_cow(ip, &imap, &shared);
-        if (error)
-                goto out_trans_cancel;
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
 
-        if (!shared) {
-                *offset_fsb = imap.br_startoff + imap.br_blockcount;
-                goto out_trans_cancel;
+        /* Convert all the extents to real from unwritten. */
+        for (found = xfs_iext_lookup_extent(ip, ifp, offset_fsb, &idx, &got);
+             found && got.br_startoff < end_fsb;
+             found = xfs_iext_get_extent(ifp, ++idx, &got)) {
+                error = xfs_reflink_convert_cow_extent(ip, &got, offset_fsb,
+                                end_fsb - offset_fsb, &dfops);
+                if (error)
+                        break;
         }
 
-        xfs_trans_ijoin(tp, ip, 0);
-        error = xfs_bmapi_write(tp, ip, imap.br_startoff, imap.br_blockcount,
-                        XFS_BMAPI_COWFORK, &first_block,
-                        XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK),
-                        &imap, &nimaps, &dfops);
-        if (error)
-                goto out_trans_cancel;
-
-        error = xfs_defer_finish(&tp, &dfops, NULL);
-        if (error)
-                goto out_trans_cancel;
-
-        error = xfs_trans_commit(tp);
-
-        *offset_fsb = imap.br_startoff + imap.br_blockcount;
-out_unlock:
+        /* Finish up. */
         xfs_iunlock(ip, XFS_ILOCK_EXCL);
         return error;
-out_trans_cancel:
-        xfs_defer_cancel(&dfops);
-        xfs_trans_cancel(tp);
-        goto out_unlock;
 }
 
-/* Allocate all CoW reservations covering a part of a file. */
+/* Allocate all CoW reservations covering a range of blocks in a file. */
 int
-xfs_reflink_allocate_cow_range(
+xfs_reflink_allocate_cow(
         struct xfs_inode        *ip,
-        xfs_off_t               offset,
-        xfs_off_t               count)
+        struct xfs_bmbt_irec    *imap,
+        bool                    *shared,
+        uint                    *lockmode)
 {
         struct xfs_mount        *mp = ip->i_mount;
-        xfs_fileoff_t           offset_fsb = XFS_B_TO_FSBT(mp, offset);
-        xfs_fileoff_t           end_fsb = XFS_B_TO_FSB(mp, offset + count);
-        int                     error;
+        xfs_fileoff_t           offset_fsb = imap->br_startoff;
+        xfs_filblks_t           count_fsb = imap->br_blockcount;
+        struct xfs_bmbt_irec    got;
+        struct xfs_defer_ops    dfops;
+        struct xfs_trans        *tp = NULL;
+        xfs_fsblock_t           first_block;
+        int                     nimaps, error = 0;
+        bool                    trimmed;
+        xfs_filblks_t           resaligned;
+        xfs_extlen_t            resblks = 0;
+        xfs_extnum_t            idx;
 
+retry:
         ASSERT(xfs_is_reflink_inode(ip));
-
-        trace_xfs_reflink_allocate_cow_range(ip, offset, count);
+        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL | XFS_ILOCK_SHARED));
 
         /*
-         * Make sure that the dquots are there.
+         * Even if the extent is not shared we might have a preallocation for
+         * it in the COW fork.  If so use it.
          */
-        error = xfs_qm_dqattach(ip, 0);
-        if (error)
-                return error;
+        if (xfs_iext_lookup_extent(ip, ip->i_cowfp, offset_fsb, &idx, &got) &&
+            got.br_startoff <= offset_fsb) {
+                *shared = true;
 
-        while (offset_fsb < end_fsb) {
-                error = __xfs_reflink_allocate_cow(ip, &offset_fsb, end_fsb);
-                if (error) {
-                        trace_xfs_reflink_allocate_cow_range_error(ip, error,
-                                        _RET_IP_);
-                        break;
+                /* If we have a real allocation in the COW fork we're done. */
+                if (!isnullstartblock(got.br_startblock)) {
+                        xfs_trim_extent(&got, offset_fsb, count_fsb);
+                        *imap = got;
+                        goto convert;
                 }
+
+                xfs_trim_extent(imap, got.br_startoff, got.br_blockcount);
+        } else {
+                error = xfs_reflink_trim_around_shared(ip, imap, shared, &trimmed);
+                if (error || !*shared)
+                        goto out;
+        }
+
+        if (!tp) {
+                resaligned = xfs_aligned_fsb_count(imap->br_startoff,
+                        imap->br_blockcount, xfs_get_cowextsz_hint(ip));
+                resblks = XFS_DIOSTRAT_SPACE_RES(mp, resaligned);
+
+                xfs_iunlock(ip, *lockmode);
+                error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, resblks, 0, 0, &tp);
+                *lockmode = XFS_ILOCK_EXCL;
+                xfs_ilock(ip, *lockmode);
+
+                if (error)
+                        return error;
+
+                error = xfs_qm_dqattach_locked(ip, 0);
+                if (error)
+                        goto out;
+                goto retry;
         }
 
+        error = xfs_trans_reserve_quota_nblks(tp, ip, resblks, 0,
+                        XFS_QMOPT_RES_REGBLKS);
+        if (error)
+                goto out;
+
+        xfs_trans_ijoin(tp, ip, 0);
+
+        xfs_defer_init(&dfops, &first_block);
+        nimaps = 1;
+
+        /* Allocate the entire reservation as unwritten blocks. */
+        error = xfs_bmapi_write(tp, ip, imap->br_startoff, imap->br_blockcount,
+                        XFS_BMAPI_COWFORK | XFS_BMAPI_PREALLOC, &first_block,
+                        resblks, imap, &nimaps, &dfops);
+        if (error)
+                goto out_bmap_cancel;
+
+        /* Finish up. */
+        error = xfs_defer_finish(&tp, &dfops, NULL);
+        if (error)
+                goto out_bmap_cancel;
+
+        error = xfs_trans_commit(tp);
+        if (error)
+                return error;
+convert:
+        return xfs_reflink_convert_cow_extent(ip, imap, offset_fsb, count_fsb,
+                        &dfops);
+out_bmap_cancel:
+        xfs_defer_cancel(&dfops);
+        xfs_trans_unreserve_quota_nblks(tp, ip, (long)resblks, 0,
+                        XFS_QMOPT_RES_REGBLKS);
+out:
+        if (tp)
+                xfs_trans_cancel(tp);
         return error;
 }
 
@@ -641,6 +730,16 @@ xfs_reflink_end_cow(
 
                 ASSERT(!isnullstartblock(got.br_startblock));
 
+                /*
+                 * Don't remap unwritten extents; these are
+                 * speculatively preallocated CoW extents that have been
+                 * allocated but have not yet been involved in a write.
+                 */
+                if (got.br_state == XFS_EXT_UNWRITTEN) {
+                        idx--;
+                        goto next_extent;
+                }
+
                 /* Unmap the old blocks in the data fork. */
                 xfs_defer_init(&dfops, &firstfsb);
                 rlen = del.br_blockcount;
@@ -855,13 +954,14 @@ STATIC int
 xfs_reflink_update_dest(
         struct xfs_inode        *dest,
         xfs_off_t               newlen,
-        xfs_extlen_t            cowextsize)
+        xfs_extlen_t            cowextsize,
+        bool                    is_dedupe)
 {
         struct xfs_mount        *mp = dest->i_mount;
         struct xfs_trans        *tp;
         int                     error;
 
-        if (newlen <= i_size_read(VFS_I(dest)) && cowextsize == 0)
+        if (is_dedupe && newlen <= i_size_read(VFS_I(dest)) && cowextsize == 0)
                 return 0;
 
         error = xfs_trans_alloc(mp, &M_RES(mp)->tr_ichange, 0, 0, 0, &tp);
@@ -882,6 +982,10 @@ xfs_reflink_update_dest(
                 dest->i_d.di_flags2 |= XFS_DIFLAG2_COWEXTSIZE;
         }
 
+        if (!is_dedupe) {
+                xfs_trans_ichgtime(tp, dest,
+                                   XFS_ICHGTIME_MOD | XFS_ICHGTIME_CHG);
+        }
         xfs_trans_log_inode(tp, dest, XFS_ILOG_CORE);
 
         error = xfs_trans_commit(tp);
@@ -1195,7 +1299,8 @@ xfs_reflink_remap_range(
             !(dest->i_d.di_flags2 & XFS_DIFLAG2_COWEXTSIZE))
                 cowextsize = src->i_d.di_cowextsize;
 
