131 files changed, 9750 insertions, 2416 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 78c514cfd212..969beb0e2231 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -476,14 +476,21 @@ static void kiocb_batch_init(struct kiocb_batch *batch, long total)
         batch->count = total;
 }
 
-static void kiocb_batch_free(struct kiocb_batch *batch)
+static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
 {
         struct kiocb *req, *n;
 
+        if (list_empty(&batch->head))
+                return;
+
+        spin_lock_irq(&ctx->ctx_lock);
         list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
                 list_del(&req->ki_batch);
+                list_del(&req->ki_list);
                 kmem_cache_free(kiocb_cachep, req);
+                ctx->reqs_active--;
         }
+        spin_unlock_irq(&ctx->ctx_lock);
 }
 
 /*
@@ -1742,7 +1749,7 @@ long do_io_submit(aio_context_t ctx_id, long nr,
         }
         blk_finish_plug(&plug);
 
-        kiocb_batch_free(&batch);
+        kiocb_batch_free(ctx, &batch);
         put_ioctx(ctx);
         return i ? i : ret;
 }
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 9ef5b2914407..da8876d38a7b 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -76,7 +76,7 @@ static int autofs4_write(struct autofs_sb_info *sbi,
                 data += wr;
                 bytes -= wr;
         }
-        mutex_lock(&sbi->pipe_mutex);
+        mutex_unlock(&sbi->pipe_mutex);
 
         set_fs(fs);
 
diff --git a/fs/block_dev.c b/fs/block_dev.c
index afe74dda632b..0e575d1304b4 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1139,6 +1139,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
         mutex_lock_nested(&bdev->bd_mutex, for_part);
         if (!bdev->bd_openers) {
                 bdev->bd_disk = disk;
+                bdev->bd_queue = disk->queue;
                 bdev->bd_contains = bdev;
                 if (!partno) {
                         struct backing_dev_info *bdi;
@@ -1159,6 +1160,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                         disk_put_part(bdev->bd_part);
                                         bdev->bd_part = NULL;
                                         bdev->bd_disk = NULL;
+                                        bdev->bd_queue = NULL;
                                         mutex_unlock(&bdev->bd_mutex);
                                         disk_unblock_events(disk);
                                         put_disk(disk);
@@ -1232,6 +1234,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
         disk_put_part(bdev->bd_part);
         bdev->bd_disk = NULL;
         bdev->bd_part = NULL;
+        bdev->bd_queue = NULL;
         bdev_inode_switch_bdi(bdev->bd_inode, &default_backing_dev_info);
         if (bdev != bdev->bd_contains)
                 __blkdev_put(bdev->bd_contains, mode, 1);
diff --git a/fs/btrfs/Kconfig b/fs/btrfs/Kconfig
index ecb9fd3be143..d33f01c08b60 100644
--- a/fs/btrfs/Kconfig
+++ b/fs/btrfs/Kconfig
@@ -31,3 +31,22 @@ config BTRFS_FS_POSIX_ACL
           Linux website <http://acl.bestbits.at/>.
 
           If you don't know what Access Control Lists are, say N
+
+config BTRFS_FS_CHECK_INTEGRITY
+        bool "Btrfs with integrity check tool compiled in (DANGEROUS)"
+        depends on BTRFS_FS
+        help
+          Adds code that examines all block write requests (including
+          writes of the super block). The goal is to verify that the
+          state of the filesystem on disk is always consistent, i.e.,
+          after a power-loss or kernel panic event the filesystem is
+          in a consistent state.
+
+          If the integrity check tool is included and activated in
+          the mount options, plenty of kernel memory is used, and
+          plenty of additional CPU cycles are spent. Enabling this
+          functionality is not intended for normal use.
+
+          In most cases, unless you are a btrfs developer who needs
+          to verify the integrity of (super)-block write requests
+          during the run of a regression test, say N
diff --git a/fs/btrfs/Makefile b/fs/btrfs/Makefile
index c0ddfd29c5e5..0c4fa2befae7 100644
--- a/fs/btrfs/Makefile
+++ b/fs/btrfs/Makefile
@@ -8,6 +8,7 @@ btrfs-y += super.o ctree.o extent-tree.o print-tree.o root-tree.o dir-item.o \
            extent_io.o volumes.o async-thread.o ioctl.o locking.o orphan.o \
            export.o tree-log.o free-space-cache.o zlib.o lzo.o \
            compression.o delayed-ref.o relocation.o delayed-inode.o scrub.o \
-           reada.o backref.o
+           reada.o backref.o ulist.o
 
 btrfs-$(CONFIG_BTRFS_FS_POSIX_ACL) += acl.o
+btrfs-$(CONFIG_BTRFS_FS_CHECK_INTEGRITY) += check-integrity.o
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 22c64fff1bd5..b9a843226de8 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -19,18 +19,789 @@
 #include "ctree.h"
 #include "disk-io.h"
 #include "backref.h"
+#include "ulist.h"
+#include "transaction.h"
+#include "delayed-ref.h"
 
-struct __data_ref {
+/*
+ * this structure records all encountered refs on the way up to the root
+ */
+struct __prelim_ref {
         struct list_head list;
-        u64 inum;
-        u64 root;
-        u64 extent_data_item_offset;
+        u64 root_id;
+        struct btrfs_key key;
+        int level;
+        int count;
+        u64 parent;
+        u64 wanted_disk_byte;
 };
 
-struct __shared_ref {
-        struct list_head list;
+static int __add_prelim_ref(struct list_head *head, u64 root_id,
+                            struct btrfs_key *key, int level, u64 parent,
+                            u64 wanted_disk_byte, int count)
+{
+        struct __prelim_ref *ref;
+
+        /* in case we're adding delayed refs, we're holding the refs spinlock */
+        ref = kmalloc(sizeof(*ref), GFP_ATOMIC);
+        if (!ref)
+                return -ENOMEM;
+
+        ref->root_id = root_id;
+        if (key)
+                ref->key = *key;
+        else
+                memset(&ref->key, 0, sizeof(ref->key));
+
+        ref->level = level;
+        ref->count = count;
+        ref->parent = parent;
+        ref->wanted_disk_byte = wanted_disk_byte;
+        list_add_tail(&ref->list, head);
+
+        return 0;
+}
+
+static int add_all_parents(struct btrfs_root *root, struct btrfs_path *path,
+                                struct ulist *parents,
+                                struct extent_buffer *eb, int level,
+                                u64 wanted_objectid, u64 wanted_disk_byte)
+{
+        int ret;
+        int slot;
+        struct btrfs_file_extent_item *fi;
+        struct btrfs_key key;
         u64 disk_byte;
-};
+
+add_parent:
+        ret = ulist_add(parents, eb->start, 0, GFP_NOFS);
+        if (ret < 0)
+                return ret;
+
+        if (level != 0)
+                return 0;
+
+        /*
+         * if the current leaf is full with EXTENT_DATA items, we must
+         * check the next one if that holds a reference as well.
+         * ref->count cannot be used to skip this check.
+         * repeat this until we don't find any additional EXTENT_DATA items.
+         */
+        while (1) {
+                ret = btrfs_next_leaf(root, path);
+                if (ret < 0)
+                        return ret;
+                if (ret)
+                        return 0;
+
+                eb = path->nodes[0];
+                for (slot = 0; slot < btrfs_header_nritems(eb); ++slot) {
+                        btrfs_item_key_to_cpu(eb, &key, slot);
+                        if (key.objectid != wanted_objectid ||
+                            key.type != BTRFS_EXTENT_DATA_KEY)
+                                return 0;
+                        fi = btrfs_item_ptr(eb, slot,
+                                                struct btrfs_file_extent_item);
+                        disk_byte = btrfs_file_extent_disk_bytenr(eb, fi);
+                        if (disk_byte == wanted_disk_byte)
+                                goto add_parent;
+                }
+        }
+
+        return 0;
+}
+
+/*
+ * resolve an indirect backref in the form (root_id, key, level)
+ * to a logical address
+ */
+static int __resolve_indirect_ref(struct btrfs_fs_info *fs_info,
+                                        struct __prelim_ref *ref,
+                                        struct ulist *parents)
+{
+        struct btrfs_path *path;
+        struct btrfs_root *root;
+        struct btrfs_key root_key;
+        struct btrfs_key key = {0};
+        struct extent_buffer *eb;
+        int ret = 0;
+        int root_level;
+        int level = ref->level;
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
+        root_key.objectid = ref->root_id;
+        root_key.type = BTRFS_ROOT_ITEM_KEY;
+        root_key.offset = (u64)-1;
+        root = btrfs_read_fs_root_no_name(fs_info, &root_key);
+        if (IS_ERR(root)) {
+                ret = PTR_ERR(root);
+                goto out;
+        }
+
+        rcu_read_lock();
+        root_level = btrfs_header_level(root->node);
+        rcu_read_unlock();
+
+        if (root_level + 1 == level)
+                goto out;
+
+        path->lowest_level = level;
+        ret = btrfs_search_slot(NULL, root, &ref->key, path, 0, 0);
+        pr_debug("search slot in root %llu (level %d, ref count %d) returned "
+                 "%d for key (%llu %u %llu)\n",
+                 (unsigned long long)ref->root_id, level, ref->count, ret,
+                 (unsigned long long)ref->key.objectid, ref->key.type,
+                 (unsigned long long)ref->key.offset);
+        if (ret < 0)
+                goto out;
+
+        eb = path->nodes[level];
+        if (!eb) {
+                WARN_ON(1);
+                ret = 1;
+                goto out;
+        }
+
+        if (level == 0) {
+                if (ret == 1 && path->slots[0] >= btrfs_header_nritems(eb)) {
+                        ret = btrfs_next_leaf(root, path);
+                        if (ret)
+                                goto out;
+                        eb = path->nodes[0];
+                }
+
+                btrfs_item_key_to_cpu(eb, &key, path->slots[0]);
+        }
+
+        /* the last two parameters will only be used for level == 0 */
+        ret = add_all_parents(root, path, parents, eb, level, key.objectid,
+                                ref->wanted_disk_byte);
+out:
+        btrfs_free_path(path);
+        return ret;
+}
+
+/*
+ * resolve all indirect backrefs from the list
+ */
+static int __resolve_indirect_refs(struct btrfs_fs_info *fs_info,
+                                   struct list_head *head)
+{
+        int err;
+        int ret = 0;
+        struct __prelim_ref *ref;
+        struct __prelim_ref *ref_safe;
+        struct __prelim_ref *new_ref;
+        struct ulist *parents;
+        struct ulist_node *node;
+
+        parents = ulist_alloc(GFP_NOFS);
+        if (!parents)
+                return -ENOMEM;
+
+        /*
+         * _safe allows us to insert directly after the current item without
+         * iterating over the newly inserted items.
+         * we're also allowed to re-assign ref during iteration.
+         */
+        list_for_each_entry_safe(ref, ref_safe, head, list) {
+                if (ref->parent)        /* already direct */
+                        continue;
+                if (ref->count == 0)
+                        continue;
+                err = __resolve_indirect_ref(fs_info, ref, parents);
+                if (err) {
+                        if (ret == 0)
+                                ret = err;
+                        continue;
+                }
+
+                /* we put the first parent into the ref at hand */
+                node = ulist_next(parents, NULL);
+                ref->parent = node ? node->val : 0;
+
+                /* additional parents require new refs being added here */
+                while ((node = ulist_next(parents, node))) {
+                        new_ref = kmalloc(sizeof(*new_ref), GFP_NOFS);
+                        if (!new_ref) {
+                                ret = -ENOMEM;
+                                break;
+                        }
+                        memcpy(new_ref, ref, sizeof(*ref));
+                        new_ref->parent = node->val;
+                        list_add(&new_ref->list, &ref->list);
+                }
+                ulist_reinit(parents);
+        }
+
+        ulist_free(parents);
+        return ret;
+}
+
+/*
+ * merge two lists of backrefs and adjust counts accordingly
+ *
+ * mode = 1: merge identical keys, if key is set
+ * mode = 2: merge identical parents
+ */
+static int __merge_refs(struct list_head *head, int mode)
+{
+        struct list_head *pos1;
+
+        list_for_each(pos1, head) {
+                struct list_head *n2;
+                struct list_head *pos2;
+                struct __prelim_ref *ref1;
+
+                ref1 = list_entry(pos1, struct __prelim_ref, list);
+
+                if (mode == 1 && ref1->key.type == 0)
+                        continue;
+                for (pos2 = pos1->next, n2 = pos2->next; pos2 != head;
+                     pos2 = n2, n2 = pos2->next) {
+                        struct __prelim_ref *ref2;
+
+                        ref2 = list_entry(pos2, struct __prelim_ref, list);
+
+                        if (mode == 1) {
+                                if (memcmp(&ref1->key, &ref2->key,
+                                           sizeof(ref1->key)) ||
+                                    ref1->level != ref2->level ||
+                                    ref1->root_id != ref2->root_id)
+                                        continue;
+                                ref1->count += ref2->count;
+                        } else {
+                                if (ref1->parent != ref2->parent)
+                                        continue;
+                                ref1->count += ref2->count;
+                        }
+                        list_del(&ref2->list);
+                        kfree(ref2);
+                }
+
+        }
+        return 0;
+}
+
+/*
+ * add all currently queued delayed refs from this head whose seq nr is
+ * smaller or equal that seq to the list
+ */
+static int __add_delayed_refs(struct btrfs_delayed_ref_head *head, u64 seq,
+                              struct btrfs_key *info_key,
+                              struct list_head *prefs)
+{
+        struct btrfs_delayed_extent_op *extent_op = head->extent_op;
+        struct rb_node *n = &head->node.rb_node;
+        int sgn;
+        int ret;
+
+        if (extent_op && extent_op->update_key)
+                btrfs_disk_key_to_cpu(info_key, &extent_op->key);
+
+        while ((n = rb_prev(n))) {
+                struct btrfs_delayed_ref_node *node;
+                node = rb_entry(n, struct btrfs_delayed_ref_node,
+                                rb_node);
+                if (node->bytenr != head->node.bytenr)
+                        break;
+                WARN_ON(node->is_head);
+
+                if (node->seq > seq)
+                        continue;
+
+                switch (node->action) {
+                case BTRFS_ADD_DELAYED_EXTENT:
+                case BTRFS_UPDATE_DELAYED_HEAD:
+                        WARN_ON(1);
+                        continue;
+                case BTRFS_ADD_DELAYED_REF:
+                        sgn = 1;
+                        break;
+                case BTRFS_DROP_DELAYED_REF:
+                        sgn = -1;
+                        break;
+                default:
+                        BUG_ON(1);
+                }
+                switch (node->type) {
+                case BTRFS_TREE_BLOCK_REF_KEY: {
+                        struct btrfs_delayed_tree_ref *ref;
+
+                        ref = btrfs_delayed_node_to_tree_ref(node);
+                        ret = __add_prelim_ref(prefs, ref->root, info_key,
+                                               ref->level + 1, 0, node->bytenr,
+                                               node->ref_mod * sgn);
+                        break;
+                }
+                case BTRFS_SHARED_BLOCK_REF_KEY: {
+                        struct btrfs_delayed_tree_ref *ref;
+
+                        ref = btrfs_delayed_node_to_tree_ref(node);
+                        ret = __add_prelim_ref(prefs, ref->root, info_key,
+                                               ref->level + 1, ref->parent,
+                                               node->bytenr,
+                                               node->ref_mod * sgn);
+                        break;
+                }
+                case BTRFS_EXTENT_DATA_REF_KEY: {
+                        struct btrfs_delayed_data_ref *ref;
+                        struct btrfs_key key;
+
+                        ref = btrfs_delayed_node_to_data_ref(node);
+
+                        key.objectid = ref->objectid;
+                        key.type = BTRFS_EXTENT_DATA_KEY;
+                        key.offset = ref->offset;
+                        ret = __add_prelim_ref(prefs, ref->root, &key, 0, 0,
+                                               node->bytenr,
+                                               node->ref_mod * sgn);
+                        break;
+                }
+                case BTRFS_SHARED_DATA_REF_KEY: {
+                        struct btrfs_delayed_data_ref *ref;
+                        struct btrfs_key key;
+
+                        ref = btrfs_delayed_node_to_data_ref(node);
+
+                        key.objectid = ref->objectid;
+                        key.type = BTRFS_EXTENT_DATA_KEY;
+                        key.offset = ref->offset;
+                        ret = __add_prelim_ref(prefs, ref->root, &key, 0,
+                                               ref->parent, node->bytenr,
+                                               node->ref_mod * sgn);
+                        break;
+                }
+                default:
+                        WARN_ON(1);
+                }
+                BUG_ON(ret);
+        }
+
+        return 0;
+}
+
+/*
+ * add all inline backrefs for bytenr to the list
+ */
+static int __add_inline_refs(struct btrfs_fs_info *fs_info,
+                             struct btrfs_path *path, u64 bytenr,
+                             struct btrfs_key *info_key, int *info_level,
+                             struct list_head *prefs)
+{
+        int ret;
+        int slot;
+        struct extent_buffer *leaf;
+        struct btrfs_key key;
+        unsigned long ptr;
+        unsigned long end;
+        struct btrfs_extent_item *ei;
+        u64 flags;
+        u64 item_size;
+
+        /*
+         * enumerate all inline refs
+         */
+        leaf = path->nodes[0];
+        slot = path->slots[0] - 1;
+
+        item_size = btrfs_item_size_nr(leaf, slot);
+        BUG_ON(item_size < sizeof(*ei));
+
+        ei = btrfs_item_ptr(leaf, slot, struct btrfs_extent_item);
+        flags = btrfs_extent_flags(leaf, ei);
+
+        ptr = (unsigned long)(ei + 1);
+        end = (unsigned long)ei + item_size;
+
+        if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) {
+                struct btrfs_tree_block_info *info;
+                struct btrfs_disk_key disk_key;
+
+                info = (struct btrfs_tree_block_info *)ptr;
+                *info_level = btrfs_tree_block_level(leaf, info);
+                btrfs_tree_block_key(leaf, info, &disk_key);
+                btrfs_disk_key_to_cpu(info_key, &disk_key);
+                ptr += sizeof(struct btrfs_tree_block_info);
+                BUG_ON(ptr > end);
+        } else {
+                BUG_ON(!(flags & BTRFS_EXTENT_FLAG_DATA));
+        }
+
+        while (ptr < end) {
+                struct btrfs_extent_inline_ref *iref;
+                u64 offset;
+                int type;
+
+                iref = (struct btrfs_extent_inline_ref *)ptr;
+                type = btrfs_extent_inline_ref_type(leaf, iref);
+                offset = btrfs_extent_inline_ref_offset(leaf, iref);
+
+                switch (type) {
+                case BTRFS_SHARED_BLOCK_REF_KEY:
+                        ret = __add_prelim_ref(prefs, 0, info_key,
+                                                *info_level + 1, offset,
+                                                bytenr, 1);
+                        break;
+                case BTRFS_SHARED_DATA_REF_KEY: {
+                        struct btrfs_shared_data_ref *sdref;
+                        int count;
+
+                        sdref = (struct btrfs_shared_data_ref *)(iref + 1);
+                        count = btrfs_shared_data_ref_count(leaf, sdref);
+                        ret = __add_prelim_ref(prefs, 0, NULL, 0, offset,
+                                               bytenr, count);
+                        break;
+                }
+                case BTRFS_TREE_BLOCK_REF_KEY:
+                        ret = __add_prelim_ref(prefs, offset, info_key,
+                                               *info_level + 1, 0, bytenr, 1);
+                        break;
+                case BTRFS_EXTENT_DATA_REF_KEY: {
+                        struct btrfs_extent_data_ref *dref;
+                        int count;
+                        u64 root;
+
+                        dref = (struct btrfs_extent_data_ref *)(&iref->offset);
+                        count = btrfs_extent_data_ref_count(leaf, dref);
+                        key.objectid = btrfs_extent_data_ref_objectid(leaf,
+                                                                      dref);
+                        key.type = BTRFS_EXTENT_DATA_KEY;
+                        key.offset = btrfs_extent_data_ref_offset(leaf, dref);
+                        root = btrfs_extent_data_ref_root(leaf, dref);
+                        ret = __add_prelim_ref(prefs, root, &key, 0, 0, bytenr,
+                                                count);
+                        break;
+                }
+                default:
+                        WARN_ON(1);
+                }
+                BUG_ON(ret);
+                ptr += btrfs_extent_inline_ref_size(type);
+        }
+
+        return 0;
+}
+
+/*
+ * add all non-inline backrefs for bytenr to the list
+ */
+static int __add_keyed_refs(struct btrfs_fs_info *fs_info,
+                            struct btrfs_path *path, u64 bytenr,
+                            struct btrfs_key *info_key, int info_level,
+                            struct list_head *prefs)
+{
+        struct btrfs_root *extent_root = fs_info->extent_root;
+        int ret;
+        int slot;
+        struct extent_buffer *leaf;
+        struct btrfs_key key;
+
+        while (1) {
+                ret = btrfs_next_item(extent_root, path);
+                if (ret < 0)
+                        break;
+                if (ret) {
+                        ret = 0;
+                        break;
+                }
+
+                slot = path->slots[0];
+                leaf = path->nodes[0];
+                btrfs_item_key_to_cpu(leaf, &key, slot);
+
+                if (key.objectid != bytenr)
+                        break;
+                if (key.type < BTRFS_TREE_BLOCK_REF_KEY)
+                        continue;
+                if (key.type > BTRFS_SHARED_DATA_REF_KEY)
+                        break;
+
+                switch (key.type) {
+                case BTRFS_SHARED_BLOCK_REF_KEY:
+                        ret = __add_prelim_ref(prefs, 0, info_key,
+                                                info_level + 1, key.offset,
+                                                bytenr, 1);
+                        break;
+                case BTRFS_SHARED_DATA_REF_KEY: {
+                        struct btrfs_shared_data_ref *sdref;
+                        int count;
+
+                        sdref = btrfs_item_ptr(leaf, slot,
+                                              struct btrfs_shared_data_ref);
+                        count = btrfs_shared_data_ref_count(leaf, sdref);
+                        ret = __add_prelim_ref(prefs, 0, NULL, 0, key.offset,
+                                                bytenr, count);
+                        break;
+                }
+                case BTRFS_TREE_BLOCK_REF_KEY:
+                        ret = __add_prelim_ref(prefs, key.offset, info_key,
+                                                info_level + 1, 0, bytenr, 1);
+                        break;
+                case BTRFS_EXTENT_DATA_REF_KEY: {
+                        struct btrfs_extent_data_ref *dref;
+                        int count;
+                        u64 root;
+
+                        dref = btrfs_item_ptr(leaf, slot,
+                                              struct btrfs_extent_data_ref);
+                        count = btrfs_extent_data_ref_count(leaf, dref);
+                        key.objectid = btrfs_extent_data_ref_objectid(leaf,
+                                                                      dref);
+                        key.type = BTRFS_EXTENT_DATA_KEY;
+                        key.offset = btrfs_extent_data_ref_offset(leaf, dref);
+                        root = btrfs_extent_data_ref_root(leaf, dref);
+                        ret = __add_prelim_ref(prefs, root, &key, 0, 0,
+                                                bytenr, count);
+                        break;
+                }
+                default:
+                        WARN_ON(1);
+                }
+                BUG_ON(ret);
+        }
+
+        return ret;
+}
+
+/*
+ * this adds all existing backrefs (inline backrefs, backrefs and delayed
+ * refs) for the given bytenr to the refs list, merges duplicates and resolves
+ * indirect refs to their parent bytenr.
+ * When roots are found, they're added to the roots list
+ *
+ * FIXME some caching might speed things up
+ */
+static int find_parent_nodes(struct btrfs_trans_handle *trans,
+                             struct btrfs_fs_info *fs_info, u64 bytenr,
+                             u64 seq, struct ulist *refs, struct ulist *roots)
+{
+        struct btrfs_key key;
+        struct btrfs_path *path;
+        struct btrfs_key info_key = { 0 };
+        struct btrfs_delayed_ref_root *delayed_refs = NULL;
+        struct btrfs_delayed_ref_head *head = NULL;
+        int info_level = 0;
+        int ret;
+        struct list_head prefs_delayed;
+        struct list_head prefs;
+        struct __prelim_ref *ref;
+
+        INIT_LIST_HEAD(&prefs);
+        INIT_LIST_HEAD(&prefs_delayed);
+
+        key.objectid = bytenr;
+        key.type = BTRFS_EXTENT_ITEM_KEY;
+        key.offset = (u64)-1;
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
+        /*
+         * grab both a lock on the path and a lock on the delayed ref head.
+         * We need both to get a consistent picture of how the refs look
+         * at a specified point in time
+         */
+again:
+        ret = btrfs_search_slot(trans, fs_info->extent_root, &key, path, 0, 0);
+        if (ret < 0)
+                goto out;
+        BUG_ON(ret == 0);
+
+        /*
+         * look if there are updates for this ref queued and lock the head
+         */
+        delayed_refs = &trans->transaction->delayed_refs;
+        spin_lock(&delayed_refs->lock);
+        head = btrfs_find_delayed_ref_head(trans, bytenr);
+        if (head) {
+                if (!mutex_trylock(&head->mutex)) {
+                        atomic_inc(&head->node.refs);
+                        spin_unlock(&delayed_refs->lock);
+
+                        btrfs_release_path(path);
+
+                        /*
+                         * Mutex was contended, block until it's
+                         * released and try again
+                         */
+                        mutex_lock(&head->mutex);
+                        mutex_unlock(&head->mutex);
+                        btrfs_put_delayed_ref(&head->node);
+                        goto again;
+                }
+                ret = __add_delayed_refs(head, seq, &info_key, &prefs_delayed);
+                if (ret)
+                        goto out;
+        }
+        spin_unlock(&delayed_refs->lock);
+
+        if (path->slots[0]) {
+                struct extent_buffer *leaf;
+                int slot;
+
+                leaf = path->nodes[0];
+                slot = path->slots[0] - 1;
+                btrfs_item_key_to_cpu(leaf, &key, slot);
+                if (key.objectid == bytenr &&
+                    key.type == BTRFS_EXTENT_ITEM_KEY) {
+                        ret = __add_inline_refs(fs_info, path, bytenr,
+                                                &info_key, &info_level, &prefs);
+                        if (ret)
+                                goto out;
+                        ret = __add_keyed_refs(fs_info, path, bytenr, &info_key,
+                                               info_level, &prefs);
+                        if (ret)
+                                goto out;
+                }
+        }
+        btrfs_release_path(path);
+
+        /*
+         * when adding the delayed refs above, the info_key might not have
+         * been known yet. Go over the list and replace the missing keys
+         */
+        list_for_each_entry(ref, &prefs_delayed, list) {
+                if ((ref->key.offset | ref->key.type | ref->key.objectid) == 0)
+                        memcpy(&ref->key, &info_key, sizeof(ref->key));
+        }
+        list_splice_init(&prefs_delayed, &prefs);
+
+        ret = __merge_refs(&prefs, 1);
+        if (ret)
+                goto out;
+
+        ret = __resolve_indirect_refs(fs_info, &prefs);
+        if (ret)
+                goto out;
+
+        ret = __merge_refs(&prefs, 2);
+        if (ret)
+                goto out;
+
+        while (!list_empty(&prefs)) {
+                ref = list_first_entry(&prefs, struct __prelim_ref, list);
+                list_del(&ref->list);
+                if (ref->count < 0)
+                        WARN_ON(1);
+                if (ref->count && ref->root_id && ref->parent == 0) {
+                        /* no parent == root of tree */
+                        ret = ulist_add(roots, ref->root_id, 0, GFP_NOFS);
+                        BUG_ON(ret < 0);
+                }
+                if (ref->count && ref->parent) {
+                        ret = ulist_add(refs, ref->parent, 0, GFP_NOFS);
+                        BUG_ON(ret < 0);
+                }
+                kfree(ref);
+        }
+
+out:
+        if (head)
+                mutex_unlock(&head->mutex);
+        btrfs_free_path(path);
+        while (!list_empty(&prefs)) {
+                ref = list_first_entry(&prefs, struct __prelim_ref, list);
+                list_del(&ref->list);
+                kfree(ref);
+        }
+        while (!list_empty(&prefs_delayed)) {
+                ref = list_first_entry(&prefs_delayed, struct __prelim_ref,
+                                       list);
+                list_del(&ref->list);
+                kfree(ref);
+        }
+
+        return ret;
+}
+
+/*
+ * Finds all leafs with a reference to the specified combination of bytenr and
+ * offset. key_list_head will point to a list of corresponding keys (caller must
+ * free each list element). The leafs will be stored in the leafs ulist, which
+ * must be freed with ulist_free.
+ *
+ * returns 0 on success, <0 on error
+ */
+static int btrfs_find_all_leafs(struct btrfs_trans_handle *trans,
+                                struct btrfs_fs_info *fs_info, u64 bytenr,
+                                u64 num_bytes, u64 seq, struct ulist **leafs)
+{
+        struct ulist *tmp;
+        int ret;
+
+        tmp = ulist_alloc(GFP_NOFS);
+        if (!tmp)
+                return -ENOMEM;
+        *leafs = ulist_alloc(GFP_NOFS);
+        if (!*leafs) {
+                ulist_free(tmp);
+                return -ENOMEM;
+        }
+
+        ret = find_parent_nodes(trans, fs_info, bytenr, seq, *leafs, tmp);
+        ulist_free(tmp);
+
+        if (ret < 0 && ret != -ENOENT) {
+                ulist_free(*leafs);
+                return ret;
+        }
+
+        return 0;
+}
+
+/*
+ * walk all backrefs for a given extent to find all roots that reference this
+ * extent. Walking a backref means finding all extents that reference this
+ * extent and in turn walk the backrefs of those, too. Naturally this is a
+ * recursive process, but here it is implemented in an iterative fashion: We
+ * find all referencing extents for the extent in question and put them on a
+ * list. In turn, we find all referencing extents for those, further appending
+ * to the list. The way we iterate the list allows adding more elements after
+ * the current while iterating. The process stops when we reach the end of the
+ * list. Found roots are added to the roots list.
+ *
+ * returns 0 on success, < 0 on error.
+ */
+int btrfs_find_all_roots(struct btrfs_trans_handle *trans,
+                                struct btrfs_fs_info *fs_info, u64 bytenr,
+                                u64 num_bytes, u64 seq, struct ulist **roots)
+{
+        struct ulist *tmp;
+        struct ulist_node *node = NULL;
+        int ret;
+
+        tmp = ulist_alloc(GFP_NOFS);
+        if (!tmp)
+                return -ENOMEM;
+        *roots = ulist_alloc(GFP_NOFS);
+        if (!*roots) {
+                ulist_free(tmp);
+                return -ENOMEM;
+        }
+
+        while (1) {
+                ret = find_parent_nodes(trans, fs_info, bytenr, seq,
+                                        tmp, *roots);
+                if (ret < 0 && ret != -ENOENT) {
+                        ulist_free(tmp);
+                        ulist_free(*roots);
+                        return ret;
+                }
+                node = ulist_next(tmp, node);
+                if (!node)
+                        break;
+                bytenr = node->val;
+        }
+
+        ulist_free(tmp);
+        return 0;
+}
+
 
