Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	drivers/net/sfc/sfe4001.c
	drivers/net/wireless/libertas/cmd.c
	drivers/staging/Kconfig
	drivers/staging/Makefile
	drivers/staging/rtl8187se/Kconfig
	drivers/staging/rtl8192e/Kconfig

101 files changed, 1413 insertions, 610 deletions

diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index 873cd31baa47..15cce53bf61e 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -40,6 +40,24 @@
 #include "fid.h"
 
 /**
+ * struct p9_rdir - readdir accounting
+ * @mutex: mutex protecting readdir
+ * @head: start offset of current dirread buffer
+ * @tail: end offset of current dirread buffer
+ * @buf: dirread buffer
+ *
+ * private structure for keeping track of readdir
+ * allocated on demand
+ */
+
+struct p9_rdir {
+        struct mutex mutex;
+        int head;
+        int tail;
+        uint8_t *buf;
+};
+
+/**
  * dt_type - return file type
  * @mistat: mistat structure
  *
@@ -70,56 +88,79 @@ static int v9fs_dir_readdir(struct file *filp, void *dirent, filldir_t filldir)
 {
         int over;
         struct p9_wstat st;
-        int err;
+        int err = 0;
         struct p9_fid *fid;
         int buflen;
-        char *statbuf;
-        int n, i = 0;
+        int reclen = 0;
+        struct p9_rdir *rdir;
 
         P9_DPRINTK(P9_DEBUG_VFS, "name %s\n", filp->f_path.dentry->d_name.name);
         fid = filp->private_data;
 
         buflen = fid->clnt->msize - P9_IOHDRSZ;
-        statbuf = kmalloc(buflen, GFP_KERNEL);
-        if (!statbuf)
-                return -ENOMEM;
-
-        while (1) {
-                err = v9fs_file_readn(filp, statbuf, NULL, buflen,
-                                                                fid->rdir_fpos);
-                if (err <= 0)
-                        break;
-
-                n = err;
-                while (i < n) {
-                        err = p9stat_read(statbuf + i, buflen-i, &st,
-                                                        fid->clnt->dotu);
+
+        /* allocate rdir on demand */
+        if (!fid->rdir) {
+                rdir = kmalloc(sizeof(struct p9_rdir) + buflen, GFP_KERNEL);
+
+                if (rdir == NULL) {
+                        err = -ENOMEM;
+                        goto exit;
+                }
+                spin_lock(&filp->f_dentry->d_lock);
+                if (!fid->rdir) {
+                        rdir->buf = (uint8_t *)rdir + sizeof(struct p9_rdir);
+                        mutex_init(&rdir->mutex);
+                        rdir->head = rdir->tail = 0;
+                        fid->rdir = (void *) rdir;
+                        rdir = NULL;
+                }
+                spin_unlock(&filp->f_dentry->d_lock);
+                kfree(rdir);
+        }
+        rdir = (struct p9_rdir *) fid->rdir;
+
+        err = mutex_lock_interruptible(&rdir->mutex);
+        while (err == 0) {
+                if (rdir->tail == rdir->head) {
+                        err = v9fs_file_readn(filp, rdir->buf, NULL,
+                                                        buflen, filp->f_pos);
+                        if (err <= 0)
+                                goto unlock_and_exit;
+
+                        rdir->head = 0;
+                        rdir->tail = err;
+                }
+
+                while (rdir->head < rdir->tail) {
+                        err = p9stat_read(rdir->buf + rdir->head,
+                                                buflen - rdir->head, &st,
+                                                fid->clnt->dotu);
                         if (err) {
                                 P9_DPRINTK(P9_DEBUG_VFS, "returned %d\n", err);
                                 err = -EIO;
                                 p9stat_free(&st);
-                                goto free_and_exit;
+                                goto unlock_and_exit;
                         }
-
-                        i += st.size+2;
-                        fid->rdir_fpos += st.size+2;
+                        reclen = st.size+2;
 
                         over = filldir(dirent, st.name, strlen(st.name),
                             filp->f_pos, v9fs_qid2ino(&st.qid), dt_type(&st));
 
-                        filp->f_pos += st.size+2;
-
                         p9stat_free(&st);
 
                         if (over) {
                                 err = 0;
-                                goto free_and_exit;
+                                goto unlock_and_exit;
                         }
+                        rdir->head += reclen;
+                        filp->f_pos += reclen;
                 }
         }
 
-free_and_exit:
-        kfree(statbuf);
+unlock_and_exit:
+        mutex_unlock(&rdir->mutex);
+exit:
         return err;
 }
 
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 5947628aefef..18f74ec4dce9 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -994,8 +994,7 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
         P9_DPRINTK(P9_DEBUG_VFS,
                 "%s -> %s (%s)\n", dentry->d_name.name, st->extension, buffer);
 
-        retval = buflen;
-
+        retval = strnlen(buffer, buflen);
 done:
         kfree(st);
         return retval;
@@ -1062,7 +1061,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
                         __putname(link);
                         link = ERR_PTR(len);
                 } else
-                        link[len] = 0;
+                        link[min(len, PATH_MAX-1)] = 0;
         }
         nd_set_link(nd, link);
 
diff --git a/fs/Kconfig b/fs/Kconfig
index d4bf8caad8d0..64d44efad7a5 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -135,8 +135,8 @@ config TMPFS_POSIX_ACL
 
 config HUGETLBFS
         bool "HugeTLB file system support"
-        depends on X86 || IA64 || PPC64 || SPARC64 || (SUPERH && MMU) || \
-                   (S390 && 64BIT) || SYS_SUPPORTS_HUGETLBFS || BROKEN
+        depends on X86 || IA64 || SPARC64 || (S390 && 64BIT) || \
+                   SYS_SUPPORTS_HUGETLBFS || BROKEN
         help
           hugetlbfs is a filesystem backing for HugeTLB pages, based on
           ramfs. For architectures that support it, say Y here and read
diff --git a/fs/bio.c b/fs/bio.c
index 402cb84a92a1..12da5db8682c 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -325,8 +325,16 @@ static void bio_fs_destructor(struct bio *bio)
  *      @gfp_mask: allocation mask to use
  *      @nr_iovecs: number of iovecs
  *
- *      Allocate a new bio with @nr_iovecs bvecs.  If @gfp_mask
- *      contains __GFP_WAIT, the allocation is guaranteed to succeed.
+ *      bio_alloc will allocate a bio and associated bio_vec array that can hold
+ *      at least @nr_iovecs entries. Allocations will be done from the
+ *      fs_bio_set. Also see @bio_alloc_bioset and @bio_kmalloc.
+ *
+ *      If %__GFP_WAIT is set, then bio_alloc will always be able to allocate
+ *      a bio. This is due to the mempool guarantees. To make this work, callers
+ *      must never allocate more than 1 bio at a time from this pool. Callers
+ *      that need to allocate more than 1 bio must always submit the previously
+ *      allocated bio for IO before attempting to allocate a new one. Failure to
+ *      do so can cause livelocks under memory pressure.
  *
  *      RETURNS:
  *      Pointer to new bio on success, NULL on failure.
@@ -350,21 +358,13 @@ static void bio_kmalloc_destructor(struct bio *bio)
 }
 
 /**
- * bio_alloc - allocate a bio for I/O
+ * bio_kmalloc - allocate a bio for I/O using kmalloc()
  * @gfp_mask:   the GFP_ mask given to the slab allocator
  * @nr_iovecs:  number of iovecs to pre-allocate
  *
  * Description:
- *   bio_alloc will allocate a bio and associated bio_vec array that can hold
- *   at least @nr_iovecs entries. Allocations will be done from the
- *   fs_bio_set. Also see @bio_alloc_bioset.
- *
- *   If %__GFP_WAIT is set, then bio_alloc will always be able to allocate
- *   a bio. This is due to the mempool guarantees. To make this work, callers
- *   must never allocate more than 1 bio at a time from this pool. Callers
- *   that need to allocate more than 1 bio must always submit the previously
- *   allocated bio for IO before attempting to allocate a new one. Failure to
- *   do so can cause livelocks under memory pressure.
+ *   Allocate a new bio with @nr_iovecs bvecs.  If @gfp_mask contains
+ *   %__GFP_WAIT, the allocation is guaranteed to succeed.
  *
  **/
 struct bio *bio_kmalloc(gfp_t gfp_mask, int nr_iovecs)
@@ -407,7 +407,7 @@ EXPORT_SYMBOL(zero_fill_bio);
  *
  * Description:
  *   Put a reference to a &struct bio, either one you have gotten with
- *   bio_alloc or bio_get. The last put of a bio will free it.
+ *   bio_alloc, bio_get or bio_clone. The last put of a bio will free it.
  **/
 void bio_put(struct bio *bio)
 {
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 9cf4b926f8e4..8bed0557d88c 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1248,8 +1248,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                         bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9);
                 }
         } else {
-                put_disk(disk);
                 module_put(disk->fops->owner);
+                put_disk(disk);
                 disk = NULL;
                 if (bdev->bd_contains == bdev) {
                         if (bdev->bd_disk->fops->open) {
diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
index 69b355ae7f49..361604244271 100644
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -27,7 +27,7 @@
 #include "btrfs_inode.h"
 #include "xattr.h"
 
-#ifdef CONFIG_BTRFS_POSIX_ACL
+#ifdef CONFIG_BTRFS_FS_POSIX_ACL
 
 static struct posix_acl *btrfs_get_acl(struct inode *inode, int type)
 {
@@ -313,7 +313,7 @@ struct xattr_handler btrfs_xattr_acl_access_handler = {
         .set    = btrfs_xattr_acl_access_set,
 };
 
-#else /* CONFIG_BTRFS_POSIX_ACL */
+#else /* CONFIG_BTRFS_FS_POSIX_ACL */
 
 int btrfs_acl_chmod(struct inode *inode)
 {
@@ -325,4 +325,4 @@ int btrfs_init_acl(struct inode *inode, struct inode *dir)
         return 0;
 }
 
-#endif /* CONFIG_BTRFS_POSIX_ACL */
+#endif /* CONFIG_BTRFS_FS_POSIX_ACL */
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 282ca085c2fb..c0861e781cdb 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -64,6 +64,51 @@ struct btrfs_worker_thread {
 };
 
 /*
+ * btrfs_start_workers uses kthread_run, which can block waiting for memory
+ * for a very long time.  It will actually throttle on page writeback,
+ * and so it may not make progress until after our btrfs worker threads
+ * process all of the pending work structs in their queue
+ *
+ * This means we can't use btrfs_start_workers from inside a btrfs worker
+ * thread that is used as part of cleaning dirty memory, which pretty much
+ * involves all of the worker threads.
+ *
+ * Instead we have a helper queue who never has more than one thread
+ * where we scheduler thread start operations.  This worker_start struct
+ * is used to contain the work and hold a pointer to the queue that needs
+ * another worker.
+ */
+struct worker_start {
+        struct btrfs_work work;
+        struct btrfs_workers *queue;
+};
+
+static void start_new_worker_func(struct btrfs_work *work)
+{
+        struct worker_start *start;
+        start = container_of(work, struct worker_start, work);
+        btrfs_start_workers(start->queue, 1);
+        kfree(start);
+}
+
+static int start_new_worker(struct btrfs_workers *queue)
+{
+        struct worker_start *start;
+        int ret;
+
+        start = kzalloc(sizeof(*start), GFP_NOFS);
+        if (!start)
+                return -ENOMEM;
+
+        start->work.func = start_new_worker_func;
+        start->queue = queue;
+        ret = btrfs_queue_worker(queue->atomic_worker_start, &start->work);
+        if (ret)
+                kfree(start);
+        return ret;
+}
+
+/*
  * helper function to move a thread onto the idle list after it
  * has finished some requests.
  */
@@ -118,11 +163,13 @@ static void check_pending_worker_creates(struct btrfs_worker_thread *worker)
                 goto out;
 
         workers->atomic_start_pending = 0;
-        if (workers->num_workers >= workers->max_workers)
+        if (workers->num_workers + workers->num_workers_starting >=
+            workers->max_workers)
                 goto out;
 
+        workers->num_workers_starting += 1;
         spin_unlock_irqrestore(&workers->lock, flags);
-        btrfs_start_workers(workers, 1);
+        start_new_worker(workers);
         return;
 
 out:
@@ -390,9 +437,11 @@ int btrfs_stop_workers(struct btrfs_workers *workers)
 /*
  * simple init on struct btrfs_workers
  */
-void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max)
+void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max,
+                        struct btrfs_workers *async_helper)
 {
         workers->num_workers = 0;
+        workers->num_workers_starting = 0;
         INIT_LIST_HEAD(&workers->worker_list);
         INIT_LIST_HEAD(&workers->idle_list);
         INIT_LIST_HEAD(&workers->order_list);
@@ -404,14 +453,15 @@ void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max)
         workers->name = name;
         workers->ordered = 0;
         workers->atomic_start_pending = 0;
-        workers->atomic_worker_start = 0;
+        workers->atomic_worker_start = async_helper;
 }
 
 /*
  * starts new worker threads.  This does not enforce the max worker
  * count in case you need to temporarily go past it.
  */
-int btrfs_start_workers(struct btrfs_workers *workers, int num_workers)
+static int __btrfs_start_workers(struct btrfs_workers *workers,
+                                 int num_workers)
 {
         struct btrfs_worker_thread *worker;
         int ret = 0;
@@ -444,6 +494,8 @@ int btrfs_start_workers(struct btrfs_workers *workers, int num_workers)
                 list_add_tail(&worker->worker_list, &workers->idle_list);
                 worker->idle = 1;
                 workers->num_workers++;
+                workers->num_workers_starting--;
+                WARN_ON(workers->num_workers_starting < 0);
                 spin_unlock_irq(&workers->lock);
         }
         return 0;
@@ -452,6 +504,14 @@ fail:
         return ret;
 }
 
+int btrfs_start_workers(struct btrfs_workers *workers, int num_workers)
+{
+        spin_lock_irq(&workers->lock);
+        workers->num_workers_starting += num_workers;
+        spin_unlock_irq(&workers->lock);
+        return __btrfs_start_workers(workers, num_workers);
+}
+
 /*
  * run through the list and find a worker thread that doesn't have a lot
  * to do right now.  This can return null if we aren't yet at the thread
@@ -461,7 +521,10 @@ static struct btrfs_worker_thread *next_worker(struct btrfs_workers *workers)
 {
         struct btrfs_worker_thread *worker;
         struct list_head *next;
-        int enforce_min = workers->num_workers < workers->max_workers;
+        int enforce_min;
+
+        enforce_min = (workers->num_workers + workers->num_workers_starting) <
+                workers->max_workers;
 
         /*
          * if we find an idle thread, don't move it to the end of the
@@ -509,15 +572,17 @@ again:
         worker = next_worker(workers);
 
         if (!worker) {
-                if (workers->num_workers >= workers->max_workers) {
+                if (workers->num_workers + workers->num_workers_starting >=
+                    workers->max_workers) {
                         goto fallback;
                 } else if (workers->atomic_worker_start) {
                         workers->atomic_start_pending = 1;
                         goto fallback;
                 } else {
+                        workers->num_workers_starting++;
                         spin_unlock_irqrestore(&workers->lock, flags);
                         /* we're below the limit, start another worker */
-                        btrfs_start_workers(workers, 1);
+                        __btrfs_start_workers(workers, 1);
                         goto again;
                 }
         }
diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h
index fc089b95ec14..5077746cf85e 100644
--- a/fs/btrfs/async-thread.h
+++ b/fs/btrfs/async-thread.h
@@ -64,6 +64,8 @@ struct btrfs_workers {
         /* current number of running workers */
         int num_workers;
 
+        int num_workers_starting;
+
         /* max number of workers allowed.  changed by btrfs_start_workers */
         int max_workers;
 
@@ -78,9 +80,10 @@ struct btrfs_workers {
 
         /*
          * are we allowed to sleep while starting workers or are we required
-         * to start them at a later time?
+         * to start them at a later time?  If we can't sleep, this indicates
+         * which queue we need to use to schedule thread creation.
          */
-        int atomic_worker_start;
+        struct btrfs_workers *atomic_worker_start;
 
         /* list with all the work threads.  The workers on the idle thread
          * may be actively servicing jobs, but they haven't yet hit the
@@ -109,7 +112,8 @@ struct btrfs_workers {
 int btrfs_queue_worker(struct btrfs_workers *workers, struct btrfs_work *work);
 int btrfs_start_workers(struct btrfs_workers *workers, int num_workers);
 int btrfs_stop_workers(struct btrfs_workers *workers);
-void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max);
+void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max,
+                        struct btrfs_workers *async_starter);
 int btrfs_requeue_work(struct btrfs_work *work);
 void btrfs_set_work_high_prio(struct btrfs_work *work);
 #endif
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index a54d354cefcb..f6783a42f010 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -86,6 +86,12 @@ struct btrfs_inode {
          * transid of the trans_handle that last modified this inode
          */
         u64 last_trans;
+
+        /*
+         * log transid when this inode was last modified
+         */
+        u64 last_sub_trans;
+
         /*
          * transid that last logged this inode
          */
@@ -128,12 +134,14 @@ struct btrfs_inode {
         u64 last_unlink_trans;
 
         /*
-         * These two counters are for delalloc metadata reservations.  We keep
-         * track of how many extents we've accounted for vs how many extents we
-         * have.
+         * Counters to keep track of the number of extent item's we may use due
+         * to delalloc and such.  outstanding_extents is the number of extent
+         * items we think we'll end up using, and reserved_extents is the number
+         * of extent items we've reserved metadata for.
          */
-        int delalloc_reserved_extents;
-        int delalloc_extents;
+        spinlock_t accounting_lock;
+        int reserved_extents;
+        int outstanding_extents;
 
         /*
          * ordered_data_close is set by truncate when a file that used
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index dd8ced9814c4..444b3e9b92a4 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -691,14 +691,17 @@ struct btrfs_space_info {
 
         struct list_head list;
 
+        /* for controlling how we free up space for allocations */
+        wait_queue_head_t allocate_wait;
+        wait_queue_head_t flush_wait;
+        int allocating_chunk;
+        int flushing;
+
         /* for block groups in our same type */
         struct list_head block_groups;
         spinlock_t lock;
         struct rw_semaphore groups_sem;
         atomic_t caching_threads;
-
-        int allocating_chunk;
-        wait_queue_head_t wait;
 };
 
 /*
@@ -907,6 +910,7 @@ struct btrfs_fs_info {
          * A third pool does submit_bio to avoid deadlocking with the other
          * two
          */
+        struct btrfs_workers generic_worker;
         struct btrfs_workers workers;
         struct btrfs_workers delalloc_workers;
         struct btrfs_workers endio_workers;
@@ -914,6 +918,7 @@ struct btrfs_fs_info {
         struct btrfs_workers endio_meta_write_workers;
         struct btrfs_workers endio_write_workers;
         struct btrfs_workers submit_workers;
+        struct btrfs_workers enospc_workers;
         /*
          * fixup workers take dirty pages that didn't properly go through
          * the cow mechanism and make them safe to write.  It happens
@@ -1004,7 +1009,10 @@ struct btrfs_root {
         atomic_t log_writers;
         atomic_t log_commit[2];
         unsigned long log_transid;
+        unsigned long last_log_commit;
         unsigned long log_batch;
+        pid_t log_start_pid;
+        bool log_multiple_pids;
 
         u64 objectid;
         u64 last_trans;
@@ -1145,6 +1153,7 @@ struct btrfs_root {
 #define BTRFS_MOUNT_FLUSHONCOMMIT       (1 << 7)
 #define BTRFS_MOUNT_SSD_SPREAD          (1 << 8)
 #define BTRFS_MOUNT_NOSSD               (1 << 9)
+#define BTRFS_MOUNT_DISCARD             (1 << 10)
 
 #define btrfs_clear_opt(o, opt)         ((o) &= ~BTRFS_MOUNT_##opt)
 #define btrfs_set_opt(o, opt)           ((o) |= BTRFS_MOUNT_##opt)
@@ -2323,7 +2332,7 @@ int btrfs_orphan_del(struct btrfs_trans_handle *trans, struct inode *inode);
 void btrfs_orphan_cleanup(struct btrfs_root *root);
 int btrfs_cont_expand(struct inode *inode, loff_t size);
 int btrfs_invalidate_inodes(struct btrfs_root *root);
-extern struct dentry_operations btrfs_dentry_operations;
+extern const struct dentry_operations btrfs_dentry_operations;
 
 /* ioctl.c */
 long btrfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
@@ -2366,7 +2375,7 @@ int btrfs_parse_options(struct btrfs_root *root, char *options);
 int btrfs_sync_fs(struct super_block *sb, int wait);
 
 /* acl.c */
-#ifdef CONFIG_BTRFS_POSIX_ACL
+#ifdef CONFIG_BTRFS_FS_POSIX_ACL
 int btrfs_check_acl(struct inode *inode, int mask);
 #else
 #define btrfs_check_acl NULL
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index af0435f79fa6..02b6afbd7450 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -917,6 +917,7 @@ static int __setup_root(u32 nodesize, u32 leafsize, u32 sectorsize,
         atomic_set(&root->log_writers, 0);
         root->log_batch = 0;
         root->log_transid = 0;
+        root->last_log_commit = 0;
         extent_io_tree_init(&root->dirty_log_pages,
                              fs_info->btree_inode->i_mapping, GFP_NOFS);
 
@@ -1087,6 +1088,7 @@ int btrfs_add_log_tree(struct btrfs_trans_handle *trans,
         WARN_ON(root->log_root);
         root->log_root = log_root;
         root->log_transid = 0;
+        root->last_log_commit = 0;
         return 0;
 }
 
@@ -1746,21 +1748,25 @@ struct btrfs_root *open_ctree(struct super_block *sb,
                 err = -EINVAL;
                 goto fail_iput;
         }
-printk("thread pool is %d\n", fs_info->thread_pool_size);
-        /*
-         * we need to start all the end_io workers up front because the
-         * queue work function gets called at interrupt time, and so it
-         * cannot dynamically grow.
-         */
+
+        btrfs_init_workers(&fs_info->generic_worker,
+                           "genwork", 1, NULL);
+
         btrfs_init_workers(&fs_info->workers, "worker",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
 
         btrfs_init_workers(&fs_info->delalloc_workers, "delalloc",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
 
         btrfs_init_workers(&fs_info->submit_workers, "submit",
                            min_t(u64, fs_devices->num_devices,
-                           fs_info->thread_pool_size));
+                           fs_info->thread_pool_size),
+                           &fs_info->generic_worker);
+        btrfs_init_workers(&fs_info->enospc_workers, "enospc",
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
 
         /* a higher idle thresh on the submit workers makes it much more
          * likely that bios will be send down in a sane order to the
@@ -1774,15 +1780,20 @@ printk("thread pool is %d\n", fs_info->thread_pool_size);
         fs_info->delalloc_workers.idle_thresh = 2;
         fs_info->delalloc_workers.ordered = 1;
 
-        btrfs_init_workers(&fs_info->fixup_workers, "fixup", 1);
+        btrfs_init_workers(&fs_info->fixup_workers, "fixup", 1,
+                           &fs_info->generic_worker);
         btrfs_init_workers(&fs_info->endio_workers, "endio",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
         btrfs_init_workers(&fs_info->endio_meta_workers, "endio-meta",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
         btrfs_init_workers(&fs_info->endio_meta_write_workers,
-                           "endio-meta-write", fs_info->thread_pool_size);
+                           "endio-meta-write", fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
         btrfs_init_workers(&fs_info->endio_write_workers, "endio-write",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
 
         /*
          * endios are largely parallel and should have a very
@@ -1794,12 +1805,8 @@ printk("thread pool is %d\n", fs_info->thread_pool_size);
         fs_info->endio_write_workers.idle_thresh = 2;
         fs_info->endio_meta_write_workers.idle_thresh = 2;
 