-        ret = xfs_reflink_update_dest(dest, pos_out + len, cowextsize);
+        ret = xfs_reflink_update_dest(dest, pos_out + len, cowextsize,
+                        is_dedupe);
 
 out_unlock:
         xfs_iunlock(src, XFS_MMAPLOCK_EXCL);
diff --git a/fs/xfs/xfs_reflink.h b/fs/xfs/xfs_reflink.h
index aa6a4d64bd35..33ac9b8db683 100644
--- a/fs/xfs/xfs_reflink.h
+++ b/fs/xfs/xfs_reflink.h
@@ -28,8 +28,10 @@ extern int xfs_reflink_trim_around_shared(struct xfs_inode *ip,
 
 extern int xfs_reflink_reserve_cow(struct xfs_inode *ip,
                 struct xfs_bmbt_irec *imap, bool *shared);
-extern int xfs_reflink_allocate_cow_range(struct xfs_inode *ip,
-                xfs_off_t offset, xfs_off_t count);
+extern int xfs_reflink_allocate_cow(struct xfs_inode *ip,
+                struct xfs_bmbt_irec *imap, bool *shared, uint *lockmode);
+extern int xfs_reflink_convert_cow(struct xfs_inode *ip, xfs_off_t offset,
+                xfs_off_t count);
 extern bool xfs_reflink_find_cow_mapping(struct xfs_inode *ip, xfs_off_t offset,
                 struct xfs_bmbt_irec *imap);
 extern void xfs_reflink_trim_irec_to_next_cow(struct xfs_inode *ip,
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 802bcc326d9f..c57aa7f18087 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -1093,7 +1093,6 @@ xfs_rtallocate_extent(
         xfs_extlen_t    minlen,         /* minimum length to allocate */
         xfs_extlen_t    maxlen,         /* maximum length to allocate */
         xfs_extlen_t    *len,           /* out: actual length allocated */
-        xfs_alloctype_t type,           /* allocation type XFS_ALLOCTYPE... */
         int             wasdel,         /* was a delayed allocation extent */
         xfs_extlen_t    prod,           /* extent product factor */
         xfs_rtblock_t   *rtblock)       /* out: start block allocated */
@@ -1123,27 +1122,16 @@ xfs_rtallocate_extent(
                 }
         }
 
+retry:
         sumbp = NULL;
-        /*
-         * Allocate by size, or near another block, or exactly at some block.
-         */
-        switch (type) {
-        case XFS_ALLOCTYPE_ANY_AG:
+        if (bno == 0) {
                 error = xfs_rtallocate_extent_size(mp, tp, minlen, maxlen, len,
                                 &sumbp, &sb, prod, &r);
-                break;
-        case XFS_ALLOCTYPE_NEAR_BNO:
+        } else {
                 error = xfs_rtallocate_extent_near(mp, tp, bno, minlen, maxlen,
                                 len, &sumbp, &sb, prod, &r);
-                break;
-        case XFS_ALLOCTYPE_THIS_BNO:
-                error = xfs_rtallocate_extent_exact(mp, tp, bno, minlen, maxlen,
-                                len, &sumbp, &sb, prod, &r);
-                break;
-        default:
-                error = -EIO;
-                ASSERT(0);
         }
+
         if (error)
                 return error;
 
@@ -1158,7 +1146,11 @@ xfs_rtallocate_extent(
                         xfs_trans_mod_sb(tp, XFS_TRANS_SB_RES_FREXTENTS, -slen);
                 else
                         xfs_trans_mod_sb(tp, XFS_TRANS_SB_FREXTENTS, -slen);
+        } else if (prod > 1) {
+                prod = 1;
+                goto retry;
         }
+
         *rtblock = r;
         return 0;
 }
diff --git a/fs/xfs/xfs_rtalloc.h b/fs/xfs/xfs_rtalloc.h
index 355dd9e1cb64..51dd3c726608 100644
--- a/fs/xfs/xfs_rtalloc.h
+++ b/fs/xfs/xfs_rtalloc.h
@@ -40,7 +40,6 @@ xfs_rtallocate_extent(
         xfs_extlen_t            minlen, /* minimum length to allocate */
         xfs_extlen_t            maxlen, /* maximum length to allocate */
         xfs_extlen_t            *len,   /* out: actual length allocated */
-        xfs_alloctype_t         type,   /* allocation type XFS_ALLOCTYPE... */
         int                     wasdel, /* was a delayed allocation extent */
         xfs_extlen_t            prod,   /* extent product factor */
         xfs_rtblock_t           *rtblock); /* out: start block allocated */
@@ -122,7 +121,7 @@ int xfs_rtfree_range(struct xfs_mount *mp, struct xfs_trans *tp,
 
 
 #else
-# define xfs_rtallocate_extent(t,b,min,max,l,a,f,p,rb)  (ENOSYS)
+# define xfs_rtallocate_extent(t,b,min,max,l,f,p,rb)    (ENOSYS)
 # define xfs_rtfree_extent(t,b,l)                       (ENOSYS)
 # define xfs_rtpick_extent(m,t,l,rb)                    (ENOSYS)
 # define xfs_growfs_rt(mp,in)                           (ENOSYS)
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index eecbaac08eba..890862f2447c 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1956,12 +1956,20 @@ xfs_init_workqueues(void)
         if (!xfs_alloc_wq)
                 return -ENOMEM;
 
+        xfs_discard_wq = alloc_workqueue("xfsdiscard", WQ_UNBOUND, 0);
+        if (!xfs_discard_wq)
+                goto out_free_alloc_wq;
+
         return 0;
+out_free_alloc_wq:
+        destroy_workqueue(xfs_alloc_wq);
+        return -ENOMEM;
 }
 
 STATIC void
 xfs_destroy_workqueues(void)
 {
+        destroy_workqueue(xfs_discard_wq);
         destroy_workqueue(xfs_alloc_wq);
 }
 
diff --git a/fs/xfs/xfs_super.h b/fs/xfs/xfs_super.h
index b6418abd85ad..5f2f32408011 100644
--- a/fs/xfs/xfs_super.h
+++ b/fs/xfs/xfs_super.h
@@ -73,6 +73,8 @@ extern const struct quotactl_ops xfs_quotactl_operations;
 
 extern void xfs_reinit_percpu_counters(struct xfs_mount *mp);
 
+extern struct workqueue_struct *xfs_discard_wq;
+
 #define XFS_M(sb)               ((struct xfs_mount *)((sb)->s_fs_info))
 
 #endif  /* __XFS_SUPER_H__ */
diff --git a/fs/xfs/xfs_sysfs.c b/fs/xfs/xfs_sysfs.c
index de6195e38910..80ac15fb9638 100644
--- a/fs/xfs/xfs_sysfs.c
+++ b/fs/xfs/xfs_sysfs.c
@@ -93,7 +93,7 @@ to_mp(struct kobject *kobject)
 #ifdef DEBUG
 
 STATIC ssize_t
-fail_writes_store(
+drop_writes_store(
         struct kobject          *kobject,
         const char              *buf,
         size_t                  count)
@@ -107,9 +107,9 @@ fail_writes_store(
                 return ret;
 
         if (val == 1)
-                mp->m_fail_writes = true;
+                mp->m_drop_writes = true;
         else if (val == 0)
-                mp->m_fail_writes = false;
+                mp->m_drop_writes = false;
         else
                 return -EINVAL;
 
@@ -117,21 +117,21 @@ fail_writes_store(
 }
 
 STATIC ssize_t
-fail_writes_show(
+drop_writes_show(
         struct kobject          *kobject,
         char                    *buf)
 {
         struct xfs_mount        *mp = to_mp(kobject);
 
-        return snprintf(buf, PAGE_SIZE, "%d\n", mp->m_fail_writes ? 1 : 0);
+        return snprintf(buf, PAGE_SIZE, "%d\n", mp->m_drop_writes ? 1 : 0);
 }
-XFS_SYSFS_ATTR_RW(fail_writes);
+XFS_SYSFS_ATTR_RW(drop_writes);
 
 #endif /* DEBUG */
 
 static struct attribute *xfs_mp_attrs[] = {
 #ifdef DEBUG
-        ATTR_LIST(fail_writes),
+        ATTR_LIST(drop_writes),
 #endif
         NULL,
 };
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index 69c5bcd9a51b..fb7555e73a62 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -2245,7 +2245,6 @@ DEFINE_BTREE_CUR_EVENT(xfs_btree_overlapped_query_range);
 
 /* deferred ops */
 struct xfs_defer_pending;
-struct xfs_defer_intake;
 struct xfs_defer_ops;
 