 static int __inode_info(u64 inum, u64 ioff, u8 key_type,
                         struct btrfs_root *fs_root, struct btrfs_path *path,
@@ -181,8 +952,11 @@ int extent_from_logical(struct btrfs_fs_info *fs_info, u64 logical,
         btrfs_item_key_to_cpu(path->nodes[0], found_key, path->slots[0]);
         if (found_key->type != BTRFS_EXTENT_ITEM_KEY ||
             found_key->objectid > logical ||
-            found_key->objectid + found_key->offset <= logical)
+            found_key->objectid + found_key->offset <= logical) {
+                pr_debug("logical %llu is not within any extent\n",
+                         (unsigned long long)logical);
                 return -ENOENT;
+        }
 
         eb = path->nodes[0];
         item_size = btrfs_item_size_nr(eb, path->slots[0]);
@@ -191,6 +965,13 @@ int extent_from_logical(struct btrfs_fs_info *fs_info, u64 logical,
         ei = btrfs_item_ptr(eb, path->slots[0], struct btrfs_extent_item);
         flags = btrfs_extent_flags(eb, ei);
 
+        pr_debug("logical %llu is at position %llu within the extent (%llu "
+                 "EXTENT_ITEM %llu) flags %#llx size %u\n",
+                 (unsigned long long)logical,
+                 (unsigned long long)(logical - found_key->objectid),
+                 (unsigned long long)found_key->objectid,
+                 (unsigned long long)found_key->offset,
+                 (unsigned long long)flags, item_size);
         if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK)
                 return BTRFS_EXTENT_FLAG_TREE_BLOCK;
         if (flags & BTRFS_EXTENT_FLAG_DATA)
@@ -287,128 +1068,11 @@ int tree_backref_for_extent(unsigned long *ptr, struct extent_buffer *eb,
         return 0;
 }
 
-static int __data_list_add(struct list_head *head, u64 inum,
-                                u64 extent_data_item_offset, u64 root)
-{
-        struct __data_ref *ref;
-
-        ref = kmalloc(sizeof(*ref), GFP_NOFS);
-        if (!ref)
-                return -ENOMEM;
-
-        ref->inum = inum;
-        ref->extent_data_item_offset = extent_data_item_offset;
-        ref->root = root;
-        list_add_tail(&ref->list, head);
-
-        return 0;
-}
-
-static int __data_list_add_eb(struct list_head *head, struct extent_buffer *eb,
-                                struct btrfs_extent_data_ref *dref)
-{
-        return __data_list_add(head, btrfs_extent_data_ref_objectid(eb, dref),
-                                btrfs_extent_data_ref_offset(eb, dref),
-                                btrfs_extent_data_ref_root(eb, dref));
-}
-
-static int __shared_list_add(struct list_head *head, u64 disk_byte)
-{
-        struct __shared_ref *ref;
-
-        ref = kmalloc(sizeof(*ref), GFP_NOFS);
-        if (!ref)
-                return -ENOMEM;
-
-        ref->disk_byte = disk_byte;
-        list_add_tail(&ref->list, head);
-
-        return 0;
-}
-
-static int __iter_shared_inline_ref_inodes(struct btrfs_fs_info *fs_info,
-                                           u64 logical, u64 inum,
-                                           u64 extent_data_item_offset,
-                                           u64 extent_offset,
-                                           struct btrfs_path *path,
-                                           struct list_head *data_refs,
-                                           iterate_extent_inodes_t *iterate,
-                                           void *ctx)
-{
-        u64 ref_root;
-        u32 item_size;
-        struct btrfs_key key;
-        struct extent_buffer *eb;
-        struct btrfs_extent_item *ei;
-        struct btrfs_extent_inline_ref *eiref;
-        struct __data_ref *ref;
-        int ret;
-        int type;
-        int last;
-        unsigned long ptr = 0;
-
-        WARN_ON(!list_empty(data_refs));
-        ret = extent_from_logical(fs_info, logical, path, &key);
-        if (ret & BTRFS_EXTENT_FLAG_DATA)
-                ret = -EIO;
-        if (ret < 0)
-                goto out;
-
-        eb = path->nodes[0];
-        ei = btrfs_item_ptr(eb, path->slots[0], struct btrfs_extent_item);
-        item_size = btrfs_item_size_nr(eb, path->slots[0]);
-
-        ret = 0;
-        ref_root = 0;
-        /*
-         * as done in iterate_extent_inodes, we first build a list of refs to
-         * iterate, then free the path and then iterate them to avoid deadlocks.
-         */
-        do {
-                last = __get_extent_inline_ref(&ptr, eb, ei, item_size,
-                                                &eiref, &type);
-                if (last < 0) {
-                        ret = last;
-                        goto out;
-                }
-                if (type == BTRFS_TREE_BLOCK_REF_KEY ||
-                    type == BTRFS_SHARED_BLOCK_REF_KEY) {
-                        ref_root = btrfs_extent_inline_ref_offset(eb, eiref);
-                        ret = __data_list_add(data_refs, inum,
-                                                extent_data_item_offset,
-                                                ref_root);
-                }
-        } while (!ret && !last);
-
-        btrfs_release_path(path);
-
-        if (ref_root == 0) {
-                printk(KERN_ERR "btrfs: failed to find tree block ref "
-                        "for shared data backref %llu\n", logical);
-                WARN_ON(1);
-                ret = -EIO;
-        }
-
-out:
-        while (!list_empty(data_refs)) {
-                ref = list_first_entry(data_refs, struct __data_ref, list);
-                list_del(&ref->list);
-                if (!ret)
-                        ret = iterate(ref->inum, extent_offset +
-                                        ref->extent_data_item_offset,
-                                        ref->root, ctx);
-                kfree(ref);
-        }
-
-        return ret;
-}
-
-static int __iter_shared_inline_ref(struct btrfs_fs_info *fs_info,
-                                    u64 logical, u64 orig_extent_item_objectid,
-                                    u64 extent_offset, struct btrfs_path *path,
-                                    struct list_head *data_refs,
-                                    iterate_extent_inodes_t *iterate,
-                                    void *ctx)
+static int iterate_leaf_refs(struct btrfs_fs_info *fs_info,
+                                struct btrfs_path *path, u64 logical,
+                                u64 orig_extent_item_objectid,
+                                u64 extent_item_pos, u64 root,
+                                iterate_extent_inodes_t *iterate, void *ctx)
 {
         u64 disk_byte;
         struct btrfs_key key;
@@ -416,8 +1080,10 @@ static int __iter_shared_inline_ref(struct btrfs_fs_info *fs_info,
         struct extent_buffer *eb;
         int slot;
         int nritems;
-        int ret;
-        int found = 0;
+        int ret = 0;
+        int extent_type;
+        u64 data_offset;
+        u64 data_len;
 
         eb = read_tree_block(fs_info->tree_root, logical,
                                 fs_info->tree_root->leafsize, 0);
@@ -435,149 +1101,99 @@ static int __iter_shared_inline_ref(struct btrfs_fs_info *fs_info,
                 if (key.type != BTRFS_EXTENT_DATA_KEY)
                         continue;
                 fi = btrfs_item_ptr(eb, slot, struct btrfs_file_extent_item);
-                if (!fi) {
-                        free_extent_buffer(eb);
-                        return -EIO;
-                }
+                extent_type = btrfs_file_extent_type(eb, fi);
+                if (extent_type == BTRFS_FILE_EXTENT_INLINE)
+                        continue;
+                /* don't skip BTRFS_FILE_EXTENT_PREALLOC, we can handle that */
                 disk_byte = btrfs_file_extent_disk_bytenr(eb, fi);
-                if (disk_byte != orig_extent_item_objectid) {
-                        if (found)
-                                break;
-                        else
-                                continue;
-                }
-                ++found;
-                ret = __iter_shared_inline_ref_inodes(fs_info, logical,
-                                                        key.objectid,
-                                                        key.offset,
-                                                        extent_offset, path,
-                                                        data_refs,
-                                                        iterate, ctx);
-                if (ret)
-                        break;
-        }
+                if (disk_byte != orig_extent_item_objectid)
+                        continue;
 
-        if (!found) {
-                printk(KERN_ERR "btrfs: failed to follow shared data backref "
-                        "to parent %llu\n", logical);
-                WARN_ON(1);
-                ret = -EIO;
+                data_offset = btrfs_file_extent_offset(eb, fi);
+                data_len = btrfs_file_extent_num_bytes(eb, fi);
+
+                if (extent_item_pos < data_offset ||
+                    extent_item_pos >= data_offset + data_len)
+                        continue;
+
+                pr_debug("ref for %llu resolved, key (%llu EXTEND_DATA %llu), "
+                                "root %llu\n", orig_extent_item_objectid,
+                                key.objectid, key.offset, root);
+                ret = iterate(key.objectid,
+                                key.offset + (extent_item_pos - data_offset),
+                                root, ctx);
+                if (ret) {
+                        pr_debug("stopping iteration because ret=%d\n", ret);
+                        break;
+                }
         }
 
         free_extent_buffer(eb);
+
         return ret;
 }
 
 /*
  * calls iterate() for every inode that references the extent identified by
- * the given parameters. will use the path given as a parameter and return it
- * released.
+ * the given parameters.
  * when the iterator function returns a non-zero value, iteration stops.
+ * path is guaranteed to be in released state when iterate() is called.
  */
 int iterate_extent_inodes(struct btrfs_fs_info *fs_info,
                                 struct btrfs_path *path,
-                                u64 extent_item_objectid,
-                                u64 extent_offset,
+                                u64 extent_item_objectid, u64 extent_item_pos,
                                 iterate_extent_inodes_t *iterate, void *ctx)
 {
-        unsigned long ptr = 0;
-        int last;
         int ret;
-        int type;
-        u64 logical;
-        u32 item_size;
-        struct btrfs_extent_inline_ref *eiref;
-        struct btrfs_extent_data_ref *dref;
-        struct extent_buffer *eb;
-        struct btrfs_extent_item *ei;
-        struct btrfs_key key;
         struct list_head data_refs = LIST_HEAD_INIT(data_refs);
         struct list_head shared_refs = LIST_HEAD_INIT(shared_refs);
-        struct __data_ref *ref_d;
-        struct __shared_ref *ref_s;
-
-        eb = path->nodes[0];
-        ei = btrfs_item_ptr(eb, path->slots[0], struct btrfs_extent_item);
-        item_size = btrfs_item_size_nr(eb, path->slots[0]);
-
-        /* first we iterate the inline refs, ... */
-        do {
-                last = __get_extent_inline_ref(&ptr, eb, ei, item_size,
-                                                &eiref, &type);
-                if (last == -ENOENT) {
-                        ret = 0;
-                        break;
-                }
-                if (last < 0) {
-                        ret = last;
-                        break;
-                }
+        struct btrfs_trans_handle *trans;
+        struct ulist *refs;
+        struct ulist *roots;
+        struct ulist_node *ref_node = NULL;
+        struct ulist_node *root_node = NULL;
+        struct seq_list seq_elem;
+        struct btrfs_delayed_ref_root *delayed_refs;
+
+        trans = btrfs_join_transaction(fs_info->extent_root);
+        if (IS_ERR(trans))
+                return PTR_ERR(trans);
+
+        pr_debug("resolving all inodes for extent %llu\n",
+                        extent_item_objectid);
+
+        delayed_refs = &trans->transaction->delayed_refs;
+        spin_lock(&delayed_refs->lock);
+        btrfs_get_delayed_seq(delayed_refs, &seq_elem);
+        spin_unlock(&delayed_refs->lock);
+
+        ret = btrfs_find_all_leafs(trans, fs_info, extent_item_objectid,
+                                   extent_item_pos, seq_elem.seq,
+                                   &refs);
 
-                if (type == BTRFS_EXTENT_DATA_REF_KEY) {
-                        dref = (struct btrfs_extent_data_ref *)(&eiref->offset);
-                        ret = __data_list_add_eb(&data_refs, eb, dref);
-                } else if (type == BTRFS_SHARED_DATA_REF_KEY) {
-                        logical = btrfs_extent_inline_ref_offset(eb, eiref);
-                        ret = __shared_list_add(&shared_refs, logical);
-                }
-        } while (!ret && !last);
+        if (ret)
+                goto out;
 
-        /* ... then we proceed to in-tree references and ... */
-        while (!ret) {
-                ++path->slots[0];
-                if (path->slots[0] > btrfs_header_nritems(eb)) {
-                        ret = btrfs_next_leaf(fs_info->extent_root, path);
-                        if (ret) {
-                                if (ret == 1)
-                                        ret = 0; /* we're done */
-                                break;
-                        }
-                        eb = path->nodes[0];
-                }
-                btrfs_item_key_to_cpu(eb, &key, path->slots[0]);
-                if (key.objectid != extent_item_objectid)
+        while (!ret && (ref_node = ulist_next(refs, ref_node))) {
+                ret = btrfs_find_all_roots(trans, fs_info, ref_node->val, -1,
+                                                seq_elem.seq, &roots);
+                if (ret)
                         break;
-                if (key.type == BTRFS_EXTENT_DATA_REF_KEY) {
-                        dref = btrfs_item_ptr(eb, path->slots[0],
-                                                struct btrfs_extent_data_ref);
-                        ret = __data_list_add_eb(&data_refs, eb, dref);
-                } else if (key.type == BTRFS_SHARED_DATA_REF_KEY) {
-                        ret = __shared_list_add(&shared_refs, key.offset);
+                while (!ret && (root_node = ulist_next(roots, root_node))) {
+                        pr_debug("root %llu references leaf %llu\n",
+                                        root_node->val, ref_node->val);
+                        ret = iterate_leaf_refs(fs_info, path, ref_node->val,
+                                                extent_item_objectid,
+                                                extent_item_pos, root_node->val,
+                                                iterate, ctx);
                 }
         }
 
-        btrfs_release_path(path);
-
-        /*
-         * ... only at the very end we can process the refs we found. this is
-         * because the iterator function we call is allowed to make tree lookups
-         * and we have to avoid deadlocks. additionally, we need more tree
-         * lookups ourselves for shared data refs.
-         */
-        while (!list_empty(&data_refs)) {
-                ref_d = list_first_entry(&data_refs, struct __data_ref, list);
-                list_del(&ref_d->list);
-                if (!ret)
-                        ret = iterate(ref_d->inum, extent_offset +
-                                        ref_d->extent_data_item_offset,
-                                        ref_d->root, ctx);
-                kfree(ref_d);
-        }
-
-        while (!list_empty(&shared_refs)) {
-                ref_s = list_first_entry(&shared_refs, struct __shared_ref,
-                                        list);
-                list_del(&ref_s->list);
-                if (!ret)
-                        ret = __iter_shared_inline_ref(fs_info,
-                                                        ref_s->disk_byte,
-                                                        extent_item_objectid,
-                                                        extent_offset, path,
-                                                        &data_refs,
-                                                        iterate, ctx);
-                kfree(ref_s);
-        }
-
+        ulist_free(refs);
+        ulist_free(roots);
+out:
+        btrfs_put_delayed_seq(delayed_refs, &seq_elem);
+        btrfs_end_transaction(trans, fs_info->extent_root);
         return ret;
 }
 
@@ -586,19 +1202,20 @@ int iterate_inodes_from_logical(u64 logical, struct btrfs_fs_info *fs_info,
                                 iterate_extent_inodes_t *iterate, void *ctx)
 {
         int ret;
-        u64 offset;
+        u64 extent_item_pos;
         struct btrfs_key found_key;
 
         ret = extent_from_logical(fs_info, logical, path,
                                         &found_key);
+        btrfs_release_path(path);
         if (ret & BTRFS_EXTENT_FLAG_TREE_BLOCK)
                 ret = -EINVAL;
         if (ret < 0)
                 return ret;
 
-        offset = logical - found_key.objectid;
+        extent_item_pos = logical - found_key.objectid;
         ret = iterate_extent_inodes(fs_info, path, found_key.objectid,
-                                        offset, iterate, ctx);
+                                        extent_item_pos, iterate, ctx);
 
         return ret;
 }
@@ -643,6 +1260,10 @@ static int iterate_irefs(u64 inum, struct btrfs_root *fs_root,
                 for (cur = 0; cur < btrfs_item_size(eb, item); cur += len) {
                         name_len = btrfs_inode_ref_name_len(eb, iref);
                         /* path must be released before calling iterate()! */
+                        pr_debug("following ref at offset %u for inode %llu in "
+                                 "tree %llu\n", cur,
+                                 (unsigned long long)found_key.objectid,
+                                 (unsigned long long)fs_root->objectid);
                         ret = iterate(parent, iref, eb, ctx);
                         if (ret) {
                                 free_extent_buffer(eb);
@@ -683,10 +1304,14 @@ static int inode_to_path(u64 inum, struct btrfs_inode_ref *iref,
                 return PTR_ERR(fspath);
 
         if (fspath > fspath_min) {
+                pr_debug("path resolved: %s\n", fspath);
                 ipath->fspath->val[i] = (u64)(unsigned long)fspath;
                 ++ipath->fspath->elem_cnt;
                 ipath->fspath->bytes_left = fspath - fspath_min;
         } else {
+                pr_debug("missed path, not enough space. missing bytes: %lu, "
+                         "constructed so far: %s\n",
+                         (unsigned long)(fspath_min - fspath), fspath_min);
                 ++ipath->fspath->elem_missed;
                 ipath->fspath->bytes_missing += fspath_min - fspath;
                 ipath->fspath->bytes_left = 0;
diff --git a/fs/btrfs/backref.h b/fs/btrfs/backref.h
index 92618837cb8f..d00dfa9ca934 100644
--- a/fs/btrfs/backref.h
+++ b/fs/btrfs/backref.h
@@ -20,6 +20,7 @@
 #define __BTRFS_BACKREF__
 
 #include "ioctl.h"
+#include "ulist.h"
 
 struct inode_fs_paths {
         struct btrfs_path               *btrfs_path;
@@ -54,6 +55,10 @@ int iterate_inodes_from_logical(u64 logical, struct btrfs_fs_info *fs_info,
 
 int paths_from_inode(u64 inum, struct inode_fs_paths *ipath);
 
+int btrfs_find_all_roots(struct btrfs_trans_handle *trans,
+                                struct btrfs_fs_info *fs_info, u64 bytenr,
+                                u64 num_bytes, u64 seq, struct ulist **roots);
+
 struct btrfs_data_container *init_data_container(u32 total_bytes);
 struct inode_fs_paths *init_ipath(s32 total_bytes, struct btrfs_root *fs_root,
                                         struct btrfs_path *path);
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index 634608d2a6d0..9b9b15fd5204 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -51,6 +51,9 @@ struct btrfs_inode {
         /* held while logging the inode in tree-log.c */
         struct mutex log_mutex;
 