-        fs_info->endio_workers.atomic_worker_start = 1;
-        fs_info->endio_meta_workers.atomic_worker_start = 1;
-        fs_info->endio_write_workers.atomic_worker_start = 1;
-        fs_info->endio_meta_write_workers.atomic_worker_start = 1;
-
         btrfs_start_workers(&fs_info->workers, 1);
+        btrfs_start_workers(&fs_info->generic_worker, 1);
         btrfs_start_workers(&fs_info->submit_workers, 1);
         btrfs_start_workers(&fs_info->delalloc_workers, 1);
         btrfs_start_workers(&fs_info->fixup_workers, 1);
@@ -1807,6 +1814,7 @@ printk("thread pool is %d\n", fs_info->thread_pool_size);
         btrfs_start_workers(&fs_info->endio_meta_workers, 1);
         btrfs_start_workers(&fs_info->endio_meta_write_workers, 1);
         btrfs_start_workers(&fs_info->endio_write_workers, 1);
+        btrfs_start_workers(&fs_info->enospc_workers, 1);
 
         fs_info->bdi.ra_pages *= btrfs_super_num_devices(disk_super);
         fs_info->bdi.ra_pages = max(fs_info->bdi.ra_pages,
@@ -2012,6 +2020,7 @@ fail_chunk_root:
         free_extent_buffer(chunk_root->node);
         free_extent_buffer(chunk_root->commit_root);
 fail_sb_buffer:
+        btrfs_stop_workers(&fs_info->generic_worker);
         btrfs_stop_workers(&fs_info->fixup_workers);
         btrfs_stop_workers(&fs_info->delalloc_workers);
         btrfs_stop_workers(&fs_info->workers);
@@ -2020,6 +2029,7 @@ fail_sb_buffer:
         btrfs_stop_workers(&fs_info->endio_meta_write_workers);
         btrfs_stop_workers(&fs_info->endio_write_workers);
         btrfs_stop_workers(&fs_info->submit_workers);
+        btrfs_stop_workers(&fs_info->enospc_workers);
 fail_iput:
         invalidate_inode_pages2(fs_info->btree_inode->i_mapping);
         iput(fs_info->btree_inode);
@@ -2437,6 +2447,7 @@ int close_ctree(struct btrfs_root *root)
 
         iput(fs_info->btree_inode);
 
+        btrfs_stop_workers(&fs_info->generic_worker);
         btrfs_stop_workers(&fs_info->fixup_workers);
         btrfs_stop_workers(&fs_info->delalloc_workers);
         btrfs_stop_workers(&fs_info->workers);
@@ -2445,6 +2456,7 @@ int close_ctree(struct btrfs_root *root)
         btrfs_stop_workers(&fs_info->endio_meta_write_workers);
         btrfs_stop_workers(&fs_info->endio_write_workers);
         btrfs_stop_workers(&fs_info->submit_workers);
+        btrfs_stop_workers(&fs_info->enospc_workers);
 
         btrfs_close_devices(fs_info->fs_devices);
         btrfs_mapping_tree_free(&fs_info->mapping_tree);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 359a754c782c..94627c4cc193 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1568,23 +1568,23 @@ static int remove_extent_backref(struct btrfs_trans_handle *trans,
         return ret;
 }
 
-#ifdef BIO_RW_DISCARD
 static void btrfs_issue_discard(struct block_device *bdev,
                                 u64 start, u64 len)
 {
         blkdev_issue_discard(bdev, start >> 9, len >> 9, GFP_KERNEL,
                              DISCARD_FL_BARRIER);
 }
-#endif
 
 static int btrfs_discard_extent(struct btrfs_root *root, u64 bytenr,
                                 u64 num_bytes)
 {
-#ifdef BIO_RW_DISCARD
         int ret;
         u64 map_length = num_bytes;
         struct btrfs_multi_bio *multi = NULL;
 
+        if (!btrfs_test_opt(root, DISCARD))
+                return 0;
+
         /* Tell the block device(s) that the sectors can be discarded */
         ret = btrfs_map_block(&root->fs_info->mapping_tree, READ,
                               bytenr, &map_length, &multi, 0);
@@ -1604,9 +1604,6 @@ static int btrfs_discard_extent(struct btrfs_root *root, u64 bytenr,
         }
 
         return ret;
-#else
-        return 0;
-#endif
 }
 
 int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
@@ -2824,14 +2821,17 @@ int btrfs_unreserve_metadata_for_delalloc(struct btrfs_root *root,
                                            num_items);
 
         spin_lock(&meta_sinfo->lock);
-        if (BTRFS_I(inode)->delalloc_reserved_extents <=
-            BTRFS_I(inode)->delalloc_extents) {
+        spin_lock(&BTRFS_I(inode)->accounting_lock);
+        if (BTRFS_I(inode)->reserved_extents <=
+            BTRFS_I(inode)->outstanding_extents) {
+                spin_unlock(&BTRFS_I(inode)->accounting_lock);
                 spin_unlock(&meta_sinfo->lock);
                 return 0;
         }
+        spin_unlock(&BTRFS_I(inode)->accounting_lock);
 
-        BTRFS_I(inode)->delalloc_reserved_extents--;
-        BUG_ON(BTRFS_I(inode)->delalloc_reserved_extents < 0);
+        BTRFS_I(inode)->reserved_extents--;
+        BUG_ON(BTRFS_I(inode)->reserved_extents < 0);
 
         if (meta_sinfo->bytes_delalloc < num_bytes) {
                 bug = true;
@@ -2864,6 +2864,107 @@ static void check_force_delalloc(struct btrfs_space_info *meta_sinfo)
                 meta_sinfo->force_delalloc = 0;
 }
 
+struct async_flush {
+        struct btrfs_root *root;
+        struct btrfs_space_info *info;
+        struct btrfs_work work;
+};
+
+static noinline void flush_delalloc_async(struct btrfs_work *work)
+{
+        struct async_flush *async;
+        struct btrfs_root *root;
+        struct btrfs_space_info *info;
+
+        async = container_of(work, struct async_flush, work);
+        root = async->root;
+        info = async->info;
+
+        btrfs_start_delalloc_inodes(root);
+        wake_up(&info->flush_wait);
+        btrfs_wait_ordered_extents(root, 0);
+
+        spin_lock(&info->lock);
+        info->flushing = 0;
+        spin_unlock(&info->lock);
+        wake_up(&info->flush_wait);
+
+        kfree(async);
+}
+
+static void wait_on_flush(struct btrfs_space_info *info)
+{
+        DEFINE_WAIT(wait);
+        u64 used;
+
+        while (1) {
+                prepare_to_wait(&info->flush_wait, &wait,
+                                TASK_UNINTERRUPTIBLE);
+                spin_lock(&info->lock);
+                if (!info->flushing) {
+                        spin_unlock(&info->lock);
+                        break;
+                }
+
+                used = info->bytes_used + info->bytes_reserved +
+                        info->bytes_pinned + info->bytes_readonly +
+                        info->bytes_super + info->bytes_root +
+                        info->bytes_may_use + info->bytes_delalloc;
+                if (used < info->total_bytes) {
+                        spin_unlock(&info->lock);
+                        break;
+                }
+                spin_unlock(&info->lock);
+                schedule();
+        }
+        finish_wait(&info->flush_wait, &wait);
+}
+
+static void flush_delalloc(struct btrfs_root *root,
+                                 struct btrfs_space_info *info)
+{
+        struct async_flush *async;
+        bool wait = false;
+
+        spin_lock(&info->lock);
+
+        if (!info->flushing) {
+                info->flushing = 1;
+                init_waitqueue_head(&info->flush_wait);
+        } else {
+                wait = true;
+        }
+
+        spin_unlock(&info->lock);
+
+        if (wait) {
+                wait_on_flush(info);
+                return;
+        }
+
+        async = kzalloc(sizeof(*async), GFP_NOFS);
+        if (!async)
+                goto flush;
+
+        async->root = root;
+        async->info = info;
+        async->work.func = flush_delalloc_async;
+
+        btrfs_queue_worker(&root->fs_info->enospc_workers,
+                           &async->work);
+        wait_on_flush(info);
+        return;
+
+flush:
+        btrfs_start_delalloc_inodes(root);
+        btrfs_wait_ordered_extents(root, 0);
+
+        spin_lock(&info->lock);
+        info->flushing = 0;
+        spin_unlock(&info->lock);
+        wake_up(&info->flush_wait);
+}
+
 static int maybe_allocate_chunk(struct btrfs_root *root,
                                  struct btrfs_space_info *info)
 {
@@ -2876,10 +2977,10 @@ static int maybe_allocate_chunk(struct btrfs_root *root,
 
         free_space = btrfs_super_total_bytes(disk_super);
         /*
-         * we allow the metadata to grow to a max of either 5gb or 5% of the
+         * we allow the metadata to grow to a max of either 10gb or 5% of the
          * space in the volume.
          */
-        min_metadata = min((u64)5 * 1024 * 1024 * 1024,
+        min_metadata = min((u64)10 * 1024 * 1024 * 1024,
                              div64_u64(free_space * 5, 100));
         if (info->total_bytes >= min_metadata) {
                 spin_unlock(&info->lock);
@@ -2894,7 +2995,7 @@ static int maybe_allocate_chunk(struct btrfs_root *root,
         if (!info->allocating_chunk) {
                 info->force_alloc = 1;
                 info->allocating_chunk = 1;
-                init_waitqueue_head(&info->wait);
+                init_waitqueue_head(&info->allocate_wait);
         } else {
                 wait = true;
         }
@@ -2902,7 +3003,7 @@ static int maybe_allocate_chunk(struct btrfs_root *root,
         spin_unlock(&info->lock);
 
         if (wait) {
-                wait_event(info->wait,
+                wait_event(info->allocate_wait,
                            !info->allocating_chunk);
                 return 1;
         }
@@ -2923,7 +3024,7 @@ out:
         spin_lock(&info->lock);
         info->allocating_chunk = 0;
         spin_unlock(&info->lock);
-        wake_up(&info->wait);
+        wake_up(&info->allocate_wait);
 
         if (ret)
                 return 0;
@@ -2981,21 +3082,20 @@ again:
                         filemap_flush(inode->i_mapping);
                         goto again;
                 } else if (flushed == 3) {
-                        btrfs_start_delalloc_inodes(root);
-                        btrfs_wait_ordered_extents(root, 0);
+                        flush_delalloc(root, meta_sinfo);
                         goto again;
                 }
                 spin_lock(&meta_sinfo->lock);
                 meta_sinfo->bytes_delalloc -= num_bytes;
                 spin_unlock(&meta_sinfo->lock);
                 printk(KERN_ERR "enospc, has %d, reserved %d\n",
-                       BTRFS_I(inode)->delalloc_extents,
-                       BTRFS_I(inode)->delalloc_reserved_extents);
+                       BTRFS_I(inode)->outstanding_extents,
+                       BTRFS_I(inode)->reserved_extents);
                 dump_space_info(meta_sinfo, 0, 0);
                 return -ENOSPC;
         }
 
-        BTRFS_I(inode)->delalloc_reserved_extents++;
+        BTRFS_I(inode)->reserved_extents++;
         check_force_delalloc(meta_sinfo);
         spin_unlock(&meta_sinfo->lock);
 
@@ -3094,8 +3194,7 @@ again:
                 }
 
                 if (retries == 2) {
-                        btrfs_start_delalloc_inodes(root);
-                        btrfs_wait_ordered_extents(root, 0);
+                        flush_delalloc(root, meta_sinfo);
                         goto again;
                 }
                 spin_lock(&meta_sinfo->lock);
@@ -3588,6 +3687,14 @@ static int pin_down_bytes(struct btrfs_trans_handle *trans,
         if (is_data)
                 goto pinit;
 
+        /*
+         * discard is sloooow, and so triggering discards on
+         * individual btree blocks isn't a good plan.  Just
+         * pin everything in discard mode.
+         */
+        if (btrfs_test_opt(root, DISCARD))
+                goto pinit;
+
         buf = btrfs_find_tree_block(root, bytenr, num_bytes);
         if (!buf)
                 goto pinit;
@@ -3995,7 +4102,7 @@ wait_block_group_cache_done(struct btrfs_block_group_cache *cache)
 }
 
 enum btrfs_loop_type {
-        LOOP_CACHED_ONLY = 0,
+        LOOP_FIND_IDEAL = 0,
         LOOP_CACHING_NOWAIT = 1,
         LOOP_CACHING_WAIT = 2,
         LOOP_ALLOC_CHUNK = 3,
@@ -4024,11 +4131,15 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
         struct btrfs_block_group_cache *block_group = NULL;
         int empty_cluster = 2 * 1024 * 1024;
         int allowed_chunk_alloc = 0;
+        int done_chunk_alloc = 0;
         struct btrfs_space_info *space_info;
         int last_ptr_loop = 0;
         int loop = 0;
         bool found_uncached_bg = false;
         bool failed_cluster_refill = false;
+        bool failed_alloc = false;
+        u64 ideal_cache_percent = 0;
+        u64 ideal_cache_offset = 0;
 
         WARN_ON(num_bytes < root->sectorsize);
         btrfs_set_key_type(ins, BTRFS_EXTENT_ITEM_KEY);
@@ -4064,14 +4175,19 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
                 empty_cluster = 0;
 
         if (search_start == hint_byte) {
+ideal_cache:
                 block_group = btrfs_lookup_block_group(root->fs_info,
                                                        search_start);
                 /*
                  * we don't want to use the block group if it doesn't match our
                  * allocation bits, or if its not cached.
+                 *
+                 * However if we are re-searching with an ideal block group
+                 * picked out then we don't care that the block group is cached.
                  */
                 if (block_group && block_group_bits(block_group, data) &&
-                    block_group_cache_done(block_group)) {
+                    (block_group->cached != BTRFS_CACHE_NO ||
+                     search_start == ideal_cache_offset)) {
                         down_read(&space_info->groups_sem);
                         if (list_empty(&block_group->list) ||
                             block_group->ro) {
@@ -4083,13 +4199,13 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
                                  */
                                 btrfs_put_block_group(block_group);
                                 up_read(&space_info->groups_sem);
-                        } else
+                        } else {
                                 goto have_block_group;
+                        }
                 } else if (block_group) {
                         btrfs_put_block_group(block_group);
                 }
         }
-
 search:
         down_read(&space_info->groups_sem);
         list_for_each_entry(block_group, &space_info->block_groups, list) {
@@ -4101,28 +4217,45 @@ search:
 
 have_block_group:
                 if (unlikely(block_group->cached == BTRFS_CACHE_NO)) {
+                        u64 free_percent;
+
+                        free_percent = btrfs_block_group_used(&block_group->item);
+                        free_percent *= 100;
+                        free_percent = div64_u64(free_percent,
+                                                 block_group->key.offset);
+                        free_percent = 100 - free_percent;
+                        if (free_percent > ideal_cache_percent &&
+                            likely(!block_group->ro)) {
+                                ideal_cache_offset = block_group->key.objectid;
+                                ideal_cache_percent = free_percent;
+                        }
+
                         /*
-                         * we want to start caching kthreads, but not too many
-                         * right off the bat so we don't overwhelm the system,
-                         * so only start them if there are less than 2 and we're
-                         * in the initial allocation phase.
+                         * We only want to start kthread caching if we are at
+                         * the point where we will wait for caching to make
+                         * progress, or if our ideal search is over and we've
+                         * found somebody to start caching.
                          */
                         if (loop > LOOP_CACHING_NOWAIT ||
-                            atomic_read(&space_info->caching_threads) < 2) {
+                            (loop > LOOP_FIND_IDEAL &&
+                             atomic_read(&space_info->caching_threads) < 2)) {
                                 ret = cache_block_group(block_group);
                                 BUG_ON(ret);
                         }
-                }
-
-                cached = block_group_cache_done(block_group);
-                if (unlikely(!cached)) {
                         found_uncached_bg = true;
 
-                        /* if we only want cached bgs, loop */
-                        if (loop == LOOP_CACHED_ONLY)
+                        /*
+                         * If loop is set for cached only, try the next block
+                         * group.
+                         */
+                        if (loop == LOOP_FIND_IDEAL)
                                 goto loop;
                 }
 
+                cached = block_group_cache_done(block_group);
+                if (unlikely(!cached))
+                        found_uncached_bg = true;
+
                 if (unlikely(block_group->ro))
                         goto loop;
 
@@ -4233,14 +4366,23 @@ refill_cluster:
 
                 offset = btrfs_find_space_for_alloc(block_group, search_start,
                                                     num_bytes, empty_size);
-                if (!offset && (cached || (!cached &&
-                                           loop == LOOP_CACHING_NOWAIT))) {
-                        goto loop;
-                } else if (!offset && (!cached &&
-                                       loop > LOOP_CACHING_NOWAIT)) {
+                /*
+                 * If we didn't find a chunk, and we haven't failed on this
+                 * block group before, and this block group is in the middle of
+                 * caching and we are ok with waiting, then go ahead and wait
+                 * for progress to be made, and set failed_alloc to true.
+                 *
+                 * If failed_alloc is true then we've already waited on this
+                 * block group once and should move on to the next block group.
+                 */
+                if (!offset && !failed_alloc && !cached &&
+                    loop > LOOP_CACHING_NOWAIT) {
                         wait_block_group_cache_progress(block_group,
-                                        num_bytes + empty_size);
+                                                num_bytes + empty_size);
+                        failed_alloc = true;
                         goto have_block_group;
+                } else if (!offset) {
+                        goto loop;
                 }
 checks:
                 search_start = stripe_align(root, offset);
@@ -4288,13 +4430,16 @@ checks:
                 break;
 loop:
                 failed_cluster_refill = false;
+                failed_alloc = false;
                 btrfs_put_block_group(block_group);
         }
         up_read(&space_info->groups_sem);
 
-        /* LOOP_CACHED_ONLY, only search fully cached block groups
-         * LOOP_CACHING_NOWAIT, search partially cached block groups, but
-         *                      dont wait foR them to finish caching
+        /* LOOP_FIND_IDEAL, only search caching/cached bg's, and don't wait for
+         *                      for them to make caching progress.  Also
+         *                      determine the best possible bg to cache
+         * LOOP_CACHING_NOWAIT, search partially cached block groups, kicking
+         *                      caching kthreads as we move along
          * LOOP_CACHING_WAIT, search everything, and wait if our bg is caching
          * LOOP_ALLOC_CHUNK, force a chunk allocation and try again
          * LOOP_NO_EMPTY_SIZE, set empty_size and empty_cluster to 0 and try
@@ -4303,12 +4448,47 @@ loop:
         if (!ins->objectid && loop < LOOP_NO_EMPTY_SIZE &&
             (found_uncached_bg || empty_size || empty_cluster ||
              allowed_chunk_alloc)) {
-                if (found_uncached_bg) {
+                if (loop == LOOP_FIND_IDEAL && found_uncached_bg) {
                         found_uncached_bg = false;
-                        if (loop < LOOP_CACHING_WAIT) {
-                                loop++;
+                        loop++;
+                        if (!ideal_cache_percent &&
+                            atomic_read(&space_info->caching_threads))
                                 goto search;
-                        }
+
+                        /*
+                         * 1 of the following 2 things have happened so far
+                         *
+                         * 1) We found an ideal block group for caching that
+                         * is mostly full and will cache quickly, so we might
+                         * as well wait for it.
+                         *
+                         * 2) We searched for cached only and we didn't find
+                         * anything, and we didn't start any caching kthreads
+                         * either, so chances are we will loop through and
+                         * start a couple caching kthreads, and then come back
+                         * around and just wait for them.  This will be slower
+                         * because we will have 2 caching kthreads reading at
+                         * the same time when we could have just started one
+                         * and waited for it to get far enough to give us an
+                         * allocation, so go ahead and go to the wait caching
+                         * loop.
+                         */
+                        loop = LOOP_CACHING_WAIT;
+                        search_start = ideal_cache_offset;
+                        ideal_cache_percent = 0;
+                        goto ideal_cache;
+                } else if (loop == LOOP_FIND_IDEAL) {
+                        /*
+                         * Didn't find a uncached bg, wait on anything we find
+                         * next.
+                         */
+                        loop = LOOP_CACHING_WAIT;
+                        goto search;
+                }
+
+                if (loop < LOOP_CACHING_WAIT) {
+                        loop++;
+                        goto search;
                 }
 
                 if (loop == LOOP_ALLOC_CHUNK) {
@@ -4320,7 +4500,8 @@ loop:
                         ret = do_chunk_alloc(trans, root, num_bytes +
                                              2 * 1024 * 1024, data, 1);
                         allowed_chunk_alloc = 0;
-                } else {
+                        done_chunk_alloc = 1;
+                } else if (!done_chunk_alloc) {
                         space_info->force_alloc = 1;
                 }
 
@@ -4799,6 +4980,7 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans,
         u64 bytenr;
         u64 generation;
         u64 refs;
+        u64 flags;
         u64 last = 0;
         u32 nritems;
         u32 blocksize;
@@ -4836,15 +5018,19 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans,
                     generation <= root->root_key.offset)
                         continue;
 
+                /* We don't lock the tree block, it's OK to be racy here */
+                ret = btrfs_lookup_extent_info(trans, root, bytenr, blocksize,
+                                               &refs, &flags);
+                BUG_ON(ret);
+                BUG_ON(refs == 0);
+
                 if (wc->stage == DROP_REFERENCE) {
-                        ret = btrfs_lookup_extent_info(trans, root,
-                                                bytenr, blocksize,
-                                                &refs, NULL);
-                        BUG_ON(ret);
-                        BUG_ON(refs == 0);
                         if (refs == 1)
                                 goto reada;
 
+                        if (wc->level == 1 &&
+                            (flags & BTRFS_BLOCK_FLAG_FULL_BACKREF))
+                                continue;
                         if (!wc->update_ref ||
                             generation <= root->root_key.offset)
                                 continue;
@@ -4853,6 +5039,10 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans,
                                                   &wc->update_progress);
                         if (ret < 0)
                                 continue;
+                } else {
+                        if (wc->level == 1 &&
+                            (flags & BTRFS_BLOCK_FLAG_FULL_BACKREF))
+                                continue;
                 }
 reada:
                 ret = readahead_tree_block(root, bytenr, blocksize,
@@ -4876,7 +5066,7 @@ reada:
 static noinline int walk_down_proc(struct btrfs_trans_handle *trans,
                                    struct btrfs_root *root,
                                    struct btrfs_path *path,
-                                   struct walk_control *wc)
+                                   struct walk_control *wc, int lookup_info)
 {
         int level = wc->level;
         struct extent_buffer *eb = path->nodes[level];
@@ -4891,8 +5081,9 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans,
          * when reference count of tree block is 1, it won't increase
          * again. once full backref flag is set, we never clear it.
          */
-        if ((wc->stage == DROP_REFERENCE && wc->refs[level] != 1) ||
-            (wc->stage == UPDATE_BACKREF && !(wc->flags[level] & flag))) {
+        if (lookup_info &&
+            ((wc->stage == DROP_REFERENCE && wc->refs[level] != 1) ||
+             (wc->stage == UPDATE_BACKREF && !(wc->flags[level] & flag)))) {
                 BUG_ON(!path->locks[level]);
                 ret = btrfs_lookup_extent_info(trans, root,
                                                eb->start, eb->len,
@@ -4953,7 +5144,7 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans,
 static noinline int do_walk_down(struct btrfs_trans_handle *trans,
                                  struct btrfs_root *root,
                                  struct btrfs_path *path,
-                                 struct walk_control *wc)
+                                 struct walk_control *wc, int *lookup_info)
 {
         u64 bytenr;
         u64 generation;
@@ -4973,8 +5164,10 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
          * for the subtree
          */
         if (wc->stage == UPDATE_BACKREF &&
-            generation <= root->root_key.offset)
+            generation <= root->root_key.offset) {
+                *lookup_info = 1;
                 return 1;
+        }
 
         bytenr = btrfs_node_blockptr(path->nodes[level], path->slots[level]);
         blocksize = btrfs_level_size(root, level - 1);
@@ -4987,14 +5180,19 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
         btrfs_tree_lock(next);
         btrfs_set_lock_blocking(next);
 