 DECLARE_EVENT_CLASS(xfs_defer_class,
@@ -3089,6 +3088,7 @@ DECLARE_EVENT_CLASS(xfs_inode_irec_class,
                 __field(xfs_fileoff_t, lblk)
                 __field(xfs_extlen_t, len)
                 __field(xfs_fsblock_t, pblk)
+                __field(int, state)
         ),
         TP_fast_assign(
                 __entry->dev = VFS_I(ip)->i_sb->s_dev;
@@ -3096,13 +3096,15 @@ DECLARE_EVENT_CLASS(xfs_inode_irec_class,
                 __entry->lblk = irec->br_startoff;
                 __entry->len = irec->br_blockcount;
                 __entry->pblk = irec->br_startblock;
+                __entry->state = irec->br_state;
         ),
-        TP_printk("dev %d:%d ino 0x%llx lblk 0x%llx len 0x%x pblk %llu",
+        TP_printk("dev %d:%d ino 0x%llx lblk 0x%llx len 0x%x pblk %llu st %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->lblk,
                   __entry->len,
-                  __entry->pblk)
+                  __entry->pblk,
+                  __entry->state)
 );
 #define DEFINE_INODE_IREC_EVENT(name) \
 DEFINE_EVENT(xfs_inode_irec_class, name, \
@@ -3242,11 +3244,11 @@ DEFINE_INODE_IREC_EVENT(xfs_reflink_trim_around_shared);
 DEFINE_INODE_IREC_EVENT(xfs_reflink_cow_alloc);
 DEFINE_INODE_IREC_EVENT(xfs_reflink_cow_found);
 DEFINE_INODE_IREC_EVENT(xfs_reflink_cow_enospc);
+DEFINE_INODE_IREC_EVENT(xfs_reflink_convert_cow);
 
 DEFINE_RW_EVENT(xfs_reflink_reserve_cow);
-DEFINE_RW_EVENT(xfs_reflink_allocate_cow_range);
 
-DEFINE_INODE_IREC_EVENT(xfs_reflink_bounce_dio_write);
+DEFINE_SIMPLE_IO_EVENT(xfs_reflink_bounce_dio_write);
 DEFINE_IOMAP_EVENT(xfs_reflink_find_cow_mapping);
 DEFINE_INODE_IREC_EVENT(xfs_reflink_trim_irec);
 
@@ -3254,7 +3256,6 @@ DEFINE_SIMPLE_IO_EVENT(xfs_reflink_cancel_cow_range);
 DEFINE_SIMPLE_IO_EVENT(xfs_reflink_end_cow);
 DEFINE_INODE_IREC_EVENT(xfs_reflink_cow_remap);
 
-DEFINE_INODE_ERROR_EVENT(xfs_reflink_allocate_cow_range_error);
 DEFINE_INODE_ERROR_EVENT(xfs_reflink_cancel_cow_range_error);
 DEFINE_INODE_ERROR_EVENT(xfs_reflink_end_cow_error);
 
diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h
index 61b7fbdd3ebd..1646f659b60f 100644
--- a/fs/xfs/xfs_trans.h
+++ b/fs/xfs/xfs_trans.h
@@ -32,7 +32,6 @@ struct xfs_mount;
 struct xfs_trans;
 struct xfs_trans_res;
 struct xfs_dquot_acct;
-struct xfs_busy_extent;
 struct xfs_rud_log_item;
 struct xfs_rui_log_item;
 struct xfs_btree_cur;
diff --git a/include/linux/dax.h b/include/linux/dax.h
index 24ad71173995..2983e52efd07 100644
--- a/include/linux/dax.h
+++ b/include/linux/dax.h
@@ -37,9 +37,9 @@ static inline void *dax_radix_locked_entry(sector_t sector, unsigned long flags)
 }
 
 ssize_t dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
-                struct iomap_ops *ops);
+                const struct iomap_ops *ops);
 int dax_iomap_fault(struct vm_area_struct *vma, struct vm_fault *vmf,
-                        struct iomap_ops *ops);
+                        const struct iomap_ops *ops);
 int dax_delete_mapping_entry(struct address_space *mapping, pgoff_t index);
 int dax_invalidate_mapping_entry(struct address_space *mapping, pgoff_t index);
 int dax_invalidate_mapping_entry_sync(struct address_space *mapping,
@@ -72,7 +72,7 @@ static inline unsigned int dax_radix_order(void *entry)
         return 0;
 }
 int dax_iomap_pmd_fault(struct vm_area_struct *vma, unsigned long address,
-                pmd_t *pmd, unsigned int flags, struct iomap_ops *ops);
+                pmd_t *pmd, unsigned int flags, const struct iomap_ops *ops);
 #else
 static inline unsigned int dax_radix_order(void *entry)
 {
@@ -80,7 +80,7 @@ static inline unsigned int dax_radix_order(void *entry)
 }
 static inline int dax_iomap_pmd_fault(struct vm_area_struct *vma,
                 unsigned long address, pmd_t *pmd, unsigned int flags,
-                struct iomap_ops *ops)
+                const struct iomap_ops *ops)
 {
         return VM_FAULT_FALLBACK;
 }
diff --git a/include/linux/iomap.h b/include/linux/iomap.h
index a4c94b86401e..891459caa278 100644
--- a/include/linux/iomap.h
+++ b/include/linux/iomap.h
@@ -72,17 +72,17 @@ struct iomap_ops {
 };
 
 ssize_t iomap_file_buffered_write(struct kiocb *iocb, struct iov_iter *from,
-                struct iomap_ops *ops);
+                const struct iomap_ops *ops);
 int iomap_file_dirty(struct inode *inode, loff_t pos, loff_t len,
-                struct iomap_ops *ops);
+                const struct iomap_ops *ops);
 int iomap_zero_range(struct inode *inode, loff_t pos, loff_t len,
-                bool *did_zero, struct iomap_ops *ops);
+                bool *did_zero, const struct iomap_ops *ops);
 int iomap_truncate_page(struct inode *inode, loff_t pos, bool *did_zero,
-                struct iomap_ops *ops);
+                const struct iomap_ops *ops);
 int iomap_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf,
-                struct iomap_ops *ops);
+                const struct iomap_ops *ops);
 int iomap_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
-                loff_t start, loff_t len, struct iomap_ops *ops);
+                loff_t start, loff_t len, const struct iomap_ops *ops);
 
 /*
  * Flags for direct I/O ->end_io:
@@ -92,6 +92,6 @@ int iomap_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 typedef int (iomap_dio_end_io_t)(struct kiocb *iocb, ssize_t ret,
                 unsigned flags);
 ssize_t iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
-                struct iomap_ops *ops, iomap_dio_end_io_t end_io);
+                const struct iomap_ops *ops, iomap_dio_end_io_t end_io);
 
 #endif /* LINUX_IOMAP_H */
diff --git a/include/linux/module.h b/include/linux/module.h
index f4f542ed3d92..0297c5cd7cdf 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -126,13 +126,13 @@ extern void cleanup_module(void);
 
 /* Each module must use one module_init(). */
 #define module_init(initfn)                                     \
-        static inline initcall_t __inittest(void)               \
+        static inline initcall_t __maybe_unused __inittest(void)                \
         { return initfn; }                                      \
         int init_module(void) __attribute__((alias(#initfn)));
 
 /* This is only required if you want to be unloadable. */
 #define module_exit(exitfn)                                     \
-        static inline exitcall_t __exittest(void)               \
+        static inline exitcall_t __maybe_unused __exittest(void)                \
         { return exitfn; }                                      \
         void cleanup_module(void) __attribute__((alias(#exitfn)));
 
@@ -281,8 +281,6 @@ enum module_state {
         MODULE_STATE_UNFORMED,  /* Still setting it up. */
 };
 
-struct module;
-
 struct mod_tree_node {
         struct module *mod;
         struct latch_tree_node node;
diff --git a/include/linux/printk.h b/include/linux/printk.h
index 3472cc6b7a60..571257e0f53d 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -147,17 +147,11 @@ void early_printk(const char *s, ...) { }
 #endif
 
 #ifdef CONFIG_PRINTK_NMI
-extern void printk_nmi_init(void);
 extern void printk_nmi_enter(void);
 extern void printk_nmi_exit(void);
-extern void printk_nmi_flush(void);
-extern void printk_nmi_flush_on_panic(void);
 #else
-static inline void printk_nmi_init(void) { }
 static inline void printk_nmi_enter(void) { }
 static inline void printk_nmi_exit(void) { }
-static inline void printk_nmi_flush(void) { }
-static inline void printk_nmi_flush_on_panic(void) { }
 #endif /* PRINTK_NMI */
 
 #ifdef CONFIG_PRINTK
@@ -209,6 +203,9 @@ void __init setup_log_buf(int early);
 __printf(1, 2) void dump_stack_set_arch_desc(const char *fmt, ...);
 void dump_stack_print_info(const char *log_lvl);
 void show_regs_print_info(const char *log_lvl);
+extern void printk_safe_init(void);
+extern void printk_safe_flush(void);
+extern void printk_safe_flush_on_panic(void);
 #else
 static inline __printf(1, 0)
 int vprintk(const char *s, va_list args)
@@ -268,6 +265,18 @@ static inline void dump_stack_print_info(const char *log_lvl)
 static inline void show_regs_print_info(const char *log_lvl)
 {
 }
+
+static inline void printk_safe_init(void)
+{
+}
+
+static inline void printk_safe_flush(void)
+{
+}
+
+static inline void printk_safe_flush_on_panic(void)
+{
+}
 #endif
 
 extern asmlinkage void dump_stack(void) __cold;
diff --git a/init/Kconfig b/init/Kconfig
index 55bb6fbc294e..483ad679aa37 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -861,17 +861,19 @@ config LOG_CPU_MAX_BUF_SHIFT
                      13 =>   8 KB for each CPU
                      12 =>   4 KB for each CPU
 
-config NMI_LOG_BUF_SHIFT
-        int "Temporary per-CPU NMI log buffer size (12 => 4KB, 13 => 8KB)"
+config PRINTK_SAFE_LOG_BUF_SHIFT
+        int "Temporary per-CPU printk log buffer size (12 => 4KB, 13 => 8KB)"
         range 10 21
         default 13
-        depends on PRINTK_NMI
+        depends on PRINTK
         help
-          Select the size of a per-CPU buffer where NMI messages are temporary
-          stored. They are copied to the main log buffer in a safe context
-          to avoid a deadlock. The value defines the size as a power of 2.
+          Select the size of an alternate printk per-CPU buffer where messages
+          printed from usafe contexts are temporary stored. One example would
+          be NMI messages, another one - printk recursion. The messages are
+          copied to the main log buffer in a safe context to avoid a deadlock.
+          The value defines the size as a power of 2.
 