+        /* held while doing delalloc reservations */
+        struct mutex delalloc_mutex;
+
         /* used to order data wrt metadata */
         struct btrfs_ordered_inode_tree ordered_tree;
 
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
new file mode 100644
index 000000000000..ad0b3ba735b7
--- /dev/null
+++ b/fs/btrfs/check-integrity.c
@@ -0,0 +1,3068 @@
+/*
+ * Copyright (C) STRATO AG 2011.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public
+ * License v2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public
+ * License along with this program; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 021110-1307, USA.
+ */
+
+/*
+ * This module can be used to catch cases when the btrfs kernel
+ * code executes write requests to the disk that bring the file
+ * system in an inconsistent state. In such a state, a power-loss
+ * or kernel panic event would cause that the data on disk is
+ * lost or at least damaged.
+ *
+ * Code is added that examines all block write requests during
+ * runtime (including writes of the super block). Three rules
+ * are verified and an error is printed on violation of the
+ * rules:
+ * 1. It is not allowed to write a disk block which is
+ *    currently referenced by the super block (either directly
+ *    or indirectly).
+ * 2. When a super block is written, it is verified that all
+ *    referenced (directly or indirectly) blocks fulfill the
+ *    following requirements:
+ *    2a. All referenced blocks have either been present when
+ *        the file system was mounted, (i.e., they have been
+ *        referenced by the super block) or they have been
+ *        written since then and the write completion callback
+ *        was called and a FLUSH request to the device where
+ *        these blocks are located was received and completed.
+ *    2b. All referenced blocks need to have a generation
+ *        number which is equal to the parent's number.
+ *
+ * One issue that was found using this module was that the log
+ * tree on disk became temporarily corrupted because disk blocks
+ * that had been in use for the log tree had been freed and
+ * reused too early, while being referenced by the written super
+ * block.
+ *
+ * The search term in the kernel log that can be used to filter
+ * on the existence of detected integrity issues is
+ * "btrfs: attempt".
+ *
+ * The integrity check is enabled via mount options. These
+ * mount options are only supported if the integrity check
+ * tool is compiled by defining BTRFS_FS_CHECK_INTEGRITY.
+ *
+ * Example #1, apply integrity checks to all metadata:
+ * mount /dev/sdb1 /mnt -o check_int
+ *
+ * Example #2, apply integrity checks to all metadata and
+ * to data extents:
+ * mount /dev/sdb1 /mnt -o check_int_data
+ *
+ * Example #3, apply integrity checks to all metadata and dump
+ * the tree that the super block references to kernel messages
+ * each time after a super block was written:
+ * mount /dev/sdb1 /mnt -o check_int,check_int_print_mask=263
+ *
+ * If the integrity check tool is included and activated in
+ * the mount options, plenty of kernel memory is used, and
+ * plenty of additional CPU cycles are spent. Enabling this
+ * functionality is not intended for normal use. In most
+ * cases, unless you are a btrfs developer who needs to verify
+ * the integrity of (super)-block write requests, do not
+ * enable the config option BTRFS_FS_CHECK_INTEGRITY to
+ * include and compile the integrity check tool.
+ */
+
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/buffer_head.h>
+#include <linux/mutex.h>
+#include <linux/crc32c.h>
+#include <linux/genhd.h>
+#include <linux/blkdev.h>
+#include "ctree.h"
+#include "disk-io.h"
+#include "transaction.h"
+#include "extent_io.h"
+#include "disk-io.h"
+#include "volumes.h"
+#include "print-tree.h"
+#include "locking.h"
+#include "check-integrity.h"
+
+#define BTRFSIC_BLOCK_HASHTABLE_SIZE 0x10000
+#define BTRFSIC_BLOCK_LINK_HASHTABLE_SIZE 0x10000
+#define BTRFSIC_DEV2STATE_HASHTABLE_SIZE 0x100
+#define BTRFSIC_BLOCK_MAGIC_NUMBER 0x14491051
+#define BTRFSIC_BLOCK_LINK_MAGIC_NUMBER 0x11070807
+#define BTRFSIC_DEV2STATE_MAGIC_NUMBER 0x20111530
+#define BTRFSIC_BLOCK_STACK_FRAME_MAGIC_NUMBER 20111300
+#define BTRFSIC_TREE_DUMP_MAX_INDENT_LEVEL (200 - 6)    /* in characters,
+                                                         * excluding " [...]" */
+#define BTRFSIC_BLOCK_SIZE PAGE_SIZE
+
+#define BTRFSIC_GENERATION_UNKNOWN ((u64)-1)
+
+/*
+ * The definition of the bitmask fields for the print_mask.
+ * They are specified with the mount option check_integrity_print_mask.
+ */
+#define BTRFSIC_PRINT_MASK_SUPERBLOCK_WRITE                     0x00000001
+#define BTRFSIC_PRINT_MASK_ROOT_CHUNK_LOG_TREE_LOCATION         0x00000002
+#define BTRFSIC_PRINT_MASK_TREE_AFTER_SB_WRITE                  0x00000004
+#define BTRFSIC_PRINT_MASK_TREE_BEFORE_SB_WRITE                 0x00000008
+#define BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH                        0x00000010
+#define BTRFSIC_PRINT_MASK_END_IO_BIO_BH                        0x00000020
+#define BTRFSIC_PRINT_MASK_VERBOSE                              0x00000040
+#define BTRFSIC_PRINT_MASK_VERY_VERBOSE                         0x00000080
+#define BTRFSIC_PRINT_MASK_INITIAL_TREE                         0x00000100
+#define BTRFSIC_PRINT_MASK_INITIAL_ALL_TREES                    0x00000200
+#define BTRFSIC_PRINT_MASK_INITIAL_DATABASE                     0x00000400
+#define BTRFSIC_PRINT_MASK_NUM_COPIES                           0x00000800
+#define BTRFSIC_PRINT_MASK_TREE_WITH_ALL_MIRRORS                0x00001000
+
+struct btrfsic_dev_state;
+struct btrfsic_state;
+
+struct btrfsic_block {
+        u32 magic_num;          /* only used for debug purposes */
+        unsigned int is_metadata:1;     /* if it is meta-data, not data-data */
+        unsigned int is_superblock:1;   /* if it is one of the superblocks */
+        unsigned int is_iodone:1;       /* if is done by lower subsystem */
+        unsigned int iodone_w_error:1;  /* error was indicated to endio */
+        unsigned int never_written:1;   /* block was added because it was
+                                         * referenced, not because it was
+                                         * written */
+        unsigned int mirror_num:2;      /* large enough to hold
+                                         * BTRFS_SUPER_MIRROR_MAX */
+        struct btrfsic_dev_state *dev_state;
+        u64 dev_bytenr;         /* key, physical byte num on disk */
+        u64 logical_bytenr;     /* logical byte num on disk */
+        u64 generation;
+        struct btrfs_disk_key disk_key; /* extra info to print in case of
+                                         * issues, will not always be correct */
+        struct list_head collision_resolving_node;      /* list node */
+        struct list_head all_blocks_node;       /* list node */
+
+        /* the following two lists contain block_link items */
+        struct list_head ref_to_list;   /* list */
+        struct list_head ref_from_list; /* list */
+        struct btrfsic_block *next_in_same_bio;
+        void *orig_bio_bh_private;
+        union {
+                bio_end_io_t *bio;
+                bh_end_io_t *bh;
+        } orig_bio_bh_end_io;
+        int submit_bio_bh_rw;
+        u64 flush_gen; /* only valid if !never_written */
+};
+
+/*
+ * Elements of this type are allocated dynamically and required because
+ * each block object can refer to and can be ref from multiple blocks.
+ * The key to lookup them in the hashtable is the dev_bytenr of
+ * the block ref to plus the one from the block refered from.
+ * The fact that they are searchable via a hashtable and that a
+ * ref_cnt is maintained is not required for the btrfs integrity
+ * check algorithm itself, it is only used to make the output more
+ * beautiful in case that an error is detected (an error is defined
+ * as a write operation to a block while that block is still referenced).
+ */
+struct btrfsic_block_link {
+        u32 magic_num;          /* only used for debug purposes */
+        u32 ref_cnt;
+        struct list_head node_ref_to;   /* list node */
+        struct list_head node_ref_from; /* list node */
+        struct list_head collision_resolving_node;      /* list node */
+        struct btrfsic_block *block_ref_to;
+        struct btrfsic_block *block_ref_from;
+        u64 parent_generation;
+};
+
+struct btrfsic_dev_state {
+        u32 magic_num;          /* only used for debug purposes */
+        struct block_device *bdev;
+        struct btrfsic_state *state;
+        struct list_head collision_resolving_node;      /* list node */
+        struct btrfsic_block dummy_block_for_bio_bh_flush;
+        u64 last_flush_gen;
+        char name[BDEVNAME_SIZE];
+};
+
+struct btrfsic_block_hashtable {
+        struct list_head table[BTRFSIC_BLOCK_HASHTABLE_SIZE];
+};
+
+struct btrfsic_block_link_hashtable {
+        struct list_head table[BTRFSIC_BLOCK_LINK_HASHTABLE_SIZE];
+};
+
+struct btrfsic_dev_state_hashtable {
+        struct list_head table[BTRFSIC_DEV2STATE_HASHTABLE_SIZE];
+};
+
+struct btrfsic_block_data_ctx {
+        u64 start;              /* virtual bytenr */
+        u64 dev_bytenr;         /* physical bytenr on device */
+        u32 len;
+        struct btrfsic_dev_state *dev;
+        char *data;
+        struct buffer_head *bh; /* do not use if set to NULL */
+};
+
+/* This structure is used to implement recursion without occupying
+ * any stack space, refer to btrfsic_process_metablock() */
+struct btrfsic_stack_frame {
+        u32 magic;
+        u32 nr;
+        int error;
+        int i;
+        int limit_nesting;
+        int num_copies;
+        int mirror_num;
+        struct btrfsic_block *block;
+        struct btrfsic_block_data_ctx *block_ctx;
+        struct btrfsic_block *next_block;
+        struct btrfsic_block_data_ctx next_block_ctx;
+        struct btrfs_header *hdr;
+        struct btrfsic_stack_frame *prev;
+};
+
+/* Some state per mounted filesystem */
+struct btrfsic_state {
+        u32 print_mask;
+        int include_extent_data;
+        int csum_size;
+        struct list_head all_blocks_list;
+        struct btrfsic_block_hashtable block_hashtable;
+        struct btrfsic_block_link_hashtable block_link_hashtable;
+        struct btrfs_root *root;
+        u64 max_superblock_generation;
+        struct btrfsic_block *latest_superblock;
+};
+
+static void btrfsic_block_init(struct btrfsic_block *b);
+static struct btrfsic_block *btrfsic_block_alloc(void);
+static void btrfsic_block_free(struct btrfsic_block *b);
+static void btrfsic_block_link_init(struct btrfsic_block_link *n);
+static struct btrfsic_block_link *btrfsic_block_link_alloc(void);
+static void btrfsic_block_link_free(struct btrfsic_block_link *n);
+static void btrfsic_dev_state_init(struct btrfsic_dev_state *ds);
+static struct btrfsic_dev_state *btrfsic_dev_state_alloc(void);
+static void btrfsic_dev_state_free(struct btrfsic_dev_state *ds);
+static void btrfsic_block_hashtable_init(struct btrfsic_block_hashtable *h);
+static void btrfsic_block_hashtable_add(struct btrfsic_block *b,
+                                        struct btrfsic_block_hashtable *h);
+static void btrfsic_block_hashtable_remove(struct btrfsic_block *b);
+static struct btrfsic_block *btrfsic_block_hashtable_lookup(
+                struct block_device *bdev,
+                u64 dev_bytenr,
+                struct btrfsic_block_hashtable *h);
+static void btrfsic_block_link_hashtable_init(
+                struct btrfsic_block_link_hashtable *h);
+static void btrfsic_block_link_hashtable_add(
+                struct btrfsic_block_link *l,
+                struct btrfsic_block_link_hashtable *h);
+static void btrfsic_block_link_hashtable_remove(struct btrfsic_block_link *l);
+static struct btrfsic_block_link *btrfsic_block_link_hashtable_lookup(
+                struct block_device *bdev_ref_to,
+                u64 dev_bytenr_ref_to,
+                struct block_device *bdev_ref_from,
+                u64 dev_bytenr_ref_from,
+                struct btrfsic_block_link_hashtable *h);
+static void btrfsic_dev_state_hashtable_init(
+                struct btrfsic_dev_state_hashtable *h);
+static void btrfsic_dev_state_hashtable_add(
+                struct btrfsic_dev_state *ds,
+                struct btrfsic_dev_state_hashtable *h);
+static void btrfsic_dev_state_hashtable_remove(struct btrfsic_dev_state *ds);
+static struct btrfsic_dev_state *btrfsic_dev_state_hashtable_lookup(
+                struct block_device *bdev,
+                struct btrfsic_dev_state_hashtable *h);
+static struct btrfsic_stack_frame *btrfsic_stack_frame_alloc(void);
+static void btrfsic_stack_frame_free(struct btrfsic_stack_frame *sf);
+static int btrfsic_process_superblock(struct btrfsic_state *state,
+                                      struct btrfs_fs_devices *fs_devices);
+static int btrfsic_process_metablock(struct btrfsic_state *state,
+                                     struct btrfsic_block *block,
+                                     struct btrfsic_block_data_ctx *block_ctx,
+                                     struct btrfs_header *hdr,
+                                     int limit_nesting, int force_iodone_flag);
+static int btrfsic_create_link_to_next_block(
+                struct btrfsic_state *state,
+                struct btrfsic_block *block,
+                struct btrfsic_block_data_ctx
+                *block_ctx, u64 next_bytenr,
+                int limit_nesting,
+                struct btrfsic_block_data_ctx *next_block_ctx,
+                struct btrfsic_block **next_blockp,
+                int force_iodone_flag,
+                int *num_copiesp, int *mirror_nump,
+                struct btrfs_disk_key *disk_key,
+                u64 parent_generation);
+static int btrfsic_handle_extent_data(struct btrfsic_state *state,
+                                      struct btrfsic_block *block,
+                                      struct btrfsic_block_data_ctx *block_ctx,
+                                      u32 item_offset, int force_iodone_flag);
+static int btrfsic_map_block(struct btrfsic_state *state, u64 bytenr, u32 len,
+                             struct btrfsic_block_data_ctx *block_ctx_out,
+                             int mirror_num);
+static int btrfsic_map_superblock(struct btrfsic_state *state, u64 bytenr,
+                                  u32 len, struct block_device *bdev,
+                                  struct btrfsic_block_data_ctx *block_ctx_out);
+static void btrfsic_release_block_ctx(struct btrfsic_block_data_ctx *block_ctx);
+static int btrfsic_read_block(struct btrfsic_state *state,
+                              struct btrfsic_block_data_ctx *block_ctx);
+static void btrfsic_dump_database(struct btrfsic_state *state);
+static int btrfsic_test_for_metadata(struct btrfsic_state *state,
+                                     const u8 *data, unsigned int size);
+static void btrfsic_process_written_block(struct btrfsic_dev_state *dev_state,
+                                          u64 dev_bytenr, u8 *mapped_data,
+                                          unsigned int len, struct bio *bio,
+                                          int *bio_is_patched,
+                                          struct buffer_head *bh,
+                                          int submit_bio_bh_rw);
+static int btrfsic_process_written_superblock(
+                struct btrfsic_state *state,
+                struct btrfsic_block *const block,
+                struct btrfs_super_block *const super_hdr);
+static void btrfsic_bio_end_io(struct bio *bp, int bio_error_status);
+static void btrfsic_bh_end_io(struct buffer_head *bh, int uptodate);
+static int btrfsic_is_block_ref_by_superblock(const struct btrfsic_state *state,
+                                              const struct btrfsic_block *block,
+                                              int recursion_level);
+static int btrfsic_check_all_ref_blocks(struct btrfsic_state *state,
+                                        struct btrfsic_block *const block,
+                                        int recursion_level);
+static void btrfsic_print_add_link(const struct btrfsic_state *state,
+                                   const struct btrfsic_block_link *l);
+static void btrfsic_print_rem_link(const struct btrfsic_state *state,
+                                   const struct btrfsic_block_link *l);
+static char btrfsic_get_block_type(const struct btrfsic_state *state,
+                                   const struct btrfsic_block *block);
+static void btrfsic_dump_tree(const struct btrfsic_state *state);
+static void btrfsic_dump_tree_sub(const struct btrfsic_state *state,
+                                  const struct btrfsic_block *block,
+                                  int indent_level);
+static struct btrfsic_block_link *btrfsic_block_link_lookup_or_add(
+                struct btrfsic_state *state,
+                struct btrfsic_block_data_ctx *next_block_ctx,
+                struct btrfsic_block *next_block,
+                struct btrfsic_block *from_block,
+                u64 parent_generation);
+static struct btrfsic_block *btrfsic_block_lookup_or_add(
+                struct btrfsic_state *state,
+                struct btrfsic_block_data_ctx *block_ctx,
+                const char *additional_string,
+                int is_metadata,
+                int is_iodone,
+                int never_written,
+                int mirror_num,
+                int *was_created);
+static int btrfsic_process_superblock_dev_mirror(
+                struct btrfsic_state *state,
+                struct btrfsic_dev_state *dev_state,
+                struct btrfs_device *device,
+                int superblock_mirror_num,
+                struct btrfsic_dev_state **selected_dev_state,
+                struct btrfs_super_block *selected_super);
+static struct btrfsic_dev_state *btrfsic_dev_state_lookup(
+                struct block_device *bdev);
+static void btrfsic_cmp_log_and_dev_bytenr(struct btrfsic_state *state,
+                                           u64 bytenr,
+                                           struct btrfsic_dev_state *dev_state,
+                                           u64 dev_bytenr, char *data);
+
+static struct mutex btrfsic_mutex;
+static int btrfsic_is_initialized;
+static struct btrfsic_dev_state_hashtable btrfsic_dev_state_hashtable;
+
+
+static void btrfsic_block_init(struct btrfsic_block *b)
+{
+        b->magic_num = BTRFSIC_BLOCK_MAGIC_NUMBER;
+        b->dev_state = NULL;
+        b->dev_bytenr = 0;
+        b->logical_bytenr = 0;
+        b->generation = BTRFSIC_GENERATION_UNKNOWN;
+        b->disk_key.objectid = 0;
+        b->disk_key.type = 0;
+        b->disk_key.offset = 0;
+        b->is_metadata = 0;
+        b->is_superblock = 0;
+        b->is_iodone = 0;
+        b->iodone_w_error = 0;
+        b->never_written = 0;
+        b->mirror_num = 0;
+        b->next_in_same_bio = NULL;
+        b->orig_bio_bh_private = NULL;
+        b->orig_bio_bh_end_io.bio = NULL;
+        INIT_LIST_HEAD(&b->collision_resolving_node);
+        INIT_LIST_HEAD(&b->all_blocks_node);
+        INIT_LIST_HEAD(&b->ref_to_list);
+        INIT_LIST_HEAD(&b->ref_from_list);
+        b->submit_bio_bh_rw = 0;
+        b->flush_gen = 0;
+}
+
+static struct btrfsic_block *btrfsic_block_alloc(void)
+{
+        struct btrfsic_block *b;
+
+        b = kzalloc(sizeof(*b), GFP_NOFS);
+        if (NULL != b)
+                btrfsic_block_init(b);
+
+        return b;
+}
+
+static void btrfsic_block_free(struct btrfsic_block *b)
+{
+        BUG_ON(!(NULL == b || BTRFSIC_BLOCK_MAGIC_NUMBER == b->magic_num));
+        kfree(b);
+}
+
+static void btrfsic_block_link_init(struct btrfsic_block_link *l)
+{
+        l->magic_num = BTRFSIC_BLOCK_LINK_MAGIC_NUMBER;
+        l->ref_cnt = 1;
+        INIT_LIST_HEAD(&l->node_ref_to);
+        INIT_LIST_HEAD(&l->node_ref_from);
+        INIT_LIST_HEAD(&l->collision_resolving_node);
+        l->block_ref_to = NULL;
+        l->block_ref_from = NULL;
+}
+
+static struct btrfsic_block_link *btrfsic_block_link_alloc(void)
+{
+        struct btrfsic_block_link *l;
+
+        l = kzalloc(sizeof(*l), GFP_NOFS);
+        if (NULL != l)
+                btrfsic_block_link_init(l);
+
+        return l;
+}
+
+static void btrfsic_block_link_free(struct btrfsic_block_link *l)
+{
+        BUG_ON(!(NULL == l || BTRFSIC_BLOCK_LINK_MAGIC_NUMBER == l->magic_num));
+        kfree(l);
+}
+
+static void btrfsic_dev_state_init(struct btrfsic_dev_state *ds)
+{
+        ds->magic_num = BTRFSIC_DEV2STATE_MAGIC_NUMBER;
+        ds->bdev = NULL;
+        ds->state = NULL;
+        ds->name[0] = '\0';
+        INIT_LIST_HEAD(&ds->collision_resolving_node);
+        ds->last_flush_gen = 0;
+        btrfsic_block_init(&ds->dummy_block_for_bio_bh_flush);
+        ds->dummy_block_for_bio_bh_flush.is_iodone = 1;
+        ds->dummy_block_for_bio_bh_flush.dev_state = ds;
+}
+
+static struct btrfsic_dev_state *btrfsic_dev_state_alloc(void)
+{
+        struct btrfsic_dev_state *ds;
+
+        ds = kzalloc(sizeof(*ds), GFP_NOFS);
+        if (NULL != ds)
+                btrfsic_dev_state_init(ds);
+
+        return ds;
+}
+
+static void btrfsic_dev_state_free(struct btrfsic_dev_state *ds)
+{
+        BUG_ON(!(NULL == ds ||
+                 BTRFSIC_DEV2STATE_MAGIC_NUMBER == ds->magic_num));
+        kfree(ds);
+}
+
+static void btrfsic_block_hashtable_init(struct btrfsic_block_hashtable *h)
+{
+        int i;
+
+        for (i = 0; i < BTRFSIC_BLOCK_HASHTABLE_SIZE; i++)
+                INIT_LIST_HEAD(h->table + i);
+}
+
+static void btrfsic_block_hashtable_add(struct btrfsic_block *b,
+                                        struct btrfsic_block_hashtable *h)
+{
+        const unsigned int hashval =
+            (((unsigned int)(b->dev_bytenr >> 16)) ^
+             ((unsigned int)((uintptr_t)b->dev_state->bdev))) &
+             (BTRFSIC_BLOCK_HASHTABLE_SIZE - 1);
+
+        list_add(&b->collision_resolving_node, h->table + hashval);
+}
+
+static void btrfsic_block_hashtable_remove(struct btrfsic_block *b)
+{
+        list_del(&b->collision_resolving_node);
+}
+
+static struct btrfsic_block *btrfsic_block_hashtable_lookup(
+                struct block_device *bdev,
+                u64 dev_bytenr,
+                struct btrfsic_block_hashtable *h)
+{
+        const unsigned int hashval =
+            (((unsigned int)(dev_bytenr >> 16)) ^
+             ((unsigned int)((uintptr_t)bdev))) &
+             (BTRFSIC_BLOCK_HASHTABLE_SIZE - 1);
+        struct list_head *elem;
+
+        list_for_each(elem, h->table + hashval) {
+                struct btrfsic_block *const b =
+                    list_entry(elem, struct btrfsic_block,
+                               collision_resolving_node);
+
+                if (b->dev_state->bdev == bdev && b->dev_bytenr == dev_bytenr)
+                        return b;
+        }
+
+        return NULL;
+}
+
+static void btrfsic_block_link_hashtable_init(
+                struct btrfsic_block_link_hashtable *h)
+{
+        int i;
+
+        for (i = 0; i < BTRFSIC_BLOCK_LINK_HASHTABLE_SIZE; i++)
+                INIT_LIST_HEAD(h->table + i);
+}
+
+static void btrfsic_block_link_hashtable_add(
+                struct btrfsic_block_link *l,
+                struct btrfsic_block_link_hashtable *h)
+{
+        const unsigned int hashval =
+            (((unsigned int)(l->block_ref_to->dev_bytenr >> 16)) ^
+             ((unsigned int)(l->block_ref_from->dev_bytenr >> 16)) ^
+             ((unsigned int)((uintptr_t)l->block_ref_to->dev_state->bdev)) ^
+             ((unsigned int)((uintptr_t)l->block_ref_from->dev_state->bdev)))
+             & (BTRFSIC_BLOCK_LINK_HASHTABLE_SIZE - 1);
+
+        BUG_ON(NULL == l->block_ref_to);
+        BUG_ON(NULL == l->block_ref_from);
+        list_add(&l->collision_resolving_node, h->table + hashval);
+}
+
+static void btrfsic_block_link_hashtable_remove(struct btrfsic_block_link *l)
+{
+        list_del(&l->collision_resolving_node);
+}
+
+static struct btrfsic_block_link *btrfsic_block_link_hashtable_lookup(
+                struct block_device *bdev_ref_to,
+                u64 dev_bytenr_ref_to,
+                struct block_device *bdev_ref_from,
+                u64 dev_bytenr_ref_from,
+                struct btrfsic_block_link_hashtable *h)
+{
+        const unsigned int hashval =
+            (((unsigned int)(dev_bytenr_ref_to >> 16)) ^
+             ((unsigned int)(dev_bytenr_ref_from >> 16)) ^
+             ((unsigned int)((uintptr_t)bdev_ref_to)) ^
+             ((unsigned int)((uintptr_t)bdev_ref_from))) &
+             (BTRFSIC_BLOCK_LINK_HASHTABLE_SIZE - 1);
+        struct list_head *elem;
+
+        list_for_each(elem, h->table + hashval) {
+                struct btrfsic_block_link *const l =
+                    list_entry(elem, struct btrfsic_block_link,
+                               collision_resolving_node);
+
+                BUG_ON(NULL == l->block_ref_to);
+                BUG_ON(NULL == l->block_ref_from);
+                if (l->block_ref_to->dev_state->bdev == bdev_ref_to &&
+                    l->block_ref_to->dev_bytenr == dev_bytenr_ref_to &&
+                    l->block_ref_from->dev_state->bdev == bdev_ref_from &&
+                    l->block_ref_from->dev_bytenr == dev_bytenr_ref_from)
+                        return l;
+        }
+
+        return NULL;
+}
+
+static void btrfsic_dev_state_hashtable_init(
+                struct btrfsic_dev_state_hashtable *h)
+{
+        int i;
+
+        for (i = 0; i < BTRFSIC_DEV2STATE_HASHTABLE_SIZE; i++)
+                INIT_LIST_HEAD(h->table + i);
+}
+
+static void btrfsic_dev_state_hashtable_add(
+                struct btrfsic_dev_state *ds,
+                struct btrfsic_dev_state_hashtable *h)
+{
+        const unsigned int hashval =
+            (((unsigned int)((uintptr_t)ds->bdev)) &
+             (BTRFSIC_DEV2STATE_HASHTABLE_SIZE - 1));
+
+        list_add(&ds->collision_resolving_node, h->table + hashval);
+}
+
+static void btrfsic_dev_state_hashtable_remove(struct btrfsic_dev_state *ds)
+{
+        list_del(&ds->collision_resolving_node);
+}
+
+static struct btrfsic_dev_state *btrfsic_dev_state_hashtable_lookup(
+                struct block_device *bdev,
+                struct btrfsic_dev_state_hashtable *h)
+{
+        const unsigned int hashval =
+            (((unsigned int)((uintptr_t)bdev)) &
+             (BTRFSIC_DEV2STATE_HASHTABLE_SIZE - 1));
+        struct list_head *elem;
+
+        list_for_each(elem, h->table + hashval) {
+                struct btrfsic_dev_state *const ds =
+                    list_entry(elem, struct btrfsic_dev_state,
+                               collision_resolving_node);
+
+                if (ds->bdev == bdev)
+                        return ds;
+        }
+
+        return NULL;
+}
+
+static int btrfsic_process_superblock(struct btrfsic_state *state,
+                                      struct btrfs_fs_devices *fs_devices)
+{
+        int ret;
+        struct btrfs_super_block *selected_super;
+        struct list_head *dev_head = &fs_devices->devices;
+        struct btrfs_device *device;
+        struct btrfsic_dev_state *selected_dev_state = NULL;
+        int pass;
+
+        BUG_ON(NULL == state);
+        selected_super = kmalloc(sizeof(*selected_super), GFP_NOFS);
+        if (NULL == selected_super) {
+                printk(KERN_INFO "btrfsic: error, kmalloc failed!\n");
+                return -1;
+        }
+
+        list_for_each_entry(device, dev_head, dev_list) {
+                int i;
+                struct btrfsic_dev_state *dev_state;
+
+                if (!device->bdev || !device->name)
+                        continue;
+
+                dev_state = btrfsic_dev_state_lookup(device->bdev);
+                BUG_ON(NULL == dev_state);
+                for (i = 0; i < BTRFS_SUPER_MIRROR_MAX; i++) {
+                        ret = btrfsic_process_superblock_dev_mirror(
+                                        state, dev_state, device, i,
+                                        &selected_dev_state, selected_super);
+                        if (0 != ret && 0 == i) {
+                                kfree(selected_super);
+                                return ret;
+                        }
+                }
+        }
+
+        if (NULL == state->latest_superblock) {
+                printk(KERN_INFO "btrfsic: no superblock found!\n");
+                kfree(selected_super);
+                return -1;
+        }
+
+        state->csum_size = btrfs_super_csum_size(selected_super);
+
+        for (pass = 0; pass < 3; pass++) {
+                int num_copies;