-        if (wc->stage == DROP_REFERENCE) {
-                ret = btrfs_lookup_extent_info(trans, root, bytenr, blocksize,
-                                               &wc->refs[level - 1],
-                                               &wc->flags[level - 1]);
-                BUG_ON(ret);
-                BUG_ON(wc->refs[level - 1] == 0);
+        ret = btrfs_lookup_extent_info(trans, root, bytenr, blocksize,
+                                       &wc->refs[level - 1],
+                                       &wc->flags[level - 1]);
+        BUG_ON(ret);
+        BUG_ON(wc->refs[level - 1] == 0);
+        *lookup_info = 0;
 
+        if (wc->stage == DROP_REFERENCE) {
                 if (wc->refs[level - 1] > 1) {
+                        if (level == 1 &&
+                            (wc->flags[0] & BTRFS_BLOCK_FLAG_FULL_BACKREF))
+                                goto skip;
+
                         if (!wc->update_ref ||
                             generation <= root->root_key.offset)
                                 goto skip;
@@ -5008,12 +5206,17 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
                         wc->stage = UPDATE_BACKREF;
                         wc->shared_level = level - 1;
                 }
+        } else {
+                if (level == 1 &&
+                    (wc->flags[0] & BTRFS_BLOCK_FLAG_FULL_BACKREF))
+                        goto skip;
         }
 
         if (!btrfs_buffer_uptodate(next, generation)) {
                 btrfs_tree_unlock(next);
                 free_extent_buffer(next);
                 next = NULL;
+                *lookup_info = 1;
         }
 
         if (!next) {
@@ -5036,21 +5239,22 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
 skip:
         wc->refs[level - 1] = 0;
         wc->flags[level - 1] = 0;
+        if (wc->stage == DROP_REFERENCE) {
+                if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF) {
+                        parent = path->nodes[level]->start;
+                } else {
+                        BUG_ON(root->root_key.objectid !=
+                               btrfs_header_owner(path->nodes[level]));
+                        parent = 0;
+                }
 
-        if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF) {
-                parent = path->nodes[level]->start;
-        } else {
-                BUG_ON(root->root_key.objectid !=
-                       btrfs_header_owner(path->nodes[level]));
-                parent = 0;
+                ret = btrfs_free_extent(trans, root, bytenr, blocksize, parent,
+                                        root->root_key.objectid, level - 1, 0);
+                BUG_ON(ret);
         }
-
-        ret = btrfs_free_extent(trans, root, bytenr, blocksize, parent,
-                                root->root_key.objectid, level - 1, 0);
-        BUG_ON(ret);
-
         btrfs_tree_unlock(next);
         free_extent_buffer(next);
+        *lookup_info = 1;
         return 1;
 }
 
@@ -5164,6 +5368,7 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
                                    struct walk_control *wc)
 {
         int level = wc->level;
+        int lookup_info = 1;
         int ret;
 
         while (level >= 0) {
@@ -5171,14 +5376,14 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
                     btrfs_header_nritems(path->nodes[level]))
                         break;
 
-                ret = walk_down_proc(trans, root, path, wc);
+                ret = walk_down_proc(trans, root, path, wc, lookup_info);
                 if (ret > 0)
                         break;
 
                 if (level == 0)
                         break;
 
-                ret = do_walk_down(trans, root, path, wc);
+                ret = do_walk_down(trans, root, path, wc, &lookup_info);
                 if (ret > 0) {
                         path->slots[level]++;
                         continue;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index de1793ba004a..96577e8bf9fd 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -460,7 +460,8 @@ static int clear_state_bit(struct extent_io_tree *tree,
                             struct extent_state *state, int bits, int wake,
                             int delete)
 {
-        int ret = state->state & bits;
+        int bits_to_clear = bits & ~EXTENT_DO_ACCOUNTING;
+        int ret = state->state & bits_to_clear;
 
         if ((bits & EXTENT_DIRTY) && (state->state & EXTENT_DIRTY)) {
                 u64 range = state->end - state->start + 1;
@@ -468,7 +469,7 @@ static int clear_state_bit(struct extent_io_tree *tree,
                 tree->dirty_bytes -= range;
         }
         clear_state_cb(tree, state, bits);
-        state->state &= ~bits;
+        state->state &= ~bits_to_clear;
         if (wake)
                 wake_up(&state->wq);
         if (delete || state->state == 0) {
@@ -956,7 +957,8 @@ int clear_extent_dirty(struct extent_io_tree *tree, u64 start, u64 end,
                        gfp_t mask)
 {
         return clear_extent_bit(tree, start, end,
-                                EXTENT_DIRTY | EXTENT_DELALLOC, 0, 0,
+                                EXTENT_DIRTY | EXTENT_DELALLOC |
+                                EXTENT_DO_ACCOUNTING, 0, 0,
                                 NULL, mask);
 }
 
@@ -1401,12 +1403,7 @@ out_failed:
 int extent_clear_unlock_delalloc(struct inode *inode,
                                 struct extent_io_tree *tree,
                                 u64 start, u64 end, struct page *locked_page,
-                                int unlock_pages,
-                                int clear_unlock,
-                                int clear_delalloc, int clear_dirty,
-                                int set_writeback,
-                                int end_writeback,
-                                int set_private2)
+                                unsigned long op)
 {
         int ret;
         struct page *pages[16];
@@ -1416,17 +1413,21 @@ int extent_clear_unlock_delalloc(struct inode *inode,
         int i;
         int clear_bits = 0;
 
-        if (clear_unlock)
+        if (op & EXTENT_CLEAR_UNLOCK)
                 clear_bits |= EXTENT_LOCKED;
-        if (clear_dirty)
+        if (op & EXTENT_CLEAR_DIRTY)
                 clear_bits |= EXTENT_DIRTY;
 
-        if (clear_delalloc)
+        if (op & EXTENT_CLEAR_DELALLOC)
                 clear_bits |= EXTENT_DELALLOC;
 
+        if (op & EXTENT_CLEAR_ACCOUNTING)
+                clear_bits |= EXTENT_DO_ACCOUNTING;
+
         clear_extent_bit(tree, start, end, clear_bits, 1, 0, NULL, GFP_NOFS);
-        if (!(unlock_pages || clear_dirty || set_writeback || end_writeback ||
-              set_private2))
+        if (!(op & (EXTENT_CLEAR_UNLOCK_PAGE | EXTENT_CLEAR_DIRTY |
+                    EXTENT_SET_WRITEBACK | EXTENT_END_WRITEBACK |
+                    EXTENT_SET_PRIVATE2)))
                 return 0;
 
         while (nr_pages > 0) {
@@ -1435,20 +1436,20 @@ int extent_clear_unlock_delalloc(struct inode *inode,
                                      nr_pages, ARRAY_SIZE(pages)), pages);
                 for (i = 0; i < ret; i++) {
 
-                        if (set_private2)
+                        if (op & EXTENT_SET_PRIVATE2)
                                 SetPagePrivate2(pages[i]);
 
                         if (pages[i] == locked_page) {
                                 page_cache_release(pages[i]);
                                 continue;
                         }
-                        if (clear_dirty)
+                        if (op & EXTENT_CLEAR_DIRTY)
                                 clear_page_dirty_for_io(pages[i]);
-                        if (set_writeback)
+                        if (op & EXTENT_SET_WRITEBACK)
                                 set_page_writeback(pages[i]);
-                        if (end_writeback)
+                        if (op & EXTENT_END_WRITEBACK)
                                 end_page_writeback(pages[i]);
-                        if (unlock_pages)
+                        if (op & EXTENT_CLEAR_UNLOCK_PAGE)
                                 unlock_page(pages[i]);
                         page_cache_release(pages[i]);
                 }
@@ -2714,7 +2715,8 @@ int extent_invalidatepage(struct extent_io_tree *tree,
         lock_extent(tree, start, end, GFP_NOFS);
         wait_on_page_writeback(page);
         clear_extent_bit(tree, start, end,
-                         EXTENT_LOCKED | EXTENT_DIRTY | EXTENT_DELALLOC,
+                         EXTENT_LOCKED | EXTENT_DIRTY | EXTENT_DELALLOC |
+                         EXTENT_DO_ACCOUNTING,
                          1, 1, NULL, GFP_NOFS);
         return 0;
 }
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 4794ec891fed..36de250a7b2b 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -15,6 +15,7 @@
 #define EXTENT_BUFFER_FILLED (1 << 8)
 #define EXTENT_BOUNDARY (1 << 9)
 #define EXTENT_NODATASUM (1 << 10)
+#define EXTENT_DO_ACCOUNTING (1 << 11)
 #define EXTENT_IOBITS (EXTENT_LOCKED | EXTENT_WRITEBACK)
 
 /* flags for bio submission */
@@ -25,6 +26,16 @@
 #define EXTENT_BUFFER_BLOCKING 1
 #define EXTENT_BUFFER_DIRTY 2
 
+/* these are flags for extent_clear_unlock_delalloc */
+#define EXTENT_CLEAR_UNLOCK_PAGE 0x1
+#define EXTENT_CLEAR_UNLOCK      0x2
+#define EXTENT_CLEAR_DELALLOC    0x4
+#define EXTENT_CLEAR_DIRTY       0x8
+#define EXTENT_SET_WRITEBACK     0x10
+#define EXTENT_END_WRITEBACK     0x20
+#define EXTENT_SET_PRIVATE2      0x40
+#define EXTENT_CLEAR_ACCOUNTING  0x80
+
 /*
  * page->private values.  Every page that is controlled by the extent
  * map has page->private set to one.
@@ -288,10 +299,5 @@ int extent_range_uptodate(struct extent_io_tree *tree,
 int extent_clear_unlock_delalloc(struct inode *inode,
                                 struct extent_io_tree *tree,
                                 u64 start, u64 end, struct page *locked_page,
-                                int unlock_page,
-                                int clear_unlock,
-                                int clear_delalloc, int clear_dirty,
-                                int set_writeback,
-                                int end_writeback,
-                                int set_private2);
+                                unsigned long op);
 #endif
diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 2c726b7b9faa..ccbdcb54ec5d 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -208,7 +208,7 @@ int unpin_extent_cache(struct extent_map_tree *tree, u64 start, u64 len)
         write_lock(&tree->lock);
         em = lookup_extent_mapping(tree, start, len);
 
-        WARN_ON(em->start != start || !em);
+        WARN_ON(!em || em->start != start);
 
         if (!em)
                 goto out;
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index f19e1259a971..06550affbd27 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -878,7 +878,8 @@ again:
                         btrfs_put_ordered_extent(ordered);
 
                 clear_extent_bits(&BTRFS_I(inode)->io_tree, start_pos,
-                                  last_pos - 1, EXTENT_DIRTY | EXTENT_DELALLOC,
+                                  last_pos - 1, EXTENT_DIRTY | EXTENT_DELALLOC |
+                                  EXTENT_DO_ACCOUNTING,
                                   GFP_NOFS);
                 unlock_extent(&BTRFS_I(inode)->io_tree,
                               start_pos, last_pos - 1, GFP_NOFS);
@@ -1085,8 +1086,10 @@ out_nolock:
                                         btrfs_end_transaction(trans, root);
                                 else
                                         btrfs_commit_transaction(trans, root);
-                        } else {
+                        } else if (ret != BTRFS_NO_LOG_SYNC) {
                                 btrfs_commit_transaction(trans, root);
+                        } else {
+                                btrfs_end_transaction(trans, root);
                         }
                 }
                 if (file->f_flags & O_DIRECT) {
@@ -1136,6 +1139,13 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
         int ret = 0;
         struct btrfs_trans_handle *trans;
 
+
+        /* we wait first, since the writeback may change the inode */
+        root->log_batch++;
+        /* the VFS called filemap_fdatawrite for us */
+        btrfs_wait_ordered_range(inode, 0, (u64)-1);
+        root->log_batch++;
+
         /*
          * check the transaction that last modified this inode
          * and see if its already been committed
@@ -1143,6 +1153,11 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
         if (!BTRFS_I(inode)->last_trans)
                 goto out;
 
+        /*
+         * if the last transaction that changed this file was before
+         * the current transaction, we can bail out now without any
+         * syncing
+         */
         mutex_lock(&root->fs_info->trans_mutex);
         if (BTRFS_I(inode)->last_trans <=
             root->fs_info->last_trans_committed) {
@@ -1152,13 +1167,6 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
         }
         mutex_unlock(&root->fs_info->trans_mutex);
 
-        root->log_batch++;
-        filemap_fdatawrite(inode->i_mapping);
-        btrfs_wait_ordered_range(inode, 0, (u64)-1);
-        root->log_batch++;
-
-        if (datasync && !(inode->i_state & I_DIRTY_PAGES))
-                goto out;
         /*
          * ok we haven't committed the transaction yet, lets do a commit
          */
@@ -1187,14 +1195,18 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
          */
         mutex_unlock(&dentry->d_inode->i_mutex);
 
-        if (ret > 0) {
-                ret = btrfs_commit_transaction(trans, root);
-        } else {
-                ret = btrfs_sync_log(trans, root);
-                if (ret == 0)
-                        ret = btrfs_end_transaction(trans, root);
-                else
+        if (ret != BTRFS_NO_LOG_SYNC) {
+                if (ret > 0) {
                         ret = btrfs_commit_transaction(trans, root);
+                } else {
+                        ret = btrfs_sync_log(trans, root);
+                        if (ret == 0)
+                                ret = btrfs_end_transaction(trans, root);
+                        else
+                                ret = btrfs_commit_transaction(trans, root);
+                }
+        } else {
+                ret = btrfs_end_transaction(trans, root);
         }
         mutex_lock(&dentry->d_inode->i_mutex);
 out:
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 5c2caad76212..cb2849f03251 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1296,7 +1296,7 @@ again:
                         window_start = entry->offset;
                         window_free = entry->bytes;
                         last = entry;
-                        max_extent = 0;
+                        max_extent = entry->bytes;
                 } else {
                         last = next;
                         window_free += next->bytes;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 112e5aa85892..b3ad168a0bfc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -424,9 +424,12 @@ again:
                          * and free up our temp pages.
                          */
                         extent_clear_unlock_delalloc(inode,
-                                                     &BTRFS_I(inode)->io_tree,
-                                                     start, end, NULL, 1, 0,
-                                                     0, 1, 1, 1, 0);
+                             &BTRFS_I(inode)->io_tree,
+                             start, end, NULL,
+                             EXTENT_CLEAR_UNLOCK_PAGE | EXTENT_CLEAR_DIRTY |
+                             EXTENT_CLEAR_DELALLOC |
+                             EXTENT_CLEAR_ACCOUNTING |
+                             EXTENT_SET_WRITEBACK | EXTENT_END_WRITEBACK);
                         ret = 0;
                         goto free_pages_out;
                 }
@@ -535,7 +538,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
         struct extent_io_tree *io_tree;
-        int ret;
+        int ret = 0;
 
         if (list_empty(&async_cow->extents))
                 return 0;
@@ -549,6 +552,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
 
                 io_tree = &BTRFS_I(inode)->io_tree;
 
+retry:
                 /* did the compression code fall back to uncompressed IO? */
                 if (!async_extent->pages) {
                         int page_started = 0;
@@ -559,11 +563,11 @@ static noinline int submit_compressed_extents(struct inode *inode,
                                     async_extent->ram_size - 1, GFP_NOFS);
 
                         /* allocate blocks */
-                        cow_file_range(inode, async_cow->locked_page,
-                                       async_extent->start,
-                                       async_extent->start +
-                                       async_extent->ram_size - 1,
-                                       &page_started, &nr_written, 0);
+                        ret = cow_file_range(inode, async_cow->locked_page,
+                                             async_extent->start,
+                                             async_extent->start +
+                                             async_extent->ram_size - 1,
+                                             &page_started, &nr_written, 0);
 
                         /*
                          * if page_started, cow_file_range inserted an
@@ -571,7 +575,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
                          * and IO for us.  Otherwise, we need to submit
                          * all those pages down to the drive.
                          */
-                        if (!page_started)
+                        if (!page_started && !ret)
                                 extent_write_locked_range(io_tree,
                                                   inode, async_extent->start,
                                                   async_extent->start +
@@ -599,7 +603,21 @@ static noinline int submit_compressed_extents(struct inode *inode,
                                            async_extent->compressed_size,
                                            0, alloc_hint,
                                            (u64)-1, &ins, 1);
-                BUG_ON(ret);
+                if (ret) {
+                        int i;
+                        for (i = 0; i < async_extent->nr_pages; i++) {
+                                WARN_ON(async_extent->pages[i]->mapping);
+                                page_cache_release(async_extent->pages[i]);
+                        }
+                        kfree(async_extent->pages);
+                        async_extent->nr_pages = 0;
+                        async_extent->pages = NULL;
+                        unlock_extent(io_tree, async_extent->start,
+                                      async_extent->start +
+                                      async_extent->ram_size - 1, GFP_NOFS);
+                        goto retry;
+                }
+
                 em = alloc_extent_map(GFP_NOFS);
                 em->start = async_extent->start;
                 em->len = async_extent->ram_size;
@@ -637,11 +655,14 @@ static noinline int submit_compressed_extents(struct inode *inode,
                  * clear dirty, set writeback and unlock the pages.
                  */
                 extent_clear_unlock_delalloc(inode,
-                                             &BTRFS_I(inode)->io_tree,
-                                             async_extent->start,
-                                             async_extent->start +
-                                             async_extent->ram_size - 1,
-                                             NULL, 1, 1, 0, 1, 1, 0, 0);
+                                &BTRFS_I(inode)->io_tree,
+                                async_extent->start,
+                                async_extent->start +
+                                async_extent->ram_size - 1,
+                                NULL, EXTENT_CLEAR_UNLOCK_PAGE |
+                                EXTENT_CLEAR_UNLOCK |
+                                EXTENT_CLEAR_DELALLOC |
+                                EXTENT_CLEAR_DIRTY | EXTENT_SET_WRITEBACK);
 
                 ret = btrfs_submit_compressed_write(inode,
                                     async_extent->start,
@@ -712,9 +733,15 @@ static noinline int cow_file_range(struct inode *inode,
                                             start, end, 0, NULL);
                 if (ret == 0) {
                         extent_clear_unlock_delalloc(inode,
-                                                     &BTRFS_I(inode)->io_tree,
-                                                     start, end, NULL, 1, 1,
-                                                     1, 1, 1, 1, 0);
+                                     &BTRFS_I(inode)->io_tree,
+                                     start, end, NULL,
+                                     EXTENT_CLEAR_UNLOCK_PAGE |
+                                     EXTENT_CLEAR_UNLOCK |
+                                     EXTENT_CLEAR_DELALLOC |
+                                     EXTENT_CLEAR_ACCOUNTING |
+                                     EXTENT_CLEAR_DIRTY |
+                                     EXTENT_SET_WRITEBACK |
+                                     EXTENT_END_WRITEBACK);
                         *nr_written = *nr_written +
                              (end - start + PAGE_CACHE_SIZE) / PAGE_CACHE_SIZE;
                         *page_started = 1;
@@ -731,13 +758,29 @@ static noinline int cow_file_range(struct inode *inode,
         em = search_extent_mapping(&BTRFS_I(inode)->extent_tree,
                                    start, num_bytes);
         if (em) {
-                alloc_hint = em->block_start;
-                free_extent_map(em);
+                /*
+                 * if block start isn't an actual block number then find the
+                 * first block in this inode and use that as a hint.  If that
+                 * block is also bogus then just don't worry about it.
+                 */
+                if (em->block_start >= EXTENT_MAP_LAST_BYTE) {
+                        free_extent_map(em);
+                        em = search_extent_mapping(em_tree, 0, 0);
+                        if (em && em->block_start < EXTENT_MAP_LAST_BYTE)
+                                alloc_hint = em->block_start;
+                        if (em)
+                                free_extent_map(em);
+                } else {
+                        alloc_hint = em->block_start;
+                        free_extent_map(em);
+                }
         }
         read_unlock(&BTRFS_I(inode)->extent_tree.lock);
         btrfs_drop_extent_cache(inode, start, start + num_bytes - 1, 0);
 
         while (disk_num_bytes > 0) {
+                unsigned long op;
+
                 cur_alloc_size = min(disk_num_bytes, root->fs_info->max_extent);
                 ret = btrfs_reserve_extent(trans, root, cur_alloc_size,
                                            root->sectorsize, 0, alloc_hint,
@@ -789,10 +832,13 @@ static noinline int cow_file_range(struct inode *inode,
                  * Do set the Private2 bit so we know this page was properly
                  * setup for writepage
                  */
+                op = unlock ? EXTENT_CLEAR_UNLOCK_PAGE : 0;
+                op |= EXTENT_CLEAR_UNLOCK | EXTENT_CLEAR_DELALLOC |
+                        EXTENT_SET_PRIVATE2;
+
                 extent_clear_unlock_delalloc(inode, &BTRFS_I(inode)->io_tree,
                                              start, start + ram_size - 1,
-                                             locked_page, unlock, 1,
-                                             1, 0, 0, 0, 1);
+                                             locked_page, op);
                 disk_num_bytes -= cur_alloc_size;
                 num_bytes -= cur_alloc_size;
                 alloc_hint = ins.objectid + ins.offset;
@@ -864,8 +910,8 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page,
         u64 cur_end;
         int limit = 10 * 1024 * 1042;
 
-        clear_extent_bit(&BTRFS_I(inode)->io_tree, start, end, EXTENT_LOCKED |
-                         EXTENT_DELALLOC, 1, 0, NULL, GFP_NOFS);
+        clear_extent_bit(&BTRFS_I(inode)->io_tree, start, end, EXTENT_LOCKED,
+                         1, 0, NULL, GFP_NOFS);
         while (start < end) {
                 async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
                 async_cow->inode = inode;
@@ -1006,6 +1052,7 @@ next_slot:
 
                 if (found_key.offset > cur_offset) {
                         extent_end = found_key.offset;
+                        extent_type = 0;
                         goto out_check;
                 }
 
@@ -1112,8 +1159,10 @@ out_check:
                 BUG_ON(ret);
 
                 extent_clear_unlock_delalloc(inode, &BTRFS_I(inode)->io_tree,
-                                        cur_offset, cur_offset + num_bytes - 1,
-                                        locked_page, 1, 1, 1, 0, 0, 0, 1);
+                                cur_offset, cur_offset + num_bytes - 1,
+                                locked_page, EXTENT_CLEAR_UNLOCK_PAGE |
+                                EXTENT_CLEAR_UNLOCK | EXTENT_CLEAR_DELALLOC |
+                                EXTENT_SET_PRIVATE2);
                 cur_offset = extent_end;
                 if (cur_offset > end)
                         break;
@@ -1178,15 +1227,17 @@ static int btrfs_split_extent_hook(struct inode *inode,
                                         root->fs_info->max_extent);
 
                 /*
-                 * if we break a large extent up then leave delalloc_extents be,
-                 * since we've already accounted for the large extent.
+                 * if we break a large extent up then leave oustanding_extents
+                 * be, since we've already accounted for the large extent.
                  */
                 if (div64_u64(new_size + root->fs_info->max_extent - 1,
                               root->fs_info->max_extent) < num_extents)
                         return 0;
         }
 
-        BTRFS_I(inode)->delalloc_extents++;
+        spin_lock(&BTRFS_I(inode)->accounting_lock);
+        BTRFS_I(inode)->outstanding_extents++;
+        spin_unlock(&BTRFS_I(inode)->accounting_lock);
 
         return 0;
 }
@@ -1217,7 +1268,9 @@ static int btrfs_merge_extent_hook(struct inode *inode,
 
         /* we're not bigger than the max, unreserve the space and go */
         if (new_size <= root->fs_info->max_extent) {
-                BTRFS_I(inode)->delalloc_extents--;
+                spin_lock(&BTRFS_I(inode)->accounting_lock);
+                BTRFS_I(inode)->outstanding_extents--;
+                spin_unlock(&BTRFS_I(inode)->accounting_lock);
                 return 0;
         }
 
@@ -1231,7 +1284,9 @@ static int btrfs_merge_extent_hook(struct inode *inode,
                       root->fs_info->max_extent) > num_extents)
                 return 0;
 