-          NMI messages are rare and limited. The largest one is when
+          Those messages are rare and limited. The largest one is when
           a backtrace is printed. It usually fits into 4KB. Select
           8KB if you want to be on the safe side.
 
diff --git a/init/main.c b/init/main.c
index c8a00f0f10ff..24ea48745061 100644
--- a/init/main.c
+++ b/init/main.c
@@ -581,7 +581,7 @@ asmlinkage __visible void __init start_kernel(void)
         timekeeping_init();
         time_init();
         sched_clock_postinit();
-        printk_nmi_init();
+        printk_safe_init();
         perf_event_init();
         profile_init();
         call_function_init();
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index a01974e1bf6b..bfe62d5b3872 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -916,7 +916,7 @@ void crash_kexec(struct pt_regs *regs)
         old_cpu = atomic_cmpxchg(&panic_cpu, PANIC_CPU_INVALID, this_cpu);
         if (old_cpu == PANIC_CPU_INVALID) {
                 /* This is the 1st CPU which comes here, so go ahead. */
-                printk_nmi_flush_on_panic();
+                printk_safe_flush_on_panic();
                 __crash_kexec(regs);
 
                 /*
diff --git a/kernel/module.c b/kernel/module.c
index a3889169a3ae..7eba6dea4f41 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2811,6 +2811,8 @@ static int check_modinfo_livepatch(struct module *mod, struct load_info *info)
         if (get_modinfo(info, "livepatch")) {
                 mod->klp = true;
                 add_taint_module(mod, TAINT_LIVEPATCH, LOCKDEP_STILL_OK);
+                pr_notice_once("%s: tainting kernel with TAINT_LIVEPATCH\n",
+                               mod->name);
         }
 
         return 0;
@@ -3723,6 +3725,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
         mod_sysfs_teardown(mod);
  coming_cleanup:
         mod->state = MODULE_STATE_GOING;
+        destroy_params(mod->kp, mod->num_kp);
         blocking_notifier_call_chain(&module_notify_list,
                                      MODULE_STATE_GOING, mod);
         klp_module_going(mod);
@@ -4169,22 +4172,23 @@ const struct exception_table_entry *search_module_extables(unsigned long addr)
         struct module *mod;
 
         preempt_disable();
-        list_for_each_entry_rcu(mod, &modules, list) {
-                if (mod->state == MODULE_STATE_UNFORMED)
-                        continue;
-                if (mod->num_exentries == 0)
-                        continue;
+        mod = __module_address(addr);
+        if (!mod)
+                goto out;
 
-                e = search_extable(mod->extable,
-                                   mod->extable + mod->num_exentries - 1,
-                                   addr);
-                if (e)
-                        break;
-        }
+        if (!mod->num_exentries)
+                goto out;
+
+        e = search_extable(mod->extable,
+                           mod->extable + mod->num_exentries - 1,
+                           addr);
+out:
         preempt_enable();
 
-        /* Now, if we found one, we are running inside it now, hence
-           we cannot unload the module, hence no refcnt needed. */
+        /*
+         * Now, if we found one, we are running inside it now, hence
+         * we cannot unload the module, hence no refcnt needed.
+         */
         return e;
 }
 
diff --git a/kernel/panic.c b/kernel/panic.c
index 08aa88dde7de..b95959733ce0 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -188,7 +188,7 @@ void panic(const char *fmt, ...)
          * Bypass the panic_cpu check and call __crash_kexec directly.
          */
         if (!_crash_kexec_post_notifiers) {
-                printk_nmi_flush_on_panic();
+                printk_safe_flush_on_panic();
                 __crash_kexec(NULL);
 
                 /*
@@ -213,7 +213,7 @@ void panic(const char *fmt, ...)
         atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
 
         /* Call flush even twice. It tries harder with a single online CPU */
-        printk_nmi_flush_on_panic();
+        printk_safe_flush_on_panic();
         kmsg_dump(KMSG_DUMP_PANIC);
 
         /*
diff --git a/kernel/printk/Makefile b/kernel/printk/Makefile
index abb0042a427b..4a2ffc39eb95 100644
--- a/kernel/printk/Makefile
+++ b/kernel/printk/Makefile
@@ -1,3 +1,3 @@
 obj-y   = printk.o
-obj-$(CONFIG_PRINTK_NMI)                += nmi.o
+obj-$(CONFIG_PRINTK)    += printk_safe.o
 obj-$(CONFIG_A11Y_BRAILLE_CONSOLE)      += braille.o
diff --git a/kernel/printk/internal.h b/kernel/printk/internal.h
index 7fd2838fa417..1db044f808b7 100644
--- a/kernel/printk/internal.h
+++ b/kernel/printk/internal.h
@@ -16,42 +16,55 @@
  */
 #include <linux/percpu.h>
 
-typedef __printf(1, 0) int (*printk_func_t)(const char *fmt, va_list args);
+#ifdef CONFIG_PRINTK
 
-int __printf(1, 0) vprintk_default(const char *fmt, va_list args);
-
-#ifdef CONFIG_PRINTK_NMI
+#define PRINTK_SAFE_CONTEXT_MASK        0x7fffffff
+#define PRINTK_NMI_CONTEXT_MASK 0x80000000
 
 extern raw_spinlock_t logbuf_lock;
 
+__printf(1, 0) int vprintk_default(const char *fmt, va_list args);
+__printf(1, 0) int vprintk_func(const char *fmt, va_list args);
+void __printk_safe_enter(void);
+void __printk_safe_exit(void);
+
+#define printk_safe_enter_irqsave(flags)        \
+        do {                                    \
+                local_irq_save(flags);          \
+                __printk_safe_enter();          \
+        } while (0)
+
+#define printk_safe_exit_irqrestore(flags)      \
+        do {                                    \
+                __printk_safe_exit();           \
+                local_irq_restore(flags);       \
+        } while (0)
+
+#define printk_safe_enter_irq()         \
+        do {                                    \
+                local_irq_disable();            \
+                __printk_safe_enter();          \
+        } while (0)
+
+#define printk_safe_exit_irq()                  \
+        do {                                    \
+                __printk_safe_exit();           \
+                local_irq_enable();             \
+        } while (0)
+
+#else
+
+__printf(1, 0) int vprintk_func(const char *fmt, va_list args) { return 0; }
+
 /*
- * printk() could not take logbuf_lock in NMI context. Instead,
- * it temporary stores the strings into a per-CPU buffer.
- * The alternative implementation is chosen transparently
- * via per-CPU variable.
+ * In !PRINTK builds we still export logbuf_lock spin_lock, console_sem
+ * semaphore and some of console functions (console_unlock()/etc.), so
+ * printk-safe must preserve the existing local IRQ guarantees.
  */
-DECLARE_PER_CPU(printk_func_t, printk_func);
-static inline __printf(1, 0) int vprintk_func(const char *fmt, va_list args)
-{
-        return this_cpu_read(printk_func)(fmt, args);
-}
-
-extern atomic_t nmi_message_lost;
-static inline int get_nmi_message_lost(void)
-{
-        return atomic_xchg(&nmi_message_lost, 0);
-}
-
-#else /* CONFIG_PRINTK_NMI */
-
-static inline __printf(1, 0) int vprintk_func(const char *fmt, va_list args)
-{
-        return vprintk_default(fmt, args);
-}
-
-static inline int get_nmi_message_lost(void)
-{
-        return 0;
-}
-
-#endif /* CONFIG_PRINTK_NMI */
+#define printk_safe_enter_irqsave(flags) local_irq_save(flags)
+#define printk_safe_exit_irqrestore(flags) local_irq_restore(flags)
+
+#define printk_safe_enter_irq() local_irq_disable()
+#define printk_safe_exit_irq() local_irq_enable()
+
+#endif /* CONFIG_PRINTK */
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 4ba3d34938c0..34da86e73d00 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -213,17 +213,36 @@ static int nr_ext_console_drivers;
 
 static int __down_trylock_console_sem(unsigned long ip)
 {
-        if (down_trylock(&console_sem))
+        int lock_failed;
+        unsigned long flags;
+
+        /*
+         * Here and in __up_console_sem() we need to be in safe mode,
+         * because spindump/WARN/etc from under console ->lock will
+         * deadlock in printk()->down_trylock_console_sem() otherwise.
+         */
+        printk_safe_enter_irqsave(flags);
+        lock_failed = down_trylock(&console_sem);
+        printk_safe_exit_irqrestore(flags);
+
+        if (lock_failed)
                 return 1;
         mutex_acquire(&console_lock_dep_map, 0, 1, ip);
         return 0;
 }
 #define down_trylock_console_sem() __down_trylock_console_sem(_RET_IP_)
 