+                int mirror_num;
+                u64 next_bytenr;
+
+                switch (pass) {
+                case 0:
+                        next_bytenr = btrfs_super_root(selected_super);
+                        if (state->print_mask &
+                            BTRFSIC_PRINT_MASK_ROOT_CHUNK_LOG_TREE_LOCATION)
+                                printk(KERN_INFO "root@%llu\n",
+                                       (unsigned long long)next_bytenr);
+                        break;
+                case 1:
+                        next_bytenr = btrfs_super_chunk_root(selected_super);
+                        if (state->print_mask &
+                            BTRFSIC_PRINT_MASK_ROOT_CHUNK_LOG_TREE_LOCATION)
+                                printk(KERN_INFO "chunk@%llu\n",
+                                       (unsigned long long)next_bytenr);
+                        break;
+                case 2:
+                        next_bytenr = btrfs_super_log_root(selected_super);
+                        if (0 == next_bytenr)
+                                continue;
+                        if (state->print_mask &
+                            BTRFSIC_PRINT_MASK_ROOT_CHUNK_LOG_TREE_LOCATION)
+                                printk(KERN_INFO "log@%llu\n",
+                                       (unsigned long long)next_bytenr);
+                        break;
+                }
+
+                num_copies =
+                    btrfs_num_copies(&state->root->fs_info->mapping_tree,
+                                     next_bytenr, PAGE_SIZE);
+                if (state->print_mask & BTRFSIC_PRINT_MASK_NUM_COPIES)
+                        printk(KERN_INFO "num_copies(log_bytenr=%llu) = %d\n",
+                               (unsigned long long)next_bytenr, num_copies);
+
+                for (mirror_num = 1; mirror_num <= num_copies; mirror_num++) {
+                        struct btrfsic_block *next_block;
+                        struct btrfsic_block_data_ctx tmp_next_block_ctx;
+                        struct btrfsic_block_link *l;
+                        struct btrfs_header *hdr;
+
+                        ret = btrfsic_map_block(state, next_bytenr, PAGE_SIZE,
+                                                &tmp_next_block_ctx,
+                                                mirror_num);
+                        if (ret) {
+                                printk(KERN_INFO "btrfsic:"
+                                       " btrfsic_map_block(root @%llu,"
+                                       " mirror %d) failed!\n",
+                                       (unsigned long long)next_bytenr,
+                                       mirror_num);
+                                kfree(selected_super);
+                                return -1;
+                        }
+
+                        next_block = btrfsic_block_hashtable_lookup(
+                                        tmp_next_block_ctx.dev->bdev,
+                                        tmp_next_block_ctx.dev_bytenr,
+                                        &state->block_hashtable);
+                        BUG_ON(NULL == next_block);
+
+                        l = btrfsic_block_link_hashtable_lookup(
+                                        tmp_next_block_ctx.dev->bdev,
+                                        tmp_next_block_ctx.dev_bytenr,
+                                        state->latest_superblock->dev_state->
+                                        bdev,
+                                        state->latest_superblock->dev_bytenr,
+                                        &state->block_link_hashtable);
+                        BUG_ON(NULL == l);
+
+                        ret = btrfsic_read_block(state, &tmp_next_block_ctx);
+                        if (ret < (int)BTRFSIC_BLOCK_SIZE) {
+                                printk(KERN_INFO
+                                       "btrfsic: read @logical %llu failed!\n",
+                                       (unsigned long long)
+                                       tmp_next_block_ctx.start);
+                                btrfsic_release_block_ctx(&tmp_next_block_ctx);
+                                kfree(selected_super);
+                                return -1;
+                        }
+
+                        hdr = (struct btrfs_header *)tmp_next_block_ctx.data;
+                        ret = btrfsic_process_metablock(state,
+                                                        next_block,
+                                                        &tmp_next_block_ctx,
+                                                        hdr,
+                                                        BTRFS_MAX_LEVEL + 3, 1);
+                        btrfsic_release_block_ctx(&tmp_next_block_ctx);
+                }
+        }
+
+        kfree(selected_super);
+        return ret;
+}
+
+static int btrfsic_process_superblock_dev_mirror(
+                struct btrfsic_state *state,
+                struct btrfsic_dev_state *dev_state,
+                struct btrfs_device *device,
+                int superblock_mirror_num,
+                struct btrfsic_dev_state **selected_dev_state,
+                struct btrfs_super_block *selected_super)
+{
+        struct btrfs_super_block *super_tmp;
+        u64 dev_bytenr;
+        struct buffer_head *bh;
+        struct btrfsic_block *superblock_tmp;
+        int pass;
+        struct block_device *const superblock_bdev = device->bdev;
+
+        /* super block bytenr is always the unmapped device bytenr */
+        dev_bytenr = btrfs_sb_offset(superblock_mirror_num);
+        bh = __bread(superblock_bdev, dev_bytenr / 4096, 4096);
+        if (NULL == bh)
+                return -1;
+        super_tmp = (struct btrfs_super_block *)
+            (bh->b_data + (dev_bytenr & 4095));
+
+        if (btrfs_super_bytenr(super_tmp) != dev_bytenr ||
+            strncmp((char *)(&(super_tmp->magic)), BTRFS_MAGIC,
+                    sizeof(super_tmp->magic)) ||
+            memcmp(device->uuid, super_tmp->dev_item.uuid, BTRFS_UUID_SIZE)) {
+                brelse(bh);
+                return 0;
+        }
+
+        superblock_tmp =
+            btrfsic_block_hashtable_lookup(superblock_bdev,
+                                           dev_bytenr,
+                                           &state->block_hashtable);
+        if (NULL == superblock_tmp) {
+                superblock_tmp = btrfsic_block_alloc();
+                if (NULL == superblock_tmp) {
+                        printk(KERN_INFO "btrfsic: error, kmalloc failed!\n");
+                        brelse(bh);
+                        return -1;
+                }
+                /* for superblock, only the dev_bytenr makes sense */
+                superblock_tmp->dev_bytenr = dev_bytenr;
+                superblock_tmp->dev_state = dev_state;
+                superblock_tmp->logical_bytenr = dev_bytenr;
+                superblock_tmp->generation = btrfs_super_generation(super_tmp);
+                superblock_tmp->is_metadata = 1;
+                superblock_tmp->is_superblock = 1;
+                superblock_tmp->is_iodone = 1;
+                superblock_tmp->never_written = 0;
+                superblock_tmp->mirror_num = 1 + superblock_mirror_num;
+                if (state->print_mask & BTRFSIC_PRINT_MASK_SUPERBLOCK_WRITE)
+                        printk(KERN_INFO "New initial S-block (bdev %p, %s)"
+                               " @%llu (%s/%llu/%d)\n",
+                               superblock_bdev, device->name,
+                               (unsigned long long)dev_bytenr,
+                               dev_state->name,
+                               (unsigned long long)dev_bytenr,
+                               superblock_mirror_num);
+                list_add(&superblock_tmp->all_blocks_node,
+                         &state->all_blocks_list);
+                btrfsic_block_hashtable_add(superblock_tmp,
+                                            &state->block_hashtable);
+        }
+
+        /* select the one with the highest generation field */
+        if (btrfs_super_generation(super_tmp) >
+            state->max_superblock_generation ||
+            0 == state->max_superblock_generation) {
+                memcpy(selected_super, super_tmp, sizeof(*selected_super));
+                *selected_dev_state = dev_state;
+                state->max_superblock_generation =
+                    btrfs_super_generation(super_tmp);
+                state->latest_superblock = superblock_tmp;
+        }
+
+        for (pass = 0; pass < 3; pass++) {
+                u64 next_bytenr;
+                int num_copies;
+                int mirror_num;
+                const char *additional_string = NULL;
+                struct btrfs_disk_key tmp_disk_key;
+
+                tmp_disk_key.type = BTRFS_ROOT_ITEM_KEY;
+                tmp_disk_key.offset = 0;
+                switch (pass) {
+                case 0:
+                        tmp_disk_key.objectid =
+                            cpu_to_le64(BTRFS_ROOT_TREE_OBJECTID);
+                        additional_string = "initial root ";
+                        next_bytenr = btrfs_super_root(super_tmp);
+                        break;
+                case 1:
+                        tmp_disk_key.objectid =
+                            cpu_to_le64(BTRFS_CHUNK_TREE_OBJECTID);
+                        additional_string = "initial chunk ";
+                        next_bytenr = btrfs_super_chunk_root(super_tmp);
+                        break;
+                case 2:
+                        tmp_disk_key.objectid =
+                            cpu_to_le64(BTRFS_TREE_LOG_OBJECTID);
+                        additional_string = "initial log ";
+                        next_bytenr = btrfs_super_log_root(super_tmp);
+                        if (0 == next_bytenr)
+                                continue;
+                        break;
+                }
+
+                num_copies =
+                    btrfs_num_copies(&state->root->fs_info->mapping_tree,
+                                     next_bytenr, PAGE_SIZE);
+                if (state->print_mask & BTRFSIC_PRINT_MASK_NUM_COPIES)
+                        printk(KERN_INFO "num_copies(log_bytenr=%llu) = %d\n",
+                               (unsigned long long)next_bytenr, num_copies);
+                for (mirror_num = 1; mirror_num <= num_copies; mirror_num++) {
+                        struct btrfsic_block *next_block;
+                        struct btrfsic_block_data_ctx tmp_next_block_ctx;
+                        struct btrfsic_block_link *l;
+
+                        if (btrfsic_map_block(state, next_bytenr, PAGE_SIZE,
+                                              &tmp_next_block_ctx,
+                                              mirror_num)) {
+                                printk(KERN_INFO "btrfsic: btrfsic_map_block("
+                                       "bytenr @%llu, mirror %d) failed!\n",
+                                       (unsigned long long)next_bytenr,
+                                       mirror_num);
+                                brelse(bh);
+                                return -1;
+                        }
+
+                        next_block = btrfsic_block_lookup_or_add(
+                                        state, &tmp_next_block_ctx,
+                                        additional_string, 1, 1, 0,
+                                        mirror_num, NULL);
+                        if (NULL == next_block) {
+                                btrfsic_release_block_ctx(&tmp_next_block_ctx);
+                                brelse(bh);
+                                return -1;
+                        }
+
+                        next_block->disk_key = tmp_disk_key;
+                        next_block->generation = BTRFSIC_GENERATION_UNKNOWN;
+                        l = btrfsic_block_link_lookup_or_add(
+                                        state, &tmp_next_block_ctx,
+                                        next_block, superblock_tmp,
+                                        BTRFSIC_GENERATION_UNKNOWN);
+                        btrfsic_release_block_ctx(&tmp_next_block_ctx);
+                        if (NULL == l) {
+                                brelse(bh);
+                                return -1;
+                        }
+                }
+        }
+        if (state->print_mask & BTRFSIC_PRINT_MASK_INITIAL_ALL_TREES)
+                btrfsic_dump_tree_sub(state, superblock_tmp, 0);
+
+        brelse(bh);
+        return 0;
+}
+
+static struct btrfsic_stack_frame *btrfsic_stack_frame_alloc(void)
+{
+        struct btrfsic_stack_frame *sf;
+
+        sf = kzalloc(sizeof(*sf), GFP_NOFS);
+        if (NULL == sf)
+                printk(KERN_INFO "btrfsic: alloc memory failed!\n");
+        else
+                sf->magic = BTRFSIC_BLOCK_STACK_FRAME_MAGIC_NUMBER;
+        return sf;
+}
+
+static void btrfsic_stack_frame_free(struct btrfsic_stack_frame *sf)
+{
+        BUG_ON(!(NULL == sf ||
+                 BTRFSIC_BLOCK_STACK_FRAME_MAGIC_NUMBER == sf->magic));
+        kfree(sf);
+}
+
+static int btrfsic_process_metablock(
+                struct btrfsic_state *state,
+                struct btrfsic_block *const first_block,
+                struct btrfsic_block_data_ctx *const first_block_ctx,
+                struct btrfs_header *const first_hdr,
+                int first_limit_nesting, int force_iodone_flag)
+{
+        struct btrfsic_stack_frame initial_stack_frame = { 0 };
+        struct btrfsic_stack_frame *sf;
+        struct btrfsic_stack_frame *next_stack;
+
+        sf = &initial_stack_frame;
+        sf->error = 0;
+        sf->i = -1;
+        sf->limit_nesting = first_limit_nesting;
+        sf->block = first_block;
+        sf->block_ctx = first_block_ctx;
+        sf->next_block = NULL;
+        sf->hdr = first_hdr;
+        sf->prev = NULL;
+
+continue_with_new_stack_frame:
+        sf->block->generation = le64_to_cpu(sf->hdr->generation);
+        if (0 == sf->hdr->level) {
+                struct btrfs_leaf *const leafhdr =
+                    (struct btrfs_leaf *)sf->hdr;
+
+                if (-1 == sf->i) {
+                        sf->nr = le32_to_cpu(leafhdr->header.nritems);
+
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                                printk(KERN_INFO
+                                       "leaf %llu items %d generation %llu"
+                                       " owner %llu\n",
+                                       (unsigned long long)
+                                       sf->block_ctx->start,
+                                       sf->nr,
+                                       (unsigned long long)
+                                       le64_to_cpu(leafhdr->header.generation),
+                                       (unsigned long long)
+                                       le64_to_cpu(leafhdr->header.owner));
+                }
+
+continue_with_current_leaf_stack_frame:
+                if (0 == sf->num_copies || sf->mirror_num > sf->num_copies) {
+                        sf->i++;
+                        sf->num_copies = 0;
+                }
+
+                if (sf->i < sf->nr) {
+                        struct btrfs_item *disk_item = leafhdr->items + sf->i;
+                        struct btrfs_disk_key *disk_key = &disk_item->key;
+                        u8 type;
+                        const u32 item_offset = le32_to_cpu(disk_item->offset);
+
+                        type = disk_key->type;
+
+                        if (BTRFS_ROOT_ITEM_KEY == type) {
+                                const struct btrfs_root_item *const root_item =
+                                    (struct btrfs_root_item *)
+                                    (sf->block_ctx->data +
+                                     offsetof(struct btrfs_leaf, items) +
+                                     item_offset);
+                                const u64 next_bytenr =
+                                    le64_to_cpu(root_item->bytenr);
+
+                                sf->error =
+                                    btrfsic_create_link_to_next_block(
+                                                state,
+                                                sf->block,
+                                                sf->block_ctx,
+                                                next_bytenr,
+                                                sf->limit_nesting,
+                                                &sf->next_block_ctx,
+                                                &sf->next_block,
+                                                force_iodone_flag,
+                                                &sf->num_copies,
+                                                &sf->mirror_num,
+                                                disk_key,
+                                                le64_to_cpu(root_item->
+                                                generation));
+                                if (sf->error)
+                                        goto one_stack_frame_backwards;
+
+                                if (NULL != sf->next_block) {
+                                        struct btrfs_header *const next_hdr =
+                                            (struct btrfs_header *)
+                                            sf->next_block_ctx.data;
+
+                                        next_stack =
+                                            btrfsic_stack_frame_alloc();
+                                        if (NULL == next_stack) {
+                                                btrfsic_release_block_ctx(
+                                                                &sf->
+                                                                next_block_ctx);
+                                                goto one_stack_frame_backwards;
+                                        }
+
+                                        next_stack->i = -1;
+                                        next_stack->block = sf->next_block;
+                                        next_stack->block_ctx =
+                                            &sf->next_block_ctx;
+                                        next_stack->next_block = NULL;
+                                        next_stack->hdr = next_hdr;
+                                        next_stack->limit_nesting =
+                                            sf->limit_nesting - 1;
+                                        next_stack->prev = sf;
+                                        sf = next_stack;
+                                        goto continue_with_new_stack_frame;
+                                }
+                        } else if (BTRFS_EXTENT_DATA_KEY == type &&
+                                   state->include_extent_data) {
+                                sf->error = btrfsic_handle_extent_data(
+                                                state,
+                                                sf->block,
+                                                sf->block_ctx,
+                                                item_offset,
+                                                force_iodone_flag);
+                                if (sf->error)
+                                        goto one_stack_frame_backwards;
+                        }
+
+                        goto continue_with_current_leaf_stack_frame;
+                }
+        } else {
+                struct btrfs_node *const nodehdr = (struct btrfs_node *)sf->hdr;
+
+                if (-1 == sf->i) {
+                        sf->nr = le32_to_cpu(nodehdr->header.nritems);
+
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                                printk(KERN_INFO "node %llu level %d items %d"
+                                       " generation %llu owner %llu\n",
+                                       (unsigned long long)
+                                       sf->block_ctx->start,
+                                       nodehdr->header.level, sf->nr,
+                                       (unsigned long long)
+                                       le64_to_cpu(nodehdr->header.generation),
+                                       (unsigned long long)
+                                       le64_to_cpu(nodehdr->header.owner));
+                }
+
+continue_with_current_node_stack_frame:
+                if (0 == sf->num_copies || sf->mirror_num > sf->num_copies) {
+                        sf->i++;
+                        sf->num_copies = 0;
+                }
+
+                if (sf->i < sf->nr) {
+                        struct btrfs_key_ptr *disk_key_ptr =
+                            nodehdr->ptrs + sf->i;
+                        const u64 next_bytenr =
+                            le64_to_cpu(disk_key_ptr->blockptr);
+
+                        sf->error = btrfsic_create_link_to_next_block(
+                                        state,
+                                        sf->block,
+                                        sf->block_ctx,
+                                        next_bytenr,
+                                        sf->limit_nesting,
+                                        &sf->next_block_ctx,
+                                        &sf->next_block,
+                                        force_iodone_flag,
+                                        &sf->num_copies,
+                                        &sf->mirror_num,
+                                        &disk_key_ptr->key,
+                                        le64_to_cpu(disk_key_ptr->generation));
+                        if (sf->error)
+                                goto one_stack_frame_backwards;
+
+                        if (NULL != sf->next_block) {
+                                struct btrfs_header *const next_hdr =
+                                    (struct btrfs_header *)
+                                    sf->next_block_ctx.data;
+
+                                next_stack = btrfsic_stack_frame_alloc();
+                                if (NULL == next_stack)
+                                        goto one_stack_frame_backwards;
+
+                                next_stack->i = -1;
+                                next_stack->block = sf->next_block;
+                                next_stack->block_ctx = &sf->next_block_ctx;
+                                next_stack->next_block = NULL;
+                                next_stack->hdr = next_hdr;
+                                next_stack->limit_nesting =
+                                    sf->limit_nesting - 1;
+                                next_stack->prev = sf;
+                                sf = next_stack;
+                                goto continue_with_new_stack_frame;
+                        }
+
+                        goto continue_with_current_node_stack_frame;
+                }
+        }
+
+one_stack_frame_backwards:
+        if (NULL != sf->prev) {
+                struct btrfsic_stack_frame *const prev = sf->prev;
+
+                /* the one for the initial block is freed in the caller */
+                btrfsic_release_block_ctx(sf->block_ctx);
+
+                if (sf->error) {
+                        prev->error = sf->error;
+                        btrfsic_stack_frame_free(sf);
+                        sf = prev;
+                        goto one_stack_frame_backwards;
+                }
+
+                btrfsic_stack_frame_free(sf);
+                sf = prev;
+                goto continue_with_new_stack_frame;
+        } else {
+                BUG_ON(&initial_stack_frame != sf);
+        }
+
+        return sf->error;
+}
+
+static int btrfsic_create_link_to_next_block(
+                struct btrfsic_state *state,
+                struct btrfsic_block *block,
+                struct btrfsic_block_data_ctx *block_ctx,
+                u64 next_bytenr,
+                int limit_nesting,
+                struct btrfsic_block_data_ctx *next_block_ctx,
+                struct btrfsic_block **next_blockp,
+                int force_iodone_flag,
+                int *num_copiesp, int *mirror_nump,
+                struct btrfs_disk_key *disk_key,
+                u64 parent_generation)
+{
+        struct btrfsic_block *next_block = NULL;
+        int ret;
+        struct btrfsic_block_link *l;
+        int did_alloc_block_link;
+        int block_was_created;
+
+        *next_blockp = NULL;
+        if (0 == *num_copiesp) {
+                *num_copiesp =
+                    btrfs_num_copies(&state->root->fs_info->mapping_tree,
+                                     next_bytenr, PAGE_SIZE);
+                if (state->print_mask & BTRFSIC_PRINT_MASK_NUM_COPIES)
+                        printk(KERN_INFO "num_copies(log_bytenr=%llu) = %d\n",
+                               (unsigned long long)next_bytenr, *num_copiesp);
+                *mirror_nump = 1;
+        }
+
+        if (*mirror_nump > *num_copiesp)
+                return 0;
+
+        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                printk(KERN_INFO
+                       "btrfsic_create_link_to_next_block(mirror_num=%d)\n",
+                       *mirror_nump);
+        ret = btrfsic_map_block(state, next_bytenr,
+                                BTRFSIC_BLOCK_SIZE,
+                                next_block_ctx, *mirror_nump);
+        if (ret) {
+                printk(KERN_INFO
+                       "btrfsic: btrfsic_map_block(@%llu, mirror=%d) failed!\n",
+                       (unsigned long long)next_bytenr, *mirror_nump);
+                btrfsic_release_block_ctx(next_block_ctx);
+                *next_blockp = NULL;
+                return -1;
+        }
+
+        next_block = btrfsic_block_lookup_or_add(state,
+                                                 next_block_ctx, "referenced ",
+                                                 1, force_iodone_flag,
+                                                 !force_iodone_flag,
+                                                 *mirror_nump,
+                                                 &block_was_created);
+        if (NULL == next_block) {
+                btrfsic_release_block_ctx(next_block_ctx);
+                *next_blockp = NULL;
+                return -1;
+        }
+        if (block_was_created) {
+                l = NULL;
+                next_block->generation = BTRFSIC_GENERATION_UNKNOWN;
+        } else {
+                if (next_block->logical_bytenr != next_bytenr &&
+                    !(!next_block->is_metadata &&
+                      0 == next_block->logical_bytenr)) {
+                        printk(KERN_INFO
+                               "Referenced block @%llu (%s/%llu/%d)"
+                               " found in hash table, %c,"
+                               " bytenr mismatch (!= stored %llu).\n",
+                               (unsigned long long)next_bytenr,
+                               next_block_ctx->dev->name,
+                               (unsigned long long)next_block_ctx->dev_bytenr,
+                               *mirror_nump,
+                               btrfsic_get_block_type(state, next_block),
+                               (unsigned long long)next_block->logical_bytenr);
+                } else if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                        printk(KERN_INFO
+                               "Referenced block @%llu (%s/%llu/%d)"
+                               " found in hash table, %c.\n",
+                               (unsigned long long)next_bytenr,
+                               next_block_ctx->dev->name,
+                               (unsigned long long)next_block_ctx->dev_bytenr,
+                               *mirror_nump,
+                               btrfsic_get_block_type(state, next_block));
+                next_block->logical_bytenr = next_bytenr;
+
+                next_block->mirror_num = *mirror_nump;
+                l = btrfsic_block_link_hashtable_lookup(
+                                next_block_ctx->dev->bdev,
+                                next_block_ctx->dev_bytenr,
+                                block_ctx->dev->bdev,
+                                block_ctx->dev_bytenr,
+                                &state->block_link_hashtable);
+        }
+
+        next_block->disk_key = *disk_key;
+        if (NULL == l) {
+                l = btrfsic_block_link_alloc();
+                if (NULL == l) {
+                        printk(KERN_INFO "btrfsic: error, kmalloc failed!\n");
+                        btrfsic_release_block_ctx(next_block_ctx);