-        BTRFS_I(inode)->delalloc_extents--;
+        spin_lock(&BTRFS_I(inode)->accounting_lock);
+        BTRFS_I(inode)->outstanding_extents--;
+        spin_unlock(&BTRFS_I(inode)->accounting_lock);
 
         return 0;
 }
@@ -1253,7 +1308,9 @@ static int btrfs_set_bit_hook(struct inode *inode, u64 start, u64 end,
         if (!(old & EXTENT_DELALLOC) && (bits & EXTENT_DELALLOC)) {
                 struct btrfs_root *root = BTRFS_I(inode)->root;
 
-                BTRFS_I(inode)->delalloc_extents++;
+                spin_lock(&BTRFS_I(inode)->accounting_lock);
+                BTRFS_I(inode)->outstanding_extents++;
+                spin_unlock(&BTRFS_I(inode)->accounting_lock);
                 btrfs_delalloc_reserve_space(root, inode, end - start + 1);
                 spin_lock(&root->fs_info->delalloc_lock);
                 BTRFS_I(inode)->delalloc_bytes += end - start + 1;
@@ -1281,8 +1338,12 @@ static int btrfs_clear_bit_hook(struct inode *inode,
         if ((state->state & EXTENT_DELALLOC) && (bits & EXTENT_DELALLOC)) {
                 struct btrfs_root *root = BTRFS_I(inode)->root;
 
-                BTRFS_I(inode)->delalloc_extents--;
-                btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
+                if (bits & EXTENT_DO_ACCOUNTING) {
+                        spin_lock(&BTRFS_I(inode)->accounting_lock);
+                        BTRFS_I(inode)->outstanding_extents--;
+                        spin_unlock(&BTRFS_I(inode)->accounting_lock);
+                        btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
+                }
 
                 spin_lock(&root->fs_info->delalloc_lock);
                 if (state->end - state->start + 1 >
@@ -2442,7 +2503,19 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
 
         root = BTRFS_I(dir)->root;
 
+        /*
+         * 5 items for unlink inode
+         * 1 for orphan
+         */
+        ret = btrfs_reserve_metadata_space(root, 6);
+        if (ret)
+                return ret;
+
         trans = btrfs_start_transaction(root, 1);
+        if (IS_ERR(trans)) {
+                btrfs_unreserve_metadata_space(root, 6);
+                return PTR_ERR(trans);
+        }
 
         btrfs_set_trans_block_group(trans, dir);
 
@@ -2457,6 +2530,7 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
         nr = trans->blocks_used;
 
         btrfs_end_transaction_throttle(trans, root);
+        btrfs_unreserve_metadata_space(root, 6);
         btrfs_btree_balance_dirty(root, nr);
         return ret;
 }
@@ -2537,7 +2611,16 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
             inode->i_ino == BTRFS_FIRST_FREE_OBJECTID)
                 return -ENOTEMPTY;
 
+        ret = btrfs_reserve_metadata_space(root, 5);
+        if (ret)
+                return ret;
+
         trans = btrfs_start_transaction(root, 1);
+        if (IS_ERR(trans)) {
+                btrfs_unreserve_metadata_space(root, 5);
+                return PTR_ERR(trans);
+        }
+
         btrfs_set_trans_block_group(trans, dir);
 
         if (unlikely(inode->i_ino == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID)) {
@@ -2560,6 +2643,7 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
 out:
         nr = trans->blocks_used;
         ret = btrfs_end_transaction_throttle(trans, root);
+        btrfs_unreserve_metadata_space(root, 5);
         btrfs_btree_balance_dirty(root, nr);
 
         if (ret && !err)
@@ -3000,12 +3084,22 @@ static int btrfs_truncate_page(struct address_space *mapping, loff_t from)
 
         if ((offset & (blocksize - 1)) == 0)
                 goto out;
+        ret = btrfs_check_data_free_space(root, inode, PAGE_CACHE_SIZE);
+        if (ret)
+                goto out;
+
+        ret = btrfs_reserve_metadata_for_delalloc(root, inode, 1);
+        if (ret)
+                goto out;
 
         ret = -ENOMEM;
 again:
         page = grab_cache_page(mapping, index);
-        if (!page)
+        if (!page) {
+                btrfs_free_reserved_data_space(root, inode, PAGE_CACHE_SIZE);
+                btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
                 goto out;
+        }
 
         page_start = page_offset(page);
         page_end = page_start + PAGE_CACHE_SIZE - 1;
@@ -3038,6 +3132,10 @@ again:
                 goto again;
         }
 
+        clear_extent_bits(&BTRFS_I(inode)->io_tree, page_start, page_end,
+                          EXTENT_DIRTY | EXTENT_DELALLOC | EXTENT_DO_ACCOUNTING,
+                          GFP_NOFS);
+
         ret = btrfs_set_extent_delalloc(inode, page_start, page_end);
         if (ret) {
                 unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
@@ -3056,6 +3154,9 @@ again:
         unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
 
 out_unlock:
+        if (ret)
+                btrfs_free_reserved_data_space(root, inode, PAGE_CACHE_SIZE);
+        btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
         unlock_page(page);
         page_cache_release(page);
 out:
@@ -3079,7 +3180,9 @@ int btrfs_cont_expand(struct inode *inode, loff_t size)
         if (size <= hole_start)
                 return 0;
 
-        btrfs_truncate_page(inode->i_mapping, inode->i_size);
+        err = btrfs_truncate_page(inode->i_mapping, inode->i_size);
+        if (err)
+                return err;
 
         while (1) {
                 struct btrfs_ordered_extent *ordered;
@@ -3448,6 +3551,7 @@ static noinline void init_btrfs_i(struct inode *inode)
         bi->generation = 0;
         bi->sequence = 0;
         bi->last_trans = 0;
+        bi->last_sub_trans = 0;
         bi->logged_trans = 0;
         bi->delalloc_bytes = 0;
         bi->reserved_bytes = 0;
@@ -3598,12 +3702,14 @@ static int btrfs_dentry_delete(struct dentry *dentry)
 {
         struct btrfs_root *root;
 
-        if (!dentry->d_inode)
-                return 0;
+        if (!dentry->d_inode && !IS_ROOT(dentry))
+                dentry = dentry->d_parent;
 
-        root = BTRFS_I(dentry->d_inode)->root;
-        if (btrfs_root_refs(&root->root_item) == 0)
-                return 1;
+        if (dentry->d_inode) {
+                root = BTRFS_I(dentry->d_inode)->root;
+                if (btrfs_root_refs(&root->root_item) == 0)
+                        return 1;
+        }
         return 0;
 }
 
@@ -4808,7 +4914,8 @@ static void btrfs_invalidatepage(struct page *page, unsigned long offset)
                  */
                 clear_extent_bit(tree, page_start, page_end,
                                  EXTENT_DIRTY | EXTENT_DELALLOC |
-                                 EXTENT_LOCKED, 1, 0, NULL, GFP_NOFS);
+                                 EXTENT_LOCKED | EXTENT_DO_ACCOUNTING, 1, 0,
+                                 NULL, GFP_NOFS);
                 /*
                  * whoever cleared the private bit is responsible
                  * for the finish_ordered_io
@@ -4821,8 +4928,8 @@ static void btrfs_invalidatepage(struct page *page, unsigned long offset)
                 lock_extent(tree, page_start, page_end, GFP_NOFS);
         }
         clear_extent_bit(tree, page_start, page_end,
-                 EXTENT_LOCKED | EXTENT_DIRTY | EXTENT_DELALLOC,
-                 1, 1, NULL, GFP_NOFS);
+                 EXTENT_LOCKED | EXTENT_DIRTY | EXTENT_DELALLOC |
+                 EXTENT_DO_ACCOUNTING, 1, 1, NULL, GFP_NOFS);
         __btrfs_releasepage(page, GFP_NOFS);
 
         ClearPageChecked(page);
@@ -4917,7 +5024,8 @@ again:
          * prepare_pages in the normal write path.
          */
         clear_extent_bits(&BTRFS_I(inode)->io_tree, page_start, page_end,
-                          EXTENT_DIRTY | EXTENT_DELALLOC, GFP_NOFS);
+                          EXTENT_DIRTY | EXTENT_DELALLOC | EXTENT_DO_ACCOUNTING,
+                          GFP_NOFS);
 
         ret = btrfs_set_extent_delalloc(inode, page_start, page_end);
         if (ret) {
@@ -4944,7 +5052,9 @@ again:
         set_page_dirty(page);
         SetPageUptodate(page);
 
-        BTRFS_I(inode)->last_trans = root->fs_info->generation + 1;
+        BTRFS_I(inode)->last_trans = root->fs_info->generation;
+        BTRFS_I(inode)->last_sub_trans = BTRFS_I(inode)->root->log_transid;
+
         unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
 
 out_unlock:
@@ -4969,7 +5079,9 @@ static void btrfs_truncate(struct inode *inode)
         if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
                 return;
 
-        btrfs_truncate_page(inode->i_mapping, inode->i_size);
+        ret = btrfs_truncate_page(inode->i_mapping, inode->i_size);
+        if (ret)
+                return;
         btrfs_wait_ordered_range(inode, inode->i_size & (~mask), (u64)-1);
 
         trans = btrfs_start_transaction(root, 1);
@@ -5064,9 +5176,12 @@ struct inode *btrfs_alloc_inode(struct super_block *sb)
         if (!ei)
                 return NULL;
         ei->last_trans = 0;
+        ei->last_sub_trans = 0;
         ei->logged_trans = 0;
-        ei->delalloc_extents = 0;
-        ei->delalloc_reserved_extents = 0;
+        ei->outstanding_extents = 0;
+        ei->reserved_extents = 0;
+        ei->root = NULL;
+        spin_lock_init(&ei->accounting_lock);
         btrfs_ordered_inode_tree_init(&ei->ordered_tree);
         INIT_LIST_HEAD(&ei->i_orphan);
         INIT_LIST_HEAD(&ei->ordered_operations);
@@ -5082,6 +5197,14 @@ void btrfs_destroy_inode(struct inode *inode)
         WARN_ON(inode->i_data.nrpages);
 
         /*
+         * This can happen where we create an inode, but somebody else also
+         * created the same inode and we need to destroy the one we already
+         * created.
+         */
+        if (!root)
+                goto free;
+
+        /*
          * Make sure we're properly removed from the ordered operation
          * lists.
          */
@@ -5116,6 +5239,7 @@ void btrfs_destroy_inode(struct inode *inode)
         }
         inode_tree_del(inode);
         btrfs_drop_extent_cache(inode, 0, (u64)-1, 0);
+free:
         kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode));
 }
 
@@ -5221,11 +5345,14 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 return -ENOTEMPTY;
 
         /*
-         * 2 items for dir items
-         * 1 item for orphan entry
-         * 1 item for ref
+         * We want to reserve the absolute worst case amount of items.  So if
+         * both inodes are subvols and we need to unlink them then that would
+         * require 4 item modifications, but if they are both normal inodes it
+         * would require 5 item modifications, so we'll assume their normal
+         * inodes.  So 5 * 2 is 10, plus 1 for the new link, so 11 total items
+         * should cover the worst case number of items we'll modify.
          */
-        ret = btrfs_reserve_metadata_space(root, 4);
+        ret = btrfs_reserve_metadata_space(root, 11);
         if (ret)
                 return ret;
 
@@ -5341,7 +5468,7 @@ out_fail:
         if (old_inode->i_ino == BTRFS_FIRST_FREE_OBJECTID)
                 up_read(&root->fs_info->subvol_sem);
 
-        btrfs_unreserve_metadata_space(root, 4);
+        btrfs_unreserve_metadata_space(root, 11);
         return ret;
 }
 
@@ -5805,6 +5932,6 @@ static const struct inode_operations btrfs_symlink_inode_operations = {
         .removexattr    = btrfs_removexattr,
 };
 
-struct dentry_operations btrfs_dentry_operations = {
+const struct dentry_operations btrfs_dentry_operations = {
         .d_delete       = btrfs_dentry_delete,
 };
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 9a780c8d0ac8..cdbb054102b9 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -830,6 +830,7 @@ out_up_write:
 out_unlock:
         mutex_unlock(&inode->i_mutex);
         if (!err) {
+                shrink_dcache_sb(root->fs_info->sb);
                 btrfs_invalidate_inodes(dest);
                 d_delete(dentry);
         }
@@ -1122,8 +1123,10 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                                         datao += off - key.offset;
                                         datal -= off - key.offset;
                                 }
-                                if (key.offset + datao + datal > off + len)
-                                        datal = off + len - key.offset - datao;
+
+                                if (key.offset + datal > off + len)
+                                        datal = off + len - key.offset;
+
                                 /* disko == 0 means it's a hole */
                                 if (!disko)
                                         datao = 0;
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 897fba835f89..5799bc46a309 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -306,6 +306,12 @@ int btrfs_remove_ordered_extent(struct inode *inode,
         tree->last = NULL;
         set_bit(BTRFS_ORDERED_COMPLETE, &entry->flags);
 
+        spin_lock(&BTRFS_I(inode)->accounting_lock);
+        BTRFS_I(inode)->outstanding_extents--;
+        spin_unlock(&BTRFS_I(inode)->accounting_lock);
+        btrfs_unreserve_metadata_for_delalloc(BTRFS_I(inode)->root,
+                                              inode, 1);
+
         spin_lock(&BTRFS_I(inode)->root->fs_info->ordered_extent_lock);
         list_del_init(&entry->root_extent_list);
 
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 361ad323faac..cfcc93c93a7b 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -3518,7 +3518,7 @@ int btrfs_relocate_block_group(struct btrfs_root *extent_root, u64 group_start)
         BUG_ON(!rc->block_group);
 
         btrfs_init_workers(&rc->workers, "relocate",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size, NULL);
 
         rc->extent_root = extent_root;
         btrfs_prepare_block_group_relocation(extent_root, rc->block_group);
@@ -3701,7 +3701,7 @@ int btrfs_recover_relocation(struct btrfs_root *root)
         mapping_tree_init(&rc->reloc_root_tree);
         INIT_LIST_HEAD(&rc->reloc_roots);
         btrfs_init_workers(&rc->workers, "relocate",
-                           root->fs_info->thread_pool_size);
+                           root->fs_info->thread_pool_size, NULL);
         rc->extent_root = root->fs_info->extent_root;
 
         set_reloc_control(rc);
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index 9351428f30e2..67fa2d29d663 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -159,7 +159,6 @@ int btrfs_update_root(struct btrfs_trans_handle *trans, struct btrfs_root
         write_extent_buffer(l, item, ptr, sizeof(*item));
         btrfs_mark_buffer_dirty(path->nodes[0]);
 out:
-        btrfs_release_path(root, path);
         btrfs_free_path(path);
         return ret;
 }
@@ -332,7 +331,6 @@ int btrfs_del_root(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         BUG_ON(refs != 0);
         ret = btrfs_del_item(trans, root, path);
 out:
-        btrfs_release_path(root, path);
         btrfs_free_path(path);
         return ret;
 }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 9de9b2236419..752a5463bf53 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -66,7 +66,8 @@ enum {
         Opt_degraded, Opt_subvol, Opt_device, Opt_nodatasum, Opt_nodatacow,
         Opt_max_extent, Opt_max_inline, Opt_alloc_start, Opt_nobarrier,
         Opt_ssd, Opt_nossd, Opt_ssd_spread, Opt_thread_pool, Opt_noacl,
-        Opt_compress, Opt_notreelog, Opt_ratio, Opt_flushoncommit, Opt_err,
+        Opt_compress, Opt_notreelog, Opt_ratio, Opt_flushoncommit,
+        Opt_discard, Opt_err,
 };
 
 static match_table_t tokens = {
@@ -88,6 +89,7 @@ static match_table_t tokens = {
         {Opt_notreelog, "notreelog"},
         {Opt_flushoncommit, "flushoncommit"},
         {Opt_ratio, "metadata_ratio=%d"},
+        {Opt_discard, "discard"},
         {Opt_err, NULL},
 };
 
@@ -257,6 +259,9 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                                        info->metadata_ratio);
                         }
                         break;
+                case Opt_discard:
+                        btrfs_set_opt(info->mount_opt, DISCARD);
+                        break;
                 default:
                         break;
                 }
@@ -344,7 +349,7 @@ static int btrfs_fill_super(struct super_block *sb,
         sb->s_export_op = &btrfs_export_ops;
         sb->s_xattr = btrfs_xattr_handlers;
         sb->s_time_gran = 1;
-#ifdef CONFIG_BTRFS_POSIX_ACL
+#ifdef CONFIG_BTRFS_FS_POSIX_ACL
         sb->s_flags |= MS_POSIXACL;
 #endif
 
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 0b8f36d4400a..c207e8c32c9b 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -163,8 +163,14 @@ static void wait_current_trans(struct btrfs_root *root)
         }
 }
 
+enum btrfs_trans_type {
+        TRANS_START,
+        TRANS_JOIN,
+        TRANS_USERSPACE,
+};
+
 static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
-                                             int num_blocks, int wait)
+                                             int num_blocks, int type)
 {
         struct btrfs_trans_handle *h =
                 kmem_cache_alloc(btrfs_trans_handle_cachep, GFP_NOFS);
@@ -172,7 +178,8 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
 
         mutex_lock(&root->fs_info->trans_mutex);
         if (!root->fs_info->log_root_recovering &&
-            ((wait == 1 && !root->fs_info->open_ioctl_trans) || wait == 2))
+            ((type == TRANS_START && !root->fs_info->open_ioctl_trans) ||
+             type == TRANS_USERSPACE))
                 wait_current_trans(root);
         ret = join_transaction(root);
         BUG_ON(ret);
@@ -186,7 +193,7 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
         h->alloc_exclude_start = 0;
         h->delayed_ref_updates = 0;
 
-        if (!current->journal_info)
+        if (!current->journal_info && type != TRANS_USERSPACE)
                 current->journal_info = h;
 
         root->fs_info->running_transaction->use_count++;
@@ -198,18 +205,18 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
 struct btrfs_trans_handle *btrfs_start_transaction(struct btrfs_root *root,
                                                    int num_blocks)
 {
-        return start_transaction(root, num_blocks, 1);
+        return start_transaction(root, num_blocks, TRANS_START);
 }
 struct btrfs_trans_handle *btrfs_join_transaction(struct btrfs_root *root,
                                                    int num_blocks)
 {
-        return start_transaction(root, num_blocks, 0);
+        return start_transaction(root, num_blocks, TRANS_JOIN);
 }
 
 struct btrfs_trans_handle *btrfs_start_ioctl_transaction(struct btrfs_root *r,
                                                          int num_blocks)
 {
-        return start_transaction(r, num_blocks, 2);
+        return start_transaction(r, num_blocks, TRANS_USERSPACE);
 }
 
 /* wait for a transaction commit to be fully complete */
@@ -344,10 +351,10 @@ int btrfs_end_transaction_throttle(struct btrfs_trans_handle *trans,
 /*
  * when btree blocks are allocated, they have some corresponding bits set for
  * them in one of two extent_io trees.  This is used to make sure all of
- * those extents are on disk for transaction or log commit
+ * those extents are sent to disk but does not wait on them
  */
-int btrfs_write_and_wait_marked_extents(struct btrfs_root *root,
-                                        struct extent_io_tree *dirty_pages)
+int btrfs_write_marked_extents(struct btrfs_root *root,
+                               struct extent_io_tree *dirty_pages)
 {
         int ret;
         int err = 0;
@@ -394,6 +401,29 @@ int btrfs_write_and_wait_marked_extents(struct btrfs_root *root,
                         page_cache_release(page);
                 }
         }
+        if (err)
+                werr = err;
+        return werr;
+}
+
+/*
+ * when btree blocks are allocated, they have some corresponding bits set for
+ * them in one of two extent_io trees.  This is used to make sure all of
+ * those extents are on disk for transaction or log commit.  We wait
+ * on all the pages and clear them from the dirty pages state tree
+ */
+int btrfs_wait_marked_extents(struct btrfs_root *root,
+                              struct extent_io_tree *dirty_pages)
+{
+        int ret;
+        int err = 0;
+        int werr = 0;
+        struct page *page;
+        struct inode *btree_inode = root->fs_info->btree_inode;
+        u64 start = 0;
+        u64 end;
+        unsigned long index;
+
         while (1) {
                 ret = find_first_extent_bit(dirty_pages, 0, &start, &end,
                                             EXTENT_DIRTY);
@@ -424,6 +454,22 @@ int btrfs_write_and_wait_marked_extents(struct btrfs_root *root,
         return werr;
 }
 
+/*
+ * when btree blocks are allocated, they have some corresponding bits set for
+ * them in one of two extent_io trees.  This is used to make sure all of
+ * those extents are on disk for transaction or log commit
+ */
+int btrfs_write_and_wait_marked_extents(struct btrfs_root *root,
+                                        struct extent_io_tree *dirty_pages)
+{
+        int ret;
+        int ret2;
+
+        ret = btrfs_write_marked_extents(root, dirty_pages);
+        ret2 = btrfs_wait_marked_extents(root, dirty_pages);
+        return ret || ret2;
+}
+
 int btrfs_write_and_wait_transaction(struct btrfs_trans_handle *trans,
                                      struct btrfs_root *root)
 {
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index 663c67404918..d4e3e7a6938c 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -79,6 +79,7 @@ static inline void btrfs_set_inode_last_trans(struct btrfs_trans_handle *trans,
                                               struct inode *inode)
 {
         BTRFS_I(inode)->last_trans = trans->transaction->transid;
+        BTRFS_I(inode)->last_sub_trans = BTRFS_I(inode)->root->log_transid;
 }
 
 int btrfs_end_transaction(struct btrfs_trans_handle *trans,
@@ -107,5 +108,9 @@ int btrfs_record_root_in_trans(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root);
 int btrfs_write_and_wait_marked_extents(struct btrfs_root *root,
                                         struct extent_io_tree *dirty_pages);
+int btrfs_write_marked_extents(struct btrfs_root *root,
+                                        struct extent_io_tree *dirty_pages);
+int btrfs_wait_marked_extents(struct btrfs_root *root,
+                                        struct extent_io_tree *dirty_pages);
 int btrfs_transaction_in_commit(struct btrfs_fs_info *info);
 #endif
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 7827841b55cb..741666a7676a 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -137,11 +137,20 @@ static int start_log_trans(struct btrfs_trans_handle *trans,
 
         mutex_lock(&root->log_mutex);
         if (root->log_root) {
+                if (!root->log_start_pid) {
+                        root->log_start_pid = current->pid;
+                        root->log_multiple_pids = false;
+                } else if (root->log_start_pid != current->pid) {
+                        root->log_multiple_pids = true;
+                }
+
                 root->log_batch++;
                 atomic_inc(&root->log_writers);
                 mutex_unlock(&root->log_mutex);
                 return 0;
         }
+        root->log_multiple_pids = false;
+        root->log_start_pid = current->pid;
         mutex_lock(&root->fs_info->tree_log_mutex);
         if (!root->fs_info->log_root_tree) {
                 ret = btrfs_init_log_root_tree(trans, root->fs_info);
@@ -1971,6 +1980,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
         int ret;
         struct btrfs_root *log = root->log_root;
         struct btrfs_root *log_root_tree = root->fs_info->log_root_tree;
+        u64 log_transid = 0;
 
         mutex_lock(&root->log_mutex);
         index1 = root->log_transid % 2;
@@ -1987,10 +1997,11 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
 
         while (1) {
                 unsigned long batch = root->log_batch;
-                mutex_unlock(&root->log_mutex);
-                schedule_timeout_uninterruptible(1);
-                mutex_lock(&root->log_mutex);
-
+                if (root->log_multiple_pids) {
+                        mutex_unlock(&root->log_mutex);
+                        schedule_timeout_uninterruptible(1);
+                        mutex_lock(&root->log_mutex);
+                }
                 wait_for_writer(trans, root);
                 if (batch == root->log_batch)
                         break;
@@ -2003,14 +2014,19 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
                 goto out;
         }
 
