Merge branch 'master' into next

162 files changed, 4679 insertions, 1885 deletions

diff --git a/fs/9p/cache.c b/fs/9p/cache.c
index 51c94e26a346..e777961939f3 100644
--- a/fs/9p/cache.c
+++ b/fs/9p/cache.c
@@ -343,18 +343,7 @@ int __v9fs_fscache_release_page(struct page *page, gfp_t gfp)
 
         BUG_ON(!vcookie->fscache);
 
-        if (PageFsCache(page)) {
-                if (fscache_check_page_write(vcookie->fscache, page)) {
-                        if (!(gfp & __GFP_WAIT))
-                                return 0;
-                        fscache_wait_on_page_write(vcookie->fscache, page);
-                }
-
-                fscache_uncache_page(vcookie->fscache, page);
-                ClearPageFsCache(page);
-        }
-
-        return 1;
+        return fscache_maybe_release_page(vcookie->fscache, page, gfp);
 }
 
 void __v9fs_fscache_invalidate_page(struct page *page)
@@ -368,7 +357,6 @@ void __v9fs_fscache_invalidate_page(struct page *page)
                 fscache_wait_on_page_write(vcookie->fscache, page);
                 BUG_ON(!PageLocked(page));
                 fscache_uncache_page(vcookie->fscache, page);
-                ClearPageFsCache(page);
         }
 }
 
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index 873cd31baa47..15cce53bf61e 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -40,6 +40,24 @@
 #include "fid.h"
 
 /**
+ * struct p9_rdir - readdir accounting
+ * @mutex: mutex protecting readdir
+ * @head: start offset of current dirread buffer
+ * @tail: end offset of current dirread buffer
+ * @buf: dirread buffer
+ *
+ * private structure for keeping track of readdir
+ * allocated on demand
+ */
+
+struct p9_rdir {
+        struct mutex mutex;
+        int head;
+        int tail;
+        uint8_t *buf;
+};
+
+/**
  * dt_type - return file type
  * @mistat: mistat structure
  *
@@ -70,56 +88,79 @@ static int v9fs_dir_readdir(struct file *filp, void *dirent, filldir_t filldir)
 {
         int over;
         struct p9_wstat st;
-        int err;
+        int err = 0;
         struct p9_fid *fid;
         int buflen;
-        char *statbuf;
-        int n, i = 0;
+        int reclen = 0;
+        struct p9_rdir *rdir;
 
         P9_DPRINTK(P9_DEBUG_VFS, "name %s\n", filp->f_path.dentry->d_name.name);
         fid = filp->private_data;
 
         buflen = fid->clnt->msize - P9_IOHDRSZ;
-        statbuf = kmalloc(buflen, GFP_KERNEL);
-        if (!statbuf)
-                return -ENOMEM;
-
-        while (1) {
-                err = v9fs_file_readn(filp, statbuf, NULL, buflen,
-                                                                fid->rdir_fpos);
-                if (err <= 0)
-                        break;
-
-                n = err;
-                while (i < n) {
-                        err = p9stat_read(statbuf + i, buflen-i, &st,
-                                                        fid->clnt->dotu);
+
+        /* allocate rdir on demand */
+        if (!fid->rdir) {
+                rdir = kmalloc(sizeof(struct p9_rdir) + buflen, GFP_KERNEL);
+
+                if (rdir == NULL) {
+                        err = -ENOMEM;
+                        goto exit;
+                }
+                spin_lock(&filp->f_dentry->d_lock);
+                if (!fid->rdir) {
+                        rdir->buf = (uint8_t *)rdir + sizeof(struct p9_rdir);
+                        mutex_init(&rdir->mutex);
+                        rdir->head = rdir->tail = 0;
+                        fid->rdir = (void *) rdir;
+                        rdir = NULL;
+                }
+                spin_unlock(&filp->f_dentry->d_lock);
+                kfree(rdir);
+        }
+        rdir = (struct p9_rdir *) fid->rdir;
+
+        err = mutex_lock_interruptible(&rdir->mutex);
+        while (err == 0) {
+                if (rdir->tail == rdir->head) {
+                        err = v9fs_file_readn(filp, rdir->buf, NULL,
+                                                        buflen, filp->f_pos);
+                        if (err <= 0)
+                                goto unlock_and_exit;
+
+                        rdir->head = 0;
+                        rdir->tail = err;
+                }
+
+                while (rdir->head < rdir->tail) {
+                        err = p9stat_read(rdir->buf + rdir->head,
+                                                buflen - rdir->head, &st,
+                                                fid->clnt->dotu);
                         if (err) {
                                 P9_DPRINTK(P9_DEBUG_VFS, "returned %d\n", err);
                                 err = -EIO;
                                 p9stat_free(&st);
-                                goto free_and_exit;
+                                goto unlock_and_exit;
                         }
-
-                        i += st.size+2;
-                        fid->rdir_fpos += st.size+2;
+                        reclen = st.size+2;
 
                         over = filldir(dirent, st.name, strlen(st.name),
                             filp->f_pos, v9fs_qid2ino(&st.qid), dt_type(&st));
 
-                        filp->f_pos += st.size+2;
-
                         p9stat_free(&st);
 
                         if (over) {
                                 err = 0;
-                                goto free_and_exit;
+                                goto unlock_and_exit;
                         }
+                        rdir->head += reclen;
+                        filp->f_pos += reclen;
                 }
         }
 
-free_and_exit:
-        kfree(statbuf);
+unlock_and_exit:
+        mutex_unlock(&rdir->mutex);
+exit:
         return err;
 }
 
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 5947628aefef..18f74ec4dce9 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -994,8 +994,7 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
         P9_DPRINTK(P9_DEBUG_VFS,
                 "%s -> %s (%s)\n", dentry->d_name.name, st->extension, buffer);
 
-        retval = buflen;
-
+        retval = strnlen(buffer, buflen);
 done:
         kfree(st);
         return retval;
@@ -1062,7 +1061,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
                         __putname(link);
                         link = ERR_PTR(len);
                 } else
-                        link[len] = 0;
+                        link[min(len, PATH_MAX-1)] = 0;
         }
         nd_set_link(nd, link);
 
diff --git a/fs/Kconfig b/fs/Kconfig
index d4bf8caad8d0..64d44efad7a5 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -135,8 +135,8 @@ config TMPFS_POSIX_ACL
 
 config HUGETLBFS
         bool "HugeTLB file system support"
-        depends on X86 || IA64 || PPC64 || SPARC64 || (SUPERH && MMU) || \
-                   (S390 && 64BIT) || SYS_SUPPORTS_HUGETLBFS || BROKEN
+        depends on X86 || IA64 || SPARC64 || (S390 && 64BIT) || \
+                   SYS_SUPPORTS_HUGETLBFS || BROKEN
         help
           hugetlbfs is a filesystem backing for HugeTLB pages, based on
           ramfs. For architectures that support it, say Y here and read
diff --git a/fs/afs/cache.h b/fs/afs/cache.h
deleted file mode 100644
index 5c4f6b499e90..000000000000
--- a/fs/afs/cache.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/* AFS local cache management interface
- *
- * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-#include <linux/fscache.h>
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 681c2a7b013f..39b301662f22 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -315,7 +315,6 @@ static void afs_invalidatepage(struct page *page, unsigned long offset)
                         struct afs_vnode *vnode = AFS_FS_I(page->mapping->host);
                         fscache_wait_on_page_write(vnode->cache, page);
                         fscache_uncache_page(vnode->cache, page);
-                        ClearPageFsCache(page);
                 }
 #endif
 
@@ -349,17 +348,9 @@ static int afs_releasepage(struct page *page, gfp_t gfp_flags)
         /* deny if page is being written to the cache and the caller hasn't
          * elected to wait */
 #ifdef CONFIG_AFS_FSCACHE
-        if (PageFsCache(page)) {
-                if (fscache_check_page_write(vnode->cache, page)) {
-                        if (!(gfp_flags & __GFP_WAIT)) {
-                                _leave(" = F [cache busy]");
-                                return 0;
-                        }
-                        fscache_wait_on_page_write(vnode->cache, page);
-                }
-
-                fscache_uncache_page(vnode->cache, page);
-                ClearPageFsCache(page);
+        if (!fscache_maybe_release_page(vnode->cache, page, gfp_flags)) {
+                _leave(" = F [cache busy]");
+                return 0;
         }
 #endif
 
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 106be66dafd2..6ece2a13bf71 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -18,10 +18,10 @@
 #include <linux/key.h>
 #include <linux/workqueue.h>
 #include <linux/sched.h>
+#include <linux/fscache.h>
 
 #include "afs.h"
 #include "afs_vl.h"
-#include "cache.h"
 
 #define AFS_CELL_MAX_ADDRS 15
 
diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c
index d11c51fc2a3f..2ca7a7cafdbf 100644
--- a/fs/anon_inodes.c
+++ b/fs/anon_inodes.c
@@ -8,8 +8,10 @@
  *
  */
 
+#include <linux/cred.h>
 #include <linux/file.h>
 #include <linux/poll.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/fs.h>
diff --git a/fs/bio.c b/fs/bio.c
index 76738005c8e8..12da5db8682c 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -249,6 +249,7 @@ void bio_free(struct bio *bio, struct bio_set *bs)
 
         mempool_free(p, bs->bio_pool);
 }
+EXPORT_SYMBOL(bio_free);
 
 void bio_init(struct bio *bio)
 {
@@ -257,6 +258,7 @@ void bio_init(struct bio *bio)
         bio->bi_comp_cpu = -1;
         atomic_set(&bio->bi_cnt, 1);
 }
+EXPORT_SYMBOL(bio_init);
 
 /**
  * bio_alloc_bioset - allocate a bio for I/O
@@ -311,6 +313,7 @@ err_free:
         mempool_free(p, bs->bio_pool);
         return NULL;
 }
+EXPORT_SYMBOL(bio_alloc_bioset);
 
 static void bio_fs_destructor(struct bio *bio)
 {
@@ -322,8 +325,16 @@ static void bio_fs_destructor(struct bio *bio)
  *      @gfp_mask: allocation mask to use
  *      @nr_iovecs: number of iovecs
  *
- *      Allocate a new bio with @nr_iovecs bvecs.  If @gfp_mask
- *      contains __GFP_WAIT, the allocation is guaranteed to succeed.
+ *      bio_alloc will allocate a bio and associated bio_vec array that can hold
+ *      at least @nr_iovecs entries. Allocations will be done from the
+ *      fs_bio_set. Also see @bio_alloc_bioset and @bio_kmalloc.
+ *
+ *      If %__GFP_WAIT is set, then bio_alloc will always be able to allocate
+ *      a bio. This is due to the mempool guarantees. To make this work, callers
+ *      must never allocate more than 1 bio at a time from this pool. Callers
+ *      that need to allocate more than 1 bio must always submit the previously
+ *      allocated bio for IO before attempting to allocate a new one. Failure to
+ *      do so can cause livelocks under memory pressure.
  *
  *      RETURNS:
  *      Pointer to new bio on success, NULL on failure.
@@ -337,6 +348,7 @@ struct bio *bio_alloc(gfp_t gfp_mask, int nr_iovecs)
 
         return bio;
 }
+EXPORT_SYMBOL(bio_alloc);
 
 static void bio_kmalloc_destructor(struct bio *bio)
 {
@@ -346,21 +358,13 @@ static void bio_kmalloc_destructor(struct bio *bio)
 }
 
 /**
- * bio_alloc - allocate a bio for I/O
+ * bio_kmalloc - allocate a bio for I/O using kmalloc()
  * @gfp_mask:   the GFP_ mask given to the slab allocator
  * @nr_iovecs:  number of iovecs to pre-allocate
  *
  * Description:
- *   bio_alloc will allocate a bio and associated bio_vec array that can hold
- *   at least @nr_iovecs entries. Allocations will be done from the
- *   fs_bio_set. Also see @bio_alloc_bioset.
- *
- *   If %__GFP_WAIT is set, then bio_alloc will always be able to allocate
- *   a bio. This is due to the mempool guarantees. To make this work, callers
- *   must never allocate more than 1 bio at a time from this pool. Callers
- *   that need to allocate more than 1 bio must always submit the previously
- *   allocated bio for IO before attempting to allocate a new one. Failure to
- *   do so can cause livelocks under memory pressure.
+ *   Allocate a new bio with @nr_iovecs bvecs.  If @gfp_mask contains
+ *   %__GFP_WAIT, the allocation is guaranteed to succeed.
  *
  **/
 struct bio *bio_kmalloc(gfp_t gfp_mask, int nr_iovecs)
@@ -380,6 +384,7 @@ struct bio *bio_kmalloc(gfp_t gfp_mask, int nr_iovecs)
 
         return bio;
 }
+EXPORT_SYMBOL(bio_kmalloc);
 
 void zero_fill_bio(struct bio *bio)
 {
@@ -402,7 +407,7 @@ EXPORT_SYMBOL(zero_fill_bio);
  *
  * Description:
  *   Put a reference to a &struct bio, either one you have gotten with
- *   bio_alloc or bio_get. The last put of a bio will free it.
+ *   bio_alloc, bio_get or bio_clone. The last put of a bio will free it.
  **/
 void bio_put(struct bio *bio)
 {
@@ -416,6 +421,7 @@ void bio_put(struct bio *bio)
                 bio->bi_destructor(bio);
         }
 }
+EXPORT_SYMBOL(bio_put);
 
 inline int bio_phys_segments(struct request_queue *q, struct bio *bio)
 {
@@ -424,6 +430,7 @@ inline int bio_phys_segments(struct request_queue *q, struct bio *bio)
 
         return bio->bi_phys_segments;
 }
+EXPORT_SYMBOL(bio_phys_segments);
 
 /**
  *      __bio_clone     -       clone a bio
@@ -451,6 +458,7 @@ void __bio_clone(struct bio *bio, struct bio *bio_src)
         bio->bi_size = bio_src->bi_size;
         bio->bi_idx = bio_src->bi_idx;
 }
+EXPORT_SYMBOL(__bio_clone);
 
 /**
  *      bio_clone       -       clone a bio
@@ -482,6 +490,7 @@ struct bio *bio_clone(struct bio *bio, gfp_t gfp_mask)
 
         return b;
 }
+EXPORT_SYMBOL(bio_clone);
 
 /**
  *      bio_get_nr_vecs         - return approx number of vecs
@@ -505,6 +514,7 @@ int bio_get_nr_vecs(struct block_device *bdev)
 
         return nr_pages;
 }
+EXPORT_SYMBOL(bio_get_nr_vecs);
 
 static int __bio_add_page(struct request_queue *q, struct bio *bio, struct page
                           *page, unsigned int len, unsigned int offset,
@@ -635,6 +645,7 @@ int bio_add_pc_page(struct request_queue *q, struct bio *bio, struct page *page,
         return __bio_add_page(q, bio, page, len, offset,
                               queue_max_hw_sectors(q));
 }
+EXPORT_SYMBOL(bio_add_pc_page);
 
 /**
  *      bio_add_page    -       attempt to add page to bio
@@ -655,6 +666,7 @@ int bio_add_page(struct bio *bio, struct page *page, unsigned int len,
         struct request_queue *q = bdev_get_queue(bio->bi_bdev);
         return __bio_add_page(q, bio, page, len, offset, queue_max_sectors(q));
 }
+EXPORT_SYMBOL(bio_add_page);
 
 struct bio_map_data {
         struct bio_vec *iovecs;
@@ -776,6 +788,7 @@ int bio_uncopy_user(struct bio *bio)
         bio_put(bio);
         return ret;
 }
+EXPORT_SYMBOL(bio_uncopy_user);
 
 /**
  *      bio_copy_user_iov       -       copy user data to bio
@@ -920,6 +933,7 @@ struct bio *bio_copy_user(struct request_queue *q, struct rq_map_data *map_data,
 
         return bio_copy_user_iov(q, map_data, &iov, 1, write_to_vm, gfp_mask);
 }
+EXPORT_SYMBOL(bio_copy_user);
 
 static struct bio *__bio_map_user_iov(struct request_queue *q,
                                       struct block_device *bdev,
@@ -1050,6 +1064,7 @@ struct bio *bio_map_user(struct request_queue *q, struct block_device *bdev,
 
         return bio_map_user_iov(q, bdev, &iov, 1, write_to_vm, gfp_mask);
 }
+EXPORT_SYMBOL(bio_map_user);
 
 /**
  *      bio_map_user_iov - map user sg_iovec table into bio
@@ -1117,13 +1132,13 @@ void bio_unmap_user(struct bio *bio)
         __bio_unmap_user(bio);
         bio_put(bio);
 }
+EXPORT_SYMBOL(bio_unmap_user);
 
 static void bio_map_kern_endio(struct bio *bio, int err)
 {
         bio_put(bio);
 }
 
-
 static struct bio *__bio_map_kern(struct request_queue *q, void *data,
                                   unsigned int len, gfp_t gfp_mask)
 {
@@ -1189,6 +1204,7 @@ struct bio *bio_map_kern(struct request_queue *q, void *data, unsigned int len,
         bio_put(bio);
         return ERR_PTR(-EINVAL);
 }
+EXPORT_SYMBOL(bio_map_kern);
 
 static void bio_copy_kern_endio(struct bio *bio, int err)
 {
@@ -1250,6 +1266,7 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len,
 
         return bio;
 }
+EXPORT_SYMBOL(bio_copy_kern);
 
 /*
  * bio_set_pages_dirty() and bio_check_pages_dirty() are support functions
@@ -1400,6 +1417,7 @@ void bio_endio(struct bio *bio, int error)
         if (bio->bi_end_io)
                 bio->bi_end_io(bio, error);
 }
+EXPORT_SYMBOL(bio_endio);
 
 void bio_pair_release(struct bio_pair *bp)
 {
@@ -1410,6 +1428,7 @@ void bio_pair_release(struct bio_pair *bp)
                 mempool_free(bp, bp->bio2.bi_private);
         }
 }
+EXPORT_SYMBOL(bio_pair_release);
 
 static void bio_pair_end_1(struct bio *bi, int err)
 {
@@ -1477,6 +1496,7 @@ struct bio_pair *bio_split(struct bio *bi, int first_sectors)
 
         return bp;
 }
+EXPORT_SYMBOL(bio_split);
 
 /**
  *      bio_sector_offset - Find hardware sector offset in bio
@@ -1547,6 +1567,7 @@ void bioset_free(struct bio_set *bs)
 
         kfree(bs);
 }
+EXPORT_SYMBOL(bioset_free);
 
 /**
  * bioset_create  - Create a bio_set
@@ -1592,6 +1613,7 @@ bad:
         bioset_free(bs);
         return NULL;
 }
+EXPORT_SYMBOL(bioset_create);
 
 static void __init biovec_init_slabs(void)
 {
@@ -1636,29 +1658,4 @@ static int __init init_bio(void)
 
         return 0;
 }
-
 subsys_initcall(init_bio);
-
-EXPORT_SYMBOL(bio_alloc);
-EXPORT_SYMBOL(bio_kmalloc);
-EXPORT_SYMBOL(bio_put);
-EXPORT_SYMBOL(bio_free);
-EXPORT_SYMBOL(bio_endio);
-EXPORT_SYMBOL(bio_init);
-EXPORT_SYMBOL(__bio_clone);
-EXPORT_SYMBOL(bio_clone);
-EXPORT_SYMBOL(bio_phys_segments);
-EXPORT_SYMBOL(bio_add_page);
-EXPORT_SYMBOL(bio_add_pc_page);
-EXPORT_SYMBOL(bio_get_nr_vecs);
-EXPORT_SYMBOL(bio_map_user);
-EXPORT_SYMBOL(bio_unmap_user);
-EXPORT_SYMBOL(bio_map_kern);
-EXPORT_SYMBOL(bio_copy_kern);
-EXPORT_SYMBOL(bio_pair_release);
-EXPORT_SYMBOL(bio_split);
-EXPORT_SYMBOL(bio_copy_user);
-EXPORT_SYMBOL(bio_uncopy_user);
-EXPORT_SYMBOL(bioset_create);
-EXPORT_SYMBOL(bioset_free);
-EXPORT_SYMBOL(bio_alloc_bioset);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 9cf4b926f8e4..8bed0557d88c 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1248,8 +1248,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                         bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9);
                 }
         } else {
-                put_disk(disk);
                 module_put(disk->fops->owner);
+                put_disk(disk);
                 disk = NULL;
                 if (bdev->bd_contains == bdev) {
                         if (bdev->bd_disk->fops->open) {
diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
index f128427b995b..361604244271 100644
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -27,7 +27,7 @@
 #include "btrfs_inode.h"
 #include "xattr.h"
 
-#ifdef CONFIG_FS_POSIX_ACL
+#ifdef CONFIG_BTRFS_FS_POSIX_ACL
 
 static struct posix_acl *btrfs_get_acl(struct inode *inode, int type)
 {
@@ -313,7 +313,7 @@ struct xattr_handler btrfs_xattr_acl_access_handler = {
         .set    = btrfs_xattr_acl_access_set,
 };
 
-#else /* CONFIG_FS_POSIX_ACL */
+#else /* CONFIG_BTRFS_FS_POSIX_ACL */
 
 int btrfs_acl_chmod(struct inode *inode)
 {
@@ -325,4 +325,4 @@ int btrfs_init_acl(struct inode *inode, struct inode *dir)
         return 0;
 }
 
-#endif /* CONFIG_FS_POSIX_ACL */
+#endif /* CONFIG_BTRFS_FS_POSIX_ACL */
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 282ca085c2fb..c0861e781cdb 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -64,6 +64,51 @@ struct btrfs_worker_thread {
 };
 
 /*
+ * btrfs_start_workers uses kthread_run, which can block waiting for memory
+ * for a very long time.  It will actually throttle on page writeback,
+ * and so it may not make progress until after our btrfs worker threads
+ * process all of the pending work structs in their queue
+ *
+ * This means we can't use btrfs_start_workers from inside a btrfs worker
+ * thread that is used as part of cleaning dirty memory, which pretty much
+ * involves all of the worker threads.
+ *
+ * Instead we have a helper queue who never has more than one thread
+ * where we scheduler thread start operations.  This worker_start struct
+ * is used to contain the work and hold a pointer to the queue that needs
+ * another worker.
+ */
+struct worker_start {
+        struct btrfs_work work;
+        struct btrfs_workers *queue;
+};
+
+static void start_new_worker_func(struct btrfs_work *work)
+{
+        struct worker_start *start;
+        start = container_of(work, struct worker_start, work);
+        btrfs_start_workers(start->queue, 1);
+        kfree(start);
+}
+
+static int start_new_worker(struct btrfs_workers *queue)
+{
+        struct worker_start *start;
+        int ret;
+
+        start = kzalloc(sizeof(*start), GFP_NOFS);
+        if (!start)
+                return -ENOMEM;
+
+        start->work.func = start_new_worker_func;
+        start->queue = queue;
+        ret = btrfs_queue_worker(queue->atomic_worker_start, &start->work);
+        if (ret)
+                kfree(start);
+        return ret;
+}
+
+/*
  * helper function to move a thread onto the idle list after it
  * has finished some requests.
  */
@@ -118,11 +163,13 @@ static void check_pending_worker_creates(struct btrfs_worker_thread *worker)
                 goto out;
 
         workers->atomic_start_pending = 0;
-        if (workers->num_workers >= workers->max_workers)
+        if (workers->num_workers + workers->num_workers_starting >=
+            workers->max_workers)
                 goto out;
 
+        workers->num_workers_starting += 1;
         spin_unlock_irqrestore(&workers->lock, flags);
-        btrfs_start_workers(workers, 1);
+        start_new_worker(workers);
         return;
 
 out:
@@ -390,9 +437,11 @@ int btrfs_stop_workers(struct btrfs_workers *workers)
 /*
  * simple init on struct btrfs_workers
  */
-void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max)
+void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max,
+                        struct btrfs_workers *async_helper)
 {
         workers->num_workers = 0;
+        workers->num_workers_starting = 0;
         INIT_LIST_HEAD(&workers->worker_list);
         INIT_LIST_HEAD(&workers->idle_list);
         INIT_LIST_HEAD(&workers->order_list);
@@ -404,14 +453,15 @@ void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max)
         workers->name = name;
         workers->ordered = 0;
         workers->atomic_start_pending = 0;
-        workers->atomic_worker_start = 0;
+        workers->atomic_worker_start = async_helper;
 }
 
 /*
  * starts new worker threads.  This does not enforce the max worker
  * count in case you need to temporarily go past it.
  */
-int btrfs_start_workers(struct btrfs_workers *workers, int num_workers)
+static int __btrfs_start_workers(struct btrfs_workers *workers,
+                                 int num_workers)
 {
         struct btrfs_worker_thread *worker;
         int ret = 0;
@@ -444,6 +494,8 @@ int btrfs_start_workers(struct btrfs_workers *workers, int num_workers)
                 list_add_tail(&worker->worker_list, &workers->idle_list);
                 worker->idle = 1;
                 workers->num_workers++;
+                workers->num_workers_starting--;
+                WARN_ON(workers->num_workers_starting < 0);
                 spin_unlock_irq(&workers->lock);
         }
         return 0;
@@ -452,6 +504,14 @@ fail:
         return ret;
 }
 
+int btrfs_start_workers(struct btrfs_workers *workers, int num_workers)
+{
+        spin_lock_irq(&workers->lock);
+        workers->num_workers_starting += num_workers;
+        spin_unlock_irq(&workers->lock);
+        return __btrfs_start_workers(workers, num_workers);
+}
+
 /*
  * run through the list and find a worker thread that doesn't have a lot
  * to do right now.  This can return null if we aren't yet at the thread
@@ -461,7 +521,10 @@ static struct btrfs_worker_thread *next_worker(struct btrfs_workers *workers)
 {
         struct btrfs_worker_thread *worker;
         struct list_head *next;
-        int enforce_min = workers->num_workers < workers->max_workers;
+        int enforce_min;
+
+        enforce_min = (workers->num_workers + workers->num_workers_starting) <
+                workers->max_workers;
 
         /*
          * if we find an idle thread, don't move it to the end of the
@@ -509,15 +572,17 @@ again:
         worker = next_worker(workers);
 
         if (!worker) {
-                if (workers->num_workers >= workers->max_workers) {
+                if (workers->num_workers + workers->num_workers_starting >=
+                    workers->max_workers) {
                         goto fallback;
                 } else if (workers->atomic_worker_start) {
                         workers->atomic_start_pending = 1;
                         goto fallback;
                 } else {
+                        workers->num_workers_starting++;
                         spin_unlock_irqrestore(&workers->lock, flags);
                         /* we're below the limit, start another worker */
-                        btrfs_start_workers(workers, 1);
+                        __btrfs_start_workers(workers, 1);
                         goto again;
                 }
         }
diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h
index fc089b95ec14..5077746cf85e 100644
--- a/fs/btrfs/async-thread.h
+++ b/fs/btrfs/async-thread.h
@@ -64,6 +64,8 @@ struct btrfs_workers {
         /* current number of running workers */
         int num_workers;
 
+        int num_workers_starting;
+
         /* max number of workers allowed.  changed by btrfs_start_workers */
         int max_workers;
 
@@ -78,9 +80,10 @@ struct btrfs_workers {
 
         /*
          * are we allowed to sleep while starting workers or are we required
-         * to start them at a later time?
+         * to start them at a later time?  If we can't sleep, this indicates
+         * which queue we need to use to schedule thread creation.
          */
-        int atomic_worker_start;
+        struct btrfs_workers *atomic_worker_start;
 
         /* list with all the work threads.  The workers on the idle thread
          * may be actively servicing jobs, but they haven't yet hit the
@@ -109,7 +112,8 @@ struct btrfs_workers {
 int btrfs_queue_worker(struct btrfs_workers *workers, struct btrfs_work *work);
 int btrfs_start_workers(struct btrfs_workers *workers, int num_workers);
 int btrfs_stop_workers(struct btrfs_workers *workers);
-void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max);
+void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max,
+                        struct btrfs_workers *async_starter);
 int btrfs_requeue_work(struct btrfs_work *work);
 void btrfs_set_work_high_prio(struct btrfs_work *work);
 #endif
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index 82ee56bba299..f6783a42f010 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -86,6 +86,12 @@ struct btrfs_inode {
          * transid of the trans_handle that last modified this inode
          */
         u64 last_trans;
+
+        /*
+         * log transid when this inode was last modified
+         */
+        u64 last_sub_trans;
+
         /*
          * transid that last logged this inode
          */
@@ -128,6 +134,16 @@ struct btrfs_inode {
         u64 last_unlink_trans;
 
         /*
+         * Counters to keep track of the number of extent item's we may use due
+         * to delalloc and such.  outstanding_extents is the number of extent
+         * items we think we'll end up using, and reserved_extents is the number
+         * of extent items we've reserved metadata for.
+         */
+        spinlock_t accounting_lock;
+        int reserved_extents;
+        int outstanding_extents;
+
+        /*
          * ordered_data_close is set by truncate when a file that used
          * to have good data has been truncated to zero.  When it is set
          * the btrfs file release call will add this inode to the
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 80599b4e42bd..444b3e9b92a4 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -675,21 +675,28 @@ struct btrfs_space_info {
                                    current allocations */
         u64 bytes_readonly;     /* total bytes that are read only */
         u64 bytes_super;        /* total bytes reserved for the super blocks */
-
-        /* delalloc accounting */
-        u64 bytes_delalloc;     /* number of bytes reserved for allocation,
-                                   this space is not necessarily reserved yet
-                                   by the allocator */
+        u64 bytes_root;         /* the number of bytes needed to commit a
+                                   transaction */
         u64 bytes_may_use;      /* number of bytes that may be used for
-                                   delalloc */
+                                   delalloc/allocations */
+        u64 bytes_delalloc;     /* number of bytes currently reserved for
+                                   delayed allocation */
 
         int full;               /* indicates that we cannot allocate any more
                                    chunks for this space */
         int force_alloc;        /* set if we need to force a chunk alloc for
                                    this space */
+        int force_delalloc;     /* make people start doing filemap_flush until
+                                   we're under a threshold */
 
         struct list_head list;
 
+        /* for controlling how we free up space for allocations */
+        wait_queue_head_t allocate_wait;
+        wait_queue_head_t flush_wait;
+        int allocating_chunk;
+        int flushing;
+
         /* for block groups in our same type */
         struct list_head block_groups;
         spinlock_t lock;
@@ -903,6 +910,7 @@ struct btrfs_fs_info {
          * A third pool does submit_bio to avoid deadlocking with the other
          * two
          */
+        struct btrfs_workers generic_worker;
         struct btrfs_workers workers;
         struct btrfs_workers delalloc_workers;
         struct btrfs_workers endio_workers;
@@ -910,6 +918,7 @@ struct btrfs_fs_info {
         struct btrfs_workers endio_meta_write_workers;
         struct btrfs_workers endio_write_workers;
         struct btrfs_workers submit_workers;
+        struct btrfs_workers enospc_workers;
         /*
          * fixup workers take dirty pages that didn't properly go through
          * the cow mechanism and make them safe to write.  It happens
@@ -1000,7 +1009,10 @@ struct btrfs_root {
         atomic_t log_writers;
         atomic_t log_commit[2];
         unsigned long log_transid;
+        unsigned long last_log_commit;
         unsigned long log_batch;
+        pid_t log_start_pid;
+        bool log_multiple_pids;
 
         u64 objectid;
         u64 last_trans;
@@ -1141,6 +1153,7 @@ struct btrfs_root {
 #define BTRFS_MOUNT_FLUSHONCOMMIT       (1 << 7)
 #define BTRFS_MOUNT_SSD_SPREAD          (1 << 8)
 #define BTRFS_MOUNT_NOSSD               (1 << 9)
+#define BTRFS_MOUNT_DISCARD             (1 << 10)
 
 #define btrfs_clear_opt(o, opt)         ((o) &= ~BTRFS_MOUNT_##opt)
 #define btrfs_set_opt(o, opt)           ((o) |= BTRFS_MOUNT_##opt)
@@ -2022,7 +2035,12 @@ u64 btrfs_reduce_alloc_profile(struct btrfs_root *root, u64 flags);
 void btrfs_set_inode_space_info(struct btrfs_root *root, struct inode *ionde);
 void btrfs_clear_space_info_full(struct btrfs_fs_info *info);
 
-int btrfs_check_metadata_free_space(struct btrfs_root *root);
+int btrfs_reserve_metadata_space(struct btrfs_root *root, int num_items);
+int btrfs_unreserve_metadata_space(struct btrfs_root *root, int num_items);
+int btrfs_unreserve_metadata_for_delalloc(struct btrfs_root *root,
+                                          struct inode *inode, int num_items);
+int btrfs_reserve_metadata_for_delalloc(struct btrfs_root *root,
+                                        struct inode *inode, int num_items);
 int btrfs_check_data_free_space(struct btrfs_root *root, struct inode *inode,
                                 u64 bytes);
 void btrfs_free_reserved_data_space(struct btrfs_root *root,
@@ -2314,7 +2332,7 @@ int btrfs_orphan_del(struct btrfs_trans_handle *trans, struct inode *inode);
 void btrfs_orphan_cleanup(struct btrfs_root *root);
 int btrfs_cont_expand(struct inode *inode, loff_t size);
 int btrfs_invalidate_inodes(struct btrfs_root *root);
-extern struct dentry_operations btrfs_dentry_operations;
+extern const struct dentry_operations btrfs_dentry_operations;
 
 /* ioctl.c */
 long btrfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
@@ -2326,7 +2344,7 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync);
 int btrfs_drop_extent_cache(struct inode *inode, u64 start, u64 end,
                             int skip_pinned);
 int btrfs_check_file(struct btrfs_root *root, struct inode *inode);
-extern struct file_operations btrfs_file_operations;
+extern const struct file_operations btrfs_file_operations;
 int btrfs_drop_extents(struct btrfs_trans_handle *trans,
                        struct btrfs_root *root, struct inode *inode,
                        u64 start, u64 end, u64 locked_end,
@@ -2357,7 +2375,7 @@ int btrfs_parse_options(struct btrfs_root *root, char *options);
 int btrfs_sync_fs(struct super_block *sb, int wait);
 
 /* acl.c */
-#ifdef CONFIG_FS_POSIX_ACL
+#ifdef CONFIG_BTRFS_FS_POSIX_ACL
 int btrfs_check_acl(struct inode *inode, int mask);
 #else
 #define btrfs_check_acl NULL
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 644e796fd643..02b6afbd7450 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -822,14 +822,14 @@ struct extent_buffer *btrfs_find_create_tree_block(struct btrfs_root *root,
 
 int btrfs_write_tree_block(struct extent_buffer *buf)
 {
-        return btrfs_fdatawrite_range(buf->first_page->mapping, buf->start,
-                                      buf->start + buf->len - 1, WB_SYNC_ALL);
+        return filemap_fdatawrite_range(buf->first_page->mapping, buf->start,
+                                        buf->start + buf->len - 1);
 }
 
 int btrfs_wait_tree_block_writeback(struct extent_buffer *buf)
 {
-        return btrfs_wait_on_page_writeback_range(buf->first_page->mapping,
-                                  buf->start, buf->start + buf->len - 1);
+        return filemap_fdatawait_range(buf->first_page->mapping,
+                                       buf->start, buf->start + buf->len - 1);
 }
 
 struct extent_buffer *read_tree_block(struct btrfs_root *root, u64 bytenr,
@@ -917,6 +917,7 @@ static int __setup_root(u32 nodesize, u32 leafsize, u32 sectorsize,
         atomic_set(&root->log_writers, 0);
         root->log_batch = 0;
         root->log_transid = 0;
+        root->last_log_commit = 0;
         extent_io_tree_init(&root->dirty_log_pages,
                              fs_info->btree_inode->i_mapping, GFP_NOFS);
 
@@ -1087,6 +1088,7 @@ int btrfs_add_log_tree(struct btrfs_trans_handle *trans,
         WARN_ON(root->log_root);
         root->log_root = log_root;
         root->log_transid = 0;
+        root->last_log_commit = 0;
         return 0;
 }
 
@@ -1630,7 +1632,7 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         fs_info->sb = sb;
         fs_info->max_extent = (u64)-1;
         fs_info->max_inline = 8192 * 1024;
-        fs_info->metadata_ratio = 8;
+        fs_info->metadata_ratio = 0;
 
         fs_info->thread_pool_size = min_t(unsigned long,
                                           num_online_cpus() + 2, 8);
@@ -1746,21 +1748,25 @@ struct btrfs_root *open_ctree(struct super_block *sb,
                 err = -EINVAL;
                 goto fail_iput;
         }
-printk("thread pool is %d\n", fs_info->thread_pool_size);
-        /*
-         * we need to start all the end_io workers up front because the
-         * queue work function gets called at interrupt time, and so it
-         * cannot dynamically grow.
-         */
+
+        btrfs_init_workers(&fs_info->generic_worker,
+                           "genwork", 1, NULL);
+
         btrfs_init_workers(&fs_info->workers, "worker",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
 
         btrfs_init_workers(&fs_info->delalloc_workers, "delalloc",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
 
         btrfs_init_workers(&fs_info->submit_workers, "submit",
                            min_t(u64, fs_devices->num_devices,
-                           fs_info->thread_pool_size));
+                           fs_info->thread_pool_size),
+                           &fs_info->generic_worker);
+        btrfs_init_workers(&fs_info->enospc_workers, "enospc",
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
 
         /* a higher idle thresh on the submit workers makes it much more
          * likely that bios will be send down in a sane order to the
@@ -1774,15 +1780,20 @@ printk("thread pool is %d\n", fs_info->thread_pool_size);
         fs_info->delalloc_workers.idle_thresh = 2;
         fs_info->delalloc_workers.ordered = 1;
 
-        btrfs_init_workers(&fs_info->fixup_workers, "fixup", 1);
+        btrfs_init_workers(&fs_info->fixup_workers, "fixup", 1,
+                           &fs_info->generic_worker);
         btrfs_init_workers(&fs_info->endio_workers, "endio",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
         btrfs_init_workers(&fs_info->endio_meta_workers, "endio-meta",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
         btrfs_init_workers(&fs_info->endio_meta_write_workers,
-                           "endio-meta-write", fs_info->thread_pool_size);
+                           "endio-meta-write", fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
         btrfs_init_workers(&fs_info->endio_write_workers, "endio-write",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size,
+                           &fs_info->generic_worker);
 
         /*
          * endios are largely parallel and should have a very
@@ -1794,12 +1805,8 @@ printk("thread pool is %d\n", fs_info->thread_pool_size);
         fs_info->endio_write_workers.idle_thresh = 2;
         fs_info->endio_meta_write_workers.idle_thresh = 2;
 
-        fs_info->endio_workers.atomic_worker_start = 1;
-        fs_info->endio_meta_workers.atomic_worker_start = 1;
-        fs_info->endio_write_workers.atomic_worker_start = 1;
-        fs_info->endio_meta_write_workers.atomic_worker_start = 1;
-
         btrfs_start_workers(&fs_info->workers, 1);
+        btrfs_start_workers(&fs_info->generic_worker, 1);
         btrfs_start_workers(&fs_info->submit_workers, 1);
         btrfs_start_workers(&fs_info->delalloc_workers, 1);
         btrfs_start_workers(&fs_info->fixup_workers, 1);
@@ -1807,6 +1814,7 @@ printk("thread pool is %d\n", fs_info->thread_pool_size);
         btrfs_start_workers(&fs_info->endio_meta_workers, 1);
         btrfs_start_workers(&fs_info->endio_meta_write_workers, 1);
         btrfs_start_workers(&fs_info->endio_write_workers, 1);
+        btrfs_start_workers(&fs_info->enospc_workers, 1);
 
         fs_info->bdi.ra_pages *= btrfs_super_num_devices(disk_super);
         fs_info->bdi.ra_pages = max(fs_info->bdi.ra_pages,
@@ -2012,6 +2020,7 @@ fail_chunk_root:
         free_extent_buffer(chunk_root->node);
         free_extent_buffer(chunk_root->commit_root);
 fail_sb_buffer:
+        btrfs_stop_workers(&fs_info->generic_worker);
         btrfs_stop_workers(&fs_info->fixup_workers);
         btrfs_stop_workers(&fs_info->delalloc_workers);
         btrfs_stop_workers(&fs_info->workers);
@@ -2020,6 +2029,7 @@ fail_sb_buffer:
         btrfs_stop_workers(&fs_info->endio_meta_write_workers);
         btrfs_stop_workers(&fs_info->endio_write_workers);
         btrfs_stop_workers(&fs_info->submit_workers);
+        btrfs_stop_workers(&fs_info->enospc_workers);
 fail_iput:
         invalidate_inode_pages2(fs_info->btree_inode->i_mapping);
         iput(fs_info->btree_inode);
@@ -2437,6 +2447,7 @@ int close_ctree(struct btrfs_root *root)
 
         iput(fs_info->btree_inode);
 
+        btrfs_stop_workers(&fs_info->generic_worker);
         btrfs_stop_workers(&fs_info->fixup_workers);
         btrfs_stop_workers(&fs_info->delalloc_workers);
         btrfs_stop_workers(&fs_info->workers);
@@ -2445,6 +2456,7 @@ int close_ctree(struct btrfs_root *root)
         btrfs_stop_workers(&fs_info->endio_meta_write_workers);
         btrfs_stop_workers(&fs_info->endio_write_workers);
         btrfs_stop_workers(&fs_info->submit_workers);
+        btrfs_stop_workers(&fs_info->enospc_workers);
 
         btrfs_close_devices(fs_info->fs_devices);
         btrfs_mapping_tree_free(&fs_info->mapping_tree);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 993f93ff7ba6..94627c4cc193 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -68,6 +68,8 @@ static int pin_down_bytes(struct btrfs_trans_handle *trans,
                           struct extent_buffer **must_clean);
 static int find_next_key(struct btrfs_path *path, int level,
                          struct btrfs_key *key);
+static void dump_space_info(struct btrfs_space_info *info, u64 bytes,
+                            int dump_block_groups);
 
 static noinline int
 block_group_cache_done(struct btrfs_block_group_cache *cache)
@@ -1566,23 +1568,23 @@ static int remove_extent_backref(struct btrfs_trans_handle *trans,
         return ret;
 }
 
-#ifdef BIO_RW_DISCARD
 static void btrfs_issue_discard(struct block_device *bdev,
                                 u64 start, u64 len)
 {
         blkdev_issue_discard(bdev, start >> 9, len >> 9, GFP_KERNEL,
                              DISCARD_FL_BARRIER);
 }
-#endif
 
 static int btrfs_discard_extent(struct btrfs_root *root, u64 bytenr,
                                 u64 num_bytes)
 {
-#ifdef BIO_RW_DISCARD
         int ret;
         u64 map_length = num_bytes;
         struct btrfs_multi_bio *multi = NULL;
 
+        if (!btrfs_test_opt(root, DISCARD))
+                return 0;
+
         /* Tell the block device(s) that the sectors can be discarded */
         ret = btrfs_map_block(&root->fs_info->mapping_tree, READ,
                               bytenr, &map_length, &multi, 0);
@@ -1602,9 +1604,6 @@ static int btrfs_discard_extent(struct btrfs_root *root, u64 bytenr,
         }
 
         return ret;
-#else
-        return 0;
-#endif
 }
 
 int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
@@ -2765,67 +2764,448 @@ void btrfs_set_inode_space_info(struct btrfs_root *root, struct inode *inode)
                                                        alloc_target);
 }
 
+static u64 calculate_bytes_needed(struct btrfs_root *root, int num_items)
+{
+        u64 num_bytes;
+        int level;
+
+        level = BTRFS_MAX_LEVEL - 2;
+        /*
+         * NOTE: these calculations are absolutely the worst possible case.
+         * This assumes that _every_ item we insert will require a new leaf, and
+         * that the tree has grown to its maximum level size.
+         */
+
+        /*
+         * for every item we insert we could insert both an extent item and a
+         * extent ref item.  Then for ever item we insert, we will need to cow
+         * both the original leaf, plus the leaf to the left and right of it.
+         *
+         * Unless we are talking about the extent root, then we just want the
+         * number of items * 2, since we just need the extent item plus its ref.
+         */
+        if (root == root->fs_info->extent_root)
+                num_bytes = num_items * 2;
+        else
+                num_bytes = (num_items + (2 * num_items)) * 3;
+
+        /*
+         * num_bytes is total number of leaves we could need times the leaf
+         * size, and then for every leaf we could end up cow'ing 2 nodes per
+         * level, down to the leaf level.
+         */
+        num_bytes = (num_bytes * root->leafsize) +
+                (num_bytes * (level * 2)) * root->nodesize;
+
+        return num_bytes;
+}
+
 /*
- * for now this just makes sure we have at least 5% of our metadata space free
- * for use.
+ * Unreserve metadata space for delalloc.  If we have less reserved credits than
+ * we have extents, this function does nothing.
  */
-int btrfs_check_metadata_free_space(struct btrfs_root *root)
+int btrfs_unreserve_metadata_for_delalloc(struct btrfs_root *root,
+                                          struct inode *inode, int num_items)
 {
         struct btrfs_fs_info *info = root->fs_info;
         struct btrfs_space_info *meta_sinfo;
-        u64 alloc_target, thresh;
-        int committed = 0, ret;
+        u64 num_bytes;
+        u64 alloc_target;
+        bool bug = false;
 
         /* get the space info for where the metadata will live */
         alloc_target = btrfs_get_alloc_profile(root, 0);
         meta_sinfo = __find_space_info(info, alloc_target);
-        if (!meta_sinfo)
-                goto alloc;
 
-again:
+        num_bytes = calculate_bytes_needed(root->fs_info->extent_root,
+                                           num_items);
+
         spin_lock(&meta_sinfo->lock);
-        if (!meta_sinfo->full)
-                thresh = meta_sinfo->total_bytes * 80;
-        else
-                thresh = meta_sinfo->total_bytes * 95;
+        spin_lock(&BTRFS_I(inode)->accounting_lock);
+        if (BTRFS_I(inode)->reserved_extents <=
+            BTRFS_I(inode)->outstanding_extents) {
+                spin_unlock(&BTRFS_I(inode)->accounting_lock);
+                spin_unlock(&meta_sinfo->lock);
+                return 0;
+        }
+        spin_unlock(&BTRFS_I(inode)->accounting_lock);
+
+        BTRFS_I(inode)->reserved_extents--;
+        BUG_ON(BTRFS_I(inode)->reserved_extents < 0);
+
+        if (meta_sinfo->bytes_delalloc < num_bytes) {
+                bug = true;
+                meta_sinfo->bytes_delalloc = 0;
+        } else {
+                meta_sinfo->bytes_delalloc -= num_bytes;
+        }
+        spin_unlock(&meta_sinfo->lock);
+
+        BUG_ON(bug);
 
+        return 0;
+}
+
+static void check_force_delalloc(struct btrfs_space_info *meta_sinfo)
+{
+        u64 thresh;
+
+        thresh = meta_sinfo->bytes_used + meta_sinfo->bytes_reserved +
+                meta_sinfo->bytes_pinned + meta_sinfo->bytes_readonly +
+                meta_sinfo->bytes_super + meta_sinfo->bytes_root +
+                meta_sinfo->bytes_may_use;
+
+        thresh = meta_sinfo->total_bytes - thresh;
+        thresh *= 80;
         do_div(thresh, 100);
+        if (thresh <= meta_sinfo->bytes_delalloc)
+                meta_sinfo->force_delalloc = 1;
+        else
+                meta_sinfo->force_delalloc = 0;
+}
 
-        if (meta_sinfo->bytes_used + meta_sinfo->bytes_reserved +
-            meta_sinfo->bytes_pinned + meta_sinfo->bytes_readonly +
-            meta_sinfo->bytes_super > thresh) {
-                struct btrfs_trans_handle *trans;
-                if (!meta_sinfo->full) {
-                        meta_sinfo->force_alloc = 1;
+struct async_flush {
+        struct btrfs_root *root;
+        struct btrfs_space_info *info;
+        struct btrfs_work work;
+};
+
+static noinline void flush_delalloc_async(struct btrfs_work *work)
+{
+        struct async_flush *async;
+        struct btrfs_root *root;
+        struct btrfs_space_info *info;
+
+        async = container_of(work, struct async_flush, work);
+        root = async->root;
+        info = async->info;
+
+        btrfs_start_delalloc_inodes(root);
+        wake_up(&info->flush_wait);
+        btrfs_wait_ordered_extents(root, 0);
+
+        spin_lock(&info->lock);
+        info->flushing = 0;
+        spin_unlock(&info->lock);
+        wake_up(&info->flush_wait);
+
+        kfree(async);
+}
+
+static void wait_on_flush(struct btrfs_space_info *info)
+{
+        DEFINE_WAIT(wait);
+        u64 used;
+
+        while (1) {
+                prepare_to_wait(&info->flush_wait, &wait,
+                                TASK_UNINTERRUPTIBLE);
+                spin_lock(&info->lock);
+                if (!info->flushing) {
+                        spin_unlock(&info->lock);
+                        break;
+                }
+
+                used = info->bytes_used + info->bytes_reserved +
+                        info->bytes_pinned + info->bytes_readonly +
+                        info->bytes_super + info->bytes_root +
+                        info->bytes_may_use + info->bytes_delalloc;
+                if (used < info->total_bytes) {
+                        spin_unlock(&info->lock);
+                        break;
+                }
+                spin_unlock(&info->lock);
+                schedule();
+        }
+        finish_wait(&info->flush_wait, &wait);
+}
+
+static void flush_delalloc(struct btrfs_root *root,
+                                 struct btrfs_space_info *info)
+{
+        struct async_flush *async;
+        bool wait = false;
+
+        spin_lock(&info->lock);
+
+        if (!info->flushing) {
+                info->flushing = 1;
+                init_waitqueue_head(&info->flush_wait);
+        } else {
+                wait = true;
+        }
+
+        spin_unlock(&info->lock);
+
+        if (wait) {
+                wait_on_flush(info);
+                return;
+        }
+
+        async = kzalloc(sizeof(*async), GFP_NOFS);
+        if (!async)
+                goto flush;
+
+        async->root = root;
+        async->info = info;
+        async->work.func = flush_delalloc_async;
+
+        btrfs_queue_worker(&root->fs_info->enospc_workers,
+                           &async->work);
+        wait_on_flush(info);
+        return;
+
+flush:
+        btrfs_start_delalloc_inodes(root);
+        btrfs_wait_ordered_extents(root, 0);
+
+        spin_lock(&info->lock);
+        info->flushing = 0;
+        spin_unlock(&info->lock);
+        wake_up(&info->flush_wait);
+}
+
+static int maybe_allocate_chunk(struct btrfs_root *root,
+                                 struct btrfs_space_info *info)
+{
+        struct btrfs_super_block *disk_super = &root->fs_info->super_copy;
+        struct btrfs_trans_handle *trans;
+        bool wait = false;
+        int ret = 0;
+        u64 min_metadata;
+        u64 free_space;
+
+        free_space = btrfs_super_total_bytes(disk_super);
+        /*
+         * we allow the metadata to grow to a max of either 10gb or 5% of the
+         * space in the volume.
+         */
+        min_metadata = min((u64)10 * 1024 * 1024 * 1024,
+                             div64_u64(free_space * 5, 100));
+        if (info->total_bytes >= min_metadata) {
+                spin_unlock(&info->lock);
+                return 0;
+        }
+
+        if (info->full) {
+                spin_unlock(&info->lock);
+                return 0;
+        }
+
+        if (!info->allocating_chunk) {
+                info->force_alloc = 1;
+                info->allocating_chunk = 1;
+                init_waitqueue_head(&info->allocate_wait);
+        } else {
+                wait = true;
+        }
+
+        spin_unlock(&info->lock);
+
+        if (wait) {
+                wait_event(info->allocate_wait,
+                           !info->allocating_chunk);
+                return 1;
+        }
+
+        trans = btrfs_start_transaction(root, 1);
+        if (!trans) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ret = do_chunk_alloc(trans, root->fs_info->extent_root,
+                             4096 + 2 * 1024 * 1024,
+                             info->flags, 0);
+        btrfs_end_transaction(trans, root);
+        if (ret)
+                goto out;
+out:
+        spin_lock(&info->lock);
+        info->allocating_chunk = 0;
+        spin_unlock(&info->lock);
+        wake_up(&info->allocate_wait);
+
+        if (ret)
+                return 0;
+        return 1;
+}
+
+/*
+ * Reserve metadata space for delalloc.
+ */
+int btrfs_reserve_metadata_for_delalloc(struct btrfs_root *root,
+                                        struct inode *inode, int num_items)
+{
+        struct btrfs_fs_info *info = root->fs_info;
+        struct btrfs_space_info *meta_sinfo;
+        u64 num_bytes;
+        u64 used;
+        u64 alloc_target;
+        int flushed = 0;
+        int force_delalloc;
+
+        /* get the space info for where the metadata will live */
+        alloc_target = btrfs_get_alloc_profile(root, 0);
+        meta_sinfo = __find_space_info(info, alloc_target);
+
+        num_bytes = calculate_bytes_needed(root->fs_info->extent_root,
+                                           num_items);
+again:
+        spin_lock(&meta_sinfo->lock);
+
+        force_delalloc = meta_sinfo->force_delalloc;
+
+        if (unlikely(!meta_sinfo->bytes_root))
+                meta_sinfo->bytes_root = calculate_bytes_needed(root, 6);
+
+        if (!flushed)
+                meta_sinfo->bytes_delalloc += num_bytes;
+
+        used = meta_sinfo->bytes_used + meta_sinfo->bytes_reserved +
+                meta_sinfo->bytes_pinned + meta_sinfo->bytes_readonly +
+                meta_sinfo->bytes_super + meta_sinfo->bytes_root +
+                meta_sinfo->bytes_may_use + meta_sinfo->bytes_delalloc;
+
+        if (used > meta_sinfo->total_bytes) {
+                flushed++;
+
+                if (flushed == 1) {
+                        if (maybe_allocate_chunk(root, meta_sinfo))
+                                goto again;
+                        flushed++;
+                } else {
                         spin_unlock(&meta_sinfo->lock);
-alloc:
-                        trans = btrfs_start_transaction(root, 1);
-                        if (!trans)
-                                return -ENOMEM;
+                }
 
-                        ret = do_chunk_alloc(trans, root->fs_info->extent_root,
-                                             2 * 1024 * 1024, alloc_target, 0);
-                        btrfs_end_transaction(trans, root);
-                        if (!meta_sinfo) {
-                                meta_sinfo = __find_space_info(info,
-                                                               alloc_target);
-                        }
+                if (flushed == 2) {
+                        filemap_flush(inode->i_mapping);
+                        goto again;
+                } else if (flushed == 3) {
+                        flush_delalloc(root, meta_sinfo);
                         goto again;
                 }
+                spin_lock(&meta_sinfo->lock);
+                meta_sinfo->bytes_delalloc -= num_bytes;
                 spin_unlock(&meta_sinfo->lock);
+                printk(KERN_ERR "enospc, has %d, reserved %d\n",
+                       BTRFS_I(inode)->outstanding_extents,
+                       BTRFS_I(inode)->reserved_extents);
+                dump_space_info(meta_sinfo, 0, 0);
+                return -ENOSPC;
+        }
 
-                if (!committed) {
-                        committed = 1;
-                        trans = btrfs_join_transaction(root, 1);
-                        if (!trans)
-                                return -ENOMEM;
-                        ret = btrfs_commit_transaction(trans, root);
-                        if (ret)
-                                return ret;
+        BTRFS_I(inode)->reserved_extents++;
+        check_force_delalloc(meta_sinfo);
+        spin_unlock(&meta_sinfo->lock);
+
+        if (!flushed && force_delalloc)
+                filemap_flush(inode->i_mapping);
+
+        return 0;
+}
+
+/*
+ * unreserve num_items number of items worth of metadata space.  This needs to
+ * be paired with btrfs_reserve_metadata_space.
+ *
+ * NOTE: if you have the option, run this _AFTER_ you do a
+ * btrfs_end_transaction, since btrfs_end_transaction will run delayed ref
+ * oprations which will result in more used metadata, so we want to make sure we
+ * can do that without issue.
+ */
+int btrfs_unreserve_metadata_space(struct btrfs_root *root, int num_items)
+{
+        struct btrfs_fs_info *info = root->fs_info;
+        struct btrfs_space_info *meta_sinfo;
+        u64 num_bytes;
+        u64 alloc_target;
+        bool bug = false;
+
+        /* get the space info for where the metadata will live */
+        alloc_target = btrfs_get_alloc_profile(root, 0);
+        meta_sinfo = __find_space_info(info, alloc_target);
+
+        num_bytes = calculate_bytes_needed(root, num_items);
+
+        spin_lock(&meta_sinfo->lock);
+        if (meta_sinfo->bytes_may_use < num_bytes) {
+                bug = true;
+                meta_sinfo->bytes_may_use = 0;
+        } else {
+                meta_sinfo->bytes_may_use -= num_bytes;
+        }
+        spin_unlock(&meta_sinfo->lock);
+
+        BUG_ON(bug);
+
+        return 0;
+}
+
+/*
+ * Reserve some metadata space for use.  We'll calculate the worste case number
+ * of bytes that would be needed to modify num_items number of items.  If we
+ * have space, fantastic, if not, you get -ENOSPC.  Please call
+ * btrfs_unreserve_metadata_space when you are done for the _SAME_ number of
+ * items you reserved, since whatever metadata you needed should have already
+ * been allocated.
+ *
+ * This will commit the transaction to make more space if we don't have enough
+ * metadata space.  THe only time we don't do this is if we're reserving space
+ * inside of a transaction, then we will just return -ENOSPC and it is the
+ * callers responsibility to handle it properly.
+ */
+int btrfs_reserve_metadata_space(struct btrfs_root *root, int num_items)
+{
+        struct btrfs_fs_info *info = root->fs_info;
+        struct btrfs_space_info *meta_sinfo;
+        u64 num_bytes;
+        u64 used;
+        u64 alloc_target;
+        int retries = 0;
+
+        /* get the space info for where the metadata will live */
+        alloc_target = btrfs_get_alloc_profile(root, 0);
+        meta_sinfo = __find_space_info(info, alloc_target);
+
+        num_bytes = calculate_bytes_needed(root, num_items);
+again:
+        spin_lock(&meta_sinfo->lock);
+
+        if (unlikely(!meta_sinfo->bytes_root))
+                meta_sinfo->bytes_root = calculate_bytes_needed(root, 6);
+
+        if (!retries)
+                meta_sinfo->bytes_may_use += num_bytes;
+
+        used = meta_sinfo->bytes_used + meta_sinfo->bytes_reserved +
+                meta_sinfo->bytes_pinned + meta_sinfo->bytes_readonly +
+                meta_sinfo->bytes_super + meta_sinfo->bytes_root +
+                meta_sinfo->bytes_may_use + meta_sinfo->bytes_delalloc;
+
+        if (used > meta_sinfo->total_bytes) {
+                retries++;
+                if (retries == 1) {
+                        if (maybe_allocate_chunk(root, meta_sinfo))
+                                goto again;
+                        retries++;
+                } else {
+                        spin_unlock(&meta_sinfo->lock);
+                }
+
+                if (retries == 2) {
+                        flush_delalloc(root, meta_sinfo);
                         goto again;
                 }
+                spin_lock(&meta_sinfo->lock);
+                meta_sinfo->bytes_may_use -= num_bytes;
+                spin_unlock(&meta_sinfo->lock);
+
+                dump_space_info(meta_sinfo, 0, 0);
                 return -ENOSPC;
         }
+
+        check_force_delalloc(meta_sinfo);
         spin_unlock(&meta_sinfo->lock);
 
         return 0;
@@ -2888,7 +3268,7 @@ alloc:
                 spin_unlock(&data_sinfo->lock);
 
                 /* commit the current transaction and try again */
-                if (!committed) {
+                if (!committed && !root->fs_info->open_ioctl_trans) {
                         committed = 1;
                         trans = btrfs_join_transaction(root, 1);
                         if (!trans)
@@ -2916,7 +3296,7 @@ alloc:
         BTRFS_I(inode)->reserved_bytes += bytes;
         spin_unlock(&data_sinfo->lock);
 