+                        *next_blockp = NULL;
+                        return -1;
+                }
+
+                did_alloc_block_link = 1;
+                l->block_ref_to = next_block;
+                l->block_ref_from = block;
+                l->ref_cnt = 1;
+                l->parent_generation = parent_generation;
+
+                if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                        btrfsic_print_add_link(state, l);
+
+                list_add(&l->node_ref_to, &block->ref_to_list);
+                list_add(&l->node_ref_from, &next_block->ref_from_list);
+
+                btrfsic_block_link_hashtable_add(l,
+                                                 &state->block_link_hashtable);
+        } else {
+                did_alloc_block_link = 0;
+                if (0 == limit_nesting) {
+                        l->ref_cnt++;
+                        l->parent_generation = parent_generation;
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                                btrfsic_print_add_link(state, l);
+                }
+        }
+
+        if (limit_nesting > 0 && did_alloc_block_link) {
+                ret = btrfsic_read_block(state, next_block_ctx);
+                if (ret < (int)BTRFSIC_BLOCK_SIZE) {
+                        printk(KERN_INFO
+                               "btrfsic: read block @logical %llu failed!\n",
+                               (unsigned long long)next_bytenr);
+                        btrfsic_release_block_ctx(next_block_ctx);
+                        *next_blockp = NULL;
+                        return -1;
+                }
+
+                *next_blockp = next_block;
+        } else {
+                *next_blockp = NULL;
+        }
+        (*mirror_nump)++;
+
+        return 0;
+}
+
+static int btrfsic_handle_extent_data(
+                struct btrfsic_state *state,
+                struct btrfsic_block *block,
+                struct btrfsic_block_data_ctx *block_ctx,
+                u32 item_offset, int force_iodone_flag)
+{
+        int ret;
+        struct btrfs_file_extent_item *file_extent_item =
+            (struct btrfs_file_extent_item *)(block_ctx->data +
+                                              offsetof(struct btrfs_leaf,
+                                                       items) + item_offset);
+        u64 next_bytenr =
+            le64_to_cpu(file_extent_item->disk_bytenr) +
+            le64_to_cpu(file_extent_item->offset);
+        u64 num_bytes = le64_to_cpu(file_extent_item->num_bytes);
+        u64 generation = le64_to_cpu(file_extent_item->generation);
+        struct btrfsic_block_link *l;
+
+        if (state->print_mask & BTRFSIC_PRINT_MASK_VERY_VERBOSE)
+                printk(KERN_INFO "extent_data: type %u, disk_bytenr = %llu,"
+                       " offset = %llu, num_bytes = %llu\n",
+                       file_extent_item->type,
+                       (unsigned long long)
+                       le64_to_cpu(file_extent_item->disk_bytenr),
+                       (unsigned long long)
+                       le64_to_cpu(file_extent_item->offset),
+                       (unsigned long long)
+                       le64_to_cpu(file_extent_item->num_bytes));
+        if (BTRFS_FILE_EXTENT_REG != file_extent_item->type ||
+            ((u64)0) == le64_to_cpu(file_extent_item->disk_bytenr))
+                return 0;
+        while (num_bytes > 0) {
+                u32 chunk_len;
+                int num_copies;
+                int mirror_num;
+
+                if (num_bytes > BTRFSIC_BLOCK_SIZE)
+                        chunk_len = BTRFSIC_BLOCK_SIZE;
+                else
+                        chunk_len = num_bytes;
+
+                num_copies =
+                    btrfs_num_copies(&state->root->fs_info->mapping_tree,
+                                     next_bytenr, PAGE_SIZE);
+                if (state->print_mask & BTRFSIC_PRINT_MASK_NUM_COPIES)
+                        printk(KERN_INFO "num_copies(log_bytenr=%llu) = %d\n",
+                               (unsigned long long)next_bytenr, num_copies);
+                for (mirror_num = 1; mirror_num <= num_copies; mirror_num++) {
+                        struct btrfsic_block_data_ctx next_block_ctx;
+                        struct btrfsic_block *next_block;
+                        int block_was_created;
+
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                                printk(KERN_INFO "btrfsic_handle_extent_data("
+                                       "mirror_num=%d)\n", mirror_num);
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERY_VERBOSE)
+                                printk(KERN_INFO
+                                       "\tdisk_bytenr = %llu, num_bytes %u\n",
+                                       (unsigned long long)next_bytenr,
+                                       chunk_len);
+                        ret = btrfsic_map_block(state, next_bytenr,
+                                                chunk_len, &next_block_ctx,
+                                                mirror_num);
+                        if (ret) {
+                                printk(KERN_INFO
+                                       "btrfsic: btrfsic_map_block(@%llu,"
+                                       " mirror=%d) failed!\n",
+                                       (unsigned long long)next_bytenr,
+                                       mirror_num);
+                                return -1;
+                        }
+
+                        next_block = btrfsic_block_lookup_or_add(
+                                        state,
+                                        &next_block_ctx,
+                                        "referenced ",
+                                        0,
+                                        force_iodone_flag,
+                                        !force_iodone_flag,
+                                        mirror_num,
+                                        &block_was_created);
+                        if (NULL == next_block) {
+                                printk(KERN_INFO
+                                       "btrfsic: error, kmalloc failed!\n");
+                                btrfsic_release_block_ctx(&next_block_ctx);
+                                return -1;
+                        }
+                        if (!block_was_created) {
+                                if (next_block->logical_bytenr != next_bytenr &&
+                                    !(!next_block->is_metadata &&
+                                      0 == next_block->logical_bytenr)) {
+                                        printk(KERN_INFO
+                                               "Referenced block"
+                                               " @%llu (%s/%llu/%d)"
+                                               " found in hash table, D,"
+                                               " bytenr mismatch"
+                                               " (!= stored %llu).\n",
+                                               (unsigned long long)next_bytenr,
+                                               next_block_ctx.dev->name,
+                                               (unsigned long long)
+                                               next_block_ctx.dev_bytenr,
+                                               mirror_num,
+                                               (unsigned long long)
+                                               next_block->logical_bytenr);
+                                }
+                                next_block->logical_bytenr = next_bytenr;
+                                next_block->mirror_num = mirror_num;
+                        }
+
+                        l = btrfsic_block_link_lookup_or_add(state,
+                                                             &next_block_ctx,
+                                                             next_block, block,
+                                                             generation);
+                        btrfsic_release_block_ctx(&next_block_ctx);
+                        if (NULL == l)
+                                return -1;
+                }
+
+                next_bytenr += chunk_len;
+                num_bytes -= chunk_len;
+        }
+
+        return 0;
+}
+
+static int btrfsic_map_block(struct btrfsic_state *state, u64 bytenr, u32 len,
+                             struct btrfsic_block_data_ctx *block_ctx_out,
+                             int mirror_num)
+{
+        int ret;
+        u64 length;
+        struct btrfs_bio *multi = NULL;
+        struct btrfs_device *device;
+
+        length = len;
+        ret = btrfs_map_block(&state->root->fs_info->mapping_tree, READ,
+                              bytenr, &length, &multi, mirror_num);
+
+        device = multi->stripes[0].dev;
+        block_ctx_out->dev = btrfsic_dev_state_lookup(device->bdev);
+        block_ctx_out->dev_bytenr = multi->stripes[0].physical;
+        block_ctx_out->start = bytenr;
+        block_ctx_out->len = len;
+        block_ctx_out->data = NULL;
+        block_ctx_out->bh = NULL;
+
+        if (0 == ret)
+                kfree(multi);
+        if (NULL == block_ctx_out->dev) {
+                ret = -ENXIO;
+                printk(KERN_INFO "btrfsic: error, cannot lookup dev (#1)!\n");
+        }
+
+        return ret;
+}
+
+static int btrfsic_map_superblock(struct btrfsic_state *state, u64 bytenr,
+                                  u32 len, struct block_device *bdev,
+                                  struct btrfsic_block_data_ctx *block_ctx_out)
+{
+        block_ctx_out->dev = btrfsic_dev_state_lookup(bdev);
+        block_ctx_out->dev_bytenr = bytenr;
+        block_ctx_out->start = bytenr;
+        block_ctx_out->len = len;
+        block_ctx_out->data = NULL;
+        block_ctx_out->bh = NULL;
+        if (NULL != block_ctx_out->dev) {
+                return 0;
+        } else {
+                printk(KERN_INFO "btrfsic: error, cannot lookup dev (#2)!\n");
+                return -ENXIO;
+        }
+}
+
+static void btrfsic_release_block_ctx(struct btrfsic_block_data_ctx *block_ctx)
+{
+        if (NULL != block_ctx->bh) {
+                brelse(block_ctx->bh);
+                block_ctx->bh = NULL;
+        }
+}
+
+static int btrfsic_read_block(struct btrfsic_state *state,
+                              struct btrfsic_block_data_ctx *block_ctx)
+{
+        block_ctx->bh = NULL;
+        if (block_ctx->dev_bytenr & 4095) {
+                printk(KERN_INFO
+                       "btrfsic: read_block() with unaligned bytenr %llu\n",
+                       (unsigned long long)block_ctx->dev_bytenr);
+                return -1;
+        }
+        if (block_ctx->len > 4096) {
+                printk(KERN_INFO
+                       "btrfsic: read_block() with too huge size %d\n",
+                       block_ctx->len);
+                return -1;
+        }
+
+        block_ctx->bh = __bread(block_ctx->dev->bdev,
+                                block_ctx->dev_bytenr >> 12, 4096);
+        if (NULL == block_ctx->bh)
+                return -1;
+        block_ctx->data = block_ctx->bh->b_data;
+
+        return block_ctx->len;
+}
+
+static void btrfsic_dump_database(struct btrfsic_state *state)
+{
+        struct list_head *elem_all;
+
+        BUG_ON(NULL == state);
+
+        printk(KERN_INFO "all_blocks_list:\n");
+        list_for_each(elem_all, &state->all_blocks_list) {
+                const struct btrfsic_block *const b_all =
+                    list_entry(elem_all, struct btrfsic_block,
+                               all_blocks_node);
+                struct list_head *elem_ref_to;
+                struct list_head *elem_ref_from;
+
+                printk(KERN_INFO "%c-block @%llu (%s/%llu/%d)\n",
+                       btrfsic_get_block_type(state, b_all),
+                       (unsigned long long)b_all->logical_bytenr,
+                       b_all->dev_state->name,
+                       (unsigned long long)b_all->dev_bytenr,
+                       b_all->mirror_num);
+
+                list_for_each(elem_ref_to, &b_all->ref_to_list) {
+                        const struct btrfsic_block_link *const l =
+                            list_entry(elem_ref_to,
+                                       struct btrfsic_block_link,
+                                       node_ref_to);
+
+                        printk(KERN_INFO " %c @%llu (%s/%llu/%d)"
+                               " refers %u* to"
+                               " %c @%llu (%s/%llu/%d)\n",
+                               btrfsic_get_block_type(state, b_all),
+                               (unsigned long long)b_all->logical_bytenr,
+                               b_all->dev_state->name,
+                               (unsigned long long)b_all->dev_bytenr,
+                               b_all->mirror_num,
+                               l->ref_cnt,
+                               btrfsic_get_block_type(state, l->block_ref_to),
+                               (unsigned long long)
+                               l->block_ref_to->logical_bytenr,
+                               l->block_ref_to->dev_state->name,
+                               (unsigned long long)l->block_ref_to->dev_bytenr,
+                               l->block_ref_to->mirror_num);
+                }
+
+                list_for_each(elem_ref_from, &b_all->ref_from_list) {
+                        const struct btrfsic_block_link *const l =
+                            list_entry(elem_ref_from,
+                                       struct btrfsic_block_link,
+                                       node_ref_from);
+
+                        printk(KERN_INFO " %c @%llu (%s/%llu/%d)"
+                               " is ref %u* from"
+                               " %c @%llu (%s/%llu/%d)\n",
+                               btrfsic_get_block_type(state, b_all),
+                               (unsigned long long)b_all->logical_bytenr,
+                               b_all->dev_state->name,
+                               (unsigned long long)b_all->dev_bytenr,
+                               b_all->mirror_num,
+                               l->ref_cnt,
+                               btrfsic_get_block_type(state, l->block_ref_from),
+                               (unsigned long long)
+                               l->block_ref_from->logical_bytenr,
+                               l->block_ref_from->dev_state->name,
+                               (unsigned long long)
+                               l->block_ref_from->dev_bytenr,
+                               l->block_ref_from->mirror_num);
+                }
+
+                printk(KERN_INFO "\n");
+        }
+}
+
+/*
+ * Test whether the disk block contains a tree block (leaf or node)
+ * (note that this test fails for the super block)
+ */
+static int btrfsic_test_for_metadata(struct btrfsic_state *state,
+                                     const u8 *data, unsigned int size)
+{
+        struct btrfs_header *h;
+        u8 csum[BTRFS_CSUM_SIZE];
+        u32 crc = ~(u32)0;
+        int fail = 0;
+        int crc_fail = 0;
+
+        h = (struct btrfs_header *)data;
+
+        if (memcmp(h->fsid, state->root->fs_info->fsid, BTRFS_UUID_SIZE))
+                fail++;
+
+        crc = crc32c(crc, data + BTRFS_CSUM_SIZE, PAGE_SIZE - BTRFS_CSUM_SIZE);
+        btrfs_csum_final(crc, csum);
+        if (memcmp(csum, h->csum, state->csum_size))
+                crc_fail++;
+
+        return fail || crc_fail;
+}
+
+static void btrfsic_process_written_block(struct btrfsic_dev_state *dev_state,
+                                          u64 dev_bytenr,
+                                          u8 *mapped_data, unsigned int len,
+                                          struct bio *bio,
+                                          int *bio_is_patched,
+                                          struct buffer_head *bh,
+                                          int submit_bio_bh_rw)
+{
+        int is_metadata;
+        struct btrfsic_block *block;
+        struct btrfsic_block_data_ctx block_ctx;
+        int ret;
+        struct btrfsic_state *state = dev_state->state;
+        struct block_device *bdev = dev_state->bdev;
+
+        WARN_ON(len > PAGE_SIZE);
+        is_metadata = (0 == btrfsic_test_for_metadata(state, mapped_data, len));
+        if (NULL != bio_is_patched)
+                *bio_is_patched = 0;
+
+        block = btrfsic_block_hashtable_lookup(bdev, dev_bytenr,
+                                               &state->block_hashtable);
+        if (NULL != block) {
+                u64 bytenr;
+                struct list_head *elem_ref_to;
+                struct list_head *tmp_ref_to;
+
+                if (block->is_superblock) {
+                        bytenr = le64_to_cpu(((struct btrfs_super_block *)
+                                              mapped_data)->bytenr);
+                        is_metadata = 1;
+                        if (state->print_mask &
+                            BTRFSIC_PRINT_MASK_TREE_BEFORE_SB_WRITE) {
+                                printk(KERN_INFO
+                                       "[before new superblock is written]:\n");
+                                btrfsic_dump_tree_sub(state, block, 0);
+                        }
+                }
+                if (is_metadata) {
+                        if (!block->is_superblock) {
+                                bytenr = le64_to_cpu(((struct btrfs_header *)
+                                                      mapped_data)->bytenr);
+                                btrfsic_cmp_log_and_dev_bytenr(state, bytenr,
+                                                               dev_state,
+                                                               dev_bytenr,
+                                                               mapped_data);
+                        }
+                        if (block->logical_bytenr != bytenr) {
+                                printk(KERN_INFO
+                                       "Written block @%llu (%s/%llu/%d)"
+                                       " found in hash table, %c,"
+                                       " bytenr mismatch"
+                                       " (!= stored %llu).\n",
+                                       (unsigned long long)bytenr,
+                                       dev_state->name,
+                                       (unsigned long long)dev_bytenr,
+                                       block->mirror_num,
+                                       btrfsic_get_block_type(state, block),
+                                       (unsigned long long)
+                                       block->logical_bytenr);
+                                block->logical_bytenr = bytenr;
+                        } else if (state->print_mask &
+                                   BTRFSIC_PRINT_MASK_VERBOSE)
+                                printk(KERN_INFO
+                                       "Written block @%llu (%s/%llu/%d)"
+                                       " found in hash table, %c.\n",
+                                       (unsigned long long)bytenr,
+                                       dev_state->name,
+                                       (unsigned long long)dev_bytenr,
+                                       block->mirror_num,
+                                       btrfsic_get_block_type(state, block));
+                } else {
+                        bytenr = block->logical_bytenr;
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                                printk(KERN_INFO
+                                       "Written block @%llu (%s/%llu/%d)"
+                                       " found in hash table, %c.\n",
+                                       (unsigned long long)bytenr,
+                                       dev_state->name,
+                                       (unsigned long long)dev_bytenr,
+                                       block->mirror_num,
+                                       btrfsic_get_block_type(state, block));
+                }
+
+                if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                        printk(KERN_INFO
+                               "ref_to_list: %cE, ref_from_list: %cE\n",
+                               list_empty(&block->ref_to_list) ? ' ' : '!',
+                               list_empty(&block->ref_from_list) ? ' ' : '!');
+                if (btrfsic_is_block_ref_by_superblock(state, block, 0)) {
+                        printk(KERN_INFO "btrfs: attempt to overwrite %c-block"
+                               " @%llu (%s/%llu/%d), old(gen=%llu,"
+                               " objectid=%llu, type=%d, offset=%llu),"
+                               " new(gen=%llu),"
+                               " which is referenced by most recent superblock"
+                               " (superblockgen=%llu)!\n",
+                               btrfsic_get_block_type(state, block),
+                               (unsigned long long)bytenr,
+                               dev_state->name,
+                               (unsigned long long)dev_bytenr,
+                               block->mirror_num,
+                               (unsigned long long)block->generation,
+                               (unsigned long long)
+                               le64_to_cpu(block->disk_key.objectid),
+                               block->disk_key.type,
+                               (unsigned long long)
+                               le64_to_cpu(block->disk_key.offset),
+                               (unsigned long long)
+                               le64_to_cpu(((struct btrfs_header *)
+                                            mapped_data)->generation),
+                               (unsigned long long)
+                               state->max_superblock_generation);
+                        btrfsic_dump_tree(state);
+                }
+
+                if (!block->is_iodone && !block->never_written) {
+                        printk(KERN_INFO "btrfs: attempt to overwrite %c-block"
+                               " @%llu (%s/%llu/%d), oldgen=%llu, newgen=%llu,"
+                               " which is not yet iodone!\n",
+                               btrfsic_get_block_type(state, block),
+                               (unsigned long long)bytenr,
+                               dev_state->name,
+                               (unsigned long long)dev_bytenr,
+                               block->mirror_num,
+                               (unsigned long long)block->generation,
+                               (unsigned long long)
+                               le64_to_cpu(((struct btrfs_header *)
+                                            mapped_data)->generation));
+                        /* it would not be safe to go on */
+                        btrfsic_dump_tree(state);
+                        return;
+                }
+
+                /*
+                 * Clear all references of this block. Do not free
+                 * the block itself even if is not referenced anymore
+                 * because it still carries valueable information
+                 * like whether it was ever written and IO completed.
+                 */
+                list_for_each_safe(elem_ref_to, tmp_ref_to,
+                                   &block->ref_to_list) {
+                        struct btrfsic_block_link *const l =
+                            list_entry(elem_ref_to,
+                                       struct btrfsic_block_link,
+                                       node_ref_to);
+
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                                btrfsic_print_rem_link(state, l);
+                        l->ref_cnt--;
+                        if (0 == l->ref_cnt) {
+                                list_del(&l->node_ref_to);
+                                list_del(&l->node_ref_from);
+                                btrfsic_block_link_hashtable_remove(l);
+                                btrfsic_block_link_free(l);
+                        }
+                }
+
+                if (block->is_superblock)
+                        ret = btrfsic_map_superblock(state, bytenr, len,
+                                                     bdev, &block_ctx);
+                else
+                        ret = btrfsic_map_block(state, bytenr, len,
+                                                &block_ctx, 0);
+                if (ret) {
+                        printk(KERN_INFO
+                               "btrfsic: btrfsic_map_block(root @%llu)"
+                               " failed!\n", (unsigned long long)bytenr);
+                        return;
+                }
+                block_ctx.data = mapped_data;
+                /* the following is required in case of writes to mirrors,
+                 * use the same that was used for the lookup */
+                block_ctx.dev = dev_state;
+                block_ctx.dev_bytenr = dev_bytenr;
+
+                if (is_metadata || state->include_extent_data) {
+                        block->never_written = 0;
+                        block->iodone_w_error = 0;
+                        if (NULL != bio) {
+                                block->is_iodone = 0;
+                                BUG_ON(NULL == bio_is_patched);
+                                if (!*bio_is_patched) {
+                                        block->orig_bio_bh_private =
+                                            bio->bi_private;
+                                        block->orig_bio_bh_end_io.bio =
+                                            bio->bi_end_io;
+                                        block->next_in_same_bio = NULL;
+                                        bio->bi_private = block;
+                                        bio->bi_end_io = btrfsic_bio_end_io;
+                                        *bio_is_patched = 1;
+                                } else {
+                                        struct btrfsic_block *chained_block =
+                                            (struct btrfsic_block *)
+                                            bio->bi_private;
+
+                                        BUG_ON(NULL == chained_block);
+                                        block->orig_bio_bh_private =
+                                            chained_block->orig_bio_bh_private;
+                                        block->orig_bio_bh_end_io.bio =
+                                            chained_block->orig_bio_bh_end_io.
+                                            bio;
+                                        block->next_in_same_bio = chained_block;
+                                        bio->bi_private = block;
+                                }
+                        } else if (NULL != bh) {
+                                block->is_iodone = 0;
+                                block->orig_bio_bh_private = bh->b_private;
+                                block->orig_bio_bh_end_io.bh = bh->b_end_io;
+                                block->next_in_same_bio = NULL;
+                                bh->b_private = block;
+                                bh->b_end_io = btrfsic_bh_end_io;
+                        } else {
+                                block->is_iodone = 1;
+                                block->orig_bio_bh_private = NULL;
+                                block->orig_bio_bh_end_io.bio = NULL;
+                                block->next_in_same_bio = NULL;
+                        }
+                }
+
+                block->flush_gen = dev_state->last_flush_gen + 1;
+                block->submit_bio_bh_rw = submit_bio_bh_rw;
+                if (is_metadata) {
+                        block->logical_bytenr = bytenr;
+                        block->is_metadata = 1;
+                        if (block->is_superblock) {
+                                ret = btrfsic_process_written_superblock(
+                                                state,
+                                                block,
+                                                (struct btrfs_super_block *)
+                                                mapped_data);
+                                if (state->print_mask &
+                                    BTRFSIC_PRINT_MASK_TREE_AFTER_SB_WRITE) {
+                                        printk(KERN_INFO
+                                        "[after new superblock is written]:\n");
+                                        btrfsic_dump_tree_sub(state, block, 0);