-#define up_console_sem() do { \
-        mutex_release(&console_lock_dep_map, 1, _RET_IP_);\
-        up(&console_sem);\
-} while (0)
+static void __up_console_sem(unsigned long ip)
+{
+        unsigned long flags;
+
+        mutex_release(&console_lock_dep_map, 1, ip);
+
+        printk_safe_enter_irqsave(flags);
+        up(&console_sem);
+        printk_safe_exit_irqrestore(flags);
+}
+#define up_console_sem() __up_console_sem(_RET_IP_)
 
 /*
  * This is used for debugging the mess that is the VT code by
@@ -351,6 +370,34 @@ __packed __aligned(4)
  */
 DEFINE_RAW_SPINLOCK(logbuf_lock);
 
+/*
+ * Helper macros to lock/unlock logbuf_lock and switch between
+ * printk-safe/unsafe modes.
+ */
+#define logbuf_lock_irq()                               \
+        do {                                            \
+                printk_safe_enter_irq();                \
+                raw_spin_lock(&logbuf_lock);            \
+        } while (0)
+
+#define logbuf_unlock_irq()                             \
+        do {                                            \
+                raw_spin_unlock(&logbuf_lock);          \
+                printk_safe_exit_irq();                 \
+        } while (0)
+
+#define logbuf_lock_irqsave(flags)                      \
+        do {                                            \
+                printk_safe_enter_irqsave(flags);       \
+                raw_spin_lock(&logbuf_lock);            \
+        } while (0)
+
+#define logbuf_unlock_irqrestore(flags)         \
+        do {                                            \
+                raw_spin_unlock(&logbuf_lock);          \
+                printk_safe_exit_irqrestore(flags);     \
+        } while (0)
+
 #ifdef CONFIG_PRINTK
 DECLARE_WAIT_QUEUE_HEAD(log_wait);
 /* the next printk record to read by syslog(READ) or /proc/kmsg */
@@ -782,20 +829,21 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
         ret = mutex_lock_interruptible(&user->lock);
         if (ret)
                 return ret;
-        raw_spin_lock_irq(&logbuf_lock);
+
+        logbuf_lock_irq();
         while (user->seq == log_next_seq) {
                 if (file->f_flags & O_NONBLOCK) {
                         ret = -EAGAIN;
-                        raw_spin_unlock_irq(&logbuf_lock);
+                        logbuf_unlock_irq();
                         goto out;
                 }
 
-                raw_spin_unlock_irq(&logbuf_lock);
+                logbuf_unlock_irq();
                 ret = wait_event_interruptible(log_wait,
                                                user->seq != log_next_seq);
                 if (ret)
                         goto out;
-                raw_spin_lock_irq(&logbuf_lock);
+                logbuf_lock_irq();
         }
 
         if (user->seq < log_first_seq) {
@@ -803,7 +851,7 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
                 user->idx = log_first_idx;
                 user->seq = log_first_seq;
                 ret = -EPIPE;
-                raw_spin_unlock_irq(&logbuf_lock);
+                logbuf_unlock_irq();
                 goto out;
         }
 
@@ -816,7 +864,7 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
 
         user->idx = log_next(user->idx);
         user->seq++;
-        raw_spin_unlock_irq(&logbuf_lock);
+        logbuf_unlock_irq();
 
         if (len > count) {
                 ret = -EINVAL;
@@ -843,7 +891,7 @@ static loff_t devkmsg_llseek(struct file *file, loff_t offset, int whence)
         if (offset)
                 return -ESPIPE;
 
-        raw_spin_lock_irq(&logbuf_lock);
+        logbuf_lock_irq();
         switch (whence) {
         case SEEK_SET:
                 /* the first record */
@@ -867,7 +915,7 @@ static loff_t devkmsg_llseek(struct file *file, loff_t offset, int whence)
         default:
                 ret = -EINVAL;
         }
-        raw_spin_unlock_irq(&logbuf_lock);
+        logbuf_unlock_irq();
         return ret;
 }
 
@@ -881,7 +929,7 @@ static unsigned int devkmsg_poll(struct file *file, poll_table *wait)
 
         poll_wait(file, &log_wait, wait);
 
-        raw_spin_lock_irq(&logbuf_lock);
+        logbuf_lock_irq();
         if (user->seq < log_next_seq) {
                 /* return error when data has vanished underneath us */
                 if (user->seq < log_first_seq)
@@ -889,7 +937,7 @@ static unsigned int devkmsg_poll(struct file *file, poll_table *wait)
                 else
                         ret = POLLIN|POLLRDNORM;
         }
-        raw_spin_unlock_irq(&logbuf_lock);
+        logbuf_unlock_irq();
 
         return ret;
 }
@@ -919,10 +967,10 @@ static int devkmsg_open(struct inode *inode, struct file *file)
 
         mutex_init(&user->lock);
 
-        raw_spin_lock_irq(&logbuf_lock);
+        logbuf_lock_irq();
         user->idx = log_first_idx;
         user->seq = log_first_seq;
-        raw_spin_unlock_irq(&logbuf_lock);
+        logbuf_unlock_irq();
 
         file->private_data = user;
         return 0;
@@ -1064,13 +1112,13 @@ void __init setup_log_buf(int early)
                 return;
         }
 
-        raw_spin_lock_irqsave(&logbuf_lock, flags);
+        logbuf_lock_irqsave(flags);
         log_buf_len = new_log_buf_len;
         log_buf = new_log_buf;
         new_log_buf_len = 0;
         free = __LOG_BUF_LEN - log_next_idx;
         memcpy(log_buf, __log_buf, __LOG_BUF_LEN);
-        raw_spin_unlock_irqrestore(&logbuf_lock, flags);
+        logbuf_unlock_irqrestore(flags);
 
         pr_info("log_buf_len: %d bytes\n", log_buf_len);
         pr_info("early log buf free: %d(%d%%)\n",
@@ -1248,7 +1296,7 @@ static int syslog_print(char __user *buf, int size)
                 size_t n;
                 size_t skip;
 
-                raw_spin_lock_irq(&logbuf_lock);
+                logbuf_lock_irq();
                 if (syslog_seq < log_first_seq) {
                         /* messages are gone, move to first one */
                         syslog_seq = log_first_seq;
@@ -1256,7 +1304,7 @@ static int syslog_print(char __user *buf, int size)
                         syslog_partial = 0;
                 }
                 if (syslog_seq == log_next_seq) {
-                        raw_spin_unlock_irq(&logbuf_lock);
+                        logbuf_unlock_irq();
                         break;
                 }
 
@@ -1275,7 +1323,7 @@ static int syslog_print(char __user *buf, int size)
                         syslog_partial += n;
                 } else
                         n = 0;
-                raw_spin_unlock_irq(&logbuf_lock);
+                logbuf_unlock_irq();
 
                 if (!n)
                         break;
@@ -1304,7 +1352,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
         if (!text)
                 return -ENOMEM;
 
-        raw_spin_lock_irq(&logbuf_lock);
+        logbuf_lock_irq();
         if (buf) {
                 u64 next_seq;
                 u64 seq;
@@ -1352,12 +1400,12 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                         idx = log_next(idx);
                         seq++;
 
-                        raw_spin_unlock_irq(&logbuf_lock);
+                        logbuf_unlock_irq();
                         if (copy_to_user(buf + len, text, textlen))
                                 len = -EFAULT;
                         else
                                 len += textlen;
-                        raw_spin_lock_irq(&logbuf_lock);
+                        logbuf_lock_irq();
 