-        return btrfs_check_metadata_free_space(root);
+        return 0;
 }
 
 /*
@@ -3015,17 +3395,15 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans,
         BUG_ON(!space_info);
 
         spin_lock(&space_info->lock);
-        if (space_info->force_alloc) {
+        if (space_info->force_alloc)
                 force = 1;
-                space_info->force_alloc = 0;
-        }
         if (space_info->full) {
                 spin_unlock(&space_info->lock);
                 goto out;
         }
 
         thresh = space_info->total_bytes - space_info->bytes_readonly;
-        thresh = div_factor(thresh, 6);
+        thresh = div_factor(thresh, 8);
         if (!force &&
            (space_info->bytes_used + space_info->bytes_pinned +
             space_info->bytes_reserved + alloc_bytes) < thresh) {
@@ -3039,7 +3417,7 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans,
          * we keep a reasonable number of metadata chunks allocated in the
          * FS as well.
          */
-        if (flags & BTRFS_BLOCK_GROUP_DATA) {
+        if (flags & BTRFS_BLOCK_GROUP_DATA && fs_info->metadata_ratio) {
                 fs_info->data_chunk_allocations++;
                 if (!(fs_info->data_chunk_allocations %
                       fs_info->metadata_ratio))
@@ -3047,8 +3425,11 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans,
         }
 
         ret = btrfs_alloc_chunk(trans, extent_root, flags);
+        spin_lock(&space_info->lock);
         if (ret)
                 space_info->full = 1;
+        space_info->force_alloc = 0;
+        spin_unlock(&space_info->lock);
 out:
         mutex_unlock(&extent_root->fs_info->chunk_mutex);
         return ret;
@@ -3306,6 +3687,14 @@ static int pin_down_bytes(struct btrfs_trans_handle *trans,
         if (is_data)
                 goto pinit;
 
+        /*
+         * discard is sloooow, and so triggering discards on
+         * individual btree blocks isn't a good plan.  Just
+         * pin everything in discard mode.
+         */
+        if (btrfs_test_opt(root, DISCARD))
+                goto pinit;
+
         buf = btrfs_find_tree_block(root, bytenr, num_bytes);
         if (!buf)
                 goto pinit;
@@ -3713,7 +4102,7 @@ wait_block_group_cache_done(struct btrfs_block_group_cache *cache)
 }
 
 enum btrfs_loop_type {
-        LOOP_CACHED_ONLY = 0,
+        LOOP_FIND_IDEAL = 0,
         LOOP_CACHING_NOWAIT = 1,
         LOOP_CACHING_WAIT = 2,
         LOOP_ALLOC_CHUNK = 3,
@@ -3742,11 +4131,15 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
         struct btrfs_block_group_cache *block_group = NULL;
         int empty_cluster = 2 * 1024 * 1024;
         int allowed_chunk_alloc = 0;
+        int done_chunk_alloc = 0;
         struct btrfs_space_info *space_info;
         int last_ptr_loop = 0;
         int loop = 0;
         bool found_uncached_bg = false;
         bool failed_cluster_refill = false;
+        bool failed_alloc = false;
+        u64 ideal_cache_percent = 0;
+        u64 ideal_cache_offset = 0;
 
         WARN_ON(num_bytes < root->sectorsize);
         btrfs_set_key_type(ins, BTRFS_EXTENT_ITEM_KEY);
@@ -3782,14 +4175,19 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
                 empty_cluster = 0;
 
         if (search_start == hint_byte) {
+ideal_cache:
                 block_group = btrfs_lookup_block_group(root->fs_info,
                                                        search_start);
                 /*
                  * we don't want to use the block group if it doesn't match our
                  * allocation bits, or if its not cached.
+                 *
+                 * However if we are re-searching with an ideal block group
+                 * picked out then we don't care that the block group is cached.
                  */
                 if (block_group && block_group_bits(block_group, data) &&
-                    block_group_cache_done(block_group)) {
+                    (block_group->cached != BTRFS_CACHE_NO ||
+                     search_start == ideal_cache_offset)) {
                         down_read(&space_info->groups_sem);
                         if (list_empty(&block_group->list) ||
                             block_group->ro) {
@@ -3801,13 +4199,13 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
                                  */
                                 btrfs_put_block_group(block_group);
                                 up_read(&space_info->groups_sem);
-                        } else
+                        } else {
                                 goto have_block_group;
+                        }
                 } else if (block_group) {
                         btrfs_put_block_group(block_group);
                 }
         }
-
 search:
         down_read(&space_info->groups_sem);
         list_for_each_entry(block_group, &space_info->block_groups, list) {
@@ -3819,28 +4217,45 @@ search:
 
 have_block_group:
                 if (unlikely(block_group->cached == BTRFS_CACHE_NO)) {
+                        u64 free_percent;
+
+                        free_percent = btrfs_block_group_used(&block_group->item);
+                        free_percent *= 100;
+                        free_percent = div64_u64(free_percent,
+                                                 block_group->key.offset);
+                        free_percent = 100 - free_percent;
+                        if (free_percent > ideal_cache_percent &&
+                            likely(!block_group->ro)) {
+                                ideal_cache_offset = block_group->key.objectid;
+                                ideal_cache_percent = free_percent;
+                        }
+
                         /*
-                         * we want to start caching kthreads, but not too many
-                         * right off the bat so we don't overwhelm the system,
-                         * so only start them if there are less than 2 and we're
-                         * in the initial allocation phase.
+                         * We only want to start kthread caching if we are at
+                         * the point where we will wait for caching to make
+                         * progress, or if our ideal search is over and we've
+                         * found somebody to start caching.
                          */
                         if (loop > LOOP_CACHING_NOWAIT ||
-                            atomic_read(&space_info->caching_threads) < 2) {
+                            (loop > LOOP_FIND_IDEAL &&
+                             atomic_read(&space_info->caching_threads) < 2)) {
                                 ret = cache_block_group(block_group);
                                 BUG_ON(ret);
                         }
-                }
-
-                cached = block_group_cache_done(block_group);
-                if (unlikely(!cached)) {
                         found_uncached_bg = true;
 
-                        /* if we only want cached bgs, loop */
-                        if (loop == LOOP_CACHED_ONLY)
+                        /*
+                         * If loop is set for cached only, try the next block
+                         * group.
+                         */
+                        if (loop == LOOP_FIND_IDEAL)
                                 goto loop;
                 }
 
+                cached = block_group_cache_done(block_group);
+                if (unlikely(!cached))
+                        found_uncached_bg = true;
+
                 if (unlikely(block_group->ro))
                         goto loop;
 
@@ -3951,14 +4366,23 @@ refill_cluster:
 
                 offset = btrfs_find_space_for_alloc(block_group, search_start,
                                                     num_bytes, empty_size);
-                if (!offset && (cached || (!cached &&
-                                           loop == LOOP_CACHING_NOWAIT))) {
-                        goto loop;
-                } else if (!offset && (!cached &&
-                                       loop > LOOP_CACHING_NOWAIT)) {
+                /*
+                 * If we didn't find a chunk, and we haven't failed on this
+                 * block group before, and this block group is in the middle of
+                 * caching and we are ok with waiting, then go ahead and wait
+                 * for progress to be made, and set failed_alloc to true.
+                 *
+                 * If failed_alloc is true then we've already waited on this
+                 * block group once and should move on to the next block group.
+                 */
+                if (!offset && !failed_alloc && !cached &&
+                    loop > LOOP_CACHING_NOWAIT) {
                         wait_block_group_cache_progress(block_group,
-                                        num_bytes + empty_size);
+                                                num_bytes + empty_size);
+                        failed_alloc = true;
                         goto have_block_group;
+                } else if (!offset) {
+                        goto loop;
                 }
 checks:
                 search_start = stripe_align(root, offset);
@@ -4006,13 +4430,16 @@ checks:
                 break;
 loop:
                 failed_cluster_refill = false;
+                failed_alloc = false;
                 btrfs_put_block_group(block_group);
         }
         up_read(&space_info->groups_sem);
 
-        /* LOOP_CACHED_ONLY, only search fully cached block groups
-         * LOOP_CACHING_NOWAIT, search partially cached block groups, but
-         *                      dont wait foR them to finish caching
+        /* LOOP_FIND_IDEAL, only search caching/cached bg's, and don't wait for
+         *                      for them to make caching progress.  Also
+         *                      determine the best possible bg to cache
+         * LOOP_CACHING_NOWAIT, search partially cached block groups, kicking
+         *                      caching kthreads as we move along
          * LOOP_CACHING_WAIT, search everything, and wait if our bg is caching
          * LOOP_ALLOC_CHUNK, force a chunk allocation and try again
          * LOOP_NO_EMPTY_SIZE, set empty_size and empty_cluster to 0 and try
@@ -4021,12 +4448,47 @@ loop:
         if (!ins->objectid && loop < LOOP_NO_EMPTY_SIZE &&
             (found_uncached_bg || empty_size || empty_cluster ||
              allowed_chunk_alloc)) {
-                if (found_uncached_bg) {
+                if (loop == LOOP_FIND_IDEAL && found_uncached_bg) {
                         found_uncached_bg = false;
-                        if (loop < LOOP_CACHING_WAIT) {
-                                loop++;
+                        loop++;
+                        if (!ideal_cache_percent &&
+                            atomic_read(&space_info->caching_threads))
                                 goto search;
-                        }
+
+                        /*
+                         * 1 of the following 2 things have happened so far
+                         *
+                         * 1) We found an ideal block group for caching that
+                         * is mostly full and will cache quickly, so we might
+                         * as well wait for it.
+                         *
+                         * 2) We searched for cached only and we didn't find
+                         * anything, and we didn't start any caching kthreads
+                         * either, so chances are we will loop through and
+                         * start a couple caching kthreads, and then come back
+                         * around and just wait for them.  This will be slower
+                         * because we will have 2 caching kthreads reading at
+                         * the same time when we could have just started one
+                         * and waited for it to get far enough to give us an
+                         * allocation, so go ahead and go to the wait caching
+                         * loop.
+                         */
+                        loop = LOOP_CACHING_WAIT;
+                        search_start = ideal_cache_offset;
+                        ideal_cache_percent = 0;
+                        goto ideal_cache;
+                } else if (loop == LOOP_FIND_IDEAL) {
+                        /*
+                         * Didn't find a uncached bg, wait on anything we find
+                         * next.
+                         */
+                        loop = LOOP_CACHING_WAIT;
+                        goto search;
+                }
+
+                if (loop < LOOP_CACHING_WAIT) {
+                        loop++;
+                        goto search;
                 }
 
                 if (loop == LOOP_ALLOC_CHUNK) {
@@ -4038,7 +4500,8 @@ loop:
                         ret = do_chunk_alloc(trans, root, num_bytes +
                                              2 * 1024 * 1024, data, 1);
                         allowed_chunk_alloc = 0;
-                } else {
+                        done_chunk_alloc = 1;
+                } else if (!done_chunk_alloc) {
                         space_info->force_alloc = 1;
                 }
 
@@ -4063,21 +4526,32 @@ loop:
         return ret;
 }
 
-static void dump_space_info(struct btrfs_space_info *info, u64 bytes)
+static void dump_space_info(struct btrfs_space_info *info, u64 bytes,
+                            int dump_block_groups)
 {
         struct btrfs_block_group_cache *cache;
 
+        spin_lock(&info->lock);
         printk(KERN_INFO "space_info has %llu free, is %sfull\n",
                (unsigned long long)(info->total_bytes - info->bytes_used -
-                                    info->bytes_pinned - info->bytes_reserved),
+                                    info->bytes_pinned - info->bytes_reserved -
+                                    info->bytes_super),
                (info->full) ? "" : "not ");
         printk(KERN_INFO "space_info total=%llu, pinned=%llu, delalloc=%llu,"
-               " may_use=%llu, used=%llu\n",
+               " may_use=%llu, used=%llu, root=%llu, super=%llu, reserved=%llu"
+               "\n",
                (unsigned long long)info->total_bytes,
                (unsigned long long)info->bytes_pinned,
                (unsigned long long)info->bytes_delalloc,
                (unsigned long long)info->bytes_may_use,
-               (unsigned long long)info->bytes_used);
+               (unsigned long long)info->bytes_used,
+               (unsigned long long)info->bytes_root,
+               (unsigned long long)info->bytes_super,
+               (unsigned long long)info->bytes_reserved);
+        spin_unlock(&info->lock);
+
+        if (!dump_block_groups)
+                return;
 
         down_read(&info->groups_sem);
         list_for_each_entry(cache, &info->block_groups, list) {
@@ -4145,7 +4619,7 @@ again:
                 printk(KERN_ERR "btrfs allocation failed flags %llu, "
                        "wanted %llu\n", (unsigned long long)data,
                        (unsigned long long)num_bytes);
-                dump_space_info(sinfo, num_bytes);
+                dump_space_info(sinfo, num_bytes, 1);
         }
 
         return ret;
@@ -4506,6 +4980,7 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans,
         u64 bytenr;
         u64 generation;
         u64 refs;
+        u64 flags;
         u64 last = 0;
         u32 nritems;
         u32 blocksize;
@@ -4543,15 +5018,19 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans,
                     generation <= root->root_key.offset)
                         continue;
 
+                /* We don't lock the tree block, it's OK to be racy here */
+                ret = btrfs_lookup_extent_info(trans, root, bytenr, blocksize,
+                                               &refs, &flags);
+                BUG_ON(ret);
+                BUG_ON(refs == 0);
+
                 if (wc->stage == DROP_REFERENCE) {
-                        ret = btrfs_lookup_extent_info(trans, root,
-                                                bytenr, blocksize,
-                                                &refs, NULL);
-                        BUG_ON(ret);
-                        BUG_ON(refs == 0);
                         if (refs == 1)
                                 goto reada;
 
+                        if (wc->level == 1 &&
+                            (flags & BTRFS_BLOCK_FLAG_FULL_BACKREF))
+                                continue;
                         if (!wc->update_ref ||
                             generation <= root->root_key.offset)
                                 continue;
@@ -4560,6 +5039,10 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans,
                                                   &wc->update_progress);
                         if (ret < 0)
                                 continue;
+                } else {
+                        if (wc->level == 1 &&
+                            (flags & BTRFS_BLOCK_FLAG_FULL_BACKREF))
+                                continue;
                 }
 reada:
                 ret = readahead_tree_block(root, bytenr, blocksize,
@@ -4583,7 +5066,7 @@ reada:
 static noinline int walk_down_proc(struct btrfs_trans_handle *trans,
                                    struct btrfs_root *root,
                                    struct btrfs_path *path,
-                                   struct walk_control *wc)
+                                   struct walk_control *wc, int lookup_info)
 {
         int level = wc->level;
         struct extent_buffer *eb = path->nodes[level];
@@ -4598,8 +5081,9 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans,
          * when reference count of tree block is 1, it won't increase
          * again. once full backref flag is set, we never clear it.
          */
-        if ((wc->stage == DROP_REFERENCE && wc->refs[level] != 1) ||
-            (wc->stage == UPDATE_BACKREF && !(wc->flags[level] & flag))) {
+        if (lookup_info &&
+            ((wc->stage == DROP_REFERENCE && wc->refs[level] != 1) ||
+             (wc->stage == UPDATE_BACKREF && !(wc->flags[level] & flag)))) {
                 BUG_ON(!path->locks[level]);
                 ret = btrfs_lookup_extent_info(trans, root,
                                                eb->start, eb->len,
@@ -4660,7 +5144,7 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans,
 static noinline int do_walk_down(struct btrfs_trans_handle *trans,
                                  struct btrfs_root *root,
                                  struct btrfs_path *path,
-                                 struct walk_control *wc)
+                                 struct walk_control *wc, int *lookup_info)
 {
         u64 bytenr;
         u64 generation;
@@ -4680,8 +5164,10 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
          * for the subtree
          */
         if (wc->stage == UPDATE_BACKREF &&
-            generation <= root->root_key.offset)
+            generation <= root->root_key.offset) {
+                *lookup_info = 1;
                 return 1;
+        }
 
         bytenr = btrfs_node_blockptr(path->nodes[level], path->slots[level]);
         blocksize = btrfs_level_size(root, level - 1);
@@ -4694,14 +5180,19 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
         btrfs_tree_lock(next);
         btrfs_set_lock_blocking(next);
 
-        if (wc->stage == DROP_REFERENCE) {
-                ret = btrfs_lookup_extent_info(trans, root, bytenr, blocksize,
-                                               &wc->refs[level - 1],
-                                               &wc->flags[level - 1]);
-                BUG_ON(ret);
-                BUG_ON(wc->refs[level - 1] == 0);
+        ret = btrfs_lookup_extent_info(trans, root, bytenr, blocksize,
+                                       &wc->refs[level - 1],
+                                       &wc->flags[level - 1]);
+        BUG_ON(ret);
+        BUG_ON(wc->refs[level - 1] == 0);
+        *lookup_info = 0;
 
+        if (wc->stage == DROP_REFERENCE) {
                 if (wc->refs[level - 1] > 1) {
+                        if (level == 1 &&
+                            (wc->flags[0] & BTRFS_BLOCK_FLAG_FULL_BACKREF))
+                                goto skip;
+
                         if (!wc->update_ref ||
                             generation <= root->root_key.offset)
                                 goto skip;
@@ -4715,12 +5206,17 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
                         wc->stage = UPDATE_BACKREF;
                         wc->shared_level = level - 1;
                 }
+        } else {
+                if (level == 1 &&
+                    (wc->flags[0] & BTRFS_BLOCK_FLAG_FULL_BACKREF))
+                        goto skip;
         }
 
         if (!btrfs_buffer_uptodate(next, generation)) {
                 btrfs_tree_unlock(next);
                 free_extent_buffer(next);
                 next = NULL;
+                *lookup_info = 1;
         }
 
         if (!next) {
@@ -4743,21 +5239,22 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
 skip:
         wc->refs[level - 1] = 0;
         wc->flags[level - 1] = 0;
+        if (wc->stage == DROP_REFERENCE) {
+                if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF) {
+                        parent = path->nodes[level]->start;
+                } else {
+                        BUG_ON(root->root_key.objectid !=
+                               btrfs_header_owner(path->nodes[level]));
+                        parent = 0;
+                }
 
-        if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF) {
-                parent = path->nodes[level]->start;
-        } else {
-                BUG_ON(root->root_key.objectid !=
-                       btrfs_header_owner(path->nodes[level]));
-                parent = 0;
+                ret = btrfs_free_extent(trans, root, bytenr, blocksize, parent,
+                                        root->root_key.objectid, level - 1, 0);
+                BUG_ON(ret);
         }
-
-        ret = btrfs_free_extent(trans, root, bytenr, blocksize, parent,
-                                root->root_key.objectid, level - 1, 0);
-        BUG_ON(ret);
-
         btrfs_tree_unlock(next);
         free_extent_buffer(next);
+        *lookup_info = 1;
         return 1;
 }
 
@@ -4871,6 +5368,7 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
                                    struct walk_control *wc)
 {
         int level = wc->level;
+        int lookup_info = 1;
         int ret;
 
         while (level >= 0) {
@@ -4878,14 +5376,14 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
                     btrfs_header_nritems(path->nodes[level]))
                         break;
 
-                ret = walk_down_proc(trans, root, path, wc);
+                ret = walk_down_proc(trans, root, path, wc, lookup_info);
                 if (ret > 0)
                         break;
 
                 if (level == 0)
                         break;
 
-                ret = do_walk_down(trans, root, path, wc);
+                ret = do_walk_down(trans, root, path, wc, &lookup_info);
                 if (ret > 0) {
                         path->slots[level]++;
                         continue;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 0cb88f8146ea..96577e8bf9fd 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -280,6 +280,14 @@ static struct extent_buffer *buffer_search(struct extent_io_tree *tree,
         return NULL;
 }
 
+static void merge_cb(struct extent_io_tree *tree, struct extent_state *new,
+                     struct extent_state *other)
+{
+        if (tree->ops && tree->ops->merge_extent_hook)
+                tree->ops->merge_extent_hook(tree->mapping->host, new,
+                                             other);
+}
+
 /*
  * utility function to look for merge candidates inside a given range.
  * Any extents with matching state are merged together into a single
@@ -303,6 +311,7 @@ static int merge_state(struct extent_io_tree *tree,
                 other = rb_entry(other_node, struct extent_state, rb_node);
                 if (other->end == state->start - 1 &&
                     other->state == state->state) {
+                        merge_cb(tree, state, other);
                         state->start = other->start;
                         other->tree = NULL;
                         rb_erase(&other->rb_node, &tree->state);
@@ -314,33 +323,37 @@ static int merge_state(struct extent_io_tree *tree,
                 other = rb_entry(other_node, struct extent_state, rb_node);
                 if (other->start == state->end + 1 &&
                     other->state == state->state) {
+                        merge_cb(tree, state, other);
                         other->start = state->start;
                         state->tree = NULL;
                         rb_erase(&state->rb_node, &tree->state);
                         free_extent_state(state);
+                        state = NULL;
                 }
         }
+
         return 0;
 }
 
-static void set_state_cb(struct extent_io_tree *tree,
+static int set_state_cb(struct extent_io_tree *tree,
                          struct extent_state *state,
                          unsigned long bits)
 {
         if (tree->ops && tree->ops->set_bit_hook) {
-                tree->ops->set_bit_hook(tree->mapping->host, state->start,
-                                        state->end, state->state, bits);
+                return tree->ops->set_bit_hook(tree->mapping->host,
+                                               state->start, state->end,
+                                               state->state, bits);
         }
+
+        return 0;
 }
 
 static void clear_state_cb(struct extent_io_tree *tree,
                            struct extent_state *state,
                            unsigned long bits)
 {
-        if (tree->ops && tree->ops->clear_bit_hook) {
-                tree->ops->clear_bit_hook(tree->mapping->host, state->start,
-                                          state->end, state->state, bits);
-        }
+        if (tree->ops && tree->ops->clear_bit_hook)
+                tree->ops->clear_bit_hook(tree->mapping->host, state, bits);
 }
 
 /*
@@ -358,6 +371,7 @@ static int insert_state(struct extent_io_tree *tree,
                         int bits)
 {
         struct rb_node *node;
+        int ret;
 
         if (end < start) {
                 printk(KERN_ERR "btrfs end < start %llu %llu\n",
@@ -365,11 +379,14 @@ static int insert_state(struct extent_io_tree *tree,
                        (unsigned long long)start);
                 WARN_ON(1);
         }
-        if (bits & EXTENT_DIRTY)
-                tree->dirty_bytes += end - start + 1;
         state->start = start;
         state->end = end;
-        set_state_cb(tree, state, bits);
+        ret = set_state_cb(tree, state, bits);
+        if (ret)
+                return ret;
+
+        if (bits & EXTENT_DIRTY)
+                tree->dirty_bytes += end - start + 1;
         state->state |= bits;
         node = tree_insert(&tree->state, end, &state->rb_node);
         if (node) {
@@ -387,6 +404,15 @@ static int insert_state(struct extent_io_tree *tree,
         return 0;
 }
 
+static int split_cb(struct extent_io_tree *tree, struct extent_state *orig,
+                     u64 split)
+{
+        if (tree->ops && tree->ops->split_extent_hook)
+                return tree->ops->split_extent_hook(tree->mapping->host,
+                                                    orig, split);
+        return 0;
+}
+
 /*
  * split a given extent state struct in two, inserting the preallocated
  * struct 'prealloc' as the newly created second half.  'split' indicates an
@@ -405,6 +431,9 @@ static int split_state(struct extent_io_tree *tree, struct extent_state *orig,
                        struct extent_state *prealloc, u64 split)
 {
         struct rb_node *node;
+
+        split_cb(tree, orig, split);
+
         prealloc->start = orig->start;
         prealloc->end = split - 1;
         prealloc->state = orig->state;
@@ -431,7 +460,8 @@ static int clear_state_bit(struct extent_io_tree *tree,
                             struct extent_state *state, int bits, int wake,
                             int delete)
 {
-        int ret = state->state & bits;
+        int bits_to_clear = bits & ~EXTENT_DO_ACCOUNTING;
+        int ret = state->state & bits_to_clear;
 
         if ((bits & EXTENT_DIRTY) && (state->state & EXTENT_DIRTY)) {
                 u64 range = state->end - state->start + 1;
@@ -439,7 +469,7 @@ static int clear_state_bit(struct extent_io_tree *tree,
                 tree->dirty_bytes -= range;
         }
         clear_state_cb(tree, state, bits);
-        state->state &= ~bits;
+        state->state &= ~bits_to_clear;
         if (wake)
                 wake_up(&state->wq);
         if (delete || state->state == 0) {
@@ -542,8 +572,8 @@ hit_next:
                 if (err)
                         goto out;
                 if (state->end <= end) {
-                        set |= clear_state_bit(tree, state, bits,
-                                        wake, delete);
+                        set |= clear_state_bit(tree, state, bits, wake,
+                                               delete);
                         if (last_end == (u64)-1)
                                 goto out;
                         start = last_end + 1;
@@ -561,12 +591,11 @@ hit_next:
                         prealloc = alloc_extent_state(GFP_ATOMIC);
                 err = split_state(tree, state, prealloc, end + 1);
                 BUG_ON(err == -EEXIST);
-
                 if (wake)
                         wake_up(&state->wq);
 
-                set |= clear_state_bit(tree, prealloc, bits,
-                                       wake, delete);
+                set |= clear_state_bit(tree, prealloc, bits, wake, delete);
+
                 prealloc = NULL;
                 goto out;
         }
@@ -667,16 +696,23 @@ out:
         return 0;
 }
 
-static void set_state_bits(struct extent_io_tree *tree,
+static int set_state_bits(struct extent_io_tree *tree,
                            struct extent_state *state,
                            int bits)
 {
+        int ret;
+
+        ret = set_state_cb(tree, state, bits);
+        if (ret)
+                return ret;
+
         if ((bits & EXTENT_DIRTY) && !(state->state & EXTENT_DIRTY)) {
                 u64 range = state->end - state->start + 1;
                 tree->dirty_bytes += range;
         }
-        set_state_cb(tree, state, bits);
         state->state |= bits;
+
+        return 0;
 }
 
 static void cache_state(struct extent_state *state,
@@ -758,7 +794,10 @@ hit_next:
                         goto out;
                 }
 
-                set_state_bits(tree, state, bits);
+                err = set_state_bits(tree, state, bits);
+                if (err)
+                        goto out;
+
                 cache_state(state, cached_state);
                 merge_state(tree, state);
                 if (last_end == (u64)-1)
@@ -805,7 +844,9 @@ hit_next:
                 if (err)
                         goto out;
                 if (state->end <= end) {
-                        set_state_bits(tree, state, bits);
+                        err = set_state_bits(tree, state, bits);
+                        if (err)
+                                goto out;
                         cache_state(state, cached_state);
                         merge_state(tree, state);
                         if (last_end == (u64)-1)
@@ -829,11 +870,13 @@ hit_next:
                         this_end = last_start - 1;
                 err = insert_state(tree, prealloc, start, this_end,
                                    bits);
-                cache_state(prealloc, cached_state);
-                prealloc = NULL;
                 BUG_ON(err == -EEXIST);
-                if (err)
+                if (err) {
+                        prealloc = NULL;
                         goto out;
+                }
+                cache_state(prealloc, cached_state);
+                prealloc = NULL;
                 start = this_end + 1;
                 goto search_again;
         }
@@ -852,7 +895,11 @@ hit_next:
                 err = split_state(tree, state, prealloc, end + 1);
                 BUG_ON(err == -EEXIST);
 
-                set_state_bits(tree, prealloc, bits);
+                err = set_state_bits(tree, prealloc, bits);
+                if (err) {
+                        prealloc = NULL;
+                        goto out;
+                }
                 cache_state(prealloc, cached_state);
                 merge_state(tree, prealloc);
                 prealloc = NULL;
@@ -910,7 +957,8 @@ int clear_extent_dirty(struct extent_io_tree *tree, u64 start, u64 end,
                        gfp_t mask)
 {
         return clear_extent_bit(tree, start, end,
-                                EXTENT_DIRTY | EXTENT_DELALLOC, 0, 0,
+                                EXTENT_DIRTY | EXTENT_DELALLOC |
+                                EXTENT_DO_ACCOUNTING, 0, 0,
                                 NULL, mask);
 }
 
@@ -1355,12 +1403,7 @@ out_failed:
 int extent_clear_unlock_delalloc(struct inode *inode,
                                 struct extent_io_tree *tree,
                                 u64 start, u64 end, struct page *locked_page,
-                                int unlock_pages,
-                                int clear_unlock,
-                                int clear_delalloc, int clear_dirty,
-                                int set_writeback,
-                                int end_writeback,
-                                int set_private2)
+                                unsigned long op)
 {
         int ret;
         struct page *pages[16];
@@ -1370,17 +1413,21 @@ int extent_clear_unlock_delalloc(struct inode *inode,
         int i;
         int clear_bits = 0;
 
-        if (clear_unlock)
+        if (op & EXTENT_CLEAR_UNLOCK)
                 clear_bits |= EXTENT_LOCKED;
-        if (clear_dirty)
+        if (op & EXTENT_CLEAR_DIRTY)
                 clear_bits |= EXTENT_DIRTY;
 
-        if (clear_delalloc)
+        if (op & EXTENT_CLEAR_DELALLOC)
                 clear_bits |= EXTENT_DELALLOC;
 
+        if (op & EXTENT_CLEAR_ACCOUNTING)
+                clear_bits |= EXTENT_DO_ACCOUNTING;
+
         clear_extent_bit(tree, start, end, clear_bits, 1, 0, NULL, GFP_NOFS);
-        if (!(unlock_pages || clear_dirty || set_writeback || end_writeback ||
-              set_private2))
+        if (!(op & (EXTENT_CLEAR_UNLOCK_PAGE | EXTENT_CLEAR_DIRTY |
+                    EXTENT_SET_WRITEBACK | EXTENT_END_WRITEBACK |
+                    EXTENT_SET_PRIVATE2)))
                 return 0;
 
         while (nr_pages > 0) {
@@ -1389,20 +1436,20 @@ int extent_clear_unlock_delalloc(struct inode *inode,
                                      nr_pages, ARRAY_SIZE(pages)), pages);
                 for (i = 0; i < ret; i++) {
 
-                        if (set_private2)
+                        if (op & EXTENT_SET_PRIVATE2)
                                 SetPagePrivate2(pages[i]);
 
                         if (pages[i] == locked_page) {
                                 page_cache_release(pages[i]);
                                 continue;
                         }
-                        if (clear_dirty)
+                        if (op & EXTENT_CLEAR_DIRTY)
                                 clear_page_dirty_for_io(pages[i]);
-                        if (set_writeback)
+                        if (op & EXTENT_SET_WRITEBACK)
                                 set_page_writeback(pages[i]);
-                        if (end_writeback)
+                        if (op & EXTENT_END_WRITEBACK)
                                 end_page_writeback(pages[i]);
-                        if (unlock_pages)
+                        if (op & EXTENT_CLEAR_UNLOCK_PAGE)
                                 unlock_page(pages[i]);
                         page_cache_release(pages[i]);
                 }
@@ -2668,7 +2715,8 @@ int extent_invalidatepage(struct extent_io_tree *tree,
         lock_extent(tree, start, end, GFP_NOFS);
         wait_on_page_writeback(page);
         clear_extent_bit(tree, start, end,
-                         EXTENT_LOCKED | EXTENT_DIRTY | EXTENT_DELALLOC,
+                         EXTENT_LOCKED | EXTENT_DIRTY | EXTENT_DELALLOC |
+                         EXTENT_DO_ACCOUNTING,
                          1, 1, NULL, GFP_NOFS);
         return 0;
 }
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 14ed16fd862d..36de250a7b2b 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -15,6 +15,7 @@
 #define EXTENT_BUFFER_FILLED (1 << 8)
 #define EXTENT_BOUNDARY (1 << 9)
 #define EXTENT_NODATASUM (1 << 10)
+#define EXTENT_DO_ACCOUNTING (1 << 11)
 #define EXTENT_IOBITS (EXTENT_LOCKED | EXTENT_WRITEBACK)
 
 /* flags for bio submission */
@@ -25,6 +26,16 @@
 #define EXTENT_BUFFER_BLOCKING 1
 #define EXTENT_BUFFER_DIRTY 2
 
+/* these are flags for extent_clear_unlock_delalloc */
+#define EXTENT_CLEAR_UNLOCK_PAGE 0x1
+#define EXTENT_CLEAR_UNLOCK      0x2
+#define EXTENT_CLEAR_DELALLOC    0x4
+#define EXTENT_CLEAR_DIRTY       0x8
+#define EXTENT_SET_WRITEBACK     0x10
+#define EXTENT_END_WRITEBACK     0x20
+#define EXTENT_SET_PRIVATE2      0x40
+#define EXTENT_CLEAR_ACCOUNTING  0x80
+
 /*
  * page->private values.  Every page that is controlled by the extent
  * map has page->private set to one.
@@ -60,8 +71,13 @@ struct extent_io_ops {
                                       struct extent_state *state, int uptodate);
         int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
                             unsigned long old, unsigned long bits);
-        int (*clear_bit_hook)(struct inode *inode, u64 start, u64 end,
-                            unsigned long old, unsigned long bits);
+        int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
+                              unsigned long bits);
+        int (*merge_extent_hook)(struct inode *inode,
+                                 struct extent_state *new,
+                                 struct extent_state *other);
+        int (*split_extent_hook)(struct inode *inode,
+                                 struct extent_state *orig, u64 split);
         int (*write_cache_pages_lock_hook)(struct page *page);
 };
 
@@ -79,10 +95,14 @@ struct extent_state {
         u64 start;
         u64 end; /* inclusive */
         struct rb_node rb_node;
+
+        /* ADD NEW ELEMENTS AFTER THIS */
         struct extent_io_tree *tree;
         wait_queue_head_t wq;
         atomic_t refs;
         unsigned long state;
+        u64 split_start;
+        u64 split_end;
 
         /* for use by the FS */
         u64 private;
@@ -279,10 +299,5 @@ int extent_range_uptodate(struct extent_io_tree *tree,
 int extent_clear_unlock_delalloc(struct inode *inode,
                                 struct extent_io_tree *tree,
                                 u64 start, u64 end, struct page *locked_page,
-                                int unlock_page,
-                                int clear_unlock,
-                                int clear_delalloc, int clear_dirty,
-                                int set_writeback,
-                                int end_writeback,
-                                int set_private2);
+                                unsigned long op);
 #endif
diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 2c726b7b9faa..ccbdcb54ec5d 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -208,7 +208,7 @@ int unpin_extent_cache(struct extent_map_tree *tree, u64 start, u64 len)
         write_lock(&tree->lock);
         em = lookup_extent_mapping(tree, start, len);
 
-        WARN_ON(em->start != start || !em);
+        WARN_ON(!em || em->start != start);
 
         if (!em)
                 goto out;
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index a3492a3ad96b..06550affbd27 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -123,7 +123,10 @@ static noinline int dirty_and_release_pages(struct btrfs_trans_handle *trans,
                     root->sectorsize - 1) & ~((u64)root->sectorsize - 1);
 
         end_of_last_block = start_pos + num_bytes - 1;
-        btrfs_set_extent_delalloc(inode, start_pos, end_of_last_block);
+        err = btrfs_set_extent_delalloc(inode, start_pos, end_of_last_block);
+        if (err)
+                return err;
+
         for (i = 0; i < num_pages; i++) {
                 struct page *p = pages[i];
                 SetPageUptodate(p);
@@ -875,7 +878,8 @@ again:
                         btrfs_put_ordered_extent(ordered);
 
                 clear_extent_bits(&BTRFS_I(inode)->io_tree, start_pos,
-                                  last_pos - 1, EXTENT_DIRTY | EXTENT_DELALLOC,
+                                  last_pos - 1, EXTENT_DIRTY | EXTENT_DELALLOC |
+                                  EXTENT_DO_ACCOUNTING,
                                   GFP_NOFS);
                 unlock_extent(&BTRFS_I(inode)->io_tree,
                               start_pos, last_pos - 1, GFP_NOFS);
@@ -917,21 +921,35 @@ static ssize_t btrfs_file_write(struct file *file, const char __user *buf,
         start_pos = pos;
 
         vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
+
+        /* do the reserve before the mutex lock in case we have to do some
+         * flushing.  We wouldn't deadlock, but this is more polite.
+         */
+        err = btrfs_reserve_metadata_for_delalloc(root, inode, 1);
+        if (err)
+                goto out_nolock;
+
+        mutex_lock(&inode->i_mutex);
+
         current->backing_dev_info = inode->i_mapping->backing_dev_info;
         err = generic_write_checks(file, &pos, &count, S_ISBLK(inode->i_mode));
         if (err)
-                goto out_nolock;
+                goto out;
+
         if (count == 0)
-                goto out_nolock;
+                goto out;
 
         err = file_remove_suid(file);
         if (err)
-                goto out_nolock;
+                goto out;
+
         file_update_time(file);
 
         pages = kmalloc(nrptrs * sizeof(struct page *), GFP_KERNEL);
 
-        mutex_lock(&inode->i_mutex);
+        /* generic_write_checks can change our pos */
+        start_pos = pos;
+
         BTRFS_I(inode)->sequence++;
         first_index = pos >> PAGE_CACHE_SHIFT;
         last_index = (pos + count) >> PAGE_CACHE_SHIFT;
@@ -1005,9 +1023,8 @@ static ssize_t btrfs_file_write(struct file *file, const char __user *buf,
                 }
 
                 if (will_write) {
-                        btrfs_fdatawrite_range(inode->i_mapping, pos,
-                                               pos + write_bytes - 1,
-                                               WB_SYNC_ALL);
+                        filemap_fdatawrite_range(inode->i_mapping, pos,
+                                                 pos + write_bytes - 1);
                 } else {
                         balance_dirty_pages_ratelimited_nr(inode->i_mapping,
                                                            num_pages);
@@ -1028,6 +1045,7 @@ out:
         mutex_unlock(&inode->i_mutex);
         if (ret)
                 err = ret;
+        btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
 
 out_nolock:
         kfree(pages);
@@ -1068,8 +1086,10 @@ out_nolock:
                                         btrfs_end_transaction(trans, root);
                                 else
                                         btrfs_commit_transaction(trans, root);
-                        } else {
+                        } else if (ret != BTRFS_NO_LOG_SYNC) {
                                 btrfs_commit_transaction(trans, root);
+                        } else {
+                                btrfs_end_transaction(trans, root);
                         }
                 }
                 if (file->f_flags & O_DIRECT) {
@@ -1119,6 +1139,13 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
         int ret = 0;
         struct btrfs_trans_handle *trans;
 
+
+        /* we wait first, since the writeback may change the inode */
+        root->log_batch++;
+        /* the VFS called filemap_fdatawrite for us */
+        btrfs_wait_ordered_range(inode, 0, (u64)-1);
+        root->log_batch++;
+
         /*
          * check the transaction that last modified this inode
          * and see if its already been committed
@@ -1126,6 +1153,11 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
         if (!BTRFS_I(inode)->last_trans)
                 goto out;
 
+        /*
+         * if the last transaction that changed this file was before
+         * the current transaction, we can bail out now without any
+         * syncing
+         */
         mutex_lock(&root->fs_info->trans_mutex);
         if (BTRFS_I(inode)->last_trans <=
             root->fs_info->last_trans_committed) {
@@ -1135,13 +1167,6 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
         }
         mutex_unlock(&root->fs_info->trans_mutex);
 
-        root->log_batch++;
-        filemap_fdatawrite(inode->i_mapping);
-        btrfs_wait_ordered_range(inode, 0, (u64)-1);
-        root->log_batch++;
-
-        if (datasync && !(inode->i_state & I_DIRTY_PAGES))
-                goto out;
         /*
          * ok we haven't committed the transaction yet, lets do a commit
          */
@@ -1170,14 +1195,18 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
          */
         mutex_unlock(&dentry->d_inode->i_mutex);
 
-        if (ret > 0) {
-                ret = btrfs_commit_transaction(trans, root);
-        } else {
-                ret = btrfs_sync_log(trans, root);
-                if (ret == 0)
-                        ret = btrfs_end_transaction(trans, root);
-                else
+        if (ret != BTRFS_NO_LOG_SYNC) {
+                if (ret > 0) {
                         ret = btrfs_commit_transaction(trans, root);
+                } else {
+                        ret = btrfs_sync_log(trans, root);
+                        if (ret == 0)
+                                ret = btrfs_end_transaction(trans, root);
+                        else
+                                ret = btrfs_commit_transaction(trans, root);
+                }
+        } else {
+                ret = btrfs_end_transaction(trans, root);
         }
         mutex_lock(&dentry->d_inode->i_mutex);
 out:
@@ -1196,7 +1225,7 @@ static int btrfs_file_mmap(struct file	*filp, struct vm_area_struct *vma)
         return 0;
 }
 
-struct file_operations btrfs_file_operations = {
+const struct file_operations btrfs_file_operations = {
         .llseek         = generic_file_llseek,
         .read           = do_sync_read,
         .aio_read       = generic_file_aio_read,
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 5c2caad76212..cb2849f03251 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1296,7 +1296,7 @@ again:
                         window_start = entry->offset;
                         window_free = entry->bytes;
                         last = entry;
-                        max_extent = 0;
+                        max_extent = entry->bytes;
                 } else {
                         last = next;
                         window_free += next->bytes;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index e9b76bcd1c12..b3ad168a0bfc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -62,7 +62,7 @@ static const struct inode_operations btrfs_special_inode_operations;
 static const struct inode_operations btrfs_file_inode_operations;
 static const struct address_space_operations btrfs_aops;
 static const struct address_space_operations btrfs_symlink_aops;
-static struct file_operations btrfs_dir_file_operations;
+static const struct file_operations btrfs_dir_file_operations;
 static struct extent_io_ops btrfs_extent_io_ops;
 
 static struct kmem_cache *btrfs_inode_cachep;
@@ -424,9 +424,12 @@ again:
                          * and free up our temp pages.
                          */
                         extent_clear_unlock_delalloc(inode,
-                                                     &BTRFS_I(inode)->io_tree,
-                                                     start, end, NULL, 1, 0,
-                                                     0, 1, 1, 1, 0);
+                             &BTRFS_I(inode)->io_tree,
+                             start, end, NULL,
+                             EXTENT_CLEAR_UNLOCK_PAGE | EXTENT_CLEAR_DIRTY |
+                             EXTENT_CLEAR_DELALLOC |
+                             EXTENT_CLEAR_ACCOUNTING |
+                             EXTENT_SET_WRITEBACK | EXTENT_END_WRITEBACK);
                         ret = 0;
                         goto free_pages_out;
                 }
@@ -535,7 +538,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
         struct extent_io_tree *io_tree;
-        int ret;
+        int ret = 0;
 
         if (list_empty(&async_cow->extents))
                 return 0;
@@ -549,6 +552,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
 
                 io_tree = &BTRFS_I(inode)->io_tree;
 
+retry:
                 /* did the compression code fall back to uncompressed IO? */
                 if (!async_extent->pages) {
                         int page_started = 0;
@@ -559,11 +563,11 @@ static noinline int submit_compressed_extents(struct inode *inode,
                                     async_extent->ram_size - 1, GFP_NOFS);
 
                         /* allocate blocks */
-                        cow_file_range(inode, async_cow->locked_page,
-                                       async_extent->start,
-                                       async_extent->start +
-                                       async_extent->ram_size - 1,
-                                       &page_started, &nr_written, 0);
+                        ret = cow_file_range(inode, async_cow->locked_page,
+                                             async_extent->start,
+                                             async_extent->start +
+                                             async_extent->ram_size - 1,
+                                             &page_started, &nr_written, 0);
 
                         /*
                          * if page_started, cow_file_range inserted an
@@ -571,7 +575,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
                          * and IO for us.  Otherwise, we need to submit
                          * all those pages down to the drive.
                          */
-                        if (!page_started)
+                        if (!page_started && !ret)
                                 extent_write_locked_range(io_tree,
                                                   inode, async_extent->start,
                                                   async_extent->start +
@@ -599,7 +603,21 @@ static noinline int submit_compressed_extents(struct inode *inode,
                                            async_extent->compressed_size,
                                            0, alloc_hint,
                                            (u64)-1, &ins, 1);
-                BUG_ON(ret);
+                if (ret) {
+                        int i;
+                        for (i = 0; i < async_extent->nr_pages; i++) {
+                                WARN_ON(async_extent->pages[i]->mapping);
+                                page_cache_release(async_extent->pages[i]);
+                        }
+                        kfree(async_extent->pages);
+                        async_extent->nr_pages = 0;
+                        async_extent->pages = NULL;
+                        unlock_extent(io_tree, async_extent->start,
+                                      async_extent->start +
+                                      async_extent->ram_size - 1, GFP_NOFS);
+                        goto retry;
+                }
+
                 em = alloc_extent_map(GFP_NOFS);
                 em->start = async_extent->start;
                 em->len = async_extent->ram_size;
@@ -637,11 +655,14 @@ static noinline int submit_compressed_extents(struct inode *inode,
                  * clear dirty, set writeback and unlock the pages.
                  */
                 extent_clear_unlock_delalloc(inode,
-                                             &BTRFS_I(inode)->io_tree,
-                                             async_extent->start,
-                                             async_extent->start +
-                                             async_extent->ram_size - 1,
-                                             NULL, 1, 1, 0, 1, 1, 0, 0);
+                                &BTRFS_I(inode)->io_tree,
+                                async_extent->start,
+                                async_extent->start +
+                                async_extent->ram_size - 1,
+                                NULL, EXTENT_CLEAR_UNLOCK_PAGE |
+                                EXTENT_CLEAR_UNLOCK |
+                                EXTENT_CLEAR_DELALLOC |
+                                EXTENT_CLEAR_DIRTY | EXTENT_SET_WRITEBACK);
 
                 ret = btrfs_submit_compressed_write(inode,
                                     async_extent->start,
@@ -712,9 +733,15 @@ static noinline int cow_file_range(struct inode *inode,
                                             start, end, 0, NULL);
                 if (ret == 0) {
                         extent_clear_unlock_delalloc(inode,
-                                                     &BTRFS_I(inode)->io_tree,
-                                                     start, end, NULL, 1, 1,
-                                                     1, 1, 1, 1, 0);
+                                     &BTRFS_I(inode)->io_tree,
+                                     start, end, NULL,
+                                     EXTENT_CLEAR_UNLOCK_PAGE |
+                                     EXTENT_CLEAR_UNLOCK |
+                                     EXTENT_CLEAR_DELALLOC |
+                                     EXTENT_CLEAR_ACCOUNTING |
+                                     EXTENT_CLEAR_DIRTY |
+                                     EXTENT_SET_WRITEBACK |
+                                     EXTENT_END_WRITEBACK);
                         *nr_written = *nr_written +
                              (end - start + PAGE_CACHE_SIZE) / PAGE_CACHE_SIZE;
                         *page_started = 1;
@@ -731,13 +758,29 @@ static noinline int cow_file_range(struct inode *inode,
         em = search_extent_mapping(&BTRFS_I(inode)->extent_tree,
                                    start, num_bytes);
         if (em) {
-                alloc_hint = em->block_start;
-                free_extent_map(em);
+                /*
+                 * if block start isn't an actual block number then find the
+                 * first block in this inode and use that as a hint.  If that
+                 * block is also bogus then just don't worry about it.
+                 */
+                if (em->block_start >= EXTENT_MAP_LAST_BYTE) {
+                        free_extent_map(em);
+                        em = search_extent_mapping(em_tree, 0, 0);
+                        if (em && em->block_start < EXTENT_MAP_LAST_BYTE)
+                                alloc_hint = em->block_start;
+                        if (em)
+                                free_extent_map(em);
+                } else {
+                        alloc_hint = em->block_start;
+                        free_extent_map(em);
+                }
         }
         read_unlock(&BTRFS_I(inode)->extent_tree.lock);
         btrfs_drop_extent_cache(inode, start, start + num_bytes - 1, 0);
 
         while (disk_num_bytes > 0) {
+                unsigned long op;
+
                 cur_alloc_size = min(disk_num_bytes, root->fs_info->max_extent);
                 ret = btrfs_reserve_extent(trans, root, cur_alloc_size,
                                            root->sectorsize, 0, alloc_hint,
@@ -789,10 +832,13 @@ static noinline int cow_file_range(struct inode *inode,
                  * Do set the Private2 bit so we know this page was properly
                  * setup for writepage
                  */
+                op = unlock ? EXTENT_CLEAR_UNLOCK_PAGE : 0;
+                op |= EXTENT_CLEAR_UNLOCK | EXTENT_CLEAR_DELALLOC |
+                        EXTENT_SET_PRIVATE2;
+
                 extent_clear_unlock_delalloc(inode, &BTRFS_I(inode)->io_tree,
                                              start, start + ram_size - 1,
-                                             locked_page, unlock, 1,
-                                             1, 0, 0, 0, 1);
+                                             locked_page, op);
                 disk_num_bytes -= cur_alloc_size;
                 num_bytes -= cur_alloc_size;
                 alloc_hint = ins.objectid + ins.offset;
@@ -864,8 +910,8 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page,
         u64 cur_end;
         int limit = 10 * 1024 * 1042;
 
-        clear_extent_bit(&BTRFS_I(inode)->io_tree, start, end, EXTENT_LOCKED |
-                         EXTENT_DELALLOC, 1, 0, NULL, GFP_NOFS);
+        clear_extent_bit(&BTRFS_I(inode)->io_tree, start, end, EXTENT_LOCKED,
+                         1, 0, NULL, GFP_NOFS);
         while (start < end) {
                 async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
                 async_cow->inode = inode;
@@ -1006,6 +1052,7 @@ next_slot:
 
                 if (found_key.offset > cur_offset) {
                         extent_end = found_key.offset;
+                        extent_type = 0;
                         goto out_check;
                 }
 
@@ -1112,8 +1159,10 @@ out_check:
                 BUG_ON(ret);
 
                 extent_clear_unlock_delalloc(inode, &BTRFS_I(inode)->io_tree,
-                                        cur_offset, cur_offset + num_bytes - 1,
-                                        locked_page, 1, 1, 1, 0, 0, 0, 1);
+                                cur_offset, cur_offset + num_bytes - 1,
+                                locked_page, EXTENT_CLEAR_UNLOCK_PAGE |
+                                EXTENT_CLEAR_UNLOCK | EXTENT_CLEAR_DELALLOC |
+                                EXTENT_SET_PRIVATE2);
                 cur_offset = extent_end;
                 if (cur_offset > end)
                         break;
@@ -1159,6 +1208,89 @@ static int run_delalloc_range(struct inode *inode, struct page *locked_page,
         return ret;
 }
 
+static int btrfs_split_extent_hook(struct inode *inode,
+                                    struct extent_state *orig, u64 split)
+{
+        struct btrfs_root *root = BTRFS_I(inode)->root;
+        u64 size;
+
+        if (!(orig->state & EXTENT_DELALLOC))
+                return 0;
+
+        size = orig->end - orig->start + 1;
+        if (size > root->fs_info->max_extent) {
+                u64 num_extents;
+                u64 new_size;
+
+                new_size = orig->end - split + 1;
+                num_extents = div64_u64(size + root->fs_info->max_extent - 1,
+                                        root->fs_info->max_extent);
+
+                /*
+                 * if we break a large extent up then leave oustanding_extents
+                 * be, since we've already accounted for the large extent.
+                 */
+                if (div64_u64(new_size + root->fs_info->max_extent - 1,
+                              root->fs_info->max_extent) < num_extents)
+                        return 0;
+        }
+
+        spin_lock(&BTRFS_I(inode)->accounting_lock);
+        BTRFS_I(inode)->outstanding_extents++;
+        spin_unlock(&BTRFS_I(inode)->accounting_lock);
+
+        return 0;
+}
+
+/*
+ * extent_io.c merge_extent_hook, used to track merged delayed allocation
+ * extents so we can keep track of new extents that are just merged onto old
+ * extents, such as when we are doing sequential writes, so we can properly
+ * account for the metadata space we'll need.
+ */
+static int btrfs_merge_extent_hook(struct inode *inode,
+                                   struct extent_state *new,
+                                   struct extent_state *other)
+{
+        struct btrfs_root *root = BTRFS_I(inode)->root;
+        u64 new_size, old_size;
+        u64 num_extents;
+
+        /* not delalloc, ignore it */
+        if (!(other->state & EXTENT_DELALLOC))
+                return 0;
+
+        old_size = other->end - other->start + 1;
+        if (new->start < other->start)
+                new_size = other->end - new->start + 1;
+        else
+                new_size = new->end - other->start + 1;
+
+        /* we're not bigger than the max, unreserve the space and go */
+        if (new_size <= root->fs_info->max_extent) {
+                spin_lock(&BTRFS_I(inode)->accounting_lock);
+                BTRFS_I(inode)->outstanding_extents--;
+                spin_unlock(&BTRFS_I(inode)->accounting_lock);
+                return 0;
+        }
+
+        /*
+         * If we grew by another max_extent, just return, we want to keep that
+         * reserved amount.
+         */
+        num_extents = div64_u64(old_size + root->fs_info->max_extent - 1,
+                                root->fs_info->max_extent);
+        if (div64_u64(new_size + root->fs_info->max_extent - 1,
+                      root->fs_info->max_extent) > num_extents)
+                return 0;
+
+        spin_lock(&BTRFS_I(inode)->accounting_lock);
+        BTRFS_I(inode)->outstanding_extents--;
+        spin_unlock(&BTRFS_I(inode)->accounting_lock);
+
+        return 0;
+}
+
 /*
  * extent_io.c set_bit_hook, used to track delayed allocation
  * bytes in this file, and to maintain the list of inodes that
@@ -1167,6 +1299,7 @@ static int run_delalloc_range(struct inode *inode, struct page *locked_page,
 static int btrfs_set_bit_hook(struct inode *inode, u64 start, u64 end,
                        unsigned long old, unsigned long bits)
 {
+
         /*
          * set_bit and clear bit hooks normally require _irqsave/restore
          * but in this case, we are only testeing for the DELALLOC
@@ -1174,6 +1307,10 @@ static int btrfs_set_bit_hook(struct inode *inode, u64 start, u64 end,
          */
         if (!(old & EXTENT_DELALLOC) && (bits & EXTENT_DELALLOC)) {
                 struct btrfs_root *root = BTRFS_I(inode)->root;
+
+                spin_lock(&BTRFS_I(inode)->accounting_lock);
+                BTRFS_I(inode)->outstanding_extents++;
+                spin_unlock(&BTRFS_I(inode)->accounting_lock);
                 btrfs_delalloc_reserve_space(root, inode, end - start + 1);
                 spin_lock(&root->fs_info->delalloc_lock);
                 BTRFS_I(inode)->delalloc_bytes += end - start + 1;
@@ -1190,22 +1327,31 @@ static int btrfs_set_bit_hook(struct inode *inode, u64 start, u64 end,
 /*
  * extent_io.c clear_bit_hook, see set_bit_hook for why
  */
-static int btrfs_clear_bit_hook(struct inode *inode, u64 start, u64 end,
-                         unsigned long old, unsigned long bits)
+static int btrfs_clear_bit_hook(struct inode *inode,
+                                struct extent_state *state, unsigned long bits)
 {
         /*
          * set_bit and clear bit hooks normally require _irqsave/restore
          * but in this case, we are only testeing for the DELALLOC
          * bit, which is only set or cleared with irqs on
          */
-        if ((old & EXTENT_DELALLOC) && (bits & EXTENT_DELALLOC)) {
+        if ((state->state & EXTENT_DELALLOC) && (bits & EXTENT_DELALLOC)) {
                 struct btrfs_root *root = BTRFS_I(inode)->root;
 
+                if (bits & EXTENT_DO_ACCOUNTING) {
+                        spin_lock(&BTRFS_I(inode)->accounting_lock);
+                        BTRFS_I(inode)->outstanding_extents--;
+                        spin_unlock(&BTRFS_I(inode)->accounting_lock);
+                        btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
+                }
+
                 spin_lock(&root->fs_info->delalloc_lock);
-                if (end - start + 1 > root->fs_info->delalloc_bytes) {
+                if (state->end - state->start + 1 >
+                    root->fs_info->delalloc_bytes) {
                         printk(KERN_INFO "btrfs warning: delalloc account "
                                "%llu %llu\n",
-                               (unsigned long long)end - start + 1,
+                               (unsigned long long)
+                               state->end - state->start + 1,
                                (unsigned long long)
                                root->fs_info->delalloc_bytes);
                         btrfs_delalloc_free_space(root, inode, (u64)-1);
@@ -1213,9 +1359,12 @@ static int btrfs_clear_bit_hook(struct inode *inode, u64 start, u64 end,
                         BTRFS_I(inode)->delalloc_bytes = 0;
                 } else {
                         btrfs_delalloc_free_space(root, inode,
-                                                  end - start + 1);
-                        root->fs_info->delalloc_bytes -= end - start + 1;
-                        BTRFS_I(inode)->delalloc_bytes -= end - start + 1;
+                                                  state->end -
+                                                  state->start + 1);
+                        root->fs_info->delalloc_bytes -= state->end -
+                                state->start + 1;
+                        BTRFS_I(inode)->delalloc_bytes -= state->end -
+                                state->start + 1;
                 }
                 if (BTRFS_I(inode)->delalloc_bytes == 0 &&
                     !list_empty(&BTRFS_I(inode)->delalloc_inodes)) {
@@ -2354,7 +2503,19 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
 
         root = BTRFS_I(dir)->root;
 
+        /*
+         * 5 items for unlink inode
+         * 1 for orphan
+         */
+        ret = btrfs_reserve_metadata_space(root, 6);
+        if (ret)
+                return ret;
+
         trans = btrfs_start_transaction(root, 1);
+        if (IS_ERR(trans)) {
+                btrfs_unreserve_metadata_space(root, 6);
+                return PTR_ERR(trans);
+        }
 
         btrfs_set_trans_block_group(trans, dir);
 
@@ -2369,6 +2530,7 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
         nr = trans->blocks_used;
 
         btrfs_end_transaction_throttle(trans, root);
+        btrfs_unreserve_metadata_space(root, 6);
         btrfs_btree_balance_dirty(root, nr);
         return ret;
 }
@@ -2449,7 +2611,16 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
             inode->i_ino == BTRFS_FIRST_FREE_OBJECTID)
                 return -ENOTEMPTY;
 
+        ret = btrfs_reserve_metadata_space(root, 5);
+        if (ret)
+                return ret;
+
         trans = btrfs_start_transaction(root, 1);
+        if (IS_ERR(trans)) {
+                btrfs_unreserve_metadata_space(root, 5);
+                return PTR_ERR(trans);
+        }
+
         btrfs_set_trans_block_group(trans, dir);
 
         if (unlikely(inode->i_ino == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID)) {
@@ -2472,6 +2643,7 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
 out:
         nr = trans->blocks_used;
         ret = btrfs_end_transaction_throttle(trans, root);
+        btrfs_unreserve_metadata_space(root, 5);
         btrfs_btree_balance_dirty(root, nr);
 
         if (ret && !err)
@@ -2912,12 +3084,22 @@ static int btrfs_truncate_page(struct address_space *mapping, loff_t from)
 
         if ((offset & (blocksize - 1)) == 0)
                 goto out;
+        ret = btrfs_check_data_free_space(root, inode, PAGE_CACHE_SIZE);
+        if (ret)
+                goto out;
+
+        ret = btrfs_reserve_metadata_for_delalloc(root, inode, 1);
+        if (ret)
+                goto out;
 
         ret = -ENOMEM;
 again:
         page = grab_cache_page(mapping, index);
-        if (!page)
+        if (!page) {
+                btrfs_free_reserved_data_space(root, inode, PAGE_CACHE_SIZE);
+                btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
                 goto out;
+        }
 
         page_start = page_offset(page);
         page_end = page_start + PAGE_CACHE_SIZE - 1;
@@ -2950,7 +3132,16 @@ again:
                 goto again;
         }
 