+                                }
+                        } else {
+                                block->mirror_num = 0;  /* unknown */
+                                ret = btrfsic_process_metablock(
+                                                state,
+                                                block,
+                                                &block_ctx,
+                                                (struct btrfs_header *)
+                                                block_ctx.data,
+                                                0, 0);
+                        }
+                        if (ret)
+                                printk(KERN_INFO
+                                       "btrfsic: btrfsic_process_metablock"
+                                       "(root @%llu) failed!\n",
+                                       (unsigned long long)dev_bytenr);
+                } else {
+                        block->is_metadata = 0;
+                        block->mirror_num = 0;  /* unknown */
+                        block->generation = BTRFSIC_GENERATION_UNKNOWN;
+                        if (!state->include_extent_data
+                            && list_empty(&block->ref_from_list)) {
+                                /*
+                                 * disk block is overwritten with extent
+                                 * data (not meta data) and we are configured
+                                 * to not include extent data: take the
+                                 * chance and free the block's memory
+                                 */
+                                btrfsic_block_hashtable_remove(block);
+                                list_del(&block->all_blocks_node);
+                                btrfsic_block_free(block);
+                        }
+                }
+                btrfsic_release_block_ctx(&block_ctx);
+        } else {
+                /* block has not been found in hash table */
+                u64 bytenr;
+
+                if (!is_metadata) {
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                                printk(KERN_INFO "Written block (%s/%llu/?)"
+                                       " !found in hash table, D.\n",
+                                       dev_state->name,
+                                       (unsigned long long)dev_bytenr);
+                        if (!state->include_extent_data)
+                                return; /* ignore that written D block */
+
+                        /* this is getting ugly for the
+                         * include_extent_data case... */
+                        bytenr = 0;     /* unknown */
+                        block_ctx.start = bytenr;
+                        block_ctx.len = len;
+                        block_ctx.bh = NULL;
+                } else {
+                        bytenr = le64_to_cpu(((struct btrfs_header *)
+                                              mapped_data)->bytenr);
+                        btrfsic_cmp_log_and_dev_bytenr(state, bytenr, dev_state,
+                                                       dev_bytenr,
+                                                       mapped_data);
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                                printk(KERN_INFO
+                                       "Written block @%llu (%s/%llu/?)"
+                                       " !found in hash table, M.\n",
+                                       (unsigned long long)bytenr,
+                                       dev_state->name,
+                                       (unsigned long long)dev_bytenr);
+
+                        ret = btrfsic_map_block(state, bytenr, len, &block_ctx,
+                                                0);
+                        if (ret) {
+                                printk(KERN_INFO
+                                       "btrfsic: btrfsic_map_block(root @%llu)"
+                                       " failed!\n",
+                                       (unsigned long long)dev_bytenr);
+                                return;
+                        }
+                }
+                block_ctx.data = mapped_data;
+                /* the following is required in case of writes to mirrors,
+                 * use the same that was used for the lookup */
+                block_ctx.dev = dev_state;
+                block_ctx.dev_bytenr = dev_bytenr;
+
+                block = btrfsic_block_alloc();
+                if (NULL == block) {
+                        printk(KERN_INFO "btrfsic: error, kmalloc failed!\n");
+                        btrfsic_release_block_ctx(&block_ctx);
+                        return;
+                }
+                block->dev_state = dev_state;
+                block->dev_bytenr = dev_bytenr;
+                block->logical_bytenr = bytenr;
+                block->is_metadata = is_metadata;
+                block->never_written = 0;
+                block->iodone_w_error = 0;
+                block->mirror_num = 0;  /* unknown */
+                block->flush_gen = dev_state->last_flush_gen + 1;
+                block->submit_bio_bh_rw = submit_bio_bh_rw;
+                if (NULL != bio) {
+                        block->is_iodone = 0;
+                        BUG_ON(NULL == bio_is_patched);
+                        if (!*bio_is_patched) {
+                                block->orig_bio_bh_private = bio->bi_private;
+                                block->orig_bio_bh_end_io.bio = bio->bi_end_io;
+                                block->next_in_same_bio = NULL;
+                                bio->bi_private = block;
+                                bio->bi_end_io = btrfsic_bio_end_io;
+                                *bio_is_patched = 1;
+                        } else {
+                                struct btrfsic_block *chained_block =
+                                    (struct btrfsic_block *)
+                                    bio->bi_private;
+
+                                BUG_ON(NULL == chained_block);
+                                block->orig_bio_bh_private =
+                                    chained_block->orig_bio_bh_private;
+                                block->orig_bio_bh_end_io.bio =
+                                    chained_block->orig_bio_bh_end_io.bio;
+                                block->next_in_same_bio = chained_block;
+                                bio->bi_private = block;
+                        }
+                } else if (NULL != bh) {
+                        block->is_iodone = 0;
+                        block->orig_bio_bh_private = bh->b_private;
+                        block->orig_bio_bh_end_io.bh = bh->b_end_io;
+                        block->next_in_same_bio = NULL;
+                        bh->b_private = block;
+                        bh->b_end_io = btrfsic_bh_end_io;
+                } else {
+                        block->is_iodone = 1;
+                        block->orig_bio_bh_private = NULL;
+                        block->orig_bio_bh_end_io.bio = NULL;
+                        block->next_in_same_bio = NULL;
+                }
+                if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                        printk(KERN_INFO
+                               "New written %c-block @%llu (%s/%llu/%d)\n",
+                               is_metadata ? 'M' : 'D',
+                               (unsigned long long)block->logical_bytenr,
+                               block->dev_state->name,
+                               (unsigned long long)block->dev_bytenr,
+                               block->mirror_num);
+                list_add(&block->all_blocks_node, &state->all_blocks_list);
+                btrfsic_block_hashtable_add(block, &state->block_hashtable);
+
+                if (is_metadata) {
+                        ret = btrfsic_process_metablock(state, block,
+                                                        &block_ctx,
+                                                        (struct btrfs_header *)
+                                                        block_ctx.data, 0, 0);
+                        if (ret)
+                                printk(KERN_INFO
+                                       "btrfsic: process_metablock(root @%llu)"
+                                       " failed!\n",
+                                       (unsigned long long)dev_bytenr);
+                }
+                btrfsic_release_block_ctx(&block_ctx);
+        }
+}
+
+static void btrfsic_bio_end_io(struct bio *bp, int bio_error_status)
+{
+        struct btrfsic_block *block = (struct btrfsic_block *)bp->bi_private;
+        int iodone_w_error;
+
+        /* mutex is not held! This is not save if IO is not yet completed
+         * on umount */
+        iodone_w_error = 0;
+        if (bio_error_status)
+                iodone_w_error = 1;
+
+        BUG_ON(NULL == block);
+        bp->bi_private = block->orig_bio_bh_private;
+        bp->bi_end_io = block->orig_bio_bh_end_io.bio;
+
+        do {
+                struct btrfsic_block *next_block;
+                struct btrfsic_dev_state *const dev_state = block->dev_state;
+
+                if ((dev_state->state->print_mask &
+                     BTRFSIC_PRINT_MASK_END_IO_BIO_BH))
+                        printk(KERN_INFO
+                               "bio_end_io(err=%d) for %c @%llu (%s/%llu/%d)\n",
+                               bio_error_status,
+                               btrfsic_get_block_type(dev_state->state, block),
+                               (unsigned long long)block->logical_bytenr,
+                               dev_state->name,
+                               (unsigned long long)block->dev_bytenr,
+                               block->mirror_num);
+                next_block = block->next_in_same_bio;
+                block->iodone_w_error = iodone_w_error;
+                if (block->submit_bio_bh_rw & REQ_FLUSH) {
+                        dev_state->last_flush_gen++;
+                        if ((dev_state->state->print_mask &
+                             BTRFSIC_PRINT_MASK_END_IO_BIO_BH))
+                                printk(KERN_INFO
+                                       "bio_end_io() new %s flush_gen=%llu\n",
+                                       dev_state->name,
+                                       (unsigned long long)
+                                       dev_state->last_flush_gen);
+                }
+                if (block->submit_bio_bh_rw & REQ_FUA)
+                        block->flush_gen = 0; /* FUA completed means block is
+                                               * on disk */
+                block->is_iodone = 1; /* for FLUSH, this releases the block */
+                block = next_block;
+        } while (NULL != block);
+
+        bp->bi_end_io(bp, bio_error_status);
+}
+
+static void btrfsic_bh_end_io(struct buffer_head *bh, int uptodate)
+{
+        struct btrfsic_block *block = (struct btrfsic_block *)bh->b_private;
+        int iodone_w_error = !uptodate;
+        struct btrfsic_dev_state *dev_state;
+
+        BUG_ON(NULL == block);
+        dev_state = block->dev_state;
+        if ((dev_state->state->print_mask & BTRFSIC_PRINT_MASK_END_IO_BIO_BH))
+                printk(KERN_INFO
+                       "bh_end_io(error=%d) for %c @%llu (%s/%llu/%d)\n",
+                       iodone_w_error,
+                       btrfsic_get_block_type(dev_state->state, block),
+                       (unsigned long long)block->logical_bytenr,
+                       block->dev_state->name,
+                       (unsigned long long)block->dev_bytenr,
+                       block->mirror_num);
+
+        block->iodone_w_error = iodone_w_error;
+        if (block->submit_bio_bh_rw & REQ_FLUSH) {
+                dev_state->last_flush_gen++;
+                if ((dev_state->state->print_mask &
+                     BTRFSIC_PRINT_MASK_END_IO_BIO_BH))
+                        printk(KERN_INFO
+                               "bh_end_io() new %s flush_gen=%llu\n",
+                               dev_state->name,
+                               (unsigned long long)dev_state->last_flush_gen);
+        }
+        if (block->submit_bio_bh_rw & REQ_FUA)
+                block->flush_gen = 0; /* FUA completed means block is on disk */
+
+        bh->b_private = block->orig_bio_bh_private;
+        bh->b_end_io = block->orig_bio_bh_end_io.bh;
+        block->is_iodone = 1; /* for FLUSH, this releases the block */
+        bh->b_end_io(bh, uptodate);
+}
+
+static int btrfsic_process_written_superblock(
+                struct btrfsic_state *state,
+                struct btrfsic_block *const superblock,
+                struct btrfs_super_block *const super_hdr)
+{
+        int pass;
+
+        superblock->generation = btrfs_super_generation(super_hdr);
+        if (!(superblock->generation > state->max_superblock_generation ||
+              0 == state->max_superblock_generation)) {
+                if (state->print_mask & BTRFSIC_PRINT_MASK_SUPERBLOCK_WRITE)
+                        printk(KERN_INFO
+                               "btrfsic: superblock @%llu (%s/%llu/%d)"
+                               " with old gen %llu <= %llu\n",
+                               (unsigned long long)superblock->logical_bytenr,
+                               superblock->dev_state->name,
+                               (unsigned long long)superblock->dev_bytenr,
+                               superblock->mirror_num,
+                               (unsigned long long)
+                               btrfs_super_generation(super_hdr),
+                               (unsigned long long)
+                               state->max_superblock_generation);
+        } else {
+                if (state->print_mask & BTRFSIC_PRINT_MASK_SUPERBLOCK_WRITE)
+                        printk(KERN_INFO
+                               "btrfsic: got new superblock @%llu (%s/%llu/%d)"
+                               " with new gen %llu > %llu\n",
+                               (unsigned long long)superblock->logical_bytenr,
+                               superblock->dev_state->name,
+                               (unsigned long long)superblock->dev_bytenr,
+                               superblock->mirror_num,
+                               (unsigned long long)
+                               btrfs_super_generation(super_hdr),
+                               (unsigned long long)
+                               state->max_superblock_generation);
+
+                state->max_superblock_generation =
+                    btrfs_super_generation(super_hdr);
+                state->latest_superblock = superblock;
+        }
+
+        for (pass = 0; pass < 3; pass++) {
+                int ret;
+                u64 next_bytenr;
+                struct btrfsic_block *next_block;
+                struct btrfsic_block_data_ctx tmp_next_block_ctx;
+                struct btrfsic_block_link *l;
+                int num_copies;
+                int mirror_num;
+                const char *additional_string = NULL;
+                struct btrfs_disk_key tmp_disk_key;
+
+                tmp_disk_key.type = BTRFS_ROOT_ITEM_KEY;
+                tmp_disk_key.offset = 0;
+
+                switch (pass) {
+                case 0:
+                        tmp_disk_key.objectid =
+                            cpu_to_le64(BTRFS_ROOT_TREE_OBJECTID);
+                        additional_string = "root ";
+                        next_bytenr = btrfs_super_root(super_hdr);
+                        if (state->print_mask &
+                            BTRFSIC_PRINT_MASK_ROOT_CHUNK_LOG_TREE_LOCATION)
+                                printk(KERN_INFO "root@%llu\n",
+                                       (unsigned long long)next_bytenr);
+                        break;
+                case 1:
+                        tmp_disk_key.objectid =
+                            cpu_to_le64(BTRFS_CHUNK_TREE_OBJECTID);
+                        additional_string = "chunk ";
+                        next_bytenr = btrfs_super_chunk_root(super_hdr);
+                        if (state->print_mask &
+                            BTRFSIC_PRINT_MASK_ROOT_CHUNK_LOG_TREE_LOCATION)
+                                printk(KERN_INFO "chunk@%llu\n",
+                                       (unsigned long long)next_bytenr);
+                        break;
+                case 2:
+                        tmp_disk_key.objectid =
+                            cpu_to_le64(BTRFS_TREE_LOG_OBJECTID);
+                        additional_string = "log ";
+                        next_bytenr = btrfs_super_log_root(super_hdr);
+                        if (0 == next_bytenr)
+                                continue;
+                        if (state->print_mask &
+                            BTRFSIC_PRINT_MASK_ROOT_CHUNK_LOG_TREE_LOCATION)
+                                printk(KERN_INFO "log@%llu\n",
+                                       (unsigned long long)next_bytenr);
+                        break;
+                }
+
+                num_copies =
+                    btrfs_num_copies(&state->root->fs_info->mapping_tree,
+                                     next_bytenr, PAGE_SIZE);
+                if (state->print_mask & BTRFSIC_PRINT_MASK_NUM_COPIES)
+                        printk(KERN_INFO "num_copies(log_bytenr=%llu) = %d\n",
+                               (unsigned long long)next_bytenr, num_copies);
+                for (mirror_num = 1; mirror_num <= num_copies; mirror_num++) {
+                        int was_created;
+
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                                printk(KERN_INFO
+                                       "btrfsic_process_written_superblock("
+                                       "mirror_num=%d)\n", mirror_num);
+                        ret = btrfsic_map_block(state, next_bytenr, PAGE_SIZE,
+                                                &tmp_next_block_ctx,
+                                                mirror_num);
+                        if (ret) {
+                                printk(KERN_INFO
+                                       "btrfsic: btrfsic_map_block(@%llu,"
+                                       " mirror=%d) failed!\n",
+                                       (unsigned long long)next_bytenr,
+                                       mirror_num);
+                                return -1;
+                        }
+
+                        next_block = btrfsic_block_lookup_or_add(
+                                        state,
+                                        &tmp_next_block_ctx,
+                                        additional_string,
+                                        1, 0, 1,
+                                        mirror_num,
+                                        &was_created);
+                        if (NULL == next_block) {
+                                printk(KERN_INFO
+                                       "btrfsic: error, kmalloc failed!\n");
+                                btrfsic_release_block_ctx(&tmp_next_block_ctx);
+                                return -1;
+                        }
+
+                        next_block->disk_key = tmp_disk_key;
+                        if (was_created)
+                                next_block->generation =
+                                    BTRFSIC_GENERATION_UNKNOWN;
+                        l = btrfsic_block_link_lookup_or_add(
+                                        state,
+                                        &tmp_next_block_ctx,
+                                        next_block,
+                                        superblock,
+                                        BTRFSIC_GENERATION_UNKNOWN);
+                        btrfsic_release_block_ctx(&tmp_next_block_ctx);
+                        if (NULL == l)
+                                return -1;
+                }
+        }
+
+        if (-1 == btrfsic_check_all_ref_blocks(state, superblock, 0)) {
+                WARN_ON(1);
+                btrfsic_dump_tree(state);
+        }
+
+        return 0;
+}
+
+static int btrfsic_check_all_ref_blocks(struct btrfsic_state *state,
+                                        struct btrfsic_block *const block,
+                                        int recursion_level)
+{
+        struct list_head *elem_ref_to;
+        int ret = 0;
+
+        if (recursion_level >= 3 + BTRFS_MAX_LEVEL) {
+                /*
+                 * Note that this situation can happen and does not
+                 * indicate an error in regular cases. It happens
+                 * when disk blocks are freed and later reused.
+                 * The check-integrity module is not aware of any
+                 * block free operations, it just recognizes block
+                 * write operations. Therefore it keeps the linkage
+                 * information for a block until a block is
+                 * rewritten. This can temporarily cause incorrect
+                 * and even circular linkage informations. This
+                 * causes no harm unless such blocks are referenced
+                 * by the most recent super block.
+                 */
+                if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                        printk(KERN_INFO
+                               "btrfsic: abort cyclic linkage (case 1).\n");
+
+                return ret;
+        }
+
+        /*
+         * This algorithm is recursive because the amount of used stack
+         * space is very small and the max recursion depth is limited.
+         */
+        list_for_each(elem_ref_to, &block->ref_to_list) {
+                const struct btrfsic_block_link *const l =
+                    list_entry(elem_ref_to, struct btrfsic_block_link,
+                               node_ref_to);
+
+                if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                        printk(KERN_INFO
+                               "rl=%d, %c @%llu (%s/%llu/%d)"
+                               " %u* refers to %c @%llu (%s/%llu/%d)\n",
+                               recursion_level,
+                               btrfsic_get_block_type(state, block),
+                               (unsigned long long)block->logical_bytenr,
+                               block->dev_state->name,
+                               (unsigned long long)block->dev_bytenr,
+                               block->mirror_num,
+                               l->ref_cnt,
+                               btrfsic_get_block_type(state, l->block_ref_to),
+                               (unsigned long long)
+                               l->block_ref_to->logical_bytenr,
+                               l->block_ref_to->dev_state->name,
+                               (unsigned long long)l->block_ref_to->dev_bytenr,
+                               l->block_ref_to->mirror_num);
+                if (l->block_ref_to->never_written) {
+                        printk(KERN_INFO "btrfs: attempt to write superblock"
+                               " which references block %c @%llu (%s/%llu/%d)"
+                               " which is never written!\n",
+                               btrfsic_get_block_type(state, l->block_ref_to),
+                               (unsigned long long)
+                               l->block_ref_to->logical_bytenr,
+                               l->block_ref_to->dev_state->name,
+                               (unsigned long long)l->block_ref_to->dev_bytenr,
+                               l->block_ref_to->mirror_num);
+                        ret = -1;
+                } else if (!l->block_ref_to->is_iodone) {
+                        printk(KERN_INFO "btrfs: attempt to write superblock"
+                               " which references block %c @%llu (%s/%llu/%d)"
+                               " which is not yet iodone!\n",
+                               btrfsic_get_block_type(state, l->block_ref_to),
+                               (unsigned long long)
+                               l->block_ref_to->logical_bytenr,
+                               l->block_ref_to->dev_state->name,
+                               (unsigned long long)l->block_ref_to->dev_bytenr,
+                               l->block_ref_to->mirror_num);
+                        ret = -1;
+                } else if (l->parent_generation !=
+                           l->block_ref_to->generation &&
+                           BTRFSIC_GENERATION_UNKNOWN !=
+                           l->parent_generation &&
+                           BTRFSIC_GENERATION_UNKNOWN !=
+                           l->block_ref_to->generation) {
+                        printk(KERN_INFO "btrfs: attempt to write superblock"
+                               " which references block %c @%llu (%s/%llu/%d)"
+                               " with generation %llu !="
+                               " parent generation %llu!\n",
+                               btrfsic_get_block_type(state, l->block_ref_to),
+                               (unsigned long long)
+                               l->block_ref_to->logical_bytenr,
+                               l->block_ref_to->dev_state->name,
+                               (unsigned long long)l->block_ref_to->dev_bytenr,
+                               l->block_ref_to->mirror_num,
+                               (unsigned long long)l->block_ref_to->generation,
+                               (unsigned long long)l->parent_generation);
+                        ret = -1;
+                } else if (l->block_ref_to->flush_gen >
+                           l->block_ref_to->dev_state->last_flush_gen) {
+                        printk(KERN_INFO "btrfs: attempt to write superblock"
+                               " which references block %c @%llu (%s/%llu/%d)"
+                               " which is not flushed out of disk's write cache"
+                               " (block flush_gen=%llu,"
+                               " dev->flush_gen=%llu)!\n",
+                               btrfsic_get_block_type(state, l->block_ref_to),
+                               (unsigned long long)
+                               l->block_ref_to->logical_bytenr,
+                               l->block_ref_to->dev_state->name,
+                               (unsigned long long)l->block_ref_to->dev_bytenr,
+                               l->block_ref_to->mirror_num,
+                               (unsigned long long)block->flush_gen,
+                               (unsigned long long)
+                               l->block_ref_to->dev_state->last_flush_gen);
+                        ret = -1;
+                } else if (-1 == btrfsic_check_all_ref_blocks(state,
+                                                              l->block_ref_to,
+                                                              recursion_level +
+                                                              1)) {
+                        ret = -1;
+                }
+        }
+
+        return ret;
+}
+
+static int btrfsic_is_block_ref_by_superblock(
+                const struct btrfsic_state *state,
+                const struct btrfsic_block *block,
+                int recursion_level)
+{
+        struct list_head *elem_ref_from;
+
+        if (recursion_level >= 3 + BTRFS_MAX_LEVEL) {
+                /* refer to comment at "abort cyclic linkage (case 1)" */
+                if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                        printk(KERN_INFO
+                               "btrfsic: abort cyclic linkage (case 2).\n");
+
+                return 0;
+        }
+
+        /*
+         * This algorithm is recursive because the amount of used stack space
+         * is very small and the max recursion depth is limited.
+         */
+        list_for_each(elem_ref_from, &block->ref_from_list) {
+                const struct btrfsic_block_link *const l =
+                    list_entry(elem_ref_from, struct btrfsic_block_link,
+                               node_ref_from);
+
+                if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                        printk(KERN_INFO
+                               "rl=%d, %c @%llu (%s/%llu/%d)"
+                               " is ref %u* from %c @%llu (%s/%llu/%d)\n",
+                               recursion_level,
+                               btrfsic_get_block_type(state, block),
+                               (unsigned long long)block->logical_bytenr,
+                               block->dev_state->name,
+                               (unsigned long long)block->dev_bytenr,