                         if (seq < log_first_seq) {
                                 /* messages are gone, move to next one */
@@ -1371,7 +1419,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 clear_seq = log_next_seq;
                 clear_idx = log_next_idx;
         }
-        raw_spin_unlock_irq(&logbuf_lock);
+        logbuf_unlock_irq();
 
         kfree(text);
         return len;
@@ -1458,7 +1506,7 @@ int do_syslog(int type, char __user *buf, int len, int source)
                 break;
         /* Number of chars in the log buffer */
         case SYSLOG_ACTION_SIZE_UNREAD:
-                raw_spin_lock_irq(&logbuf_lock);
+                logbuf_lock_irq();
                 if (syslog_seq < log_first_seq) {
                         /* messages are gone, move to first one */
                         syslog_seq = log_first_seq;
@@ -1486,7 +1534,7 @@ int do_syslog(int type, char __user *buf, int len, int source)
                         }
                         error -= syslog_partial;
                 }
-                raw_spin_unlock_irq(&logbuf_lock);
+                logbuf_unlock_irq();
                 break;
         /* Size of the log buffer */
         case SYSLOG_ACTION_SIZE_BUFFER:
@@ -1510,8 +1558,7 @@ SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
  * log_buf[start] to log_buf[end - 1].
  * The console_lock must be held.
  */
-static void call_console_drivers(int level,
-                                 const char *ext_text, size_t ext_len,
+static void call_console_drivers(const char *ext_text, size_t ext_len,
                                  const char *text, size_t len)
 {
         struct console *con;
@@ -1538,28 +1585,6 @@ static void call_console_drivers(int level,
         }
 }
 
-/*
- * Zap console related locks when oopsing.
- * To leave time for slow consoles to print a full oops,
- * only zap at most once every 30 seconds.
- */
-static void zap_locks(void)
-{
-        static unsigned long oops_timestamp;
-
-        if (time_after_eq(jiffies, oops_timestamp) &&
-            !time_after(jiffies, oops_timestamp + 30 * HZ))
-                return;
-
-        oops_timestamp = jiffies;
-
-        debug_locks_off();
-        /* If a crash is occurring, make sure we can't deadlock */
-        raw_spin_lock_init(&logbuf_lock);
-        /* And make sure that we print immediately */
-        sema_init(&console_sem, 1);
-}
-
 int printk_delay_msec __read_mostly;
 
 static inline void printk_delay(void)
@@ -1669,18 +1694,13 @@ asmlinkage int vprintk_emit(int facility, int level,
                             const char *dict, size_t dictlen,
                             const char *fmt, va_list args)
 {
-        static bool recursion_bug;
         static char textbuf[LOG_LINE_MAX];
         char *text = textbuf;
         size_t text_len = 0;
         enum log_flags lflags = 0;
         unsigned long flags;
-        int this_cpu;
         int printed_len = 0;
-        int nmi_message_lost;
         bool in_sched = false;
-        /* cpu currently holding logbuf_lock in this function */
-        static unsigned int logbuf_cpu = UINT_MAX;
 
         if (level == LOGLEVEL_SCHED) {
                 level = LOGLEVEL_DEFAULT;
@@ -1690,53 +1710,8 @@ asmlinkage int vprintk_emit(int facility, int level,
         boot_delay_msec(level);
         printk_delay();
 
-        local_irq_save(flags);
-        this_cpu = smp_processor_id();
-
-        /*
-         * Ouch, printk recursed into itself!
-         */
-        if (unlikely(logbuf_cpu == this_cpu)) {
-                /*
-                 * If a crash is occurring during printk() on this CPU,
-                 * then try to get the crash message out but make sure
-                 * we can't deadlock. Otherwise just return to avoid the
-                 * recursion and return - but flag the recursion so that
-                 * it can be printed at the next appropriate moment:
-                 */
-                if (!oops_in_progress && !lockdep_recursing(current)) {
-                        recursion_bug = true;
-                        local_irq_restore(flags);
-                        return 0;
-                }
-                zap_locks();
-        }
-
-        lockdep_off();
         /* This stops the holder of console_sem just where we want him */
-        raw_spin_lock(&logbuf_lock);
-        logbuf_cpu = this_cpu;
-
-        if (unlikely(recursion_bug)) {
-                static const char recursion_msg[] =
-                        "BUG: recent printk recursion!";
-
-                recursion_bug = false;
-                /* emit KERN_CRIT message */
-                printed_len += log_store(0, 2, LOG_PREFIX|LOG_NEWLINE, 0,
-                                         NULL, 0, recursion_msg,
-                                         strlen(recursion_msg));
-        }
-
-        nmi_message_lost = get_nmi_message_lost();
-        if (unlikely(nmi_message_lost)) {
-                text_len = scnprintf(textbuf, sizeof(textbuf),
-                                     "BAD LUCK: lost %d message(s) from NMI context!",
-                                     nmi_message_lost);
-                printed_len += log_store(0, 2, LOG_PREFIX|LOG_NEWLINE, 0,
-                                         NULL, 0, textbuf, text_len);
-        }
-
+        logbuf_lock_irqsave(flags);
         /*
          * The printf needs to come first; we need the syslog
          * prefix which might be passed-in as a parameter.
@@ -1779,14 +1754,10 @@ asmlinkage int vprintk_emit(int facility, int level,
 
         printed_len += log_output(facility, level, lflags, dict, dictlen, text, text_len);
 
-        logbuf_cpu = UINT_MAX;
-        raw_spin_unlock(&logbuf_lock);
-        lockdep_on();
-        local_irq_restore(flags);
+        logbuf_unlock_irqrestore(flags);
 
         /* If called from the scheduler, we can not call up(). */
         if (!in_sched) {
-                lockdep_off();
                 /*
                  * Try to acquire and then immediately release the console
                  * semaphore.  The release will print out buffers and wake up
@@ -1794,7 +1765,6 @@ asmlinkage int vprintk_emit(int facility, int level,
                  */
                 if (console_trylock())
                         console_unlock();
-                lockdep_on();
         }
 
         return printed_len;
@@ -1803,7 +1773,7 @@ EXPORT_SYMBOL(vprintk_emit);
 
 asmlinkage int vprintk(const char *fmt, va_list args)
 {
-        return vprintk_emit(0, LOGLEVEL_DEFAULT, NULL, 0, fmt, args);
+        return vprintk_func(fmt, args);
 }
 EXPORT_SYMBOL(vprintk);
 
@@ -1895,16 +1865,12 @@ static ssize_t msg_print_ext_header(char *buf, size_t size,
 static ssize_t msg_print_ext_body(char *buf, size_t size,
                                   char *dict, size_t dict_len,
                                   char *text, size_t text_len) { return 0; }
-static void call_console_drivers(int level,
-                                 const char *ext_text, size_t ext_len,
+static void call_console_drivers(const char *ext_text, size_t ext_len,
                                  const char *text, size_t len) {}
 static size_t msg_print_text(const struct printk_log *msg,
                              bool syslog, char *buf, size_t size) { return 0; }
 static bool suppress_message_printing(int level) { return false; }
 
-/* Still needs to be defined for users */
-DEFINE_PER_CPU(printk_func_t, printk_func);
-
 #endif /* CONFIG_PRINTK */
 
 #ifdef CONFIG_EARLY_PRINTK
@@ -2220,9 +2186,9 @@ again:
                 struct printk_log *msg;
                 size_t ext_len = 0;
                 size_t len;
-                int level;
 
-                raw_spin_lock_irqsave(&logbuf_lock, flags);
+                printk_safe_enter_irqsave(flags);
+                raw_spin_lock(&logbuf_lock);
                 if (seen_seq != log_next_seq) {
                         wake_klogd = true;
                         seen_seq = log_next_seq;
@@ -2243,8 +2209,7 @@ skip:
                         break;
 
                 msg = log_from_idx(console_idx);
-                level = msg->level;
-                if (suppress_message_printing(level)) {
+                if (suppress_message_printing(msg->level)) {
                         /*
                          * Skip record we have buffered and already printed
                          * directly to the console when we received it, and
@@ -2270,9 +2235,9 @@ skip:
                 raw_spin_unlock(&logbuf_lock);
 
                 stop_critical_timings();        /* don't trace print latency */
-                call_console_drivers(level, ext_text, ext_len, text, len);
+                call_console_drivers(ext_text, ext_len, text, len);
                 start_critical_timings();
-                local_irq_restore(flags);
+                printk_safe_exit_irqrestore(flags);
 
                 if (do_cond_resched)
                         cond_resched();
@@ -2295,7 +2260,8 @@ skip:
          */
         raw_spin_lock(&logbuf_lock);
         retry = console_seq != log_next_seq;
-        raw_spin_unlock_irqrestore(&logbuf_lock, flags);
+        raw_spin_unlock(&logbuf_lock);
+        printk_safe_exit_irqrestore(flags);
 
         if (retry && console_trylock())
                 goto again;
@@ -2558,10 +2524,10 @@ void register_console(struct console *newcon)
                  * console_unlock(); will print out the buffered messages
                  * for us.
                  */
-                raw_spin_lock_irqsave(&logbuf_lock, flags);
+                logbuf_lock_irqsave(flags);
                 console_seq = syslog_seq;
                 console_idx = syslog_idx;
-                raw_spin_unlock_irqrestore(&logbuf_lock, flags);
+                logbuf_unlock_irqrestore(flags);
                 /*
                  * We're about to replay the log buffer.  Only do this to the
                  * just-registered console to avoid excessive message spam to
@@ -2860,12 +2826,12 @@ void kmsg_dump(enum kmsg_dump_reason reason)
                 /* initialize iterator with data about the stored records */
                 dumper->active = true;
 