-        btrfs_set_extent_delalloc(inode, page_start, page_end);
+        clear_extent_bits(&BTRFS_I(inode)->io_tree, page_start, page_end,
+                          EXTENT_DIRTY | EXTENT_DELALLOC | EXTENT_DO_ACCOUNTING,
+                          GFP_NOFS);
+
+        ret = btrfs_set_extent_delalloc(inode, page_start, page_end);
+        if (ret) {
+                unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
+                goto out_unlock;
+        }
+
         ret = 0;
         if (offset != PAGE_CACHE_SIZE) {
                 kaddr = kmap(page);
@@ -2963,6 +3154,9 @@ again:
         unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
 
 out_unlock:
+        if (ret)
+                btrfs_free_reserved_data_space(root, inode, PAGE_CACHE_SIZE);
+        btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
         unlock_page(page);
         page_cache_release(page);
 out:
@@ -2981,17 +3175,15 @@ int btrfs_cont_expand(struct inode *inode, loff_t size)
         u64 last_byte;
         u64 cur_offset;
         u64 hole_size;
-        int err;
+        int err = 0;
 
         if (size <= hole_start)
                 return 0;
 
-        err = btrfs_check_metadata_free_space(root);
+        err = btrfs_truncate_page(inode->i_mapping, inode->i_size);
         if (err)
                 return err;
 
-        btrfs_truncate_page(inode->i_mapping, inode->i_size);
-
         while (1) {
                 struct btrfs_ordered_extent *ordered;
                 btrfs_wait_ordered_range(inode, hole_start,
@@ -3024,12 +3216,18 @@ int btrfs_cont_expand(struct inode *inode, loff_t size)
                                                  cur_offset, &hint_byte, 1);
                         if (err)
                                 break;
+
+                        err = btrfs_reserve_metadata_space(root, 1);
+                        if (err)
+                                break;
+
                         err = btrfs_insert_file_extent(trans, root,
                                         inode->i_ino, cur_offset, 0,
                                         0, hole_size, 0, hole_size,
                                         0, 0, 0);
                         btrfs_drop_extent_cache(inode, hole_start,
                                         last_byte - 1, 0);
+                        btrfs_unreserve_metadata_space(root, 1);
                 }
                 free_extent_map(em);
                 cur_offset = last_byte;
@@ -3353,6 +3551,7 @@ static noinline void init_btrfs_i(struct inode *inode)
         bi->generation = 0;
         bi->sequence = 0;
         bi->last_trans = 0;
+        bi->last_sub_trans = 0;
         bi->logged_trans = 0;
         bi->delalloc_bytes = 0;
         bi->reserved_bytes = 0;
@@ -3503,12 +3702,14 @@ static int btrfs_dentry_delete(struct dentry *dentry)
 {
         struct btrfs_root *root;
 
-        if (!dentry->d_inode)
-                return 0;
+        if (!dentry->d_inode && !IS_ROOT(dentry))
+                dentry = dentry->d_parent;
 
-        root = BTRFS_I(dentry->d_inode)->root;
-        if (btrfs_root_refs(&root->root_item) == 0)
-                return 1;
+        if (dentry->d_inode) {
+                root = BTRFS_I(dentry->d_inode)->root;
+                if (btrfs_root_refs(&root->root_item) == 0)
+                        return 1;
+        }
         return 0;
 }
 
@@ -3990,11 +4191,18 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
         if (!new_valid_dev(rdev))
                 return -EINVAL;
 
-        err = btrfs_check_metadata_free_space(root);
+        /*
+         * 2 for inode item and ref
+         * 2 for dir items
+         * 1 for xattr if selinux is on
+         */
+        err = btrfs_reserve_metadata_space(root, 5);
         if (err)
-                goto fail;
+                return err;
 
         trans = btrfs_start_transaction(root, 1);
+        if (!trans)
+                goto fail;
         btrfs_set_trans_block_group(trans, dir);
 
         err = btrfs_find_free_objectid(trans, root, dir->i_ino, &objectid);
@@ -4032,6 +4240,7 @@ out_unlock:
         nr = trans->blocks_used;
         btrfs_end_transaction_throttle(trans, root);
 fail:
+        btrfs_unreserve_metadata_space(root, 5);
         if (drop_inode) {
                 inode_dec_link_count(inode);
                 iput(inode);
@@ -4052,10 +4261,18 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
         u64 objectid;
         u64 index = 0;
 
-        err = btrfs_check_metadata_free_space(root);
+        /*
+         * 2 for inode item and ref
+         * 2 for dir items
+         * 1 for xattr if selinux is on
+         */
+        err = btrfs_reserve_metadata_space(root, 5);
         if (err)
-                goto fail;
+                return err;
+
         trans = btrfs_start_transaction(root, 1);
+        if (!trans)
+                goto fail;
         btrfs_set_trans_block_group(trans, dir);
 
         err = btrfs_find_free_objectid(trans, root, dir->i_ino, &objectid);
@@ -4096,6 +4313,7 @@ out_unlock:
         nr = trans->blocks_used;
         btrfs_end_transaction_throttle(trans, root);
 fail:
+        btrfs_unreserve_metadata_space(root, 5);
         if (drop_inode) {
                 inode_dec_link_count(inode);
                 iput(inode);
@@ -4118,10 +4336,16 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
         if (inode->i_nlink == 0)
                 return -ENOENT;
 
-        btrfs_inc_nlink(inode);
-        err = btrfs_check_metadata_free_space(root);
+        /*
+         * 1 item for inode ref
+         * 2 items for dir items
+         */
+        err = btrfs_reserve_metadata_space(root, 3);
         if (err)
-                goto fail;
+                return err;
+
+        btrfs_inc_nlink(inode);
+
         err = btrfs_set_inode_index(dir, &index);
         if (err)
                 goto fail;
@@ -4145,6 +4369,7 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
         nr = trans->blocks_used;
         btrfs_end_transaction_throttle(trans, root);
 fail:
+        btrfs_unreserve_metadata_space(root, 3);
         if (drop_inode) {
                 inode_dec_link_count(inode);
                 iput(inode);
@@ -4164,17 +4389,21 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         u64 index = 0;
         unsigned long nr = 1;
 
-        err = btrfs_check_metadata_free_space(root);
+        /*
+         * 2 items for inode and ref
+         * 2 items for dir items
+         * 1 for xattr if selinux is on
+         */
+        err = btrfs_reserve_metadata_space(root, 5);
         if (err)
-                goto out_unlock;
+                return err;
 
         trans = btrfs_start_transaction(root, 1);
-        btrfs_set_trans_block_group(trans, dir);
-
-        if (IS_ERR(trans)) {
-                err = PTR_ERR(trans);
+        if (!trans) {
+                err = -ENOMEM;
                 goto out_unlock;
         }
+        btrfs_set_trans_block_group(trans, dir);
 
         err = btrfs_find_free_objectid(trans, root, dir->i_ino, &objectid);
         if (err) {
@@ -4223,6 +4452,7 @@ out_fail:
         btrfs_end_transaction_throttle(trans, root);
 
 out_unlock:
+        btrfs_unreserve_metadata_space(root, 5);
         if (drop_on_err)
                 iput(inode);
         btrfs_btree_balance_dirty(root, nr);
@@ -4684,7 +4914,8 @@ static void btrfs_invalidatepage(struct page *page, unsigned long offset)
                  */
                 clear_extent_bit(tree, page_start, page_end,
                                  EXTENT_DIRTY | EXTENT_DELALLOC |
-                                 EXTENT_LOCKED, 1, 0, NULL, GFP_NOFS);
+                                 EXTENT_LOCKED | EXTENT_DO_ACCOUNTING, 1, 0,
+                                 NULL, GFP_NOFS);
                 /*
                  * whoever cleared the private bit is responsible
                  * for the finish_ordered_io
@@ -4697,8 +4928,8 @@ static void btrfs_invalidatepage(struct page *page, unsigned long offset)
                 lock_extent(tree, page_start, page_end, GFP_NOFS);
         }
         clear_extent_bit(tree, page_start, page_end,
-                 EXTENT_LOCKED | EXTENT_DIRTY | EXTENT_DELALLOC,
-                 1, 1, NULL, GFP_NOFS);
+                 EXTENT_LOCKED | EXTENT_DIRTY | EXTENT_DELALLOC |
+                 EXTENT_DO_ACCOUNTING, 1, 1, NULL, GFP_NOFS);
         __btrfs_releasepage(page, GFP_NOFS);
 
         ClearPageChecked(page);
@@ -4747,6 +4978,13 @@ int btrfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
                 goto out;
         }
 
+        ret = btrfs_reserve_metadata_for_delalloc(root, inode, 1);
+        if (ret) {
+                btrfs_free_reserved_data_space(root, inode, PAGE_CACHE_SIZE);
+                ret = VM_FAULT_SIGBUS;
+                goto out;
+        }
+
         ret = VM_FAULT_NOPAGE; /* make the VM retry the fault */
 again:
         lock_page(page);
@@ -4778,7 +5016,24 @@ again:
                 goto again;
         }
 
-        btrfs_set_extent_delalloc(inode, page_start, page_end);
+        /*
+         * XXX - page_mkwrite gets called every time the page is dirtied, even
+         * if it was already dirty, so for space accounting reasons we need to
+         * clear any delalloc bits for the range we are fixing to save.  There
+         * is probably a better way to do this, but for now keep consistent with
+         * prepare_pages in the normal write path.
+         */
+        clear_extent_bits(&BTRFS_I(inode)->io_tree, page_start, page_end,
+                          EXTENT_DIRTY | EXTENT_DELALLOC | EXTENT_DO_ACCOUNTING,
+                          GFP_NOFS);
+
+        ret = btrfs_set_extent_delalloc(inode, page_start, page_end);
+        if (ret) {
+                unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
+                ret = VM_FAULT_SIGBUS;
+                btrfs_free_reserved_data_space(root, inode, PAGE_CACHE_SIZE);
+                goto out_unlock;
+        }
         ret = 0;
 
         /* page is wholly or partially inside EOF */
@@ -4797,10 +5052,13 @@ again:
         set_page_dirty(page);
         SetPageUptodate(page);
 
-        BTRFS_I(inode)->last_trans = root->fs_info->generation + 1;
+        BTRFS_I(inode)->last_trans = root->fs_info->generation;
+        BTRFS_I(inode)->last_sub_trans = BTRFS_I(inode)->root->log_transid;
+
         unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
 
 out_unlock:
+        btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
         if (!ret)
                 return VM_FAULT_LOCKED;
         unlock_page(page);
@@ -4821,7 +5079,9 @@ static void btrfs_truncate(struct inode *inode)
         if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
                 return;
 
-        btrfs_truncate_page(inode->i_mapping, inode->i_size);
+        ret = btrfs_truncate_page(inode->i_mapping, inode->i_size);
+        if (ret)
+                return;
         btrfs_wait_ordered_range(inode, inode->i_size & (~mask), (u64)-1);
 
         trans = btrfs_start_transaction(root, 1);
@@ -4916,7 +5176,12 @@ struct inode *btrfs_alloc_inode(struct super_block *sb)
         if (!ei)
                 return NULL;
         ei->last_trans = 0;
+        ei->last_sub_trans = 0;
         ei->logged_trans = 0;
+        ei->outstanding_extents = 0;
+        ei->reserved_extents = 0;
+        ei->root = NULL;
+        spin_lock_init(&ei->accounting_lock);
         btrfs_ordered_inode_tree_init(&ei->ordered_tree);
         INIT_LIST_HEAD(&ei->i_orphan);
         INIT_LIST_HEAD(&ei->ordered_operations);
@@ -4932,6 +5197,14 @@ void btrfs_destroy_inode(struct inode *inode)
         WARN_ON(inode->i_data.nrpages);
 
         /*
+         * This can happen where we create an inode, but somebody else also
+         * created the same inode and we need to destroy the one we already
+         * created.
+         */
+        if (!root)
+                goto free;
+
+        /*
          * Make sure we're properly removed from the ordered operation
          * lists.
          */
@@ -4966,6 +5239,7 @@ void btrfs_destroy_inode(struct inode *inode)
         }
         inode_tree_del(inode);
         btrfs_drop_extent_cache(inode, 0, (u64)-1, 0);
+free:
         kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode));
 }
 
@@ -5070,7 +5344,15 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
             new_inode->i_size > BTRFS_EMPTY_DIR_SIZE)
                 return -ENOTEMPTY;
 
-        ret = btrfs_check_metadata_free_space(root);
+        /*
+         * We want to reserve the absolute worst case amount of items.  So if
+         * both inodes are subvols and we need to unlink them then that would
+         * require 4 item modifications, but if they are both normal inodes it
+         * would require 5 item modifications, so we'll assume their normal
+         * inodes.  So 5 * 2 is 10, plus 1 for the new link, so 11 total items
+         * should cover the worst case number of items we'll modify.
+         */
+        ret = btrfs_reserve_metadata_space(root, 11);
         if (ret)
                 return ret;
 
@@ -5185,6 +5467,8 @@ out_fail:
 
         if (old_inode->i_ino == BTRFS_FIRST_FREE_OBJECTID)
                 up_read(&root->fs_info->subvol_sem);
+
+        btrfs_unreserve_metadata_space(root, 11);
         return ret;
 }
 
@@ -5256,11 +5540,18 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
         if (name_len > BTRFS_MAX_INLINE_DATA_SIZE(root))
                 return -ENAMETOOLONG;
 
-        err = btrfs_check_metadata_free_space(root);
+        /*
+         * 2 items for inode item and ref
+         * 2 items for dir items
+         * 1 item for xattr if selinux is on
+         */
+        err = btrfs_reserve_metadata_space(root, 5);
         if (err)
-                goto out_fail;
+                return err;
 
         trans = btrfs_start_transaction(root, 1);
+        if (!trans)
+                goto out_fail;
         btrfs_set_trans_block_group(trans, dir);
 
         err = btrfs_find_free_objectid(trans, root, dir->i_ino, &objectid);
@@ -5341,6 +5632,7 @@ out_unlock:
         nr = trans->blocks_used;
         btrfs_end_transaction_throttle(trans, root);
 out_fail:
+        btrfs_unreserve_metadata_space(root, 5);
         if (drop_inode) {
                 inode_dec_link_count(inode);
                 iput(inode);
@@ -5362,6 +5654,11 @@ static int prealloc_file_range(struct btrfs_trans_handle *trans,
 
         while (num_bytes > 0) {
                 alloc_size = min(num_bytes, root->fs_info->max_extent);
+
+                ret = btrfs_reserve_metadata_space(root, 1);
+                if (ret)
+                        goto out;
+
                 ret = btrfs_reserve_extent(trans, root, alloc_size,
                                            root->sectorsize, 0, alloc_hint,
                                            (u64)-1, &ins, 1);
@@ -5381,6 +5678,7 @@ static int prealloc_file_range(struct btrfs_trans_handle *trans,
                 num_bytes -= ins.offset;
                 cur_offset += ins.offset;
                 alloc_hint = ins.objectid + ins.offset;
+                btrfs_unreserve_metadata_space(root, 1);
         }
 out:
         if (cur_offset > start) {
@@ -5544,7 +5842,7 @@ static const struct inode_operations btrfs_dir_ro_inode_operations = {
         .permission     = btrfs_permission,
 };
 
-static struct file_operations btrfs_dir_file_operations = {
+static const struct file_operations btrfs_dir_file_operations = {
         .llseek         = generic_file_llseek,
         .read           = generic_read_dir,
         .readdir        = btrfs_real_readdir,
@@ -5566,6 +5864,8 @@ static struct extent_io_ops btrfs_extent_io_ops = {
         .readpage_io_failed_hook = btrfs_io_failed_hook,
         .set_bit_hook = btrfs_set_bit_hook,
         .clear_bit_hook = btrfs_clear_bit_hook,
+        .merge_extent_hook = btrfs_merge_extent_hook,
+        .split_extent_hook = btrfs_split_extent_hook,
 };
 
 /*
@@ -5632,6 +5932,6 @@ static const struct inode_operations btrfs_symlink_inode_operations = {
         .removexattr    = btrfs_removexattr,
 };
 
-struct dentry_operations btrfs_dentry_operations = {
+const struct dentry_operations btrfs_dentry_operations = {
         .d_delete       = btrfs_dentry_delete,
 };
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index a8577a7f26ab..cdbb054102b9 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -239,7 +239,13 @@ static noinline int create_subvol(struct btrfs_root *root,
         u64 index = 0;
         unsigned long nr = 1;
 
-        ret = btrfs_check_metadata_free_space(root);
+        /*
+         * 1 - inode item
+         * 2 - refs
+         * 1 - root item
+         * 2 - dir items
+         */
+        ret = btrfs_reserve_metadata_space(root, 6);
         if (ret)
                 return ret;
 
@@ -340,6 +346,9 @@ fail:
         err = btrfs_commit_transaction(trans, root);
         if (err && !ret)
                 ret = err;
+
+        btrfs_unreserve_metadata_space(root, 6);
+        btrfs_btree_balance_dirty(root, nr);
         return ret;
 }
 
@@ -355,19 +364,27 @@ static int create_snapshot(struct btrfs_root *root, struct dentry *dentry,
         if (!root->ref_cows)
                 return -EINVAL;
 
-        ret = btrfs_check_metadata_free_space(root);
+        /*
+         * 1 - inode item
+         * 2 - refs
+         * 1 - root item
+         * 2 - dir items
+         */
+        ret = btrfs_reserve_metadata_space(root, 6);
         if (ret)
                 goto fail_unlock;
 
         pending_snapshot = kzalloc(sizeof(*pending_snapshot), GFP_NOFS);
         if (!pending_snapshot) {
                 ret = -ENOMEM;
+                btrfs_unreserve_metadata_space(root, 6);
                 goto fail_unlock;
         }
         pending_snapshot->name = kmalloc(namelen + 1, GFP_NOFS);
         if (!pending_snapshot->name) {
                 ret = -ENOMEM;
                 kfree(pending_snapshot);
+                btrfs_unreserve_metadata_space(root, 6);
                 goto fail_unlock;
         }
         memcpy(pending_snapshot->name, name, namelen);
@@ -813,6 +830,7 @@ out_up_write:
 out_unlock:
         mutex_unlock(&inode->i_mutex);
         if (!err) {
+                shrink_dcache_sb(root->fs_info->sb);
                 btrfs_invalidate_inodes(dest);
                 d_delete(dentry);
         }
@@ -1105,8 +1123,10 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                                         datao += off - key.offset;
                                         datal -= off - key.offset;
                                 }
-                                if (key.offset + datao + datal > off + len)
-                                        datal = off + len - key.offset - datao;
+
+                                if (key.offset + datal > off + len)
+                                        datal = off + len - key.offset;
+
                                 /* disko == 0 means it's a hole */
                                 if (!disko)
                                         datao = 0;
@@ -1215,15 +1235,15 @@ static long btrfs_ioctl_trans_start(struct file *file)
         struct inode *inode = fdentry(file)->d_inode;
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_trans_handle *trans;
-        int ret = 0;
+        int ret;
 
+        ret = -EPERM;
         if (!capable(CAP_SYS_ADMIN))
-                return -EPERM;
+                goto out;
 
-        if (file->private_data) {
-                ret = -EINPROGRESS;
+        ret = -EINPROGRESS;
+        if (file->private_data)
                 goto out;
-        }
 
         ret = mnt_want_write(file->f_path.mnt);
         if (ret)
@@ -1233,12 +1253,19 @@ static long btrfs_ioctl_trans_start(struct file *file)
         root->fs_info->open_ioctl_trans++;
         mutex_unlock(&root->fs_info->trans_mutex);
 
+        ret = -ENOMEM;
         trans = btrfs_start_ioctl_transaction(root, 0);
-        if (trans)
-                file->private_data = trans;
-        else
-                ret = -ENOMEM;
-        /*printk(KERN_INFO "btrfs_ioctl_trans_start on %p\n", file);*/
+        if (!trans)
+                goto out_drop;
+
+        file->private_data = trans;
+        return 0;
+
+out_drop:
+        mutex_lock(&root->fs_info->trans_mutex);
+        root->fs_info->open_ioctl_trans--;
+        mutex_unlock(&root->fs_info->trans_mutex);
+        mnt_drop_write(file->f_path.mnt);
 out:
         return ret;
 }
@@ -1254,24 +1281,20 @@ long btrfs_ioctl_trans_end(struct file *file)
         struct inode *inode = fdentry(file)->d_inode;
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_trans_handle *trans;
-        int ret = 0;
 
         trans = file->private_data;
-        if (!trans) {
-                ret = -EINVAL;
-                goto out;
-        }
-        btrfs_end_transaction(trans, root);
+        if (!trans)
+                return -EINVAL;
         file->private_data = NULL;
 
+        btrfs_end_transaction(trans, root);
+
         mutex_lock(&root->fs_info->trans_mutex);
         root->fs_info->open_ioctl_trans--;
         mutex_unlock(&root->fs_info->trans_mutex);
 
         mnt_drop_write(file->f_path.mnt);
-
-out:
-        return ret;
+        return 0;
 }
 
 long btrfs_ioctl(struct file *file, unsigned int
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index b5d6d24726b0..5799bc46a309 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -306,6 +306,12 @@ int btrfs_remove_ordered_extent(struct inode *inode,
         tree->last = NULL;
         set_bit(BTRFS_ORDERED_COMPLETE, &entry->flags);
 
+        spin_lock(&BTRFS_I(inode)->accounting_lock);
+        BTRFS_I(inode)->outstanding_extents--;
+        spin_unlock(&BTRFS_I(inode)->accounting_lock);
+        btrfs_unreserve_metadata_for_delalloc(BTRFS_I(inode)->root,
+                                              inode, 1);
+
         spin_lock(&BTRFS_I(inode)->root->fs_info->ordered_extent_lock);
         list_del_init(&entry->root_extent_list);
 
@@ -458,7 +464,7 @@ void btrfs_start_ordered_extent(struct inode *inode,
          * start IO on any dirty ones so the wait doesn't stall waiting
          * for pdflush to find them
          */
-        btrfs_fdatawrite_range(inode->i_mapping, start, end, WB_SYNC_ALL);
+        filemap_fdatawrite_range(inode->i_mapping, start, end);
         if (wait) {
                 wait_event(entry->wait, test_bit(BTRFS_ORDERED_COMPLETE,
                                                  &entry->flags));
@@ -488,17 +494,15 @@ again:
         /* start IO across the range first to instantiate any delalloc
          * extents
          */
-        btrfs_fdatawrite_range(inode->i_mapping, start, orig_end, WB_SYNC_ALL);
+        filemap_fdatawrite_range(inode->i_mapping, start, orig_end);
 
         /* The compression code will leave pages locked but return from
          * writepage without setting the page writeback.  Starting again
          * with WB_SYNC_ALL will end up waiting for the IO to actually start.
          */
-        btrfs_fdatawrite_range(inode->i_mapping, start, orig_end, WB_SYNC_ALL);
+        filemap_fdatawrite_range(inode->i_mapping, start, orig_end);
 
-        btrfs_wait_on_page_writeback_range(inode->i_mapping,
-                                           start >> PAGE_CACHE_SHIFT,
-                                           orig_end >> PAGE_CACHE_SHIFT);
+        filemap_fdatawait_range(inode->i_mapping, start, orig_end);
 
         end = orig_end;
         found = 0;
@@ -716,89 +720,6 @@ out:
 }
 
 
-/**
- * taken from mm/filemap.c because it isn't exported
- *
- * __filemap_fdatawrite_range - start writeback on mapping dirty pages in range
- * @mapping:    address space structure to write
- * @start:      offset in bytes where the range starts
- * @end:        offset in bytes where the range ends (inclusive)
- * @sync_mode:  enable synchronous operation
- *
- * Start writeback against all of a mapping's dirty pages that lie
- * within the byte offsets <start, end> inclusive.
- *
- * If sync_mode is WB_SYNC_ALL then this is a "data integrity" operation, as
- * opposed to a regular memory cleansing writeback.  The difference between
- * these two operations is that if a dirty page/buffer is encountered, it must
- * be waited upon, and not just skipped over.
- */
-int btrfs_fdatawrite_range(struct address_space *mapping, loff_t start,
-                           loff_t end, int sync_mode)
-{
-        struct writeback_control wbc = {
-                .sync_mode = sync_mode,
-                .nr_to_write = mapping->nrpages * 2,
-                .range_start = start,
-                .range_end = end,
-        };
-        return btrfs_writepages(mapping, &wbc);
-}
-
-/**
- * taken from mm/filemap.c because it isn't exported
- *
- * wait_on_page_writeback_range - wait for writeback to complete
- * @mapping:    target address_space
- * @start:      beginning page index
- * @end:        ending page index
- *
- * Wait for writeback to complete against pages indexed by start->end
- * inclusive
- */
-int btrfs_wait_on_page_writeback_range(struct address_space *mapping,
-                                       pgoff_t start, pgoff_t end)
-{
-        struct pagevec pvec;
-        int nr_pages;
-        int ret = 0;
-        pgoff_t index;
-
-        if (end < start)
-                return 0;
-
-        pagevec_init(&pvec, 0);
-        index = start;
-        while ((index <= end) &&
-                        (nr_pages = pagevec_lookup_tag(&pvec, mapping, &index,
-                        PAGECACHE_TAG_WRITEBACK,
-                        min(end - index, (pgoff_t)PAGEVEC_SIZE-1) + 1)) != 0) {
-                unsigned i;
-
-                for (i = 0; i < nr_pages; i++) {
-                        struct page *page = pvec.pages[i];
-
-                        /* until radix tree lookup accepts end_index */
-                        if (page->index > end)
-                                continue;
-
-                        wait_on_page_writeback(page);
-                        if (PageError(page))
-                                ret = -EIO;
-                }
-                pagevec_release(&pvec);
-                cond_resched();
-        }
-
-        /* Check for outstanding write errors */
-        if (test_and_clear_bit(AS_ENOSPC, &mapping->flags))
-                ret = -ENOSPC;
-        if (test_and_clear_bit(AS_EIO, &mapping->flags))
-                ret = -EIO;
-
-        return ret;
-}
-
 /*
  * add a given inode to the list of inodes that must be fully on
  * disk before a transaction commit finishes.
diff --git a/fs/btrfs/ordered-data.h b/fs/btrfs/ordered-data.h
index 993a7ea45c70..f82e87488ca8 100644
--- a/fs/btrfs/ordered-data.h
+++ b/fs/btrfs/ordered-data.h
@@ -153,10 +153,6 @@ btrfs_lookup_first_ordered_extent(struct inode * inode, u64 file_offset);
 int btrfs_ordered_update_i_size(struct inode *inode,
                                 struct btrfs_ordered_extent *ordered);
 int btrfs_find_ordered_sum(struct inode *inode, u64 offset, u64 disk_bytenr, u32 *sum);
-int btrfs_wait_on_page_writeback_range(struct address_space *mapping,
-                                       pgoff_t start, pgoff_t end);
-int btrfs_fdatawrite_range(struct address_space *mapping, loff_t start,
-                           loff_t end, int sync_mode);
 int btrfs_wait_ordered_extents(struct btrfs_root *root, int nocow_only);
 int btrfs_run_ordered_operations(struct btrfs_root *root, int wait);
 int btrfs_add_ordered_operation(struct btrfs_trans_handle *trans,
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 361ad323faac..cfcc93c93a7b 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -3518,7 +3518,7 @@ int btrfs_relocate_block_group(struct btrfs_root *extent_root, u64 group_start)
         BUG_ON(!rc->block_group);
 
         btrfs_init_workers(&rc->workers, "relocate",
-                           fs_info->thread_pool_size);
+                           fs_info->thread_pool_size, NULL);
 
         rc->extent_root = extent_root;
         btrfs_prepare_block_group_relocation(extent_root, rc->block_group);
@@ -3701,7 +3701,7 @@ int btrfs_recover_relocation(struct btrfs_root *root)
         mapping_tree_init(&rc->reloc_root_tree);
         INIT_LIST_HEAD(&rc->reloc_roots);
         btrfs_init_workers(&rc->workers, "relocate",
-                           root->fs_info->thread_pool_size);
+                           root->fs_info->thread_pool_size, NULL);
         rc->extent_root = root->fs_info->extent_root;
 
         set_reloc_control(rc);
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index 9351428f30e2..67fa2d29d663 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -159,7 +159,6 @@ int btrfs_update_root(struct btrfs_trans_handle *trans, struct btrfs_root
         write_extent_buffer(l, item, ptr, sizeof(*item));
         btrfs_mark_buffer_dirty(path->nodes[0]);
 out:
-        btrfs_release_path(root, path);
         btrfs_free_path(path);
         return ret;
 }
@@ -332,7 +331,6 @@ int btrfs_del_root(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         BUG_ON(refs != 0);
         ret = btrfs_del_item(trans, root, path);
 out:
-        btrfs_release_path(root, path);
         btrfs_free_path(path);
         return ret;
 }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 67035385444c..752a5463bf53 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -66,7 +66,8 @@ enum {
         Opt_degraded, Opt_subvol, Opt_device, Opt_nodatasum, Opt_nodatacow,
         Opt_max_extent, Opt_max_inline, Opt_alloc_start, Opt_nobarrier,
         Opt_ssd, Opt_nossd, Opt_ssd_spread, Opt_thread_pool, Opt_noacl,
-        Opt_compress, Opt_notreelog, Opt_ratio, Opt_flushoncommit, Opt_err,
+        Opt_compress, Opt_notreelog, Opt_ratio, Opt_flushoncommit,
+        Opt_discard, Opt_err,
 };
 
 static match_table_t tokens = {
@@ -88,6 +89,7 @@ static match_table_t tokens = {
         {Opt_notreelog, "notreelog"},
         {Opt_flushoncommit, "flushoncommit"},
         {Opt_ratio, "metadata_ratio=%d"},
+        {Opt_discard, "discard"},
         {Opt_err, NULL},
 };
 
@@ -257,6 +259,9 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                                        info->metadata_ratio);
                         }
                         break;
+                case Opt_discard:
+                        btrfs_set_opt(info->mount_opt, DISCARD);
+                        break;
                 default:
                         break;
                 }
@@ -344,7 +349,9 @@ static int btrfs_fill_super(struct super_block *sb,
         sb->s_export_op = &btrfs_export_ops;
         sb->s_xattr = btrfs_xattr_handlers;
         sb->s_time_gran = 1;
+#ifdef CONFIG_BTRFS_FS_POSIX_ACL
         sb->s_flags |= MS_POSIXACL;
+#endif
 
         tree_root = open_ctree(sb, fs_devices, (char *)data);
 
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 88f866f85e7a..c207e8c32c9b 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -163,8 +163,14 @@ static void wait_current_trans(struct btrfs_root *root)
         }
 }
 
+enum btrfs_trans_type {
+        TRANS_START,
+        TRANS_JOIN,
+        TRANS_USERSPACE,
+};
+
 static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
-                                             int num_blocks, int wait)
+                                             int num_blocks, int type)
 {
         struct btrfs_trans_handle *h =
                 kmem_cache_alloc(btrfs_trans_handle_cachep, GFP_NOFS);
@@ -172,7 +178,8 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
 
         mutex_lock(&root->fs_info->trans_mutex);
         if (!root->fs_info->log_root_recovering &&
-            ((wait == 1 && !root->fs_info->open_ioctl_trans) || wait == 2))
+            ((type == TRANS_START && !root->fs_info->open_ioctl_trans) ||
+             type == TRANS_USERSPACE))
                 wait_current_trans(root);
         ret = join_transaction(root);
         BUG_ON(ret);
@@ -186,6 +193,9 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
         h->alloc_exclude_start = 0;
         h->delayed_ref_updates = 0;
 
+        if (!current->journal_info && type != TRANS_USERSPACE)
+                current->journal_info = h;
+
         root->fs_info->running_transaction->use_count++;
         record_root_in_trans(h, root);
         mutex_unlock(&root->fs_info->trans_mutex);
@@ -195,18 +205,18 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
 struct btrfs_trans_handle *btrfs_start_transaction(struct btrfs_root *root,
                                                    int num_blocks)
 {
-        return start_transaction(root, num_blocks, 1);
+        return start_transaction(root, num_blocks, TRANS_START);
 }
 struct btrfs_trans_handle *btrfs_join_transaction(struct btrfs_root *root,
                                                    int num_blocks)
 {
-        return start_transaction(root, num_blocks, 0);
+        return start_transaction(root, num_blocks, TRANS_JOIN);
 }
 
 struct btrfs_trans_handle *btrfs_start_ioctl_transaction(struct btrfs_root *r,
                                                          int num_blocks)
 {
-        return start_transaction(r, num_blocks, 2);
+        return start_transaction(r, num_blocks, TRANS_USERSPACE);
 }
 
 /* wait for a transaction commit to be fully complete */
@@ -317,6 +327,9 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
                 wake_up(&cur_trans->writer_wait);
         put_transaction(cur_trans);
         mutex_unlock(&info->trans_mutex);
+
+        if (current->journal_info == trans)
+                current->journal_info = NULL;
         memset(trans, 0, sizeof(*trans));
         kmem_cache_free(btrfs_trans_handle_cachep, trans);
 
@@ -338,10 +351,10 @@ int btrfs_end_transaction_throttle(struct btrfs_trans_handle *trans,
 /*
  * when btree blocks are allocated, they have some corresponding bits set for
  * them in one of two extent_io trees.  This is used to make sure all of
- * those extents are on disk for transaction or log commit
+ * those extents are sent to disk but does not wait on them
  */
-int btrfs_write_and_wait_marked_extents(struct btrfs_root *root,
-                                        struct extent_io_tree *dirty_pages)
+int btrfs_write_marked_extents(struct btrfs_root *root,
+                               struct extent_io_tree *dirty_pages)
 {
         int ret;
         int err = 0;
@@ -388,6 +401,29 @@ int btrfs_write_and_wait_marked_extents(struct btrfs_root *root,
                         page_cache_release(page);
                 }
         }
+        if (err)
+                werr = err;
+        return werr;
+}
+
+/*
+ * when btree blocks are allocated, they have some corresponding bits set for
+ * them in one of two extent_io trees.  This is used to make sure all of
+ * those extents are on disk for transaction or log commit.  We wait
+ * on all the pages and clear them from the dirty pages state tree
+ */
+int btrfs_wait_marked_extents(struct btrfs_root *root,
+                              struct extent_io_tree *dirty_pages)
+{
+        int ret;
+        int err = 0;
+        int werr = 0;
+        struct page *page;
+        struct inode *btree_inode = root->fs_info->btree_inode;
+        u64 start = 0;
+        u64 end;
+        unsigned long index;
+
         while (1) {
                 ret = find_first_extent_bit(dirty_pages, 0, &start, &end,
                                             EXTENT_DIRTY);
@@ -418,6 +454,22 @@ int btrfs_write_and_wait_marked_extents(struct btrfs_root *root,
         return werr;
 }
 
+/*
+ * when btree blocks are allocated, they have some corresponding bits set for
+ * them in one of two extent_io trees.  This is used to make sure all of
+ * those extents are on disk for transaction or log commit
+ */
+int btrfs_write_and_wait_marked_extents(struct btrfs_root *root,
+                                        struct extent_io_tree *dirty_pages)
+{
+        int ret;
+        int ret2;
+
+        ret = btrfs_write_marked_extents(root, dirty_pages);
+        ret2 = btrfs_wait_marked_extents(root, dirty_pages);
+        return ret || ret2;
+}
+
 int btrfs_write_and_wait_transaction(struct btrfs_trans_handle *trans,
                                      struct btrfs_root *root)
 {
@@ -743,6 +795,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
         memcpy(&pending->root_key, &key, sizeof(key));
 fail:
         kfree(new_root_item);
+        btrfs_unreserve_metadata_space(root, 6);
         return ret;
 }
 
@@ -1059,6 +1112,9 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
         mutex_unlock(&root->fs_info->trans_mutex);
 
+        if (current->journal_info == trans)
+                current->journal_info = NULL;
+
         kmem_cache_free(btrfs_trans_handle_cachep, trans);
         return ret;
 }
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index 663c67404918..d4e3e7a6938c 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -79,6 +79,7 @@ static inline void btrfs_set_inode_last_trans(struct btrfs_trans_handle *trans,
                                               struct inode *inode)
 {
         BTRFS_I(inode)->last_trans = trans->transaction->transid;
+        BTRFS_I(inode)->last_sub_trans = BTRFS_I(inode)->root->log_transid;
 }
 
 int btrfs_end_transaction(struct btrfs_trans_handle *trans,
@@ -107,5 +108,9 @@ int btrfs_record_root_in_trans(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root);
 int btrfs_write_and_wait_marked_extents(struct btrfs_root *root,
                                         struct extent_io_tree *dirty_pages);
+int btrfs_write_marked_extents(struct btrfs_root *root,
+                                        struct extent_io_tree *dirty_pages);
+int btrfs_wait_marked_extents(struct btrfs_root *root,
+                                        struct extent_io_tree *dirty_pages);
 int btrfs_transaction_in_commit(struct btrfs_fs_info *info);
 #endif
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 7827841b55cb..741666a7676a 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -137,11 +137,20 @@ static int start_log_trans(struct btrfs_trans_handle *trans,
 
         mutex_lock(&root->log_mutex);
         if (root->log_root) {
+                if (!root->log_start_pid) {
+                        root->log_start_pid = current->pid;
+                        root->log_multiple_pids = false;
+                } else if (root->log_start_pid != current->pid) {
+                        root->log_multiple_pids = true;
+                }
+
                 root->log_batch++;
                 atomic_inc(&root->log_writers);
                 mutex_unlock(&root->log_mutex);
                 return 0;
         }
+        root->log_multiple_pids = false;
+        root->log_start_pid = current->pid;
         mutex_lock(&root->fs_info->tree_log_mutex);
         if (!root->fs_info->log_root_tree) {
                 ret = btrfs_init_log_root_tree(trans, root->fs_info);
@@ -1971,6 +1980,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
         int ret;
         struct btrfs_root *log = root->log_root;
         struct btrfs_root *log_root_tree = root->fs_info->log_root_tree;
+        u64 log_transid = 0;
 
         mutex_lock(&root->log_mutex);
         index1 = root->log_transid % 2;
@@ -1987,10 +1997,11 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
 
         while (1) {
                 unsigned long batch = root->log_batch;
-                mutex_unlock(&root->log_mutex);
-                schedule_timeout_uninterruptible(1);
-                mutex_lock(&root->log_mutex);
-
+                if (root->log_multiple_pids) {
+                        mutex_unlock(&root->log_mutex);
+                        schedule_timeout_uninterruptible(1);
+                        mutex_lock(&root->log_mutex);
+                }
                 wait_for_writer(trans, root);
                 if (batch == root->log_batch)
                         break;
@@ -2003,14 +2014,19 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
                 goto out;
         }
 
-        ret = btrfs_write_and_wait_marked_extents(log, &log->dirty_log_pages);
+        /* we start IO on  all the marked extents here, but we don't actually
+         * wait for them until later.
+         */
+        ret = btrfs_write_marked_extents(log, &log->dirty_log_pages);
         BUG_ON(ret);
 
         btrfs_set_root_node(&log->root_item, log->node);
 
         root->log_batch = 0;
+        log_transid = root->log_transid;
         root->log_transid++;
         log->log_transid = root->log_transid;
+        root->log_start_pid = 0;
         smp_mb();
         /*
          * log tree has been flushed to disk, new modifications of
@@ -2036,6 +2052,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
 
         index2 = log_root_tree->log_transid % 2;
         if (atomic_read(&log_root_tree->log_commit[index2])) {
+                btrfs_wait_marked_extents(log, &log->dirty_log_pages);
                 wait_log_commit(trans, log_root_tree,
                                 log_root_tree->log_transid);
                 mutex_unlock(&log_root_tree->log_mutex);
@@ -2055,6 +2072,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
          * check the full commit flag again
          */
         if (root->fs_info->last_trans_log_full_commit == trans->transid) {
+                btrfs_wait_marked_extents(log, &log->dirty_log_pages);
                 mutex_unlock(&log_root_tree->log_mutex);
                 ret = -EAGAIN;
                 goto out_wake_log_root;
@@ -2063,6 +2081,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
         ret = btrfs_write_and_wait_marked_extents(log_root_tree,
                                 &log_root_tree->dirty_log_pages);
         BUG_ON(ret);
+        btrfs_wait_marked_extents(log, &log->dirty_log_pages);
 
         btrfs_set_super_log_root(&root->fs_info->super_for_commit,
                                 log_root_tree->node->start);
@@ -2082,9 +2101,14 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
          * the running transaction open, so a full commit can't hop
          * in and cause problems either.
          */
-        write_ctree_super(trans, root->fs_info->tree_root, 2);
+        write_ctree_super(trans, root->fs_info->tree_root, 1);
         ret = 0;
 
+        mutex_lock(&root->log_mutex);
+        if (root->last_log_commit < log_transid)
+                root->last_log_commit = log_transid;
+        mutex_unlock(&root->log_mutex);
+
 out_wake_log_root:
         atomic_set(&log_root_tree->log_commit[index2], 0);
         smp_mb();
@@ -2852,6 +2876,21 @@ out:
         return ret;
 }
 
+static int inode_in_log(struct btrfs_trans_handle *trans,
+                 struct inode *inode)
+{
+        struct btrfs_root *root = BTRFS_I(inode)->root;
+        int ret = 0;
+
+        mutex_lock(&root->log_mutex);
+        if (BTRFS_I(inode)->logged_trans == trans->transid &&
+            BTRFS_I(inode)->last_sub_trans <= root->last_log_commit)
+                ret = 1;
+        mutex_unlock(&root->log_mutex);
+        return ret;
+}
+
+
 /*
  * helper function around btrfs_log_inode to make sure newly created
  * parent directories also end up in the log.  A minimal inode and backref
@@ -2891,6 +2930,11 @@ int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
         if (ret)
                 goto end_no_trans;
 
+        if (inode_in_log(trans, inode)) {
+                ret = BTRFS_NO_LOG_SYNC;
+                goto end_no_trans;
+        }
+
         start_log_trans(trans, root);
 
         ret = btrfs_log_inode(trans, root, inode, inode_only);
diff --git a/fs/btrfs/tree-log.h b/fs/btrfs/tree-log.h
index d09c7609e16b..0776eacb5083 100644
--- a/fs/btrfs/tree-log.h
+++ b/fs/btrfs/tree-log.h
@@ -19,6 +19,9 @@
 #ifndef __TREE_LOG_
 #define __TREE_LOG_
 
+/* return value for btrfs_log_dentry_safe that means we don't need to log it at all */
+#define BTRFS_NO_LOG_SYNC 256
+
 int btrfs_sync_log(struct btrfs_trans_handle *trans,
                    struct btrfs_root *root);
 int btrfs_free_log(struct btrfs_trans_handle *trans, struct btrfs_root *root);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 23e7d36ff325..7eda483d7b5a 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -446,8 +446,10 @@ static struct btrfs_fs_devices *clone_fs_devices(struct btrfs_fs_devices *orig)
                         goto error;
 
                 device->name = kstrdup(orig_dev->name, GFP_NOFS);
-                if (!device->name)
+                if (!device->name) {
+                        kfree(device);
                         goto error;
+                }
 
                 device->devid = orig_dev->devid;
                 device->work.func = pending_bios_fn;
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index a9d3bf4d2689..b6dd5967c48a 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -260,7 +260,7 @@ err:
  * attributes are handled directly.
  */
 struct xattr_handler *btrfs_xattr_handlers[] = {
-#ifdef CONFIG_FS_POSIX_ACL
+#ifdef CONFIG_BTRFS_FS_POSIX_ACL
         &btrfs_xattr_acl_access_handler,
         &btrfs_xattr_acl_default_handler,
 #endif
diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c
index 431accd475a7..27089311fbea 100644
--- a/fs/cachefiles/interface.c
+++ b/fs/cachefiles/interface.c
@@ -114,8 +114,9 @@ nomem_lookup_data:
 
 /*
  * attempt to look up the nominated node in this cache
+ * - return -ETIMEDOUT to be scheduled again
  */
-static void cachefiles_lookup_object(struct fscache_object *_object)
+static int cachefiles_lookup_object(struct fscache_object *_object)
 {
         struct cachefiles_lookup_data *lookup_data;
         struct cachefiles_object *parent, *object;
@@ -145,13 +146,15 @@ static void cachefiles_lookup_object(struct fscache_object *_object)
             object->fscache.cookie->def->type != FSCACHE_COOKIE_TYPE_INDEX)
                 cachefiles_attr_changed(&object->fscache);
 
-        if (ret < 0) {
-                printk(KERN_WARNING "CacheFiles: Lookup failed error %d\n",
-                       ret);
+        if (ret < 0 && ret != -ETIMEDOUT) {
+                if (ret != -ENOBUFS)
+                        printk(KERN_WARNING
+                               "CacheFiles: Lookup failed error %d\n", ret);
                 fscache_object_lookup_error(&object->fscache);
         }
 
         _leave(" [%d]", ret);
+        return ret;
 }
 
 /*
@@ -331,6 +334,7 @@ static void cachefiles_put_object(struct fscache_object *_object)
                 }
 
                 cache = object->fscache.cache;
+                fscache_object_destroy(&object->fscache);
                 kmem_cache_free(cachefiles_object_jar, object);
                 fscache_object_destroyed(cache);
         }
@@ -403,12 +407,26 @@ static int cachefiles_attr_changed(struct fscache_object *_object)
         if (oi_size == ni_size)
                 return 0;
 
-        newattrs.ia_size = ni_size;
-        newattrs.ia_valid = ATTR_SIZE;
-
         cachefiles_begin_secure(cache, &saved_cred);
         mutex_lock(&object->backer->d_inode->i_mutex);
+
+        /* if there's an extension to a partial page at the end of the backing
+         * file, we need to discard the partial page so that we pick up new
+         * data after it */
+        if (oi_size & ~PAGE_MASK && ni_size > oi_size) {
+                _debug("discard tail %llx", oi_size);
+                newattrs.ia_valid = ATTR_SIZE;
+                newattrs.ia_size = oi_size & PAGE_MASK;
+                ret = notify_change(object->backer, &newattrs);
+                if (ret < 0)
+                        goto truncate_failed;
+        }
+
+        newattrs.ia_valid = ATTR_SIZE;
+        newattrs.ia_size = ni_size;
         ret = notify_change(object->backer, &newattrs);
+
+truncate_failed:
         mutex_unlock(&object->backer->d_inode->i_mutex);
         cachefiles_end_secure(cache, saved_cred);
 
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index 4ce818ae39ea..14ac4806e291 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -21,17 +21,81 @@
 #include <linux/security.h>
 #include "internal.h"
 
-static int cachefiles_wait_bit(void *flags)
+#define CACHEFILES_KEYBUF_SIZE 512
+
+/*
+ * dump debugging info about an object
+ */
+static noinline
+void __cachefiles_printk_object(struct cachefiles_object *object,
+                                const char *prefix,
+                                u8 *keybuf)
 {
-        schedule();
-        return 0;
+        struct fscache_cookie *cookie;
+        unsigned keylen, loop;
+
+        printk(KERN_ERR "%sobject: OBJ%x\n",
+               prefix, object->fscache.debug_id);
+        printk(KERN_ERR "%sobjstate=%s fl=%lx swfl=%lx ev=%lx[%lx]\n",
+               prefix, fscache_object_states[object->fscache.state],
+               object->fscache.flags, object->fscache.work.flags,
+               object->fscache.events,
+               object->fscache.event_mask & FSCACHE_OBJECT_EVENTS_MASK);
+        printk(KERN_ERR "%sops=%u inp=%u exc=%u\n",
+               prefix, object->fscache.n_ops, object->fscache.n_in_progress,
+               object->fscache.n_exclusive);
+        printk(KERN_ERR "%sparent=%p\n",
+               prefix, object->fscache.parent);
+
+        spin_lock(&object->fscache.lock);
+        cookie = object->fscache.cookie;
+        if (cookie) {
+                printk(KERN_ERR "%scookie=%p [pr=%p nd=%p fl=%lx]\n",
+                       prefix,
+                       object->fscache.cookie,
+                       object->fscache.cookie->parent,
+                       object->fscache.cookie->netfs_data,
+                       object->fscache.cookie->flags);
+                if (keybuf)
+                        keylen = cookie->def->get_key(cookie->netfs_data, keybuf,
+                                                      CACHEFILES_KEYBUF_SIZE);
+                else
+                        keylen = 0;
+        } else {
+                printk(KERN_ERR "%scookie=NULL\n", prefix);
+                keylen = 0;
+        }
+        spin_unlock(&object->fscache.lock);
+
+        if (keylen) {
+                printk(KERN_ERR "%skey=[%u] '", prefix, keylen);
+                for (loop = 0; loop < keylen; loop++)
+                        printk("%02x", keybuf[loop]);
+                printk("'\n");
+        }
+}
+
+/*
+ * dump debugging info about a pair of objects
+ */
+static noinline void cachefiles_printk_object(struct cachefiles_object *object,
+                                              struct cachefiles_object *xobject)
+{
+        u8 *keybuf;
+
+        keybuf = kmalloc(CACHEFILES_KEYBUF_SIZE, GFP_NOIO);
+        if (object)
+                __cachefiles_printk_object(object, "", keybuf);
+        if (xobject)
+                __cachefiles_printk_object(xobject, "x", keybuf);
+        kfree(keybuf);
 }
 
 /*
  * record the fact that an object is now active
  */
-static void cachefiles_mark_object_active(struct cachefiles_cache *cache,
-                                          struct cachefiles_object *object)
+static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
+                                         struct cachefiles_object *object)
 {
         struct cachefiles_object *xobject;
         struct rb_node **_p, *_parent = NULL;
@@ -42,8 +106,11 @@ static void cachefiles_mark_object_active(struct cachefiles_cache *cache,
 try_again:
         write_lock(&cache->active_lock);
 
-        if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags))
+        if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags)) {
+                printk(KERN_ERR "CacheFiles: Error: Object already active\n");
+                cachefiles_printk_object(object, NULL);
                 BUG();
+        }
 
         dentry = object->dentry;
         _p = &cache->active_nodes.rb_node;
@@ -66,8 +133,8 @@ try_again:
         rb_insert_color(&object->active_node, &cache->active_nodes);
 
         write_unlock(&cache->active_lock);
-        _leave("");
-        return;
+        _leave(" = 0");
+        return 0;
 
         /* an old object from a previous incarnation is hogging the slot - we
          * need to wait for it to be destroyed */
@@ -76,44 +143,70 @@ wait_for_old_object:
                 printk(KERN_ERR "\n");
                 printk(KERN_ERR "CacheFiles: Error:"
                        " Unexpected object collision\n");
-                printk(KERN_ERR "xobject: OBJ%x\n",
-                       xobject->fscache.debug_id);
-                printk(KERN_ERR "xobjstate=%s\n",
-                       fscache_object_states[xobject->fscache.state]);
-                printk(KERN_ERR "xobjflags=%lx\n", xobject->fscache.flags);
-                printk(KERN_ERR "xobjevent=%lx [%lx]\n",
-                       xobject->fscache.events, xobject->fscache.event_mask);
-                printk(KERN_ERR "xops=%u inp=%u exc=%u\n",
-                       xobject->fscache.n_ops, xobject->fscache.n_in_progress,
-                       xobject->fscache.n_exclusive);
-                printk(KERN_ERR "xcookie=%p [pr=%p nd=%p fl=%lx]\n",
-                       xobject->fscache.cookie,
-                       xobject->fscache.cookie->parent,
-                       xobject->fscache.cookie->netfs_data,
-                       xobject->fscache.cookie->flags);
-                printk(KERN_ERR "xparent=%p\n",
-                       xobject->fscache.parent);
-                printk(KERN_ERR "object: OBJ%x\n",
-                       object->fscache.debug_id);
-                printk(KERN_ERR "cookie=%p [pr=%p nd=%p fl=%lx]\n",
-                       object->fscache.cookie,
-                       object->fscache.cookie->parent,
-                       object->fscache.cookie->netfs_data,
-                       object->fscache.cookie->flags);
-                printk(KERN_ERR "parent=%p\n",
-                       object->fscache.parent);
+                cachefiles_printk_object(object, xobject);
                 BUG();
         }
         atomic_inc(&xobject->usage);
         write_unlock(&cache->active_lock);
 
-        _debug(">>> wait");
-        wait_on_bit(&xobject->flags, CACHEFILES_OBJECT_ACTIVE,
-                    cachefiles_wait_bit, TASK_UNINTERRUPTIBLE);
-        _debug("<<< waited");
+        if (test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
+                wait_queue_head_t *wq;
+
+                signed long timeout = 60 * HZ;
+                wait_queue_t wait;
+                bool requeue;
+
+                /* if the object we're waiting for is queued for processing,
+                 * then just put ourselves on the queue behind it */
+                if (slow_work_is_queued(&xobject->fscache.work)) {
+                        _debug("queue OBJ%x behind OBJ%x immediately",
+                               object->fscache.debug_id,
+                               xobject->fscache.debug_id);
+                        goto requeue;
+                }
+
+                /* otherwise we sleep until either the object we're waiting for
+                 * is done, or the slow-work facility wants the thread back to
+                 * do other work */
+                wq = bit_waitqueue(&xobject->flags, CACHEFILES_OBJECT_ACTIVE);
+                init_wait(&wait);
+                requeue = false;
+                do {
+                        prepare_to_wait(wq, &wait, TASK_UNINTERRUPTIBLE);
+                        if (!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags))
+                                break;
+                        requeue = slow_work_sleep_till_thread_needed(
+                                &object->fscache.work, &timeout);
+                } while (timeout > 0 && !requeue);
+                finish_wait(wq, &wait);
+
+                if (requeue &&
+                    test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
+                        _debug("queue OBJ%x behind OBJ%x after wait",
+                               object->fscache.debug_id,
+                               xobject->fscache.debug_id);
+                        goto requeue;
+                }
+
+                if (timeout <= 0) {
+                        printk(KERN_ERR "\n");
+                        printk(KERN_ERR "CacheFiles: Error: Overlong"
+                               " wait for old active object to go away\n");
+                        cachefiles_printk_object(object, xobject);
+                        goto requeue;
+                }
+        }
+
+        ASSERT(!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags));
 
         cache->cache.ops->put_object(&xobject->fscache);
         goto try_again;
+
+requeue:
+        clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
+        cache->cache.ops->put_object(&xobject->fscache);
+        _leave(" = -ETIMEDOUT");
+        return -ETIMEDOUT;
 }
 
 /*
@@ -254,7 +347,7 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
 
         dir = dget_parent(object->dentry);
 
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
         ret = cachefiles_bury_object(cache, dir, object->dentry);
 
         dput(dir);
@@ -307,7 +400,7 @@ lookup_again:
         /* search the current directory for the element name */
         _debug("lookup '%s'", name);
 
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
 
         start = jiffies;
         next = lookup_one_len(name, dir, nlen);
@@ -418,12 +511,15 @@ lookup_again:
         }
 
         /* note that we're now using this object */
-        cachefiles_mark_object_active(cache, object);
+        ret = cachefiles_mark_object_active(cache, object);
 
         mutex_unlock(&dir->d_inode->i_mutex);
         dput(dir);
         dir = NULL;
 
+        if (ret == -ETIMEDOUT)
+                goto mark_active_timed_out;
+
         _debug("=== OBTAINED_OBJECT ===");
 
         if (object->new) {
@@ -467,6 +563,10 @@ create_error:
                 cachefiles_io_error(cache, "Create/mkdir failed");
         goto error;
 
+mark_active_timed_out:
+        _debug("mark active timed out");
+        goto release_dentry;
+
 check_error:
         _debug("check error %d", ret);
         write_lock(&cache->active_lock);
@@ -474,7 +574,7 @@ check_error:
         clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
         wake_up_bit(&object->flags, CACHEFILES_OBJECT_ACTIVE);
         write_unlock(&cache->active_lock);
-
+release_dentry:
         dput(object->dentry);
         object->dentry = NULL;
         goto error_out;
@@ -495,9 +595,6 @@ error:
 error_out2:
         dput(dir);
 error_out:
-        if (ret == -ENOSPC)
-                ret = -ENOBUFS;
-
         _leave(" = error %d", -ret);
         return ret;
 }
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index a69787e7dd96..a6c8c6fe8df9 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -11,6 +11,7 @@
 
 #include <linux/mount.h>
 #include <linux/file.h>
+#include <linux/ima.h>
 #include "internal.h"
 
 /*
@@ -40,8 +41,10 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode,
 
         _debug("--- monitor %p %lx ---", page, page->flags);
 
-        if (!PageUptodate(page) && !PageError(page))
-                dump_stack();
+        if (!PageUptodate(page) && !PageError(page)) {
+                /* unlocked, not uptodate and not erronous? */
+                _debug("page probably truncated");
+        }
 
         /* remove from the waitqueue */
         list_del(&wait->task_list);
@@ -61,6 +64,84 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode,
 }
 
 /*
+ * handle a probably truncated page
+ * - check to see if the page is still relevant and reissue the read if
+ *   possible
+ * - return -EIO on error, -ENODATA if the page is gone, -EINPROGRESS if we
+ *   must wait again and 0 if successful
+ */
+static int cachefiles_read_reissue(struct cachefiles_object *object,
+                                   struct cachefiles_one_read *monitor)
+{
+        struct address_space *bmapping = object->backer->d_inode->i_mapping;
+        struct page *backpage = monitor->back_page, *backpage2;
+        int ret;
+
+        kenter("{ino=%lx},{%lx,%lx}",
+               object->backer->d_inode->i_ino,
+               backpage->index, backpage->flags);
+
+        /* skip if the page was truncated away completely */
+        if (backpage->mapping != bmapping) {
+                kleave(" = -ENODATA [mapping]");
+                return -ENODATA;
+        }
+
+        backpage2 = find_get_page(bmapping, backpage->index);
+        if (!backpage2) {
+                kleave(" = -ENODATA [gone]");
+                return -ENODATA;
+        }
+
+        if (backpage != backpage2) {
+                put_page(backpage2);
+                kleave(" = -ENODATA [different]");
+                return -ENODATA;
+        }
+
+        /* the page is still there and we already have a ref on it, so we don't
+         * need a second */
+        put_page(backpage2);
+
+        INIT_LIST_HEAD(&monitor->op_link);
+        add_page_wait_queue(backpage, &monitor->monitor);
+
+        if (trylock_page(backpage)) {
+                ret = -EIO;
+                if (PageError(backpage))
+                        goto unlock_discard;
+                ret = 0;
+                if (PageUptodate(backpage))
+                        goto unlock_discard;
+
+                kdebug("reissue read");
+                ret = bmapping->a_ops->readpage(NULL, backpage);
+                if (ret < 0)
+                        goto unlock_discard;
+        }
+
+        /* but the page may have been read before the monitor was installed, so
+         * the monitor may miss the event - so we have to ensure that we do get
+         * one in such a case */
+        if (trylock_page(backpage)) {
+                _debug("jumpstart %p {%lx}", backpage, backpage->flags);
+                unlock_page(backpage);
+        }
+
+        /* it'll reappear on the todo list */
+        kleave(" = -EINPROGRESS");
+        return -EINPROGRESS;
+
+unlock_discard:
+        unlock_page(backpage);
+        spin_lock_irq(&object->work_lock);
+        list_del(&monitor->op_link);
+        spin_unlock_irq(&object->work_lock);
+        kleave(" = %d", ret);
+        return ret;
+}
+
+/*
  * copy data from backing pages to netfs pages to complete a read operation
  * - driven by FS-Cache's thread pool
  */
@@ -92,20 +173,26 @@ static void cachefiles_read_copier(struct fscache_operation *_op)
 
                 _debug("- copy {%lu}", monitor->back_page->index);
 
-                error = -EIO;
+        recheck:
                 if (PageUptodate(monitor->back_page)) {
                         copy_highpage(monitor->netfs_page, monitor->back_page);
 
                         pagevec_add(&pagevec, monitor->netfs_page);
                         fscache_mark_pages_cached(monitor->op, &pagevec);
                         error = 0;
-                }
-
-                if (error)
+                } else if (!PageError(monitor->back_page)) {
+                        /* the page has probably been truncated */
+                        error = cachefiles_read_reissue(object, monitor);
+                        if (error == -EINPROGRESS)
+                                goto next;
+                        goto recheck;
+                } else {
                         cachefiles_io_error_obj(
                                 object,
                                 "Readpage failed on backing file %lx",
                                 (unsigned long) monitor->back_page->flags);
+                        error = -EIO;
+                }
 
                 page_cache_release(monitor->back_page);
 