+                               block->mirror_num,
+                               l->ref_cnt,
+                               btrfsic_get_block_type(state, l->block_ref_from),
+                               (unsigned long long)
+                               l->block_ref_from->logical_bytenr,
+                               l->block_ref_from->dev_state->name,
+                               (unsigned long long)
+                               l->block_ref_from->dev_bytenr,
+                               l->block_ref_from->mirror_num);
+                if (l->block_ref_from->is_superblock &&
+                    state->latest_superblock->dev_bytenr ==
+                    l->block_ref_from->dev_bytenr &&
+                    state->latest_superblock->dev_state->bdev ==
+                    l->block_ref_from->dev_state->bdev)
+                        return 1;
+                else if (btrfsic_is_block_ref_by_superblock(state,
+                                                            l->block_ref_from,
+                                                            recursion_level +
+                                                            1))
+                        return 1;
+        }
+
+        return 0;
+}
+
+static void btrfsic_print_add_link(const struct btrfsic_state *state,
+                                   const struct btrfsic_block_link *l)
+{
+        printk(KERN_INFO
+               "Add %u* link from %c @%llu (%s/%llu/%d)"
+               " to %c @%llu (%s/%llu/%d).\n",
+               l->ref_cnt,
+               btrfsic_get_block_type(state, l->block_ref_from),
+               (unsigned long long)l->block_ref_from->logical_bytenr,
+               l->block_ref_from->dev_state->name,
+               (unsigned long long)l->block_ref_from->dev_bytenr,
+               l->block_ref_from->mirror_num,
+               btrfsic_get_block_type(state, l->block_ref_to),
+               (unsigned long long)l->block_ref_to->logical_bytenr,
+               l->block_ref_to->dev_state->name,
+               (unsigned long long)l->block_ref_to->dev_bytenr,
+               l->block_ref_to->mirror_num);
+}
+
+static void btrfsic_print_rem_link(const struct btrfsic_state *state,
+                                   const struct btrfsic_block_link *l)
+{
+        printk(KERN_INFO
+               "Rem %u* link from %c @%llu (%s/%llu/%d)"
+               " to %c @%llu (%s/%llu/%d).\n",
+               l->ref_cnt,
+               btrfsic_get_block_type(state, l->block_ref_from),
+               (unsigned long long)l->block_ref_from->logical_bytenr,
+               l->block_ref_from->dev_state->name,
+               (unsigned long long)l->block_ref_from->dev_bytenr,
+               l->block_ref_from->mirror_num,
+               btrfsic_get_block_type(state, l->block_ref_to),
+               (unsigned long long)l->block_ref_to->logical_bytenr,
+               l->block_ref_to->dev_state->name,
+               (unsigned long long)l->block_ref_to->dev_bytenr,
+               l->block_ref_to->mirror_num);
+}
+
+static char btrfsic_get_block_type(const struct btrfsic_state *state,
+                                   const struct btrfsic_block *block)
+{
+        if (block->is_superblock &&
+            state->latest_superblock->dev_bytenr == block->dev_bytenr &&
+            state->latest_superblock->dev_state->bdev == block->dev_state->bdev)
+                return 'S';
+        else if (block->is_superblock)
+                return 's';
+        else if (block->is_metadata)
+                return 'M';
+        else
+                return 'D';
+}
+
+static void btrfsic_dump_tree(const struct btrfsic_state *state)
+{
+        btrfsic_dump_tree_sub(state, state->latest_superblock, 0);
+}
+
+static void btrfsic_dump_tree_sub(const struct btrfsic_state *state,
+                                  const struct btrfsic_block *block,
+                                  int indent_level)
+{
+        struct list_head *elem_ref_to;
+        int indent_add;
+        static char buf[80];
+        int cursor_position;
+
+        /*
+         * Should better fill an on-stack buffer with a complete line and
+         * dump it at once when it is time to print a newline character.
+         */
+
+        /*
+         * This algorithm is recursive because the amount of used stack space
+         * is very small and the max recursion depth is limited.
+         */
+        indent_add = sprintf(buf, "%c-%llu(%s/%llu/%d)",
+                             btrfsic_get_block_type(state, block),
+                             (unsigned long long)block->logical_bytenr,
+                             block->dev_state->name,
+                             (unsigned long long)block->dev_bytenr,
+                             block->mirror_num);
+        if (indent_level + indent_add > BTRFSIC_TREE_DUMP_MAX_INDENT_LEVEL) {
+                printk("[...]\n");
+                return;
+        }
+        printk(buf);
+        indent_level += indent_add;
+        if (list_empty(&block->ref_to_list)) {
+                printk("\n");
+                return;
+        }
+        if (block->mirror_num > 1 &&
+            !(state->print_mask & BTRFSIC_PRINT_MASK_TREE_WITH_ALL_MIRRORS)) {
+                printk(" [...]\n");
+                return;
+        }
+
+        cursor_position = indent_level;
+        list_for_each(elem_ref_to, &block->ref_to_list) {
+                const struct btrfsic_block_link *const l =
+                    list_entry(elem_ref_to, struct btrfsic_block_link,
+                               node_ref_to);
+
+                while (cursor_position < indent_level) {
+                        printk(" ");
+                        cursor_position++;
+                }
+                if (l->ref_cnt > 1)
+                        indent_add = sprintf(buf, " %d*--> ", l->ref_cnt);
+                else
+                        indent_add = sprintf(buf, " --> ");
+                if (indent_level + indent_add >
+                    BTRFSIC_TREE_DUMP_MAX_INDENT_LEVEL) {
+                        printk("[...]\n");
+                        cursor_position = 0;
+                        continue;
+                }
+
+                printk(buf);
+
+                btrfsic_dump_tree_sub(state, l->block_ref_to,
+                                      indent_level + indent_add);
+                cursor_position = 0;
+        }
+}
+
+static struct btrfsic_block_link *btrfsic_block_link_lookup_or_add(
+                struct btrfsic_state *state,
+                struct btrfsic_block_data_ctx *next_block_ctx,
+                struct btrfsic_block *next_block,
+                struct btrfsic_block *from_block,
+                u64 parent_generation)
+{
+        struct btrfsic_block_link *l;
+
+        l = btrfsic_block_link_hashtable_lookup(next_block_ctx->dev->bdev,
+                                                next_block_ctx->dev_bytenr,
+                                                from_block->dev_state->bdev,
+                                                from_block->dev_bytenr,
+                                                &state->block_link_hashtable);
+        if (NULL == l) {
+                l = btrfsic_block_link_alloc();
+                if (NULL == l) {
+                        printk(KERN_INFO
+                               "btrfsic: error, kmalloc" " failed!\n");
+                        return NULL;
+                }
+
+                l->block_ref_to = next_block;
+                l->block_ref_from = from_block;
+                l->ref_cnt = 1;
+                l->parent_generation = parent_generation;
+
+                if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                        btrfsic_print_add_link(state, l);
+
+                list_add(&l->node_ref_to, &from_block->ref_to_list);
+                list_add(&l->node_ref_from, &next_block->ref_from_list);
+
+                btrfsic_block_link_hashtable_add(l,
+                                                 &state->block_link_hashtable);
+        } else {
+                l->ref_cnt++;
+                l->parent_generation = parent_generation;
+                if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                        btrfsic_print_add_link(state, l);
+        }
+
+        return l;
+}
+
+static struct btrfsic_block *btrfsic_block_lookup_or_add(
+                struct btrfsic_state *state,
+                struct btrfsic_block_data_ctx *block_ctx,
+                const char *additional_string,
+                int is_metadata,
+                int is_iodone,
+                int never_written,
+                int mirror_num,
+                int *was_created)
+{
+        struct btrfsic_block *block;
+
+        block = btrfsic_block_hashtable_lookup(block_ctx->dev->bdev,
+                                               block_ctx->dev_bytenr,
+                                               &state->block_hashtable);
+        if (NULL == block) {
+                struct btrfsic_dev_state *dev_state;
+
+                block = btrfsic_block_alloc();
+                if (NULL == block) {
+                        printk(KERN_INFO "btrfsic: error, kmalloc failed!\n");
+                        return NULL;
+                }
+                dev_state = btrfsic_dev_state_lookup(block_ctx->dev->bdev);
+                if (NULL == dev_state) {
+                        printk(KERN_INFO
+                               "btrfsic: error, lookup dev_state failed!\n");
+                        btrfsic_block_free(block);
+                        return NULL;
+                }
+                block->dev_state = dev_state;
+                block->dev_bytenr = block_ctx->dev_bytenr;
+                block->logical_bytenr = block_ctx->start;
+                block->is_metadata = is_metadata;
+                block->is_iodone = is_iodone;
+                block->never_written = never_written;
+                block->mirror_num = mirror_num;
+                if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                        printk(KERN_INFO
+                               "New %s%c-block @%llu (%s/%llu/%d)\n",
+                               additional_string,
+                               btrfsic_get_block_type(state, block),
+                               (unsigned long long)block->logical_bytenr,
+                               dev_state->name,
+                               (unsigned long long)block->dev_bytenr,
+                               mirror_num);
+                list_add(&block->all_blocks_node, &state->all_blocks_list);
+                btrfsic_block_hashtable_add(block, &state->block_hashtable);
+                if (NULL != was_created)
+                        *was_created = 1;
+        } else {
+                if (NULL != was_created)
+                        *was_created = 0;
+        }
+
+        return block;
+}
+
+static void btrfsic_cmp_log_and_dev_bytenr(struct btrfsic_state *state,
+                                           u64 bytenr,
+                                           struct btrfsic_dev_state *dev_state,
+                                           u64 dev_bytenr, char *data)
+{
+        int num_copies;
+        int mirror_num;
+        int ret;
+        struct btrfsic_block_data_ctx block_ctx;
+        int match = 0;
+
+        num_copies = btrfs_num_copies(&state->root->fs_info->mapping_tree,
+                                      bytenr, PAGE_SIZE);
+
+        for (mirror_num = 1; mirror_num <= num_copies; mirror_num++) {
+                ret = btrfsic_map_block(state, bytenr, PAGE_SIZE,
+                                        &block_ctx, mirror_num);
+                if (ret) {
+                        printk(KERN_INFO "btrfsic:"
+                               " btrfsic_map_block(logical @%llu,"
+                               " mirror %d) failed!\n",
+                               (unsigned long long)bytenr, mirror_num);
+                        continue;
+                }
+
+                if (dev_state->bdev == block_ctx.dev->bdev &&
+                    dev_bytenr == block_ctx.dev_bytenr) {
+                        match++;
+                        btrfsic_release_block_ctx(&block_ctx);
+                        break;
+                }
+                btrfsic_release_block_ctx(&block_ctx);
+        }
+
+        if (!match) {
+                printk(KERN_INFO "btrfs: attempt to write M-block which contains logical bytenr that doesn't map to dev+physical bytenr of submit_bio,"
+                       " buffer->log_bytenr=%llu, submit_bio(bdev=%s,"
+                       " phys_bytenr=%llu)!\n",
+                       (unsigned long long)bytenr, dev_state->name,
+                       (unsigned long long)dev_bytenr);
+                for (mirror_num = 1; mirror_num <= num_copies; mirror_num++) {
+                        ret = btrfsic_map_block(state, bytenr, PAGE_SIZE,
+                                                &block_ctx, mirror_num);
+                        if (ret)
+                                continue;
+
+                        printk(KERN_INFO "Read logical bytenr @%llu maps to"
+                               " (%s/%llu/%d)\n",
+                               (unsigned long long)bytenr,
+                               block_ctx.dev->name,
+                               (unsigned long long)block_ctx.dev_bytenr,
+                               mirror_num);
+                }
+                WARN_ON(1);
+        }
+}
+
+static struct btrfsic_dev_state *btrfsic_dev_state_lookup(
+                struct block_device *bdev)
+{
+        struct btrfsic_dev_state *ds;
+
+        ds = btrfsic_dev_state_hashtable_lookup(bdev,
+                                                &btrfsic_dev_state_hashtable);
+        return ds;
+}
+
+int btrfsic_submit_bh(int rw, struct buffer_head *bh)
+{
+        struct btrfsic_dev_state *dev_state;
+
+        if (!btrfsic_is_initialized)
+                return submit_bh(rw, bh);
+
+        mutex_lock(&btrfsic_mutex);
+        /* since btrfsic_submit_bh() might also be called before
+         * btrfsic_mount(), this might return NULL */
+        dev_state = btrfsic_dev_state_lookup(bh->b_bdev);
+
+        /* Only called to write the superblock (incl. FLUSH/FUA) */
+        if (NULL != dev_state &&
+            (rw & WRITE) && bh->b_size > 0) {
+                u64 dev_bytenr;
+
+                dev_bytenr = 4096 * bh->b_blocknr;
+                if (dev_state->state->print_mask &
+                    BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH)
+                        printk(KERN_INFO
+                               "submit_bh(rw=0x%x, blocknr=%lu (bytenr %llu),"
+                               " size=%lu, data=%p, bdev=%p)\n",
+                               rw, bh->b_blocknr,
+                               (unsigned long long)dev_bytenr, bh->b_size,
+                               bh->b_data, bh->b_bdev);
+                btrfsic_process_written_block(dev_state, dev_bytenr,
+                                              bh->b_data, bh->b_size, NULL,
+                                              NULL, bh, rw);
+        } else if (NULL != dev_state && (rw & REQ_FLUSH)) {
+                if (dev_state->state->print_mask &
+                    BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH)
+                        printk(KERN_INFO
+                               "submit_bh(rw=0x%x) FLUSH, bdev=%p)\n",
+                               rw, bh->b_bdev);
+                if (!dev_state->dummy_block_for_bio_bh_flush.is_iodone) {
+                        if ((dev_state->state->print_mask &
+                             (BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH |
+                              BTRFSIC_PRINT_MASK_VERBOSE)))
+                                printk(KERN_INFO
+                                       "btrfsic_submit_bh(%s) with FLUSH"
+                                       " but dummy block already in use"
+                                       " (ignored)!\n",
+                                       dev_state->name);
+                } else {
+                        struct btrfsic_block *const block =
+                                &dev_state->dummy_block_for_bio_bh_flush;
+
+                        block->is_iodone = 0;
+                        block->never_written = 0;
+                        block->iodone_w_error = 0;
+                        block->flush_gen = dev_state->last_flush_gen + 1;
+                        block->submit_bio_bh_rw = rw;
+                        block->orig_bio_bh_private = bh->b_private;
+                        block->orig_bio_bh_end_io.bh = bh->b_end_io;
+                        block->next_in_same_bio = NULL;
+                        bh->b_private = block;
+                        bh->b_end_io = btrfsic_bh_end_io;
+                }
+        }
+        mutex_unlock(&btrfsic_mutex);
+        return submit_bh(rw, bh);
+}
+
+void btrfsic_submit_bio(int rw, struct bio *bio)
+{
+        struct btrfsic_dev_state *dev_state;
+
+        if (!btrfsic_is_initialized) {
+                submit_bio(rw, bio);
+                return;
+        }
+
+        mutex_lock(&btrfsic_mutex);
+        /* since btrfsic_submit_bio() is also called before
+         * btrfsic_mount(), this might return NULL */
+        dev_state = btrfsic_dev_state_lookup(bio->bi_bdev);
+        if (NULL != dev_state &&
+            (rw & WRITE) && NULL != bio->bi_io_vec) {
+                unsigned int i;
+                u64 dev_bytenr;
+                int bio_is_patched;
+
+                dev_bytenr = 512 * bio->bi_sector;
+                bio_is_patched = 0;
+                if (dev_state->state->print_mask &
+                    BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH)
+                        printk(KERN_INFO
+                               "submit_bio(rw=0x%x, bi_vcnt=%u,"
+                               " bi_sector=%lu (bytenr %llu), bi_bdev=%p)\n",
+                               rw, bio->bi_vcnt, bio->bi_sector,
+                               (unsigned long long)dev_bytenr,
+                               bio->bi_bdev);
+
+                for (i = 0; i < bio->bi_vcnt; i++) {
+                        u8 *mapped_data;
+
+                        mapped_data = kmap(bio->bi_io_vec[i].bv_page);
+                        if ((BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH |
+                             BTRFSIC_PRINT_MASK_VERBOSE) ==
+                            (dev_state->state->print_mask &
+                             (BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH |
+                              BTRFSIC_PRINT_MASK_VERBOSE)))
+                                printk(KERN_INFO
+                                       "#%u: page=%p, mapped=%p, len=%u,"
+                                       " offset=%u\n",
+                                       i, bio->bi_io_vec[i].bv_page,
+                                       mapped_data,
+                                       bio->bi_io_vec[i].bv_len,
+                                       bio->bi_io_vec[i].bv_offset);
+                        btrfsic_process_written_block(dev_state, dev_bytenr,
+                                                      mapped_data,
+                                                      bio->bi_io_vec[i].bv_len,
+                                                      bio, &bio_is_patched,
+                                                      NULL, rw);
+                        kunmap(bio->bi_io_vec[i].bv_page);
+                        dev_bytenr += bio->bi_io_vec[i].bv_len;
+                }
+        } else if (NULL != dev_state && (rw & REQ_FLUSH)) {
+                if (dev_state->state->print_mask &
+                    BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH)
+                        printk(KERN_INFO
+                               "submit_bio(rw=0x%x) FLUSH, bdev=%p)\n",
+                               rw, bio->bi_bdev);
+                if (!dev_state->dummy_block_for_bio_bh_flush.is_iodone) {
+                        if ((dev_state->state->print_mask &
+                             (BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH |
+                              BTRFSIC_PRINT_MASK_VERBOSE)))
+                                printk(KERN_INFO
+                                       "btrfsic_submit_bio(%s) with FLUSH"
+                                       " but dummy block already in use"
+                                       " (ignored)!\n",
+                                       dev_state->name);
+                } else {
+                        struct btrfsic_block *const block =
+                                &dev_state->dummy_block_for_bio_bh_flush;
+
+                        block->is_iodone = 0;
+                        block->never_written = 0;
+                        block->iodone_w_error = 0;
+                        block->flush_gen = dev_state->last_flush_gen + 1;
+                        block->submit_bio_bh_rw = rw;
+                        block->orig_bio_bh_private = bio->bi_private;
+                        block->orig_bio_bh_end_io.bio = bio->bi_end_io;
+                        block->next_in_same_bio = NULL;
+                        bio->bi_private = block;
+                        bio->bi_end_io = btrfsic_bio_end_io;
+                }
+        }
+        mutex_unlock(&btrfsic_mutex);
+
+        submit_bio(rw, bio);
+}
+
+int btrfsic_mount(struct btrfs_root *root,
+                  struct btrfs_fs_devices *fs_devices,
+                  int including_extent_data, u32 print_mask)
+{
+        int ret;
+        struct btrfsic_state *state;
+        struct list_head *dev_head = &fs_devices->devices;
+        struct btrfs_device *device;
+
+        state = kzalloc(sizeof(*state), GFP_NOFS);
+        if (NULL == state) {
+                printk(KERN_INFO "btrfs check-integrity: kmalloc() failed!\n");
+                return -1;
+        }
+
+        if (!btrfsic_is_initialized) {
+                mutex_init(&btrfsic_mutex);
+                btrfsic_dev_state_hashtable_init(&btrfsic_dev_state_hashtable);
+                btrfsic_is_initialized = 1;
+        }
+        mutex_lock(&btrfsic_mutex);
+        state->root = root;
+        state->print_mask = print_mask;
+        state->include_extent_data = including_extent_data;
+        state->csum_size = 0;
+        INIT_LIST_HEAD(&state->all_blocks_list);
+        btrfsic_block_hashtable_init(&state->block_hashtable);
+        btrfsic_block_link_hashtable_init(&state->block_link_hashtable);
+        state->max_superblock_generation = 0;
+        state->latest_superblock = NULL;
+
+        list_for_each_entry(device, dev_head, dev_list) {
+                struct btrfsic_dev_state *ds;
+                char *p;
+
+                if (!device->bdev || !device->name)
+                        continue;
+
+                ds = btrfsic_dev_state_alloc();
+                if (NULL == ds) {
+                        printk(KERN_INFO
+                               "btrfs check-integrity: kmalloc() failed!\n");
+                        mutex_unlock(&btrfsic_mutex);
+                        return -1;
+                }
+                ds->bdev = device->bdev;
+                ds->state = state;
+                bdevname(ds->bdev, ds->name);
+                ds->name[BDEVNAME_SIZE - 1] = '\0';
+                for (p = ds->name; *p != '\0'; p++);
+                while (p > ds->name && *p != '/')
+                        p--;
+                if (*p == '/')
+                        p++;
+                strlcpy(ds->name, p, sizeof(ds->name));
+                btrfsic_dev_state_hashtable_add(ds,
+                                                &btrfsic_dev_state_hashtable);
+        }
+
+        ret = btrfsic_process_superblock(state, fs_devices);
+        if (0 != ret) {
+                mutex_unlock(&btrfsic_mutex);
+                btrfsic_unmount(root, fs_devices);
+                return ret;
+        }
+
+        if (state->print_mask & BTRFSIC_PRINT_MASK_INITIAL_DATABASE)
+                btrfsic_dump_database(state);
+        if (state->print_mask & BTRFSIC_PRINT_MASK_INITIAL_TREE)
+                btrfsic_dump_tree(state);
+
+        mutex_unlock(&btrfsic_mutex);
+        return 0;
+}
+
+void btrfsic_unmount(struct btrfs_root *root,
+                     struct btrfs_fs_devices *fs_devices)
+{
+        struct list_head *elem_all;
+        struct list_head *tmp_all;
+        struct btrfsic_state *state;
+        struct list_head *dev_head = &fs_devices->devices;
+        struct btrfs_device *device;
+
+        if (!btrfsic_is_initialized)
+                return;
+
+        mutex_lock(&btrfsic_mutex);
+
+        state = NULL;
+        list_for_each_entry(device, dev_head, dev_list) {
+                struct btrfsic_dev_state *ds;
+
+                if (!device->bdev || !device->name)
+                        continue;
+
+                ds = btrfsic_dev_state_hashtable_lookup(
+                                device->bdev,
+                                &btrfsic_dev_state_hashtable);
+                if (NULL != ds) {
+                        state = ds->state;
+                        btrfsic_dev_state_hashtable_remove(ds);
+                        btrfsic_dev_state_free(ds);
+                }
+        }
+
+        if (NULL == state) {
+                printk(KERN_INFO
+                       "btrfsic: error, cannot find state information"
+                       " on umount!\n");
+                mutex_unlock(&btrfsic_mutex);
+                return;
+        }
+
+        /*
+         * Don't care about keeping the lists' state up to date,
+         * just free all memory that was allocated dynamically.
+         * Free the blocks and the block_links.
+         */
+        list_for_each_safe(elem_all, tmp_all, &state->all_blocks_list) {
+                struct btrfsic_block *const b_all =
+                    list_entry(elem_all, struct btrfsic_block,
+                               all_blocks_node);
+                struct list_head *elem_ref_to;
+                struct list_head *tmp_ref_to;
+
+                list_for_each_safe(elem_ref_to, tmp_ref_to,
+                                   &b_all->ref_to_list) {
+                        struct btrfsic_block_link *const l =
+                            list_entry(elem_ref_to,
+                                       struct btrfsic_block_link,
+                                       node_ref_to);
+
+                        if (state->print_mask & BTRFSIC_PRINT_MASK_VERBOSE)
+                                btrfsic_print_rem_link(state, l);
+
+                        l->ref_cnt--;
+                        if (0 == l->ref_cnt)
+                                btrfsic_block_link_free(l);
+                }
+
+                if (b_all->is_iodone)
+                        btrfsic_block_free(b_all);
+                else
+                        printk(KERN_INFO "btrfs: attempt to free %c-block"
+                               " @%llu (%s/%llu/%d) on umount which is"
+                               " not yet iodone!\n",
+                               btrfsic_get_block_type(state, b_all),
+                               (unsigned long long)b_all->logical_bytenr,
+                               b_all->dev_state->name,
+                               (unsigned long long)b_all->dev_bytenr,
+                               b_all->mirror_num);
+        }
+
+        mutex_unlock(&btrfsic_mutex);
+
+        kfree(state);
+}
diff --git a/fs/btrfs/check-integrity.h b/fs/btrfs/check-integrity.h
new file mode 100644
index 000000000000..8b59175cc502
--- /dev/null
+++ b/fs/btrfs/check-integrity.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) STRATO AG 2011.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public
+ * License v2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public
+ * License along with this program; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 021110-1307, USA.
+ */
+
+#if !defined(__BTRFS_CHECK_INTEGRITY__)
+#define __BTRFS_CHECK_INTEGRITY__
+
+#ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
+int btrfsic_submit_bh(int rw, struct buffer_head *bh);
+void btrfsic_submit_bio(int rw, struct bio *bio);
+#else
+#define btrfsic_submit_bh submit_bh
+#define btrfsic_submit_bio submit_bio
+#endif
+
+int btrfsic_mount(struct btrfs_root *root,
+                  struct btrfs_fs_devices *fs_devices,
+                  int including_extent_data, u32 print_mask);
+void btrfsic_unmount(struct btrfs_root *root,
+                     struct btrfs_fs_devices *fs_devices);
+
+#endif
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index dede441bdeee..0639a555e16e 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -240,7 +240,7 @@ int btrfs_copy_root(struct btrfs_trans_handle *trans,
 