-        ret = btrfs_write_and_wait_marked_extents(log, &log->dirty_log_pages);
+        /* we start IO on  all the marked extents here, but we don't actually
+         * wait for them until later.
+         */
+        ret = btrfs_write_marked_extents(log, &log->dirty_log_pages);
         BUG_ON(ret);
 
         btrfs_set_root_node(&log->root_item, log->node);
 
         root->log_batch = 0;
+        log_transid = root->log_transid;
         root->log_transid++;
         log->log_transid = root->log_transid;
+        root->log_start_pid = 0;
         smp_mb();
         /*
          * log tree has been flushed to disk, new modifications of
@@ -2036,6 +2052,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
 
         index2 = log_root_tree->log_transid % 2;
         if (atomic_read(&log_root_tree->log_commit[index2])) {
+                btrfs_wait_marked_extents(log, &log->dirty_log_pages);
                 wait_log_commit(trans, log_root_tree,
                                 log_root_tree->log_transid);
                 mutex_unlock(&log_root_tree->log_mutex);
@@ -2055,6 +2072,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
          * check the full commit flag again
          */
         if (root->fs_info->last_trans_log_full_commit == trans->transid) {
+                btrfs_wait_marked_extents(log, &log->dirty_log_pages);
                 mutex_unlock(&log_root_tree->log_mutex);
                 ret = -EAGAIN;
                 goto out_wake_log_root;
@@ -2063,6 +2081,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
         ret = btrfs_write_and_wait_marked_extents(log_root_tree,
                                 &log_root_tree->dirty_log_pages);
         BUG_ON(ret);
+        btrfs_wait_marked_extents(log, &log->dirty_log_pages);
 
         btrfs_set_super_log_root(&root->fs_info->super_for_commit,
                                 log_root_tree->node->start);
@@ -2082,9 +2101,14 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
          * the running transaction open, so a full commit can't hop
          * in and cause problems either.
          */
-        write_ctree_super(trans, root->fs_info->tree_root, 2);
+        write_ctree_super(trans, root->fs_info->tree_root, 1);
         ret = 0;
 
+        mutex_lock(&root->log_mutex);
+        if (root->last_log_commit < log_transid)
+                root->last_log_commit = log_transid;
+        mutex_unlock(&root->log_mutex);
+
 out_wake_log_root:
         atomic_set(&log_root_tree->log_commit[index2], 0);
         smp_mb();
@@ -2852,6 +2876,21 @@ out:
         return ret;
 }
 
+static int inode_in_log(struct btrfs_trans_handle *trans,
+                 struct inode *inode)
+{
+        struct btrfs_root *root = BTRFS_I(inode)->root;
+        int ret = 0;
+
+        mutex_lock(&root->log_mutex);
+        if (BTRFS_I(inode)->logged_trans == trans->transid &&
+            BTRFS_I(inode)->last_sub_trans <= root->last_log_commit)
+                ret = 1;
+        mutex_unlock(&root->log_mutex);
+        return ret;
+}
+
+
 /*
  * helper function around btrfs_log_inode to make sure newly created
  * parent directories also end up in the log.  A minimal inode and backref
@@ -2891,6 +2930,11 @@ int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
         if (ret)
                 goto end_no_trans;
 
+        if (inode_in_log(trans, inode)) {
+                ret = BTRFS_NO_LOG_SYNC;
+                goto end_no_trans;
+        }
+
         start_log_trans(trans, root);
 
         ret = btrfs_log_inode(trans, root, inode, inode_only);
diff --git a/fs/btrfs/tree-log.h b/fs/btrfs/tree-log.h
index d09c7609e16b..0776eacb5083 100644
--- a/fs/btrfs/tree-log.h
+++ b/fs/btrfs/tree-log.h
@@ -19,6 +19,9 @@
 #ifndef __TREE_LOG_
 #define __TREE_LOG_
 
+/* return value for btrfs_log_dentry_safe that means we don't need to log it at all */
+#define BTRFS_NO_LOG_SYNC 256
+
 int btrfs_sync_log(struct btrfs_trans_handle *trans,
                    struct btrfs_root *root);
 int btrfs_free_log(struct btrfs_trans_handle *trans, struct btrfs_root *root);
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index b0fc93f95fd0..b6dd5967c48a 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -260,7 +260,7 @@ err:
  * attributes are handled directly.
  */
 struct xattr_handler *btrfs_xattr_handlers[] = {
-#ifdef CONFIG_BTRFS_POSIX_ACL
+#ifdef CONFIG_BTRFS_FS_POSIX_ACL
         &btrfs_xattr_acl_access_handler,
         &btrfs_xattr_acl_default_handler,
 #endif
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 6928c24d1d42..5646727e33f5 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -388,4 +388,5 @@ extern int CIFSSMBSetPosixACL(const int xid, struct cifsTconInfo *tcon,
                 const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSGetExtAttr(const int xid, struct cifsTconInfo *tcon,
                         const int netfid, __u64 *pExtAttrBits, __u64 *pMask);
+extern void cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb);
 #endif                  /* _CIFSPROTO_H */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 43003e0bef18..63ea83ff687f 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1577,7 +1577,8 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
 
 out_err:
         if (tcp_ses) {
-                kfree(tcp_ses->hostname);
+                if (!IS_ERR(tcp_ses->hostname))
+                        kfree(tcp_ses->hostname);
                 if (tcp_ses->ssocket)
                         sock_release(tcp_ses->ssocket);
                 kfree(tcp_ses);
@@ -2219,16 +2220,8 @@ is_path_accessible(int xid, struct cifsTconInfo *tcon,
                    struct cifs_sb_info *cifs_sb, const char *full_path)
 {
         int rc;
-        __u64 inode_num;
         FILE_ALL_INFO *pfile_info;
 
-        rc = CIFSGetSrvInodeNumber(xid, tcon, full_path, &inode_num,
-                                   cifs_sb->local_nls,
-                                   cifs_sb->mnt_cifs_flags &
-                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
-        if (rc != -EOPNOTSUPP)
-                return rc;
-
         pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
         if (pfile_info == NULL)
                 return -ENOMEM;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 5e2492535daa..cababd8a52df 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -512,13 +512,10 @@ int cifs_get_inode_info(struct inode **pinode,
                                         cifs_sb->local_nls,
                                         cifs_sb->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
-                        if (rc1) {
+                        if (rc1 || !fattr.cf_uniqueid) {
                                 cFYI(1, ("GetSrvInodeNum rc %d", rc1));
                                 fattr.cf_uniqueid = iunique(sb, ROOT_I);
-                                /* disable serverino if call not supported */
-                                if (rc1 == -EINVAL)
-                                        cifs_sb->mnt_cifs_flags &=
-                                                        ~CIFS_MOUNT_SERVER_INUM;
+                                cifs_autodisable_serverino(cifs_sb);
                         }
                 } else {
                         fattr.cf_uniqueid = iunique(sb, ROOT_I);
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 0241b25ac33f..d27d4ec6579b 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -715,3 +715,17 @@ cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
 ctoUCS_out:
         return i;
 }
+
+void
+cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb)
+{
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
+                cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM;
+                cERROR(1, ("Autodisabling the use of server inode numbers on "
+                           "%s. This server doesn't seem to support them "
+                           "properly. Hardlinks will not be recognized on this "
+                           "mount. Consider mounting with the \"noserverino\" "
+                           "option to silence this message.",
+                           cifs_sb->tcon->treeName));
+        }
+}
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 1f098ca71636..f84062f9a985 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -727,11 +727,12 @@ static int cifs_filldir(char *pfindEntry, struct file *file, filldir_t filldir,
                 cifs_dir_info_to_fattr(&fattr, (FILE_DIRECTORY_INFO *)
                                         pfindEntry, cifs_sb);
 
-        /* FIXME: make _to_fattr functions fill this out */
-        if (pCifsF->srch_inf.info_level == SMB_FIND_FILE_ID_FULL_DIR_INFO)
+        if (inum && (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) {
                 fattr.cf_uniqueid = inum;
-        else
+        } else {
                 fattr.cf_uniqueid = iunique(sb, ROOT_I);
+                cifs_autodisable_serverino(cifs_sb);
+        }
 
         ino = cifs_uniqueid_to_ino_t(fattr.cf_uniqueid);
         tmp_dentry = cifs_readdir_lookup(file->f_dentry, &qstring, &fattr);
diff --git a/fs/compat.c b/fs/compat.c
index d576b552e8e2..6c19040ffeef 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1532,6 +1532,8 @@ int compat_do_execve(char * filename,
         if (retval < 0)
                 goto out;
 
+        current->stack_start = current->mm->start_stack;
+
         /* execve succeeded */
         current->fs->in_exec = 0;
         current->in_execve = 0;
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index cacf8a83e394..229e72218165 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1199,7 +1199,7 @@ struct space_resv_32 {
 /* just account for different alignment */
 static int compat_ioctl_preallocate(struct file *file, unsigned long arg)
 {
-        struct space_resv_32    __user *p32 = (void __user *)arg;
+        struct space_resv_32    __user *p32 = compat_ptr(arg);
         struct space_resv       __user *p = compat_alloc_user_space(sizeof(*p));
 
         if (copy_in_user(&p->l_type,    &p32->l_type,   sizeof(s16)) ||
@@ -2063,7 +2063,7 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
 #else
         case FS_IOC_RESVSP:
         case FS_IOC_RESVSP64:
-                error = ioctl_preallocate(filp, (void __user *)arg);
+                error = ioctl_preallocate(filp, compat_ptr(arg));
                 goto out_fput;
 #endif
 
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 240cef14fe58..70736eb4b516 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -316,6 +316,10 @@ int dlm_lowcomms_connect_node(int nodeid)
 {
         struct connection *con;
 
+        /* with sctp there's no connecting without sending */
+        if (dlm_config.ci_protocol != 0)
+                return 0;
+
         if (nodeid == dlm_our_nodeid())
                 return 0;
 
@@ -455,9 +459,9 @@ static void process_sctp_notification(struct connection *con,
                         int prim_len, ret;
                         int addr_len;
                         struct connection *new_con;
-                        struct file *file;
                         sctp_peeloff_arg_t parg;
                         int parglen = sizeof(parg);
+                        int err;
 
                         /*
                          * We get this before any data for an association.
@@ -512,19 +516,22 @@ static void process_sctp_notification(struct connection *con,
                         ret = kernel_getsockopt(con->sock, IPPROTO_SCTP,
                                                 SCTP_SOCKOPT_PEELOFF,
                                                 (void *)&parg, &parglen);
-                        if (ret) {
+                        if (ret < 0) {
                                 log_print("Can't peel off a socket for "
-                                          "connection %d to node %d: err=%d\n",
+                                          "connection %d to node %d: err=%d",
                                           parg.associd, nodeid, ret);
+                                return;
+                        }
+                        new_con->sock = sockfd_lookup(parg.sd, &err);
+                        if (!new_con->sock) {
+                                log_print("sockfd_lookup error %d", err);
+                                return;
                         }
-                        file = fget(parg.sd);
-                        new_con->sock = SOCKET_I(file->f_dentry->d_inode);
                         add_sock(new_con->sock, new_con);
-                        fput(file);
-                        put_unused_fd(parg.sd);
+                        sockfd_put(new_con->sock);
 
-                        log_print("got new/restarted association %d nodeid %d",
-                                 (int)sn->sn_assoc_change.sac_assoc_id, nodeid);
+                        log_print("connecting to %d sctp association %d",
+                                 nodeid, (int)sn->sn_assoc_change.sac_assoc_id);
 
                         /* Send any pending writes */
                         clear_bit(CF_CONNECT_PENDING, &new_con->flags);
@@ -837,8 +844,6 @@ static void sctp_init_assoc(struct connection *con)
         if (con->retries++ > MAX_CONNECT_RETRIES)
                 return;
 
-        log_print("Initiating association with node %d", con->nodeid);
-
         if (nodeid_to_addr(con->nodeid, (struct sockaddr *)&rem_addr)) {
                 log_print("no address for nodeid %d", con->nodeid);
                 return;
@@ -855,11 +860,14 @@ static void sctp_init_assoc(struct connection *con)
         outmessage.msg_flags = MSG_EOR;
 
         spin_lock(&con->writequeue_lock);
-        e = list_entry(con->writequeue.next, struct writequeue_entry,
-                       list);
 
-        BUG_ON((struct list_head *) e == &con->writequeue);
+        if (list_empty(&con->writequeue)) {
+                spin_unlock(&con->writequeue_lock);
+                log_print("writequeue empty for nodeid %d", con->nodeid);
+                return;
+        }
 
+        e = list_first_entry(&con->writequeue, struct writequeue_entry, list);
         len = e->len;
         offset = e->offset;
         spin_unlock(&con->writequeue_lock);
diff --git a/fs/ecryptfs/Kconfig b/fs/ecryptfs/Kconfig
index 8aadb99b7634..1cd6d9d3e29a 100644
--- a/fs/ecryptfs/Kconfig
+++ b/fs/ecryptfs/Kconfig
@@ -1,8 +1,9 @@
 config ECRYPT_FS
         tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && KEYS && NET
+        depends on EXPERIMENTAL && KEYS && CRYPTO
         select CRYPTO_ECB
         select CRYPTO_CBC
+        select CRYPTO_MD5
         help
           Encrypted filesystem that operates on the VFS layer.  See
           <file:Documentation/filesystems/ecryptfs.txt> to learn more about
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 101fe4c7b1ee..c6ac85d6c701 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -35,6 +35,7 @@
 #include <linux/key.h>
 #include <linux/parser.h>
 #include <linux/fs_stack.h>
+#include <linux/ima.h>
 #include "ecryptfs_kernel.h"
 
 /**
@@ -118,6 +119,7 @@ int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
         const struct cred *cred = current_cred();
         struct ecryptfs_inode_info *inode_info =
                 ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
+        int opened_lower_file = 0;
         int rc = 0;
 
         mutex_lock(&inode_info->lower_file_mutex);
@@ -134,9 +136,12 @@ int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
                                "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
                                "rc = [%d]\n", lower_dentry, lower_mnt, rc);
                         inode_info->lower_file = NULL;
-                }
+                } else
+                        opened_lower_file = 1;
         }
         mutex_unlock(&inode_info->lower_file_mutex);
+        if (opened_lower_file)
+                ima_counts_get(inode_info->lower_file);
         return rc;
 }
 
diff --git a/fs/exec.c b/fs/exec.c
index d49be6bc1793..ba112bd4a339 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -624,10 +624,8 @@ int setup_arg_pages(struct linux_binprm *bprm,
         /* Move stack pages down in memory. */
         if (stack_shift) {
                 ret = shift_arg_pages(vma, stack_shift);
-                if (ret) {
-                        up_write(&mm->mmap_sem);
-                        return ret;
-                }
+                if (ret)
+                        goto out_unlock;
         }
 
 #ifdef CONFIG_STACK_GROWSUP
@@ -641,7 +639,7 @@ int setup_arg_pages(struct linux_binprm *bprm,
 
 out_unlock:
         up_write(&mm->mmap_sem);
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL(setup_arg_pages);
 
diff --git a/fs/ext3/fsync.c b/fs/ext3/fsync.c
index 451d166bbe93..8209f266e9ad 100644
--- a/fs/ext3/fsync.c
+++ b/fs/ext3/fsync.c
@@ -46,19 +46,21 @@
 int ext3_sync_file(struct file * file, struct dentry *dentry, int datasync)
 {
         struct inode *inode = dentry->d_inode;
+        struct ext3_inode_info *ei = EXT3_I(inode);
+        journal_t *journal = EXT3_SB(inode->i_sb)->s_journal;
         int ret = 0;
+        tid_t commit_tid;
+
+        if (inode->i_sb->s_flags & MS_RDONLY)
+                return 0;
 
         J_ASSERT(ext3_journal_current_handle() == NULL);
 
         /*
-         * data=writeback:
+         * data=writeback,ordered:
          *  The caller's filemap_fdatawrite()/wait will sync the data.
-         *  sync_inode() will sync the metadata
-         *
-         * data=ordered:
-         *  The caller's filemap_fdatawrite() will write the data and
-         *  sync_inode() will write the inode if it is dirty.  Then the caller's
-         *  filemap_fdatawait() will wait on the pages.
+         *  Metadata is in the journal, we wait for a proper transaction
+         *  to commit here.
          *
          * data=journal:
          *  filemap_fdatawrite won't do anything (the buffers are clean).
@@ -73,22 +75,16 @@ int ext3_sync_file(struct file * file, struct dentry *dentry, int datasync)
                 goto out;
         }
 
-        if (datasync && !(inode->i_state & I_DIRTY_DATASYNC))
-                goto flush;
+        if (datasync)
+                commit_tid = atomic_read(&ei->i_datasync_tid);
+        else
+                commit_tid = atomic_read(&ei->i_sync_tid);
 
-        /*
-         * The VFS has written the file data.  If the inode is unaltered
-         * then we need not start a commit.
-         */
-        if (inode->i_state & (I_DIRTY_SYNC|I_DIRTY_DATASYNC)) {
-                struct writeback_control wbc = {
-                        .sync_mode = WB_SYNC_ALL,
-                        .nr_to_write = 0, /* sys_fsync did this */
-                };
-                ret = sync_inode(inode, &wbc);
+        if (log_start_commit(journal, commit_tid)) {
+                log_wait_commit(journal, commit_tid);
                 goto out;
         }
-flush:
+
         /*
          * In case we didn't commit a transaction, we have to flush
          * disk caches manually so that data really is on persistent
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index acf1b1423327..354ed3b47b30 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -699,8 +699,9 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode,
         int err = 0;
         struct ext3_block_alloc_info *block_i;
         ext3_fsblk_t current_block;
+        struct ext3_inode_info *ei = EXT3_I(inode);
 
-        block_i = EXT3_I(inode)->i_block_alloc_info;
+        block_i = ei->i_block_alloc_info;
         /*
          * If we're splicing into a [td]indirect block (as opposed to the
          * inode) then we need to get write access to the [td]indirect block
@@ -741,6 +742,8 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode,
 
         inode->i_ctime = CURRENT_TIME_SEC;
         ext3_mark_inode_dirty(handle, inode);
+        /* ext3_mark_inode_dirty already updated i_sync_tid */
+        atomic_set(&ei->i_datasync_tid, handle->h_transaction->t_tid);
 
         /* had we spliced it onto indirect block? */
         if (where->bh) {
@@ -1735,6 +1738,7 @@ static ssize_t ext3_direct_IO(int rw, struct kiocb *iocb,
         ssize_t ret;
         int orphan = 0;
         size_t count = iov_length(iov, nr_segs);
+        int retries = 0;
 
         if (rw == WRITE) {
                 loff_t final_size = offset + count;
@@ -1757,9 +1761,12 @@ static ssize_t ext3_direct_IO(int rw, struct kiocb *iocb,
                 }
         }
 
+retry:
         ret = blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
                                  offset, nr_segs,
                                  ext3_get_block, NULL);
+        if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
+                goto retry;
 
         if (orphan) {
                 int err;
@@ -2750,6 +2757,8 @@ struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
         struct ext3_inode_info *ei;
         struct buffer_head *bh;
         struct inode *inode;
+        journal_t *journal = EXT3_SB(sb)->s_journal;
+        transaction_t *transaction;
         long ret;
         int block;
 
@@ -2827,6 +2836,30 @@ struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
                 ei->i_data[block] = raw_inode->i_block[block];
         INIT_LIST_HEAD(&ei->i_orphan);
 
+        /*
+         * Set transaction id's of transactions that have to be committed
+         * to finish f[data]sync. We set them to currently running transaction
+         * as we cannot be sure that the inode or some of its metadata isn't
+         * part of the transaction - the inode could have been reclaimed and
+         * now it is reread from disk.
+         */
+        if (journal) {
+                tid_t tid;
+
+                spin_lock(&journal->j_state_lock);
+                if (journal->j_running_transaction)
+                        transaction = journal->j_running_transaction;
+                else
+                        transaction = journal->j_committing_transaction;
+                if (transaction)
+                        tid = transaction->t_tid;
+                else
+                        tid = journal->j_commit_sequence;
+                spin_unlock(&journal->j_state_lock);
+                atomic_set(&ei->i_sync_tid, tid);
+                atomic_set(&ei->i_datasync_tid, tid);
+        }
+
         if (inode->i_ino >= EXT3_FIRST_INO(inode->i_sb) + 1 &&
             EXT3_INODE_SIZE(inode->i_sb) > EXT3_GOOD_OLD_INODE_SIZE) {
                 /*
@@ -3011,6 +3044,7 @@ again:
                 err = rc;
         ei->i_state &= ~EXT3_STATE_NEW;
 
+        atomic_set(&ei->i_sync_tid, handle->h_transaction->t_tid);
 out_brelse:
         brelse (bh);
         ext3_std_error(inode->i_sb, err);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 72743d360509..427496c4767c 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -466,6 +466,8 @@ static struct inode *ext3_alloc_inode(struct super_block *sb)
                 return NULL;
         ei->i_block_alloc_info = NULL;
         ei->vfs_inode.i_version = 1;
+        atomic_set(&ei->i_datasync_tid, 0);
+        atomic_set(&ei->i_sync_tid, 0);
         return &ei->vfs_inode;
 }
 
@@ -2321,7 +2323,18 @@ static int ext3_commit_super(struct super_block *sb,
 
         if (!sbh)
                 return error;
-        es->s_wtime = cpu_to_le32(get_seconds());
+        /*
+         * If the file system is mounted read-only, don't update the
+         * superblock write time.  This avoids updating the superblock
+         * write time when we are mounting the root file system
+         * read/only but we need to replay the journal; at that point,
+         * for people who are east of GMT and who make their clock
+         * tick in localtime for Windows bug-for-bug compatibility,
+         * the clock is set in the future, and this will cause e2fsck
+         * to complain and force a full file system check.
+         */
+        if (!(sb->s_flags & MS_RDONLY))
+                es->s_wtime = cpu_to_le32(get_seconds());
         es->s_free_blocks_count = cpu_to_le32(ext3_count_free_blocks(sb));
         es->s_free_inodes_count = cpu_to_le32(ext3_count_free_inodes(sb));
         BUFFER_TRACE(sbh, "marking dirty");
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 984ca0cb38c3..8825515eeddd 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -322,6 +322,7 @@ static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
 #define EXT4_STATE_NO_EXPAND            0x00000008 /* No space for expansion */
 #define EXT4_STATE_DA_ALLOC_CLOSE       0x00000010 /* Alloc DA blks on close */
 #define EXT4_STATE_EXT_MIGRATE          0x00000020 /* Inode is migrating */
+#define EXT4_STATE_DIO_UNWRITTEN        0x00000040 /* need convert on dio done*/
 
 /* Used to pass group descriptor data when online resize is done */
 struct ext4_new_group_input {
@@ -743,6 +744,7 @@ struct ext4_inode_info {
 #define EXT4_MOUNT_QUOTA                0x80000 /* Some quota option set */
 #define EXT4_MOUNT_USRQUOTA             0x100000 /* "old" user quota */
 #define EXT4_MOUNT_GRPQUOTA             0x200000 /* "old" group quota */
+#define EXT4_MOUNT_JOURNAL_CHECKSUM     0x800000 /* Journal checksums */
 #define EXT4_MOUNT_JOURNAL_ASYNC_COMMIT 0x1000000 /* Journal Async Commit */
 #define EXT4_MOUNT_I_VERSION            0x2000000 /* i_version support */
 #define EXT4_MOUNT_DELALLOC             0x8000000 /* Delalloc support */
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 10539e364283..715264b4bae4 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2807,6 +2807,8 @@ fix_extent_len:
  * into three uninitialized extent(at most). After IO complete, the part
  * being filled will be convert to initialized by the end_io callback function
  * via ext4_convert_unwritten_extents().
+ *
+ * Returns the size of uninitialized extent to be written on success.
  */
 static int ext4_split_unwritten_extents(handle_t *handle,
                                         struct inode *inode,
@@ -2824,7 +2826,6 @@ static int ext4_split_unwritten_extents(handle_t *handle,
         unsigned int allocated, ee_len, depth;
         ext4_fsblk_t newblock;
         int err = 0;
-        int ret = 0;
 
         ext_debug("ext4_split_unwritten_extents: inode %lu,"
                   "iblock %llu, max_blocks %u\n", inode->i_ino,
@@ -2842,12 +2843,12 @@ static int ext4_split_unwritten_extents(handle_t *handle,
         ext4_ext_store_pblock(&orig_ex, ext_pblock(ex));
 