@@ -114,6 +201,7 @@ static void cachefiles_read_copier(struct fscache_operation *_op)
                 fscache_put_retrieval(op);
                 kfree(monitor);
 
+        next:
                 /* let the thread pool have some air occasionally */
                 max--;
                 if (max < 0 || need_resched()) {
@@ -333,7 +421,8 @@ int cachefiles_read_or_alloc_page(struct fscache_retrieval *op,
 
         shift = PAGE_SHIFT - inode->i_sb->s_blocksize_bits;
 
-        op->op.flags = FSCACHE_OP_FAST;
+        op->op.flags &= FSCACHE_OP_KEEP_FLAGS;
+        op->op.flags |= FSCACHE_OP_FAST;
         op->op.processor = cachefiles_read_copier;
 
         pagevec_init(&pagevec, 0);
@@ -639,7 +728,8 @@ int cachefiles_read_or_alloc_pages(struct fscache_retrieval *op,
 
         pagevec_init(&pagevec, 0);
 
-        op->op.flags = FSCACHE_OP_FAST;
+        op->op.flags &= FSCACHE_OP_KEEP_FLAGS;
+        op->op.flags |= FSCACHE_OP_FAST;
         op->op.processor = cachefiles_read_copier;
 
         INIT_LIST_HEAD(&backpages);
@@ -801,7 +891,8 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
         struct cachefiles_cache *cache;
         mm_segment_t old_fs;
         struct file *file;
-        loff_t pos;
+        loff_t pos, eof;
+        size_t len;
         void *data;
         int ret;
 
@@ -832,18 +923,33 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
         if (IS_ERR(file)) {
                 ret = PTR_ERR(file);
         } else {
+                ima_counts_get(file);
                 ret = -EIO;
                 if (file->f_op->write) {
                         pos = (loff_t) page->index << PAGE_SHIFT;
+
+                        /* we mustn't write more data than we have, so we have
+                         * to beware of a partial page at EOF */
+                        eof = object->fscache.store_limit_l;
+                        len = PAGE_SIZE;
+                        if (eof & ~PAGE_MASK) {
+                                ASSERTCMP(pos, <, eof);
+                                if (eof - pos < PAGE_SIZE) {
+                                        _debug("cut short %llx to %llx",
+                                               pos, eof);
+                                        len = eof - pos;
+                                        ASSERTCMP(pos + len, ==, eof);
+                                }
+                        }
+
                         data = kmap(page);
                         old_fs = get_fs();
                         set_fs(KERNEL_DS);
                         ret = file->f_op->write(
-                                file, (const void __user *) data, PAGE_SIZE,
-                                &pos);
+                                file, (const void __user *) data, len, &pos);
                         set_fs(old_fs);
                         kunmap(page);
-                        if (ret != PAGE_SIZE)
+                        if (ret != len)
                                 ret = -EIO;
                 }
                 fput(file);
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 145540a316ab..094ea65afc85 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,12 @@
+Version 1.61
+------------
+Fix append problem to Samba servers (files opened with O_APPEND could
+have duplicated data). Fix oops in cifs_lookup. Workaround problem
+mounting to OS/400 Netserve. Fix oops in cifs_get_tcp_session.
+Disable use of server inode numbers when server only
+partially supports them (e.g. for one server querying inode numbers on
+FindFirst fails but QPathInfo queries works).
+
 Version 1.60
 -------------
 Fix memory leak in reconnect.  Fix oops in DFS mount error path.
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 9a5e4f5f3122..29f1da761bbf 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1037,7 +1037,7 @@ init_cifs(void)
         if (rc)
                 goto out_unregister_key_type;
 #endif
-        rc = slow_work_register_user();
+        rc = slow_work_register_user(THIS_MODULE);
         if (rc)
                 goto out_unregister_resolver_key;
 
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 6928c24d1d42..5646727e33f5 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -388,4 +388,5 @@ extern int CIFSSMBSetPosixACL(const int xid, struct cifsTconInfo *tcon,
                 const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSGetExtAttr(const int xid, struct cifsTconInfo *tcon,
                         const int netfid, __u64 *pExtAttrBits, __u64 *pMask);
+extern void cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb);
 #endif                  /* _CIFSPROTO_H */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 43003e0bef18..63ea83ff687f 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1577,7 +1577,8 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
 
 out_err:
         if (tcp_ses) {
-                kfree(tcp_ses->hostname);
+                if (!IS_ERR(tcp_ses->hostname))
+                        kfree(tcp_ses->hostname);
                 if (tcp_ses->ssocket)
                         sock_release(tcp_ses->ssocket);
                 kfree(tcp_ses);
@@ -2219,16 +2220,8 @@ is_path_accessible(int xid, struct cifsTconInfo *tcon,
                    struct cifs_sb_info *cifs_sb, const char *full_path)
 {
         int rc;
-        __u64 inode_num;
         FILE_ALL_INFO *pfile_info;
 
-        rc = CIFSGetSrvInodeNumber(xid, tcon, full_path, &inode_num,
-                                   cifs_sb->local_nls,
-                                   cifs_sb->mnt_cifs_flags &
-                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
-        if (rc != -EOPNOTSUPP)
-                return rc;
-
         pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
         if (pfile_info == NULL)
                 return -ENOMEM;
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 627a60a6c1b1..1f42f772865a 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -214,8 +214,6 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
                 posix_flags |= SMB_O_EXCL;
         if (oflags & O_TRUNC)
                 posix_flags |= SMB_O_TRUNC;
-        if (oflags & O_APPEND)
-                posix_flags |= SMB_O_APPEND;
         if (oflags & O_SYNC)
                 posix_flags |= SMB_O_SYNC;
         if (oflags & O_DIRECTORY)
@@ -643,9 +641,9 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
          * O_EXCL: optimize away the lookup, but don't hash the dentry. Let
          * the VFS handle the create.
          */
-        if (nd->flags & LOOKUP_EXCL) {
+        if (nd && (nd->flags & LOOKUP_EXCL)) {
                 d_instantiate(direntry, NULL);
-                return 0;
+                return NULL;
         }
 
         /* can not grab the rename sem here since it would
@@ -675,7 +673,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
          * reduction in network traffic in the other paths.
          */
         if (pTcon->unix_ext) {
-                if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
+                if (nd && !(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
                      (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open &&
                      (nd->intent.open.flags & O_CREAT)) {
                         rc = cifs_posix_open(full_path, &newInode, nd->path.mnt,
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 5e2492535daa..cababd8a52df 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -512,13 +512,10 @@ int cifs_get_inode_info(struct inode **pinode,
                                         cifs_sb->local_nls,
                                         cifs_sb->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
-                        if (rc1) {
+                        if (rc1 || !fattr.cf_uniqueid) {
                                 cFYI(1, ("GetSrvInodeNum rc %d", rc1));
                                 fattr.cf_uniqueid = iunique(sb, ROOT_I);
-                                /* disable serverino if call not supported */
-                                if (rc1 == -EINVAL)
-                                        cifs_sb->mnt_cifs_flags &=
-                                                        ~CIFS_MOUNT_SERVER_INUM;
+                                cifs_autodisable_serverino(cifs_sb);
                         }
                 } else {
                         fattr.cf_uniqueid = iunique(sb, ROOT_I);
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 0241b25ac33f..d27d4ec6579b 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -715,3 +715,17 @@ cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
 ctoUCS_out:
         return i;
 }
+
+void
+cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb)
+{
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
+                cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM;
+                cERROR(1, ("Autodisabling the use of server inode numbers on "
+                           "%s. This server doesn't seem to support them "
+                           "properly. Hardlinks will not be recognized on this "
+                           "mount. Consider mounting with the \"noserverino\" "
+                           "option to silence this message.",
+                           cifs_sb->tcon->treeName));
+        }
+}
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 1f098ca71636..f84062f9a985 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -727,11 +727,12 @@ static int cifs_filldir(char *pfindEntry, struct file *file, filldir_t filldir,
                 cifs_dir_info_to_fattr(&fattr, (FILE_DIRECTORY_INFO *)
                                         pfindEntry, cifs_sb);
 
-        /* FIXME: make _to_fattr functions fill this out */
-        if (pCifsF->srch_inf.info_level == SMB_FIND_FILE_ID_FULL_DIR_INFO)
+        if (inum && (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) {
                 fattr.cf_uniqueid = inum;
-        else
+        } else {
                 fattr.cf_uniqueid = iunique(sb, ROOT_I);
+                cifs_autodisable_serverino(cifs_sb);
+        }
 
         ino = cifs_uniqueid_to_ino_t(fattr.cf_uniqueid);
         tmp_dentry = cifs_readdir_lookup(file->f_dentry, &qstring, &fattr);
diff --git a/fs/coda/psdev.c b/fs/coda/psdev.c
index 0376ac66c44a..be4392ca2098 100644
--- a/fs/coda/psdev.c
+++ b/fs/coda/psdev.c
@@ -22,6 +22,7 @@
 #include <linux/kernel.h>
 #include <linux/major.h>
 #include <linux/time.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/ioport.h>
 #include <linux/fcntl.h>
diff --git a/fs/compat.c b/fs/compat.c
index d576b552e8e2..6c19040ffeef 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1532,6 +1532,8 @@ int compat_do_execve(char * filename,
         if (retval < 0)
                 goto out;
 
+        current->stack_start = current->mm->start_stack;
+
         /* execve succeeded */
         current->fs->in_exec = 0;
         current->in_execve = 0;
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index f91fd51b32e3..d84e7058c298 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1800,7 +1800,7 @@ struct space_resv_32 {
 /* just account for different alignment */
 static int compat_ioctl_preallocate(struct file *file, unsigned long arg)
 {
-        struct space_resv_32    __user *p32 = (void __user *)arg;
+        struct space_resv_32    __user *p32 = compat_ptr(arg);
         struct space_resv       __user *p = compat_alloc_user_space(sizeof(*p));
 
         if (copy_in_user(&p->l_type,    &p32->l_type,   sizeof(s16)) ||
@@ -2802,7 +2802,7 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
 #else
         case FS_IOC_RESVSP:
         case FS_IOC_RESVSP64:
-                error = ioctl_preallocate(filp, (void __user *)arg);
+                error = ioctl_preallocate(filp, compat_ptr(arg));
                 goto out_fput;
 #endif
 
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 240cef14fe58..70736eb4b516 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -316,6 +316,10 @@ int dlm_lowcomms_connect_node(int nodeid)
 {
         struct connection *con;
 
+        /* with sctp there's no connecting without sending */
+        if (dlm_config.ci_protocol != 0)
+                return 0;
+
         if (nodeid == dlm_our_nodeid())
                 return 0;
 
@@ -455,9 +459,9 @@ static void process_sctp_notification(struct connection *con,
                         int prim_len, ret;
                         int addr_len;
                         struct connection *new_con;
-                        struct file *file;
                         sctp_peeloff_arg_t parg;
                         int parglen = sizeof(parg);
+                        int err;
 
                         /*
                          * We get this before any data for an association.
@@ -512,19 +516,22 @@ static void process_sctp_notification(struct connection *con,
                         ret = kernel_getsockopt(con->sock, IPPROTO_SCTP,
                                                 SCTP_SOCKOPT_PEELOFF,
                                                 (void *)&parg, &parglen);
-                        if (ret) {
+                        if (ret < 0) {
                                 log_print("Can't peel off a socket for "
-                                          "connection %d to node %d: err=%d\n",
+                                          "connection %d to node %d: err=%d",
                                           parg.associd, nodeid, ret);
+                                return;
+                        }
+                        new_con->sock = sockfd_lookup(parg.sd, &err);
+                        if (!new_con->sock) {
+                                log_print("sockfd_lookup error %d", err);
+                                return;
                         }
-                        file = fget(parg.sd);
-                        new_con->sock = SOCKET_I(file->f_dentry->d_inode);
                         add_sock(new_con->sock, new_con);
-                        fput(file);
-                        put_unused_fd(parg.sd);
+                        sockfd_put(new_con->sock);
 
-                        log_print("got new/restarted association %d nodeid %d",
-                                 (int)sn->sn_assoc_change.sac_assoc_id, nodeid);
+                        log_print("connecting to %d sctp association %d",
+                                 nodeid, (int)sn->sn_assoc_change.sac_assoc_id);
 
                         /* Send any pending writes */
                         clear_bit(CF_CONNECT_PENDING, &new_con->flags);
@@ -837,8 +844,6 @@ static void sctp_init_assoc(struct connection *con)
         if (con->retries++ > MAX_CONNECT_RETRIES)
                 return;
 
-        log_print("Initiating association with node %d", con->nodeid);
-
         if (nodeid_to_addr(con->nodeid, (struct sockaddr *)&rem_addr)) {
                 log_print("no address for nodeid %d", con->nodeid);
                 return;
@@ -855,11 +860,14 @@ static void sctp_init_assoc(struct connection *con)
         outmessage.msg_flags = MSG_EOR;
 
         spin_lock(&con->writequeue_lock);
-        e = list_entry(con->writequeue.next, struct writequeue_entry,
-                       list);
 
-        BUG_ON((struct list_head *) e == &con->writequeue);
+        if (list_empty(&con->writequeue)) {
+                spin_unlock(&con->writequeue_lock);
+                log_print("writequeue empty for nodeid %d", con->nodeid);
+                return;
+        }
 
+        e = list_first_entry(&con->writequeue, struct writequeue_entry, list);
         len = e->len;
         offset = e->offset;
         spin_unlock(&con->writequeue_lock);
diff --git a/fs/ecryptfs/Kconfig b/fs/ecryptfs/Kconfig
index 8aadb99b7634..1cd6d9d3e29a 100644
--- a/fs/ecryptfs/Kconfig
+++ b/fs/ecryptfs/Kconfig
@@ -1,8 +1,9 @@
 config ECRYPT_FS
         tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && KEYS && NET
+        depends on EXPERIMENTAL && KEYS && CRYPTO
         select CRYPTO_ECB
         select CRYPTO_CBC
+        select CRYPTO_MD5
         help
           Encrypted filesystem that operates on the VFS layer.  See
           <file:Documentation/filesystems/ecryptfs.txt> to learn more about
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 101fe4c7b1ee..c6ac85d6c701 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -35,6 +35,7 @@
 #include <linux/key.h>
 #include <linux/parser.h>
 #include <linux/fs_stack.h>
+#include <linux/ima.h>
 #include "ecryptfs_kernel.h"
 
 /**
@@ -118,6 +119,7 @@ int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
         const struct cred *cred = current_cred();
         struct ecryptfs_inode_info *inode_info =
                 ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
+        int opened_lower_file = 0;
         int rc = 0;
 
         mutex_lock(&inode_info->lower_file_mutex);
@@ -134,9 +136,12 @@ int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
                                "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
                                "rc = [%d]\n", lower_dentry, lower_mnt, rc);
                         inode_info->lower_file = NULL;
-                }
+                } else
+                        opened_lower_file = 1;
         }
         mutex_unlock(&inode_info->lower_file_mutex);
+        if (opened_lower_file)
+                ima_counts_get(inode_info->lower_file);
         return rc;
 }
 
diff --git a/fs/exec.c b/fs/exec.c
index d164342c2b69..c0c636e34f60 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -623,10 +623,8 @@ int setup_arg_pages(struct linux_binprm *bprm,
         /* Move stack pages down in memory. */
         if (stack_shift) {
                 ret = shift_arg_pages(vma, stack_shift);
-                if (ret) {
-                        up_write(&mm->mmap_sem);
-                        return ret;
-                }
+                if (ret)
+                        goto out_unlock;
         }
 
 #ifdef CONFIG_STACK_GROWSUP
@@ -640,7 +638,7 @@ int setup_arg_pages(struct linux_binprm *bprm,
 
 out_unlock:
         up_write(&mm->mmap_sem);
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL(setup_arg_pages);
 
diff --git a/fs/ext3/fsync.c b/fs/ext3/fsync.c
index 451d166bbe93..8209f266e9ad 100644
--- a/fs/ext3/fsync.c
+++ b/fs/ext3/fsync.c
@@ -46,19 +46,21 @@
 int ext3_sync_file(struct file * file, struct dentry *dentry, int datasync)
 {
         struct inode *inode = dentry->d_inode;
+        struct ext3_inode_info *ei = EXT3_I(inode);
+        journal_t *journal = EXT3_SB(inode->i_sb)->s_journal;
         int ret = 0;
+        tid_t commit_tid;
+
+        if (inode->i_sb->s_flags & MS_RDONLY)
+                return 0;
 
         J_ASSERT(ext3_journal_current_handle() == NULL);
 
         /*
-         * data=writeback:
+         * data=writeback,ordered:
          *  The caller's filemap_fdatawrite()/wait will sync the data.
-         *  sync_inode() will sync the metadata
-         *
-         * data=ordered:
-         *  The caller's filemap_fdatawrite() will write the data and
-         *  sync_inode() will write the inode if it is dirty.  Then the caller's
-         *  filemap_fdatawait() will wait on the pages.
+         *  Metadata is in the journal, we wait for a proper transaction
+         *  to commit here.
          *
          * data=journal:
          *  filemap_fdatawrite won't do anything (the buffers are clean).
@@ -73,22 +75,16 @@ int ext3_sync_file(struct file * file, struct dentry *dentry, int datasync)
                 goto out;
         }
 
-        if (datasync && !(inode->i_state & I_DIRTY_DATASYNC))
-                goto flush;
+        if (datasync)
+                commit_tid = atomic_read(&ei->i_datasync_tid);
+        else
+                commit_tid = atomic_read(&ei->i_sync_tid);
 
-        /*
-         * The VFS has written the file data.  If the inode is unaltered
-         * then we need not start a commit.
-         */
-        if (inode->i_state & (I_DIRTY_SYNC|I_DIRTY_DATASYNC)) {
-                struct writeback_control wbc = {
-                        .sync_mode = WB_SYNC_ALL,
-                        .nr_to_write = 0, /* sys_fsync did this */
-                };
-                ret = sync_inode(inode, &wbc);
+        if (log_start_commit(journal, commit_tid)) {
+                log_wait_commit(journal, commit_tid);
                 goto out;
         }
-flush:
+
         /*
          * In case we didn't commit a transaction, we have to flush
          * disk caches manually so that data really is on persistent
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index acf1b1423327..354ed3b47b30 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -699,8 +699,9 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode,
         int err = 0;
         struct ext3_block_alloc_info *block_i;
         ext3_fsblk_t current_block;
+        struct ext3_inode_info *ei = EXT3_I(inode);
 
-        block_i = EXT3_I(inode)->i_block_alloc_info;
+        block_i = ei->i_block_alloc_info;
         /*
          * If we're splicing into a [td]indirect block (as opposed to the
          * inode) then we need to get write access to the [td]indirect block
@@ -741,6 +742,8 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode,
 
         inode->i_ctime = CURRENT_TIME_SEC;
         ext3_mark_inode_dirty(handle, inode);
+        /* ext3_mark_inode_dirty already updated i_sync_tid */
+        atomic_set(&ei->i_datasync_tid, handle->h_transaction->t_tid);
 
         /* had we spliced it onto indirect block? */
         if (where->bh) {
@@ -1735,6 +1738,7 @@ static ssize_t ext3_direct_IO(int rw, struct kiocb *iocb,
         ssize_t ret;
         int orphan = 0;
         size_t count = iov_length(iov, nr_segs);
+        int retries = 0;
 
         if (rw == WRITE) {
                 loff_t final_size = offset + count;
@@ -1757,9 +1761,12 @@ static ssize_t ext3_direct_IO(int rw, struct kiocb *iocb,
                 }
         }
 
+retry:
         ret = blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
                                  offset, nr_segs,
                                  ext3_get_block, NULL);
+        if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
+                goto retry;
 
         if (orphan) {
                 int err;
@@ -2750,6 +2757,8 @@ struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
         struct ext3_inode_info *ei;
         struct buffer_head *bh;
         struct inode *inode;
+        journal_t *journal = EXT3_SB(sb)->s_journal;
+        transaction_t *transaction;
         long ret;
         int block;
 
@@ -2827,6 +2836,30 @@ struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
                 ei->i_data[block] = raw_inode->i_block[block];
         INIT_LIST_HEAD(&ei->i_orphan);
 
+        /*
+         * Set transaction id's of transactions that have to be committed
+         * to finish f[data]sync. We set them to currently running transaction
+         * as we cannot be sure that the inode or some of its metadata isn't
+         * part of the transaction - the inode could have been reclaimed and
+         * now it is reread from disk.
+         */
+        if (journal) {
+                tid_t tid;
+
+                spin_lock(&journal->j_state_lock);
+                if (journal->j_running_transaction)
+                        transaction = journal->j_running_transaction;
+                else
+                        transaction = journal->j_committing_transaction;
+                if (transaction)
+                        tid = transaction->t_tid;
+                else
+                        tid = journal->j_commit_sequence;
+                spin_unlock(&journal->j_state_lock);
+                atomic_set(&ei->i_sync_tid, tid);
+                atomic_set(&ei->i_datasync_tid, tid);
+        }
+
         if (inode->i_ino >= EXT3_FIRST_INO(inode->i_sb) + 1 &&
             EXT3_INODE_SIZE(inode->i_sb) > EXT3_GOOD_OLD_INODE_SIZE) {
                 /*
@@ -3011,6 +3044,7 @@ again:
                 err = rc;
         ei->i_state &= ~EXT3_STATE_NEW;
 
+        atomic_set(&ei->i_sync_tid, handle->h_transaction->t_tid);
 out_brelse:
         brelse (bh);
         ext3_std_error(inode->i_sb, err);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 72743d360509..427496c4767c 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -466,6 +466,8 @@ static struct inode *ext3_alloc_inode(struct super_block *sb)
                 return NULL;
         ei->i_block_alloc_info = NULL;
         ei->vfs_inode.i_version = 1;
+        atomic_set(&ei->i_datasync_tid, 0);
+        atomic_set(&ei->i_sync_tid, 0);
         return &ei->vfs_inode;
 }
 
@@ -2321,7 +2323,18 @@ static int ext3_commit_super(struct super_block *sb,
 
         if (!sbh)
                 return error;
-        es->s_wtime = cpu_to_le32(get_seconds());
+        /*
+         * If the file system is mounted read-only, don't update the
+         * superblock write time.  This avoids updating the superblock
+         * write time when we are mounting the root file system
+         * read/only but we need to replay the journal; at that point,
+         * for people who are east of GMT and who make their clock
+         * tick in localtime for Windows bug-for-bug compatibility,
+         * the clock is set in the future, and this will cause e2fsck
+         * to complain and force a full file system check.
+         */
+        if (!(sb->s_flags & MS_RDONLY))
+                es->s_wtime = cpu_to_le32(get_seconds());
         es->s_free_blocks_count = cpu_to_le32(ext3_count_free_blocks(sb));
         es->s_free_inodes_count = cpu_to_le32(ext3_count_free_inodes(sb));
         BUFFER_TRACE(sbh, "marking dirty");
diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig
index d5c0ea2e8f2d..9f2d45d75b1a 100644
--- a/fs/ext4/Kconfig
+++ b/fs/ext4/Kconfig
@@ -26,20 +26,6 @@ config EXT4_FS
 
           If unsure, say N.
 
-config EXT4DEV_COMPAT
-        bool "Enable ext4dev compatibility"
-        depends on EXT4_FS
-        help
-          Starting with 2.6.28, the name of the ext4 filesystem was
-          renamed from ext4dev to ext4.  Unfortunately there are some
-          legacy userspace programs (such as klibc's fstype) have
-          "ext4dev" hardcoded.
-
-          To enable backwards compatibility so that systems that are
-          still expecting to mount ext4 filesystems using ext4dev,
-          choose Y here.   This feature will go away by 2.6.31, so
-          please arrange to get your userspace programs fixed!
-
 config EXT4_FS_XATTR
         bool "Ext4 extended attributes"
         depends on EXT4_FS
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index e227eea23f05..8825515eeddd 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -65,6 +65,12 @@ typedef __u32 ext4_lblk_t;
 /* data type for block group number */
 typedef unsigned int ext4_group_t;
 
+/*
+ * Flags used in mballoc's allocation_context flags field.  
+ *
+ * Also used to show what's going on for debugging purposes when the
+ * flag field is exported via the traceport interface
+ */
 
 /* prefer goal again. length */
 #define EXT4_MB_HINT_MERGE              0x0001
@@ -127,6 +133,16 @@ struct mpage_da_data {
         int pages_written;
         int retval;
 };
+#define DIO_AIO_UNWRITTEN       0x1
+typedef struct ext4_io_end {
+        struct list_head        list;           /* per-file finished AIO list */
+        struct inode            *inode;         /* file being written to */
+        unsigned int            flag;           /* unwritten or not */
+        int                     error;          /* I/O error code */
+        ext4_lblk_t             offset;         /* offset in the file */
+        size_t                  size;           /* size of the extent */
+        struct work_struct      work;           /* data work queue */
+} ext4_io_end_t;
 
 /*
  * Special inodes numbers
@@ -306,6 +322,7 @@ static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
 #define EXT4_STATE_NO_EXPAND            0x00000008 /* No space for expansion */
 #define EXT4_STATE_DA_ALLOC_CLOSE       0x00000010 /* Alloc DA blks on close */
 #define EXT4_STATE_EXT_MIGRATE          0x00000020 /* Inode is migrating */
+#define EXT4_STATE_DIO_UNWRITTEN        0x00000040 /* need convert on dio done*/
 
 /* Used to pass group descriptor data when online resize is done */
 struct ext4_new_group_input {
@@ -347,7 +364,16 @@ struct ext4_new_group_data {
         /* Call ext4_da_update_reserve_space() after successfully 
            allocating the blocks */
 #define EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE    0x0008
-
+        /* caller is from the direct IO path, request to creation of an
+        unitialized extents if not allocated, split the uninitialized
+        extent if blocks has been preallocated already*/
+#define EXT4_GET_BLOCKS_DIO                     0x0010
+#define EXT4_GET_BLOCKS_CONVERT                 0x0020
+#define EXT4_GET_BLOCKS_DIO_CREATE_EXT          (EXT4_GET_BLOCKS_DIO|\
+                                         EXT4_GET_BLOCKS_CREATE_UNINIT_EXT)
+        /* Convert extent to initialized after direct IO complete */
+#define EXT4_GET_BLOCKS_DIO_CONVERT_EXT         (EXT4_GET_BLOCKS_CONVERT|\
+                                         EXT4_GET_BLOCKS_DIO_CREATE_EXT)
 
 /*
  * ioctl commands
@@ -500,8 +526,8 @@ struct move_extent {
 static inline __le32 ext4_encode_extra_time(struct timespec *time)
 {
        return cpu_to_le32((sizeof(time->tv_sec) > 4 ?
-                           time->tv_sec >> 32 : 0) |
-                           ((time->tv_nsec << 2) & EXT4_NSEC_MASK));
+                           (time->tv_sec >> 32) & EXT4_EPOCH_MASK : 0) |
+                          ((time->tv_nsec << EXT4_EPOCH_BITS) & EXT4_NSEC_MASK));
 }
 
 static inline void ext4_decode_extra_time(struct timespec *time, __le32 extra)
@@ -509,7 +535,7 @@ static inline void ext4_decode_extra_time(struct timespec *time, __le32 extra)
        if (sizeof(time->tv_sec) > 4)
                time->tv_sec |= (__u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK)
                                << 32;
-       time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> 2;
+       time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
 }
 
 #define EXT4_INODE_SET_XTIME(xtime, inode, raw_inode)                          \
@@ -672,6 +698,11 @@ struct ext4_inode_info {
         __u16 i_extra_isize;
 
         spinlock_t i_block_reservation_lock;
+
+        /* completed async DIOs that might need unwritten extents handling */
+        struct list_head i_aio_dio_complete_list;
+        /* current io_end structure for async DIO write*/
+        ext4_io_end_t *cur_aio_dio;
 };
 
 /*
@@ -713,6 +744,7 @@ struct ext4_inode_info {
 #define EXT4_MOUNT_QUOTA                0x80000 /* Some quota option set */
 #define EXT4_MOUNT_USRQUOTA             0x100000 /* "old" user quota */
 #define EXT4_MOUNT_GRPQUOTA             0x200000 /* "old" group quota */
+#define EXT4_MOUNT_JOURNAL_CHECKSUM     0x800000 /* Journal checksums */
 #define EXT4_MOUNT_JOURNAL_ASYNC_COMMIT 0x1000000 /* Journal Async Commit */
 #define EXT4_MOUNT_I_VERSION            0x2000000 /* i_version support */
 #define EXT4_MOUNT_DELALLOC             0x8000000 /* Delalloc support */
@@ -942,18 +974,11 @@ struct ext4_sb_info {
         unsigned int s_mb_stats;
         unsigned int s_mb_order2_reqs;
         unsigned int s_mb_group_prealloc;
+        unsigned int s_max_writeback_mb_bump;
         /* where last allocation was done - for stream allocation */
         unsigned long s_mb_last_group;
         unsigned long s_mb_last_start;
 
-        /* history to debug policy */
-        struct ext4_mb_history *s_mb_history;
-        int s_mb_history_cur;
-        int s_mb_history_max;
-        int s_mb_history_num;
-        spinlock_t s_mb_history_lock;
-        int s_mb_history_filter;
-
         /* stats for buddy allocator */
         spinlock_t s_mb_pa_lock;
         atomic_t s_bal_reqs;    /* number of reqs with len > 1 */
@@ -980,6 +1005,9 @@ struct ext4_sb_info {
 
         unsigned int s_log_groups_per_flex;
         struct flex_groups *s_flex_groups;
+
+        /* workqueue for dio unwritten */
+        struct workqueue_struct *dio_unwritten_wq;
 };
 
 static inline struct ext4_sb_info *EXT4_SB(struct super_block *sb)
@@ -1397,7 +1425,7 @@ extern int ext4_block_truncate_page(handle_t *handle,
                 struct address_space *mapping, loff_t from);
 extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
 extern qsize_t ext4_get_reserved_space(struct inode *inode);
-
+extern int flush_aio_dio_completed_IO(struct inode *inode);
 /* ioctl.c */
 extern long ext4_ioctl(struct file *, unsigned int, unsigned long);
 extern long ext4_compat_ioctl(struct file *, unsigned int, unsigned long);
@@ -1699,6 +1727,8 @@ extern void ext4_ext_init(struct super_block *);
 extern void ext4_ext_release(struct super_block *);
 extern long ext4_fallocate(struct inode *inode, int mode, loff_t offset,
                           loff_t len);
+extern int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
+                          loff_t len);
 extern int ext4_get_blocks(handle_t *handle, struct inode *inode,
                            sector_t block, unsigned int max_blocks,
                            struct buffer_head *bh, int flags);
diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
index 61652f1d15e6..2ca686454e87 100644
--- a/fs/ext4/ext4_extents.h
+++ b/fs/ext4/ext4_extents.h
@@ -220,6 +220,11 @@ static inline int ext4_ext_get_actual_len(struct ext4_extent *ext)
                 (le16_to_cpu(ext->ee_len) - EXT_INIT_MAX_LEN));
 }
 
+static inline void ext4_ext_mark_initialized(struct ext4_extent *ext)
+{
+        ext->ee_len = cpu_to_le16(ext4_ext_get_actual_len(ext));
+}
+
 extern int ext4_ext_calc_metadata_amount(struct inode *inode, int blocks);
 extern ext4_fsblk_t ext_pblock(struct ext4_extent *ex);
 extern ext4_fsblk_t idx_pblock(struct ext4_extent_idx *);
@@ -235,7 +240,7 @@ extern int ext4_ext_try_to_merge(struct inode *inode,
                                  struct ext4_ext_path *path,
                                  struct ext4_extent *);
 extern unsigned int ext4_ext_check_overlap(struct inode *, struct ext4_extent *, struct ext4_ext_path *);
-extern int ext4_ext_insert_extent(handle_t *, struct inode *, struct ext4_ext_path *, struct ext4_extent *);
+extern int ext4_ext_insert_extent(handle_t *, struct inode *, struct ext4_ext_path *, struct ext4_extent *, int);
 extern int ext4_ext_walk_space(struct inode *, ext4_lblk_t, ext4_lblk_t,
                                                         ext_prepare_callback, void *);
 extern struct ext4_ext_path *ext4_ext_find_extent(struct inode *, ext4_lblk_t,
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index 139fb8cb87e4..a2865980342f 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -161,11 +161,13 @@ int __ext4_handle_dirty_metadata(const char *where, handle_t *handle,
 handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks);
 int __ext4_journal_stop(const char *where, handle_t *handle);
 
-#define EXT4_NOJOURNAL_HANDLE   ((handle_t *) 0x1)
+#define EXT4_NOJOURNAL_MAX_REF_COUNT ((unsigned long) 4096)
 
+/* Note:  Do not use this for NULL handles.  This is only to determine if
+ * a properly allocated handle is using a journal or not. */
 static inline int ext4_handle_valid(handle_t *handle)
 {
-        if (handle == EXT4_NOJOURNAL_HANDLE)
+        if ((unsigned long)handle < EXT4_NOJOURNAL_MAX_REF_COUNT)
                 return 0;
         return 1;
 }
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 7a3832577923..715264b4bae4 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -723,7 +723,7 @@ err:
  * insert new index [@logical;@ptr] into the block at @curp;
  * check where to insert: before @curp or after @curp
  */
-static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
+int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
                                 struct ext4_ext_path *curp,
                                 int logical, ext4_fsblk_t ptr)
 {
@@ -1586,7 +1586,7 @@ out:
  */
 int ext4_ext_insert_extent(handle_t *handle, struct inode *inode,
                                 struct ext4_ext_path *path,
-                                struct ext4_extent *newext)
+                                struct ext4_extent *newext, int flag)
 {
         struct ext4_extent_header *eh;
         struct ext4_extent *ex, *fex;
@@ -1602,7 +1602,8 @@ int ext4_ext_insert_extent(handle_t *handle, struct inode *inode,
         BUG_ON(path[depth].p_hdr == NULL);
 
         /* try to insert block into found extent and return */
-        if (ex && ext4_can_extents_be_merged(inode, ex, newext)) {
+        if (ex && (flag != EXT4_GET_BLOCKS_DIO_CREATE_EXT)
+                && ext4_can_extents_be_merged(inode, ex, newext)) {
                 ext_debug("append [%d]%d block to %d:[%d]%d (from %llu)\n",
                                 ext4_ext_is_uninitialized(newext),
                                 ext4_ext_get_actual_len(newext),
@@ -1722,7 +1723,8 @@ has_space:
 
 merge:
         /* try to merge extents to the right */
-        ext4_ext_try_to_merge(inode, path, nearex);
+        if (flag != EXT4_GET_BLOCKS_DIO_CREATE_EXT)
+                ext4_ext_try_to_merge(inode, path, nearex);
 
         /* try to merge extents to the left */
 
@@ -2378,6 +2380,7 @@ void ext4_ext_init(struct super_block *sb)
          */
 
         if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_EXTENTS)) {
+#if defined(AGGRESSIVE_TEST) || defined(CHECK_BINSEARCH) || defined(EXTENTS_STATS)
                 printk(KERN_INFO "EXT4-fs: file extents enabled");
 #ifdef AGGRESSIVE_TEST
                 printk(", aggressive tests");
@@ -2389,6 +2392,7 @@ void ext4_ext_init(struct super_block *sb)
                 printk(", stats");
 #endif
                 printk("\n");
+#endif
 #ifdef EXTENTS_STATS
                 spin_lock_init(&EXT4_SB(sb)->s_ext_stats_lock);
                 EXT4_SB(sb)->s_ext_min = 1 << 30;
@@ -2490,7 +2494,6 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
 }
 
 #define EXT4_EXT_ZERO_LEN 7
-
 /*
  * This function is called by ext4_ext_get_blocks() if someone tries to write
  * to an uninitialized extent. It may result in splitting the uninitialized
@@ -2583,7 +2586,8 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
                         ex3->ee_block = cpu_to_le32(iblock);
                         ext4_ext_store_pblock(ex3, newblock);
                         ex3->ee_len = cpu_to_le16(allocated);
-                        err = ext4_ext_insert_extent(handle, inode, path, ex3);
+                        err = ext4_ext_insert_extent(handle, inode, path,
+                                                        ex3, 0);
                         if (err == -ENOSPC) {
                                 err =  ext4_ext_zeroout(inode, &orig_ex);
                                 if (err)
@@ -2639,7 +2643,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
                 ext4_ext_store_pblock(ex3, newblock + max_blocks);
                 ex3->ee_len = cpu_to_le16(allocated - max_blocks);
                 ext4_ext_mark_uninitialized(ex3);
-                err = ext4_ext_insert_extent(handle, inode, path, ex3);
+                err = ext4_ext_insert_extent(handle, inode, path, ex3, 0);
                 if (err == -ENOSPC) {
                         err =  ext4_ext_zeroout(inode, &orig_ex);
                         if (err)
@@ -2757,7 +2761,192 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
         err = ext4_ext_dirty(handle, inode, path + depth);
         goto out;
 insert:
-        err = ext4_ext_insert_extent(handle, inode, path, &newex);
+        err = ext4_ext_insert_extent(handle, inode, path, &newex, 0);
+        if (err == -ENOSPC) {
+                err =  ext4_ext_zeroout(inode, &orig_ex);
+                if (err)
+                        goto fix_extent_len;
+                /* update the extent length and mark as initialized */
+                ex->ee_block = orig_ex.ee_block;
+                ex->ee_len   = orig_ex.ee_len;
+                ext4_ext_store_pblock(ex, ext_pblock(&orig_ex));
+                ext4_ext_dirty(handle, inode, path + depth);
+                /* zero out the first half */
+                return allocated;
+        } else if (err)
+                goto fix_extent_len;
+out:
+        ext4_ext_show_leaf(inode, path);
+        return err ? err : allocated;
+
+fix_extent_len:
+        ex->ee_block = orig_ex.ee_block;
+        ex->ee_len   = orig_ex.ee_len;
+        ext4_ext_store_pblock(ex, ext_pblock(&orig_ex));
+        ext4_ext_mark_uninitialized(ex);
+        ext4_ext_dirty(handle, inode, path + depth);
+        return err;
+}
+
+/*
+ * This function is called by ext4_ext_get_blocks() from
+ * ext4_get_blocks_dio_write() when DIO to write
+ * to an uninitialized extent.
+ *
+ * Writing to an uninitized extent may result in splitting the uninitialized
+ * extent into multiple /intialized unintialized extents (up to three)
+ * There are three possibilities:
+ *   a> There is no split required: Entire extent should be uninitialized
+ *   b> Splits in two extents: Write is happening at either end of the extent
+ *   c> Splits in three extents: Somone is writing in middle of the extent
+ *
+ * One of more index blocks maybe needed if the extent tree grow after
+ * the unintialized extent split. To prevent ENOSPC occur at the IO
+ * complete, we need to split the uninitialized extent before DIO submit
+ * the IO. The uninitilized extent called at this time will be split
+ * into three uninitialized extent(at most). After IO complete, the part
+ * being filled will be convert to initialized by the end_io callback function
+ * via ext4_convert_unwritten_extents().
+ *
+ * Returns the size of uninitialized extent to be written on success.
+ */
+static int ext4_split_unwritten_extents(handle_t *handle,
+                                        struct inode *inode,
+                                        struct ext4_ext_path *path,
+                                        ext4_lblk_t iblock,
+                                        unsigned int max_blocks,
+                                        int flags)
+{
+        struct ext4_extent *ex, newex, orig_ex;
+        struct ext4_extent *ex1 = NULL;
+        struct ext4_extent *ex2 = NULL;
+        struct ext4_extent *ex3 = NULL;
+        struct ext4_extent_header *eh;
+        ext4_lblk_t ee_block;
+        unsigned int allocated, ee_len, depth;
+        ext4_fsblk_t newblock;
+        int err = 0;
+
+        ext_debug("ext4_split_unwritten_extents: inode %lu,"
+                  "iblock %llu, max_blocks %u\n", inode->i_ino,
+                  (unsigned long long)iblock, max_blocks);
+        depth = ext_depth(inode);
+        eh = path[depth].p_hdr;
+        ex = path[depth].p_ext;
+        ee_block = le32_to_cpu(ex->ee_block);
+        ee_len = ext4_ext_get_actual_len(ex);
+        allocated = ee_len - (iblock - ee_block);
+        newblock = iblock - ee_block + ext_pblock(ex);
+        ex2 = ex;
+        orig_ex.ee_block = ex->ee_block;
+        orig_ex.ee_len   = cpu_to_le16(ee_len);
+        ext4_ext_store_pblock(&orig_ex, ext_pblock(ex));
+
+        /*
+         * If the uninitialized extent begins at the same logical
+         * block where the write begins, and the write completely
+         * covers the extent, then we don't need to split it.
+         */
+        if ((iblock == ee_block) && (allocated <= max_blocks))
+                return allocated;
+
+        err = ext4_ext_get_access(handle, inode, path + depth);
+        if (err)
+                goto out;
+        /* ex1: ee_block to iblock - 1 : uninitialized */
+        if (iblock > ee_block) {
+                ex1 = ex;
+                ex1->ee_len = cpu_to_le16(iblock - ee_block);
+                ext4_ext_mark_uninitialized(ex1);
+                ex2 = &newex;
+        }
+        /*
+         * for sanity, update the length of the ex2 extent before
+         * we insert ex3, if ex1 is NULL. This is to avoid temporary
+         * overlap of blocks.
+         */
+        if (!ex1 && allocated > max_blocks)
+                ex2->ee_len = cpu_to_le16(max_blocks);
+        /* ex3: to ee_block + ee_len : uninitialised */
+        if (allocated > max_blocks) {
+                unsigned int newdepth;
+                ex3 = &newex;
+                ex3->ee_block = cpu_to_le32(iblock + max_blocks);
+                ext4_ext_store_pblock(ex3, newblock + max_blocks);
+                ex3->ee_len = cpu_to_le16(allocated - max_blocks);
+                ext4_ext_mark_uninitialized(ex3);
+                err = ext4_ext_insert_extent(handle, inode, path, ex3, flags);
+                if (err == -ENOSPC) {
+                        err =  ext4_ext_zeroout(inode, &orig_ex);
+                        if (err)
+                                goto fix_extent_len;
+                        /* update the extent length and mark as initialized */
+                        ex->ee_block = orig_ex.ee_block;
+                        ex->ee_len   = orig_ex.ee_len;
+                        ext4_ext_store_pblock(ex, ext_pblock(&orig_ex));
+                        ext4_ext_dirty(handle, inode, path + depth);
+                        /* zeroed the full extent */
+                        /* blocks available from iblock */
+                        return allocated;
+
+                } else if (err)
+                        goto fix_extent_len;
+                /*
+                 * The depth, and hence eh & ex might change
+                 * as part of the insert above.
+                 */
+                newdepth = ext_depth(inode);
+                /*
+                 * update the extent length after successful insert of the
+                 * split extent
+                 */
+                orig_ex.ee_len = cpu_to_le16(ee_len -
+                                                ext4_ext_get_actual_len(ex3));
+                depth = newdepth;
+                ext4_ext_drop_refs(path);
+                path = ext4_ext_find_extent(inode, iblock, path);
+                if (IS_ERR(path)) {
+                        err = PTR_ERR(path);
+                        goto out;
+                }
+                eh = path[depth].p_hdr;
+                ex = path[depth].p_ext;
+                if (ex2 != &newex)
+                        ex2 = ex;
+
+                err = ext4_ext_get_access(handle, inode, path + depth);
+                if (err)
+                        goto out;
+
+                allocated = max_blocks;
+        }
+        /*
+         * If there was a change of depth as part of the
+         * insertion of ex3 above, we need to update the length
+         * of the ex1 extent again here
+         */
+        if (ex1 && ex1 != ex) {
+                ex1 = ex;
+                ex1->ee_len = cpu_to_le16(iblock - ee_block);
+                ext4_ext_mark_uninitialized(ex1);
+                ex2 = &newex;
+        }
+        /*
+         * ex2: iblock to iblock + maxblocks-1 : to be direct IO written,
+         * uninitialised still.
+         */
+        ex2->ee_block = cpu_to_le32(iblock);
+        ext4_ext_store_pblock(ex2, newblock);
+        ex2->ee_len = cpu_to_le16(allocated);
+        ext4_ext_mark_uninitialized(ex2);
+        if (ex2 != ex)
+                goto insert;
+        /* Mark modified extent as dirty */
+        err = ext4_ext_dirty(handle, inode, path + depth);
+        ext_debug("out here\n");
+        goto out;
+insert:
+        err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
         if (err == -ENOSPC) {
                 err =  ext4_ext_zeroout(inode, &orig_ex);
                 if (err)
@@ -2783,7 +2972,147 @@ fix_extent_len:
         ext4_ext_dirty(handle, inode, path + depth);
         return err;
 }
+static int ext4_convert_unwritten_extents_dio(handle_t *handle,
+                                              struct inode *inode,
+                                              struct ext4_ext_path *path)
+{
+        struct ext4_extent *ex;
+        struct ext4_extent_header *eh;
+        int depth;
+        int err = 0;
+        int ret = 0;
+
+        depth = ext_depth(inode);
+        eh = path[depth].p_hdr;
+        ex = path[depth].p_ext;
+
+        err = ext4_ext_get_access(handle, inode, path + depth);
+        if (err)
+                goto out;
+        /* first mark the extent as initialized */
+        ext4_ext_mark_initialized(ex);
+
+        /*
+         * We have to see if it can be merged with the extent
+         * on the left.
+         */
+        if (ex > EXT_FIRST_EXTENT(eh)) {
+                /*
+                 * To merge left, pass "ex - 1" to try_to_merge(),
+                 * since it merges towards right _only_.
+                 */
+                ret = ext4_ext_try_to_merge(inode, path, ex - 1);
+                if (ret) {
+                        err = ext4_ext_correct_indexes(handle, inode, path);
+                        if (err)
+                                goto out;
+                        depth = ext_depth(inode);
+                        ex--;
+                }
+        }
+        /*
+         * Try to Merge towards right.
+         */
+        ret = ext4_ext_try_to_merge(inode, path, ex);
+        if (ret) {
+                err = ext4_ext_correct_indexes(handle, inode, path);
+                if (err)
+                        goto out;
+                depth = ext_depth(inode);
+        }
+        /* Mark modified extent as dirty */
+        err = ext4_ext_dirty(handle, inode, path + depth);
+out:
+        ext4_ext_show_leaf(inode, path);
+        return err;
+}
+
+static int
+ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
+                        ext4_lblk_t iblock, unsigned int max_blocks,
+                        struct ext4_ext_path *path, int flags,
+                        unsigned int allocated, struct buffer_head *bh_result,
+                        ext4_fsblk_t newblock)
+{
+        int ret = 0;
+        int err = 0;
+        ext4_io_end_t *io = EXT4_I(inode)->cur_aio_dio;
+
+        ext_debug("ext4_ext_handle_uninitialized_extents: inode %lu, logical"
+                  "block %llu, max_blocks %u, flags %d, allocated %u",
+                  inode->i_ino, (unsigned long long)iblock, max_blocks,
+                  flags, allocated);
+        ext4_ext_show_leaf(inode, path);
 
+        /* DIO get_block() before submit the IO, split the extent */
+        if (flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT) {
+                ret = ext4_split_unwritten_extents(handle,
+                                                inode, path, iblock,
+                                                max_blocks, flags);
+                /*
+                 * Flag the inode(non aio case) or end_io struct (aio case)
+                 * that this IO needs to convertion to written when IO is
+                 * completed
+                 */
+                if (io)
+                        io->flag = DIO_AIO_UNWRITTEN;
+                else
+                        EXT4_I(inode)->i_state |= EXT4_STATE_DIO_UNWRITTEN;
+                goto out;
+        }
+        /* async DIO end_io complete, convert the filled extent to written */
+        if (flags == EXT4_GET_BLOCKS_DIO_CONVERT_EXT) {
+                ret = ext4_convert_unwritten_extents_dio(handle, inode,
+                                                        path);
+                goto out2;
+        }
+        /* buffered IO case */
+        /*
+         * repeat fallocate creation request
+         * we already have an unwritten extent
+         */
+        if (flags & EXT4_GET_BLOCKS_UNINIT_EXT)
+                goto map_out;
+
+        /* buffered READ or buffered write_begin() lookup */
+        if ((flags & EXT4_GET_BLOCKS_CREATE) == 0) {
+                /*
+                 * We have blocks reserved already.  We
+                 * return allocated blocks so that delalloc
+                 * won't do block reservation for us.  But
+                 * the buffer head will be unmapped so that
+                 * a read from the block returns 0s.
+                 */
+                set_buffer_unwritten(bh_result);
+                goto out1;
+        }
+
+        /* buffered write, writepage time, convert*/
+        ret = ext4_ext_convert_to_initialized(handle, inode,
+                                                path, iblock,
+                                                max_blocks);
+out:
+        if (ret <= 0) {
+                err = ret;
+                goto out2;
+        } else
+                allocated = ret;
+        set_buffer_new(bh_result);
+map_out:
+        set_buffer_mapped(bh_result);
+out1:
+        if (allocated > max_blocks)
+                allocated = max_blocks;
+        ext4_ext_show_leaf(inode, path);
+        bh_result->b_bdev = inode->i_sb->s_bdev;
+        bh_result->b_blocknr = newblock;
+out2:
+        if (path) {
+                ext4_ext_drop_refs(path);
+                kfree(path);
+        }
+        return err ? err : allocated;
+}
 /*
  * Block allocation/map/preallocation routine for extents based files
  *
@@ -2814,6 +3143,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
         int err = 0, depth, ret, cache_type;
         unsigned int allocated = 0;
         struct ext4_allocation_request ar;
+        ext4_io_end_t *io = EXT4_I(inode)->cur_aio_dio;
 
         __clear_bit(BH_New, &bh_result->b_state);
         ext_debug("blocks %u/%u requested for inode %lu\n",
@@ -2889,33 +3219,10 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
                                                         EXT4_EXT_CACHE_EXTENT);
                                 goto out;
                         }
-                        if (flags & EXT4_GET_BLOCKS_UNINIT_EXT)
-                                goto out;
-                        if ((flags & EXT4_GET_BLOCKS_CREATE) == 0) {
-                                if (allocated > max_blocks)
-                                        allocated = max_blocks;
-                                /*
-                                 * We have blocks reserved already.  We
-                                 * return allocated blocks so that delalloc
-                                 * won't do block reservation for us.  But
-                                 * the buffer head will be unmapped so that
-                                 * a read from the block returns 0s.
-                                 */
-                                set_buffer_unwritten(bh_result);
-                                bh_result->b_bdev = inode->i_sb->s_bdev;
-                                bh_result->b_blocknr = newblock;
-                                goto out2;
-                        }
-
-                        ret = ext4_ext_convert_to_initialized(handle, inode,
-                                                                path, iblock,
-                                                                max_blocks);
-                        if (ret <= 0) {
-                                err = ret;
-                                goto out2;
-                        } else
-                                allocated = ret;
-                        goto outnew;
+                        ret = ext4_ext_handle_uninitialized_extents(handle,
+                                        inode, iblock, max_blocks, path,
+                                        flags, allocated, bh_result, newblock);
+                        return ret;
                 }
         }
 
@@ -2986,9 +3293,27 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
         /* try to insert new extent into found leaf and return */
         ext4_ext_store_pblock(&newex, newblock);
         newex.ee_len = cpu_to_le16(ar.len);
-        if (flags & EXT4_GET_BLOCKS_UNINIT_EXT)  /* Mark uninitialized */
+        /* Mark uninitialized */
+        if (flags & EXT4_GET_BLOCKS_UNINIT_EXT){
                 ext4_ext_mark_uninitialized(&newex);
-        err = ext4_ext_insert_extent(handle, inode, path, &newex);
+                /*
+                 * io_end structure was created for every async
+                 * direct IO write to the middle of the file.
+                 * To avoid unecessary convertion for every aio dio rewrite
+                 * to the mid of file, here we flag the IO that is really
+                 * need the convertion.
+                 * For non asycn direct IO case, flag the inode state
+                 * that we need to perform convertion when IO is done.
+                 */
+                if (flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT) {
+                        if (io)
+                                io->flag = DIO_AIO_UNWRITTEN;
+                        else
+                                EXT4_I(inode)->i_state |=
+                                        EXT4_STATE_DIO_UNWRITTEN;;
+                }
+        }
+        err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
         if (err) {
                 /* free data blocks we just allocated */
                 /* not a good idea to call discard here directly,
@@ -3002,7 +3327,6 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
         /* previous routine could use block we allocated */
         newblock = ext_pblock(&newex);
         allocated = ext4_ext_get_actual_len(&newex);
-outnew:
         set_buffer_new(bh_result);
 
         /* Cache only when it is _not_ an uninitialized extent */
@@ -3201,6 +3525,64 @@ retry:
 }
 
 /*
+ * This function convert a range of blocks to written extents
+ * The caller of this function will pass the start offset and the size.
+ * all unwritten extents within this range will be converted to
+ * written extents.
+ *
+ * This function is called from the direct IO end io call back
+ * function, to convert the fallocated extents after IO is completed.
+ * Returns 0 on success.
+ */
+int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
+                                    loff_t len)
+{
+        handle_t *handle;
+        ext4_lblk_t block;
+        unsigned int max_blocks;
+        int ret = 0;
+        int ret2 = 0;
+        struct buffer_head map_bh;
+        unsigned int credits, blkbits = inode->i_blkbits;
+
+        block = offset >> blkbits;
+        /*
+         * We can't just convert len to max_blocks because
+         * If blocksize = 4096 offset = 3072 and len = 2048
+         */
+        max_blocks = (EXT4_BLOCK_ALIGN(len + offset, blkbits) >> blkbits)
+                                                        - block;
+        /*
+         * credits to insert 1 extent into extent tree
+         */
+        credits = ext4_chunk_trans_blocks(inode, max_blocks);
+        while (ret >= 0 && ret < max_blocks) {
+                block = block + ret;
+                max_blocks = max_blocks - ret;
+                handle = ext4_journal_start(inode, credits);
+                if (IS_ERR(handle)) {
+                        ret = PTR_ERR(handle);
+                        break;
+                }
+                map_bh.b_state = 0;
+                ret = ext4_get_blocks(handle, inode, block,
+                                      max_blocks, &map_bh,
+                                      EXT4_GET_BLOCKS_DIO_CONVERT_EXT);
+                if (ret <= 0) {
+                        WARN_ON(ret <= 0);
+                        printk(KERN_ERR "%s: ext4_ext_get_blocks "
+                                    "returned error inode#%lu, block=%u, "
+                                    "max_blocks=%u", __func__,
+                                    inode->i_ino, block, max_blocks);
+                }
+                ext4_mark_inode_dirty(handle, inode);
+                ret2 = ext4_journal_stop(handle);
+                if (ret <= 0 || ret2 )
+                        break;
+        }
+        return ret > 0 ? ret2 : ret;
+}
+/*
  * Callback function called for each extent to gather FIEMAP information.
  */
 static int ext4_ext_fiemap_cb(struct inode *inode, struct ext4_ext_path *path,
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 07475740b512..2b1531266ee2 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -44,6 +44,8 @@
  *
  * What we do is just kick off a commit and wait on it.  This will snapshot the
  * inode to disk.
+ *
+ * i_mutex lock is held when entering and exiting this function
  */
 
 int ext4_sync_file(struct file *file, struct dentry *dentry, int datasync)
@@ -56,6 +58,9 @@ int ext4_sync_file(struct file *file, struct dentry *dentry, int datasync)
 
         trace_ext4_sync_file(file, dentry, datasync);
 
+        ret = flush_aio_dio_completed_IO(inode);
+        if (ret < 0)
+                goto out;
         /*
          * data=writeback:
          *  The caller's filemap_fdatawrite()/wait will sync the data.
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 064746fad581..2c8caa51addb 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -37,6 +37,7 @@
 #include <linux/namei.h>
 #include <linux/uio.h>
 #include <linux/bio.h>
+#include <linux/workqueue.h>
 
 #include "ext4_jbd2.h"
 #include "xattr.h"
@@ -192,7 +193,7 @@ static int try_to_extend_transaction(handle_t *handle, struct inode *inode)
  * so before we call here everything must be consistently dirtied against
  * this transaction.
  */
- int ext4_truncate_restart_trans(handle_t *handle, struct inode *inode,
+int ext4_truncate_restart_trans(handle_t *handle, struct inode *inode,
                                  int nblocks)
 {
         int ret;
@@ -208,6 +209,7 @@ static int try_to_extend_transaction(handle_t *handle, struct inode *inode)
         up_write(&EXT4_I(inode)->i_data_sem);
         ret = ext4_journal_restart(handle, blocks_for_truncate(inode));
         down_write(&EXT4_I(inode)->i_data_sem);
+        ext4_discard_preallocations(inode);
 
         return ret;
 }
@@ -1145,6 +1147,64 @@ static int check_block_validity(struct inode *inode, const char *msg,
 }
 
 /*
+ * Return the number of contiguous dirty pages in a given inode
+ * starting at page frame idx.
+ */
+static pgoff_t ext4_num_dirty_pages(struct inode *inode, pgoff_t idx,
+                                    unsigned int max_pages)
+{
+        struct address_space *mapping = inode->i_mapping;
+        pgoff_t index;
+        struct pagevec pvec;
+        pgoff_t num = 0;
+        int i, nr_pages, done = 0;
+
+        if (max_pages == 0)
+                return 0;
+        pagevec_init(&pvec, 0);
+        while (!done) {
+                index = idx;
+                nr_pages = pagevec_lookup_tag(&pvec, mapping, &index,
+                                              PAGECACHE_TAG_DIRTY,
+                                              (pgoff_t)PAGEVEC_SIZE);
+                if (nr_pages == 0)
+                        break;
+                for (i = 0; i < nr_pages; i++) {
+                        struct page *page = pvec.pages[i];
+                        struct buffer_head *bh, *head;
+
+                        lock_page(page);
+                        if (unlikely(page->mapping != mapping) ||
+                            !PageDirty(page) ||
+                            PageWriteback(page) ||
+                            page->index != idx) {
+                                done = 1;
+                                unlock_page(page);
+                                break;
+                        }
+                        if (page_has_buffers(page)) {
+                                bh = head = page_buffers(page);
+                                do {
+                                        if (!buffer_delay(bh) &&
+                                            !buffer_unwritten(bh))
+                                                done = 1;
+                                        bh = bh->b_this_page;
+                                } while (!done && (bh != head));
+                        }
+                        unlock_page(page);
+                        if (done)
+                                break;
+                        idx++;
+                        num++;
+                        if (num >= max_pages)
+                                break;
+                }
+                pagevec_release(&pvec);
+        }
+        return num;
+}
+
+/*
  * The ext4_get_blocks() function tries to look up the requested blocks,
  * and returns if the blocks are already mapped.
  *
@@ -1175,6 +1235,9 @@ int ext4_get_blocks(handle_t *handle, struct inode *inode, sector_t block,
         clear_buffer_mapped(bh);
         clear_buffer_unwritten(bh);
 