-                raw_spin_lock_irqsave(&logbuf_lock, flags);
+                logbuf_lock_irqsave(flags);
                 dumper->cur_seq = clear_seq;
                 dumper->cur_idx = clear_idx;
                 dumper->next_seq = log_next_seq;
                 dumper->next_idx = log_next_idx;
-                raw_spin_unlock_irqrestore(&logbuf_lock, flags);
+                logbuf_unlock_irqrestore(flags);
 
                 /* invoke dumper which will iterate over records */
                 dumper->dump(dumper, reason);
@@ -2950,9 +2916,9 @@ bool kmsg_dump_get_line(struct kmsg_dumper *dumper, bool syslog,
         unsigned long flags;
         bool ret;
 
-        raw_spin_lock_irqsave(&logbuf_lock, flags);
+        logbuf_lock_irqsave(flags);
         ret = kmsg_dump_get_line_nolock(dumper, syslog, line, size, len);
-        raw_spin_unlock_irqrestore(&logbuf_lock, flags);
+        logbuf_unlock_irqrestore(flags);
 
         return ret;
 }
@@ -2991,7 +2957,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         if (!dumper->active)
                 goto out;
 
-        raw_spin_lock_irqsave(&logbuf_lock, flags);
+        logbuf_lock_irqsave(flags);
         if (dumper->cur_seq < log_first_seq) {
                 /* messages are gone, move to first available one */
                 dumper->cur_seq = log_first_seq;
@@ -3000,7 +2966,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
 
         /* last entry */
         if (dumper->cur_seq >= dumper->next_seq) {
-                raw_spin_unlock_irqrestore(&logbuf_lock, flags);
+                logbuf_unlock_irqrestore(flags);
                 goto out;
         }
 
@@ -3042,7 +3008,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         dumper->next_seq = next_seq;
         dumper->next_idx = next_idx;
         ret = true;
-        raw_spin_unlock_irqrestore(&logbuf_lock, flags);
+        logbuf_unlock_irqrestore(flags);
 out:
         if (len)
                 *len = l;
@@ -3080,9 +3046,9 @@ void kmsg_dump_rewind(struct kmsg_dumper *dumper)
 {
         unsigned long flags;
 
-        raw_spin_lock_irqsave(&logbuf_lock, flags);
+        logbuf_lock_irqsave(flags);
         kmsg_dump_rewind_nolock(dumper);
-        raw_spin_unlock_irqrestore(&logbuf_lock, flags);
+        logbuf_unlock_irqrestore(flags);
 }
 EXPORT_SYMBOL_GPL(kmsg_dump_rewind);
 
diff --git a/kernel/printk/nmi.c b/kernel/printk/printk_safe.c
index f011aaef583c..033e50a7d706 100644
--- a/kernel/printk/nmi.c
+++ b/kernel/printk/printk_safe.c
@@ -1,5 +1,5 @@
 /*
- * nmi.c - Safe printk in NMI context
+ * printk_safe.c - Safe printk for printk-deadlock-prone contexts
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -32,36 +32,58 @@
  * is later flushed into the main ring buffer via IRQ work.
  *
  * The alternative implementation is chosen transparently
- * via @printk_func per-CPU variable.
+ * by examinig current printk() context mask stored in @printk_context
+ * per-CPU variable.
  *
  * The implementation allows to flush the strings also from another CPU.
  * There are situations when we want to make sure that all buffers
  * were handled or when IRQs are blocked.
  */
-DEFINE_PER_CPU(printk_func_t, printk_func) = vprintk_default;
-static int printk_nmi_irq_ready;
-atomic_t nmi_message_lost;
+static int printk_safe_irq_ready;
 
-#define NMI_LOG_BUF_LEN ((1 << CONFIG_NMI_LOG_BUF_SHIFT) -              \
-                         sizeof(atomic_t) - sizeof(struct irq_work))
+#define SAFE_LOG_BUF_LEN ((1 << CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT) -     \
+                                sizeof(atomic_t) -                      \
+                                sizeof(atomic_t) -                      \
+                                sizeof(struct irq_work))
 
-struct nmi_seq_buf {
+struct printk_safe_seq_buf {
         atomic_t                len;    /* length of written data */
+        atomic_t                message_lost;
         struct irq_work         work;   /* IRQ work that flushes the buffer */
-        unsigned char           buffer[NMI_LOG_BUF_LEN];
+        unsigned char           buffer[SAFE_LOG_BUF_LEN];
 };
-static DEFINE_PER_CPU(struct nmi_seq_buf, nmi_print_seq);
+
+static DEFINE_PER_CPU(struct printk_safe_seq_buf, safe_print_seq);
+static DEFINE_PER_CPU(int, printk_context);
+
+#ifdef CONFIG_PRINTK_NMI
+static DEFINE_PER_CPU(struct printk_safe_seq_buf, nmi_print_seq);
+#endif
+
+/* Get flushed in a more safe context. */
+static void queue_flush_work(struct printk_safe_seq_buf *s)
+{
+        if (printk_safe_irq_ready) {
+                /* Make sure that IRQ work is really initialized. */
+                smp_rmb();
+                irq_work_queue(&s->work);
+        }
+}
 
 /*
- * Safe printk() for NMI context. It uses a per-CPU buffer to
- * store the message. NMIs are not nested, so there is always only
- * one writer running. But the buffer might get flushed from another
- * CPU, so we need to be careful.
+ * Add a message to per-CPU context-dependent buffer. NMI and printk-safe
+ * have dedicated buffers, because otherwise printk-safe preempted by
+ * NMI-printk would have overwritten the NMI messages.
+ *
+ * The messages are fushed from irq work (or from panic()), possibly,
+ * from other CPU, concurrently with printk_safe_log_store(). Should this
+ * happen, printk_safe_log_store() will notice the buffer->len mismatch
+ * and repeat the write.
  */
-static int vprintk_nmi(const char *fmt, va_list args)
+static int printk_safe_log_store(struct printk_safe_seq_buf *s,
+                                 const char *fmt, va_list args)
 {
-        struct nmi_seq_buf *s = this_cpu_ptr(&nmi_print_seq);
-        int add = 0;
+        int add;
         size_t len;
 
 again:
@@ -69,18 +91,21 @@ again:
 
         /* The trailing '\0' is not counted into len. */
         if (len >= sizeof(s->buffer) - 1) {
-                atomic_inc(&nmi_message_lost);
+                atomic_inc(&s->message_lost);
+                queue_flush_work(s);
                 return 0;
         }
 
         /*
-         * Make sure that all old data have been read before the buffer was
-         * reseted. This is not needed when we just append data.
+         * Make sure that all old data have been read before the buffer
+         * was reset. This is not needed when we just append data.
          */
         if (!len)
                 smp_rmb();
 
         add = vscnprintf(s->buffer + len, sizeof(s->buffer) - len, fmt, args);
+        if (!add)
+                return 0;
 
         /*
          * Do it once again if the buffer has been flushed in the meantime.
@@ -90,32 +115,23 @@ again:
         if (atomic_cmpxchg(&s->len, len, len + add) != len)
                 goto again;
 
-        /* Get flushed in a more safe context. */
-        if (add && printk_nmi_irq_ready) {
-                /* Make sure that IRQ work is really initialized. */
-                smp_rmb();
-                irq_work_queue(&s->work);
-        }
-
+        queue_flush_work(s);
         return add;
 }
 
-static void printk_nmi_flush_line(const char *text, int len)
+static inline void printk_safe_flush_line(const char *text, int len)
 {
         /*
-         * The buffers are flushed in NMI only on panic.  The messages must
-         * go only into the ring buffer at this stage.  Consoles will get
-         * explicitly called later when a crashdump is not generated.
+         * Avoid any console drivers calls from here, because we may be
+         * in NMI or printk_safe context (when in panic). The messages
+         * must go only into the ring buffer at this stage.  Consoles will
+         * get explicitly called later when a crashdump is not generated.
          */
-        if (in_nmi())
-                printk_deferred("%.*s", len, text);
-        else
-                printk("%.*s", len, text);
-
+        printk_deferred("%.*s", len, text);
 }
 