         /*
-         * if the entire unintialized extent length less than
-         * the size of extent to write, there is no need to split
-         * uninitialized extent
+         * If the uninitialized extent begins at the same logical
+         * block where the write begins, and the write completely
+         * covers the extent, then we don't need to split it.
          */
-        if (allocated <= max_blocks)
-                return ret;
+        if ((iblock == ee_block) && (allocated <= max_blocks))
+                return allocated;
 
         err = ext4_ext_get_access(handle, inode, path + depth);
         if (err)
@@ -3048,12 +3049,18 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                 ret = ext4_split_unwritten_extents(handle,
                                                 inode, path, iblock,
                                                 max_blocks, flags);
-                /* flag the io_end struct that we need convert when IO done */
+                /*
+                 * Flag the inode(non aio case) or end_io struct (aio case)
+                 * that this IO needs to convertion to written when IO is
+                 * completed
+                 */
                 if (io)
                         io->flag = DIO_AIO_UNWRITTEN;
+                else
+                        EXT4_I(inode)->i_state |= EXT4_STATE_DIO_UNWRITTEN;
                 goto out;
         }
-        /* DIO end_io complete, convert the filled extent to written */
+        /* async DIO end_io complete, convert the filled extent to written */
         if (flags == EXT4_GET_BLOCKS_DIO_CONVERT_EXT) {
                 ret = ext4_convert_unwritten_extents_dio(handle, inode,
                                                         path);
@@ -3295,10 +3302,16 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
                  * To avoid unecessary convertion for every aio dio rewrite
                  * to the mid of file, here we flag the IO that is really
                  * need the convertion.
-                 *
+                 * For non asycn direct IO case, flag the inode state
+                 * that we need to perform convertion when IO is done.
                  */
-                if (io && flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT)
-                        io->flag = DIO_AIO_UNWRITTEN;
+                if (flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT) {
+                        if (io)
+                                io->flag = DIO_AIO_UNWRITTEN;
+                        else
+                                EXT4_I(inode)->i_state |=
+                                        EXT4_STATE_DIO_UNWRITTEN;;
+                }
         }
         err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
         if (err) {
@@ -3519,6 +3532,7 @@ retry:
  *
  * This function is called from the direct IO end io call back
  * function, to convert the fallocated extents after IO is completed.
+ * Returns 0 on success.
  */
 int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
                                     loff_t len)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5c5bc5dafff8..2c8caa51addb 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -193,7 +193,7 @@ static int try_to_extend_transaction(handle_t *handle, struct inode *inode)
  * so before we call here everything must be consistently dirtied against
  * this transaction.
  */
- int ext4_truncate_restart_trans(handle_t *handle, struct inode *inode,
+int ext4_truncate_restart_trans(handle_t *handle, struct inode *inode,
                                  int nblocks)
 {
         int ret;
@@ -209,6 +209,7 @@ static int try_to_extend_transaction(handle_t *handle, struct inode *inode)
         up_write(&EXT4_I(inode)->i_data_sem);
         ret = ext4_journal_restart(handle, blocks_for_truncate(inode));
         down_write(&EXT4_I(inode)->i_data_sem);
+        ext4_discard_preallocations(inode);
 
         return ret;
 }
@@ -3445,8 +3446,6 @@ out:
         return ret;
 }
 
-/* Maximum number of blocks we map for direct IO at once. */
-
 static int ext4_get_block_dio_write(struct inode *inode, sector_t iblock,
                    struct buffer_head *bh_result, int create)
 {
@@ -3654,13 +3653,14 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
         ext4_io_end_t *io_end = iocb->private;
         struct workqueue_struct *wq;
 
+        /* if not async direct IO or dio with 0 bytes write, just return */
+        if (!io_end || !size)
+                return;
+
         ext_debug("ext4_end_io_dio(): io_end 0x%p"
                   "for inode %lu, iocb 0x%p, offset %llu, size %llu\n",
                   iocb->private, io_end->inode->i_ino, iocb, offset,
                   size);
-        /* if not async direct IO or dio with 0 bytes write, just return */
-        if (!io_end || !size)
-                return;
 
         /* if not aio dio with unwritten extents, just free io and return */
         if (io_end->flag != DIO_AIO_UNWRITTEN){
@@ -3771,13 +3771,19 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
                 if (ret != -EIOCBQUEUED && ret <= 0 && iocb->private) {
                         ext4_free_io_end(iocb->private);
                         iocb->private = NULL;
-                } else if (ret > 0)
+                } else if (ret > 0 && (EXT4_I(inode)->i_state &
+                                       EXT4_STATE_DIO_UNWRITTEN)) {
+                        int err;
                         /*
                          * for non AIO case, since the IO is already
                          * completed, we could do the convertion right here
                          */
-                        ret = ext4_convert_unwritten_extents(inode,
-                                                                offset, ret);
+                        err = ext4_convert_unwritten_extents(inode,
+                                                             offset, ret);
+                        if (err < 0)
+                                ret = err;
+                        EXT4_I(inode)->i_state &= ~EXT4_STATE_DIO_UNWRITTEN;
+                }
                 return ret;
         }
 
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 7c8fe80bacdd..6d2c1b897fc7 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1518,12 +1518,8 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
                         return retval;
 
                 if (blocks == 1 && !dx_fallback &&
-                    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
-                        retval = make_indexed_dir(handle, dentry, inode, bh);
-                        if (retval == -ENOSPC)
-                                brelse(bh);
-                        return retval;
-                }
+                    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+                        return make_indexed_dir(handle, dentry, inode, bh);
                 brelse(bh);
         }
         bh = ext4_append(handle, dir, &block, &retval);
@@ -1532,10 +1528,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
         de = (struct ext4_dir_entry_2 *) bh->b_data;
         de->inode = 0;
         de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
-        retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
-        if (retval == -ENOSPC)
-                brelse(bh);
-        return retval;
+        return add_dirent_to_buf(handle, dentry, inode, de, bh);
 }
 
 /*
@@ -1664,8 +1657,7 @@ static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
         if (!de)
                 goto cleanup;
         err = add_dirent_to_buf(handle, dentry, inode, de, bh);
-        if (err != -ENOSPC)
-                bh = NULL;
+        bh = NULL;
         goto cleanup;
 
 journal_error:
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 312211ee05af..d4ca92aab514 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1300,9 +1300,11 @@ static int parse_options(char *options, struct super_block *sb,
                         *journal_devnum = option;
                         break;
                 case Opt_journal_checksum:
-                        break;  /* Kept for backwards compatibility */
+                        set_opt(sbi->s_mount_opt, JOURNAL_CHECKSUM);
+                        break;
                 case Opt_journal_async_commit:
                         set_opt(sbi->s_mount_opt, JOURNAL_ASYNC_COMMIT);
+                        set_opt(sbi->s_mount_opt, JOURNAL_CHECKSUM);
                         break;
                 case Opt_noload:
                         set_opt(sbi->s_mount_opt, NOLOAD);
@@ -2759,14 +2761,20 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                 goto failed_mount4;
         }
 
-        jbd2_journal_set_features(sbi->s_journal,
-                                  JBD2_FEATURE_COMPAT_CHECKSUM, 0, 0);
-        if (test_opt(sb, JOURNAL_ASYNC_COMMIT))
-                jbd2_journal_set_features(sbi->s_journal, 0, 0,
+        if (test_opt(sb, JOURNAL_ASYNC_COMMIT)) {
+                jbd2_journal_set_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0,
                                 JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
-        else
+        } else if (test_opt(sb, JOURNAL_CHECKSUM)) {
+                jbd2_journal_set_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0, 0);
                 jbd2_journal_clear_features(sbi->s_journal, 0, 0,
                                 JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
+        } else {
+                jbd2_journal_clear_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0,
+                                JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
+        }
 
         /* We have now updated the journal if required, so we can
          * validate the data journaling mode. */
diff --git a/fs/fcntl.c b/fs/fcntl.c
index fc089f2f7f56..2cf93ec40a67 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -284,7 +284,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
                 type = PIDTYPE_PID;
                 break;
 
-        case F_OWNER_GID:
+        case F_OWNER_PGRP:
                 type = PIDTYPE_PGID;
                 break;
 
@@ -321,7 +321,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg)
                 break;
 
         case PIDTYPE_PGID:
-                owner.type = F_OWNER_GID;
+                owner.type = F_OWNER_PGRP;
                 break;
 
         default:
diff --git a/fs/file.c b/fs/file.c
index f313314f996f..87e129030ab1 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -10,6 +10,7 @@
 #include <linux/fs.h>
 #include <linux/mm.h>
 #include <linux/time.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/file.h>
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 992f6c9410bb..8ada78aade58 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -712,8 +712,10 @@ static int fuse_rename(struct inode *olddir, struct dentry *oldent,
                         fuse_invalidate_attr(newdir);
 
                 /* newent will end up negative */
-                if (newent->d_inode)
+                if (newent->d_inode) {
+                        fuse_invalidate_attr(newent->d_inode);
                         fuse_invalidate_entry_cache(newent);
+                }
         } else if (err == -EINTR) {
                 /* If request was interrupted, DEITY only knows if the
                    rename actually took place.  If the invalidation
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index a3492f7d207c..c18913a777ae 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1063,7 +1063,8 @@ ssize_t fuse_direct_io(struct file *file, const char __user *buf,
                                 break;
                 }
         }
-        fuse_put_request(fc, req);
+        if (!IS_ERR(req))
+                fuse_put_request(fc, req);
         if (res > 0)
                 *ppos = pos;
 
@@ -1599,7 +1600,7 @@ static int fuse_ioctl_copy_user(struct page **pages, struct iovec *iov,
                         kaddr += copy;
                 }
 
-                kunmap(map);
+                kunmap(page);
         }
 
         return 0;
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 9b9d6395bad3..052f214ea6f0 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -58,6 +58,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         }
         unlock_new_inode(tree->inode);
 
+        if (!HFS_I(tree->inode)->first_blocks) {
+                printk(KERN_ERR "hfs: invalid btree extent records (0 size).\n");
+                goto free_inode;
+        }
+
         mapping = tree->inode->i_mapping;
         page = read_mapping_page(mapping, 0, NULL);
         if (IS_ERR(page))
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 175d08eacc86..bed78ac8f6d1 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -99,6 +99,10 @@ int hfsplus_read_wrapper(struct super_block *sb)
 
         if (hfsplus_get_last_session(sb, &part_start, &part_size))
                 return -EINVAL;
+        if ((u64)part_start + part_size > 0x100000000ULL) {
+                pr_err("hfs: volumes larger than 2TB are not supported yet\n");
+                return -EINVAL;
+        }
         while (1) {
                 bh = sb_bread512(sb, part_start + HFSPLUS_VOLHEAD_SECTOR, vhdr);
                 if (!bh)
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 7b17a14396ff..6c751106c2e5 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -254,7 +254,7 @@ int __generic_block_fiemap(struct inode *inode,
                            u64 len, get_block_t *get_block)
 {
         struct buffer_head tmp;
-        unsigned int start_blk;
+        unsigned long long start_blk;
         long long length = 0, map_len = 0;
         u64 logical = 0, phys = 0, size = 0;
         u32 flags = FIEMAP_EXTENT_MERGED;
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index bd3c073b485d..4160afad6d00 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -73,6 +73,7 @@ EXPORT_SYMBOL(journal_errno);
 EXPORT_SYMBOL(journal_ack_err);
 EXPORT_SYMBOL(journal_clear_err);
 EXPORT_SYMBOL(log_wait_commit);
+EXPORT_SYMBOL(log_start_commit);
 EXPORT_SYMBOL(journal_start_commit);
 EXPORT_SYMBOL(journal_force_commit_nested);
 EXPORT_SYMBOL(journal_wipe);
@@ -756,6 +757,7 @@ journal_t * journal_init_dev(struct block_device *bdev,
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         kfree(journal);
         return NULL;
 }
@@ -820,6 +822,7 @@ journal_t * journal_init_inode (struct inode *inode)
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         kfree(journal);
         return NULL;
 }
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index b0ab5219becb..fed85388ee86 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -913,6 +913,7 @@ journal_t * jbd2_journal_init_dev(struct block_device *bdev,
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         jbd2_stats_proc_exit(journal);
         kfree(journal);
         return NULL;
@@ -986,6 +987,7 @@ journal_t * jbd2_journal_init_inode (struct inode *inode)
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         jbd2_stats_proc_exit(journal);
         kfree(journal);
         return NULL;
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 63976c0ccc25..99ea196f071f 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1180,7 +1180,7 @@ static int nfs4_init_client(struct nfs_client *clp,
                                       1, flags & NFS_MOUNT_NORESVPORT);
         if (error < 0)
                 goto error;
-        memcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
+        strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
 
         error = nfs_idmap_new(clp);
         if (error < 0) {
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 32062c33c859..7cb298525eef 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1536,6 +1536,8 @@ nfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry)
                 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
                 dentry->d_parent->d_name.name, dentry->d_name.name);
 
+        nfs_inode_return_delegation(inode);
+
         d_drop(dentry);
         error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name);
         if (error == 0) {
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 6c3210099d51..e1d415e97849 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -457,6 +457,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
         };
         struct rpc_task_setup task_setup_data = {
                 .rpc_client = NFS_CLIENT(inode),
+                .rpc_message = &msg,
                 .callback_ops = &nfs_write_direct_ops,
                 .workqueue = nfsiod_workqueue,
                 .flags = RPC_TASK_ASYNC,
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 2636c26d56fa..fa3408f20112 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -121,7 +121,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
 
         mnt_path = nfs4_pathname_string(&location->rootpath, page2, PAGE_SIZE);
         if (IS_ERR(mnt_path))
-                return mnt;
+                return ERR_CAST(mnt_path);
         mountdata->mnt_path = mnt_path;
         maxbuflen = mnt_path - 1 - page2;
 
@@ -132,15 +132,15 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                 if (buf->len <= 0 || buf->len >= maxbuflen)
                         continue;
 
-                mountdata->addr = (struct sockaddr *)&addr;
-
                 if (memchr(buf->data, IPV6_SCOPE_DELIMITER, buf->len))
                         continue;
-                mountdata->addrlen = nfs_parse_server_name(buf->data,
-                                buf->len,
-                                mountdata->addr, mountdata->addrlen);
+
+                mountdata->addrlen = nfs_parse_server_name(buf->data, buf->len,
+                                (struct sockaddr *)&addr, sizeof(addr));
                 if (mountdata->addrlen == 0)
                         continue;
+
+                mountdata->addr = (struct sockaddr *)&addr;
                 rpc_set_port(mountdata->addr, NFS_PORT);
 
                 memcpy(page2, buf->data, buf->len);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ed7c269e2514..ff37454fa783 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -72,12 +72,17 @@ static int _nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle,
 /* Prevent leaks of NFSv4 errors into userland */
 static int nfs4_map_errors(int err)
 {
-        if (err < -1000) {
+        if (err >= -1000)
+                return err;
+        switch (err) {
+        case -NFS4ERR_RESOURCE:
+                return -EREMOTEIO;
+        default:
                 dprintk("%s could not handle NFSv4 error %d\n",
                                 __func__, -err);
-                return -EIO;
+                break;
         }
-        return err;
+        return -EIO;
 }
 
 /*
@@ -3060,9 +3065,6 @@ static void nfs4_renew_done(struct rpc_task *task, void *data)
         if (time_before(clp->cl_last_renewal,timestamp))
                 clp->cl_last_renewal = timestamp;
         spin_unlock(&clp->cl_lock);
-        dprintk("%s calling put_rpccred on rpc_cred %p\n", __func__,
-                                task->tk_msg.rpc_cred);
-        put_rpccred(task->tk_msg.rpc_cred);
 }
 
 static const struct rpc_call_ops nfs4_renew_ops = {
@@ -4877,7 +4879,6 @@ void nfs41_sequence_call_done(struct rpc_task *task, void *data)
         nfs41_sequence_free_slot(clp, task->tk_msg.rpc_resp);
         dprintk("%s rpc_cred %p\n", __func__, task->tk_msg.rpc_cred);
 
-        put_rpccred(task->tk_msg.rpc_cred);
         kfree(task->tk_msg.rpc_argp);
         kfree(task->tk_msg.rpc_resp);
 
diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
index e27c6cef18f2..0156c01c212c 100644
--- a/fs/nfs/nfs4renewd.c
+++ b/fs/nfs/nfs4renewd.c
@@ -127,12 +127,6 @@ nfs4_schedule_state_renewal(struct nfs_client *clp)
 }
 
 void
-nfs4_renewd_prepare_shutdown(struct nfs_server *server)
-{
-        cancel_delayed_work(&server->nfs_client->cl_renewd);
-}
-
-void
 nfs4_kill_renewd(struct nfs_client *clp)
 {
         cancel_delayed_work_sync(&clp->cl_renewd);
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 83ad47cbdd8a..20b4e30e6c82 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -5681,7 +5681,6 @@ static struct {
         { NFS4ERR_SERVERFAULT,  -ESERVERFAULT   },
         { NFS4ERR_BADTYPE,      -EBADTYPE       },
         { NFS4ERR_LOCKED,       -EAGAIN         },
-        { NFS4ERR_RESOURCE,     -EREMOTEIO      },
         { NFS4ERR_SYMLINK,      -ELOOP          },
         { NFS4ERR_OP_ILLEGAL,   -EOPNOTSUPP     },
         { NFS4ERR_DEADLOCK,     -EDEADLK        },
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 29786d3b9326..90be551b80c1 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -728,22 +728,24 @@ static void nfs_umount_begin(struct super_block *sb)
         unlock_kernel();
 }
 
-static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(int flags)
+static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(unsigned int version)
 {
         struct nfs_parsed_mount_data *data;
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (data) {
-                data->flags             = flags;
                 data->rsize             = NFS_MAX_FILE_IO_SIZE;
                 data->wsize             = NFS_MAX_FILE_IO_SIZE;
                 data->acregmin          = NFS_DEF_ACREGMIN;
                 data->acregmax          = NFS_DEF_ACREGMAX;
                 data->acdirmin          = NFS_DEF_ACDIRMIN;
                 data->acdirmax          = NFS_DEF_ACDIRMAX;
+                data->mount_server.port = NFS_UNSPEC_PORT;
                 data->nfs_server.port   = NFS_UNSPEC_PORT;
+                data->nfs_server.protocol = XPRT_TRANSPORT_TCP;
                 data->auth_flavors[0]   = RPC_AUTH_UNIX;
                 data->auth_flavor_len   = 1;
+                data->version           = version;
                 data->minorversion      = 0;
         }
         return data;
@@ -776,15 +778,13 @@ static int nfs_verify_server_address(struct sockaddr *addr)
  * Select between a default port value and a user-specified port value.
  * If a zero value is set, then autobind will be used.
  */
-static void nfs_set_default_port(struct sockaddr *sap, const int parsed_port,
+static void nfs_set_port(struct sockaddr *sap, int *port,
                                  const unsigned short default_port)
 {
-        unsigned short port = default_port;
+        if (*port == NFS_UNSPEC_PORT)
+                *port = default_port;
 
-        if (parsed_port != NFS_UNSPEC_PORT)
-                port = parsed_port;
-
-        rpc_set_port(sap, port);
+        rpc_set_port(sap, *port);
 }
 
 /*
@@ -1253,6 +1253,7 @@ static int nfs_parse_mount_options(char *raw,
                         default:
                                 dfprintk(MOUNT, "NFS:   unrecognized "
                                                 "transport protocol\n");
+                                kfree(string);
                                 return 0;
                         }
                         break;
@@ -1475,7 +1476,7 @@ static int nfs_try_mount(struct nfs_parsed_mount_data *args,
                 args->mount_server.addrlen = args->nfs_server.addrlen;
         }
         request.salen = args->mount_server.addrlen;
-        nfs_set_default_port(request.sap, args->mount_server.port, 0);
+        nfs_set_port(request.sap, &args->mount_server.port, 0);
 
         /*
          * Now ask the mount server to map our export path
@@ -1711,8 +1712,6 @@ static int nfs_validate_mount_data(void *options,
 
                 if (!(data->flags & NFS_MOUNT_TCP))
                         args->nfs_server.protocol = XPRT_TRANSPORT_UDP;
-                else
-                        args->nfs_server.protocol = XPRT_TRANSPORT_TCP;
                 /* N.B. caller will free nfs_server.hostname in all cases */
                 args->nfs_server.hostname = kstrdup(data->hostname, GFP_KERNEL);
                 args->namlen            = data->namlen;
@@ -1767,7 +1766,7 @@ static int nfs_validate_mount_data(void *options,
                         goto out_v4_not_compiled;
 #endif
 
-                nfs_set_default_port(sap, args->nfs_server.port, 0);
+                nfs_set_port(sap, &args->nfs_server.port, 0);
 
                 nfs_set_mount_transport_protocol(args);
 
@@ -1848,9 +1847,10 @@ nfs_compare_remount_data(struct nfs_server *nfss,
             data->acdirmin != nfss->acdirmin / HZ ||
             data->acdirmax != nfss->acdirmax / HZ ||
             data->timeo != (10U * nfss->client->cl_timeout->to_initval / HZ) ||
+            data->nfs_server.port != nfss->port ||
             data->nfs_server.addrlen != nfss->nfs_client->cl_addrlen ||
-            memcmp(&data->nfs_server.address, &nfss->nfs_client->cl_addr,
-                   data->nfs_server.addrlen) != 0)
+            !rpc_cmp_addr((struct sockaddr *)&data->nfs_server.address,
+                          (struct sockaddr *)&nfss->nfs_client->cl_addr))
                 return -EINVAL;
 
         return 0;
@@ -1893,6 +1893,7 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data)
         data->acdirmin = nfss->acdirmin / HZ;
         data->acdirmax = nfss->acdirmax / HZ;
         data->timeo = 10U * nfss->client->cl_timeout->to_initval / HZ;
+        data->nfs_server.port = nfss->port;
         data->nfs_server.addrlen = nfss->nfs_client->cl_addrlen;
         memcpy(&data->nfs_server.address, &nfss->nfs_client->cl_addr,
                 data->nfs_server.addrlen);
@@ -2106,7 +2107,7 @@ static int nfs_get_sb(struct file_system_type *fs_type,
         };
         int error = -ENOMEM;
 
-        data = nfs_alloc_parsed_mount_data(NFS_MOUNT_VER3 | NFS_MOUNT_TCP);
+        data = nfs_alloc_parsed_mount_data(3);
         mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
         if (data == NULL || mntfh == NULL)
                 goto out_free_fh;
@@ -2331,7 +2332,7 @@ static int nfs4_validate_text_mount_data(void *options,
 {
         struct sockaddr *sap = (struct sockaddr *)&args->nfs_server.address;
 
-        nfs_set_default_port(sap, args->nfs_server.port, NFS_PORT);
+        nfs_set_port(sap, &args->nfs_server.port, NFS_PORT);
 
         nfs_validate_transport_protocol(args);
 
@@ -2376,7 +2377,6 @@ static int nfs4_validate_mount_data(void *options,
         if (data == NULL)
                 goto out_no_data;
 
-        args->version           = 4;
         switch (data->version) {
         case 1:
                 if (data->host_addrlen > sizeof(args->nfs_server.address))
@@ -2660,7 +2660,7 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
         struct nfs_parsed_mount_data *data;
         int error = -ENOMEM;
 
-        data = nfs_alloc_parsed_mount_data(0);
+        data = nfs_alloc_parsed_mount_data(4);
         if (data == NULL)
                 goto out_free_data;
 