+        ext_debug("ext4_get_blocks(): inode %lu, flag %d, max_blocks %u,"
+                  "logical block %lu\n", inode->i_ino, flags, max_blocks,
+                  (unsigned long)block);
         /*
          * Try to see if we can get the block without requesting a new
          * file system block.
@@ -1796,11 +1859,11 @@ repeat:
 
         if (ext4_claim_free_blocks(sbi, total)) {
                 spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+                vfs_dq_release_reservation_block(inode, total);
                 if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
                         yield();
                         goto repeat;
                 }
-                vfs_dq_release_reservation_block(inode, total);
                 return -ENOSPC;
         }
         EXT4_I(inode)->i_reserved_data_blocks += nrblocks;
@@ -2092,18 +2155,18 @@ static void ext4_da_block_invalidatepages(struct mpage_da_data *mpd,
 static void ext4_print_free_blocks(struct inode *inode)
 {
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
-        printk(KERN_EMERG "Total free blocks count %lld\n",
-                        ext4_count_free_blocks(inode->i_sb));
-        printk(KERN_EMERG "Free/Dirty block details\n");
-        printk(KERN_EMERG "free_blocks=%lld\n",
-                        (long long)percpu_counter_sum(&sbi->s_freeblocks_counter));
-        printk(KERN_EMERG "dirty_blocks=%lld\n",
-                        (long long)percpu_counter_sum(&sbi->s_dirtyblocks_counter));
-        printk(KERN_EMERG "Block reservation details\n");
-        printk(KERN_EMERG "i_reserved_data_blocks=%u\n",
-                        EXT4_I(inode)->i_reserved_data_blocks);
-        printk(KERN_EMERG "i_reserved_meta_blocks=%u\n",
-                        EXT4_I(inode)->i_reserved_meta_blocks);
+        printk(KERN_CRIT "Total free blocks count %lld\n",
+               ext4_count_free_blocks(inode->i_sb));
+        printk(KERN_CRIT "Free/Dirty block details\n");
+        printk(KERN_CRIT "free_blocks=%lld\n",
+               (long long) percpu_counter_sum(&sbi->s_freeblocks_counter));
+        printk(KERN_CRIT "dirty_blocks=%lld\n",
+               (long long) percpu_counter_sum(&sbi->s_dirtyblocks_counter));
+        printk(KERN_CRIT "Block reservation details\n");
+        printk(KERN_CRIT "i_reserved_data_blocks=%u\n",
+               EXT4_I(inode)->i_reserved_data_blocks);
+        printk(KERN_CRIT "i_reserved_meta_blocks=%u\n",
+               EXT4_I(inode)->i_reserved_meta_blocks);
         return;
 }
 
@@ -2189,14 +2252,14 @@ static int mpage_da_map_blocks(struct mpage_da_data *mpd)
                  * writepage and writepages will again try to write
                  * the same.
                  */
-                printk(KERN_EMERG "%s block allocation failed for inode %lu "
-                                  "at logical offset %llu with max blocks "
-                                  "%zd with error %d\n",
-                                  __func__, mpd->inode->i_ino,
-                                  (unsigned long long)next,
-                                  mpd->b_size >> mpd->inode->i_blkbits, err);
-                printk(KERN_EMERG "This should not happen.!! "
-                                        "Data will be lost\n");
+                ext4_msg(mpd->inode->i_sb, KERN_CRIT,
+                         "delayed block allocation failed for inode %lu at "
+                         "logical offset %llu with max blocks %zd with "
+                         "error %d\n", mpd->inode->i_ino,
+                         (unsigned long long) next,
+                         mpd->b_size >> mpd->inode->i_blkbits, err);
+                printk(KERN_CRIT "This should not happen!!  "
+                       "Data will be lost\n");
                 if (err == -ENOSPC) {
                         ext4_print_free_blocks(mpd->inode);
                 }
@@ -2743,8 +2806,10 @@ static int ext4_da_writepages(struct address_space *mapping,
         int no_nrwrite_index_update;
         int pages_written = 0;
         long pages_skipped;
+        unsigned int max_pages;
         int range_cyclic, cycled = 1, io_done = 0;
-        int needed_blocks, ret = 0, nr_to_writebump = 0;
+        int needed_blocks, ret = 0;
+        long desired_nr_to_write, nr_to_writebump = 0;
         loff_t range_start = wbc->range_start;
         struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb);
 
@@ -2771,16 +2836,6 @@ static int ext4_da_writepages(struct address_space *mapping,
         if (unlikely(sbi->s_mount_flags & EXT4_MF_FS_ABORTED))
                 return -EROFS;
 
-        /*
-         * Make sure nr_to_write is >= sbi->s_mb_stream_request
-         * This make sure small files blocks are allocated in
-         * single attempt. This ensure that small files
-         * get less fragmented.
-         */
-        if (wbc->nr_to_write < sbi->s_mb_stream_request) {
-                nr_to_writebump = sbi->s_mb_stream_request - wbc->nr_to_write;
-                wbc->nr_to_write = sbi->s_mb_stream_request;
-        }
         if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
                 range_whole = 1;
 
@@ -2795,6 +2850,36 @@ static int ext4_da_writepages(struct address_space *mapping,
         } else
                 index = wbc->range_start >> PAGE_CACHE_SHIFT;
 
+        /*
+         * This works around two forms of stupidity.  The first is in
+         * the writeback code, which caps the maximum number of pages
+         * written to be 1024 pages.  This is wrong on multiple
+         * levels; different architectues have a different page size,
+         * which changes the maximum amount of data which gets
+         * written.  Secondly, 4 megabytes is way too small.  XFS
+         * forces this value to be 16 megabytes by multiplying
+         * nr_to_write parameter by four, and then relies on its
+         * allocator to allocate larger extents to make them
+         * contiguous.  Unfortunately this brings us to the second
+         * stupidity, which is that ext4's mballoc code only allocates
+         * at most 2048 blocks.  So we force contiguous writes up to
+         * the number of dirty blocks in the inode, or
+         * sbi->max_writeback_mb_bump whichever is smaller.
+         */
+        max_pages = sbi->s_max_writeback_mb_bump << (20 - PAGE_CACHE_SHIFT);
+        if (!range_cyclic && range_whole)
+                desired_nr_to_write = wbc->nr_to_write * 8;
+        else
+                desired_nr_to_write = ext4_num_dirty_pages(inode, index,
+                                                           max_pages);
+        if (desired_nr_to_write > max_pages)
+                desired_nr_to_write = max_pages;
+
+        if (wbc->nr_to_write < desired_nr_to_write) {
+                nr_to_writebump = desired_nr_to_write - wbc->nr_to_write;
+                wbc->nr_to_write = desired_nr_to_write;
+        }
+
         mpd.wbc = wbc;
         mpd.inode = mapping->host;
 
@@ -2822,10 +2907,9 @@ retry:
                 handle = ext4_journal_start(inode, needed_blocks);
                 if (IS_ERR(handle)) {
                         ret = PTR_ERR(handle);
-                        printk(KERN_CRIT "%s: jbd2_start: "
+                        ext4_msg(inode->i_sb, KERN_CRIT, "%s: jbd2_start: "
                                "%ld pages, ino %lu; err %d\n", __func__,
                                 wbc->nr_to_write, inode->i_ino, ret);
-                        dump_stack();
                         goto out_writepages;
                 }
 
@@ -2897,9 +2981,10 @@ retry:
                 goto retry;
         }
         if (pages_skipped != wbc->pages_skipped)
-                printk(KERN_EMERG "This should not happen leaving %s "
-                                "with nr_to_write = %ld ret = %d\n",
-                                __func__, wbc->nr_to_write, ret);
+                ext4_msg(inode->i_sb, KERN_CRIT,
+                         "This should not happen leaving %s "
+                         "with nr_to_write = %ld ret = %d\n",
+                         __func__, wbc->nr_to_write, ret);
 
         /* Update index */
         index += pages_written;
@@ -2914,7 +2999,8 @@ retry:
 out_writepages:
         if (!no_nrwrite_index_update)
                 wbc->no_nrwrite_index_update = 0;
-        wbc->nr_to_write -= nr_to_writebump;
+        if (wbc->nr_to_write > nr_to_writebump)
+                wbc->nr_to_write -= nr_to_writebump;
         wbc->range_start = range_start;
         trace_ext4_da_writepages_result(inode, wbc, ret, pages_written);
         return ret;
@@ -3272,6 +3358,8 @@ static int ext4_releasepage(struct page *page, gfp_t wait)
 }
 
 /*
+ * O_DIRECT for ext3 (or indirect map) based files
+ *
  * If the O_DIRECT write will extend the file then add this inode to the
  * orphan list.  So recovery will truncate it back to the original size
  * if the machine crashes during the write.
@@ -3280,7 +3368,7 @@ static int ext4_releasepage(struct page *page, gfp_t wait)
  * crashes then stale disk data _may_ be exposed inside the file. But current
  * VFS code falls back into buffered path in that case so we are safe.
  */
-static ssize_t ext4_direct_IO(int rw, struct kiocb *iocb,
+static ssize_t ext4_ind_direct_IO(int rw, struct kiocb *iocb,
                               const struct iovec *iov, loff_t offset,
                               unsigned long nr_segs)
 {
@@ -3291,6 +3379,7 @@ static ssize_t ext4_direct_IO(int rw, struct kiocb *iocb,
         ssize_t ret;
         int orphan = 0;
         size_t count = iov_length(iov, nr_segs);
+        int retries = 0;
 
         if (rw == WRITE) {
                 loff_t final_size = offset + count;
@@ -3313,9 +3402,12 @@ static ssize_t ext4_direct_IO(int rw, struct kiocb *iocb,
                 }
         }
 
+retry:
         ret = blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
                                  offset, nr_segs,
                                  ext4_get_block, NULL);
+        if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
+                goto retry;
 
         if (orphan) {
                 int err;
@@ -3354,6 +3446,364 @@ out:
         return ret;
 }
 
+static int ext4_get_block_dio_write(struct inode *inode, sector_t iblock,
+                   struct buffer_head *bh_result, int create)
+{
+        handle_t *handle = NULL;
+        int ret = 0;
+        unsigned max_blocks = bh_result->b_size >> inode->i_blkbits;
+        int dio_credits;
+
+        ext4_debug("ext4_get_block_dio_write: inode %lu, create flag %d\n",
+                   inode->i_ino, create);
+        /*
+         * DIO VFS code passes create = 0 flag for write to
+         * the middle of file. It does this to avoid block
+         * allocation for holes, to prevent expose stale data
+         * out when there is parallel buffered read (which does
+         * not hold the i_mutex lock) while direct IO write has
+         * not completed. DIO request on holes finally falls back
+         * to buffered IO for this reason.
+         *
+         * For ext4 extent based file, since we support fallocate,
+         * new allocated extent as uninitialized, for holes, we
+         * could fallocate blocks for holes, thus parallel
+         * buffered IO read will zero out the page when read on
+         * a hole while parallel DIO write to the hole has not completed.
+         *
+         * when we come here, we know it's a direct IO write to
+         * to the middle of file (<i_size)
+         * so it's safe to override the create flag from VFS.
+         */
+        create = EXT4_GET_BLOCKS_DIO_CREATE_EXT;
+
+        if (max_blocks > DIO_MAX_BLOCKS)
+                max_blocks = DIO_MAX_BLOCKS;
+        dio_credits = ext4_chunk_trans_blocks(inode, max_blocks);
+        handle = ext4_journal_start(inode, dio_credits);
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                goto out;
+        }
+        ret = ext4_get_blocks(handle, inode, iblock, max_blocks, bh_result,
+                              create);
+        if (ret > 0) {
+                bh_result->b_size = (ret << inode->i_blkbits);
+                ret = 0;
+        }
+        ext4_journal_stop(handle);
+out:
+        return ret;
+}
+
+static void ext4_free_io_end(ext4_io_end_t *io)
+{
+        BUG_ON(!io);
+        iput(io->inode);
+        kfree(io);
+}
+static void dump_aio_dio_list(struct inode * inode)
+{
+#ifdef  EXT4_DEBUG
+        struct list_head *cur, *before, *after;
+        ext4_io_end_t *io, *io0, *io1;
+
+        if (list_empty(&EXT4_I(inode)->i_aio_dio_complete_list)){
+                ext4_debug("inode %lu aio dio list is empty\n", inode->i_ino);
+                return;
+        }
+
+        ext4_debug("Dump inode %lu aio_dio_completed_IO list \n", inode->i_ino);
+        list_for_each_entry(io, &EXT4_I(inode)->i_aio_dio_complete_list, list){
+                cur = &io->list;
+                before = cur->prev;
+                io0 = container_of(before, ext4_io_end_t, list);
+                after = cur->next;
+                io1 = container_of(after, ext4_io_end_t, list);
+
+                ext4_debug("io 0x%p from inode %lu,prev 0x%p,next 0x%p\n",
+                            io, inode->i_ino, io0, io1);
+        }
+#endif
+}
+
+/*
+ * check a range of space and convert unwritten extents to written.
+ */
+static int ext4_end_aio_dio_nolock(ext4_io_end_t *io)
+{
+        struct inode *inode = io->inode;
+        loff_t offset = io->offset;
+        size_t size = io->size;
+        int ret = 0;
+
+        ext4_debug("end_aio_dio_onlock: io 0x%p from inode %lu,list->next 0x%p,"
+                   "list->prev 0x%p\n",
+                   io, inode->i_ino, io->list.next, io->list.prev);
+
+        if (list_empty(&io->list))
+                return ret;
+
+        if (io->flag != DIO_AIO_UNWRITTEN)
+                return ret;
+
+        if (offset + size <= i_size_read(inode))
+                ret = ext4_convert_unwritten_extents(inode, offset, size);
+
+        if (ret < 0) {
+                printk(KERN_EMERG "%s: failed to convert unwritten"
+                        "extents to written extents, error is %d"
+                        " io is still on inode %lu aio dio list\n",
+                       __func__, ret, inode->i_ino);
+                return ret;
+        }
+
+        /* clear the DIO AIO unwritten flag */
+        io->flag = 0;
+        return ret;
+}
+/*
+ * work on completed aio dio IO, to convert unwritten extents to extents
+ */
+static void ext4_end_aio_dio_work(struct work_struct *work)
+{
+        ext4_io_end_t *io  = container_of(work, ext4_io_end_t, work);
+        struct inode *inode = io->inode;
+        int ret = 0;
+
+        mutex_lock(&inode->i_mutex);
+        ret = ext4_end_aio_dio_nolock(io);
+        if (ret >= 0) {
+                if (!list_empty(&io->list))
+                        list_del_init(&io->list);
+                ext4_free_io_end(io);
+        }
+        mutex_unlock(&inode->i_mutex);
+}
+/*
+ * This function is called from ext4_sync_file().
+ *
+ * When AIO DIO IO is completed, the work to convert unwritten
+ * extents to written is queued on workqueue but may not get immediately
+ * scheduled. When fsync is called, we need to ensure the
+ * conversion is complete before fsync returns.
+ * The inode keeps track of a list of completed AIO from DIO path
+ * that might needs to do the conversion. This function walks through
+ * the list and convert the related unwritten extents to written.
+ */
+int flush_aio_dio_completed_IO(struct inode *inode)
+{
+        ext4_io_end_t *io;
+        int ret = 0;
+        int ret2 = 0;
+
+        if (list_empty(&EXT4_I(inode)->i_aio_dio_complete_list))
+                return ret;
+
+        dump_aio_dio_list(inode);
+        while (!list_empty(&EXT4_I(inode)->i_aio_dio_complete_list)){
+                io = list_entry(EXT4_I(inode)->i_aio_dio_complete_list.next,
+                                ext4_io_end_t, list);
+                /*
+                 * Calling ext4_end_aio_dio_nolock() to convert completed
+                 * IO to written.
+                 *
+                 * When ext4_sync_file() is called, run_queue() may already
+                 * about to flush the work corresponding to this io structure.
+                 * It will be upset if it founds the io structure related
+                 * to the work-to-be schedule is freed.
+                 *
+                 * Thus we need to keep the io structure still valid here after
+                 * convertion finished. The io structure has a flag to
+                 * avoid double converting from both fsync and background work
+                 * queue work.
+                 */
+                ret = ext4_end_aio_dio_nolock(io);
+                if (ret < 0)
+                        ret2 = ret;
+                else
+                        list_del_init(&io->list);
+        }
+        return (ret2 < 0) ? ret2 : 0;
+}
+
+static ext4_io_end_t *ext4_init_io_end (struct inode *inode)
+{
+        ext4_io_end_t *io = NULL;
+
+        io = kmalloc(sizeof(*io), GFP_NOFS);
+
+        if (io) {
+                igrab(inode);
+                io->inode = inode;
+                io->flag = 0;
+                io->offset = 0;
+                io->size = 0;
+                io->error = 0;
+                INIT_WORK(&io->work, ext4_end_aio_dio_work);
+                INIT_LIST_HEAD(&io->list);
+        }
+
+        return io;
+}
+
+static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
+                            ssize_t size, void *private)
+{
+        ext4_io_end_t *io_end = iocb->private;
+        struct workqueue_struct *wq;
+
+        /* if not async direct IO or dio with 0 bytes write, just return */
+        if (!io_end || !size)
+                return;
+
+        ext_debug("ext4_end_io_dio(): io_end 0x%p"
+                  "for inode %lu, iocb 0x%p, offset %llu, size %llu\n",
+                  iocb->private, io_end->inode->i_ino, iocb, offset,
+                  size);
+
+        /* if not aio dio with unwritten extents, just free io and return */
+        if (io_end->flag != DIO_AIO_UNWRITTEN){
+                ext4_free_io_end(io_end);
+                iocb->private = NULL;
+                return;
+        }
+
+        io_end->offset = offset;
+        io_end->size = size;
+        wq = EXT4_SB(io_end->inode->i_sb)->dio_unwritten_wq;
+
+        /* queue the work to convert unwritten extents to written */
+        queue_work(wq, &io_end->work);
+
+        /* Add the io_end to per-inode completed aio dio list*/
+        list_add_tail(&io_end->list,
+                 &EXT4_I(io_end->inode)->i_aio_dio_complete_list);
+        iocb->private = NULL;
+}
+/*
+ * For ext4 extent files, ext4 will do direct-io write to holes,
+ * preallocated extents, and those write extend the file, no need to
+ * fall back to buffered IO.
+ *
+ * For holes, we fallocate those blocks, mark them as unintialized
+ * If those blocks were preallocated, we mark sure they are splited, but
+ * still keep the range to write as unintialized.
+ *
+ * The unwrritten extents will be converted to written when DIO is completed.
+ * For async direct IO, since the IO may still pending when return, we
+ * set up an end_io call back function, which will do the convertion
+ * when async direct IO completed.
+ *
+ * If the O_DIRECT write will extend the file then add this inode to the
+ * orphan list.  So recovery will truncate it back to the original size
+ * if the machine crashes during the write.
+ *
+ */
+static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
+                              const struct iovec *iov, loff_t offset,
+                              unsigned long nr_segs)
+{
+        struct file *file = iocb->ki_filp;
+        struct inode *inode = file->f_mapping->host;
+        ssize_t ret;
+        size_t count = iov_length(iov, nr_segs);
+
+        loff_t final_size = offset + count;
+        if (rw == WRITE && final_size <= inode->i_size) {
+                /*
+                 * We could direct write to holes and fallocate.
+                 *
+                 * Allocated blocks to fill the hole are marked as uninitialized
+                 * to prevent paralel buffered read to expose the stale data
+                 * before DIO complete the data IO.
+                 *
+                 * As to previously fallocated extents, ext4 get_block
+                 * will just simply mark the buffer mapped but still
+                 * keep the extents uninitialized.
+                 *
+                 * for non AIO case, we will convert those unwritten extents
+                 * to written after return back from blockdev_direct_IO.
+                 *
+                 * for async DIO, the conversion needs to be defered when
+                 * the IO is completed. The ext4 end_io callback function
+                 * will be called to take care of the conversion work.
+                 * Here for async case, we allocate an io_end structure to
+                 * hook to the iocb.
+                 */
+                iocb->private = NULL;
+                EXT4_I(inode)->cur_aio_dio = NULL;
+                if (!is_sync_kiocb(iocb)) {
+                        iocb->private = ext4_init_io_end(inode);
+                        if (!iocb->private)
+                                return -ENOMEM;
+                        /*
+                         * we save the io structure for current async
+                         * direct IO, so that later ext4_get_blocks()
+                         * could flag the io structure whether there
+                         * is a unwritten extents needs to be converted
+                         * when IO is completed.
+                         */
+                        EXT4_I(inode)->cur_aio_dio = iocb->private;
+                }
+
+                ret = blockdev_direct_IO(rw, iocb, inode,
+                                         inode->i_sb->s_bdev, iov,
+                                         offset, nr_segs,
+                                         ext4_get_block_dio_write,
+                                         ext4_end_io_dio);
+                if (iocb->private)
+                        EXT4_I(inode)->cur_aio_dio = NULL;
+                /*
+                 * The io_end structure takes a reference to the inode,
+                 * that structure needs to be destroyed and the
+                 * reference to the inode need to be dropped, when IO is
+                 * complete, even with 0 byte write, or failed.
+                 *
+                 * In the successful AIO DIO case, the io_end structure will be
+                 * desctroyed and the reference to the inode will be dropped
+                 * after the end_io call back function is called.
+                 *
+                 * In the case there is 0 byte write, or error case, since
+                 * VFS direct IO won't invoke the end_io call back function,
+                 * we need to free the end_io structure here.
+                 */
+                if (ret != -EIOCBQUEUED && ret <= 0 && iocb->private) {
+                        ext4_free_io_end(iocb->private);
+                        iocb->private = NULL;
+                } else if (ret > 0 && (EXT4_I(inode)->i_state &
+                                       EXT4_STATE_DIO_UNWRITTEN)) {
+                        int err;
+                        /*
+                         * for non AIO case, since the IO is already
+                         * completed, we could do the convertion right here
+                         */
+                        err = ext4_convert_unwritten_extents(inode,
+                                                             offset, ret);
+                        if (err < 0)
+                                ret = err;
+                        EXT4_I(inode)->i_state &= ~EXT4_STATE_DIO_UNWRITTEN;
+                }
+                return ret;
+        }
+
+        /* for write the the end of file case, we fall back to old way */
+        return ext4_ind_direct_IO(rw, iocb, iov, offset, nr_segs);
+}
+
+static ssize_t ext4_direct_IO(int rw, struct kiocb *iocb,
+                              const struct iovec *iov, loff_t offset,
+                              unsigned long nr_segs)
+{
+        struct file *file = iocb->ki_filp;
+        struct inode *inode = file->f_mapping->host;
+
+        if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)
+                return ext4_ext_direct_IO(rw, iocb, iov, offset, nr_segs);
+
+        return ext4_ind_direct_IO(rw, iocb, iov, offset, nr_segs);
+}
+
 /*
  * Pages can be marked dirty completely asynchronously from ext4's journalling
  * activity.  By filemap_sync_pte(), try_to_unmap_one(), etc.  We cannot do
@@ -4551,8 +5001,7 @@ static int ext4_inode_blocks_set(handle_t *handle,
  */
 static int ext4_do_update_inode(handle_t *handle,
                                 struct inode *inode,
-                                struct ext4_iloc *iloc,
-                                int do_sync)
+                                struct ext4_iloc *iloc)
 {
         struct ext4_inode *raw_inode = ext4_raw_inode(iloc);
         struct ext4_inode_info *ei = EXT4_I(inode);
@@ -4653,22 +5102,10 @@ static int ext4_do_update_inode(handle_t *handle,
                 raw_inode->i_extra_isize = cpu_to_le16(ei->i_extra_isize);
         }
 
-        /*
-         * If we're not using a journal and we were called from
-         * ext4_write_inode() to sync the inode (making do_sync true),
-         * we can just use sync_dirty_buffer() directly to do our dirty
-         * work.  Testing s_journal here is a bit redundant but it's
-         * worth it to avoid potential future trouble.
-         */
-        if (EXT4_SB(inode->i_sb)->s_journal == NULL && do_sync) {
-                BUFFER_TRACE(bh, "call sync_dirty_buffer");
-                sync_dirty_buffer(bh);
-        } else {
-                BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
-                rc = ext4_handle_dirty_metadata(handle, inode, bh);
-                if (!err)
-                        err = rc;
-        }
+        BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
+        rc = ext4_handle_dirty_metadata(handle, inode, bh);
+        if (!err)
+                err = rc;
         ei->i_state &= ~EXT4_STATE_NEW;
 
 out_brelse:
@@ -4736,8 +5173,16 @@ int ext4_write_inode(struct inode *inode, int wait)
                 err = ext4_get_inode_loc(inode, &iloc);
                 if (err)
                         return err;
-                err = ext4_do_update_inode(EXT4_NOJOURNAL_HANDLE,
-                                           inode, &iloc, wait);
+                if (wait)
+                        sync_dirty_buffer(iloc.bh);
+                if (buffer_req(iloc.bh) && !buffer_uptodate(iloc.bh)) {
+                        ext4_error(inode->i_sb, __func__,
+                                   "IO error syncing inode, "
+                                   "inode=%lu, block=%llu",
+                                   inode->i_ino,
+                                   (unsigned long long)iloc.bh->b_blocknr);
+                        err = -EIO;
+                }
         }
         return err;
 }
@@ -5033,7 +5478,7 @@ int ext4_mark_iloc_dirty(handle_t *handle,
         get_bh(iloc->bh);
 
         /* ext4_do_update_inode() does jbd2_journal_dirty_metadata */
-        err = ext4_do_update_inode(handle, inode, iloc, 0);
+        err = ext4_do_update_inode(handle, inode, iloc);
         put_bh(iloc->bh);
         return err;
 }
@@ -5177,27 +5622,14 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
  */
 void ext4_dirty_inode(struct inode *inode)
 {
-        handle_t *current_handle = ext4_journal_current_handle();
         handle_t *handle;
 
-        if (!ext4_handle_valid(current_handle)) {
-                ext4_mark_inode_dirty(current_handle, inode);
-                return;
-        }
-
         handle = ext4_journal_start(inode, 2);
         if (IS_ERR(handle))
                 goto out;
-        if (current_handle &&
-                current_handle->h_transaction != handle->h_transaction) {
-                /* This task has a transaction open against a different fs */
-                printk(KERN_EMERG "%s: transactions do not match!\n",
-                       __func__);
-        } else {
-                jbd_debug(5, "marking dirty.  outer handle=%p\n",
-                                current_handle);
-                ext4_mark_inode_dirty(handle, inode);
-        }
+
+        ext4_mark_inode_dirty(handle, inode);
+
         ext4_journal_stop(handle);
 out:
         return;
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index e9c61896d605..bba12824defa 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2096,207 +2096,6 @@ out:
         return err;
 }
 
-#ifdef EXT4_MB_HISTORY
-struct ext4_mb_proc_session {
-        struct ext4_mb_history *history;
-        struct super_block *sb;
-        int start;
-        int max;
-};
-
-static void *ext4_mb_history_skip_empty(struct ext4_mb_proc_session *s,
-                                        struct ext4_mb_history *hs,
-                                        int first)
-{
-        if (hs == s->history + s->max)
-                hs = s->history;
-        if (!first && hs == s->history + s->start)
-                return NULL;
-        while (hs->orig.fe_len == 0) {
-                hs++;
-                if (hs == s->history + s->max)
-                        hs = s->history;
-                if (hs == s->history + s->start)
-                        return NULL;
-        }
-        return hs;
-}
-
-static void *ext4_mb_seq_history_start(struct seq_file *seq, loff_t *pos)
-{
-        struct ext4_mb_proc_session *s = seq->private;
-        struct ext4_mb_history *hs;
-        int l = *pos;
-
-        if (l == 0)
-                return SEQ_START_TOKEN;
-        hs = ext4_mb_history_skip_empty(s, s->history + s->start, 1);
-        if (!hs)
-                return NULL;
-        while (--l && (hs = ext4_mb_history_skip_empty(s, ++hs, 0)) != NULL);
-        return hs;
-}
-
-static void *ext4_mb_seq_history_next(struct seq_file *seq, void *v,
-                                      loff_t *pos)
-{
-        struct ext4_mb_proc_session *s = seq->private;
-        struct ext4_mb_history *hs = v;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN)
-                return ext4_mb_history_skip_empty(s, s->history + s->start, 1);
-        else
-                return ext4_mb_history_skip_empty(s, ++hs, 0);
-}
-
-static int ext4_mb_seq_history_show(struct seq_file *seq, void *v)
-{
-        char buf[25], buf2[25], buf3[25], *fmt;
-        struct ext4_mb_history *hs = v;
-
-        if (v == SEQ_START_TOKEN) {
-                seq_printf(seq, "%-5s %-8s %-23s %-23s %-23s %-5s "
-                                "%-5s %-2s %-6s %-5s %-5s %-6s\n",
-                          "pid", "inode", "original", "goal", "result", "found",
-                           "grps", "cr", "flags", "merge", "tail", "broken");
-                return 0;
-        }
-
-        if (hs->op == EXT4_MB_HISTORY_ALLOC) {
-                fmt = "%-5u %-8u %-23s %-23s %-23s %-5u %-5u %-2u "
-                        "0x%04x %-5s %-5u %-6u\n";
-                sprintf(buf2, "%u/%d/%u@%u", hs->result.fe_group,
-                        hs->result.fe_start, hs->result.fe_len,
-                        hs->result.fe_logical);
-                sprintf(buf, "%u/%d/%u@%u", hs->orig.fe_group,
-                        hs->orig.fe_start, hs->orig.fe_len,
-                        hs->orig.fe_logical);
-                sprintf(buf3, "%u/%d/%u@%u", hs->goal.fe_group,
-                        hs->goal.fe_start, hs->goal.fe_len,
-                        hs->goal.fe_logical);
-                seq_printf(seq, fmt, hs->pid, hs->ino, buf, buf3, buf2,
-                                hs->found, hs->groups, hs->cr, hs->flags,
-                                hs->merged ? "M" : "", hs->tail,
-                                hs->buddy ? 1 << hs->buddy : 0);
-        } else if (hs->op == EXT4_MB_HISTORY_PREALLOC) {
-                fmt = "%-5u %-8u %-23s %-23s %-23s\n";
-                sprintf(buf2, "%u/%d/%u@%u", hs->result.fe_group,
-                        hs->result.fe_start, hs->result.fe_len,
-                        hs->result.fe_logical);
-                sprintf(buf, "%u/%d/%u@%u", hs->orig.fe_group,
-                        hs->orig.fe_start, hs->orig.fe_len,
-                        hs->orig.fe_logical);
-                seq_printf(seq, fmt, hs->pid, hs->ino, buf, "", buf2);
-        } else if (hs->op == EXT4_MB_HISTORY_DISCARD) {
-                sprintf(buf2, "%u/%d/%u", hs->result.fe_group,
-                        hs->result.fe_start, hs->result.fe_len);
-                seq_printf(seq, "%-5u %-8u %-23s discard\n",
-                                hs->pid, hs->ino, buf2);
-        } else if (hs->op == EXT4_MB_HISTORY_FREE) {
-                sprintf(buf2, "%u/%d/%u", hs->result.fe_group,
-                        hs->result.fe_start, hs->result.fe_len);
-                seq_printf(seq, "%-5u %-8u %-23s free\n",
-                                hs->pid, hs->ino, buf2);
-        }
-        return 0;
-}
-
-static void ext4_mb_seq_history_stop(struct seq_file *seq, void *v)
-{
-}
-
-static const struct seq_operations ext4_mb_seq_history_ops = {
-        .start  = ext4_mb_seq_history_start,
-        .next   = ext4_mb_seq_history_next,
-        .stop   = ext4_mb_seq_history_stop,
-        .show   = ext4_mb_seq_history_show,
-};
-
-static int ext4_mb_seq_history_open(struct inode *inode, struct file *file)
-{
-        struct super_block *sb = PDE(inode)->data;
-        struct ext4_sb_info *sbi = EXT4_SB(sb);
-        struct ext4_mb_proc_session *s;
-        int rc;
-        int size;
-
-        if (unlikely(sbi->s_mb_history == NULL))
-                return -ENOMEM;
-        s = kmalloc(sizeof(*s), GFP_KERNEL);
-        if (s == NULL)
-                return -ENOMEM;
-        s->sb = sb;
-        size = sizeof(struct ext4_mb_history) * sbi->s_mb_history_max;
-        s->history = kmalloc(size, GFP_KERNEL);
-        if (s->history == NULL) {
-                kfree(s);
-                return -ENOMEM;
-        }
-
-        spin_lock(&sbi->s_mb_history_lock);
-        memcpy(s->history, sbi->s_mb_history, size);
-        s->max = sbi->s_mb_history_max;
-        s->start = sbi->s_mb_history_cur % s->max;
-        spin_unlock(&sbi->s_mb_history_lock);
-
-        rc = seq_open(file, &ext4_mb_seq_history_ops);
-        if (rc == 0) {
-                struct seq_file *m = (struct seq_file *)file->private_data;
-                m->private = s;
-        } else {
-                kfree(s->history);
-                kfree(s);
-        }
-        return rc;
-
-}
-
-static int ext4_mb_seq_history_release(struct inode *inode, struct file *file)
-{
-        struct seq_file *seq = (struct seq_file *)file->private_data;
-        struct ext4_mb_proc_session *s = seq->private;
-        kfree(s->history);
-        kfree(s);
-        return seq_release(inode, file);
-}
-
-static ssize_t ext4_mb_seq_history_write(struct file *file,
-                                const char __user *buffer,
-                                size_t count, loff_t *ppos)
-{
-        struct seq_file *seq = (struct seq_file *)file->private_data;
-        struct ext4_mb_proc_session *s = seq->private;
-        struct super_block *sb = s->sb;
-        char str[32];
-        int value;
-
-        if (count >= sizeof(str)) {
-                printk(KERN_ERR "EXT4-fs: %s string too long, max %u bytes\n",
-                                "mb_history", (int)sizeof(str));
-                return -EOVERFLOW;
-        }
-
-        if (copy_from_user(str, buffer, count))
-                return -EFAULT;
-
-        value = simple_strtol(str, NULL, 0);
-        if (value < 0)
-                return -ERANGE;
-        EXT4_SB(sb)->s_mb_history_filter = value;
-
-        return count;
-}
-
-static const struct file_operations ext4_mb_seq_history_fops = {
-        .owner          = THIS_MODULE,
-        .open           = ext4_mb_seq_history_open,
-        .read           = seq_read,
-        .write          = ext4_mb_seq_history_write,
-        .llseek         = seq_lseek,
-        .release        = ext4_mb_seq_history_release,
-};
-
 static void *ext4_mb_seq_groups_start(struct seq_file *seq, loff_t *pos)
 {
         struct super_block *sb = seq->private;
@@ -2396,82 +2195,6 @@ static const struct file_operations ext4_mb_seq_groups_fops = {
         .release        = seq_release,
 };
 
-static void ext4_mb_history_release(struct super_block *sb)
-{
-        struct ext4_sb_info *sbi = EXT4_SB(sb);
-
-        if (sbi->s_proc != NULL) {
-                remove_proc_entry("mb_groups", sbi->s_proc);
-                if (sbi->s_mb_history_max)
-                        remove_proc_entry("mb_history", sbi->s_proc);
-        }
-        kfree(sbi->s_mb_history);
-}
-
-static void ext4_mb_history_init(struct super_block *sb)
-{
-        struct ext4_sb_info *sbi = EXT4_SB(sb);
-        int i;
-
-        if (sbi->s_proc != NULL) {
-                if (sbi->s_mb_history_max)
-                        proc_create_data("mb_history", S_IRUGO, sbi->s_proc,
-                                         &ext4_mb_seq_history_fops, sb);
-                proc_create_data("mb_groups", S_IRUGO, sbi->s_proc,
-                                 &ext4_mb_seq_groups_fops, sb);
-        }
-
-        sbi->s_mb_history_cur = 0;
-        spin_lock_init(&sbi->s_mb_history_lock);
-        i = sbi->s_mb_history_max * sizeof(struct ext4_mb_history);
-        sbi->s_mb_history = i ? kzalloc(i, GFP_KERNEL) : NULL;
-        /* if we can't allocate history, then we simple won't use it */
-}
-
-static noinline_for_stack void
-ext4_mb_store_history(struct ext4_allocation_context *ac)
-{
-        struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
-        struct ext4_mb_history h;
-
-        if (sbi->s_mb_history == NULL)
-                return;
-
-        if (!(ac->ac_op & sbi->s_mb_history_filter))
-                return;
-
-        h.op = ac->ac_op;
-        h.pid = current->pid;
-        h.ino = ac->ac_inode ? ac->ac_inode->i_ino : 0;
-        h.orig = ac->ac_o_ex;
-        h.result = ac->ac_b_ex;
-        h.flags = ac->ac_flags;
-        h.found = ac->ac_found;
-        h.groups = ac->ac_groups_scanned;
-        h.cr = ac->ac_criteria;
-        h.tail = ac->ac_tail;
-        h.buddy = ac->ac_buddy;
-        h.merged = 0;
-        if (ac->ac_op == EXT4_MB_HISTORY_ALLOC) {
-                if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
-                                ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
-                        h.merged = 1;
-                h.goal = ac->ac_g_ex;
-                h.result = ac->ac_f_ex;
-        }
-
-        spin_lock(&sbi->s_mb_history_lock);
-        memcpy(sbi->s_mb_history + sbi->s_mb_history_cur, &h, sizeof(h));
-        if (++sbi->s_mb_history_cur >= sbi->s_mb_history_max)
-                sbi->s_mb_history_cur = 0;
-        spin_unlock(&sbi->s_mb_history_lock);
-}
-
-#else
-#define ext4_mb_history_release(sb)
-#define ext4_mb_history_init(sb)
-#endif
-
 
 /* Create and initialize ext4_group_info data for the given group. */
 int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
@@ -2690,7 +2413,6 @@ int ext4_mb_init(struct super_block *sb, int needs_recovery)
         sbi->s_mb_stats = MB_DEFAULT_STATS;
         sbi->s_mb_stream_request = MB_DEFAULT_STREAM_THRESHOLD;
         sbi->s_mb_order2_reqs = MB_DEFAULT_ORDER2_REQS;
-        sbi->s_mb_history_filter = EXT4_MB_HISTORY_DEFAULT;
         sbi->s_mb_group_prealloc = MB_DEFAULT_GROUP_PREALLOC;
 
         sbi->s_locality_groups = alloc_percpu(struct ext4_locality_group);
@@ -2708,12 +2430,12 @@ int ext4_mb_init(struct super_block *sb, int needs_recovery)
                 spin_lock_init(&lg->lg_prealloc_lock);
         }
 
-        ext4_mb_history_init(sb);
+        if (sbi->s_proc)
+                proc_create_data("mb_groups", S_IRUGO, sbi->s_proc,
+                                 &ext4_mb_seq_groups_fops, sb);
 
         if (sbi->s_journal)
                 sbi->s_journal->j_commit_callback = release_blocks_on_commit;
-
-        printk(KERN_INFO "EXT4-fs: mballoc enabled\n");
         return 0;
 }
 
@@ -2790,7 +2512,8 @@ int ext4_mb_release(struct super_block *sb)
         }
 
         free_percpu(sbi->s_locality_groups);
-        ext4_mb_history_release(sb);
+        if (sbi->s_proc)
+                remove_proc_entry("mb_groups", sbi->s_proc);
 
         return 0;
 }
@@ -3276,7 +2999,10 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
                         atomic_inc(&sbi->s_bal_breaks);
         }
 
-        ext4_mb_store_history(ac);
+        if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
+                trace_ext4_mballoc_alloc(ac);
+        else
+                trace_ext4_mballoc_prealloc(ac);
 }
 
 /*
@@ -3776,7 +3502,6 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
         if (ac) {
                 ac->ac_sb = sb;
                 ac->ac_inode = pa->pa_inode;
-                ac->ac_op = EXT4_MB_HISTORY_DISCARD;
         }
 
         while (bit < end) {
@@ -3796,7 +3521,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
                         ac->ac_b_ex.fe_start = bit;
                         ac->ac_b_ex.fe_len = next - bit;
                         ac->ac_b_ex.fe_logical = 0;
-                        ext4_mb_store_history(ac);
+                        trace_ext4_mballoc_discard(ac);
                 }
 
                 trace_ext4_mb_release_inode_pa(ac, pa, grp_blk_start + bit,
@@ -3831,9 +3556,6 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
         ext4_group_t group;
         ext4_grpblk_t bit;
 
-        if (ac)
-                ac->ac_op = EXT4_MB_HISTORY_DISCARD;
-
         trace_ext4_mb_release_group_pa(ac, pa);
         BUG_ON(pa->pa_deleted == 0);
         ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
@@ -3848,7 +3570,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
                 ac->ac_b_ex.fe_start = bit;
                 ac->ac_b_ex.fe_len = pa->pa_len;
                 ac->ac_b_ex.fe_logical = 0;
-                ext4_mb_store_history(ac);
+                trace_ext4_mballoc_discard(ac);
         }
 
         return 0;
@@ -4189,7 +3911,6 @@ static void ext4_mb_group_or_file(struct ext4_allocation_context *ac)
         size = ac->ac_o_ex.fe_logical + ac->ac_o_ex.fe_len;
         isize = (i_size_read(ac->ac_inode) + ac->ac_sb->s_blocksize - 1)
                 >> bsbits;
-        size = max(size, isize);
 
         if ((size == isize) &&
             !ext4_fs_is_busy(sbi) &&
@@ -4199,6 +3920,7 @@ static void ext4_mb_group_or_file(struct ext4_allocation_context *ac)
         }
 
         /* don't use group allocation for large files */
+        size = max(size, isize);
         if (size >= sbi->s_mb_stream_request) {
                 ac->ac_flags |= EXT4_MB_STREAM_ALLOC;
                 return;
@@ -4739,7 +4461,6 @@ void ext4_mb_free_blocks(handle_t *handle, struct inode *inode,
 
         ac = kmem_cache_alloc(ext4_ac_cachep, GFP_NOFS);
         if (ac) {
-                ac->ac_op = EXT4_MB_HISTORY_FREE;
                 ac->ac_inode = inode;
                 ac->ac_sb = sb;
         }
@@ -4806,7 +4527,7 @@ do_more:
                 ac->ac_b_ex.fe_group = block_group;
                 ac->ac_b_ex.fe_start = bit;
                 ac->ac_b_ex.fe_len = count;
-                ext4_mb_store_history(ac);
+                trace_ext4_mballoc_free(ac);
         }
 
         err = ext4_mb_load_buddy(sb, block_group, &e4b);
diff --git a/fs/ext4/mballoc.h b/fs/ext4/mballoc.h
index 188d3d709b24..0ca811061bc7 100644
--- a/fs/ext4/mballoc.h
+++ b/fs/ext4/mballoc.h
@@ -52,18 +52,8 @@ extern u8 mb_enable_debug;
 #define mb_debug(n, fmt, a...)
 #endif
 
-/*
- * with EXT4_MB_HISTORY mballoc stores last N allocations in memory
- * and you can monitor it in /proc/fs/ext4/<dev>/mb_history
- */
-#define EXT4_MB_HISTORY
 #define EXT4_MB_HISTORY_ALLOC           1       /* allocation */
 #define EXT4_MB_HISTORY_PREALLOC        2       /* preallocated blocks used */
-#define EXT4_MB_HISTORY_DISCARD         4       /* preallocation discarded */
-#define EXT4_MB_HISTORY_FREE            8       /* free */
-
-#define EXT4_MB_HISTORY_DEFAULT         (EXT4_MB_HISTORY_ALLOC | \
-                                         EXT4_MB_HISTORY_PREALLOC)
 
 /*
  * How long mballoc can look for a best extent (in found extents)
@@ -84,7 +74,7 @@ extern u8 mb_enable_debug;
  * with 'ext4_mb_stats' allocator will collect stats that will be
  * shown at umount. The collecting costs though!
  */
-#define MB_DEFAULT_STATS                1
+#define MB_DEFAULT_STATS                0
 
 /*
  * files smaller than MB_DEFAULT_STREAM_THRESHOLD are served
@@ -217,22 +207,6 @@ struct ext4_allocation_context {
 #define AC_STATUS_FOUND         2
 #define AC_STATUS_BREAK         3
 
-struct ext4_mb_history {
-        struct ext4_free_extent orig;   /* orig allocation */
-        struct ext4_free_extent goal;   /* goal allocation */
-        struct ext4_free_extent result; /* result allocation */
-        unsigned pid;
-        unsigned ino;
-        __u16 found;    /* how many extents have been found */
-        __u16 groups;   /* how many groups have been scanned */
-        __u16 tail;     /* what tail broke some buddy */
-        __u16 buddy;    /* buddy the tail ^^^ broke */
-        __u16 flags;
-        __u8 cr:3;      /* which phase the result extent was found at */
-        __u8 op:4;
-        __u8 merged:1;
-};
-
 struct ext4_buddy {
         struct page *bd_buddy_page;
         void *bd_buddy;
@@ -247,13 +221,6 @@ struct ext4_buddy {
 #define EXT4_MB_BITMAP(e4b)     ((e4b)->bd_bitmap)
 #define EXT4_MB_BUDDY(e4b)      ((e4b)->bd_buddy)
 
-#ifndef EXT4_MB_HISTORY
-static inline void ext4_mb_store_history(struct ext4_allocation_context *ac)
-{
-        return;
-}
-#endif
-
 #define in_range(b, first, len) ((b) >= (first) && (b) <= (first) + (len) - 1)
 
 static inline ext4_fsblk_t ext4_grp_offs_to_block(struct super_block *sb,
diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
index bf519f239ae6..a93d5b80f3e2 100644
--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -75,7 +75,7 @@ static int finish_range(handle_t *handle, struct inode *inode,
                                 goto err_out;
                 }
         }
-        retval = ext4_ext_insert_extent(handle, inode, path, &newext);
+        retval = ext4_ext_insert_extent(handle, inode, path, &newext, 0);
 err_out:
         if (path) {
                 ext4_ext_drop_refs(path);
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index c07a2915e40b..25b6b1457360 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -322,7 +322,7 @@ mext_insert_across_blocks(handle_t *handle, struct inode *orig_inode,
                         goto out;
 
                 if (ext4_ext_insert_extent(handle, orig_inode,
-                                        orig_path, new_ext))
+                                        orig_path, new_ext, 0))
                         goto out;
         }
 
@@ -333,7 +333,7 @@ mext_insert_across_blocks(handle_t *handle, struct inode *orig_inode,
                         goto out;
 
                 if (ext4_ext_insert_extent(handle, orig_inode,
-                                           orig_path, end_ext))
+                                           orig_path, end_ext, 0))
                         goto out;
         }
 out:
@@ -1001,14 +1001,6 @@ mext_check_arguments(struct inode *orig_inode,
                 return -EINVAL;
         }
 
-        /* orig and donor should be different file */
-        if (orig_inode->i_ino == donor_inode->i_ino) {
-                ext4_debug("ext4 move extent: The argument files should not "
-                        "be same file [ino:orig %lu, donor %lu]\n",
-                        orig_inode->i_ino, donor_inode->i_ino);
-                return -EINVAL;
-        }
-
         /* Ext4 move extent supports only extent based file */
         if (!(EXT4_I(orig_inode)->i_flags & EXT4_EXTENTS_FL)) {
                 ext4_debug("ext4 move extent: orig file is not extents "
@@ -1232,6 +1224,14 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp,
         int block_len_in_page;
         int uninit;
 
+        /* orig and donor should be different file */
+        if (orig_inode->i_ino == donor_inode->i_ino) {
+                ext4_debug("ext4 move extent: The argument files should not "
+                        "be same file [ino:orig %lu, donor %lu]\n",
+                        orig_inode->i_ino, donor_inode->i_ino);
+                return -EINVAL;
+        }
+
         /* protect orig and donor against a truncate */
         ret1 = mext_inode_double_lock(orig_inode, donor_inode);
         if (ret1 < 0)
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 42f81d285cd5..6d2c1b897fc7 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1518,12 +1518,8 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
                         return retval;
 
                 if (blocks == 1 && !dx_fallback &&
-                    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
-                        retval = make_indexed_dir(handle, dentry, inode, bh);
-                        if (retval == -ENOSPC)
-                                brelse(bh);
-                        return retval;
-                }
+                    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+                        return make_indexed_dir(handle, dentry, inode, bh);
                 brelse(bh);
         }
         bh = ext4_append(handle, dir, &block, &retval);
@@ -1532,10 +1528,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
         de = (struct ext4_dir_entry_2 *) bh->b_data;
         de->inode = 0;
         de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
-        retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
-        if (retval == -ENOSPC)
-                brelse(bh);
-        return retval;
+        return add_dirent_to_buf(handle, dentry, inode, de, bh);
 }
 
 /*
@@ -1664,8 +1657,7 @@ static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
         if (!de)
                 goto cleanup;
         err = add_dirent_to_buf(handle, dentry, inode, de, bh);
-        if (err != -ENOSPC)
-                bh = NULL;
+        bh = NULL;
         goto cleanup;
 
 journal_error:
@@ -2076,7 +2068,8 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
         struct ext4_iloc iloc;
         int err = 0;
 
-        if (!ext4_handle_valid(handle))
+        /* ext4_handle_valid() assumes a valid handle_t pointer */
+        if (handle && !ext4_handle_valid(handle))
                 return 0;
 
         mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index df539ba27779..d4ca92aab514 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -50,13 +50,6 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/ext4.h>
 
-static int default_mb_history_length = 1000;
-
-module_param_named(default_mb_history_length, default_mb_history_length,
-                   int, 0644);
-MODULE_PARM_DESC(default_mb_history_length,
-                 "Default number of entries saved for mb_history");
-
 struct proc_dir_entry *ext4_proc_root;
 static struct kset *ext4_kset;
 
@@ -189,6 +182,36 @@ void ext4_itable_unused_set(struct super_block *sb,
                 bg->bg_itable_unused_hi = cpu_to_le16(count >> 16);
 }
 
+
+/* Just increment the non-pointer handle value */
+static handle_t *ext4_get_nojournal(void)
+{
+        handle_t *handle = current->journal_info;
+        unsigned long ref_cnt = (unsigned long)handle;
+
+        BUG_ON(ref_cnt >= EXT4_NOJOURNAL_MAX_REF_COUNT);
+
+        ref_cnt++;
+        handle = (handle_t *)ref_cnt;
+
+        current->journal_info = handle;
+        return handle;
+}
+
+
+/* Decrement the non-pointer handle value */
+static void ext4_put_nojournal(handle_t *handle)
+{
+        unsigned long ref_cnt = (unsigned long)handle;
+
+        BUG_ON(ref_cnt == 0);
+
+        ref_cnt--;
+        handle = (handle_t *)ref_cnt;
+
+        current->journal_info = handle;
+}
+
 /*
  * Wrappers for jbd2_journal_start/end.
  *
@@ -215,11 +238,7 @@ handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks)
                 }
                 return jbd2_journal_start(journal, nblocks);
         }
-        /*
-         * We're not journaling, return the appropriate indication.
-         */
-        current->journal_info = EXT4_NOJOURNAL_HANDLE;
-        return current->journal_info;
+        return ext4_get_nojournal();
 }
 
 /*
@@ -235,11 +254,7 @@ int __ext4_journal_stop(const char *where, handle_t *handle)
         int rc;
 
         if (!ext4_handle_valid(handle)) {
-                /*
-                 * Do this here since we don't call jbd2_journal_stop() in
-                 * no-journal mode.
-                 */
-                current->journal_info = NULL;
+                ext4_put_nojournal(handle);
                 return 0;
         }
         sb = handle->h_transaction->t_journal->j_private;
@@ -580,6 +595,9 @@ static void ext4_put_super(struct super_block *sb)
         struct ext4_super_block *es = sbi->s_es;
         int i, err;
 
+        flush_workqueue(sbi->dio_unwritten_wq);
+        destroy_workqueue(sbi->dio_unwritten_wq);
+
         lock_super(sb);
         lock_kernel();
         if (sb->s_dirt)
@@ -684,6 +702,8 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
         ei->i_allocated_meta_blocks = 0;
         ei->i_delalloc_reserved_flag = 0;
         spin_lock_init(&(ei->i_block_reservation_lock));
+        INIT_LIST_HEAD(&ei->i_aio_dio_complete_list);
+        ei->cur_aio_dio = NULL;
 
         return &ei->vfs_inode;
 }
@@ -1052,7 +1072,7 @@ enum {
         Opt_journal_update, Opt_journal_dev,
         Opt_journal_checksum, Opt_journal_async_commit,
         Opt_abort, Opt_data_journal, Opt_data_ordered, Opt_data_writeback,
-        Opt_data_err_abort, Opt_data_err_ignore, Opt_mb_history_length,
+        Opt_data_err_abort, Opt_data_err_ignore,
         Opt_usrjquota, Opt_grpjquota, Opt_offusrjquota, Opt_offgrpjquota,
         Opt_jqfmt_vfsold, Opt_jqfmt_vfsv0, Opt_quota, Opt_noquota,
         Opt_ignore, Opt_barrier, Opt_nobarrier, Opt_err, Opt_resize,
@@ -1099,7 +1119,6 @@ static const match_table_t tokens = {
         {Opt_data_writeback, "data=writeback"},
         {Opt_data_err_abort, "data_err=abort"},
         {Opt_data_err_ignore, "data_err=ignore"},
-        {Opt_mb_history_length, "mb_history_length=%u"},
         {Opt_offusrjquota, "usrjquota="},
         {Opt_usrjquota, "usrjquota=%s"},
         {Opt_offgrpjquota, "grpjquota="},
@@ -1281,9 +1300,11 @@ static int parse_options(char *options, struct super_block *sb,
                         *journal_devnum = option;
                         break;
                 case Opt_journal_checksum:
-                        break;  /* Kept for backwards compatibility */
+                        set_opt(sbi->s_mount_opt, JOURNAL_CHECKSUM);
+                        break;
                 case Opt_journal_async_commit:
                         set_opt(sbi->s_mount_opt, JOURNAL_ASYNC_COMMIT);
+                        set_opt(sbi->s_mount_opt, JOURNAL_CHECKSUM);
                         break;
                 case Opt_noload:
                         set_opt(sbi->s_mount_opt, NOLOAD);
@@ -1340,13 +1361,6 @@ static int parse_options(char *options, struct super_block *sb,
                 case Opt_data_err_ignore:
                         clear_opt(sbi->s_mount_opt, DATA_ERR_ABORT);
                         break;
-                case Opt_mb_history_length:
-                        if (match_int(&args[0], &option))
-                                return 0;
-                        if (option < 0)
-                                return 0;
-                        sbi->s_mb_history_max = option;
-                        break;
 #ifdef CONFIG_QUOTA
                 case Opt_usrjquota:
                         qtype = USRQUOTA;
@@ -1646,13 +1660,6 @@ static int ext4_setup_super(struct super_block *sb, struct ext4_super_block *es,
                         EXT4_INODES_PER_GROUP(sb),
                         sbi->s_mount_opt);
 
-        if (EXT4_SB(sb)->s_journal) {
-                ext4_msg(sb, KERN_INFO, "%s journal on %s",
-                       EXT4_SB(sb)->s_journal->j_inode ? "internal" :
-                       "external", EXT4_SB(sb)->s_journal->j_devname);
-        } else {
-                ext4_msg(sb, KERN_INFO, "no journal");
-        }
         return res;
 }
 
@@ -2197,6 +2204,7 @@ EXT4_RW_ATTR_SBI_UI(mb_min_to_scan, s_mb_min_to_scan);
 EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs);
 EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request);
 EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc);
+EXT4_RW_ATTR_SBI_UI(max_writeback_mb_bump, s_max_writeback_mb_bump);
 
 static struct attribute *ext4_attrs[] = {
         ATTR_LIST(delayed_allocation_blocks),
@@ -2210,6 +2218,7 @@ static struct attribute *ext4_attrs[] = {
         ATTR_LIST(mb_order2_req),
         ATTR_LIST(mb_stream_req),
         ATTR_LIST(mb_group_prealloc),
+        ATTR_LIST(max_writeback_mb_bump),
         NULL,
 };
 
@@ -2413,7 +2422,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         sbi->s_commit_interval = JBD2_DEFAULT_MAX_COMMIT_AGE * HZ;
         sbi->s_min_batch_time = EXT4_DEF_MIN_BATCH_TIME;
         sbi->s_max_batch_time = EXT4_DEF_MAX_BATCH_TIME;
-        sbi->s_mb_history_max = default_mb_history_length;
 
         set_opt(sbi->s_mount_opt, BARRIER);
 
@@ -2679,6 +2687,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         }
 
         sbi->s_stripe = ext4_get_stripe_size(sbi);
+        sbi->s_max_writeback_mb_bump = 128;
 
         /*
          * set up enough so that it can read an inode
@@ -2752,14 +2761,20 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                 goto failed_mount4;
         }
 
-        jbd2_journal_set_features(sbi->s_journal,
-                                  JBD2_FEATURE_COMPAT_CHECKSUM, 0, 0);
-        if (test_opt(sb, JOURNAL_ASYNC_COMMIT))
-                jbd2_journal_set_features(sbi->s_journal, 0, 0,
+        if (test_opt(sb, JOURNAL_ASYNC_COMMIT)) {
+                jbd2_journal_set_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0,
                                 JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
-        else
+        } else if (test_opt(sb, JOURNAL_CHECKSUM)) {
+                jbd2_journal_set_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0, 0);
                 jbd2_journal_clear_features(sbi->s_journal, 0, 0,
                                 JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
+        } else {
+                jbd2_journal_clear_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0,
+                                JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
+        }
 
         /* We have now updated the journal if required, so we can
          * validate the data journaling mode. */
@@ -2798,6 +2813,12 @@ no_journal:
                         clear_opt(sbi->s_mount_opt, NOBH);
                 }
         }
+        EXT4_SB(sb)->dio_unwritten_wq = create_workqueue("ext4-dio-unwritten");
+        if (!EXT4_SB(sb)->dio_unwritten_wq) {
+                printk(KERN_ERR "EXT4-fs: failed to create DIO workqueue\n");
+                goto failed_mount_wq;
+        }
+
         /*
          * The jbd2_journal_load will have done any necessary log recovery,
          * so we can safely mount the rest of the filesystem now.
@@ -2849,12 +2870,12 @@ no_journal:
                          "available");
         }
 
-        if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
+        if (test_opt(sb, DELALLOC) &&
+            (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)) {
                 ext4_msg(sb, KERN_WARNING, "Ignoring delalloc option - "
                          "requested data journaling mode");
                 clear_opt(sbi->s_mount_opt, DELALLOC);
-        } else if (test_opt(sb, DELALLOC))
-                ext4_msg(sb, KERN_INFO, "delayed allocation enabled");
+        }
 
         err = ext4_setup_system_zone(sb);
         if (err) {
@@ -2910,6 +2931,8 @@ cantfind_ext4:
 
 failed_mount4:
         ext4_msg(sb, KERN_ERR, "mount failed");
+        destroy_workqueue(EXT4_SB(sb)->dio_unwritten_wq);
+failed_mount_wq:
         ext4_release_system_zone(sb);
         if (sbi->s_journal) {
                 jbd2_journal_destroy(sbi->s_journal);
@@ -3164,9 +3187,7 @@ static int ext4_load_journal(struct super_block *sb,
                         return -EINVAL;
         }
 
-        if (journal->j_flags & JBD2_BARRIER)
-                ext4_msg(sb, KERN_INFO, "barriers enabled");
-        else
+        if (!(journal->j_flags & JBD2_BARRIER))
                 ext4_msg(sb, KERN_INFO, "barriers disabled");
 
         if (!really_read_only && test_opt(sb, UPDATE_JOURNAL)) {
@@ -3361,11 +3382,13 @@ static int ext4_sync_fs(struct super_block *sb, int wait)
 {
         int ret = 0;
         tid_t target;
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
 
         trace_ext4_sync_fs(sb, wait);
-        if (jbd2_journal_start_commit(EXT4_SB(sb)->s_journal, &target)) {
+        flush_workqueue(sbi->dio_unwritten_wq);
+        if (jbd2_journal_start_commit(sbi->s_journal, &target)) {
                 if (wait)
-                        jbd2_log_wait_commit(EXT4_SB(sb)->s_journal, target);
+                        jbd2_log_wait_commit(sbi->s_journal, target);
         }
         return ret;
 }
@@ -3951,27 +3974,6 @@ static struct file_system_type ext4_fs_type = {
         .fs_flags       = FS_REQUIRES_DEV,
 };
 
-#ifdef CONFIG_EXT4DEV_COMPAT
-static int ext4dev_get_sb(struct file_system_type *fs_type, int flags,
-                          const char *dev_name, void *data,struct vfsmount *mnt)
-{
-        printk(KERN_WARNING "EXT4-fs (%s): Update your userspace programs "
-               "to mount using ext4\n", dev_name);
-        printk(KERN_WARNING "EXT4-fs (%s): ext4dev backwards compatibility "
-               "will go away by 2.6.31\n", dev_name);
-        return get_sb_bdev(fs_type, flags, dev_name, data, ext4_fill_super,mnt);
-}
-
-static struct file_system_type ext4dev_fs_type = {
-        .owner          = THIS_MODULE,
-        .name           = "ext4dev",
-        .get_sb         = ext4dev_get_sb,
-        .kill_sb        = kill_block_super,
-        .fs_flags       = FS_REQUIRES_DEV,
-};
-MODULE_ALIAS("ext4dev");
-#endif
-
 static int __init init_ext4_fs(void)
 {
         int err;
@@ -3996,13 +3998,6 @@ static int __init init_ext4_fs(void)
         err = register_filesystem(&ext4_fs_type);
         if (err)
                 goto out;
-#ifdef CONFIG_EXT4DEV_COMPAT
-        err = register_filesystem(&ext4dev_fs_type);
-        if (err) {
-                unregister_filesystem(&ext4_fs_type);
-                goto out;
-        }
-#endif
         return 0;
 out:
         destroy_inodecache();
@@ -4021,9 +4016,6 @@ out4:
 static void __exit exit_ext4_fs(void)
 {
         unregister_filesystem(&ext4_fs_type);
-#ifdef CONFIG_EXT4DEV_COMPAT
-        unregister_filesystem(&ext4dev_fs_type);
-#endif
         destroy_inodecache();
         exit_ext4_xattr();
         exit_ext4_mballoc();
diff --git a/fs/fat/fat.h b/fs/fat/fat.h
index adb0e72a176d..7db0979c6b72 100644
--- a/fs/fat/fat.h
+++ b/fs/fat/fat.h
@@ -323,7 +323,7 @@ extern int fat_flush_inodes(struct super_block *sb, struct inode *i1,
 /* fat/misc.c */
 extern void fat_fs_error(struct super_block *s, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3))) __cold;
-extern void fat_clusters_flush(struct super_block *sb);
+extern int fat_clusters_flush(struct super_block *sb);
 extern int fat_chain_add(struct inode *inode, int new_dclus, int nr_cluster);
 extern void fat_time_fat2unix(struct msdos_sb_info *sbi, struct timespec *ts,
                               __le16 __time, __le16 __date, u8 time_cs);
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 04629d1302fc..76b7961ab663 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -451,12 +451,16 @@ static void fat_write_super(struct super_block *sb)
 
 static int fat_sync_fs(struct super_block *sb, int wait)
 {
-        lock_super(sb);
-        fat_clusters_flush(sb);
-        sb->s_dirt = 0;
-        unlock_super(sb);
+        int err = 0;
 
-        return 0;
+        if (sb->s_dirt) {
+                lock_super(sb);
+                sb->s_dirt = 0;
+                err = fat_clusters_flush(sb);
+                unlock_super(sb);
+        }
+
+        return err;
 }
 
 static void fat_put_super(struct super_block *sb)
@@ -812,7 +816,7 @@ static int fat_show_options(struct seq_file *m, struct vfsmount *mnt)
                         seq_puts(m, ",shortname=mixed");
                         break;
                 case VFAT_SFN_DISPLAY_LOWER | VFAT_SFN_CREATE_WIN95:
-                        /* seq_puts(m, ",shortname=lower"); */
+                        seq_puts(m, ",shortname=lower");
                         break;
                 default:
                         seq_puts(m, ",shortname=unknown");
@@ -963,7 +967,7 @@ static int parse_options(char *options, int is_vfat, int silent, int *debug,
         opts->codepage = fat_default_codepage;
         opts->iocharset = fat_default_iocharset;
         if (is_vfat) {
-                opts->shortname = VFAT_SFN_DISPLAY_LOWER|VFAT_SFN_CREATE_WIN95;
+                opts->shortname = VFAT_SFN_DISPLAY_WINNT|VFAT_SFN_CREATE_WIN95;
                 opts->rodir = 0;
         } else {
                 opts->shortname = 0;
diff --git a/fs/fat/misc.c b/fs/fat/misc.c
index 4e35be873e09..0f55f5cb732f 100644
--- a/fs/fat/misc.c
+++ b/fs/fat/misc.c
@@ -43,19 +43,19 @@ EXPORT_SYMBOL_GPL(fat_fs_error);
 
 /* Flushes the number of free clusters on FAT32 */
 /* XXX: Need to write one per FSINFO block.  Currently only writes 1 */
-void fat_clusters_flush(struct super_block *sb)
+int fat_clusters_flush(struct super_block *sb)
 {
         struct msdos_sb_info *sbi = MSDOS_SB(sb);
         struct buffer_head *bh;
         struct fat_boot_fsinfo *fsinfo;
 
         if (sbi->fat_bits != 32)
-                return;
+                return 0;
 
         bh = sb_bread(sb, sbi->fsinfo_sector);
         if (bh == NULL) {
                 printk(KERN_ERR "FAT: bread failed in fat_clusters_flush\n");
-                return;
+                return -EIO;
         }
 
         fsinfo = (struct fat_boot_fsinfo *)bh->b_data;
@@ -74,6 +74,8 @@ void fat_clusters_flush(struct super_block *sb)
                 mark_buffer_dirty(bh);
         }
         brelse(bh);
+
+        return 0;
 }
 
 /*
diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
index cb6e83557112..f565f24019b5 100644
--- a/fs/fat/namei_vfat.c
+++ b/fs/fat/namei_vfat.c
@@ -499,17 +499,10 @@ xlate_to_uni(const unsigned char *name, int len, unsigned char *outname,
         int charlen;
 
         if (utf8) {
-                int name_len = strlen(name);
-
-                *outlen = utf8s_to_utf16s(name, PATH_MAX, (wchar_t *) outname);
-
-                /*
-                 * We stripped '.'s before and set len appropriately,
-                 * but utf8s_to_utf16s doesn't care about len
-                 */
-                *outlen -= (name_len - len);
-
-                if (*outlen > 255)
+                *outlen = utf8s_to_utf16s(name, len, (wchar_t *)outname);
+                if (*outlen < 0)
+                        return *outlen;
+                else if (*outlen > 255)
                         return -ENAMETOOLONG;
 
                 op = &outname[*outlen * sizeof(wchar_t)];
diff --git a/fs/fcntl.c b/fs/fcntl.c
index fc089f2f7f56..2cf93ec40a67 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -284,7 +284,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
                 type = PIDTYPE_PID;
                 break;
 
-        case F_OWNER_GID:
+        case F_OWNER_PGRP:
                 type = PIDTYPE_PGID;
                 break;
 
@@ -321,7 +321,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg)
                 break;
 
         case PIDTYPE_PGID:
-                owner.type = F_OWNER_GID;
+                owner.type = F_OWNER_PGRP;
                 break;
 
         default:
diff --git a/fs/file.c b/fs/file.c
index f313314f996f..87e129030ab1 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -10,6 +10,7 @@
 #include <linux/fs.h>
 #include <linux/mm.h>
 #include <linux/time.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/file.h>
diff --git a/fs/fscache/Kconfig b/fs/fscache/Kconfig
index 9bbb8ce7bea0..864dac20a242 100644
--- a/fs/fscache/Kconfig
+++ b/fs/fscache/Kconfig
@@ -54,3 +54,10 @@ config FSCACHE_DEBUG
           enabled by setting bits in /sys/modules/fscache/parameter/debug.
 