 /* printk part of the temporary buffer line by line */
-static int printk_nmi_flush_buffer(const char *start, size_t len)
+static int printk_safe_flush_buffer(const char *start, size_t len)
 {
         const char *c, *end;
         bool header;
@@ -127,7 +143,7 @@ static int printk_nmi_flush_buffer(const char *start, size_t len)
         /* Print line by line. */
         while (c < end) {
                 if (*c == '\n') {
-                        printk_nmi_flush_line(start, c - start + 1);
+                        printk_safe_flush_line(start, c - start + 1);
                         start = ++c;
                         header = true;
                         continue;
@@ -140,7 +156,7 @@ static int printk_nmi_flush_buffer(const char *start, size_t len)
                                 continue;
                         }
 
-                        printk_nmi_flush_line(start, c - start);
+                        printk_safe_flush_line(start, c - start);
                         start = c++;
                         header = true;
                         continue;
@@ -154,22 +170,31 @@ static int printk_nmi_flush_buffer(const char *start, size_t len)
         if (start < end && !header) {
                 static const char newline[] = KERN_CONT "\n";
 
-                printk_nmi_flush_line(start, end - start);
-                printk_nmi_flush_line(newline, strlen(newline));
+                printk_safe_flush_line(start, end - start);
+                printk_safe_flush_line(newline, strlen(newline));
         }
 
         return len;
 }
 
+static void report_message_lost(struct printk_safe_seq_buf *s)
+{
+        int lost = atomic_xchg(&s->message_lost, 0);
+
+        if (lost)
+                printk_deferred("Lost %d message(s)!\n", lost);
+}
+
 /*
- * Flush data from the associated per_CPU buffer. The function
+ * Flush data from the associated per-CPU buffer. The function
  * can be called either via IRQ work or independently.
  */
-static void __printk_nmi_flush(struct irq_work *work)
+static void __printk_safe_flush(struct irq_work *work)
 {
         static raw_spinlock_t read_lock =
                 __RAW_SPIN_LOCK_INITIALIZER(read_lock);
-        struct nmi_seq_buf *s = container_of(work, struct nmi_seq_buf, work);
+        struct printk_safe_seq_buf *s =
+                container_of(work, struct printk_safe_seq_buf, work);
         unsigned long flags;
         size_t len;
         int i;
@@ -194,9 +219,9 @@ more:
          * buffer size.
          */
         if ((i && i >= len) || len > sizeof(s->buffer)) {
-                const char *msg = "printk_nmi_flush: internal error\n";
+                const char *msg = "printk_safe_flush: internal error\n";
 
-                printk_nmi_flush_line(msg, strlen(msg));
+                printk_safe_flush_line(msg, strlen(msg));
                 len = 0;
         }
 
@@ -205,7 +230,7 @@ more:
 
         /* Make sure that data has been written up to the @len */
         smp_rmb();
-        i += printk_nmi_flush_buffer(s->buffer + i, len - i);
+        i += printk_safe_flush_buffer(s->buffer + i, len - i);
 
         /*
          * Check that nothing has got added in the meantime and truncate
@@ -217,35 +242,40 @@ more:
                 goto more;
 
 out:
+        report_message_lost(s);
         raw_spin_unlock_irqrestore(&read_lock, flags);
 }
 
 /**
- * printk_nmi_flush - flush all per-cpu nmi buffers.
+ * printk_safe_flush - flush all per-cpu nmi buffers.
  *
  * The buffers are flushed automatically via IRQ work. This function
  * is useful only when someone wants to be sure that all buffers have
  * been flushed at some point.
  */
-void printk_nmi_flush(void)
+void printk_safe_flush(void)
 {
         int cpu;
 
-        for_each_possible_cpu(cpu)
-                __printk_nmi_flush(&per_cpu(nmi_print_seq, cpu).work);
+        for_each_possible_cpu(cpu) {
+#ifdef CONFIG_PRINTK_NMI
+                __printk_safe_flush(&per_cpu(nmi_print_seq, cpu).work);
+#endif
+                __printk_safe_flush(&per_cpu(safe_print_seq, cpu).work);
+        }
 }
 
 /**
- * printk_nmi_flush_on_panic - flush all per-cpu nmi buffers when the system
+ * printk_safe_flush_on_panic - flush all per-cpu nmi buffers when the system
  *      goes down.
  *
- * Similar to printk_nmi_flush() but it can be called even in NMI context when
+ * Similar to printk_safe_flush() but it can be called even in NMI context when
  * the system goes down. It does the best effort to get NMI messages into
  * the main ring buffer.
  *
  * Note that it could try harder when there is only one CPU online.
  */
-void printk_nmi_flush_on_panic(void)
+void printk_safe_flush_on_panic(void)
 {
         /*
          * Make sure that we could access the main ring buffer.
@@ -259,33 +289,97 @@ void printk_nmi_flush_on_panic(void)
                 raw_spin_lock_init(&logbuf_lock);
         }
 
-        printk_nmi_flush();
+        printk_safe_flush();
 }
 
-void __init printk_nmi_init(void)
+#ifdef CONFIG_PRINTK_NMI
+/*
+ * Safe printk() for NMI context. It uses a per-CPU buffer to
+ * store the message. NMIs are not nested, so there is always only
+ * one writer running. But the buffer might get flushed from another
+ * CPU, so we need to be careful.
+ */
+static int vprintk_nmi(const char *fmt, va_list args)
 {
-        int cpu;
+        struct printk_safe_seq_buf *s = this_cpu_ptr(&nmi_print_seq);
 
-        for_each_possible_cpu(cpu) {
-                struct nmi_seq_buf *s = &per_cpu(nmi_print_seq, cpu);
+        return printk_safe_log_store(s, fmt, args);
+}
 
-                init_irq_work(&s->work, __printk_nmi_flush);
-        }
+void printk_nmi_enter(void)
+{
+        this_cpu_or(printk_context, PRINTK_NMI_CONTEXT_MASK);
+}
 
-        /* Make sure that IRQ works are initialized before enabling. */
-        smp_wmb();
-        printk_nmi_irq_ready = 1;
+void printk_nmi_exit(void)
+{
+        this_cpu_and(printk_context, ~PRINTK_NMI_CONTEXT_MASK);
+}
 
-        /* Flush pending messages that did not have scheduled IRQ works. */
-        printk_nmi_flush();
+#else
+
+static int vprintk_nmi(const char *fmt, va_list args)
+{
+        return 0;
 }
 
-void printk_nmi_enter(void)
+#endif /* CONFIG_PRINTK_NMI */
+
+/*
+ * Lock-less printk(), to avoid deadlocks should the printk() recurse
+ * into itself. It uses a per-CPU buffer to store the message, just like
+ * NMI.
+ */
+static int vprintk_safe(const char *fmt, va_list args)
 {
-        this_cpu_write(printk_func, vprintk_nmi);
+        struct printk_safe_seq_buf *s = this_cpu_ptr(&safe_print_seq);
+
+        return printk_safe_log_store(s, fmt, args);
 }
 
-void printk_nmi_exit(void)
+/* Can be preempted by NMI. */
+void __printk_safe_enter(void)
+{
+        this_cpu_inc(printk_context);
+}
+
+/* Can be preempted by NMI. */
+void __printk_safe_exit(void)
 {
-        this_cpu_write(printk_func, vprintk_default);
+        this_cpu_dec(printk_context);
+}
+
+__printf(1, 0) int vprintk_func(const char *fmt, va_list args)
+{
+        if (this_cpu_read(printk_context) & PRINTK_NMI_CONTEXT_MASK)
+                return vprintk_nmi(fmt, args);
+
+        if (this_cpu_read(printk_context) & PRINTK_SAFE_CONTEXT_MASK)
+                return vprintk_safe(fmt, args);
+
+        return vprintk_default(fmt, args);
+}
+
+void __init printk_safe_init(void)
+{
+        int cpu;
+
+        for_each_possible_cpu(cpu) {
+                struct printk_safe_seq_buf *s;
+
+                s = &per_cpu(safe_print_seq, cpu);
+                init_irq_work(&s->work, __printk_safe_flush);
+
+#ifdef CONFIG_PRINTK_NMI
+                s = &per_cpu(nmi_print_seq, cpu);
+                init_irq_work(&s->work, __printk_safe_flush);
+#endif
+        }
+
+        /* Make sure that IRQ works are initialized before enabling. */
+        smp_wmb();
+        printk_safe_irq_ready = 1;
+
+        /* Flush pending messages that did not have scheduled IRQ works. */
+        printk_safe_flush();
 }
diff --git a/lib/nmi_backtrace.c b/lib/nmi_backtrace.c
index 75554754eadf..5f7999eacad5 100644
--- a/lib/nmi_backtrace.c
+++ b/lib/nmi_backtrace.c
@@ -77,7 +77,7 @@ void nmi_trigger_cpumask_backtrace(const cpumask_t *mask,
          * Force flush any remote buffers that might be stuck in IRQ context
          * and therefore could not run their irq_work.
          */
-        printk_nmi_flush();
+        printk_safe_flush();
 
         clear_bit_unlock(0, &backtrace_flag);
         put_cpu();