@@ -2690,7 +2690,6 @@ static void nfs4_kill_super(struct super_block *sb)
         dprintk("--> %s\n", __func__);
         nfs_super_return_all_delegations(sb);
         kill_anon_super(sb);
-        nfs4_renewd_prepare_shutdown(server);
         nfs_fscache_release_super_cookie(sb);
         nfs_free_server(server);
         dprintk("<-- %s\n", __func__);
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index edf926e1062f..d0a2ce1b4324 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -958,7 +958,7 @@ encode_entry(struct readdir_cd *ccd, const char *name, int namlen,
                 p1 = encode_entry_baggage(cd, p1, name, namlen, ino);
 
                 if (plus)
-                        p = encode_entryplus_baggage(cd, p1, name, namlen);
+                        p1 = encode_entryplus_baggage(cd, p1, name, namlen);
 
                 /* determine entry word length and lengths to go in pages */
                 num_entry_words = p1 - tmp;
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index 5941958f1e47..84c25382f8e3 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -87,6 +87,7 @@ int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,
                         brelse(bh);
                         BUG();
                 }
+                memset(bh->b_data, 0, 1 << inode->i_blkbits);
                 bh->b_bdev = NILFS_I_NILFS(inode)->ns_bdev;
                 bh->b_blocknr = blocknr;
                 set_buffer_mapped(bh);
@@ -276,8 +277,7 @@ void nilfs_btnode_commit_change_key(struct address_space *btnc,
                                        "invalid oldkey %lld (newkey=%lld)",
                                        (unsigned long long)oldkey,
                                        (unsigned long long)newkey);
-                if (!test_set_buffer_dirty(obh) && TestSetPageDirty(opage))
-                        BUG();
+                nilfs_btnode_mark_dirty(obh);
 
                 spin_lock_irq(&btnc->tree_lock);
                 radix_tree_delete(&btnc->page_tree, oldkey);
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index 1c6cfb59128d..3f5d5d06f53c 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -871,7 +871,6 @@ int nilfs_cpfile_change_cpmode(struct inode *cpfile, __u64 cno, int mode)
                  * exclusive with a new mount job.  Though it doesn't cover
                  * umount, it's enough for the purpose.
                  */
-                mutex_lock(&nilfs->ns_mount_mutex);
                 if (nilfs_checkpoint_is_mounted(nilfs, cno, 1)) {
                         /* Current implementation does not have to protect
                            plain read-only mounts since they are exclusive
@@ -880,7 +879,6 @@ int nilfs_cpfile_change_cpmode(struct inode *cpfile, __u64 cno, int mode)
                         ret = -EBUSY;
                 } else
                         ret = nilfs_cpfile_clear_snapshot(cpfile, cno);
-                mutex_unlock(&nilfs->ns_mount_mutex);
                 return ret;
         case NILFS_SNAPSHOT:
                 return nilfs_cpfile_set_snapshot(cpfile, cno);
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 5040220c3732..2a0a5a3ac134 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -664,7 +664,6 @@ int nilfs_load_inode_block(struct nilfs_sb_info *sbi, struct inode *inode,
         int err;
 
         spin_lock(&sbi->s_inode_lock);
-        /* Caller of this function MUST lock s_inode_lock */
         if (ii->i_bh == NULL) {
                 spin_unlock(&sbi->s_inode_lock);
                 err = nilfs_ifile_get_inode_block(sbi->s_ifile, inode->i_ino,
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 6572ea4bc4df..f6af76042d80 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -99,7 +99,8 @@ static int nilfs_ioctl_wrap_copy(struct the_nilfs *nilfs,
 static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
                                      unsigned int cmd, void __user *argp)
 {
-        struct inode *cpfile = NILFS_SB(inode->i_sb)->s_nilfs->ns_cpfile;
+        struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+        struct inode *cpfile = nilfs->ns_cpfile;
         struct nilfs_transaction_info ti;
         struct nilfs_cpmode cpmode;
         int ret;
@@ -109,14 +110,17 @@ static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
         if (copy_from_user(&cpmode, argp, sizeof(cpmode)))
                 return -EFAULT;
 
+        mutex_lock(&nilfs->ns_mount_mutex);
         nilfs_transaction_begin(inode->i_sb, &ti, 0);
         ret = nilfs_cpfile_change_cpmode(
                 cpfile, cpmode.cm_cno, cpmode.cm_mode);
         if (unlikely(ret < 0)) {
                 nilfs_transaction_abort(inode->i_sb);
+                mutex_unlock(&nilfs->ns_mount_mutex);
                 return ret;
         }
         nilfs_transaction_commit(inode->i_sb); /* never fails */
+        mutex_unlock(&nilfs->ns_mount_mutex);
         return ret;
 }
 
@@ -297,7 +301,18 @@ static int nilfs_ioctl_move_inode_block(struct inode *inode,
                                (unsigned long long)vdesc->vd_vblocknr);
                 return ret;
         }
-        bh->b_private = vdesc;
+        if (unlikely(!list_empty(&bh->b_assoc_buffers))) {
+                printk(KERN_CRIT "%s: conflicting %s buffer: ino=%llu, "
+                       "cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu\n",
+                       __func__, vdesc->vd_flags ? "node" : "data",
+                       (unsigned long long)vdesc->vd_ino,
+                       (unsigned long long)vdesc->vd_cno,
+                       (unsigned long long)vdesc->vd_offset,
+                       (unsigned long long)vdesc->vd_blocknr,
+                       (unsigned long long)vdesc->vd_vblocknr);
+                brelse(bh);
+                return -EEXIST;
+        }
         list_add_tail(&bh->b_assoc_buffers, buffers);
         return 0;
 }
@@ -335,24 +350,10 @@ static int nilfs_ioctl_move_blocks(struct the_nilfs *nilfs,
         list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) {
                 ret = nilfs_gccache_wait_and_mark_dirty(bh);
                 if (unlikely(ret < 0)) {
-                        if (ret == -EEXIST) {
-                                vdesc = bh->b_private;
-                                printk(KERN_CRIT
-                                       "%s: conflicting %s buffer: "
-                                       "ino=%llu, cno=%llu, offset=%llu, "
-                                       "blocknr=%llu, vblocknr=%llu\n",
-                                       __func__,
-                                       vdesc->vd_flags ? "node" : "data",
-                                       (unsigned long long)vdesc->vd_ino,
-                                       (unsigned long long)vdesc->vd_cno,
-                                       (unsigned long long)vdesc->vd_offset,
-                                       (unsigned long long)vdesc->vd_blocknr,
-                                       (unsigned long long)vdesc->vd_vblocknr);
-                        }
+                        WARN_ON(ret == -EEXIST);
                         goto failed;
                 }
                 list_del_init(&bh->b_assoc_buffers);
-                bh->b_private = NULL;
                 brelse(bh);
         }
         return nmembs;
@@ -360,7 +361,6 @@ static int nilfs_ioctl_move_blocks(struct the_nilfs *nilfs,
  failed:
         list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) {
                 list_del_init(&bh->b_assoc_buffers);
-                bh->b_private = NULL;
                 brelse(bh);
         }
         return ret;
@@ -471,7 +471,6 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
         return 0;
 
  failed:
-        nilfs_remove_all_gcinode(nilfs);
         printk(KERN_ERR "NILFS: GC failed during preparation: %s: err=%d\n",
                msg, ret);
         return ret;
@@ -560,6 +559,8 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
         else
                 ret = nilfs_clean_segments(inode->i_sb, argv, kbufs);
 
+        if (ret < 0)
+                nilfs_remove_all_gcinode(nilfs);
         clear_nilfs_gc_running(nilfs);
 
  out_free:
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 683df89dbae5..6eff66a070d5 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2468,17 +2468,22 @@ static void nilfs_segctor_notify(struct nilfs_sc_info *sci,
         /* Clear requests (even when the construction failed) */
         spin_lock(&sci->sc_state_lock);
 
-        sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
-
         if (req->mode == SC_LSEG_SR) {
+                sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
                 sci->sc_seq_done = req->seq_accepted;
                 nilfs_segctor_wakeup(sci, req->sc_err ? : req->sb_err);
                 sci->sc_flush_request = 0;
-        } else if (req->mode == SC_FLUSH_FILE)
-                sci->sc_flush_request &= ~FLUSH_FILE_BIT;
-        else if (req->mode == SC_FLUSH_DAT)
-                sci->sc_flush_request &= ~FLUSH_DAT_BIT;
+        } else {
+                if (req->mode == SC_FLUSH_FILE)
+                        sci->sc_flush_request &= ~FLUSH_FILE_BIT;
+                else if (req->mode == SC_FLUSH_DAT)
+                        sci->sc_flush_request &= ~FLUSH_DAT_BIT;
 
+                /* re-enable timer if checkpoint creation was not done */
+                if (sci->sc_timer && (sci->sc_state & NILFS_SEGCTOR_COMMIT) &&
+                    time_before(jiffies, sci->sc_timer->expires))
+                        add_timer(sci->sc_timer);
+        }
         spin_unlock(&sci->sc_state_lock);
 }
 
diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
index 828a889be909..7e54e52964dd 100644
--- a/fs/notify/dnotify/dnotify.c
+++ b/fs/notify/dnotify/dnotify.c
@@ -91,6 +91,7 @@ static int dnotify_handle_event(struct fsnotify_group *group,
         struct dnotify_struct *dn;
         struct dnotify_struct **prev;
         struct fown_struct *fown;
+        __u32 test_mask = event->mask & ~FS_EVENT_ON_CHILD;
 
         to_tell = event->to_tell;
 
@@ -106,7 +107,7 @@ static int dnotify_handle_event(struct fsnotify_group *group,
         spin_lock(&entry->lock);
         prev = &dnentry->dn;
         while ((dn = *prev) != NULL) {
-                if ((dn->dn_mask & event->mask) == 0) {
+                if ((dn->dn_mask & test_mask) == 0) {
                         prev = &dn->dn_next;
                         continue;
                 }
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index c8a07c65482b..3165d85aada2 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -324,11 +324,11 @@ int fsnotify_add_mark(struct fsnotify_mark_entry *entry,
         spin_lock(&group->mark_lock);
         spin_lock(&inode->i_lock);
 
-        entry->group = group;
-        entry->inode = inode;
-
         lentry = fsnotify_find_mark_entry(group, inode);
         if (!lentry) {
+                entry->group = group;
+                entry->inode = inode;
+
                 hlist_add_head(&entry->i_list, &inode->i_fsnotify_mark_entries);
                 list_add(&entry->g_list, &group->mark_entries);
 
diff --git a/fs/notify/notification.c b/fs/notify/notification.c
index 3816d5750dd5..b8bf53b4c108 100644
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -143,7 +143,7 @@ static bool event_compare(struct fsnotify_event *old, struct fsnotify_event *new
                         /* remember, after old was put on the wait_q we aren't
                          * allowed to look at the inode any more, only thing
                          * left to check was if the file_name is the same */
-                        if (old->name_len &&
+                        if (!old->name_len ||
                             !strcmp(old->file_name, new->file_name))
                                 return true;
                         break;
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index f38fee0311a7..7b685e10cbad 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -248,11 +248,19 @@ ssize_t part_stat_show(struct device *dev,
                 part_stat_read(p, merges[WRITE]),
                 (unsigned long long)part_stat_read(p, sectors[WRITE]),
                 jiffies_to_msecs(part_stat_read(p, ticks[WRITE])),
-                p->in_flight,
+                part_in_flight(p),
                 jiffies_to_msecs(part_stat_read(p, io_ticks)),
                 jiffies_to_msecs(part_stat_read(p, time_in_queue)));
 }
 
+ssize_t part_inflight_show(struct device *dev,
+                        struct device_attribute *attr, char *buf)
+{
+        struct hd_struct *p = dev_to_part(dev);
+
+        return sprintf(buf, "%8u %8u\n", p->in_flight[0], p->in_flight[1]);
+}
+
 #ifdef CONFIG_FAIL_MAKE_REQUEST
 ssize_t part_fail_show(struct device *dev,
                        struct device_attribute *attr, char *buf)
@@ -281,6 +289,7 @@ static DEVICE_ATTR(start, S_IRUGO, part_start_show, NULL);
 static DEVICE_ATTR(size, S_IRUGO, part_size_show, NULL);
 static DEVICE_ATTR(alignment_offset, S_IRUGO, part_alignment_offset_show, NULL);
 static DEVICE_ATTR(stat, S_IRUGO, part_stat_show, NULL);
+static DEVICE_ATTR(inflight, S_IRUGO, part_inflight_show, NULL);
 #ifdef CONFIG_FAIL_MAKE_REQUEST
 static struct device_attribute dev_attr_fail =
         __ATTR(make-it-fail, S_IRUGO|S_IWUSR, part_fail_show, part_fail_store);
@@ -292,6 +301,7 @@ static struct attribute *part_attrs[] = {
         &dev_attr_size.attr,
         &dev_attr_alignment_offset.attr,
         &dev_attr_stat.attr,
+        &dev_attr_inflight.attr,
 #ifdef CONFIG_FAIL_MAKE_REQUEST
         &dev_attr_fail.attr,
 #endif
diff --git a/fs/pipe.c b/fs/pipe.c
index 52c415114838..ae17d026aaa3 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -777,36 +777,55 @@ pipe_rdwr_release(struct inode *inode, struct file *filp)
 static int
 pipe_read_open(struct inode *inode, struct file *filp)
 {
-        /* We could have perhaps used atomic_t, but this and friends
-           below are the only places.  So it doesn't seem worthwhile.  */
+        int ret = -ENOENT;
+
         mutex_lock(&inode->i_mutex);
-        inode->i_pipe->readers++;
+
+        if (inode->i_pipe) {
+                ret = 0;
+                inode->i_pipe->readers++;
+        }
+
         mutex_unlock(&inode->i_mutex);
 
-        return 0;
+        return ret;
 }
 
 static int
 pipe_write_open(struct inode *inode, struct file *filp)
 {
+        int ret = -ENOENT;
+
         mutex_lock(&inode->i_mutex);
-        inode->i_pipe->writers++;
+
+        if (inode->i_pipe) {
+                ret = 0;
+                inode->i_pipe->writers++;
+        }
+
         mutex_unlock(&inode->i_mutex);
 
-        return 0;
+        return ret;
 }
 
 static int
 pipe_rdwr_open(struct inode *inode, struct file *filp)
 {
+        int ret = -ENOENT;
+
         mutex_lock(&inode->i_mutex);
-        if (filp->f_mode & FMODE_READ)
-                inode->i_pipe->readers++;
-        if (filp->f_mode & FMODE_WRITE)
-                inode->i_pipe->writers++;
+
+        if (inode->i_pipe) {
+                ret = 0;
+                if (filp->f_mode & FMODE_READ)
+                        inode->i_pipe->readers++;
+                if (filp->f_mode & FMODE_WRITE)
+                        inode->i_pipe->writers++;
+        }
+
         mutex_unlock(&inode->i_mutex);
 
-        return 0;
+        return ret;
 }
 
 /*
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 07f77a7945c3..822c2d506518 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -571,7 +571,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                 rsslim,
                 mm ? mm->start_code : 0,
                 mm ? mm->end_code : 0,
-                (permitted) ? task->stack_start : 0,
+                (permitted && mm) ? task->stack_start : 0,
                 esp,
                 eip,
                 /* The signal information here is obsolete.
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 837469a96598..af643b5aefe8 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2597,8 +2597,7 @@ static void proc_flush_task_mnt(struct vfsmount *mnt, pid_t pid, pid_t tgid)
         name.len = snprintf(buf, sizeof(buf), "%d", pid);
         dentry = d_hash_and_lookup(mnt->mnt_root, &name);
         if (dentry) {
-                if (!(current->flags & PF_EXITING))
-                        shrink_dcache_parent(dentry);
+                shrink_dcache_parent(dentry);
                 d_drop(dentry);
                 dput(dentry);
         }
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index 56013371f9f3..a44a7897fd4d 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -23,7 +23,6 @@
 #include <asm/io.h>
 #include <linux/list.h>
 #include <linux/ioport.h>
-#include <linux/mm.h>
 #include <linux/memory.h>
 #include <asm/sections.h>
 
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index c7bff4f603ff..a65239cfd97e 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -99,7 +99,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
                 "VmallocUsed:    %8lu kB\n"
                 "VmallocChunk:   %8lu kB\n"
 #ifdef CONFIG_MEMORY_FAILURE
-                "HardwareCorrupted: %8lu kB\n"
+                "HardwareCorrupted: %5lu kB\n"
 #endif
                 ,
                 K(i.totalram),
diff --git a/fs/proc/page.c b/fs/proc/page.c
index 2281c2cbfe2b..5033ce0d254b 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -94,6 +94,7 @@ static const struct file_operations proc_kpagecount_operations = {
 #define KPF_COMPOUND_TAIL       16
 #define KPF_HUGE                17
 #define KPF_UNEVICTABLE         18
+#define KPF_HWPOISON            19
 #define KPF_NOPAGE              20
 
 #define KPF_KSM                 21
@@ -180,6 +181,10 @@ static u64 get_uflags(struct page *page)
         u |= kpf_copy_bit(k, KPF_UNEVICTABLE,   PG_unevictable);
         u |= kpf_copy_bit(k, KPF_MLOCKED,       PG_mlocked);
 
+#ifdef CONFIG_MEMORY_FAILURE
+        u |= kpf_copy_bit(k, KPF_HWPOISON,      PG_hwpoison);
+#endif
+
 #ifdef CONFIG_IA64_UNCACHED_ALLOCATOR
         u |= kpf_copy_bit(k, KPF_UNCACHED,      PG_uncached);
 #endif
diff --git a/fs/romfs/storage.c b/fs/romfs/storage.c
index b3208adf8e71..71e2b4d50a0a 100644
--- a/fs/romfs/storage.c
+++ b/fs/romfs/storage.c
@@ -253,11 +253,11 @@ ssize_t romfs_dev_strnlen(struct super_block *sb,
 
 #ifdef CONFIG_ROMFS_ON_MTD
         if (sb->s_mtd)
-                return romfs_mtd_strnlen(sb, pos, limit);
+                return romfs_mtd_strnlen(sb, pos, maxlen);
 #endif
 #ifdef CONFIG_ROMFS_ON_BLOCK
         if (sb->s_bdev)
-                return romfs_blk_strnlen(sb, pos, limit);
+                return romfs_blk_strnlen(sb, pos, maxlen);
 #endif
         return -EIO;
 }
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 0050fc40e8c9..e0201837d244 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -21,6 +21,7 @@
 #include <linux/completion.h>
 #include <linux/mutex.h>
 #include <linux/slab.h>
+#include <linux/security.h>
 #include "sysfs.h"
 
 DEFINE_MUTEX(sysfs_mutex);
@@ -285,6 +286,9 @@ void release_sysfs_dirent(struct sysfs_dirent * sd)
                 sysfs_put(sd->s_symlink.target_sd);
         if (sysfs_type(sd) & SYSFS_COPY_NAME)
                 kfree(sd->s_name);
+        if (sd->s_iattr && sd->s_iattr->ia_secdata)
+                security_release_secctx(sd->s_iattr->ia_secdata,
+                                        sd->s_iattr->ia_secdata_len);
         kfree(sd->s_iattr);
         sysfs_free_ino(sd->s_ino);
         kmem_cache_free(sysfs_dir_cachep, sd);
@@ -894,7 +898,8 @@ int sysfs_move_dir(struct kobject *kobj, struct kobject *new_parent_kobj)
 
         mutex_lock(&sysfs_rename_mutex);
         BUG_ON(!sd->s_parent);
-        new_parent_sd = new_parent_kobj->sd ? new_parent_kobj->sd : &sysfs_root;
+        new_parent_sd = (new_parent_kobj && new_parent_kobj->sd) ?
+                new_parent_kobj->sd : &sysfs_root;
 
         error = 0;
         if (sd->s_parent == new_parent_sd)
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 561a9c050cef..f5ea4680f15f 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -268,7 +268,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
         struct sysfs_open_dirent *od, *new_od = NULL;
 
  retry:
-        spin_lock(&sysfs_open_dirent_lock);
+        spin_lock_irq(&sysfs_open_dirent_lock);
 
         if (!sd->s_attr.open && new_od) {
                 sd->s_attr.open = new_od;
@@ -281,7 +281,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
                 list_add_tail(&buffer->list, &od->buffers);
         }
 
-        spin_unlock(&sysfs_open_dirent_lock);
+        spin_unlock_irq(&sysfs_open_dirent_lock);
 
         if (od) {
                 kfree(new_od);
@@ -315,8 +315,9 @@ static void sysfs_put_open_dirent(struct sysfs_dirent *sd,
                                   struct sysfs_buffer *buffer)
 {
         struct sysfs_open_dirent *od = sd->s_attr.open;
+        unsigned long flags;
 
-        spin_lock(&sysfs_open_dirent_lock);
+        spin_lock_irqsave(&sysfs_open_dirent_lock, flags);
 
         list_del(&buffer->list);
         if (atomic_dec_and_test(&od->refcnt))
@@ -324,7 +325,7 @@ static void sysfs_put_open_dirent(struct sysfs_dirent *sd,
         else
                 od = NULL;
 
-        spin_unlock(&sysfs_open_dirent_lock);
+        spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags);
 
         kfree(od);
 }
@@ -456,8 +457,9 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
 void sysfs_notify_dirent(struct sysfs_dirent *sd)
 {
         struct sysfs_open_dirent *od;
+        unsigned long flags;
 
-        spin_lock(&sysfs_open_dirent_lock);
+        spin_lock_irqsave(&sysfs_open_dirent_lock, flags);
 
         od = sd->s_attr.open;
         if (od) {
@@ -465,7 +467,7 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)
                 wake_up_interruptible(&od->poll);
         }
 
-        spin_unlock(&sysfs_open_dirent_lock);
+        spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags);
 }
 EXPORT_SYMBOL_GPL(sysfs_notify_dirent);
 
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index 381854461b28..c2e30eea74dc 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -186,19 +186,37 @@ xfs_destroy_ioend(
 }
 
 /*
+ * If the end of the current ioend is beyond the current EOF,
+ * return the new EOF value, otherwise zero.
+ */
+STATIC xfs_fsize_t
+xfs_ioend_new_eof(
+        xfs_ioend_t             *ioend)
+{
+        xfs_inode_t             *ip = XFS_I(ioend->io_inode);
+        xfs_fsize_t             isize;
+        xfs_fsize_t             bsize;
+
+        bsize = ioend->io_offset + ioend->io_size;
+        isize = MAX(ip->i_size, ip->i_new_size);
+        isize = MIN(isize, bsize);
+        return isize > ip->i_d.di_size ? isize : 0;
+}
+
+/*
  * Update on-disk file size now that data has been written to disk.
  * The current in-memory file size is i_size.  If a write is beyond
  * eof i_new_size will be the intended file size until i_size is
  * updated.  If this write does not extend all the way to the valid
  * file size then restrict this update to the end of the write.
  */
+
 STATIC void
 xfs_setfilesize(
         xfs_ioend_t             *ioend)
 {
         xfs_inode_t             *ip = XFS_I(ioend->io_inode);
         xfs_fsize_t             isize;
-        xfs_fsize_t             bsize;
 
         ASSERT((ip->i_d.di_mode & S_IFMT) == S_IFREG);
         ASSERT(ioend->io_type != IOMAP_READ);
@@ -206,16 +224,10 @@ xfs_setfilesize(
         if (unlikely(ioend->io_error))
                 return;
 
-        bsize = ioend->io_offset + ioend->io_size;
-
         xfs_ilock(ip, XFS_ILOCK_EXCL);
-
-        isize = MAX(ip->i_size, ip->i_new_size);
-        isize = MIN(isize, bsize);
-
-        if (ip->i_d.di_size < isize) {
+        isize = xfs_ioend_new_eof(ioend);
+        if (isize) {
                 ip->i_d.di_size = isize;
-                ip->i_update_core = 1;
                 xfs_mark_inode_dirty_sync(ip);
         }
 
@@ -404,10 +416,16 @@ xfs_submit_ioend_bio(
         struct bio      *bio)
 {
         atomic_inc(&ioend->io_remaining);
-
         bio->bi_private = ioend;
         bio->bi_end_io = xfs_end_bio;
 