           See Documentation/filesystems/caching/fscache.txt for more information.
+
+config FSCACHE_OBJECT_LIST
+        bool "Maintain global object list for debugging purposes"
+        depends on FSCACHE && PROC_FS
+        help
+          Maintain a global list of active fscache objects that can be
+          retrieved through /proc/fs/fscache/objects for debugging purposes
diff --git a/fs/fscache/Makefile b/fs/fscache/Makefile
index 91571b95aacc..6d561531cb36 100644
--- a/fs/fscache/Makefile
+++ b/fs/fscache/Makefile
@@ -15,5 +15,6 @@ fscache-y := \
 fscache-$(CONFIG_PROC_FS) += proc.o
 fscache-$(CONFIG_FSCACHE_STATS) += stats.o
 fscache-$(CONFIG_FSCACHE_HISTOGRAM) += histogram.o
+fscache-$(CONFIG_FSCACHE_OBJECT_LIST) += object-list.o
 
 obj-$(CONFIG_FSCACHE) := fscache.o
diff --git a/fs/fscache/cache.c b/fs/fscache/cache.c
index e21985bbb1fb..6a3c48abd677 100644
--- a/fs/fscache/cache.c
+++ b/fs/fscache/cache.c
@@ -263,6 +263,7 @@ int fscache_add_cache(struct fscache_cache *cache,
         spin_lock(&cache->object_list_lock);
         list_add_tail(&ifsdef->cache_link, &cache->object_list);
         spin_unlock(&cache->object_list_lock);
+        fscache_objlist_add(ifsdef);
 
         /* add the cache's netfs definition index object to the top level index
          * cookie as a known backing object */
@@ -380,11 +381,15 @@ void fscache_withdraw_cache(struct fscache_cache *cache)
 
         /* make sure all pages pinned by operations on behalf of the netfs are
          * written to disk */
+        fscache_stat(&fscache_n_cop_sync_cache);
         cache->ops->sync_cache(cache);
+        fscache_stat_d(&fscache_n_cop_sync_cache);
 
         /* dissociate all the netfs pages backed by this cache from the block
          * mappings in the cache */
+        fscache_stat(&fscache_n_cop_dissociate_pages);
         cache->ops->dissociate_pages(cache);
+        fscache_stat_d(&fscache_n_cop_dissociate_pages);
 
         /* we now have to destroy all the active objects pertaining to this
          * cache - which we do by passing them off to thread pool to be
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 72fd18f6c71f..990535071a8a 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -36,6 +36,7 @@ void fscache_cookie_init_once(void *_cookie)
 
         memset(cookie, 0, sizeof(*cookie));
         spin_lock_init(&cookie->lock);
+        spin_lock_init(&cookie->stores_lock);
         INIT_HLIST_HEAD(&cookie->backing_objects);
 }
 
@@ -102,7 +103,9 @@ struct fscache_cookie *__fscache_acquire_cookie(
         cookie->netfs_data      = netfs_data;
         cookie->flags           = 0;
 
-        INIT_RADIX_TREE(&cookie->stores, GFP_NOFS);
+        /* radix tree insertion won't use the preallocation pool unless it's
+         * told it may not wait */
+        INIT_RADIX_TREE(&cookie->stores, GFP_NOFS & ~__GFP_WAIT);
 
         switch (cookie->def->type) {
         case FSCACHE_COOKIE_TYPE_INDEX:
@@ -249,7 +252,9 @@ static int fscache_alloc_object(struct fscache_cache *cache,
 
         /* ask the cache to allocate an object (we may end up with duplicate
          * objects at this stage, but we sort that out later) */
+        fscache_stat(&fscache_n_cop_alloc_object);
         object = cache->ops->alloc_object(cache, cookie);
+        fscache_stat_d(&fscache_n_cop_alloc_object);
         if (IS_ERR(object)) {
                 fscache_stat(&fscache_n_object_no_alloc);
                 ret = PTR_ERR(object);
@@ -270,8 +275,11 @@ static int fscache_alloc_object(struct fscache_cache *cache,
         /* only attach if we managed to allocate all we needed, otherwise
          * discard the object we just allocated and instead use the one
          * attached to the cookie */
-        if (fscache_attach_object(cookie, object) < 0)
+        if (fscache_attach_object(cookie, object) < 0) {
+                fscache_stat(&fscache_n_cop_put_object);
                 cache->ops->put_object(object);
+                fscache_stat_d(&fscache_n_cop_put_object);
+        }
 
         _leave(" = 0");
         return 0;
@@ -287,7 +295,9 @@ object_already_extant:
         return 0;
 
 error_put:
+        fscache_stat(&fscache_n_cop_put_object);
         cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 error:
         _leave(" = %d", ret);
         return ret;
@@ -349,6 +359,8 @@ static int fscache_attach_object(struct fscache_cookie *cookie,
         object->cookie = cookie;
         atomic_inc(&cookie->usage);
         hlist_add_head(&object->cookie_link, &cookie->backing_objects);
+
+        fscache_objlist_add(object);
         ret = 0;
 
 cant_attach_object:
@@ -403,6 +415,8 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
         unsigned long event;
 
         fscache_stat(&fscache_n_relinquishes);
+        if (retire)
+                fscache_stat(&fscache_n_relinquishes_retire);
 
         if (!cookie) {
                 fscache_stat(&fscache_n_relinquishes_null);
@@ -428,12 +442,8 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
 
         event = retire ? FSCACHE_OBJECT_EV_RETIRE : FSCACHE_OBJECT_EV_RELEASE;
 
-        /* detach pointers back to the netfs */
         spin_lock(&cookie->lock);
 
-        cookie->netfs_data      = NULL;
-        cookie->def             = NULL;
-
         /* break links with all the active objects */
         while (!hlist_empty(&cookie->backing_objects)) {
                 object = hlist_entry(cookie->backing_objects.first,
@@ -456,6 +466,10 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
                         BUG();
         }
 
+        /* detach pointers back to the netfs */
+        cookie->netfs_data      = NULL;
+        cookie->def             = NULL;
+
         spin_unlock(&cookie->lock);
 
         if (cookie->parent) {
diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
index 1c341304621f..edd7434ab6e5 100644
--- a/fs/fscache/internal.h
+++ b/fs/fscache/internal.h
@@ -17,6 +17,7 @@
  * - cache->object_list_lock
  * - object->lock
  * - object->parent->lock
+ * - cookie->stores_lock
  * - fscache_thread_lock
  *
  */
@@ -88,17 +89,31 @@ extern int fscache_wait_bit_interruptible(void *);
 /*
  * object.c
  */
+extern const char fscache_object_states_short[FSCACHE_OBJECT__NSTATES][5];
+
 extern void fscache_withdrawing_object(struct fscache_cache *,
                                        struct fscache_object *);
 extern void fscache_enqueue_object(struct fscache_object *);
 
 /*
+ * object-list.c
+ */
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+extern const struct file_operations fscache_objlist_fops;
+
+extern void fscache_objlist_add(struct fscache_object *);
+#else
+#define fscache_objlist_add(object) do {} while(0)
+#endif
+
+/*
  * operation.c
  */
 extern int fscache_submit_exclusive_op(struct fscache_object *,
                                        struct fscache_operation *);
 extern int fscache_submit_op(struct fscache_object *,
                              struct fscache_operation *);
+extern int fscache_cancel_op(struct fscache_operation *);
 extern void fscache_abort_object(struct fscache_object *);
 extern void fscache_start_operations(struct fscache_object *);
 extern void fscache_operation_gc(struct work_struct *);
@@ -127,6 +142,8 @@ extern atomic_t fscache_n_op_enqueue;
 extern atomic_t fscache_n_op_deferred_release;
 extern atomic_t fscache_n_op_release;
 extern atomic_t fscache_n_op_gc;
+extern atomic_t fscache_n_op_cancelled;
+extern atomic_t fscache_n_op_rejected;
 
 extern atomic_t fscache_n_attr_changed;
 extern atomic_t fscache_n_attr_changed_ok;
@@ -138,6 +155,8 @@ extern atomic_t fscache_n_allocs;
 extern atomic_t fscache_n_allocs_ok;
 extern atomic_t fscache_n_allocs_wait;
 extern atomic_t fscache_n_allocs_nobufs;
+extern atomic_t fscache_n_allocs_intr;
+extern atomic_t fscache_n_allocs_object_dead;
 extern atomic_t fscache_n_alloc_ops;
 extern atomic_t fscache_n_alloc_op_waits;
 
@@ -148,6 +167,7 @@ extern atomic_t fscache_n_retrievals_nodata;
 extern atomic_t fscache_n_retrievals_nobufs;
 extern atomic_t fscache_n_retrievals_intr;
 extern atomic_t fscache_n_retrievals_nomem;
+extern atomic_t fscache_n_retrievals_object_dead;
 extern atomic_t fscache_n_retrieval_ops;
 extern atomic_t fscache_n_retrieval_op_waits;
 
@@ -158,6 +178,14 @@ extern atomic_t fscache_n_stores_nobufs;
 extern atomic_t fscache_n_stores_oom;
 extern atomic_t fscache_n_store_ops;
 extern atomic_t fscache_n_store_calls;
+extern atomic_t fscache_n_store_pages;
+extern atomic_t fscache_n_store_radix_deletes;
+extern atomic_t fscache_n_store_pages_over_limit;
+
+extern atomic_t fscache_n_store_vmscan_not_storing;
+extern atomic_t fscache_n_store_vmscan_gone;
+extern atomic_t fscache_n_store_vmscan_busy;
+extern atomic_t fscache_n_store_vmscan_cancelled;
 
 extern atomic_t fscache_n_marks;
 extern atomic_t fscache_n_uncaches;
@@ -176,6 +204,7 @@ extern atomic_t fscache_n_updates_run;
 extern atomic_t fscache_n_relinquishes;
 extern atomic_t fscache_n_relinquishes_null;
 extern atomic_t fscache_n_relinquishes_waitcrt;
+extern atomic_t fscache_n_relinquishes_retire;
 
 extern atomic_t fscache_n_cookie_index;
 extern atomic_t fscache_n_cookie_data;
@@ -186,6 +215,7 @@ extern atomic_t fscache_n_object_no_alloc;
 extern atomic_t fscache_n_object_lookups;
 extern atomic_t fscache_n_object_lookups_negative;
 extern atomic_t fscache_n_object_lookups_positive;
+extern atomic_t fscache_n_object_lookups_timed_out;
 extern atomic_t fscache_n_object_created;
 extern atomic_t fscache_n_object_avail;
 extern atomic_t fscache_n_object_dead;
@@ -195,15 +225,41 @@ extern atomic_t fscache_n_checkaux_okay;
 extern atomic_t fscache_n_checkaux_update;
 extern atomic_t fscache_n_checkaux_obsolete;
 
+extern atomic_t fscache_n_cop_alloc_object;
+extern atomic_t fscache_n_cop_lookup_object;
+extern atomic_t fscache_n_cop_lookup_complete;
+extern atomic_t fscache_n_cop_grab_object;
+extern atomic_t fscache_n_cop_update_object;
+extern atomic_t fscache_n_cop_drop_object;
+extern atomic_t fscache_n_cop_put_object;
+extern atomic_t fscache_n_cop_sync_cache;
+extern atomic_t fscache_n_cop_attr_changed;
+extern atomic_t fscache_n_cop_read_or_alloc_page;
+extern atomic_t fscache_n_cop_read_or_alloc_pages;
+extern atomic_t fscache_n_cop_allocate_page;
+extern atomic_t fscache_n_cop_allocate_pages;
+extern atomic_t fscache_n_cop_write_page;
+extern atomic_t fscache_n_cop_uncache_page;
+extern atomic_t fscache_n_cop_dissociate_pages;
+
 static inline void fscache_stat(atomic_t *stat)
 {
         atomic_inc(stat);
 }
 
+static inline void fscache_stat_d(atomic_t *stat)
+{
+        atomic_dec(stat);
+}
+
+#define __fscache_stat(stat) (stat)
+
 extern const struct file_operations fscache_stats_fops;
 #else
 
+#define __fscache_stat(stat) (NULL)
 #define fscache_stat(stat) do {} while (0)
+#define fscache_stat_d(stat) do {} while (0)
 #endif
 
 /*
diff --git a/fs/fscache/main.c b/fs/fscache/main.c
index 4de41b597499..add6bdb53f04 100644
--- a/fs/fscache/main.c
+++ b/fs/fscache/main.c
@@ -48,7 +48,7 @@ static int __init fscache_init(void)
 {
         int ret;
 
-        ret = slow_work_register_user();
+        ret = slow_work_register_user(THIS_MODULE);
         if (ret < 0)
                 goto error_slow_work;
 
@@ -80,7 +80,7 @@ error_kobj:
 error_cookie_jar:
         fscache_proc_cleanup();
 error_proc:
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
 error_slow_work:
         return ret;
 }
@@ -97,7 +97,7 @@ static void __exit fscache_exit(void)
         kobject_put(fscache_root);
         kmem_cache_destroy(fscache_cookie_jar);
         fscache_proc_cleanup();
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
         printk(KERN_NOTICE "FS-Cache: Unloaded\n");
 }
 
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
new file mode 100644
index 000000000000..e590242fa41a
--- /dev/null
+++ b/fs/fscache/object-list.c
@@ -0,0 +1,432 @@
+/* Global fscache object list maintainer and viewer
+ *
+ * Copyright (C) 2009 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#define FSCACHE_DEBUG_LEVEL COOKIE
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/key.h>
+#include <keys/user-type.h>
+#include "internal.h"
+
+static struct rb_root fscache_object_list;
+static DEFINE_RWLOCK(fscache_object_list_lock);
+
+struct fscache_objlist_data {
+        unsigned long   config;         /* display configuration */
+#define FSCACHE_OBJLIST_CONFIG_KEY      0x00000001      /* show object keys */
+#define FSCACHE_OBJLIST_CONFIG_AUX      0x00000002      /* show object auxdata */
+#define FSCACHE_OBJLIST_CONFIG_COOKIE   0x00000004      /* show objects with cookies */
+#define FSCACHE_OBJLIST_CONFIG_NOCOOKIE 0x00000008      /* show objects without cookies */
+#define FSCACHE_OBJLIST_CONFIG_BUSY     0x00000010      /* show busy objects */
+#define FSCACHE_OBJLIST_CONFIG_IDLE     0x00000020      /* show idle objects */
+#define FSCACHE_OBJLIST_CONFIG_PENDWR   0x00000040      /* show objects with pending writes */
+#define FSCACHE_OBJLIST_CONFIG_NOPENDWR 0x00000080      /* show objects without pending writes */
+#define FSCACHE_OBJLIST_CONFIG_READS    0x00000100      /* show objects with active reads */
+#define FSCACHE_OBJLIST_CONFIG_NOREADS  0x00000200      /* show objects without active reads */
+#define FSCACHE_OBJLIST_CONFIG_EVENTS   0x00000400      /* show objects with events */
+#define FSCACHE_OBJLIST_CONFIG_NOEVENTS 0x00000800      /* show objects without no events */
+#define FSCACHE_OBJLIST_CONFIG_WORK     0x00001000      /* show objects with slow work */
+#define FSCACHE_OBJLIST_CONFIG_NOWORK   0x00002000      /* show objects without slow work */
+
+        u8              buf[512];       /* key and aux data buffer */
+};
+
+/*
+ * Add an object to the object list
+ * - we use the address of the fscache_object structure as the key into the
+ *   tree
+ */
+void fscache_objlist_add(struct fscache_object *obj)
+{
+        struct fscache_object *xobj;
+        struct rb_node **p = &fscache_object_list.rb_node, *parent = NULL;
+
+        write_lock(&fscache_object_list_lock);
+
+        while (*p) {
+                parent = *p;
+                xobj = rb_entry(parent, struct fscache_object, objlist_link);
+
+                if (obj < xobj)
+                        p = &(*p)->rb_left;
+                else if (obj > xobj)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&obj->objlist_link, parent, p);
+        rb_insert_color(&obj->objlist_link, &fscache_object_list);
+
+        write_unlock(&fscache_object_list_lock);
+}
+
+/**
+ * fscache_object_destroy - Note that a cache object is about to be destroyed
+ * @object: The object to be destroyed
+ *
+ * Note the imminent destruction and deallocation of a cache object record.
+ */
+void fscache_object_destroy(struct fscache_object *obj)
+{
+        write_lock(&fscache_object_list_lock);
+
+        BUG_ON(RB_EMPTY_ROOT(&fscache_object_list));
+        rb_erase(&obj->objlist_link, &fscache_object_list);
+
+        write_unlock(&fscache_object_list_lock);
+}
+EXPORT_SYMBOL(fscache_object_destroy);
+
+/*
+ * find the object in the tree on or after the specified index
+ */
+static struct fscache_object *fscache_objlist_lookup(loff_t *_pos)
+{
+        struct fscache_object *pobj, *obj, *minobj = NULL;
+        struct rb_node *p;
+        unsigned long pos;
+
+        if (*_pos >= (unsigned long) ERR_PTR(-ENOENT))
+                return NULL;
+        pos = *_pos;
+
+        /* banners (can't represent line 0 by pos 0 as that would involve
+         * returning a NULL pointer) */
+        if (pos == 0)
+                return (struct fscache_object *) ++(*_pos);
+        if (pos < 3)
+                return (struct fscache_object *)pos;
+
+        pobj = (struct fscache_object *)pos;
+        p = fscache_object_list.rb_node;
+        while (p) {
+                obj = rb_entry(p, struct fscache_object, objlist_link);
+                if (pobj < obj) {
+                        if (!minobj || minobj > obj)
+                                minobj = obj;
+                        p = p->rb_left;
+                } else if (pobj > obj) {
+                        p = p->rb_right;
+                } else {
+                        minobj = obj;
+                        break;
+                }
+                obj = NULL;
+        }
+
+        if (!minobj)
+                *_pos = (unsigned long) ERR_PTR(-ENOENT);
+        else if (minobj != obj)
+                *_pos = (unsigned long) minobj;
+        return minobj;
+}
+
+/*
+ * set up the iterator to start reading from the first line
+ */
+static void *fscache_objlist_start(struct seq_file *m, loff_t *_pos)
+        __acquires(&fscache_object_list_lock)
+{
+        read_lock(&fscache_object_list_lock);
+        return fscache_objlist_lookup(_pos);
+}
+
+/*
+ * move to the next line
+ */
+static void *fscache_objlist_next(struct seq_file *m, void *v, loff_t *_pos)
+{
+        (*_pos)++;
+        return fscache_objlist_lookup(_pos);
+}
+
+/*
+ * clean up after reading
+ */
+static void fscache_objlist_stop(struct seq_file *m, void *v)
+        __releases(&fscache_object_list_lock)
+{
+        read_unlock(&fscache_object_list_lock);
+}
+
+/*
+ * display an object
+ */
+static int fscache_objlist_show(struct seq_file *m, void *v)
+{
+        struct fscache_objlist_data *data = m->private;
+        struct fscache_object *obj = v;
+        unsigned long config = data->config;
+        uint16_t keylen, auxlen;
+        char _type[3], *type;
+        bool no_cookie;
+        u8 *buf = data->buf, *p;
+
+        if ((unsigned long) v == 1) {
+                seq_puts(m, "OBJECT   PARENT   STAT CHLDN OPS OOP IPR EX READS"
+                         " EM EV F S"
+                         " | NETFS_COOKIE_DEF TY FL NETFS_DATA");
+                if (config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                              FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, "       ");
+                if (config & FSCACHE_OBJLIST_CONFIG_KEY)
+                        seq_puts(m, "OBJECT_KEY");
+                if ((config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                               FSCACHE_OBJLIST_CONFIG_AUX)) ==
+                    (FSCACHE_OBJLIST_CONFIG_KEY | FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, ", ");
+                if (config & FSCACHE_OBJLIST_CONFIG_AUX)
+                        seq_puts(m, "AUX_DATA");
+                seq_puts(m, "\n");
+                return 0;
+        }
+
+        if ((unsigned long) v == 2) {
+                seq_puts(m, "======== ======== ==== ===== === === === == ====="
+                         " == == = ="
+                         " | ================ == == ================");
+                if (config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                              FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, " ================");
+                seq_puts(m, "\n");
+                return 0;
+        }
+
+        /* filter out any unwanted objects */
+#define FILTER(criterion, _yes, _no)                                    \
+        do {                                                            \
+                unsigned long yes = FSCACHE_OBJLIST_CONFIG_##_yes;      \
+                unsigned long no = FSCACHE_OBJLIST_CONFIG_##_no;        \
+                if (criterion) {                                        \
+                        if (!(config & yes))                            \
+                                return 0;                               \
+                } else {                                                \
+                        if (!(config & no))                             \
+                                return 0;                               \
+                }                                                       \
+        } while(0)
+
+        if (~config) {
+                FILTER(obj->cookie,
+                       COOKIE, NOCOOKIE);
+                FILTER(obj->state != FSCACHE_OBJECT_ACTIVE ||
+                       obj->n_ops != 0 ||
+                       obj->n_obj_ops != 0 ||
+                       obj->flags ||
+                       !list_empty(&obj->dependents),
+                       BUSY, IDLE);
+                FILTER(test_bit(FSCACHE_OBJECT_PENDING_WRITE, &obj->flags),
+                       PENDWR, NOPENDWR);
+                FILTER(atomic_read(&obj->n_reads),
+                       READS, NOREADS);
+                FILTER(obj->events & obj->event_mask,
+                       EVENTS, NOEVENTS);
+                FILTER(obj->work.flags & ~(1UL << SLOW_WORK_VERY_SLOW),
+                       WORK, NOWORK);
+        }
+
+        seq_printf(m,
+                   "%8x %8x %s %5u %3u %3u %3u %2u %5u %2lx %2lx %1lx %1lx | ",
+                   obj->debug_id,
+                   obj->parent ? obj->parent->debug_id : -1,
+                   fscache_object_states_short[obj->state],
+                   obj->n_children,
+                   obj->n_ops,
+                   obj->n_obj_ops,
+                   obj->n_in_progress,
+                   obj->n_exclusive,
+                   atomic_read(&obj->n_reads),
+                   obj->event_mask & FSCACHE_OBJECT_EVENTS_MASK,
+                   obj->events,
+                   obj->flags,
+                   obj->work.flags);
+
+        no_cookie = true;
+        keylen = auxlen = 0;
+        if (obj->cookie) {
+                spin_lock(&obj->lock);
+                if (obj->cookie) {
+                        switch (obj->cookie->def->type) {
+                        case 0:
+                                type = "IX";
+                                break;
+                        case 1:
+                                type = "DT";
+                                break;
+                        default:
+                                sprintf(_type, "%02u",
+                                        obj->cookie->def->type);
+                                type = _type;
+                                break;
+                        }
+
+                        seq_printf(m, "%-16s %s %2lx %16p",
+                                   obj->cookie->def->name,
+                                   type,
+                                   obj->cookie->flags,
+                                   obj->cookie->netfs_data);
+
+                        if (obj->cookie->def->get_key &&
+                            config & FSCACHE_OBJLIST_CONFIG_KEY)
+                                keylen = obj->cookie->def->get_key(
+                                        obj->cookie->netfs_data,
+                                        buf, 400);
+
+                        if (obj->cookie->def->get_aux &&
+                            config & FSCACHE_OBJLIST_CONFIG_AUX)
+                                auxlen = obj->cookie->def->get_aux(
+                                        obj->cookie->netfs_data,
+                                        buf + keylen, 512 - keylen);
+
+                        no_cookie = false;
+                }
+                spin_unlock(&obj->lock);
+
+                if (!no_cookie && (keylen > 0 || auxlen > 0)) {
+                        seq_printf(m, " ");
+                        for (p = buf; keylen > 0; keylen--)
+                                seq_printf(m, "%02x", *p++);
+                        if (auxlen > 0) {
+                                if (config & FSCACHE_OBJLIST_CONFIG_KEY)
+                                        seq_printf(m, ", ");
+                                for (; auxlen > 0; auxlen--)
+                                        seq_printf(m, "%02x", *p++);
+                        }
+                }
+        }
+
+        if (no_cookie)
+                seq_printf(m, "<no_cookie>\n");
+        else
+                seq_printf(m, "\n");
+        return 0;
+}
+
+static const struct seq_operations fscache_objlist_ops = {
+        .start          = fscache_objlist_start,
+        .stop           = fscache_objlist_stop,
+        .next           = fscache_objlist_next,
+        .show           = fscache_objlist_show,
+};
+
+/*
+ * get the configuration for filtering the list
+ */
+static void fscache_objlist_config(struct fscache_objlist_data *data)
+{
+#ifdef CONFIG_KEYS
+        struct user_key_payload *confkey;
+        unsigned long config;
+        struct key *key;
+        const char *buf;
+        int len;
+
+        key = request_key(&key_type_user, "fscache:objlist", NULL);
+        if (IS_ERR(key))
+                goto no_config;
+
+        config = 0;
+        rcu_read_lock();
+
+        confkey = key->payload.data;
+        buf = confkey->data;
+
+        for (len = confkey->datalen - 1; len >= 0; len--) {
+                switch (buf[len]) {
+                case 'K': config |= FSCACHE_OBJLIST_CONFIG_KEY;         break;
+                case 'A': config |= FSCACHE_OBJLIST_CONFIG_AUX;         break;
+                case 'C': config |= FSCACHE_OBJLIST_CONFIG_COOKIE;      break;
+                case 'c': config |= FSCACHE_OBJLIST_CONFIG_NOCOOKIE;    break;
+                case 'B': config |= FSCACHE_OBJLIST_CONFIG_BUSY;        break;
+                case 'b': config |= FSCACHE_OBJLIST_CONFIG_IDLE;        break;
+                case 'W': config |= FSCACHE_OBJLIST_CONFIG_PENDWR;      break;
+                case 'w': config |= FSCACHE_OBJLIST_CONFIG_NOPENDWR;    break;
+                case 'R': config |= FSCACHE_OBJLIST_CONFIG_READS;       break;
+                case 'r': config |= FSCACHE_OBJLIST_CONFIG_NOREADS;     break;
+                case 'S': config |= FSCACHE_OBJLIST_CONFIG_WORK;        break;
+                case 's': config |= FSCACHE_OBJLIST_CONFIG_NOWORK;      break;
+                }
+        }
+
+        rcu_read_unlock();
+        key_put(key);
+
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_COOKIE | FSCACHE_OBJLIST_CONFIG_NOCOOKIE)))
+            config   |= FSCACHE_OBJLIST_CONFIG_COOKIE | FSCACHE_OBJLIST_CONFIG_NOCOOKIE;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_BUSY | FSCACHE_OBJLIST_CONFIG_IDLE)))
+            config   |= FSCACHE_OBJLIST_CONFIG_BUSY | FSCACHE_OBJLIST_CONFIG_IDLE;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_PENDWR | FSCACHE_OBJLIST_CONFIG_NOPENDWR)))
+            config   |= FSCACHE_OBJLIST_CONFIG_PENDWR | FSCACHE_OBJLIST_CONFIG_NOPENDWR;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_READS | FSCACHE_OBJLIST_CONFIG_NOREADS)))
+            config   |= FSCACHE_OBJLIST_CONFIG_READS | FSCACHE_OBJLIST_CONFIG_NOREADS;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_EVENTS | FSCACHE_OBJLIST_CONFIG_NOEVENTS)))
+            config   |= FSCACHE_OBJLIST_CONFIG_EVENTS | FSCACHE_OBJLIST_CONFIG_NOEVENTS;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_WORK | FSCACHE_OBJLIST_CONFIG_NOWORK)))
+            config   |= FSCACHE_OBJLIST_CONFIG_WORK | FSCACHE_OBJLIST_CONFIG_NOWORK;
+
+        data->config = config;
+        return;
+
+no_config:
+#endif
+        data->config = ULONG_MAX;
+}
+
+/*
+ * open "/proc/fs/fscache/objects" to provide a list of active objects
+ * - can be configured by a user-defined key added to the caller's keyrings
+ */
+static int fscache_objlist_open(struct inode *inode, struct file *file)
+{
+        struct fscache_objlist_data *data;
+        struct seq_file *m;
+        int ret;
+
+        ret = seq_open(file, &fscache_objlist_ops);
+        if (ret < 0)
+                return ret;
+
+        m = file->private_data;
+
+        /* buffer for key extraction */
+        data = kmalloc(sizeof(struct fscache_objlist_data), GFP_KERNEL);
+        if (!data) {
+                seq_release(inode, file);
+                return -ENOMEM;
+        }
+
+        /* get the configuration key */
+        fscache_objlist_config(data);
+
+        m->private = data;
+        return 0;
+}
+
+/*
+ * clean up on close
+ */
+static int fscache_objlist_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *m = file->private_data;
+
+        kfree(m->private);
+        m->private = NULL;
+        return seq_release(inode, file);
+}
+
+const struct file_operations fscache_objlist_fops = {
+        .owner          = THIS_MODULE,
+        .open           = fscache_objlist_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = fscache_objlist_release,
+};
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 392a41b1b79d..e513ac599c8e 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -14,9 +14,10 @@
 
 #define FSCACHE_DEBUG_LEVEL COOKIE
 #include <linux/module.h>
+#include <linux/seq_file.h>
 #include "internal.h"
 
-const char *fscache_object_states[] = {
+const char *fscache_object_states[FSCACHE_OBJECT__NSTATES] = {
         [FSCACHE_OBJECT_INIT]           = "OBJECT_INIT",
         [FSCACHE_OBJECT_LOOKING_UP]     = "OBJECT_LOOKING_UP",
         [FSCACHE_OBJECT_CREATING]       = "OBJECT_CREATING",
@@ -33,9 +34,28 @@ const char *fscache_object_states[] = {
 };
 EXPORT_SYMBOL(fscache_object_states);
 
+const char fscache_object_states_short[FSCACHE_OBJECT__NSTATES][5] = {
+        [FSCACHE_OBJECT_INIT]           = "INIT",
+        [FSCACHE_OBJECT_LOOKING_UP]     = "LOOK",
+        [FSCACHE_OBJECT_CREATING]       = "CRTN",
+        [FSCACHE_OBJECT_AVAILABLE]      = "AVBL",
+        [FSCACHE_OBJECT_ACTIVE]         = "ACTV",
+        [FSCACHE_OBJECT_UPDATING]       = "UPDT",
+        [FSCACHE_OBJECT_DYING]          = "DYNG",
+        [FSCACHE_OBJECT_LC_DYING]       = "LCDY",
+        [FSCACHE_OBJECT_ABORT_INIT]     = "ABTI",
+        [FSCACHE_OBJECT_RELEASING]      = "RELS",
+        [FSCACHE_OBJECT_RECYCLING]      = "RCYC",
+        [FSCACHE_OBJECT_WITHDRAWING]    = "WTHD",
+        [FSCACHE_OBJECT_DEAD]           = "DEAD",
+};
+
 static void fscache_object_slow_work_put_ref(struct slow_work *);
 static int  fscache_object_slow_work_get_ref(struct slow_work *);
 static void fscache_object_slow_work_execute(struct slow_work *);
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_object_slow_work_desc(struct slow_work *, struct seq_file *);
+#endif
 static void fscache_initialise_object(struct fscache_object *);
 static void fscache_lookup_object(struct fscache_object *);
 static void fscache_object_available(struct fscache_object *);
@@ -45,9 +65,13 @@ static void fscache_enqueue_dependents(struct fscache_object *);
 static void fscache_dequeue_object(struct fscache_object *);
 
 const struct slow_work_ops fscache_object_slow_work_ops = {
+        .owner          = THIS_MODULE,
         .get_ref        = fscache_object_slow_work_get_ref,
         .put_ref        = fscache_object_slow_work_put_ref,
         .execute        = fscache_object_slow_work_execute,
+#ifdef CONFIG_SLOW_WORK_PROC
+        .desc           = fscache_object_slow_work_desc,
+#endif
 };
 EXPORT_SYMBOL(fscache_object_slow_work_ops);
 
@@ -81,6 +105,7 @@ static inline void fscache_done_parent_op(struct fscache_object *object)
 static void fscache_object_state_machine(struct fscache_object *object)
 {
         enum fscache_object_state new_state;
+        struct fscache_cookie *cookie;
 
         ASSERT(object != NULL);
 
@@ -120,20 +145,31 @@ static void fscache_object_state_machine(struct fscache_object *object)
         case FSCACHE_OBJECT_UPDATING:
                 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
                 fscache_stat(&fscache_n_updates_run);
+                fscache_stat(&fscache_n_cop_update_object);
                 object->cache->ops->update_object(object);
+                fscache_stat_d(&fscache_n_cop_update_object);
                 goto active_transit;
 
                 /* handle an object dying during lookup or creation */
         case FSCACHE_OBJECT_LC_DYING:
                 object->event_mask &= ~(1 << FSCACHE_OBJECT_EV_UPDATE);
+                fscache_stat(&fscache_n_cop_lookup_complete);
                 object->cache->ops->lookup_complete(object);
+                fscache_stat_d(&fscache_n_cop_lookup_complete);
 
                 spin_lock(&object->lock);
                 object->state = FSCACHE_OBJECT_DYING;
-                if (test_and_clear_bit(FSCACHE_COOKIE_CREATING,
-                                       &object->cookie->flags))
-                        wake_up_bit(&object->cookie->flags,
-                                    FSCACHE_COOKIE_CREATING);
+                cookie = object->cookie;
+                if (cookie) {
+                        if (test_and_clear_bit(FSCACHE_COOKIE_LOOKING_UP,
+                                               &cookie->flags))
+                                wake_up_bit(&cookie->flags,
+                                            FSCACHE_COOKIE_LOOKING_UP);
+                        if (test_and_clear_bit(FSCACHE_COOKIE_CREATING,
+                                               &cookie->flags))
+                                wake_up_bit(&cookie->flags,
+                                            FSCACHE_COOKIE_CREATING);
+                }
                 spin_unlock(&object->lock);
 
                 fscache_done_parent_op(object);
@@ -165,6 +201,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
                 }
                 spin_unlock(&object->lock);
                 fscache_enqueue_dependents(object);
+                fscache_start_operations(object);
                 goto terminal_transit;
 
                 /* handle an abort during initialisation */
@@ -316,14 +353,29 @@ static void fscache_object_slow_work_execute(struct slow_work *work)
 
         _enter("{OBJ%x}", object->debug_id);
 
-        clear_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
-
         start = jiffies;
         fscache_object_state_machine(object);
         fscache_hist(fscache_objs_histogram, start);
         if (object->events & object->event_mask)
                 fscache_enqueue_object(object);
+        clear_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+}
+
+/*
+ * describe an object for slow-work debugging
+ */
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_object_slow_work_desc(struct slow_work *work,
+                                          struct seq_file *m)
+{
+        struct fscache_object *object =
+                container_of(work, struct fscache_object, work);
+
+        seq_printf(m, "FSC: OBJ%x: %s",
+                   object->debug_id,
+                   fscache_object_states_short[object->state]);
 }
+#endif
 
 /*
  * initialise an object
@@ -376,7 +428,9 @@ static void fscache_initialise_object(struct fscache_object *object)
                          * binding on to us, so we need to make sure we don't
                          * add ourself to the list multiple times */
                         if (list_empty(&object->dep_link)) {
+                                fscache_stat(&fscache_n_cop_grab_object);
                                 object->cache->ops->grab_object(object);
+                                fscache_stat_d(&fscache_n_cop_grab_object);
                                 list_add(&object->dep_link,
                                          &parent->dependents);
 
@@ -414,6 +468,7 @@ static void fscache_lookup_object(struct fscache_object *object)
 {
         struct fscache_cookie *cookie = object->cookie;
         struct fscache_object *parent;
+        int ret;
 
         _enter("");
 
@@ -438,11 +493,20 @@ static void fscache_lookup_object(struct fscache_object *object)
                object->cache->tag->name);
 
         fscache_stat(&fscache_n_object_lookups);
-        object->cache->ops->lookup_object(object);
+        fscache_stat(&fscache_n_cop_lookup_object);
+        ret = object->cache->ops->lookup_object(object);
+        fscache_stat_d(&fscache_n_cop_lookup_object);
 
         if (test_bit(FSCACHE_OBJECT_EV_ERROR, &object->events))
                 set_bit(FSCACHE_COOKIE_UNAVAILABLE, &cookie->flags);
 
+        if (ret == -ETIMEDOUT) {
+                /* probably stuck behind another object, so move this one to
+                 * the back of the queue */
+                fscache_stat(&fscache_n_object_lookups_timed_out);
+                set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+        }
+
         _leave("");
 }
 
@@ -546,7 +610,8 @@ static void fscache_object_available(struct fscache_object *object)
 
         spin_lock(&object->lock);
 
-        if (test_and_clear_bit(FSCACHE_COOKIE_CREATING, &object->cookie->flags))
+        if (object->cookie &&
+            test_and_clear_bit(FSCACHE_COOKIE_CREATING, &object->cookie->flags))
                 wake_up_bit(&object->cookie->flags, FSCACHE_COOKIE_CREATING);
 
         fscache_done_parent_op(object);
@@ -562,7 +627,9 @@ static void fscache_object_available(struct fscache_object *object)
         }
         spin_unlock(&object->lock);
 
+        fscache_stat(&fscache_n_cop_lookup_complete);
         object->cache->ops->lookup_complete(object);
+        fscache_stat_d(&fscache_n_cop_lookup_complete);
         fscache_enqueue_dependents(object);
 
         fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
@@ -581,11 +648,16 @@ static void fscache_drop_object(struct fscache_object *object)
 
         _enter("{OBJ%x,%d}", object->debug_id, object->n_children);
 
+        ASSERTCMP(object->cookie, ==, NULL);
+        ASSERT(hlist_unhashed(&object->cookie_link));
+
         spin_lock(&cache->object_list_lock);
         list_del_init(&object->cache_link);
         spin_unlock(&cache->object_list_lock);
 
+        fscache_stat(&fscache_n_cop_drop_object);
         cache->ops->drop_object(object);
+        fscache_stat_d(&fscache_n_cop_drop_object);
 
         if (parent) {
                 _debug("release parent OBJ%x {%d}",
@@ -600,7 +672,9 @@ static void fscache_drop_object(struct fscache_object *object)
         }
 
         /* this just shifts the object release to the slow work processor */
+        fscache_stat(&fscache_n_cop_put_object);
         object->cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 
         _leave("");
 }
@@ -690,8 +764,12 @@ static int fscache_object_slow_work_get_ref(struct slow_work *work)
 {
         struct fscache_object *object =
                 container_of(work, struct fscache_object, work);
+        int ret;
 
-        return object->cache->ops->grab_object(object) ? 0 : -EAGAIN;
+        fscache_stat(&fscache_n_cop_grab_object);
+        ret = object->cache->ops->grab_object(object) ? 0 : -EAGAIN;
+        fscache_stat_d(&fscache_n_cop_grab_object);
+        return ret;
 }
 
 /*
@@ -702,7 +780,9 @@ static void fscache_object_slow_work_put_ref(struct slow_work *work)
         struct fscache_object *object =
                 container_of(work, struct fscache_object, work);
 
-        return object->cache->ops->put_object(object);
+        fscache_stat(&fscache_n_cop_put_object);
+        object->cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 }
 
 /*
@@ -739,7 +819,9 @@ static void fscache_enqueue_dependents(struct fscache_object *object)
 
                 /* sort onto appropriate lists */
                 fscache_enqueue_object(dep);
+                fscache_stat(&fscache_n_cop_put_object);
                 dep->cache->ops->put_object(dep);
+                fscache_stat_d(&fscache_n_cop_put_object);
 
                 if (!list_empty(&object->dependents))
                         cond_resched_lock(&object->lock);
diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
index e7f8d53b8b6b..313e79a14266 100644
--- a/fs/fscache/operation.c
+++ b/fs/fscache/operation.c
@@ -13,6 +13,7 @@
 
 #define FSCACHE_DEBUG_LEVEL OPERATION
 #include <linux/module.h>
+#include <linux/seq_file.h>
 #include "internal.h"
 
 atomic_t fscache_op_debug_id;
@@ -31,32 +32,33 @@ void fscache_enqueue_operation(struct fscache_operation *op)
         _enter("{OBJ%x OP%x,%u}",
                op->object->debug_id, op->debug_id, atomic_read(&op->usage));
 
+        fscache_set_op_state(op, "EnQ");
+
+        ASSERT(list_empty(&op->pend_link));
         ASSERT(op->processor != NULL);
         ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
         ASSERTCMP(atomic_read(&op->usage), >, 0);
 
-        if (list_empty(&op->pend_link)) {
-                switch (op->flags & FSCACHE_OP_TYPE) {
-                case FSCACHE_OP_FAST:
-                        _debug("queue fast");
-                        atomic_inc(&op->usage);
-                        if (!schedule_work(&op->fast_work))
-                                fscache_put_operation(op);
-                        break;
-                case FSCACHE_OP_SLOW:
-                        _debug("queue slow");
-                        slow_work_enqueue(&op->slow_work);
-                        break;
-                case FSCACHE_OP_MYTHREAD:
-                        _debug("queue for caller's attention");
-                        break;
-                default:
-                        printk(KERN_ERR "FS-Cache: Unexpected op type %lx",
-                               op->flags);
-                        BUG();
-                        break;
-                }
-                fscache_stat(&fscache_n_op_enqueue);
+        fscache_stat(&fscache_n_op_enqueue);
+        switch (op->flags & FSCACHE_OP_TYPE) {
+        case FSCACHE_OP_FAST:
+                _debug("queue fast");
+                atomic_inc(&op->usage);
+                if (!schedule_work(&op->fast_work))
+                        fscache_put_operation(op);
+                break;
+        case FSCACHE_OP_SLOW:
+                _debug("queue slow");
+                slow_work_enqueue(&op->slow_work);
+                break;
+        case FSCACHE_OP_MYTHREAD:
+                _debug("queue for caller's attention");
+                break;
+        default:
+                printk(KERN_ERR "FS-Cache: Unexpected op type %lx",
+                       op->flags);
+                BUG();
+                break;
         }
 }
 EXPORT_SYMBOL(fscache_enqueue_operation);
@@ -67,6 +69,8 @@ EXPORT_SYMBOL(fscache_enqueue_operation);
 static void fscache_run_op(struct fscache_object *object,
                            struct fscache_operation *op)
 {
+        fscache_set_op_state(op, "Run");
+
         object->n_in_progress++;
         if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
                 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
@@ -87,9 +91,12 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
 
         _enter("{OBJ%x OP%x},", object->debug_id, op->debug_id);
 
+        fscache_set_op_state(op, "SubmitX");
+
         spin_lock(&object->lock);
         ASSERTCMP(object->n_ops, >=, object->n_in_progress);
         ASSERTCMP(object->n_ops, >=, object->n_exclusive);
+        ASSERT(list_empty(&op->pend_link));
 
         ret = -ENOBUFS;
         if (fscache_object_is_active(object)) {
@@ -190,9 +197,12 @@ int fscache_submit_op(struct fscache_object *object,
 
         ASSERTCMP(atomic_read(&op->usage), >, 0);
 
+        fscache_set_op_state(op, "Submit");
+
         spin_lock(&object->lock);
         ASSERTCMP(object->n_ops, >=, object->n_in_progress);
         ASSERTCMP(object->n_ops, >=, object->n_exclusive);
+        ASSERT(list_empty(&op->pend_link));
 
         ostate = object->state;
         smp_rmb();
@@ -222,6 +232,11 @@ int fscache_submit_op(struct fscache_object *object,
                 list_add_tail(&op->pend_link, &object->pending_ops);
                 fscache_stat(&fscache_n_op_pend);
                 ret = 0;
+        } else if (object->state == FSCACHE_OBJECT_DYING ||
+                   object->state == FSCACHE_OBJECT_LC_DYING ||
+                   object->state == FSCACHE_OBJECT_WITHDRAWING) {
+                fscache_stat(&fscache_n_op_rejected);
+                ret = -ENOBUFS;
         } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
                 fscache_report_unexpected_submission(object, op, ostate);
                 ASSERT(!fscache_object_is_active(object));
@@ -264,12 +279,7 @@ void fscache_start_operations(struct fscache_object *object)
                         stop = true;
                 }
                 list_del_init(&op->pend_link);
-                object->n_in_progress++;
-
-                if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
-                        wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
-                if (op->processor)
-                        fscache_enqueue_operation(op);
+                fscache_run_op(object, op);
 
                 /* the pending queue was holding a ref on the object */
                 fscache_put_operation(op);
@@ -282,6 +292,36 @@ void fscache_start_operations(struct fscache_object *object)
 }
 
 /*
+ * cancel an operation that's pending on an object
+ */
+int fscache_cancel_op(struct fscache_operation *op)
+{
+        struct fscache_object *object = op->object;
+        int ret;
+
+        _enter("OBJ%x OP%x}", op->object->debug_id, op->debug_id);
+
+        spin_lock(&object->lock);
+
+        ret = -EBUSY;
+        if (!list_empty(&op->pend_link)) {
+                fscache_stat(&fscache_n_op_cancelled);
+                list_del_init(&op->pend_link);
+                object->n_ops--;
+                if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
+                        object->n_exclusive--;
+                if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
+                        wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
+                fscache_put_operation(op);
+                ret = 0;
+        }
+
+        spin_unlock(&object->lock);
+        _leave(" = %d", ret);
+        return ret;
+}
+
+/*
  * release an operation
  * - queues pending ops if this is the last in-progress op
  */
@@ -298,6 +338,8 @@ void fscache_put_operation(struct fscache_operation *op)
         if (!atomic_dec_and_test(&op->usage))
                 return;
 
+        fscache_set_op_state(op, "Put");
+
         _debug("PUT OP");
         if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
                 BUG();
@@ -311,6 +353,9 @@ void fscache_put_operation(struct fscache_operation *op)
 
         object = op->object;
 
+        if (test_bit(FSCACHE_OP_DEC_READ_CNT, &op->flags))
+                atomic_dec(&object->n_reads);
+
         /* now... we may get called with the object spinlock held, so we
          * complete the cleanup here only if we can immediately acquire the
          * lock, and defer it otherwise */
@@ -452,8 +497,27 @@ static void fscache_op_execute(struct slow_work *work)
         _leave("");
 }
 
+/*
+ * describe an operation for slow-work debugging
+ */
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_op_desc(struct slow_work *work, struct seq_file *m)
+{
+        struct fscache_operation *op =
+                container_of(work, struct fscache_operation, slow_work);
+
+        seq_printf(m, "FSC: OBJ%x OP%x: %s/%s fl=%lx",
+                   op->object->debug_id, op->debug_id,
+                   op->name, op->state, op->flags);
+}
+#endif
+
 const struct slow_work_ops fscache_op_slow_work_ops = {
+        .owner          = THIS_MODULE,
         .get_ref        = fscache_op_get_ref,
         .put_ref        = fscache_op_put_ref,
         .execute        = fscache_op_execute,
+#ifdef CONFIG_SLOW_WORK_PROC
+        .desc           = fscache_op_desc,
+#endif
 };
diff --git a/fs/fscache/page.c b/fs/fscache/page.c
index 2568e0eb644f..c598ea4c4e7d 100644
--- a/fs/fscache/page.c
+++ b/fs/fscache/page.c
@@ -43,18 +43,102 @@ void __fscache_wait_on_page_write(struct fscache_cookie *cookie, struct page *pa
 EXPORT_SYMBOL(__fscache_wait_on_page_write);
 
 /*
- * note that a page has finished being written to the cache
+ * decide whether a page can be released, possibly by cancelling a store to it
+ * - we're allowed to sleep if __GFP_WAIT is flagged
  */
-static void fscache_end_page_write(struct fscache_cookie *cookie, struct page *page)
+bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
+                                  struct page *page,
+                                  gfp_t gfp)
 {
         struct page *xpage;
+        void *val;
+
+        _enter("%p,%p,%x", cookie, page, gfp);
+
+        rcu_read_lock();
+        val = radix_tree_lookup(&cookie->stores, page->index);
+        if (!val) {
+                rcu_read_unlock();
+                fscache_stat(&fscache_n_store_vmscan_not_storing);
+                __fscache_uncache_page(cookie, page);
+                return true;
+        }
+
+        /* see if the page is actually undergoing storage - if so we can't get
+         * rid of it till the cache has finished with it */
+        if (radix_tree_tag_get(&cookie->stores, page->index,
+                               FSCACHE_COOKIE_STORING_TAG)) {
+                rcu_read_unlock();
+                goto page_busy;
+        }
+
+        /* the page is pending storage, so we attempt to cancel the store and
+         * discard the store request so that the page can be reclaimed */
+        spin_lock(&cookie->stores_lock);
+        rcu_read_unlock();
+
+        if (radix_tree_tag_get(&cookie->stores, page->index,
+                               FSCACHE_COOKIE_STORING_TAG)) {
+                /* the page started to undergo storage whilst we were looking,
+                 * so now we can only wait or return */
+                spin_unlock(&cookie->stores_lock);
+                goto page_busy;
+        }
 
-        spin_lock(&cookie->lock);
         xpage = radix_tree_delete(&cookie->stores, page->index);
-        spin_unlock(&cookie->lock);
-        ASSERT(xpage != NULL);
+        spin_unlock(&cookie->stores_lock);
+
+        if (xpage) {
+                fscache_stat(&fscache_n_store_vmscan_cancelled);
+                fscache_stat(&fscache_n_store_radix_deletes);
+                ASSERTCMP(xpage, ==, page);
+        } else {
+                fscache_stat(&fscache_n_store_vmscan_gone);
+        }
 
         wake_up_bit(&cookie->flags, 0);
+        if (xpage)
+                page_cache_release(xpage);
+        __fscache_uncache_page(cookie, page);
+        return true;
+
+page_busy:
+        /* we might want to wait here, but that could deadlock the allocator as
+         * the slow-work threads writing to the cache may all end up sleeping
+         * on memory allocation */
+        fscache_stat(&fscache_n_store_vmscan_busy);
+        return false;
+}
+EXPORT_SYMBOL(__fscache_maybe_release_page);
+
+/*
+ * note that a page has finished being written to the cache
+ */
+static void fscache_end_page_write(struct fscache_object *object,
+                                   struct page *page)
+{
+        struct fscache_cookie *cookie;
+        struct page *xpage = NULL;
+
+        spin_lock(&object->lock);
+        cookie = object->cookie;
+        if (cookie) {
+                /* delete the page from the tree if it is now no longer
+                 * pending */
+                spin_lock(&cookie->stores_lock);
+                radix_tree_tag_clear(&cookie->stores, page->index,
+                                     FSCACHE_COOKIE_STORING_TAG);
+                if (!radix_tree_tag_get(&cookie->stores, page->index,
+                                        FSCACHE_COOKIE_PENDING_TAG)) {
+                        fscache_stat(&fscache_n_store_radix_deletes);
+                        xpage = radix_tree_delete(&cookie->stores, page->index);
+                }
+                spin_unlock(&cookie->stores_lock);
+                wake_up_bit(&cookie->flags, 0);
+        }
+        spin_unlock(&object->lock);
+        if (xpage)
+                page_cache_release(xpage);
 }
 
 /*
@@ -63,14 +147,21 @@ static void fscache_end_page_write(struct fscache_cookie *cookie, struct page *p
 static void fscache_attr_changed_op(struct fscache_operation *op)
 {
         struct fscache_object *object = op->object;
+        int ret;
 
         _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
 
         fscache_stat(&fscache_n_attr_changed_calls);
 
-        if (fscache_object_is_active(object) &&
-            object->cache->ops->attr_changed(object) < 0)
-                fscache_abort_object(object);
+        if (fscache_object_is_active(object)) {
+                fscache_set_op_state(op, "CallFS");
+                fscache_stat(&fscache_n_cop_attr_changed);
+                ret = object->cache->ops->attr_changed(object);
+                fscache_stat_d(&fscache_n_cop_attr_changed);
+                fscache_set_op_state(op, "Done");
+                if (ret < 0)
+                        fscache_abort_object(object);
+        }
 
         _leave("");
 }
@@ -99,6 +190,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
         fscache_operation_init(op, NULL);
         fscache_operation_init_slow(op, fscache_attr_changed_op);
         op->flags = FSCACHE_OP_SLOW | (1 << FSCACHE_OP_EXCLUSIVE);
+        fscache_set_op_name(op, "Attr");
 
         spin_lock(&cookie->lock);
 
@@ -184,6 +276,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
         op->start_time  = jiffies;
         INIT_WORK(&op->op.fast_work, fscache_retrieval_work);
         INIT_LIST_HEAD(&op->to_do);
+        fscache_set_op_name(&op->op, "Retr");
         return op;
 }
 
@@ -221,6 +314,43 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
 }
 
 /*
+ * wait for an object to become active (or dead)
+ */
+static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
+                                                 struct fscache_retrieval *op,
+                                                 atomic_t *stat_op_waits,
+                                                 atomic_t *stat_object_dead)
+{
+        int ret;
+
+        if (!test_bit(FSCACHE_OP_WAITING, &op->op.flags))
+                goto check_if_dead;
+
+        _debug(">>> WT");
+        fscache_stat(stat_op_waits);
+        if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
+                        fscache_wait_bit_interruptible,
+                        TASK_INTERRUPTIBLE) < 0) {
+                ret = fscache_cancel_op(&op->op);
+                if (ret == 0)
+                        return -ERESTARTSYS;
+
+                /* it's been removed from the pending queue by another party,
+                 * so we should get to run shortly */
+                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
+                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
+        }
+        _debug("<<< GO");
+
+check_if_dead:
+        if (unlikely(fscache_object_is_dead(object))) {
+                fscache_stat(stat_object_dead);
+                return -ENOBUFS;
+        }
+        return 0;
+}
+
+/*
  * read a page from the cache or allocate a block in which to store it
  * - we return:
  *   -ENOMEM    - out of memory, nothing done
@@ -257,6 +387,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
                 _leave(" = -ENOMEM");
                 return -ENOMEM;
         }
+        fscache_set_op_name(&op->op, "RetrRA1");
 
         spin_lock(&cookie->lock);
 
@@ -267,6 +398,9 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
 
         ASSERTCMP(object->state, >, FSCACHE_OBJECT_LOOKING_UP);
 
+        atomic_inc(&object->n_reads);
+        set_bit(FSCACHE_OP_DEC_READ_CNT, &op->op.flags);
+
         if (fscache_submit_op(object, &op->op) < 0)
                 goto nobufs_unlock;
         spin_unlock(&cookie->lock);
@@ -279,23 +413,27 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
 
         /* we wait for the operation to become active, and then process it
          * *here*, in this thread, and not in the thread pool */
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_retrieval_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_retrieval_op_waits),
+                __fscache_stat(&fscache_n_retrievals_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
         if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags)) {
+                fscache_stat(&fscache_n_cop_allocate_page);
                 ret = object->cache->ops->allocate_page(op, page, gfp);
+                fscache_stat_d(&fscache_n_cop_allocate_page);
                 if (ret == 0)
                         ret = -ENODATA;
         } else {
+                fscache_stat(&fscache_n_cop_read_or_alloc_page);
                 ret = object->cache->ops->read_or_alloc_page(op, page, gfp);
+                fscache_stat_d(&fscache_n_cop_read_or_alloc_page);
         }
 
+error:
         if (ret == -ENOMEM)
                 fscache_stat(&fscache_n_retrievals_nomem);
         else if (ret == -ERESTARTSYS)
@@ -347,7 +485,6 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
                                   void *context,
                                   gfp_t gfp)
 {
-        fscache_pages_retrieval_func_t func;
         struct fscache_retrieval *op;
         struct fscache_object *object;
         int ret;
@@ -369,6 +506,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
         op = fscache_alloc_retrieval(mapping, end_io_func, context);
         if (!op)
                 return -ENOMEM;
+        fscache_set_op_name(&op->op, "RetrRAN");
 
         spin_lock(&cookie->lock);
 
@@ -377,6 +515,9 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
         object = hlist_entry(cookie->backing_objects.first,
                              struct fscache_object, cookie_link);
 
+        atomic_inc(&object->n_reads);
+        set_bit(FSCACHE_OP_DEC_READ_CNT, &op->op.flags);
+
         if (fscache_submit_op(object, &op->op) < 0)
                 goto nobufs_unlock;
         spin_unlock(&cookie->lock);
@@ -389,21 +530,27 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
 
         /* we wait for the operation to become active, and then process it
          * *here*, in this thread, and not in the thread pool */
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_retrieval_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_retrieval_op_waits),
+                __fscache_stat(&fscache_n_retrievals_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
-        if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags))
-                func = object->cache->ops->allocate_pages;
-        else
-                func = object->cache->ops->read_or_alloc_pages;
-        ret = func(op, pages, nr_pages, gfp);
+        if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags)) {
+                fscache_stat(&fscache_n_cop_allocate_pages);
+                ret = object->cache->ops->allocate_pages(
+                        op, pages, nr_pages, gfp);
+                fscache_stat_d(&fscache_n_cop_allocate_pages);
+        } else {
+                fscache_stat(&fscache_n_cop_read_or_alloc_pages);
+                ret = object->cache->ops->read_or_alloc_pages(
+                        op, pages, nr_pages, gfp);
+                fscache_stat_d(&fscache_n_cop_read_or_alloc_pages);
+        }
 
+error:
         if (ret == -ENOMEM)
                 fscache_stat(&fscache_n_retrievals_nomem);
         else if (ret == -ERESTARTSYS)
@@ -461,6 +608,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
         op = fscache_alloc_retrieval(page->mapping, NULL, NULL);
         if (!op)
                 return -ENOMEM;
+        fscache_set_op_name(&op->op, "RetrAL1");
 
         spin_lock(&cookie->lock);
 
@@ -475,18 +623,22 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
 
         fscache_stat(&fscache_n_alloc_ops);
 
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_alloc_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_alloc_op_waits),
+                __fscache_stat(&fscache_n_allocs_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
+        fscache_stat(&fscache_n_cop_allocate_page);
         ret = object->cache->ops->allocate_page(op, page, gfp);
+        fscache_stat_d(&fscache_n_cop_allocate_page);
 
-        if (ret < 0)
+error:
+        if (ret == -ERESTARTSYS)
+                fscache_stat(&fscache_n_allocs_intr);
+        else if (ret < 0)
                 fscache_stat(&fscache_n_allocs_nobufs);
         else
                 fscache_stat(&fscache_n_allocs_ok);
@@ -521,7 +673,7 @@ static void fscache_write_op(struct fscache_operation *_op)
         struct fscache_storage *op =
                 container_of(_op, struct fscache_storage, op);
         struct fscache_object *object = op->op.object;
-        struct fscache_cookie *cookie = object->cookie;
+        struct fscache_cookie *cookie;
         struct page *page;
         unsigned n;
         void *results[1];
@@ -529,16 +681,19 @@ static void fscache_write_op(struct fscache_operation *_op)
 
         _enter("{OP%x,%d}", op->op.debug_id, atomic_read(&op->op.usage));
 
-        spin_lock(&cookie->lock);
+        fscache_set_op_state(&op->op, "GetPage");
+
         spin_lock(&object->lock);
+        cookie = object->cookie;
 
-        if (!fscache_object_is_active(object)) {
+        if (!fscache_object_is_active(object) || !cookie) {
                 spin_unlock(&object->lock);
-                spin_unlock(&cookie->lock);
                 _leave("");
                 return;
         }
 
+        spin_lock(&cookie->stores_lock);
+
         fscache_stat(&fscache_n_store_calls);
 
         /* find a page to store */
@@ -549,23 +704,35 @@ static void fscache_write_op(struct fscache_operation *_op)
                 goto superseded;
         page = results[0];
         _debug("gang %d [%lx]", n, page->index);
-        if (page->index > op->store_limit)
+        if (page->index > op->store_limit) {
+                fscache_stat(&fscache_n_store_pages_over_limit);
                 goto superseded;
+        }
 
-        radix_tree_tag_clear(&cookie->stores, page->index,
-                             FSCACHE_COOKIE_PENDING_TAG);
+        if (page) {
+                radix_tree_tag_set(&cookie->stores, page->index,
+                                   FSCACHE_COOKIE_STORING_TAG);
+                radix_tree_tag_clear(&cookie->stores, page->index,
+                                     FSCACHE_COOKIE_PENDING_TAG);
+        }
 
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
-        spin_unlock(&cookie->lock);
 
         if (page) {
+                fscache_set_op_state(&op->op, "Store");
+                fscache_stat(&fscache_n_store_pages);
+                fscache_stat(&fscache_n_cop_write_page);
                 ret = object->cache->ops->write_page(op, page);
-                fscache_end_page_write(cookie, page);
-                page_cache_release(page);
-                if (ret < 0)
+                fscache_stat_d(&fscache_n_cop_write_page);
+                fscache_set_op_state(&op->op, "EndWrite");
+                fscache_end_page_write(object, page);
+                if (ret < 0) {
+                        fscache_set_op_state(&op->op, "Abort");
                         fscache_abort_object(object);
-                else
+                } else {
                         fscache_enqueue_operation(&op->op);
+                }
         }
 
         _leave("");
@@ -575,9 +742,9 @@ superseded:
         /* this writer is going away and there aren't any more things to
          * write */
         _debug("cease");
+        spin_unlock(&cookie->stores_lock);
         clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags);
         spin_unlock(&object->lock);
-        spin_unlock(&cookie->lock);
         _leave("");
 }
 
@@ -634,6 +801,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         fscache_operation_init(&op->op, fscache_release_write_op);
         fscache_operation_init_slow(&op->op, fscache_write_op);
         op->op.flags = FSCACHE_OP_SLOW | (1 << FSCACHE_OP_WAITING);
+        fscache_set_op_name(&op->op, "Write1");
 
         ret = radix_tree_preload(gfp & ~__GFP_HIGHMEM);
         if (ret < 0)
@@ -652,6 +820,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         /* add the page to the pending-storage radix tree on the backing
          * object */
         spin_lock(&object->lock);
+        spin_lock(&cookie->stores_lock);
 
         _debug("store limit %llx", (unsigned long long) object->store_limit);
 
@@ -672,6 +841,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         if (test_and_set_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags))
                 goto already_pending;
 
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
 
         op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
@@ -693,6 +863,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
 already_queued:
         fscache_stat(&fscache_n_stores_again);
 already_pending:
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
         spin_unlock(&cookie->lock);
         radix_tree_preload_end();
@@ -702,7 +873,9 @@ already_pending:
         return 0;
 
 submit_failed:
+        spin_lock(&cookie->stores_lock);
         radix_tree_delete(&cookie->stores, page->index);
+        spin_unlock(&cookie->stores_lock);
         page_cache_release(page);
         ret = -ENOBUFS;
         goto nobufs;
@@ -763,7 +936,9 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
         if (TestClearPageFsCache(page) &&
             object->cache->ops->uncache_page) {
                 /* the cache backend releases the cookie lock */
+                fscache_stat(&fscache_n_cop_uncache_page);
                 object->cache->ops->uncache_page(object, page);
+                fscache_stat_d(&fscache_n_cop_uncache_page);
                 goto done;
         }
 
diff --git a/fs/fscache/proc.c b/fs/fscache/proc.c
index beeab44bc31a..1d9e4951a597 100644
--- a/fs/fscache/proc.c
+++ b/fs/fscache/proc.c
@@ -37,10 +37,20 @@ int __init fscache_proc_init(void)
                 goto error_histogram;
 #endif
 
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        if (!proc_create("fs/fscache/objects", S_IFREG | 0444, NULL,
+                         &fscache_objlist_fops))
+                goto error_objects;
+#endif
+
         _leave(" = 0");
         return 0;
 
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+error_objects:
+#endif
 #ifdef CONFIG_FSCACHE_HISTOGRAM
+        remove_proc_entry("fs/fscache/histogram", NULL);
 error_histogram:
 #endif
 #ifdef CONFIG_FSCACHE_STATS
@@ -58,6 +68,9 @@ error_dir:
  */
 void fscache_proc_cleanup(void)
 {
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        remove_proc_entry("fs/fscache/objects", NULL);
+#endif
 #ifdef CONFIG_FSCACHE_HISTOGRAM
         remove_proc_entry("fs/fscache/histogram", NULL);
 #endif
diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
index 65deb99e756b..46435f3aae68 100644
--- a/fs/fscache/stats.c
+++ b/fs/fscache/stats.c
@@ -25,6 +25,8 @@ atomic_t fscache_n_op_requeue;
 atomic_t fscache_n_op_deferred_release;
 atomic_t fscache_n_op_release;
 atomic_t fscache_n_op_gc;
+atomic_t fscache_n_op_cancelled;
+atomic_t fscache_n_op_rejected;
 
 atomic_t fscache_n_attr_changed;
 atomic_t fscache_n_attr_changed_ok;
@@ -36,6 +38,8 @@ atomic_t fscache_n_allocs;
 atomic_t fscache_n_allocs_ok;
 atomic_t fscache_n_allocs_wait;
 atomic_t fscache_n_allocs_nobufs;
+atomic_t fscache_n_allocs_intr;
+atomic_t fscache_n_allocs_object_dead;
 atomic_t fscache_n_alloc_ops;
 atomic_t fscache_n_alloc_op_waits;
 
@@ -46,6 +50,7 @@ atomic_t fscache_n_retrievals_nodata;
 atomic_t fscache_n_retrievals_nobufs;
 atomic_t fscache_n_retrievals_intr;
 atomic_t fscache_n_retrievals_nomem;
+atomic_t fscache_n_retrievals_object_dead;
 atomic_t fscache_n_retrieval_ops;
 atomic_t fscache_n_retrieval_op_waits;
 
@@ -56,6 +61,14 @@ atomic_t fscache_n_stores_nobufs;
 atomic_t fscache_n_stores_oom;
 atomic_t fscache_n_store_ops;
 atomic_t fscache_n_store_calls;
+atomic_t fscache_n_store_pages;
+atomic_t fscache_n_store_radix_deletes;
+atomic_t fscache_n_store_pages_over_limit;
+
+atomic_t fscache_n_store_vmscan_not_storing;
+atomic_t fscache_n_store_vmscan_gone;
+atomic_t fscache_n_store_vmscan_busy;
+atomic_t fscache_n_store_vmscan_cancelled;
 
 atomic_t fscache_n_marks;
 atomic_t fscache_n_uncaches;
@@ -74,6 +87,7 @@ atomic_t fscache_n_updates_run;
 atomic_t fscache_n_relinquishes;
 atomic_t fscache_n_relinquishes_null;
 atomic_t fscache_n_relinquishes_waitcrt;
+atomic_t fscache_n_relinquishes_retire;
 
 atomic_t fscache_n_cookie_index;
 atomic_t fscache_n_cookie_data;
@@ -84,6 +98,7 @@ atomic_t fscache_n_object_no_alloc;
 atomic_t fscache_n_object_lookups;
 atomic_t fscache_n_object_lookups_negative;
 atomic_t fscache_n_object_lookups_positive;
+atomic_t fscache_n_object_lookups_timed_out;
 atomic_t fscache_n_object_created;
 atomic_t fscache_n_object_avail;
 atomic_t fscache_n_object_dead;
@@ -93,6 +108,23 @@ atomic_t fscache_n_checkaux_okay;
 atomic_t fscache_n_checkaux_update;
 atomic_t fscache_n_checkaux_obsolete;
 
+atomic_t fscache_n_cop_alloc_object;
+atomic_t fscache_n_cop_lookup_object;
+atomic_t fscache_n_cop_lookup_complete;
+atomic_t fscache_n_cop_grab_object;
+atomic_t fscache_n_cop_update_object;
+atomic_t fscache_n_cop_drop_object;
+atomic_t fscache_n_cop_put_object;
+atomic_t fscache_n_cop_sync_cache;
+atomic_t fscache_n_cop_attr_changed;
+atomic_t fscache_n_cop_read_or_alloc_page;
+atomic_t fscache_n_cop_read_or_alloc_pages;
+atomic_t fscache_n_cop_allocate_page;
+atomic_t fscache_n_cop_allocate_pages;
+atomic_t fscache_n_cop_write_page;
+atomic_t fscache_n_cop_uncache_page;
+atomic_t fscache_n_cop_dissociate_pages;
+
 /*
  * display the general statistics
  */
@@ -129,10 +161,11 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_acquires_nobufs),
                    atomic_read(&fscache_n_acquires_oom));
 
-        seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u\n",
+        seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
                    atomic_read(&fscache_n_object_lookups),
                    atomic_read(&fscache_n_object_lookups_negative),
                    atomic_read(&fscache_n_object_lookups_positive),
+                   atomic_read(&fscache_n_object_lookups_timed_out),
                    atomic_read(&fscache_n_object_created));
 
         seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
@@ -140,10 +173,11 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_updates_null),
                    atomic_read(&fscache_n_updates_run));
 
-        seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u\n",
+        seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
                    atomic_read(&fscache_n_relinquishes),
                    atomic_read(&fscache_n_relinquishes_null),
-                   atomic_read(&fscache_n_relinquishes_waitcrt));
+                   atomic_read(&fscache_n_relinquishes_waitcrt),
+                   atomic_read(&fscache_n_relinquishes_retire));
 
         seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
                    atomic_read(&fscache_n_attr_changed),
@@ -152,14 +186,16 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_attr_changed_nomem),
                    atomic_read(&fscache_n_attr_changed_calls));
 
-        seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u\n",
+        seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
                    atomic_read(&fscache_n_allocs),
                    atomic_read(&fscache_n_allocs_ok),
                    atomic_read(&fscache_n_allocs_wait),
-                   atomic_read(&fscache_n_allocs_nobufs));
-        seq_printf(m, "Allocs : ops=%u owt=%u\n",
+                   atomic_read(&fscache_n_allocs_nobufs),
+                   atomic_read(&fscache_n_allocs_intr));
+        seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
                    atomic_read(&fscache_n_alloc_ops),
-                   atomic_read(&fscache_n_alloc_op_waits));
+                   atomic_read(&fscache_n_alloc_op_waits),
+                   atomic_read(&fscache_n_allocs_object_dead));
 
         seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
                    " int=%u oom=%u\n",
@@ -170,9 +206,10 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_retrievals_nobufs),
                    atomic_read(&fscache_n_retrievals_intr),
                    atomic_read(&fscache_n_retrievals_nomem));
-        seq_printf(m, "Retrvls: ops=%u owt=%u\n",
+        seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
                    atomic_read(&fscache_n_retrieval_ops),
-                   atomic_read(&fscache_n_retrieval_op_waits));
+                   atomic_read(&fscache_n_retrieval_op_waits),
+                   atomic_read(&fscache_n_retrievals_object_dead));
 
         seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
                    atomic_read(&fscache_n_stores),
@@ -180,18 +217,49 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_stores_again),
                    atomic_read(&fscache_n_stores_nobufs),
                    atomic_read(&fscache_n_stores_oom));
-        seq_printf(m, "Stores : ops=%u run=%u\n",
+        seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
                    atomic_read(&fscache_n_store_ops),
-                   atomic_read(&fscache_n_store_calls));
+                   atomic_read(&fscache_n_store_calls),
+                   atomic_read(&fscache_n_store_pages),
+                   atomic_read(&fscache_n_store_radix_deletes),
+                   atomic_read(&fscache_n_store_pages_over_limit));
 
-        seq_printf(m, "Ops    : pend=%u run=%u enq=%u\n",
+        seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
+                   atomic_read(&fscache_n_store_vmscan_not_storing),
+                   atomic_read(&fscache_n_store_vmscan_gone),
+                   atomic_read(&fscache_n_store_vmscan_busy),
+                   atomic_read(&fscache_n_store_vmscan_cancelled));
+
+        seq_printf(m, "Ops    : pend=%u run=%u enq=%u can=%u rej=%u\n",
                    atomic_read(&fscache_n_op_pend),
                    atomic_read(&fscache_n_op_run),
-                   atomic_read(&fscache_n_op_enqueue));
+                   atomic_read(&fscache_n_op_enqueue),
+                   atomic_read(&fscache_n_op_cancelled),
+                   atomic_read(&fscache_n_op_rejected));
         seq_printf(m, "Ops    : dfr=%u rel=%u gc=%u\n",
                    atomic_read(&fscache_n_op_deferred_release),
                    atomic_read(&fscache_n_op_release),
                    atomic_read(&fscache_n_op_gc));
+
+        seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
+                   atomic_read(&fscache_n_cop_alloc_object),
+                   atomic_read(&fscache_n_cop_lookup_object),
+                   atomic_read(&fscache_n_cop_lookup_complete),
+                   atomic_read(&fscache_n_cop_grab_object));
+        seq_printf(m, "CacheOp: upo=%d dro=%d pto=%d atc=%d syn=%d\n",
+                   atomic_read(&fscache_n_cop_update_object),
+                   atomic_read(&fscache_n_cop_drop_object),
+                   atomic_read(&fscache_n_cop_put_object),
+                   atomic_read(&fscache_n_cop_attr_changed),
+                   atomic_read(&fscache_n_cop_sync_cache));
+        seq_printf(m, "CacheOp: rap=%d ras=%d alp=%d als=%d wrp=%d ucp=%d dsp=%d\n",
+                   atomic_read(&fscache_n_cop_read_or_alloc_page),
+                   atomic_read(&fscache_n_cop_read_or_alloc_pages),
+                   atomic_read(&fscache_n_cop_allocate_page),
+                   atomic_read(&fscache_n_cop_allocate_pages),
+                   atomic_read(&fscache_n_cop_write_page),
+                   atomic_read(&fscache_n_cop_uncache_page),
+                   atomic_read(&fscache_n_cop_dissociate_pages));
         return 0;
 }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 992f6c9410bb..4787ae6c5c1c 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -385,6 +385,9 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         if (fc->no_create)
                 return -ENOSYS;
 
+        if (flags & O_DIRECT)
+                return -EINVAL;
+
         forget_req = fuse_get_req(fc);
         if (IS_ERR(forget_req))
                 return PTR_ERR(forget_req);
@@ -712,8 +715,10 @@ static int fuse_rename(struct inode *olddir, struct dentry *oldent,
                         fuse_invalidate_attr(newdir);
 
                 /* newent will end up negative */
-                if (newent->d_inode)
+                if (newent->d_inode) {
+                        fuse_invalidate_attr(newent->d_inode);
                         fuse_invalidate_entry_cache(newent);
+                }
         } else if (err == -EINTR) {
                 /* If request was interrupted, DEITY only knows if the
                    rename actually took place.  If the invalidation
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index a3492f7d207c..c18913a777ae 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1063,7 +1063,8 @@ ssize_t fuse_direct_io(struct file *file, const char __user *buf,
                                 break;
                 }
         }
-        fuse_put_request(fc, req);
+        if (!IS_ERR(req))
+                fuse_put_request(fc, req);
         if (res > 0)
                 *ppos = pos;
 
@@ -1599,7 +1600,7 @@ static int fuse_ioctl_copy_user(struct page **pages, struct iovec *iov,
                         kaddr += copy;
                 }
 
-                kunmap(map);
+                kunmap(page);
         }
 
         return 0;
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index eacd78a5d082..5b31f7741a8f 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -114,7 +114,7 @@ static int __init init_gfs2_fs(void)
         if (error)
                 goto fail_unregister;
 
-        error = slow_work_register_user();
+        error = slow_work_register_user(THIS_MODULE);
         if (error)
                 goto fail_slow;
 
@@ -163,7 +163,7 @@ static void __exit exit_gfs2_fs(void)
         gfs2_unregister_debugfs();
         unregister_filesystem(&gfs2_fs_type);
         unregister_filesystem(&gfs2meta_fs_type);
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
 
         kmem_cache_destroy(gfs2_quotad_cachep);
         kmem_cache_destroy(gfs2_rgrpd_cachep);
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index 59d2695509d3..09fa31965576 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -7,6 +7,7 @@
  * of the GNU General Public License version 2.
  */
 
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
@@ -593,6 +594,7 @@ fail:
 }
 
 struct slow_work_ops gfs2_recover_ops = {
+        .owner   = THIS_MODULE,
         .get_ref = gfs2_recover_get_ref,
         .put_ref = gfs2_recover_put_ref,
         .execute = gfs2_recover_work,
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 9b9d6395bad3..052f214ea6f0 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -58,6 +58,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         }
         unlock_new_inode(tree->inode);
 
+        if (!HFS_I(tree->inode)->first_blocks) {
+                printk(KERN_ERR "hfs: invalid btree extent records (0 size).\n");
+                goto free_inode;
+        }
+
         mapping = tree->inode->i_mapping;
         page = read_mapping_page(mapping, 0, NULL);
         if (IS_ERR(page))
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 175d08eacc86..bed78ac8f6d1 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -99,6 +99,10 @@ int hfsplus_read_wrapper(struct super_block *sb)
 
         if (hfsplus_get_last_session(sb, &part_start, &part_size))
                 return -EINVAL;
+        if ((u64)part_start + part_size > 0x100000000ULL) {
+                pr_err("hfs: volumes larger than 2TB are not supported yet\n");
+                return -EINVAL;
+        }
         while (1) {
                 bh = sb_bread512(sb, part_start + HFSPLUS_VOLHEAD_SECTOR, vhdr);
                 if (!bh)
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 7b17a14396ff..6c751106c2e5 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -254,7 +254,7 @@ int __generic_block_fiemap(struct inode *inode,
                            u64 len, get_block_t *get_block)
 {
         struct buffer_head tmp;
-        unsigned int start_blk;
+        unsigned long long start_blk;
         long long length = 0, map_len = 0;
         u64 logical = 0, phys = 0, size = 0;
         u32 flags = FIEMAP_EXTENT_MERGED;
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index bd3c073b485d..4160afad6d00 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -73,6 +73,7 @@ EXPORT_SYMBOL(journal_errno);
 EXPORT_SYMBOL(journal_ack_err);
 EXPORT_SYMBOL(journal_clear_err);
 EXPORT_SYMBOL(log_wait_commit);
+EXPORT_SYMBOL(log_start_commit);
 EXPORT_SYMBOL(journal_start_commit);
 EXPORT_SYMBOL(journal_force_commit_nested);
 EXPORT_SYMBOL(journal_wipe);
@@ -756,6 +757,7 @@ journal_t * journal_init_dev(struct block_device *bdev,
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         kfree(journal);
         return NULL;
 }
@@ -820,6 +822,7 @@ journal_t * journal_init_inode (struct inode *inode)
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         kfree(journal);
         return NULL;
 }
diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
index 5d70b3e6d49b..ca0f5eb62b20 100644
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -643,6 +643,7 @@ out:
 
 int __jbd2_journal_remove_checkpoint(struct journal_head *jh)
 {
+        struct transaction_chp_stats_s *stats;
         transaction_t *transaction;
         journal_t *journal;
         int ret = 0;
@@ -679,6 +680,12 @@ int __jbd2_journal_remove_checkpoint(struct journal_head *jh)
 
         /* OK, that was the last buffer for the transaction: we can now
            safely remove this transaction from the log */
+        stats = &transaction->t_chp_stats;
+        if (stats->cs_chp_time)
+                stats->cs_chp_time = jbd2_time_diff(stats->cs_chp_time,
+                                                    jiffies);
+        trace_jbd2_checkpoint_stats(journal->j_fs_dev->bd_dev,
+                                    transaction->t_tid, stats);
 
         __jbd2_journal_drop_transaction(journal, transaction);
         kfree(transaction);
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 26d991ddc1e6..d4cfd6d2779e 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -410,10 +410,10 @@ void jbd2_journal_commit_transaction(journal_t *journal)
         if (commit_transaction->t_synchronous_commit)
                 write_op = WRITE_SYNC_PLUG;
         trace_jbd2_commit_locking(journal, commit_transaction);
-        stats.u.run.rs_wait = commit_transaction->t_max_wait;
-        stats.u.run.rs_locked = jiffies;
-        stats.u.run.rs_running = jbd2_time_diff(commit_transaction->t_start,
-                                                stats.u.run.rs_locked);
+        stats.run.rs_wait = commit_transaction->t_max_wait;
+        stats.run.rs_locked = jiffies;
+        stats.run.rs_running = jbd2_time_diff(commit_transaction->t_start,
+                                              stats.run.rs_locked);
 
         spin_lock(&commit_transaction->t_handle_lock);
         while (commit_transaction->t_updates) {
@@ -486,9 +486,9 @@ void jbd2_journal_commit_transaction(journal_t *journal)
         jbd2_journal_switch_revoke_table(journal);
 
         trace_jbd2_commit_flushing(journal, commit_transaction);
-        stats.u.run.rs_flushing = jiffies;
-        stats.u.run.rs_locked = jbd2_time_diff(stats.u.run.rs_locked,
-                                               stats.u.run.rs_flushing);
+        stats.run.rs_flushing = jiffies;
+        stats.run.rs_locked = jbd2_time_diff(stats.run.rs_locked,
+                                             stats.run.rs_flushing);
 
         commit_transaction->t_state = T_FLUSH;
         journal->j_committing_transaction = commit_transaction;
@@ -523,11 +523,11 @@ void jbd2_journal_commit_transaction(journal_t *journal)
         spin_unlock(&journal->j_state_lock);
 
         trace_jbd2_commit_logging(journal, commit_transaction);
-        stats.u.run.rs_logging = jiffies;
-        stats.u.run.rs_flushing = jbd2_time_diff(stats.u.run.rs_flushing,
-                                                 stats.u.run.rs_logging);
-        stats.u.run.rs_blocks = commit_transaction->t_outstanding_credits;
-        stats.u.run.rs_blocks_logged = 0;
+        stats.run.rs_logging = jiffies;
+        stats.run.rs_flushing = jbd2_time_diff(stats.run.rs_flushing,
+                                               stats.run.rs_logging);
+        stats.run.rs_blocks = commit_transaction->t_outstanding_credits;
+        stats.run.rs_blocks_logged = 0;
 
         J_ASSERT(commit_transaction->t_nr_buffers <=
                  commit_transaction->t_outstanding_credits);
@@ -695,7 +695,7 @@ start_journal_io:
                                 submit_bh(write_op, bh);
                         }
                         cond_resched();
-                        stats.u.run.rs_blocks_logged += bufs;
+                        stats.run.rs_blocks_logged += bufs;
 
                         /* Force a new descriptor to be generated next
                            time round the loop. */
@@ -988,33 +988,30 @@ restart_loop:
         J_ASSERT(commit_transaction->t_state == T_COMMIT);
 
         commit_transaction->t_start = jiffies;
-        stats.u.run.rs_logging = jbd2_time_diff(stats.u.run.rs_logging,
-                                                commit_transaction->t_start);
+        stats.run.rs_logging = jbd2_time_diff(stats.run.rs_logging,
+                                              commit_transaction->t_start);
 
         /*
-         * File the transaction for history
+         * File the transaction statistics
          */
-        stats.ts_type = JBD2_STATS_RUN;
         stats.ts_tid = commit_transaction->t_tid;
-        stats.u.run.rs_handle_count = commit_transaction->t_handle_count;
-        spin_lock(&journal->j_history_lock);
-        memcpy(journal->j_history + journal->j_history_cur, &stats,
-                        sizeof(stats));
-        if (++journal->j_history_cur == journal->j_history_max)
-                journal->j_history_cur = 0;
+        stats.run.rs_handle_count = commit_transaction->t_handle_count;
+        trace_jbd2_run_stats(journal->j_fs_dev->bd_dev,
+                             commit_transaction->t_tid, &stats.run);
 
         /*
          * Calculate overall stats
          */
+        spin_lock(&journal->j_history_lock);
         journal->j_stats.ts_tid++;
-        journal->j_stats.u.run.rs_wait += stats.u.run.rs_wait;
-        journal->j_stats.u.run.rs_running += stats.u.run.rs_running;
-        journal->j_stats.u.run.rs_locked += stats.u.run.rs_locked;
-        journal->j_stats.u.run.rs_flushing += stats.u.run.rs_flushing;
-        journal->j_stats.u.run.rs_logging += stats.u.run.rs_logging;
-        journal->j_stats.u.run.rs_handle_count += stats.u.run.rs_handle_count;
-        journal->j_stats.u.run.rs_blocks += stats.u.run.rs_blocks;
-        journal->j_stats.u.run.rs_blocks_logged += stats.u.run.rs_blocks_logged;
+        journal->j_stats.run.rs_wait += stats.run.rs_wait;
+        journal->j_stats.run.rs_running += stats.run.rs_running;
+        journal->j_stats.run.rs_locked += stats.run.rs_locked;
+        journal->j_stats.run.rs_flushing += stats.run.rs_flushing;
+        journal->j_stats.run.rs_logging += stats.run.rs_logging;
+        journal->j_stats.run.rs_handle_count += stats.run.rs_handle_count;
+        journal->j_stats.run.rs_blocks += stats.run.rs_blocks;
+        journal->j_stats.run.rs_blocks_logged += stats.run.rs_blocks_logged;
         spin_unlock(&journal->j_history_lock);
 
         commit_transaction->t_state = T_FINISHED;
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 53b86e16e5fe..fed85388ee86 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -136,10 +136,6 @@ static int kjournald2(void *arg)
         journal->j_task = current;
         wake_up(&journal->j_wait_done_commit);
 
-        printk(KERN_INFO "kjournald2 starting: pid %d, dev %s, "
-               "commit interval %ld seconds\n", current->pid,
-               journal->j_devname, journal->j_commit_interval / HZ);
-
         /*
          * And now, wait forever for commit wakeup events.
          */
@@ -223,7 +219,8 @@ static int jbd2_journal_start_thread(journal_t *journal)
 {
         struct task_struct *t;
 
-        t = kthread_run(kjournald2, journal, "kjournald2");
+        t = kthread_run(kjournald2, journal, "jbd2/%s",
+                        journal->j_devname);
         if (IS_ERR(t))
                 return PTR_ERR(t);
 
@@ -679,153 +676,6 @@ struct jbd2_stats_proc_session {
         int max;
 };
 
-static void *jbd2_history_skip_empty(struct jbd2_stats_proc_session *s,
-                                        struct transaction_stats_s *ts,
-                                        int first)
-{
-        if (ts == s->stats + s->max)
-                ts = s->stats;
-        if (!first && ts == s->stats + s->start)
-                return NULL;
-        while (ts->ts_type == 0) {
-                ts++;
-                if (ts == s->stats + s->max)
-                        ts = s->stats;
-                if (ts == s->stats + s->start)
-                        return NULL;
-        }
-        return ts;
-
-}
-
-static void *jbd2_seq_history_start(struct seq_file *seq, loff_t *pos)
-{
-        struct jbd2_stats_proc_session *s = seq->private;
-        struct transaction_stats_s *ts;
-        int l = *pos;
-
-        if (l == 0)
-                return SEQ_START_TOKEN;
-        ts = jbd2_history_skip_empty(s, s->stats + s->start, 1);
-        if (!ts)
-                return NULL;
-        l--;
-        while (l) {
-                ts = jbd2_history_skip_empty(s, ++ts, 0);
-                if (!ts)
-                        break;
-                l--;
-        }
-        return ts;
-}
-
-static void *jbd2_seq_history_next(struct seq_file *seq, void *v, loff_t *pos)
-{
-        struct jbd2_stats_proc_session *s = seq->private;
-        struct transaction_stats_s *ts = v;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN)
-                return jbd2_history_skip_empty(s, s->stats + s->start, 1);
-        else
-                return jbd2_history_skip_empty(s, ++ts, 0);
-}
-
-static int jbd2_seq_history_show(struct seq_file *seq, void *v)
-{
-        struct transaction_stats_s *ts = v;
-        if (v == SEQ_START_TOKEN) {
-                seq_printf(seq, "%-4s %-5s %-5s %-5s %-5s %-5s %-5s %-6s %-5s "
-                                "%-5s %-5s %-5s %-5s %-5s\n", "R/C", "tid",
-                                "wait", "run", "lock", "flush", "log", "hndls",
-                                "block", "inlog", "ctime", "write", "drop",
-                                "close");
-                return 0;
-        }
-        if (ts->ts_type == JBD2_STATS_RUN)
-                seq_printf(seq, "%-4s %-5lu %-5u %-5u %-5u %-5u %-5u "
-                                "%-6lu %-5lu %-5lu\n", "R", ts->ts_tid,
-                                jiffies_to_msecs(ts->u.run.rs_wait),
-                                jiffies_to_msecs(ts->u.run.rs_running),
-                                jiffies_to_msecs(ts->u.run.rs_locked),
-                                jiffies_to_msecs(ts->u.run.rs_flushing),
-                                jiffies_to_msecs(ts->u.run.rs_logging),
-                                ts->u.run.rs_handle_count,
-                                ts->u.run.rs_blocks,
-                                ts->u.run.rs_blocks_logged);
-        else if (ts->ts_type == JBD2_STATS_CHECKPOINT)
-                seq_printf(seq, "%-4s %-5lu %48s %-5u %-5lu %-5lu %-5lu\n",
-                                "C", ts->ts_tid, " ",
-                                jiffies_to_msecs(ts->u.chp.cs_chp_time),
-                                ts->u.chp.cs_written, ts->u.chp.cs_dropped,
-                                ts->u.chp.cs_forced_to_close);
-        else
-                J_ASSERT(0);
-        return 0;
-}
-
-static void jbd2_seq_history_stop(struct seq_file *seq, void *v)
-{
-}
-
-static const struct seq_operations jbd2_seq_history_ops = {
-        .start  = jbd2_seq_history_start,
-        .next   = jbd2_seq_history_next,
-        .stop   = jbd2_seq_history_stop,
-        .show   = jbd2_seq_history_show,
-};
-
-static int jbd2_seq_history_open(struct inode *inode, struct file *file)
-{
-        journal_t *journal = PDE(inode)->data;
-        struct jbd2_stats_proc_session *s;
-        int rc, size;
-
-        s = kmalloc(sizeof(*s), GFP_KERNEL);
-        if (s == NULL)
-                return -ENOMEM;
-        size = sizeof(struct transaction_stats_s) * journal->j_history_max;
-        s->stats = kmalloc(size, GFP_KERNEL);
-        if (s->stats == NULL) {
-                kfree(s);
-                return -ENOMEM;
-        }
-        spin_lock(&journal->j_history_lock);
-        memcpy(s->stats, journal->j_history, size);
-        s->max = journal->j_history_max;
-        s->start = journal->j_history_cur % s->max;
-        spin_unlock(&journal->j_history_lock);
-
-        rc = seq_open(file, &jbd2_seq_history_ops);
-        if (rc == 0) {
-                struct seq_file *m = file->private_data;
-                m->private = s;
-        } else {
-                kfree(s->stats);
-                kfree(s);
-        }
-        return rc;
-
-}
-
-static int jbd2_seq_history_release(struct inode *inode, struct file *file)
-{
-        struct seq_file *seq = file->private_data;
-        struct jbd2_stats_proc_session *s = seq->private;
-
-        kfree(s->stats);
-        kfree(s);
-        return seq_release(inode, file);
-}
-
-static struct file_operations jbd2_seq_history_fops = {
-        .owner          = THIS_MODULE,
-        .open           = jbd2_seq_history_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = jbd2_seq_history_release,
-};
-
 static void *jbd2_seq_info_start(struct seq_file *seq, loff_t *pos)
 {
         return *pos ? NULL : SEQ_START_TOKEN;
@@ -842,29 +692,29 @@ static int jbd2_seq_info_show(struct seq_file *seq, void *v)
 
         if (v != SEQ_START_TOKEN)
                 return 0;
-        seq_printf(seq, "%lu transaction, each upto %u blocks\n",
+        seq_printf(seq, "%lu transaction, each up to %u blocks\n",
                         s->stats->ts_tid,
                         s->journal->j_max_transaction_buffers);
         if (s->stats->ts_tid == 0)
                 return 0;
         seq_printf(seq, "average: \n  %ums waiting for transaction\n",
-            jiffies_to_msecs(s->stats->u.run.rs_wait / s->stats->ts_tid));
+            jiffies_to_msecs(s->stats->run.rs_wait / s->stats->ts_tid));
         seq_printf(seq, "  %ums running transaction\n",
-            jiffies_to_msecs(s->stats->u.run.rs_running / s->stats->ts_tid));
+            jiffies_to_msecs(s->stats->run.rs_running / s->stats->ts_tid));
         seq_printf(seq, "  %ums transaction was being locked\n",
-            jiffies_to_msecs(s->stats->u.run.rs_locked / s->stats->ts_tid));
+            jiffies_to_msecs(s->stats->run.rs_locked / s->stats->ts_tid));
         seq_printf(seq, "  %ums flushing data (in ordered mode)\n",
-            jiffies_to_msecs(s->stats->u.run.rs_flushing / s->stats->ts_tid));
+            jiffies_to_msecs(s->stats->run.rs_flushing / s->stats->ts_tid));
         seq_printf(seq, "  %ums logging transaction\n",
-            jiffies_to_msecs(s->stats->u.run.rs_logging / s->stats->ts_tid));
+            jiffies_to_msecs(s->stats->run.rs_logging / s->stats->ts_tid));
         seq_printf(seq, "  %lluus average transaction commit time\n",
                    div_u64(s->journal->j_average_commit_time, 1000));
         seq_printf(seq, "  %lu handles per transaction\n",
-            s->stats->u.run.rs_handle_count / s->stats->ts_tid);
+            s->stats->run.rs_handle_count / s->stats->ts_tid);
         seq_printf(seq, "  %lu blocks per transaction\n",
-            s->stats->u.run.rs_blocks / s->stats->ts_tid);
+            s->stats->run.rs_blocks / s->stats->ts_tid);
         seq_printf(seq, "  %lu logged blocks per transaction\n",
-            s->stats->u.run.rs_blocks_logged / s->stats->ts_tid);
+            s->stats->run.rs_blocks_logged / s->stats->ts_tid);
         return 0;
 }
 
@@ -920,7 +770,7 @@ static int jbd2_seq_info_release(struct inode *inode, struct file *file)
         return seq_release(inode, file);
 }
 
-static struct file_operations jbd2_seq_info_fops = {
+static const struct file_operations jbd2_seq_info_fops = {
         .owner          = THIS_MODULE,
         .open           = jbd2_seq_info_open,
         .read           = seq_read,
@@ -934,8 +784,6 @@ static void jbd2_stats_proc_init(journal_t *journal)
 {
         journal->j_proc_entry = proc_mkdir(journal->j_devname, proc_jbd2_stats);
         if (journal->j_proc_entry) {
-                proc_create_data("history", S_IRUGO, journal->j_proc_entry,
-                                 &jbd2_seq_history_fops, journal);
                 proc_create_data("info", S_IRUGO, journal->j_proc_entry,
                                  &jbd2_seq_info_fops, journal);
         }
@@ -944,27 +792,9 @@ static void jbd2_stats_proc_init(journal_t *journal)
 static void jbd2_stats_proc_exit(journal_t *journal)
 {
         remove_proc_entry("info", journal->j_proc_entry);
-        remove_proc_entry("history", journal->j_proc_entry);
         remove_proc_entry(journal->j_devname, proc_jbd2_stats);
 }
 
-static void journal_init_stats(journal_t *journal)
-{
-        int size;
-
-        if (!proc_jbd2_stats)
-                return;
-
-        journal->j_history_max = 100;
-        size = sizeof(struct transaction_stats_s) * journal->j_history_max;
-        journal->j_history = kzalloc(size, GFP_KERNEL);
-        if (!journal->j_history) {
-                journal->j_history_max = 0;
-                return;
-        }
-        spin_lock_init(&journal->j_history_lock);
-}
-
 /*
  * Management for journal control blocks: functions to create and
  * destroy journal_t structures, and to initialise and read existing
@@ -1009,7 +839,7 @@ static journal_t * journal_init_common (void)
                 goto fail;
         }
 
-        journal_init_stats(journal);
+        spin_lock_init(&journal->j_history_lock);
 
         return journal;
 fail:
@@ -1083,6 +913,7 @@ journal_t * jbd2_journal_init_dev(struct block_device *bdev,
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         jbd2_stats_proc_exit(journal);
         kfree(journal);
         return NULL;
@@ -1115,7 +946,7 @@ journal_t * jbd2_journal_init_inode (struct inode *inode)
         while ((p = strchr(p, '/')))
                 *p = '!';
         p = journal->j_devname + strlen(journal->j_devname);
-        sprintf(p, ":%lu", journal->j_inode->i_ino);
+        sprintf(p, "-%lu", journal->j_inode->i_ino);
         jbd_debug(1,
                   "journal %p: inode %s/%ld, size %Ld, bits %d, blksize %ld\n",
                   journal, inode->i_sb->s_id, inode->i_ino,
@@ -1156,6 +987,7 @@ journal_t * jbd2_journal_init_inode (struct inode *inode)
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         jbd2_stats_proc_exit(journal);
         kfree(journal);
         return NULL;
diff --git a/fs/jffs2/read.c b/fs/jffs2/read.c
index cfe05c1966a5..3f39be1b0455 100644
--- a/fs/jffs2/read.c
+++ b/fs/jffs2/read.c
@@ -164,12 +164,15 @@ int jffs2_read_inode_range(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 
         /* XXX FIXME: Where a single physical node actually shows up in two
            frags, we read it twice. Don't do that. */
-        /* Now we're pointing at the first frag which overlaps our page */
+        /* Now we're pointing at the first frag which overlaps our page
+         * (or perhaps is before it, if we've been asked to read off the
+         * end of the file). */
         while(offset < end) {
                 D2(printk(KERN_DEBUG "jffs2_read_inode_range: offset %d, end %d\n", offset, end));
-                if (unlikely(!frag || frag->ofs > offset)) {
+                if (unlikely(!frag || frag->ofs > offset ||
+                             frag->ofs + frag->size <= offset)) {
                         uint32_t holesize = end - offset;
-                        if (frag) {
+                        if (frag && frag->ofs > offset) {
                                 D1(printk(KERN_NOTICE "Eep. Hole in ino #%u fraglist. frag->ofs = 0x%08x, offset = 0x%08x\n", f->inocache->ino, frag->ofs, offset));
                                 holesize = min(holesize, frag->ofs - offset);
                         }
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 63976c0ccc25..99ea196f071f 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1180,7 +1180,7 @@ static int nfs4_init_client(struct nfs_client *clp,
                                       1, flags & NFS_MOUNT_NORESVPORT);
         if (error < 0)
                 goto error;
-        memcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
+        strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
 
         error = nfs_idmap_new(clp);
         if (error < 0) {
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 32062c33c859..7cb298525eef 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1536,6 +1536,8 @@ nfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry)
                 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
                 dentry->d_parent->d_name.name, dentry->d_name.name);
 
+        nfs_inode_return_delegation(inode);
+
         d_drop(dentry);
         error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name);
         if (error == 0) {
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 6c3210099d51..e1d415e97849 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -457,6 +457,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
         };
         struct rpc_task_setup task_setup_data = {
                 .rpc_client = NFS_CLIENT(inode),
+                .rpc_message = &msg,
                 .callback_ops = &nfs_write_direct_ops,
                 .workqueue = nfsiod_workqueue,
                 .flags = RPC_TASK_ASYNC,
diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
index 70fad69eb959..fa588006588d 100644
--- a/fs/nfs/fscache.c
+++ b/fs/nfs/fscache.c
@@ -359,17 +359,13 @@ int nfs_fscache_release_page(struct page *page, gfp_t gfp)
 
         BUG_ON(!cookie);
 
-        if (fscache_check_page_write(cookie, page)) {
-                if (!(gfp & __GFP_WAIT))
-                        return 0;
-                fscache_wait_on_page_write(cookie, page);
-        }
-
         if (PageFsCache(page)) {
                 dfprintk(FSCACHE, "NFS: fscache releasepage (0x%p/0x%p/0x%p)\n",
                          cookie, page, nfsi);
 
-                fscache_uncache_page(cookie, page);
+                if (!fscache_maybe_release_page(cookie, page, gfp))
+                        return 0;
+
                 nfs_add_fscache_stats(page->mapping->host,
                                       NFSIOS_FSCACHE_PAGES_UNCACHED, 1);
         }
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 2636c26d56fa..fa3408f20112 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -121,7 +121,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
 
         mnt_path = nfs4_pathname_string(&location->rootpath, page2, PAGE_SIZE);
         if (IS_ERR(mnt_path))
-                return mnt;
+                return ERR_CAST(mnt_path);
         mountdata->mnt_path = mnt_path;
         maxbuflen = mnt_path - 1 - page2;
 
@@ -132,15 +132,15 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                 if (buf->len <= 0 || buf->len >= maxbuflen)
                         continue;
 
-                mountdata->addr = (struct sockaddr *)&addr;
-
                 if (memchr(buf->data, IPV6_SCOPE_DELIMITER, buf->len))
                         continue;
-                mountdata->addrlen = nfs_parse_server_name(buf->data,
-                                buf->len,
-                                mountdata->addr, mountdata->addrlen);
+
+                mountdata->addrlen = nfs_parse_server_name(buf->data, buf->len,
+                                (struct sockaddr *)&addr, sizeof(addr));
                 if (mountdata->addrlen == 0)
                         continue;
+
+                mountdata->addr = (struct sockaddr *)&addr;
                 rpc_set_port(mountdata->addr, NFS_PORT);
 
                 memcpy(page2, buf->data, buf->len);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ed7c269e2514..741a562177fc 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -72,12 +72,17 @@ static int _nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle,
 /* Prevent leaks of NFSv4 errors into userland */
 static int nfs4_map_errors(int err)
 {
-        if (err < -1000) {
+        if (err >= -1000)
+                return err;
+        switch (err) {
+        case -NFS4ERR_RESOURCE:
+                return -EREMOTEIO;
+        default:
                 dprintk("%s could not handle NFSv4 error %d\n",
                                 __func__, -err);
-                return -EIO;
+                break;
         }
-        return err;
+        return -EIO;
 }
 
 /*
@@ -2762,7 +2767,7 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
                 .pages = &page,
                 .pgbase = 0,
                 .count = count,
-                .bitmask = NFS_SERVER(dentry->d_inode)->cache_consistency_bitmask,
+                .bitmask = NFS_SERVER(dentry->d_inode)->attr_bitmask,
         };
         struct nfs4_readdir_res res;
         struct rpc_message msg = {
@@ -3060,9 +3065,6 @@ static void nfs4_renew_done(struct rpc_task *task, void *data)
         if (time_before(clp->cl_last_renewal,timestamp))
                 clp->cl_last_renewal = timestamp;
         spin_unlock(&clp->cl_lock);
-        dprintk("%s calling put_rpccred on rpc_cred %p\n", __func__,
-                                task->tk_msg.rpc_cred);
-        put_rpccred(task->tk_msg.rpc_cred);
 }
 
 static const struct rpc_call_ops nfs4_renew_ops = {
@@ -4877,7 +4879,6 @@ void nfs41_sequence_call_done(struct rpc_task *task, void *data)
         nfs41_sequence_free_slot(clp, task->tk_msg.rpc_resp);
         dprintk("%s rpc_cred %p\n", __func__, task->tk_msg.rpc_cred);
 
-        put_rpccred(task->tk_msg.rpc_cred);
         kfree(task->tk_msg.rpc_argp);
         kfree(task->tk_msg.rpc_resp);
 
diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
index e27c6cef18f2..0156c01c212c 100644
--- a/fs/nfs/nfs4renewd.c
+++ b/fs/nfs/nfs4renewd.c
@@ -127,12 +127,6 @@ nfs4_schedule_state_renewal(struct nfs_client *clp)
 }
 
 void
-nfs4_renewd_prepare_shutdown(struct nfs_server *server)
-{
-        cancel_delayed_work(&server->nfs_client->cl_renewd);
-}
-
-void
 nfs4_kill_renewd(struct nfs_client *clp)
 {
         cancel_delayed_work_sync(&clp->cl_renewd);
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 83ad47cbdd8a..20b4e30e6c82 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -5681,7 +5681,6 @@ static struct {
         { NFS4ERR_SERVERFAULT,  -ESERVERFAULT   },
         { NFS4ERR_BADTYPE,      -EBADTYPE       },
         { NFS4ERR_LOCKED,       -EAGAIN         },
-        { NFS4ERR_RESOURCE,     -EREMOTEIO      },
         { NFS4ERR_SYMLINK,      -ELOOP          },
         { NFS4ERR_OP_ILLEGAL,   -EOPNOTSUPP     },
         { NFS4ERR_DEADLOCK,     -EDEADLK        },
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 29786d3b9326..90be551b80c1 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -728,22 +728,24 @@ static void nfs_umount_begin(struct super_block *sb)
         unlock_kernel();
 }
 
-static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(int flags)
+static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(unsigned int version)
 {
         struct nfs_parsed_mount_data *data;
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (data) {
-                data->flags             = flags;
                 data->rsize             = NFS_MAX_FILE_IO_SIZE;
                 data->wsize             = NFS_MAX_FILE_IO_SIZE;
                 data->acregmin          = NFS_DEF_ACREGMIN;
                 data->acregmax          = NFS_DEF_ACREGMAX;
                 data->acdirmin          = NFS_DEF_ACDIRMIN;
                 data->acdirmax          = NFS_DEF_ACDIRMAX;
+                data->mount_server.port = NFS_UNSPEC_PORT;
                 data->nfs_server.port   = NFS_UNSPEC_PORT;
+                data->nfs_server.protocol = XPRT_TRANSPORT_TCP;
                 data->auth_flavors[0]   = RPC_AUTH_UNIX;
                 data->auth_flavor_len   = 1;
+                data->version           = version;
                 data->minorversion      = 0;
         }
         return data;
@@ -776,15 +778,13 @@ static int nfs_verify_server_address(struct sockaddr *addr)
  * Select between a default port value and a user-specified port value.
  * If a zero value is set, then autobind will be used.
  */
-static void nfs_set_default_port(struct sockaddr *sap, const int parsed_port,
+static void nfs_set_port(struct sockaddr *sap, int *port,
                                  const unsigned short default_port)
 {
-        unsigned short port = default_port;
+        if (*port == NFS_UNSPEC_PORT)
+                *port = default_port;
 
-        if (parsed_port != NFS_UNSPEC_PORT)
-                port = parsed_port;
-
-        rpc_set_port(sap, port);
+        rpc_set_port(sap, *port);
 }
 
 /*
@@ -1253,6 +1253,7 @@ static int nfs_parse_mount_options(char *raw,
                         default:
                                 dfprintk(MOUNT, "NFS:   unrecognized "
                                                 "transport protocol\n");
+                                kfree(string);
                                 return 0;
                         }
                         break;
@@ -1475,7 +1476,7 @@ static int nfs_try_mount(struct nfs_parsed_mount_data *args,
                 args->mount_server.addrlen = args->nfs_server.addrlen;
         }
         request.salen = args->mount_server.addrlen;
-        nfs_set_default_port(request.sap, args->mount_server.port, 0);
+        nfs_set_port(request.sap, &args->mount_server.port, 0);
 
         /*
          * Now ask the mount server to map our export path
@@ -1711,8 +1712,6 @@ static int nfs_validate_mount_data(void *options,
 
                 if (!(data->flags & NFS_MOUNT_TCP))
                         args->nfs_server.protocol = XPRT_TRANSPORT_UDP;
-                else
-                        args->nfs_server.protocol = XPRT_TRANSPORT_TCP;
                 /* N.B. caller will free nfs_server.hostname in all cases */
                 args->nfs_server.hostname = kstrdup(data->hostname, GFP_KERNEL);
                 args->namlen            = data->namlen;
@@ -1767,7 +1766,7 @@ static int nfs_validate_mount_data(void *options,
                         goto out_v4_not_compiled;
 #endif
 
-                nfs_set_default_port(sap, args->nfs_server.port, 0);
+                nfs_set_port(sap, &args->nfs_server.port, 0);
 
                 nfs_set_mount_transport_protocol(args);
 
@@ -1848,9 +1847,10 @@ nfs_compare_remount_data(struct nfs_server *nfss,
             data->acdirmin != nfss->acdirmin / HZ ||
             data->acdirmax != nfss->acdirmax / HZ ||
             data->timeo != (10U * nfss->client->cl_timeout->to_initval / HZ) ||
+            data->nfs_server.port != nfss->port ||
             data->nfs_server.addrlen != nfss->nfs_client->cl_addrlen ||
-            memcmp(&data->nfs_server.address, &nfss->nfs_client->cl_addr,
-                   data->nfs_server.addrlen) != 0)
+            !rpc_cmp_addr((struct sockaddr *)&data->nfs_server.address,
+                          (struct sockaddr *)&nfss->nfs_client->cl_addr))
                 return -EINVAL;
 
         return 0;
@@ -1893,6 +1893,7 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data)
         data->acdirmin = nfss->acdirmin / HZ;
         data->acdirmax = nfss->acdirmax / HZ;
         data->timeo = 10U * nfss->client->cl_timeout->to_initval / HZ;
+        data->nfs_server.port = nfss->port;
         data->nfs_server.addrlen = nfss->nfs_client->cl_addrlen;
         memcpy(&data->nfs_server.address, &nfss->nfs_client->cl_addr,
                 data->nfs_server.addrlen);
@@ -2106,7 +2107,7 @@ static int nfs_get_sb(struct file_system_type *fs_type,
         };
         int error = -ENOMEM;
 
-        data = nfs_alloc_parsed_mount_data(NFS_MOUNT_VER3 | NFS_MOUNT_TCP);
+        data = nfs_alloc_parsed_mount_data(3);
         mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
         if (data == NULL || mntfh == NULL)
                 goto out_free_fh;
@@ -2331,7 +2332,7 @@ static int nfs4_validate_text_mount_data(void *options,
 {
         struct sockaddr *sap = (struct sockaddr *)&args->nfs_server.address;
 
-        nfs_set_default_port(sap, args->nfs_server.port, NFS_PORT);
+        nfs_set_port(sap, &args->nfs_server.port, NFS_PORT);
 
         nfs_validate_transport_protocol(args);
 
@@ -2376,7 +2377,6 @@ static int nfs4_validate_mount_data(void *options,
         if (data == NULL)
                 goto out_no_data;
 
-        args->version           = 4;
         switch (data->version) {
         case 1:
                 if (data->host_addrlen > sizeof(args->nfs_server.address))
@@ -2660,7 +2660,7 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
         struct nfs_parsed_mount_data *data;
         int error = -ENOMEM;
 
-        data = nfs_alloc_parsed_mount_data(0);
+        data = nfs_alloc_parsed_mount_data(4);
         if (data == NULL)
                 goto out_free_data;
 
@@ -2690,7 +2690,6 @@ static void nfs4_kill_super(struct super_block *sb)
         dprintk("--> %s\n", __func__);
         nfs_super_return_all_delegations(sb);
         kill_anon_super(sb);
-        nfs4_renewd_prepare_shutdown(server);
         nfs_fscache_release_super_cookie(sb);
         nfs_free_server(server);
         dprintk("<-- %s\n", __func__);
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index edf926e1062f..d0a2ce1b4324 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -958,7 +958,7 @@ encode_entry(struct readdir_cd *ccd, const char *name, int namlen,
                 p1 = encode_entry_baggage(cd, p1, name, namlen, ino);
 
                 if (plus)
-                        p = encode_entryplus_baggage(cd, p1, name, namlen);
+                        p1 = encode_entryplus_baggage(cd, p1, name, namlen);
 
                 /* determine entry word length and lengths to go in pages */
                 num_entry_words = p1 - tmp;
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 00388d2a3c99..5c01fc148ce8 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -176,7 +176,7 @@ static const struct file_operations exports_operations = {
 extern int nfsd_pool_stats_open(struct inode *inode, struct file *file);
 extern int nfsd_pool_stats_release(struct inode *inode, struct file *file);
 
-static struct file_operations pool_stats_operations = {
+static const struct file_operations pool_stats_operations = {
         .open           = nfsd_pool_stats_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index 6a2711f4c321..84c25382f8e3 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -36,6 +36,7 @@
 
 void nilfs_btnode_cache_init_once(struct address_space *btnc)
 {
+        memset(btnc, 0, sizeof(*btnc));
         INIT_RADIX_TREE(&btnc->page_tree, GFP_ATOMIC);
         spin_lock_init(&btnc->tree_lock);
         INIT_LIST_HEAD(&btnc->private_list);
@@ -86,6 +87,7 @@ int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,
                         brelse(bh);
                         BUG();
                 }
+                memset(bh->b_data, 0, 1 << inode->i_blkbits);
                 bh->b_bdev = NILFS_I_NILFS(inode)->ns_bdev;
                 bh->b_blocknr = blocknr;
                 set_buffer_mapped(bh);
@@ -275,8 +277,7 @@ void nilfs_btnode_commit_change_key(struct address_space *btnc,
                                        "invalid oldkey %lld (newkey=%lld)",
                                        (unsigned long long)oldkey,
                                        (unsigned long long)newkey);
-                if (!test_set_buffer_dirty(obh) && TestSetPageDirty(opage))
-                        BUG();
+                nilfs_btnode_mark_dirty(obh);
 
                 spin_lock_irq(&btnc->tree_lock);
                 radix_tree_delete(&btnc->page_tree, oldkey);
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index 1c6cfb59128d..3f5d5d06f53c 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -871,7 +871,6 @@ int nilfs_cpfile_change_cpmode(struct inode *cpfile, __u64 cno, int mode)
                  * exclusive with a new mount job.  Though it doesn't cover
                  * umount, it's enough for the purpose.
                  */
-                mutex_lock(&nilfs->ns_mount_mutex);
                 if (nilfs_checkpoint_is_mounted(nilfs, cno, 1)) {
                         /* Current implementation does not have to protect
                            plain read-only mounts since they are exclusive
@@ -880,7 +879,6 @@ int nilfs_cpfile_change_cpmode(struct inode *cpfile, __u64 cno, int mode)
                         ret = -EBUSY;
                 } else
                         ret = nilfs_cpfile_clear_snapshot(cpfile, cno);
-                mutex_unlock(&nilfs->ns_mount_mutex);
                 return ret;
         case NILFS_SNAPSHOT:
                 return nilfs_cpfile_set_snapshot(cpfile, cno);
diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c
index 1a4fa04cf071..e097099bfc8f 100644
--- a/fs/nilfs2/dir.c
+++ b/fs/nilfs2/dir.c
@@ -697,7 +697,7 @@ not_empty:
         return 0;
 }
 