+        /*
+         * If the I/O is beyond EOF we mark the inode dirty immediately
+         * but don't update the inode size until I/O completion.
+         */
+        if (xfs_ioend_new_eof(ioend))
+                xfs_mark_inode_dirty_sync(XFS_I(ioend->io_inode));
+
         submit_bio(WRITE, bio);
         ASSERT(!bio_flagged(bio, BIO_EOPNOTSUPP));
         bio_put(bio);
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index 629370974e57..eff61e2732af 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -176,14 +176,7 @@ xfs_file_fsync(
         struct dentry           *dentry,
         int                     datasync)
 {
-        struct inode            *inode = dentry->d_inode;
-        struct xfs_inode        *ip = XFS_I(inode);
-        int                     error;
-
-        /* capture size updates in I/O completion before writing the inode. */
-        error = filemap_fdatawait(inode->i_mapping);
-        if (error)
-                return error;
+        struct xfs_inode        *ip = XFS_I(dentry->d_inode);
 
         xfs_iflags_clear(ip, XFS_ITRUNCATED);
         return -xfs_fsync(ip);
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index da0159d99f82..cd42ef78f6b5 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -57,19 +57,22 @@
 #include <linux/fiemap.h>
 
 /*
- * Bring the atime in the XFS inode uptodate.
- * Used before logging the inode to disk or when the Linux inode goes away.
+ * Bring the timestamps in the XFS inode uptodate.
+ *
+ * Used before writing the inode to disk.
  */
 void
-xfs_synchronize_atime(
+xfs_synchronize_times(
         xfs_inode_t     *ip)
 {
         struct inode    *inode = VFS_I(ip);
 
-        if (!(inode->i_state & I_CLEAR)) {
-                ip->i_d.di_atime.t_sec = (__int32_t)inode->i_atime.tv_sec;
-                ip->i_d.di_atime.t_nsec = (__int32_t)inode->i_atime.tv_nsec;
-        }
+        ip->i_d.di_atime.t_sec = (__int32_t)inode->i_atime.tv_sec;
+        ip->i_d.di_atime.t_nsec = (__int32_t)inode->i_atime.tv_nsec;
+        ip->i_d.di_ctime.t_sec = (__int32_t)inode->i_ctime.tv_sec;
+        ip->i_d.di_ctime.t_nsec = (__int32_t)inode->i_ctime.tv_nsec;
+        ip->i_d.di_mtime.t_sec = (__int32_t)inode->i_mtime.tv_sec;
+        ip->i_d.di_mtime.t_nsec = (__int32_t)inode->i_mtime.tv_nsec;
 }
 
 /*
@@ -106,32 +109,20 @@ xfs_ichgtime(
         if ((flags & XFS_ICHGTIME_MOD) &&
             !timespec_equal(&inode->i_mtime, &tv)) {
                 inode->i_mtime = tv;
-                ip->i_d.di_mtime.t_sec = (__int32_t)tv.tv_sec;
-                ip->i_d.di_mtime.t_nsec = (__int32_t)tv.tv_nsec;
                 sync_it = 1;
         }
         if ((flags & XFS_ICHGTIME_CHG) &&
             !timespec_equal(&inode->i_ctime, &tv)) {
                 inode->i_ctime = tv;
-                ip->i_d.di_ctime.t_sec = (__int32_t)tv.tv_sec;
-                ip->i_d.di_ctime.t_nsec = (__int32_t)tv.tv_nsec;
                 sync_it = 1;
         }
 
         /*
-         * We update the i_update_core field _after_ changing
-         * the timestamps in order to coordinate properly with
-         * xfs_iflush() so that we don't lose timestamp updates.
-         * This keeps us from having to hold the inode lock
-         * while doing this.  We use the SYNCHRONIZE macro to
-         * ensure that the compiler does not reorder the update
-         * of i_update_core above the timestamp updates above.
+         * Update complete - now make sure everyone knows that the inode
+         * is dirty.
          */
-        if (sync_it) {
-                SYNCHRONIZE();
-                ip->i_update_core = 1;
+        if (sync_it)
                 xfs_mark_inode_dirty_sync(ip);
-        }
 }
 
 /*
@@ -506,10 +497,8 @@ xfs_vn_getattr(
         stat->gid = ip->i_d.di_gid;
         stat->ino = ip->i_ino;
         stat->atime = inode->i_atime;
-        stat->mtime.tv_sec = ip->i_d.di_mtime.t_sec;
-        stat->mtime.tv_nsec = ip->i_d.di_mtime.t_nsec;
-        stat->ctime.tv_sec = ip->i_d.di_ctime.t_sec;
-        stat->ctime.tv_nsec = ip->i_d.di_ctime.t_nsec;
+        stat->mtime = inode->i_mtime;
+        stat->ctime = inode->i_ctime;
         stat->blocks =
                 XFS_FSB_TO_BB(mp, ip->i_d.di_nblocks + ip->i_delayed_blks);
 
diff --git a/fs/xfs/linux-2.6/xfs_lrw.c b/fs/xfs/linux-2.6/xfs_lrw.c
index 49e4a6aea73c..072050f8d346 100644
--- a/fs/xfs/linux-2.6/xfs_lrw.c
+++ b/fs/xfs/linux-2.6/xfs_lrw.c
@@ -667,7 +667,7 @@ start:
                 xip->i_new_size = new_size;
 
         if (likely(!(ioflags & IO_INVIS)))
-                xfs_ichgtime(xip, XFS_ICHGTIME_MOD | XFS_ICHGTIME_CHG);
+                file_update_time(file);
 
         /*
          * If the offset is beyond the size of the file, we have a couple
diff --git a/fs/xfs/linux-2.6/xfs_quotaops.c b/fs/xfs/linux-2.6/xfs_quotaops.c
index 9e41f91aa269..3d4a0c84d634 100644
--- a/fs/xfs/linux-2.6/xfs_quotaops.c
+++ b/fs/xfs/linux-2.6/xfs_quotaops.c
@@ -80,7 +80,7 @@ xfs_fs_set_xstate(
 
         if (sb->s_flags & MS_RDONLY)
                 return -EROFS;
-        if (!XFS_IS_QUOTA_RUNNING(mp))
+        if (op != Q_XQUOTARM && !XFS_IS_QUOTA_RUNNING(mp))
                 return -ENOSYS;
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index bdd41c8c342f..18a4b8e11df2 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -977,6 +977,28 @@ xfs_fs_inode_init_once(
 }
 
 /*
+ * Dirty the XFS inode when mark_inode_dirty_sync() is called so that
+ * we catch unlogged VFS level updates to the inode. Care must be taken
+ * here - the transaction code calls mark_inode_dirty_sync() to mark the
+ * VFS inode dirty in a transaction and clears the i_update_core field;
+ * it must clear the field after calling mark_inode_dirty_sync() to
+ * correctly indicate that the dirty state has been propagated into the
+ * inode log item.
+ *
+ * We need the barrier() to maintain correct ordering between unlogged
+ * updates and the transaction commit code that clears the i_update_core
+ * field. This requires all updates to be completed before marking the
+ * inode dirty.
+ */
+STATIC void
+xfs_fs_dirty_inode(
+        struct inode    *inode)
+{
+        barrier();
+        XFS_I(inode)->i_update_core = 1;
+}
+
+/*
  * Attempt to flush the inode, this will actually fail
  * if the inode is pinned, but we dirty the inode again
  * at the point when it is unpinned after a log write,
@@ -1126,7 +1148,7 @@ xfs_fs_put_super(
 }
 
 STATIC int
-xfs_fs_sync_super(
+xfs_fs_sync_fs(
         struct super_block      *sb,
         int                     wait)
 {
@@ -1134,23 +1156,23 @@ xfs_fs_sync_super(
         int                     error;
 
         /*
-         * Treat a sync operation like a freeze.  This is to work
-         * around a race in sync_inodes() which works in two phases
-         * - an asynchronous flush, which can write out an inode
-         * without waiting for file size updates to complete, and a
-         * synchronous flush, which wont do anything because the
-         * async flush removed the inode's dirty flag.  Also
-         * sync_inodes() will not see any files that just have
-         * outstanding transactions to be flushed because we don't
-         * dirty the Linux inode until after the transaction I/O
-         * completes.
+         * Not much we can do for the first async pass.  Writing out the
+         * superblock would be counter-productive as we are going to redirty
+         * when writing out other data and metadata (and writing out a single
+         * block is quite fast anyway).
+         *
+         * Try to asynchronously kick off quota syncing at least.
          */
-        if (wait || unlikely(sb->s_frozen == SB_FREEZE_WRITE))
-                error = xfs_quiesce_data(mp);
-        else
-                error = xfs_sync_fsdata(mp, 0);
+        if (!wait) {
+                xfs_qm_sync(mp, SYNC_TRYLOCK);
+                return 0;
+        }
+
+        error = xfs_quiesce_data(mp);
+        if (error)
+                return -error;
 
-        if (unlikely(laptop_mode)) {
+        if (laptop_mode) {
                 int     prev_sync_seq = mp->m_sync_seq;
 
                 /*
@@ -1169,7 +1191,7 @@ xfs_fs_sync_super(
                                 mp->m_sync_seq != prev_sync_seq);
         }
 
-        return -error;
+        return 0;
 }
 
 STATIC int
@@ -1539,10 +1561,11 @@ xfs_fs_get_sb(
 static const struct super_operations xfs_super_operations = {
         .alloc_inode            = xfs_fs_alloc_inode,
         .destroy_inode          = xfs_fs_destroy_inode,
+        .dirty_inode            = xfs_fs_dirty_inode,
         .write_inode            = xfs_fs_write_inode,
         .clear_inode            = xfs_fs_clear_inode,
         .put_super              = xfs_fs_put_super,
-        .sync_fs                = xfs_fs_sync_super,
+        .sync_fs                = xfs_fs_sync_fs,
         .freeze_fs              = xfs_fs_freeze,
         .statfs                 = xfs_fs_statfs,
         .remount_fs             = xfs_fs_remount,
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 320be6aea492..961df0a22c78 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -309,11 +309,15 @@ xfs_sync_attr(
 STATIC int
 xfs_commit_dummy_trans(
         struct xfs_mount        *mp,
-        uint                    log_flags)
+        uint                    flags)
 {
         struct xfs_inode        *ip = mp->m_rootip;
         struct xfs_trans        *tp;
         int                     error;
+        int                     log_flags = XFS_LOG_FORCE;
+
+        if (flags & SYNC_WAIT)
+                log_flags |= XFS_LOG_SYNC;
 
         /*
          * Put a dummy transaction in the log to tell recovery
@@ -331,13 +335,12 @@ xfs_commit_dummy_trans(
         xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
         xfs_trans_ihold(tp, ip);
         xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-        /* XXX(hch): ignoring the error here.. */
         error = xfs_trans_commit(tp, 0);
-
         xfs_iunlock(ip, XFS_ILOCK_EXCL);
 
+        /* the log force ensures this transaction is pushed to disk */
         xfs_log_force(mp, 0, log_flags);
-        return 0;
+        return error;
 }
 
 int
@@ -385,7 +388,20 @@ xfs_sync_fsdata(
         else
                 XFS_BUF_ASYNC(bp);
 
-        return xfs_bwrite(mp, bp);
+        error = xfs_bwrite(mp, bp);
+        if (error)
+                return error;
+
+        /*
+         * If this is a data integrity sync make sure all pending buffers
+         * are flushed out for the log coverage check below.
+         */
+        if (flags & SYNC_WAIT)
+                xfs_flush_buftarg(mp->m_ddev_targp, 1);
+
+        if (xfs_log_need_covered(mp))
+                error = xfs_commit_dummy_trans(mp, flags);
+        return error;
 
  out_brelse:
         xfs_buf_relse(bp);
@@ -419,14 +435,16 @@ xfs_quiesce_data(
         /* push non-blocking */
         xfs_sync_data(mp, 0);
         xfs_qm_sync(mp, SYNC_TRYLOCK);
-        xfs_filestream_flush(mp);
 
-        /* push and block */
+        /* push and block till complete */
         xfs_sync_data(mp, SYNC_WAIT);
         xfs_qm_sync(mp, SYNC_WAIT);
 
+        /* drop inode references pinned by filestreams */
+        xfs_filestream_flush(mp);
+
         /* write superblock and hoover up shutdown errors */
-        error = xfs_sync_fsdata(mp, 0);
+        error = xfs_sync_fsdata(mp, SYNC_WAIT);
 
         /* flush data-only devices */
         if (mp->m_rtdev_targp)
@@ -570,8 +588,6 @@ xfs_sync_worker(
                 /* dgc: errors ignored here */
                 error = xfs_qm_sync(mp, SYNC_TRYLOCK);
                 error = xfs_sync_fsdata(mp, SYNC_TRYLOCK);
-                if (xfs_log_need_covered(mp))
-                        error = xfs_commit_dummy_trans(mp, XFS_LOG_FORCE);
         }
         mp->m_sync_seq++;
         wake_up(&mp->m_wait_single_sync_task);
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 4e4276b956e8..5d1a3b98a6e6 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -876,7 +876,6 @@ xfs_dqrele_inode(
                 ip->i_gdquot = NULL;
         }
         xfs_iput(ip, XFS_ILOCK_EXCL);
-        IRELE(ip);
 
         return 0;
 }
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 7465f9ee125f..ab89a7e94a0f 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -206,10 +206,10 @@ xfs_swap_extents(
          * process that the file was not changed out from
          * under it.
          */
-        if ((sbp->bs_ctime.tv_sec != ip->i_d.di_ctime.t_sec) ||
-            (sbp->bs_ctime.tv_nsec != ip->i_d.di_ctime.t_nsec) ||
-            (sbp->bs_mtime.tv_sec != ip->i_d.di_mtime.t_sec) ||
-            (sbp->bs_mtime.tv_nsec != ip->i_d.di_mtime.t_nsec)) {
+        if ((sbp->bs_ctime.tv_sec != VFS_I(ip)->i_ctime.tv_sec) ||
+            (sbp->bs_ctime.tv_nsec != VFS_I(ip)->i_ctime.tv_nsec) ||
+            (sbp->bs_mtime.tv_sec != VFS_I(ip)->i_mtime.tv_sec) ||
+            (sbp->bs_mtime.tv_nsec != VFS_I(ip)->i_mtime.tv_nsec)) {
                 error = XFS_ERROR(EBUSY);
                 goto out_unlock;
         }
diff --git a/fs/xfs/xfs_dir2_leaf.c b/fs/xfs/xfs_dir2_leaf.c
index fa913e459442..41ad537c49e9 100644
--- a/fs/xfs/xfs_dir2_leaf.c
+++ b/fs/xfs/xfs_dir2_leaf.c
@@ -854,6 +854,7 @@ xfs_dir2_leaf_getdents(
                          */
                         ra_want = howmany(bufsize + mp->m_dirblksize,
                                           mp->m_sb.sb_blocksize) - 1;
+                        ASSERT(ra_want >= 0);
 
                         /*
                          * If we don't have as many as we want, and we haven't
@@ -1088,7 +1089,8 @@ xfs_dir2_leaf_getdents(
                  */
                 ptr += length;
                 curoff += length;
-                bufsize -= length;
+                /* bufsize may have just been a guess; don't go negative */
+                bufsize = bufsize > length ? bufsize - length : 0;
         }
 
         /*
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index ab64f3efb43b..0785797db828 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -880,6 +880,7 @@ nextag:
                                  * Not in range - save last search
                                  * location and allocate a new inode
                                  */
+                                xfs_btree_del_cursor(tcur, XFS_BTREE_NOERROR);
                                 pag->pagl_leftrec = trec.ir_startino;
                                 pag->pagl_rightrec = rec.ir_startino;
                                 pag->pagl_pagino = pagino;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index c1dc7ef5a1d8..b92a4fa2a0a1 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -3068,9 +3068,9 @@ xfs_iflush_int(
         SYNCHRONIZE();
 
         /*
-         * Make sure to get the latest atime from the Linux inode.
+         * Make sure to get the latest timestamps from the Linux inode.
          */
-        xfs_synchronize_atime(ip);
+        xfs_synchronize_times(ip);
 
         if (XFS_TEST_ERROR(be16_to_cpu(dip->di_magic) != XFS_DINODE_MAGIC,
                                mp, XFS_ERRTAG_IFLUSH_1, XFS_RANDOM_IFLUSH_1)) {
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 0b38b9a869ec..41555de1d1db 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -504,7 +504,7 @@ void		xfs_ichgtime(xfs_inode_t *, int);
 void            xfs_lock_inodes(xfs_inode_t **, int, uint);
 void            xfs_lock_two_inodes(xfs_inode_t *, xfs_inode_t *, uint);
 
-void            xfs_synchronize_atime(xfs_inode_t *);
+void            xfs_synchronize_times(xfs_inode_t *);
 void            xfs_mark_inode_dirty_sync(xfs_inode_t *);
 
 #if defined(XFS_INODE_TRACE)
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 47d5b663c37e..9794b876d6ff 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -232,6 +232,15 @@ xfs_inode_item_format(
         nvecs        = 1;
 
         /*
+         * Make sure the linux inode is dirty. We do this before
+         * clearing i_update_core as the VFS will call back into
+         * XFS here and set i_update_core, so we need to dirty the
+         * inode first so that the ordering of i_update_core and
+         * unlogged modifications still works as described below.
+         */
+        xfs_mark_inode_dirty_sync(ip);
+
+        /*
          * Clear i_update_core if the timestamps (or any other
          * non-transactional modification) need flushing/logging
          * and we're about to log them with the rest of the core.
@@ -263,14 +272,9 @@ xfs_inode_item_format(
         }
 
         /*
-         * Make sure to get the latest atime from the Linux inode.
+         * Make sure to get the latest timestamps from the Linux inode.
          */
-        xfs_synchronize_atime(ip);
-
-        /*
-         * make sure the linux inode is dirty
-         */
-        xfs_mark_inode_dirty_sync(ip);
+        xfs_synchronize_times(ip);
 
         vecp->i_addr = (xfs_caddr_t)&ip->i_d;
         vecp->i_len  = sizeof(struct xfs_icdinode);
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index b68f9107e26c..62efab2f3839 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -59,6 +59,7 @@ xfs_bulkstat_one_iget(
 {
         xfs_icdinode_t  *dic;   /* dinode core info pointer */
         xfs_inode_t     *ip;            /* incore inode pointer */
+        struct inode    *inode;
         int             error;
 
         error = xfs_iget(mp, NULL, ino,
@@ -72,6 +73,7 @@ xfs_bulkstat_one_iget(
         ASSERT(ip->i_imap.im_blkno != 0);
 
         dic = &ip->i_d;
+        inode = VFS_I(ip);
 
         /* xfs_iget returns the following without needing
          * further change.
@@ -83,16 +85,19 @@ xfs_bulkstat_one_iget(
         buf->bs_uid = dic->di_uid;
         buf->bs_gid = dic->di_gid;
         buf->bs_size = dic->di_size;
+
         /*
-         * We are reading the atime from the Linux inode because the
-         * dinode might not be uptodate.
+         * We need to read the timestamps from the Linux inode because
+         * the VFS keeps writing directly into the inode structure instead
+         * of telling us about the updates.
          */
-        buf->bs_atime.tv_sec = VFS_I(ip)->i_atime.tv_sec;
-        buf->bs_atime.tv_nsec = VFS_I(ip)->i_atime.tv_nsec;
-        buf->bs_mtime.tv_sec = dic->di_mtime.t_sec;
-        buf->bs_mtime.tv_nsec = dic->di_mtime.t_nsec;
-        buf->bs_ctime.tv_sec = dic->di_ctime.t_sec;
-        buf->bs_ctime.tv_nsec = dic->di_ctime.t_nsec;
+        buf->bs_atime.tv_sec = inode->i_atime.tv_sec;
+        buf->bs_atime.tv_nsec = inode->i_atime.tv_nsec;
+        buf->bs_mtime.tv_sec = inode->i_mtime.tv_sec;
+        buf->bs_mtime.tv_nsec = inode->i_mtime.tv_nsec;
+        buf->bs_ctime.tv_sec = inode->i_ctime.tv_sec;
+        buf->bs_ctime.tv_nsec = inode->i_ctime.tv_nsec;
+
         buf->bs_xflags = xfs_ip2xflags(ip);
         buf->bs_extsize = dic->di_extsize << mp->m_sb.sb_blocklog;
         buf->bs_extents = dic->di_nextents;
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 1099395d7d6c..fb17f8226b09 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1980,7 +1980,7 @@ xlog_recover_do_reg_buffer(
                                         "XFS: NULL dquot in %s.", __func__);
                                 goto next;
                         }
-                        if (item->ri_buf[i].i_len < sizeof(xfs_dqblk_t)) {
+                        if (item->ri_buf[i].i_len < sizeof(xfs_disk_dquot_t)) {
                                 cmn_err(CE_ALERT,
                                         "XFS: dquot too small (%d) in %s.",
                                         item->ri_buf[i].i_len, __func__);
@@ -2635,7 +2635,7 @@ xlog_recover_do_dquot_trans(
                         "XFS: NULL dquot in %s.", __func__);
                 return XFS_ERROR(EIO);
         }
-        if (item->ri_buf[1].i_len < sizeof(xfs_dqblk_t)) {
+        if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) {
                 cmn_err(CE_ALERT,
                         "XFS: dquot too small (%d) in %s.",
                         item->ri_buf[1].i_len, __func__);
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index f31271c30de9..2ffc570679be 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -467,6 +467,7 @@ xfs_trans_ail_update(
 {
         xfs_log_item_t          *dlip = NULL;
         xfs_log_item_t          *mlip;  /* ptr to minimum lip */
+        xfs_lsn_t               tail_lsn;
 
         mlip = xfs_ail_min(ailp);
 
@@ -483,8 +484,16 @@ xfs_trans_ail_update(
 
         if (mlip == dlip) {
                 mlip = xfs_ail_min(ailp);
+                /*
+                 * It is not safe to access mlip after the AIL lock is
+                 * dropped, so we must get a copy of li_lsn before we do
+                 * so.  This is especially important on 32-bit platforms
+                 * where accessing and updating 64-bit values like li_lsn
+                 * is not atomic.
+                 */
+                tail_lsn = mlip->li_lsn;
                 spin_unlock(&ailp->xa_lock);
-                xfs_log_move_tail(ailp->xa_mount, mlip->li_lsn);
+                xfs_log_move_tail(ailp->xa_mount, tail_lsn);
         } else {
                 spin_unlock(&ailp->xa_lock);
         }
@@ -514,6 +523,7 @@ xfs_trans_ail_delete(
 {
         xfs_log_item_t          *dlip;
         xfs_log_item_t          *mlip;
+        xfs_lsn_t               tail_lsn;
 
         if (lip->li_flags & XFS_LI_IN_AIL) {
                 mlip = xfs_ail_min(ailp);
@@ -527,9 +537,16 @@ xfs_trans_ail_delete(
 
                 if (mlip == dlip) {
                         mlip = xfs_ail_min(ailp);
+                        /*
+                         * It is not safe to access mlip after the AIL lock
+                         * is dropped, so we must get a copy of li_lsn
+                         * before we do so.  This is especially important
+                         * on 32-bit platforms where accessing and updating
+                         * 64-bit values like li_lsn is not atomic.
+                         */
+                        tail_lsn = mlip ? mlip->li_lsn : 0;
                         spin_unlock(&ailp->xa_lock);
-                        xfs_log_move_tail(ailp->xa_mount,
-                                                (mlip ? mlip->li_lsn : 0));
+                        xfs_log_move_tail(ailp->xa_mount, tail_lsn);
                 } else {
                         spin_unlock(&ailp->xa_lock);
                 }
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index a434f287962d..b572f7e840e0 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -2476,12 +2476,6 @@ xfs_reclaim(
         ASSERT(XFS_FORCED_SHUTDOWN(ip->i_mount) || ip->i_delayed_blks == 0);
 
         /*
-         * Make sure the atime in the XFS inode is correct before freeing the
-         * Linux inode.
-         */
-        xfs_synchronize_atime(ip);
-
-        /*
          * If we have nothing to flush with this inode then complete the
          * teardown now, otherwise break the link between the xfs inode and the
          * linux inode and clean up the xfs inode later. This avoids flushing