-struct file_operations nilfs_dir_operations = {
+const struct file_operations nilfs_dir_operations = {
         .llseek         = generic_file_llseek,
         .read           = generic_read_dir,
         .readdir        = nilfs_readdir,
diff --git a/fs/nilfs2/file.c b/fs/nilfs2/file.c
index 7d7b4983dee3..30292df443ce 100644
--- a/fs/nilfs2/file.c
+++ b/fs/nilfs2/file.c
@@ -134,7 +134,7 @@ static int nilfs_file_mmap(struct file *file, struct vm_area_struct *vma)
  * We have mostly NULL's here: the current defaults are ok for
  * the nilfs filesystem.
  */
-struct file_operations nilfs_file_operations = {
+const struct file_operations nilfs_file_operations = {
         .llseek         = generic_file_llseek,
         .read           = do_sync_read,
         .write          = do_sync_write,
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 2d2c501deb54..2a0a5a3ac134 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -400,6 +400,7 @@ int nilfs_read_inode_common(struct inode *inode,
         ii->i_dir_acl = S_ISREG(inode->i_mode) ?
                 0 : le32_to_cpu(raw_inode->i_dir_acl);
 #endif
+        ii->i_dir_start_lookup = 0;
         ii->i_cno = 0;
         inode->i_generation = le32_to_cpu(raw_inode->i_generation);
 
@@ -663,7 +664,6 @@ int nilfs_load_inode_block(struct nilfs_sb_info *sbi, struct inode *inode,
         int err;
 
         spin_lock(&sbi->s_inode_lock);
-        /* Caller of this function MUST lock s_inode_lock */
         if (ii->i_bh == NULL) {
                 spin_unlock(&sbi->s_inode_lock);
                 err = nilfs_ifile_get_inode_block(sbi->s_ifile, inode->i_ino,
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 6572ea4bc4df..f6af76042d80 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -99,7 +99,8 @@ static int nilfs_ioctl_wrap_copy(struct the_nilfs *nilfs,
 static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
                                      unsigned int cmd, void __user *argp)
 {
-        struct inode *cpfile = NILFS_SB(inode->i_sb)->s_nilfs->ns_cpfile;
+        struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+        struct inode *cpfile = nilfs->ns_cpfile;
         struct nilfs_transaction_info ti;
         struct nilfs_cpmode cpmode;
         int ret;
@@ -109,14 +110,17 @@ static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
         if (copy_from_user(&cpmode, argp, sizeof(cpmode)))
                 return -EFAULT;
 
+        mutex_lock(&nilfs->ns_mount_mutex);
         nilfs_transaction_begin(inode->i_sb, &ti, 0);
         ret = nilfs_cpfile_change_cpmode(
                 cpfile, cpmode.cm_cno, cpmode.cm_mode);
         if (unlikely(ret < 0)) {
                 nilfs_transaction_abort(inode->i_sb);
+                mutex_unlock(&nilfs->ns_mount_mutex);
                 return ret;
         }
         nilfs_transaction_commit(inode->i_sb); /* never fails */
+        mutex_unlock(&nilfs->ns_mount_mutex);
         return ret;
 }
 
@@ -297,7 +301,18 @@ static int nilfs_ioctl_move_inode_block(struct inode *inode,
                                (unsigned long long)vdesc->vd_vblocknr);
                 return ret;
         }
-        bh->b_private = vdesc;
+        if (unlikely(!list_empty(&bh->b_assoc_buffers))) {
+                printk(KERN_CRIT "%s: conflicting %s buffer: ino=%llu, "
+                       "cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu\n",
+                       __func__, vdesc->vd_flags ? "node" : "data",
+                       (unsigned long long)vdesc->vd_ino,
+                       (unsigned long long)vdesc->vd_cno,
+                       (unsigned long long)vdesc->vd_offset,
+                       (unsigned long long)vdesc->vd_blocknr,
+                       (unsigned long long)vdesc->vd_vblocknr);
+                brelse(bh);
+                return -EEXIST;
+        }
         list_add_tail(&bh->b_assoc_buffers, buffers);
         return 0;
 }
@@ -335,24 +350,10 @@ static int nilfs_ioctl_move_blocks(struct the_nilfs *nilfs,
         list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) {
                 ret = nilfs_gccache_wait_and_mark_dirty(bh);
                 if (unlikely(ret < 0)) {
-                        if (ret == -EEXIST) {
-                                vdesc = bh->b_private;
-                                printk(KERN_CRIT
-                                       "%s: conflicting %s buffer: "
-                                       "ino=%llu, cno=%llu, offset=%llu, "
-                                       "blocknr=%llu, vblocknr=%llu\n",
-                                       __func__,
-                                       vdesc->vd_flags ? "node" : "data",
-                                       (unsigned long long)vdesc->vd_ino,
-                                       (unsigned long long)vdesc->vd_cno,
-                                       (unsigned long long)vdesc->vd_offset,
-                                       (unsigned long long)vdesc->vd_blocknr,
-                                       (unsigned long long)vdesc->vd_vblocknr);
-                        }
+                        WARN_ON(ret == -EEXIST);
                         goto failed;
                 }
                 list_del_init(&bh->b_assoc_buffers);
-                bh->b_private = NULL;
                 brelse(bh);
         }
         return nmembs;
@@ -360,7 +361,6 @@ static int nilfs_ioctl_move_blocks(struct the_nilfs *nilfs,
  failed:
         list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) {
                 list_del_init(&bh->b_assoc_buffers);
-                bh->b_private = NULL;
                 brelse(bh);
         }
         return ret;
@@ -471,7 +471,6 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
         return 0;
 
  failed:
-        nilfs_remove_all_gcinode(nilfs);
         printk(KERN_ERR "NILFS: GC failed during preparation: %s: err=%d\n",
                msg, ret);
         return ret;
@@ -560,6 +559,8 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
         else
                 ret = nilfs_clean_segments(inode->i_sb, argv, kbufs);
 
+        if (ret < 0)
+                nilfs_remove_all_gcinode(nilfs);
         clear_nilfs_gc_running(nilfs);
 
  out_free:
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index b18c4998f8d0..f6326112d647 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -433,7 +433,7 @@ static const struct address_space_operations def_mdt_aops = {
 };
 
 static const struct inode_operations def_mdt_iops;
-static struct file_operations def_mdt_fops;
+static const struct file_operations def_mdt_fops;
 
 /*
  * NILFS2 uses pseudo inodes for meta data files such as DAT, cpfile, sufile,
diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
index bad7368782d0..4da6f67e9a91 100644
--- a/fs/nilfs2/nilfs.h
+++ b/fs/nilfs2/nilfs.h
@@ -294,9 +294,9 @@ void nilfs_clear_gcdat_inode(struct the_nilfs *);
 /*
  * Inodes and files operations
  */
-extern struct file_operations nilfs_dir_operations;
+extern const struct file_operations nilfs_dir_operations;
 extern const struct inode_operations nilfs_file_inode_operations;
-extern struct file_operations nilfs_file_operations;
+extern const struct file_operations nilfs_file_operations;
 extern const struct address_space_operations nilfs_aops;
 extern const struct inode_operations nilfs_dir_inode_operations;
 extern const struct inode_operations nilfs_special_inode_operations;
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 683df89dbae5..6eff66a070d5 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2468,17 +2468,22 @@ static void nilfs_segctor_notify(struct nilfs_sc_info *sci,
         /* Clear requests (even when the construction failed) */
         spin_lock(&sci->sc_state_lock);
 
-        sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
-
         if (req->mode == SC_LSEG_SR) {
+                sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
                 sci->sc_seq_done = req->seq_accepted;
                 nilfs_segctor_wakeup(sci, req->sc_err ? : req->sb_err);
                 sci->sc_flush_request = 0;
-        } else if (req->mode == SC_FLUSH_FILE)
-                sci->sc_flush_request &= ~FLUSH_FILE_BIT;
-        else if (req->mode == SC_FLUSH_DAT)
-                sci->sc_flush_request &= ~FLUSH_DAT_BIT;
+        } else {
+                if (req->mode == SC_FLUSH_FILE)
+                        sci->sc_flush_request &= ~FLUSH_FILE_BIT;
+                else if (req->mode == SC_FLUSH_DAT)
+                        sci->sc_flush_request &= ~FLUSH_DAT_BIT;
 
+                /* re-enable timer if checkpoint creation was not done */
+                if (sci->sc_timer && (sci->sc_state & NILFS_SEGCTOR_COMMIT) &&
+                    time_before(jiffies, sci->sc_timer->expires))
+                        add_timer(sci->sc_timer);
+        }
         spin_unlock(&sci->sc_state_lock);
 }
 
diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c
index 2224b4d07bf0..44a88a9fa2c8 100644
--- a/fs/nls/nls_base.c
+++ b/fs/nls/nls_base.c
@@ -124,10 +124,10 @@ int utf8s_to_utf16s(const u8 *s, int len, wchar_t *pwcs)
         while (*s && len > 0) {
                 if (*s & 0x80) {
                         size = utf8_to_utf32(s, len, &u);
-                        if (size < 0) {
-                                /* Ignore character and move on */
-                                size = 1;
-                        } else if (u >= PLANE_SIZE) {
+                        if (size < 0)
+                                return -EINVAL;
+
+                        if (u >= PLANE_SIZE) {
                                 u -= PLANE_SIZE;
                                 *op++ = (wchar_t) (SURROGATE_PAIR |
                                                 ((u >> 10) & SURROGATE_BITS));
diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
index 828a889be909..7e54e52964dd 100644
--- a/fs/notify/dnotify/dnotify.c
+++ b/fs/notify/dnotify/dnotify.c
@@ -91,6 +91,7 @@ static int dnotify_handle_event(struct fsnotify_group *group,
         struct dnotify_struct *dn;
         struct dnotify_struct **prev;
         struct fown_struct *fown;
+        __u32 test_mask = event->mask & ~FS_EVENT_ON_CHILD;
 
         to_tell = event->to_tell;
 
@@ -106,7 +107,7 @@ static int dnotify_handle_event(struct fsnotify_group *group,
         spin_lock(&entry->lock);
         prev = &dnentry->dn;
         while ((dn = *prev) != NULL) {
-                if ((dn->dn_mask & event->mask) == 0) {
+                if ((dn->dn_mask & test_mask) == 0) {
                         prev = &dn->dn_next;
                         continue;
                 }
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index c8a07c65482b..3165d85aada2 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -324,11 +324,11 @@ int fsnotify_add_mark(struct fsnotify_mark_entry *entry,
         spin_lock(&group->mark_lock);
         spin_lock(&inode->i_lock);
 
-        entry->group = group;
-        entry->inode = inode;
-
         lentry = fsnotify_find_mark_entry(group, inode);
         if (!lentry) {
+                entry->group = group;
+                entry->inode = inode;
+
                 hlist_add_head(&entry->i_list, &inode->i_fsnotify_mark_entries);
                 list_add(&entry->g_list, &group->mark_entries);
 
diff --git a/fs/notify/notification.c b/fs/notify/notification.c
index 3816d5750dd5..b8bf53b4c108 100644
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -143,7 +143,7 @@ static bool event_compare(struct fsnotify_event *old, struct fsnotify_event *new
                         /* remember, after old was put on the wait_q we aren't
                          * allowed to look at the inode any more, only thing
                          * left to check was if the file_name is the same */
-                        if (old->name_len &&
+                        if (!old->name_len ||
                             !strcmp(old->file_name, new->file_name))
                                 return true;
                         break;
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 09cc25d04611..c452d116b892 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -966,7 +966,7 @@ static ssize_t o2hb_debug_read(struct file *file, char __user *buf,
 }
 #endif  /* CONFIG_DEBUG_FS */
 
-static struct file_operations o2hb_debug_fops = {
+static const struct file_operations o2hb_debug_fops = {
         .open =         o2hb_debug_open,
         .release =      o2hb_debug_release,
         .read =         o2hb_debug_read,
diff --git a/fs/ocfs2/cluster/netdebug.c b/fs/ocfs2/cluster/netdebug.c
index cfb2be708abe..da794bc07a6c 100644
--- a/fs/ocfs2/cluster/netdebug.c
+++ b/fs/ocfs2/cluster/netdebug.c
@@ -207,7 +207,7 @@ static int nst_fop_release(struct inode *inode, struct file *file)
         return seq_release_private(inode, file);
 }
 
-static struct file_operations nst_seq_fops = {
+static const struct file_operations nst_seq_fops = {
         .open = nst_fop_open,
         .read = seq_read,
         .llseek = seq_lseek,
@@ -388,7 +388,7 @@ static int sc_fop_release(struct inode *inode, struct file *file)
         return seq_release_private(inode, file);
 }
 
-static struct file_operations sc_seq_fops = {
+static const struct file_operations sc_seq_fops = {
         .open = sc_fop_open,
         .read = seq_read,
         .llseek = seq_lseek,
diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
index ca46002ec10e..42b0bad7a612 100644
--- a/fs/ocfs2/dlm/dlmdebug.c
+++ b/fs/ocfs2/dlm/dlmdebug.c
@@ -478,7 +478,7 @@ bail:
         return -ENOMEM;
 }
 
-static struct file_operations debug_purgelist_fops = {
+static const struct file_operations debug_purgelist_fops = {
         .open =         debug_purgelist_open,
         .release =      debug_buffer_release,
         .read =         debug_buffer_read,
@@ -538,7 +538,7 @@ bail:
         return -ENOMEM;
 }
 
-static struct file_operations debug_mle_fops = {
+static const struct file_operations debug_mle_fops = {
         .open =         debug_mle_open,
         .release =      debug_buffer_release,
         .read =         debug_buffer_read,
@@ -741,7 +741,7 @@ static int debug_lockres_release(struct inode *inode, struct file *file)
         return seq_release_private(inode, file);
 }
 
-static struct file_operations debug_lockres_fops = {
+static const struct file_operations debug_lockres_fops = {
         .open =         debug_lockres_open,
         .release =      debug_lockres_release,
         .read =         seq_read,
@@ -925,7 +925,7 @@ bail:
         return -ENOMEM;
 }
 
-static struct file_operations debug_state_fops = {
+static const struct file_operations debug_state_fops = {
         .open =         debug_state_open,
         .release =      debug_buffer_release,
         .read =         debug_buffer_read,
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 89fc8ee1f5a5..de059f490586 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1712,7 +1712,8 @@ int ocfs2_check_range_for_refcount(struct inode *inode, loff_t pos,
         struct super_block *sb = inode->i_sb;
 
         if (!ocfs2_refcount_tree(OCFS2_SB(inode->i_sb)) ||
-            !(OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_REFCOUNT_FL))
+            !(OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_REFCOUNT_FL) ||
+            OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL)
                 return 0;
 
         cpos = pos >> OCFS2_SB(sb)->s_clustersize_bits;
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index eae404602424..d963d8638709 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -35,12 +35,7 @@
 #include <linux/kref.h>
 #include <linux/mutex.h>
 #include <linux/lockdep.h>
-#ifndef CONFIG_OCFS2_COMPAT_JBD
-# include <linux/jbd2.h>
-#else
-# include <linux/jbd.h>
-# include "ocfs2_jbd_compat.h"
-#endif
+#include <linux/jbd2.h>
 
 /* For union ocfs2_dlm_lksb */
 #include "stackglue.h"
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 60287fc56bcb..3a0df7a1b810 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -3743,6 +3743,9 @@ static int ocfs2_attach_refcount_tree(struct inode *inode,
                 goto out;
         }
 
+        if (oi->ip_dyn_features & OCFS2_INLINE_DATA_FL)
+                goto attach_xattr;
+
         ocfs2_init_dinode_extent_tree(&di_et, INODE_CACHE(inode), di_bh);
 
         size = i_size_read(inode);
@@ -3769,6 +3772,7 @@ static int ocfs2_attach_refcount_tree(struct inode *inode,
                 cpos += num_clusters;
         }
 
+attach_xattr:
         if (oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) {
                 ret = ocfs2_xattr_attach_refcount_tree(inode, di_bh,
                                                        &ref_tree->rf_ci,
@@ -3858,6 +3862,49 @@ out:
         return ret;
 }
 
+static int ocfs2_duplicate_inline_data(struct inode *s_inode,
+                                       struct buffer_head *s_bh,
+                                       struct inode *t_inode,
+                                       struct buffer_head *t_bh)
+{
+        int ret;
+        handle_t *handle;
+        struct ocfs2_super *osb = OCFS2_SB(s_inode->i_sb);
+        struct ocfs2_dinode *s_di = (struct ocfs2_dinode *)s_bh->b_data;
+        struct ocfs2_dinode *t_di = (struct ocfs2_dinode *)t_bh->b_data;
+
+        BUG_ON(!(OCFS2_I(s_inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL));
+
+        handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                mlog_errno(ret);
+                goto out;
+        }
+
+        ret = ocfs2_journal_access_di(handle, INODE_CACHE(t_inode), t_bh,
+                                      OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out_commit;
+        }
+
+        t_di->id2.i_data.id_count = s_di->id2.i_data.id_count;
+        memcpy(t_di->id2.i_data.id_data, s_di->id2.i_data.id_data,
+               le16_to_cpu(s_di->id2.i_data.id_count));
+        spin_lock(&OCFS2_I(t_inode)->ip_lock);
+        OCFS2_I(t_inode)->ip_dyn_features |= OCFS2_INLINE_DATA_FL;
+        t_di->i_dyn_features = cpu_to_le16(OCFS2_I(t_inode)->ip_dyn_features);
+        spin_unlock(&OCFS2_I(t_inode)->ip_lock);
+
+        ocfs2_journal_dirty(handle, t_bh);
+
+out_commit:
+        ocfs2_commit_trans(osb, handle);
+out:
+        return ret;
+}
+
 static int ocfs2_duplicate_extent_list(struct inode *s_inode,
                                 struct inode *t_inode,
                                 struct buffer_head *t_bh,
@@ -3997,6 +4044,14 @@ static int ocfs2_create_reflink_node(struct inode *s_inode,
                 goto out;
         }
 
+        if (OCFS2_I(s_inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+                ret = ocfs2_duplicate_inline_data(s_inode, s_bh,
+                                                  t_inode, t_bh);
+                if (ret)
+                        mlog_errno(ret);
+                goto out;
+        }
+
         ret = ocfs2_lock_refcount_tree(osb, le64_to_cpu(di->i_refcount_loc),
                                        1, &ref_tree, &ref_root_bh);
         if (ret) {
@@ -4013,10 +4068,6 @@ static int ocfs2_create_reflink_node(struct inode *s_inode,
                 goto out_unlock_refcount;
         }
 
-        ret = ocfs2_complete_reflink(s_inode, s_bh, t_inode, t_bh, preserve);
-        if (ret)
-                mlog_errno(ret);
-
 out_unlock_refcount:
         ocfs2_unlock_refcount_tree(osb, ref_tree, 1);
         brelse(ref_root_bh);
@@ -4068,9 +4119,17 @@ static int __ocfs2_reflink(struct dentry *old_dentry,
                 ret = ocfs2_reflink_xattrs(inode, old_bh,
                                            new_inode, new_bh,
                                            preserve);
-                if (ret)
+                if (ret) {
                         mlog_errno(ret);
+                        goto inode_unlock;
+                }
         }
+
+        ret = ocfs2_complete_reflink(inode, old_bh,
+                                     new_inode, new_bh, preserve);
+        if (ret)
+                mlog_errno(ret);
+
 inode_unlock:
         ocfs2_inode_unlock(new_inode, 1);
         brelse(new_bh);
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 4cc3c890a2cd..14f47d2bfe02 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -373,7 +373,7 @@ static ssize_t ocfs2_debug_read(struct file *file, char __user *buf,
 }
 #endif  /* CONFIG_DEBUG_FS */
 
-static struct file_operations ocfs2_osb_debug_fops = {
+static const struct file_operations ocfs2_osb_debug_fops = {
         .open =         ocfs2_osb_debug_open,
         .release =      ocfs2_debug_release,
         .read =         ocfs2_debug_read,
@@ -773,18 +773,20 @@ static int ocfs2_sb_probe(struct super_block *sb,
                 if (tmpstat < 0) {
                         status = tmpstat;
                         mlog_errno(status);
-                        goto bail;
+                        break;
                 }
                 di = (struct ocfs2_dinode *) (*bh)->b_data;
                 memset(stats, 0, sizeof(struct ocfs2_blockcheck_stats));
                 spin_lock_init(&stats->b_lock);
-                status = ocfs2_verify_volume(di, *bh, blksize, stats);
-                if (status >= 0)
-                        goto bail;
-                brelse(*bh);
-                *bh = NULL;
-                if (status != -EAGAIN)
+                tmpstat = ocfs2_verify_volume(di, *bh, blksize, stats);
+                if (tmpstat < 0) {
+                        brelse(*bh);
+                        *bh = NULL;
+                }
+                if (tmpstat != -EAGAIN) {
+                        status = tmpstat;
                         break;
+                }
         }
 
 bail:
@@ -1645,6 +1647,10 @@ static int ocfs2_statfs(struct dentry *dentry, struct kstatfs *buf)
         buf->f_bavail = buf->f_bfree;
         buf->f_files = numbits;
         buf->f_ffree = freebits;
+        buf->f_fsid.val[0] = crc32_le(0, osb->uuid_str, OCFS2_VOL_UUID_LEN)
+                                & 0xFFFFFFFFUL;
+        buf->f_fsid.val[1] = crc32_le(0, osb->uuid_str + OCFS2_VOL_UUID_LEN,
+                                OCFS2_VOL_UUID_LEN) & 0xFFFFFFFFUL;
 
         brelse(bh);
 
diff --git a/fs/ocfs2/uptodate.c b/fs/ocfs2/uptodate.c
index b6284f235d2f..c61369342a27 100644
--- a/fs/ocfs2/uptodate.c
+++ b/fs/ocfs2/uptodate.c
@@ -53,11 +53,6 @@
 #include <linux/highmem.h>
 #include <linux/buffer_head.h>
 #include <linux/rbtree.h>
-#ifndef CONFIG_OCFS2_COMPAT_JBD
-# include <linux/jbd2.h>
-#else
-# include <linux/jbd.h>
-#endif
 
 #define MLOG_MASK_PREFIX ML_UPTODATE
 
diff --git a/fs/omfs/dir.c b/fs/omfs/dir.c
index 3680bae335b5..b42d62419034 100644
--- a/fs/omfs/dir.c
+++ b/fs/omfs/dir.c
@@ -498,7 +498,7 @@ const struct inode_operations omfs_dir_inops = {
         .rmdir = omfs_rmdir,
 };
 
-struct file_operations omfs_dir_operations = {
+const struct file_operations omfs_dir_operations = {
         .read = generic_read_dir,
         .readdir = omfs_readdir,
         .llseek = generic_file_llseek,
diff --git a/fs/omfs/file.c b/fs/omfs/file.c
index 4845fbb18e6e..399487c09364 100644
--- a/fs/omfs/file.c
+++ b/fs/omfs/file.c
@@ -322,7 +322,7 @@ static sector_t omfs_bmap(struct address_space *mapping, sector_t block)
         return generic_block_bmap(mapping, block, omfs_get_block);
 }
 
-struct file_operations omfs_file_operations = {
+const struct file_operations omfs_file_operations = {
         .llseek = generic_file_llseek,
         .read = do_sync_read,
         .write = do_sync_write,
diff --git a/fs/omfs/omfs.h b/fs/omfs/omfs.h
index df71039945ac..ebe2fdbe535e 100644
--- a/fs/omfs/omfs.h
+++ b/fs/omfs/omfs.h
@@ -44,14 +44,14 @@ extern int omfs_allocate_range(struct super_block *sb, int min_request,
 extern int omfs_clear_range(struct super_block *sb, u64 block, int count);
 
 /* dir.c */
-extern struct file_operations omfs_dir_operations;
+extern const struct file_operations omfs_dir_operations;
 extern const struct inode_operations omfs_dir_inops;
 extern int omfs_make_empty(struct inode *inode, struct super_block *sb);
 extern int omfs_is_bad(struct omfs_sb_info *sbi, struct omfs_header *header,
                         u64 fsblock);
 
 /* file.c */
-extern struct file_operations omfs_file_operations;
+extern const struct file_operations omfs_file_operations;
 extern const struct inode_operations omfs_file_inops;
 extern const struct address_space_operations omfs_aops;
 extern void omfs_make_empty_table(struct buffer_head *bh, int offset);
diff --git a/fs/pipe.c b/fs/pipe.c
index 52c415114838..ae17d026aaa3 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -777,36 +777,55 @@ pipe_rdwr_release(struct inode *inode, struct file *filp)
 static int
 pipe_read_open(struct inode *inode, struct file *filp)
 {
-        /* We could have perhaps used atomic_t, but this and friends
-           below are the only places.  So it doesn't seem worthwhile.  */
+        int ret = -ENOENT;
+
         mutex_lock(&inode->i_mutex);
-        inode->i_pipe->readers++;
+
+        if (inode->i_pipe) {
+                ret = 0;
+                inode->i_pipe->readers++;
+        }
+
         mutex_unlock(&inode->i_mutex);
 
-        return 0;
+        return ret;
 }
 
 static int
 pipe_write_open(struct inode *inode, struct file *filp)
 {
+        int ret = -ENOENT;
+
         mutex_lock(&inode->i_mutex);
-        inode->i_pipe->writers++;
+
+        if (inode->i_pipe) {
+                ret = 0;
+                inode->i_pipe->writers++;
+        }
+
         mutex_unlock(&inode->i_mutex);
 
-        return 0;
+        return ret;
 }
 
 static int
 pipe_rdwr_open(struct inode *inode, struct file *filp)
 {
+        int ret = -ENOENT;
+
         mutex_lock(&inode->i_mutex);
-        if (filp->f_mode & FMODE_READ)
-                inode->i_pipe->readers++;
-        if (filp->f_mode & FMODE_WRITE)
-                inode->i_pipe->writers++;
+
+        if (inode->i_pipe) {
+                ret = 0;
+                if (filp->f_mode & FMODE_READ)
+                        inode->i_pipe->readers++;
+                if (filp->f_mode & FMODE_WRITE)
+                        inode->i_pipe->writers++;
+        }
+
         mutex_unlock(&inode->i_mutex);
 
-        return 0;
+        return ret;
 }
 
 /*
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 07f77a7945c3..822c2d506518 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -571,7 +571,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                 rsslim,
                 mm ? mm->start_code : 0,
                 mm ? mm->end_code : 0,
-                (permitted) ? task->stack_start : 0,
+                (permitted && mm) ? task->stack_start : 0,
                 esp,
                 eip,
                 /* The signal information here is obsolete.
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 837469a96598..af643b5aefe8 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2597,8 +2597,7 @@ static void proc_flush_task_mnt(struct vfsmount *mnt, pid_t pid, pid_t tgid)
         name.len = snprintf(buf, sizeof(buf), "%d", pid);
         dentry = d_hash_and_lookup(mnt->mnt_root, &name);
         if (dentry) {
-                if (!(current->flags & PF_EXITING))
-                        shrink_dcache_parent(dentry);
+                shrink_dcache_parent(dentry);
                 d_drop(dentry);
                 dput(dentry);
         }
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index 56013371f9f3..a44a7897fd4d 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -23,7 +23,6 @@
 #include <asm/io.h>
 #include <linux/list.h>
 #include <linux/ioport.h>
-#include <linux/mm.h>
 #include <linux/memory.h>
 #include <asm/sections.h>
 
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index c7bff4f603ff..a65239cfd97e 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -99,7 +99,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
                 "VmallocUsed:    %8lu kB\n"
                 "VmallocChunk:   %8lu kB\n"
 #ifdef CONFIG_MEMORY_FAILURE
-                "HardwareCorrupted: %8lu kB\n"
+                "HardwareCorrupted: %5lu kB\n"
 #endif
                 ,
                 K(i.totalram),
diff --git a/fs/proc/page.c b/fs/proc/page.c
index 2281c2cbfe2b..5033ce0d254b 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -94,6 +94,7 @@ static const struct file_operations proc_kpagecount_operations = {
 #define KPF_COMPOUND_TAIL       16
 #define KPF_HUGE                17
 #define KPF_UNEVICTABLE         18
+#define KPF_HWPOISON            19
 #define KPF_NOPAGE              20
 
 #define KPF_KSM                 21
@@ -180,6 +181,10 @@ static u64 get_uflags(struct page *page)
         u |= kpf_copy_bit(k, KPF_UNEVICTABLE,   PG_unevictable);
         u |= kpf_copy_bit(k, KPF_MLOCKED,       PG_mlocked);
 
+#ifdef CONFIG_MEMORY_FAILURE
+        u |= kpf_copy_bit(k, KPF_HWPOISON,      PG_hwpoison);
+#endif
+
 #ifdef CONFIG_IA64_UNCACHED_ALLOCATOR
         u |= kpf_copy_bit(k, KPF_UNCACHED,      PG_uncached);
 #endif
diff --git a/fs/romfs/storage.c b/fs/romfs/storage.c
index b3208adf8e71..71e2b4d50a0a 100644
--- a/fs/romfs/storage.c
+++ b/fs/romfs/storage.c
@@ -253,11 +253,11 @@ ssize_t romfs_dev_strnlen(struct super_block *sb,
 
 #ifdef CONFIG_ROMFS_ON_MTD
         if (sb->s_mtd)
-                return romfs_mtd_strnlen(sb, pos, limit);
+                return romfs_mtd_strnlen(sb, pos, maxlen);
 #endif
 #ifdef CONFIG_ROMFS_ON_BLOCK
         if (sb->s_bdev)
-                return romfs_blk_strnlen(sb, pos, limit);
+                return romfs_blk_strnlen(sb, pos, maxlen);
 #endif
         return -EIO;
 }
diff --git a/fs/select.c b/fs/select.c
index a201fc370223..fd38ce2e32e3 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -15,6 +15,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/sched.h>
 #include <linux/syscalls.h>
 #include <linux/module.h>
 #include <linux/slab.h>
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 0050fc40e8c9..e0201837d244 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -21,6 +21,7 @@
 #include <linux/completion.h>
 #include <linux/mutex.h>
 #include <linux/slab.h>
+#include <linux/security.h>
 #include "sysfs.h"
 
 DEFINE_MUTEX(sysfs_mutex);
@@ -285,6 +286,9 @@ void release_sysfs_dirent(struct sysfs_dirent * sd)
                 sysfs_put(sd->s_symlink.target_sd);
         if (sysfs_type(sd) & SYSFS_COPY_NAME)
                 kfree(sd->s_name);
+        if (sd->s_iattr && sd->s_iattr->ia_secdata)
+                security_release_secctx(sd->s_iattr->ia_secdata,
+                                        sd->s_iattr->ia_secdata_len);
         kfree(sd->s_iattr);
         sysfs_free_ino(sd->s_ino);
         kmem_cache_free(sysfs_dir_cachep, sd);
@@ -894,7 +898,8 @@ int sysfs_move_dir(struct kobject *kobj, struct kobject *new_parent_kobj)
 
         mutex_lock(&sysfs_rename_mutex);
         BUG_ON(!sd->s_parent);
-        new_parent_sd = new_parent_kobj->sd ? new_parent_kobj->sd : &sysfs_root;
+        new_parent_sd = (new_parent_kobj && new_parent_kobj->sd) ?
+                new_parent_kobj->sd : &sysfs_root;
 
         error = 0;
         if (sd->s_parent == new_parent_sd)
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 561a9c050cef..f5ea4680f15f 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -268,7 +268,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
         struct sysfs_open_dirent *od, *new_od = NULL;
 
  retry:
-        spin_lock(&sysfs_open_dirent_lock);
+        spin_lock_irq(&sysfs_open_dirent_lock);
 
         if (!sd->s_attr.open && new_od) {
                 sd->s_attr.open = new_od;
@@ -281,7 +281,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
                 list_add_tail(&buffer->list, &od->buffers);
         }
 
-        spin_unlock(&sysfs_open_dirent_lock);
+        spin_unlock_irq(&sysfs_open_dirent_lock);
 
         if (od) {
                 kfree(new_od);
@@ -315,8 +315,9 @@ static void sysfs_put_open_dirent(struct sysfs_dirent *sd,
                                   struct sysfs_buffer *buffer)
 {
         struct sysfs_open_dirent *od = sd->s_attr.open;
+        unsigned long flags;
 
-        spin_lock(&sysfs_open_dirent_lock);
+        spin_lock_irqsave(&sysfs_open_dirent_lock, flags);
 
         list_del(&buffer->list);
         if (atomic_dec_and_test(&od->refcnt))
@@ -324,7 +325,7 @@ static void sysfs_put_open_dirent(struct sysfs_dirent *sd,
         else
                 od = NULL;
 
-        spin_unlock(&sysfs_open_dirent_lock);
+        spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags);
 
         kfree(od);
 }
@@ -456,8 +457,9 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
 void sysfs_notify_dirent(struct sysfs_dirent *sd)
 {
         struct sysfs_open_dirent *od;
+        unsigned long flags;
 
-        spin_lock(&sysfs_open_dirent_lock);
+        spin_lock_irqsave(&sysfs_open_dirent_lock, flags);
 
         od = sd->s_attr.open;
         if (od) {
@@ -465,7 +467,7 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)
                 wake_up_interruptible(&od->poll);
         }
 
-        spin_unlock(&sysfs_open_dirent_lock);
+        spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags);
 }
 EXPORT_SYMBOL_GPL(sysfs_notify_dirent);
 
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index 381854461b28..c2e30eea74dc 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -186,19 +186,37 @@ xfs_destroy_ioend(
 }
 
 /*
+ * If the end of the current ioend is beyond the current EOF,
+ * return the new EOF value, otherwise zero.
+ */
+STATIC xfs_fsize_t
+xfs_ioend_new_eof(
+        xfs_ioend_t             *ioend)
+{
+        xfs_inode_t             *ip = XFS_I(ioend->io_inode);
+        xfs_fsize_t             isize;
+        xfs_fsize_t             bsize;
+
+        bsize = ioend->io_offset + ioend->io_size;
+        isize = MAX(ip->i_size, ip->i_new_size);
+        isize = MIN(isize, bsize);
+        return isize > ip->i_d.di_size ? isize : 0;
+}
+
+/*
  * Update on-disk file size now that data has been written to disk.
  * The current in-memory file size is i_size.  If a write is beyond
  * eof i_new_size will be the intended file size until i_size is
  * updated.  If this write does not extend all the way to the valid
  * file size then restrict this update to the end of the write.
  */
+
 STATIC void
 xfs_setfilesize(
         xfs_ioend_t             *ioend)
 {
         xfs_inode_t             *ip = XFS_I(ioend->io_inode);
         xfs_fsize_t             isize;
-        xfs_fsize_t             bsize;
 
         ASSERT((ip->i_d.di_mode & S_IFMT) == S_IFREG);
         ASSERT(ioend->io_type != IOMAP_READ);
@@ -206,16 +224,10 @@ xfs_setfilesize(
         if (unlikely(ioend->io_error))
                 return;
 
-        bsize = ioend->io_offset + ioend->io_size;
-
         xfs_ilock(ip, XFS_ILOCK_EXCL);
-
-        isize = MAX(ip->i_size, ip->i_new_size);
-        isize = MIN(isize, bsize);
-
-        if (ip->i_d.di_size < isize) {
+        isize = xfs_ioend_new_eof(ioend);
+        if (isize) {
                 ip->i_d.di_size = isize;
-                ip->i_update_core = 1;
                 xfs_mark_inode_dirty_sync(ip);
         }
 
@@ -404,10 +416,16 @@ xfs_submit_ioend_bio(
         struct bio      *bio)
 {
         atomic_inc(&ioend->io_remaining);
-
         bio->bi_private = ioend;
         bio->bi_end_io = xfs_end_bio;
 
+        /*
+         * If the I/O is beyond EOF we mark the inode dirty immediately
+         * but don't update the inode size until I/O completion.
+         */
+        if (xfs_ioend_new_eof(ioend))
+                xfs_mark_inode_dirty_sync(XFS_I(ioend->io_inode));
+
         submit_bio(WRITE, bio);
         ASSERT(!bio_flagged(bio, BIO_EOPNOTSUPP));
         bio_put(bio);
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index 629370974e57..eff61e2732af 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -176,14 +176,7 @@ xfs_file_fsync(
         struct dentry           *dentry,
         int                     datasync)
 {
-        struct inode            *inode = dentry->d_inode;
-        struct xfs_inode        *ip = XFS_I(inode);
-        int                     error;
-
-        /* capture size updates in I/O completion before writing the inode. */
-        error = filemap_fdatawait(inode->i_mapping);
-        if (error)
-                return error;
+        struct xfs_inode        *ip = XFS_I(dentry->d_inode);
 
         xfs_iflags_clear(ip, XFS_ITRUNCATED);
         return -xfs_fsync(ip);
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index da0159d99f82..cd42ef78f6b5 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -57,19 +57,22 @@
 #include <linux/fiemap.h>
 
 /*
- * Bring the atime in the XFS inode uptodate.
- * Used before logging the inode to disk or when the Linux inode goes away.
+ * Bring the timestamps in the XFS inode uptodate.
+ *
+ * Used before writing the inode to disk.
  */
 void
-xfs_synchronize_atime(
+xfs_synchronize_times(
         xfs_inode_t     *ip)
 {
         struct inode    *inode = VFS_I(ip);
 
-        if (!(inode->i_state & I_CLEAR)) {
-                ip->i_d.di_atime.t_sec = (__int32_t)inode->i_atime.tv_sec;
-                ip->i_d.di_atime.t_nsec = (__int32_t)inode->i_atime.tv_nsec;
-        }
+        ip->i_d.di_atime.t_sec = (__int32_t)inode->i_atime.tv_sec;
+        ip->i_d.di_atime.t_nsec = (__int32_t)inode->i_atime.tv_nsec;
+        ip->i_d.di_ctime.t_sec = (__int32_t)inode->i_ctime.tv_sec;
+        ip->i_d.di_ctime.t_nsec = (__int32_t)inode->i_ctime.tv_nsec;
+        ip->i_d.di_mtime.t_sec = (__int32_t)inode->i_mtime.tv_sec;
+        ip->i_d.di_mtime.t_nsec = (__int32_t)inode->i_mtime.tv_nsec;
 }
 
 /*
@@ -106,32 +109,20 @@ xfs_ichgtime(
         if ((flags & XFS_ICHGTIME_MOD) &&
             !timespec_equal(&inode->i_mtime, &tv)) {
                 inode->i_mtime = tv;
-                ip->i_d.di_mtime.t_sec = (__int32_t)tv.tv_sec;
-                ip->i_d.di_mtime.t_nsec = (__int32_t)tv.tv_nsec;
                 sync_it = 1;
         }
         if ((flags & XFS_ICHGTIME_CHG) &&
             !timespec_equal(&inode->i_ctime, &tv)) {
                 inode->i_ctime = tv;
-                ip->i_d.di_ctime.t_sec = (__int32_t)tv.tv_sec;
-                ip->i_d.di_ctime.t_nsec = (__int32_t)tv.tv_nsec;
                 sync_it = 1;
         }
 
         /*
-         * We update the i_update_core field _after_ changing
-         * the timestamps in order to coordinate properly with
-         * xfs_iflush() so that we don't lose timestamp updates.
-         * This keeps us from having to hold the inode lock
-         * while doing this.  We use the SYNCHRONIZE macro to
-         * ensure that the compiler does not reorder the update
-         * of i_update_core above the timestamp updates above.
+         * Update complete - now make sure everyone knows that the inode
+         * is dirty.
          */
-        if (sync_it) {
-                SYNCHRONIZE();
-                ip->i_update_core = 1;
+        if (sync_it)
                 xfs_mark_inode_dirty_sync(ip);
-        }
 }
 
 /*
@@ -506,10 +497,8 @@ xfs_vn_getattr(
         stat->gid = ip->i_d.di_gid;
         stat->ino = ip->i_ino;
         stat->atime = inode->i_atime;
-        stat->mtime.tv_sec = ip->i_d.di_mtime.t_sec;
-        stat->mtime.tv_nsec = ip->i_d.di_mtime.t_nsec;
-        stat->ctime.tv_sec = ip->i_d.di_ctime.t_sec;
-        stat->ctime.tv_nsec = ip->i_d.di_ctime.t_nsec;
+        stat->mtime = inode->i_mtime;
+        stat->ctime = inode->i_ctime;
         stat->blocks =
                 XFS_FSB_TO_BB(mp, ip->i_d.di_nblocks + ip->i_delayed_blks);
 
diff --git a/fs/xfs/linux-2.6/xfs_lrw.c b/fs/xfs/linux-2.6/xfs_lrw.c
index 49e4a6aea73c..072050f8d346 100644
--- a/fs/xfs/linux-2.6/xfs_lrw.c
+++ b/fs/xfs/linux-2.6/xfs_lrw.c
@@ -667,7 +667,7 @@ start:
                 xip->i_new_size = new_size;
 
         if (likely(!(ioflags & IO_INVIS)))
-                xfs_ichgtime(xip, XFS_ICHGTIME_MOD | XFS_ICHGTIME_CHG);
+                file_update_time(file);
 
         /*
          * If the offset is beyond the size of the file, we have a couple
diff --git a/fs/xfs/linux-2.6/xfs_quotaops.c b/fs/xfs/linux-2.6/xfs_quotaops.c
index 9e41f91aa269..3d4a0c84d634 100644
--- a/fs/xfs/linux-2.6/xfs_quotaops.c
+++ b/fs/xfs/linux-2.6/xfs_quotaops.c
@@ -80,7 +80,7 @@ xfs_fs_set_xstate(
 
         if (sb->s_flags & MS_RDONLY)
                 return -EROFS;
-        if (!XFS_IS_QUOTA_RUNNING(mp))
+        if (op != Q_XQUOTARM && !XFS_IS_QUOTA_RUNNING(mp))
                 return -ENOSYS;
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index bdd41c8c342f..18a4b8e11df2 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -977,6 +977,28 @@ xfs_fs_inode_init_once(
 }
 
 /*
+ * Dirty the XFS inode when mark_inode_dirty_sync() is called so that
+ * we catch unlogged VFS level updates to the inode. Care must be taken
+ * here - the transaction code calls mark_inode_dirty_sync() to mark the
+ * VFS inode dirty in a transaction and clears the i_update_core field;
+ * it must clear the field after calling mark_inode_dirty_sync() to
+ * correctly indicate that the dirty state has been propagated into the
+ * inode log item.
+ *
+ * We need the barrier() to maintain correct ordering between unlogged
+ * updates and the transaction commit code that clears the i_update_core
+ * field. This requires all updates to be completed before marking the
+ * inode dirty.
+ */
+STATIC void
+xfs_fs_dirty_inode(
+        struct inode    *inode)
+{
+        barrier();
+        XFS_I(inode)->i_update_core = 1;
+}
+
+/*
  * Attempt to flush the inode, this will actually fail
  * if the inode is pinned, but we dirty the inode again
  * at the point when it is unpinned after a log write,
@@ -1126,7 +1148,7 @@ xfs_fs_put_super(
 }
 
 STATIC int
-xfs_fs_sync_super(
+xfs_fs_sync_fs(
         struct super_block      *sb,
         int                     wait)
 {
@@ -1134,23 +1156,23 @@ xfs_fs_sync_super(
         int                     error;
 
         /*
-         * Treat a sync operation like a freeze.  This is to work
-         * around a race in sync_inodes() which works in two phases
-         * - an asynchronous flush, which can write out an inode
-         * without waiting for file size updates to complete, and a
-         * synchronous flush, which wont do anything because the
-         * async flush removed the inode's dirty flag.  Also
-         * sync_inodes() will not see any files that just have
-         * outstanding transactions to be flushed because we don't
-         * dirty the Linux inode until after the transaction I/O
-         * completes.
+         * Not much we can do for the first async pass.  Writing out the
+         * superblock would be counter-productive as we are going to redirty
+         * when writing out other data and metadata (and writing out a single
+         * block is quite fast anyway).
+         *
+         * Try to asynchronously kick off quota syncing at least.
          */
-        if (wait || unlikely(sb->s_frozen == SB_FREEZE_WRITE))
-                error = xfs_quiesce_data(mp);
-        else
-                error = xfs_sync_fsdata(mp, 0);
+        if (!wait) {
+                xfs_qm_sync(mp, SYNC_TRYLOCK);
+                return 0;
+        }
+
+        error = xfs_quiesce_data(mp);
+        if (error)
+                return -error;
 
-        if (unlikely(laptop_mode)) {
+        if (laptop_mode) {
                 int     prev_sync_seq = mp->m_sync_seq;
 
                 /*
@@ -1169,7 +1191,7 @@ xfs_fs_sync_super(
                                 mp->m_sync_seq != prev_sync_seq);
         }
 
-        return -error;
+        return 0;
 }
 
 STATIC int
@@ -1539,10 +1561,11 @@ xfs_fs_get_sb(
 static const struct super_operations xfs_super_operations = {
         .alloc_inode            = xfs_fs_alloc_inode,
         .destroy_inode          = xfs_fs_destroy_inode,
+        .dirty_inode            = xfs_fs_dirty_inode,
         .write_inode            = xfs_fs_write_inode,
         .clear_inode            = xfs_fs_clear_inode,
         .put_super              = xfs_fs_put_super,
-        .sync_fs                = xfs_fs_sync_super,
+        .sync_fs                = xfs_fs_sync_fs,
         .freeze_fs              = xfs_fs_freeze,
         .statfs                 = xfs_fs_statfs,
         .remount_fs             = xfs_fs_remount,
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 320be6aea492..961df0a22c78 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -309,11 +309,15 @@ xfs_sync_attr(
 STATIC int
 xfs_commit_dummy_trans(
         struct xfs_mount        *mp,
-        uint                    log_flags)
+        uint                    flags)
 {
         struct xfs_inode        *ip = mp->m_rootip;
         struct xfs_trans        *tp;
         int                     error;
+        int                     log_flags = XFS_LOG_FORCE;
+
+        if (flags & SYNC_WAIT)
+                log_flags |= XFS_LOG_SYNC;
 
         /*
          * Put a dummy transaction in the log to tell recovery
@@ -331,13 +335,12 @@ xfs_commit_dummy_trans(
         xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
         xfs_trans_ihold(tp, ip);
         xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-        /* XXX(hch): ignoring the error here.. */
         error = xfs_trans_commit(tp, 0);
-
         xfs_iunlock(ip, XFS_ILOCK_EXCL);
 
+        /* the log force ensures this transaction is pushed to disk */
         xfs_log_force(mp, 0, log_flags);
-        return 0;
+        return error;
 }
 
 int
@@ -385,7 +388,20 @@ xfs_sync_fsdata(
         else
                 XFS_BUF_ASYNC(bp);
 
-        return xfs_bwrite(mp, bp);
+        error = xfs_bwrite(mp, bp);
+        if (error)
+                return error;
+
+        /*
+         * If this is a data integrity sync make sure all pending buffers
+         * are flushed out for the log coverage check below.
+         */
+        if (flags & SYNC_WAIT)
+                xfs_flush_buftarg(mp->m_ddev_targp, 1);
+
+        if (xfs_log_need_covered(mp))
+                error = xfs_commit_dummy_trans(mp, flags);
+        return error;
 
  out_brelse:
         xfs_buf_relse(bp);
@@ -419,14 +435,16 @@ xfs_quiesce_data(
         /* push non-blocking */
         xfs_sync_data(mp, 0);
         xfs_qm_sync(mp, SYNC_TRYLOCK);
-        xfs_filestream_flush(mp);
 
-        /* push and block */
+        /* push and block till complete */
         xfs_sync_data(mp, SYNC_WAIT);
         xfs_qm_sync(mp, SYNC_WAIT);
 
+        /* drop inode references pinned by filestreams */
+        xfs_filestream_flush(mp);
+
         /* write superblock and hoover up shutdown errors */
-        error = xfs_sync_fsdata(mp, 0);
+        error = xfs_sync_fsdata(mp, SYNC_WAIT);
 
         /* flush data-only devices */
         if (mp->m_rtdev_targp)
@@ -570,8 +588,6 @@ xfs_sync_worker(
                 /* dgc: errors ignored here */
                 error = xfs_qm_sync(mp, SYNC_TRYLOCK);
                 error = xfs_sync_fsdata(mp, SYNC_TRYLOCK);
-                if (xfs_log_need_covered(mp))
-                        error = xfs_commit_dummy_trans(mp, XFS_LOG_FORCE);
         }
         mp->m_sync_seq++;
         wake_up(&mp->m_wait_single_sync_task);
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 4e4276b956e8..5d1a3b98a6e6 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -876,7 +876,6 @@ xfs_dqrele_inode(
                 ip->i_gdquot = NULL;
         }
         xfs_iput(ip, XFS_ILOCK_EXCL);
-        IRELE(ip);
 
         return 0;
 }
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 7465f9ee125f..ab89a7e94a0f 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -206,10 +206,10 @@ xfs_swap_extents(
          * process that the file was not changed out from
          * under it.
          */
-        if ((sbp->bs_ctime.tv_sec != ip->i_d.di_ctime.t_sec) ||
-            (sbp->bs_ctime.tv_nsec != ip->i_d.di_ctime.t_nsec) ||
-            (sbp->bs_mtime.tv_sec != ip->i_d.di_mtime.t_sec) ||
-            (sbp->bs_mtime.tv_nsec != ip->i_d.di_mtime.t_nsec)) {
+        if ((sbp->bs_ctime.tv_sec != VFS_I(ip)->i_ctime.tv_sec) ||
+            (sbp->bs_ctime.tv_nsec != VFS_I(ip)->i_ctime.tv_nsec) ||
+            (sbp->bs_mtime.tv_sec != VFS_I(ip)->i_mtime.tv_sec) ||
+            (sbp->bs_mtime.tv_nsec != VFS_I(ip)->i_mtime.tv_nsec)) {
                 error = XFS_ERROR(EBUSY);
                 goto out_unlock;
         }
diff --git a/fs/xfs/xfs_dir2_leaf.c b/fs/xfs/xfs_dir2_leaf.c
index fa913e459442..41ad537c49e9 100644
--- a/fs/xfs/xfs_dir2_leaf.c
+++ b/fs/xfs/xfs_dir2_leaf.c
@@ -854,6 +854,7 @@ xfs_dir2_leaf_getdents(
                          */
                         ra_want = howmany(bufsize + mp->m_dirblksize,
                                           mp->m_sb.sb_blocksize) - 1;
+                        ASSERT(ra_want >= 0);
 
                         /*
                          * If we don't have as many as we want, and we haven't
@@ -1088,7 +1089,8 @@ xfs_dir2_leaf_getdents(
                  */
                 ptr += length;
                 curoff += length;
-                bufsize -= length;
+                /* bufsize may have just been a guess; don't go negative */
+                bufsize = bufsize > length ? bufsize - length : 0;
         }
 
         /*
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index ab64f3efb43b..0785797db828 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -880,6 +880,7 @@ nextag:
                                  * Not in range - save last search
                                  * location and allocate a new inode
                                  */
+                                xfs_btree_del_cursor(tcur, XFS_BTREE_NOERROR);
                                 pag->pagl_leftrec = trec.ir_startino;
                                 pag->pagl_rightrec = rec.ir_startino;
                                 pag->pagl_pagino = pagino;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index c1dc7ef5a1d8..b92a4fa2a0a1 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -3068,9 +3068,9 @@ xfs_iflush_int(
         SYNCHRONIZE();
 
         /*
-         * Make sure to get the latest atime from the Linux inode.
+         * Make sure to get the latest timestamps from the Linux inode.
          */
-        xfs_synchronize_atime(ip);
+        xfs_synchronize_times(ip);
 
         if (XFS_TEST_ERROR(be16_to_cpu(dip->di_magic) != XFS_DINODE_MAGIC,
                                mp, XFS_ERRTAG_IFLUSH_1, XFS_RANDOM_IFLUSH_1)) {
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 0b38b9a869ec..41555de1d1db 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -504,7 +504,7 @@ void		xfs_ichgtime(xfs_inode_t *, int);
 void            xfs_lock_inodes(xfs_inode_t **, int, uint);
 void            xfs_lock_two_inodes(xfs_inode_t *, xfs_inode_t *, uint);
 
-void            xfs_synchronize_atime(xfs_inode_t *);
+void            xfs_synchronize_times(xfs_inode_t *);
 void            xfs_mark_inode_dirty_sync(xfs_inode_t *);
 
 #if defined(XFS_INODE_TRACE)
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 47d5b663c37e..9794b876d6ff 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -232,6 +232,15 @@ xfs_inode_item_format(
         nvecs        = 1;
 
         /*
+         * Make sure the linux inode is dirty. We do this before
+         * clearing i_update_core as the VFS will call back into
+         * XFS here and set i_update_core, so we need to dirty the
+         * inode first so that the ordering of i_update_core and
+         * unlogged modifications still works as described below.
+         */
+        xfs_mark_inode_dirty_sync(ip);
+
+        /*
          * Clear i_update_core if the timestamps (or any other
          * non-transactional modification) need flushing/logging
          * and we're about to log them with the rest of the core.
@@ -263,14 +272,9 @@ xfs_inode_item_format(
         }
 
         /*
-         * Make sure to get the latest atime from the Linux inode.
+         * Make sure to get the latest timestamps from the Linux inode.
          */
-        xfs_synchronize_atime(ip);
-
-        /*
-         * make sure the linux inode is dirty
-         */
-        xfs_mark_inode_dirty_sync(ip);
+        xfs_synchronize_times(ip);
 
         vecp->i_addr = (xfs_caddr_t)&ip->i_d;
         vecp->i_len  = sizeof(struct xfs_icdinode);
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index b68f9107e26c..62efab2f3839 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -59,6 +59,7 @@ xfs_bulkstat_one_iget(
 {
         xfs_icdinode_t  *dic;   /* dinode core info pointer */
         xfs_inode_t     *ip;            /* incore inode pointer */
+        struct inode    *inode;
         int             error;
 
         error = xfs_iget(mp, NULL, ino,
@@ -72,6 +73,7 @@ xfs_bulkstat_one_iget(
         ASSERT(ip->i_imap.im_blkno != 0);
 
         dic = &ip->i_d;
+        inode = VFS_I(ip);
 
         /* xfs_iget returns the following without needing
          * further change.
@@ -83,16 +85,19 @@ xfs_bulkstat_one_iget(
         buf->bs_uid = dic->di_uid;
         buf->bs_gid = dic->di_gid;
         buf->bs_size = dic->di_size;
+
         /*
-         * We are reading the atime from the Linux inode because the
-         * dinode might not be uptodate.
+         * We need to read the timestamps from the Linux inode because
+         * the VFS keeps writing directly into the inode structure instead
+         * of telling us about the updates.
          */
-        buf->bs_atime.tv_sec = VFS_I(ip)->i_atime.tv_sec;
-        buf->bs_atime.tv_nsec = VFS_I(ip)->i_atime.tv_nsec;
-        buf->bs_mtime.tv_sec = dic->di_mtime.t_sec;
-        buf->bs_mtime.tv_nsec = dic->di_mtime.t_nsec;
-        buf->bs_ctime.tv_sec = dic->di_ctime.t_sec;
-        buf->bs_ctime.tv_nsec = dic->di_ctime.t_nsec;
+        buf->bs_atime.tv_sec = inode->i_atime.tv_sec;
+        buf->bs_atime.tv_nsec = inode->i_atime.tv_nsec;
+        buf->bs_mtime.tv_sec = inode->i_mtime.tv_sec;
+        buf->bs_mtime.tv_nsec = inode->i_mtime.tv_nsec;
+        buf->bs_ctime.tv_sec = inode->i_ctime.tv_sec;
+        buf->bs_ctime.tv_nsec = inode->i_ctime.tv_nsec;
+
         buf->bs_xflags = xfs_ip2xflags(ip);
         buf->bs_extsize = dic->di_extsize << mp->m_sb.sb_blocklog;
         buf->bs_extents = dic->di_nextents;
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 1099395d7d6c..fb17f8226b09 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1980,7 +1980,7 @@ xlog_recover_do_reg_buffer(
                                         "XFS: NULL dquot in %s.", __func__);
                                 goto next;
                         }
-                        if (item->ri_buf[i].i_len < sizeof(xfs_dqblk_t)) {
+                        if (item->ri_buf[i].i_len < sizeof(xfs_disk_dquot_t)) {
                                 cmn_err(CE_ALERT,
                                         "XFS: dquot too small (%d) in %s.",
                                         item->ri_buf[i].i_len, __func__);
@@ -2635,7 +2635,7 @@ xlog_recover_do_dquot_trans(
                         "XFS: NULL dquot in %s.", __func__);
                 return XFS_ERROR(EIO);
         }
-        if (item->ri_buf[1].i_len < sizeof(xfs_dqblk_t)) {
+        if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) {
                 cmn_err(CE_ALERT,
                         "XFS: dquot too small (%d) in %s.",
                         item->ri_buf[1].i_len, __func__);
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index f31271c30de9..2ffc570679be 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -467,6 +467,7 @@ xfs_trans_ail_update(
 {
         xfs_log_item_t          *dlip = NULL;
         xfs_log_item_t          *mlip;  /* ptr to minimum lip */
+        xfs_lsn_t               tail_lsn;
 
         mlip = xfs_ail_min(ailp);
 
@@ -483,8 +484,16 @@ xfs_trans_ail_update(
 
         if (mlip == dlip) {
                 mlip = xfs_ail_min(ailp);
+                /*
+                 * It is not safe to access mlip after the AIL lock is
+                 * dropped, so we must get a copy of li_lsn before we do
+                 * so.  This is especially important on 32-bit platforms
+                 * where accessing and updating 64-bit values like li_lsn
+                 * is not atomic.
+                 */
+                tail_lsn = mlip->li_lsn;
                 spin_unlock(&ailp->xa_lock);
-                xfs_log_move_tail(ailp->xa_mount, mlip->li_lsn);
+                xfs_log_move_tail(ailp->xa_mount, tail_lsn);
         } else {
                 spin_unlock(&ailp->xa_lock);
         }
@@ -514,6 +523,7 @@ xfs_trans_ail_delete(
 {
         xfs_log_item_t          *dlip;
         xfs_log_item_t          *mlip;
+        xfs_lsn_t               tail_lsn;
 
         if (lip->li_flags & XFS_LI_IN_AIL) {
                 mlip = xfs_ail_min(ailp);
@@ -527,9 +537,16 @@ xfs_trans_ail_delete(
 
                 if (mlip == dlip) {
                         mlip = xfs_ail_min(ailp);
+                        /*
+                         * It is not safe to access mlip after the AIL lock
+                         * is dropped, so we must get a copy of li_lsn
+                         * before we do so.  This is especially important
+                         * on 32-bit platforms where accessing and updating
+                         * 64-bit values like li_lsn is not atomic.
+                         */
+                        tail_lsn = mlip ? mlip->li_lsn : 0;
                         spin_unlock(&ailp->xa_lock);
-                        xfs_log_move_tail(ailp->xa_mount,
-                                                (mlip ? mlip->li_lsn : 0));
+                        xfs_log_move_tail(ailp->xa_mount, tail_lsn);
                 } else {
                         spin_unlock(&ailp->xa_lock);
                 }
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index a434f287962d..b572f7e840e0 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -2476,12 +2476,6 @@ xfs_reclaim(
         ASSERT(XFS_FORCED_SHUTDOWN(ip->i_mount) || ip->i_delayed_blks == 0);
 
         /*
-         * Make sure the atime in the XFS inode is correct before freeing the
-         * Linux inode.
-         */
-        xfs_synchronize_atime(ip);
-
-        /*
          * If we have nothing to flush with this inode then complete the
          * teardown now, otherwise break the link between the xfs inode and the
          * linux inode and clean up the xfs inode later. This avoids flushing