         cow = btrfs_alloc_free_block(trans, root, buf->len, 0,
                                      new_root_objectid, &disk_key, level,
-                                     buf->start, 0);
+                                     buf->start, 0, 1);
         if (IS_ERR(cow))
                 return PTR_ERR(cow);
 
@@ -261,9 +261,9 @@ int btrfs_copy_root(struct btrfs_trans_handle *trans,
 
         WARN_ON(btrfs_header_generation(buf) > trans->transid);
         if (new_root_objectid == BTRFS_TREE_RELOC_OBJECTID)
-                ret = btrfs_inc_ref(trans, root, cow, 1);
+                ret = btrfs_inc_ref(trans, root, cow, 1, 1);
         else
-                ret = btrfs_inc_ref(trans, root, cow, 0);
+                ret = btrfs_inc_ref(trans, root, cow, 0, 1);
 
         if (ret)
                 return ret;
@@ -350,14 +350,14 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
                 if ((owner == root->root_key.objectid ||
                      root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) &&
                     !(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)) {
-                        ret = btrfs_inc_ref(trans, root, buf, 1);
+                        ret = btrfs_inc_ref(trans, root, buf, 1, 1);
                         BUG_ON(ret);
 
                         if (root->root_key.objectid ==
                             BTRFS_TREE_RELOC_OBJECTID) {
-                                ret = btrfs_dec_ref(trans, root, buf, 0);
+                                ret = btrfs_dec_ref(trans, root, buf, 0, 1);
                                 BUG_ON(ret);
-                                ret = btrfs_inc_ref(trans, root, cow, 1);
+                                ret = btrfs_inc_ref(trans, root, cow, 1, 1);
                                 BUG_ON(ret);
                         }
                         new_flags |= BTRFS_BLOCK_FLAG_FULL_BACKREF;
@@ -365,9 +365,9 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
 
                         if (root->root_key.objectid ==
                             BTRFS_TREE_RELOC_OBJECTID)
-                                ret = btrfs_inc_ref(trans, root, cow, 1);
+                                ret = btrfs_inc_ref(trans, root, cow, 1, 1);
                         else
-                                ret = btrfs_inc_ref(trans, root, cow, 0);
+                                ret = btrfs_inc_ref(trans, root, cow, 0, 1);
                         BUG_ON(ret);
                 }
                 if (new_flags != 0) {
@@ -381,11 +381,11 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
                 if (flags & BTRFS_BLOCK_FLAG_FULL_BACKREF) {
                         if (root->root_key.objectid ==
                             BTRFS_TREE_RELOC_OBJECTID)
-                                ret = btrfs_inc_ref(trans, root, cow, 1);
+                                ret = btrfs_inc_ref(trans, root, cow, 1, 1);
                         else
-                                ret = btrfs_inc_ref(trans, root, cow, 0);
+                                ret = btrfs_inc_ref(trans, root, cow, 0, 1);
                         BUG_ON(ret);
-                        ret = btrfs_dec_ref(trans, root, buf, 1);
+                        ret = btrfs_dec_ref(trans, root, buf, 1, 1);
                         BUG_ON(ret);
                 }
                 clean_tree_block(trans, root, buf);
@@ -446,7 +446,7 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
 
         cow = btrfs_alloc_free_block(trans, root, buf->len, parent_start,
                                      root->root_key.objectid, &disk_key,
-                                     level, search_start, empty_size);
+                                     level, search_start, empty_size, 1);
         if (IS_ERR(cow))
                 return PTR_ERR(cow);
 
@@ -484,7 +484,7 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
                 rcu_assign_pointer(root->node, cow);
 
                 btrfs_free_tree_block(trans, root, buf, parent_start,
-                                      last_ref);
+                                      last_ref, 1);
                 free_extent_buffer(buf);
                 add_root_to_dirty_list(root);
         } else {
@@ -500,7 +500,7 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
                                               trans->transid);
                 btrfs_mark_buffer_dirty(parent);
                 btrfs_free_tree_block(trans, root, buf, parent_start,
-                                      last_ref);
+                                      last_ref, 1);
         }
         if (unlock_orig)
                 btrfs_tree_unlock(buf);
@@ -957,7 +957,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                 free_extent_buffer(mid);
 
                 root_sub_used(root, mid->len);
-                btrfs_free_tree_block(trans, root, mid, 0, 1);
+                btrfs_free_tree_block(trans, root, mid, 0, 1, 0);
                 /* once for the root ptr */
                 free_extent_buffer(mid);
                 return 0;
@@ -1015,7 +1015,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                         if (wret)
                                 ret = wret;
                         root_sub_used(root, right->len);
-                        btrfs_free_tree_block(trans, root, right, 0, 1);
+                        btrfs_free_tree_block(trans, root, right, 0, 1, 0);
                         free_extent_buffer(right);
                         right = NULL;
                 } else {
@@ -1055,7 +1055,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                 if (wret)
                         ret = wret;
                 root_sub_used(root, mid->len);
-                btrfs_free_tree_block(trans, root, mid, 0, 1);
+                btrfs_free_tree_block(trans, root, mid, 0, 1, 0);
                 free_extent_buffer(mid);
                 mid = NULL;
         } else {
@@ -2089,7 +2089,7 @@ static noinline int insert_new_root(struct btrfs_trans_handle *trans,
 
         c = btrfs_alloc_free_block(trans, root, root->nodesize, 0,
                                    root->root_key.objectid, &lower_key,
-                                   level, root->node->start, 0);
+                                   level, root->node->start, 0, 0);
         if (IS_ERR(c))
                 return PTR_ERR(c);
 
@@ -2216,7 +2216,7 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
 
         split = btrfs_alloc_free_block(trans, root, root->nodesize, 0,
                                         root->root_key.objectid,
-                                        &disk_key, level, c->start, 0);
+                                        &disk_key, level, c->start, 0, 0);
         if (IS_ERR(split))
                 return PTR_ERR(split);
 
@@ -2970,7 +2970,7 @@ again:
 
         right = btrfs_alloc_free_block(trans, root, root->leafsize, 0,
                                         root->root_key.objectid,
-                                        &disk_key, 0, l->start, 0);
+                                        &disk_key, 0, l->start, 0, 0);
         if (IS_ERR(right))
                 return PTR_ERR(right);
 
@@ -3781,7 +3781,7 @@ static noinline int btrfs_del_leaf(struct btrfs_trans_handle *trans,
 
         root_sub_used(root, leaf->len);
 
-        btrfs_free_tree_block(trans, root, leaf, 0, 1);
+        btrfs_free_tree_block(trans, root, leaf, 0, 1, 0);
         return 0;
 }
 /*
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 67385033323d..27ebe61d3ccc 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -86,6 +86,9 @@ struct btrfs_ordered_sum;
 /* holds checksums of all the data extents */
 #define BTRFS_CSUM_TREE_OBJECTID 7ULL
 
+/* for storing balance parameters in the root tree */
+#define BTRFS_BALANCE_OBJECTID -4ULL
+
 /* orhpan objectid for tracking unlinked/truncated files */
 #define BTRFS_ORPHAN_OBJECTID -5ULL
 
@@ -692,6 +695,54 @@ struct btrfs_root_ref {
         __le16 name_len;
 } __attribute__ ((__packed__));
 
+struct btrfs_disk_balance_args {
+        /*
+         * profiles to operate on, single is denoted by
+         * BTRFS_AVAIL_ALLOC_BIT_SINGLE
+         */
+        __le64 profiles;
+
+        /* usage filter */
+        __le64 usage;
+
+        /* devid filter */
+        __le64 devid;
+
+        /* devid subset filter [pstart..pend) */
+        __le64 pstart;
+        __le64 pend;
+
+        /* btrfs virtual address space subset filter [vstart..vend) */
+        __le64 vstart;
+        __le64 vend;
+
+        /*
+         * profile to convert to, single is denoted by
+         * BTRFS_AVAIL_ALLOC_BIT_SINGLE
+         */
+        __le64 target;
+
+        /* BTRFS_BALANCE_ARGS_* */
+        __le64 flags;
+
+        __le64 unused[8];
+} __attribute__ ((__packed__));
+
+/*
+ * store balance parameters to disk so that balance can be properly
+ * resumed after crash or unmount
+ */
+struct btrfs_balance_item {
+        /* BTRFS_BALANCE_* */
+        __le64 flags;
+
+        struct btrfs_disk_balance_args data;
+        struct btrfs_disk_balance_args meta;
+        struct btrfs_disk_balance_args sys;
+
+        __le64 unused[4];
+} __attribute__ ((__packed__));
+
 #define BTRFS_FILE_EXTENT_INLINE 0
 #define BTRFS_FILE_EXTENT_REG 1
 #define BTRFS_FILE_EXTENT_PREALLOC 2
@@ -751,14 +802,32 @@ struct btrfs_csum_item {
 } __attribute__ ((__packed__));
 
 /* different types of block groups (and chunks) */
-#define BTRFS_BLOCK_GROUP_DATA     (1 << 0)
-#define BTRFS_BLOCK_GROUP_SYSTEM   (1 << 1)
-#define BTRFS_BLOCK_GROUP_METADATA (1 << 2)
-#define BTRFS_BLOCK_GROUP_RAID0    (1 << 3)
-#define BTRFS_BLOCK_GROUP_RAID1    (1 << 4)
-#define BTRFS_BLOCK_GROUP_DUP      (1 << 5)
-#define BTRFS_BLOCK_GROUP_RAID10   (1 << 6)
-#define BTRFS_NR_RAID_TYPES        5
+#define BTRFS_BLOCK_GROUP_DATA          (1ULL << 0)
+#define BTRFS_BLOCK_GROUP_SYSTEM        (1ULL << 1)
+#define BTRFS_BLOCK_GROUP_METADATA      (1ULL << 2)
+#define BTRFS_BLOCK_GROUP_RAID0         (1ULL << 3)
+#define BTRFS_BLOCK_GROUP_RAID1         (1ULL << 4)
+#define BTRFS_BLOCK_GROUP_DUP           (1ULL << 5)
+#define BTRFS_BLOCK_GROUP_RAID10        (1ULL << 6)
+#define BTRFS_BLOCK_GROUP_RESERVED      BTRFS_AVAIL_ALLOC_BIT_SINGLE
+#define BTRFS_NR_RAID_TYPES             5
+
+#define BTRFS_BLOCK_GROUP_TYPE_MASK     (BTRFS_BLOCK_GROUP_DATA |    \
+                                         BTRFS_BLOCK_GROUP_SYSTEM |  \
+                                         BTRFS_BLOCK_GROUP_METADATA)
+
+#define BTRFS_BLOCK_GROUP_PROFILE_MASK  (BTRFS_BLOCK_GROUP_RAID0 |   \
+                                         BTRFS_BLOCK_GROUP_RAID1 |   \
+                                         BTRFS_BLOCK_GROUP_DUP |     \
+                                         BTRFS_BLOCK_GROUP_RAID10)
+/*
+ * We need a bit for restriper to be able to tell when chunks of type
+ * SINGLE are available.  This "extended" profile format is used in
+ * fs_info->avail_*_alloc_bits (in-memory) and balance item fields
+ * (on-disk).  The corresponding on-disk bit in chunk.type is reserved
+ * to avoid remappings between two formats in future.
+ */
+#define BTRFS_AVAIL_ALLOC_BIT_SINGLE    (1ULL << 48)
 
 struct btrfs_block_group_item {
         __le64 used;
@@ -916,6 +985,7 @@ struct btrfs_block_group_cache {
 struct reloc_control;
 struct btrfs_device;
 struct btrfs_fs_devices;
+struct btrfs_balance_control;
 struct btrfs_delayed_root;
 struct btrfs_fs_info {
         u8 fsid[BTRFS_FSID_SIZE];
@@ -971,7 +1041,7 @@ struct btrfs_fs_info {
          * is required instead of the faster short fsync log commits
          */
         u64 last_trans_log_full_commit;
-        unsigned long mount_opt:20;
+        unsigned long mount_opt:21;
         unsigned long compress_type:4;
         u64 max_inline;
         u64 alloc_start;
@@ -1132,12 +1202,23 @@ struct btrfs_fs_info {
         spinlock_t ref_cache_lock;
         u64 total_ref_cache_size;
 
+        /*
+         * these three are in extended format (availability of single
+         * chunks is denoted by BTRFS_AVAIL_ALLOC_BIT_SINGLE bit, other
+         * types are denoted by corresponding BTRFS_BLOCK_GROUP_* bits)
+         */
         u64 avail_data_alloc_bits;
         u64 avail_metadata_alloc_bits;
         u64 avail_system_alloc_bits;
-        u64 data_alloc_profile;
-        u64 metadata_alloc_profile;
-        u64 system_alloc_profile;
+
+        /* restriper state */
+        spinlock_t balance_lock;
+        struct mutex balance_mutex;
+        atomic_t balance_running;
+        atomic_t balance_pause_req;
+        atomic_t balance_cancel_req;
+        struct btrfs_balance_control *balance_ctl;
+        wait_queue_head_t balance_wait_q;
 
         unsigned data_chunk_allocations;
         unsigned metadata_ratio;
@@ -1155,6 +1236,10 @@ struct btrfs_fs_info {
         int scrub_workers_refcnt;
         struct btrfs_workers scrub_workers;
 
+#ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
+        u32 check_integrity_print_mask;
+#endif
+
         /* filesystem state */
         u64 fs_state;
 
@@ -1383,6 +1468,8 @@ struct btrfs_ioctl_defrag_range_args {
 #define BTRFS_DEV_ITEM_KEY      216
 #define BTRFS_CHUNK_ITEM_KEY    228
 
+#define BTRFS_BALANCE_ITEM_KEY  248
+
 /*
  * string items are for debugging.  They just store a short string of
  * data in the FS
@@ -1413,6 +1500,9 @@ struct btrfs_ioctl_defrag_range_args {
 #define BTRFS_MOUNT_AUTO_DEFRAG         (1 << 16)
 #define BTRFS_MOUNT_INODE_MAP_CACHE     (1 << 17)
 #define BTRFS_MOUNT_RECOVERY            (1 << 18)
+#define BTRFS_MOUNT_SKIP_BALANCE        (1 << 19)
+#define BTRFS_MOUNT_CHECK_INTEGRITY     (1 << 20)
+#define BTRFS_MOUNT_CHECK_INTEGRITY_INCLUDING_EXTENT_DATA (1 << 21)
 
 #define btrfs_clear_opt(o, opt)         ((o) &= ~BTRFS_MOUNT_##opt)
 #define btrfs_set_opt(o, opt)           ((o) |= BTRFS_MOUNT_##opt)
@@ -2077,8 +2167,86 @@ BTRFS_SETGET_STACK_FUNCS(backup_bytes_used, struct btrfs_root_backup,
 BTRFS_SETGET_STACK_FUNCS(backup_num_devices, struct btrfs_root_backup,
                    num_devices, 64);
 
-/* struct btrfs_super_block */
+/* struct btrfs_balance_item */
+BTRFS_SETGET_FUNCS(balance_flags, struct btrfs_balance_item, flags, 64);
 
+static inline void btrfs_balance_data(struct extent_buffer *eb,
+                                      struct btrfs_balance_item *bi,
+                                      struct btrfs_disk_balance_args *ba)
+{
+        read_eb_member(eb, bi, struct btrfs_balance_item, data, ba);
+}
+
+static inline void btrfs_set_balance_data(struct extent_buffer *eb,
+                                          struct btrfs_balance_item *bi,
+                                          struct btrfs_disk_balance_args *ba)
+{
+        write_eb_member(eb, bi, struct btrfs_balance_item, data, ba);
+}
+
+static inline void btrfs_balance_meta(struct extent_buffer *eb,
+                                      struct btrfs_balance_item *bi,
+                                      struct btrfs_disk_balance_args *ba)
+{
+        read_eb_member(eb, bi, struct btrfs_balance_item, meta, ba);
+}
+
+static inline void btrfs_set_balance_meta(struct extent_buffer *eb,
+                                          struct btrfs_balance_item *bi,
+                                          struct btrfs_disk_balance_args *ba)
+{
+        write_eb_member(eb, bi, struct btrfs_balance_item, meta, ba);
+}
+
+static inline void btrfs_balance_sys(struct extent_buffer *eb,
+                                     struct btrfs_balance_item *bi,
+                                     struct btrfs_disk_balance_args *ba)
+{
+        read_eb_member(eb, bi, struct btrfs_balance_item, sys, ba);
+}
+
+static inline void btrfs_set_balance_sys(struct extent_buffer *eb,
+                                         struct btrfs_balance_item *bi,
+                                         struct btrfs_disk_balance_args *ba)
+{
+        write_eb_member(eb, bi, struct btrfs_balance_item, sys, ba);
+}
+
+static inline void
+btrfs_disk_balance_args_to_cpu(struct btrfs_balance_args *cpu,
+                               struct btrfs_disk_balance_args *disk)
+{
+        memset(cpu, 0, sizeof(*cpu));
+
+        cpu->profiles = le64_to_cpu(disk->profiles);
+        cpu->usage = le64_to_cpu(disk->usage);
+        cpu->devid = le64_to_cpu(disk->devid);
+        cpu->pstart = le64_to_cpu(disk->pstart);
+        cpu->pend = le64_to_cpu(disk->pend);
+        cpu->vstart = le64_to_cpu(disk->vstart);
+        cpu->vend = le64_to_cpu(disk->vend);
+        cpu->target = le64_to_cpu(disk->target);
+        cpu->flags = le64_to_cpu(disk->flags);
+}
+
+static inline void
+btrfs_cpu_balance_args_to_disk(struct btrfs_disk_balance_args *disk,
+                               struct btrfs_balance_args *cpu)
+{
+        memset(disk, 0, sizeof(*disk));
+
+        disk->profiles = cpu_to_le64(cpu->profiles);
+        disk->usage = cpu_to_le64(cpu->usage);
+        disk->devid = cpu_to_le64(cpu->devid);
+        disk->pstart = cpu_to_le64(cpu->pstart);
+        disk->pend = cpu_to_le64(cpu->pend);
+        disk->vstart = cpu_to_le64(cpu->vstart);
+        disk->vend = cpu_to_le64(cpu->vend);
+        disk->target = cpu_to_le64(cpu->target);
+        disk->flags = cpu_to_le64(cpu->flags);
+}
+
+/* struct btrfs_super_block */
 BTRFS_SETGET_STACK_FUNCS(super_bytenr, struct btrfs_super_block, bytenr, 64);
 BTRFS_SETGET_STACK_FUNCS(super_flags, struct btrfs_super_block, flags, 64);
 BTRFS_SETGET_STACK_FUNCS(super_generation, struct btrfs_super_block,
@@ -2196,7 +2364,7 @@ static inline u32 btrfs_file_extent_inline_item_len(struct extent_buffer *eb,
         return btrfs_item_size(eb, e) - offset;
 }
 
-static inline struct btrfs_root *btrfs_sb(struct super_block *sb)
+static inline struct btrfs_fs_info *btrfs_sb(struct super_block *sb)
 {
         return sb->s_fs_info;
 }
@@ -2277,11 +2445,11 @@ struct extent_buffer *btrfs_alloc_free_block(struct btrfs_trans_handle *trans,
                                         struct btrfs_root *root, u32 blocksize,
                                         u64 parent, u64 root_objectid,
                                         struct btrfs_disk_key *key, int level,
-                                        u64 hint, u64 empty_size);
+                                        u64 hint, u64 empty_size, int for_cow);
 void btrfs_free_tree_block(struct btrfs_trans_handle *trans,
                            struct btrfs_root *root,
                            struct extent_buffer *buf,
-                           u64 parent, int last_ref);
+                           u64 parent, int last_ref, int for_cow);
 struct extent_buffer *btrfs_init_new_buffer(struct btrfs_trans_handle *trans,
                                             struct btrfs_root *root,
                                             u64 bytenr, u32 blocksize,
@@ -2301,17 +2469,17 @@ int btrfs_reserve_extent(struct btrfs_trans_handle *trans,
                                   u64 search_end, struct btrfs_key *ins,
                                   u64 data);
 int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
-                  struct extent_buffer *buf, int full_backref);
+                  struct extent_buffer *buf, int full_backref, int for_cow);
 int btrfs_dec_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
-                  struct extent_buffer *buf, int full_backref);
+                  struct extent_buffer *buf, int full_backref, int for_cow);
 int btrfs_set_disk_extent_flags(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
                                 u64 bytenr, u64 num_bytes, u64 flags,
                                 int is_data);
 int btrfs_free_extent(struct btrfs_trans_handle *trans,
                       struct btrfs_root *root,
-                      u64 bytenr, u64 num_bytes, u64 parent,
-                      u64 root_objectid, u64 owner, u64 offset);
+                      u64 bytenr, u64 num_bytes, u64 parent, u64 root_objectid,
+                      u64 owner, u64 offset, int for_cow);
 
 int btrfs_free_reserved_extent(struct btrfs_root *root, u64 start, u64 len);
 int btrfs_free_and_pin_reserved_extent(struct btrfs_root *root,
@@ -2323,7 +2491,7 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans,
 int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
                          struct btrfs_root *root,
                          u64 bytenr, u64 num_bytes, u64 parent,
-                         u64 root_objectid, u64 owner, u64 offset);
+                         u64 root_objectid, u64 owner, u64 offset, int for_cow);
 
 int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans,
                                     struct btrfs_root *root);
@@ -2482,10 +2650,18 @@ static inline int btrfs_insert_empty_item(struct btrfs_trans_handle *trans,
 }
 
 int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path);
+static inline int btrfs_next_item(struct btrfs_root *root, struct btrfs_path *p)
+{
+        ++p->slots[0];
+        if (p->slots[0] >= btrfs_header_nritems(p->nodes[0]))
+                return btrfs_next_leaf(root, p);
+        return 0;
+}
 int btrfs_prev_leaf(struct btrfs_root *root, struct btrfs_path *path);
 int btrfs_leaf_free_space(struct btrfs_root *root, struct extent_buffer *leaf);
 void btrfs_drop_snapshot(struct btrfs_root *root,
-                         struct btrfs_block_rsv *block_rsv, int update_ref);
+                         struct btrfs_block_rsv *block_rsv, int update_ref,
+                         int for_reloc);
 int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
                         struct btrfs_root *root,
                         struct extent_buffer *node,
@@ -2500,6 +2676,7 @@ static inline int btrfs_fs_closing(struct btrfs_fs_info *fs_info)
 }
 static inline void free_fs_info(struct btrfs_fs_info *fs_info)
 {
+        kfree(fs_info->balance_ctl);
         kfree(fs_info->delayed_root);
         kfree(fs_info->extent_root);
         kfree(fs_info->tree_root);
@@ -2510,6 +2687,24 @@ static inline void free_fs_info(struct btrfs_fs_info *fs_info)
         kfree(fs_info->super_for_commit);
         kfree(fs_info);
 }
+/**
+ * profile_is_valid - tests whether a given profile is valid and reduced
+ * @flags: profile to validate
+ * @extended: if true @flags is treated as an extended profile
+ */
+static inline int profile_is_valid(u64 flags, int extended)
+{
+        u64 mask = ~BTRFS_BLOCK_GROUP_PROFILE_MASK;
+
+        flags &= ~BTRFS_BLOCK_GROUP_TYPE_MASK;
+        if (extended)
+                mask &= ~BTRFS_AVAIL_ALLOC_BIT_SINGLE;
+
+        if (flags & mask)
+                return 0;
+        /* true if zero or exactly one bit set */
+        return (flags & (~flags + 1)) == flags;
+}
 
 /* root-item.c */
 int btrfs_find_root_ref(struct btrfs_root *tree_root,
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 9c1eccc2c503..fe4cd0f1cef1 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -595,8 +595,12 @@ static int btrfs_delayed_item_reserve_metadata(struct btrfs_trans_handle *trans,
 
         num_bytes = btrfs_calc_trans_metadata_size(root, 1);
         ret = btrfs_block_rsv_migrate(src_rsv, dst_rsv, num_bytes);
-        if (!ret)
+        if (!ret) {
+                trace_btrfs_space_reservation(root->fs_info, "delayed_item",
+                                              item->key.objectid,
+                                              num_bytes, 1);
                 item->bytes_reserved = num_bytes;
+        }
 
         return ret;
 }
@@ -610,6 +614,9 @@ static void btrfs_delayed_item_release_metadata(struct btrfs_root *root,
                 return;
 
         rsv = &root->fs_info->delayed_block_rsv;
+        trace_btrfs_space_reservation(root->fs_info, "delayed_item",
+                                      item->key.objectid, item->bytes_reserved,
+                                      0);
         btrfs_block_rsv_release(root, rsv,
                                 item->bytes_reserved);
 }
@@ -624,7 +631,7 @@ static int btrfs_delayed_inode_reserve_metadata(
         struct btrfs_block_rsv *dst_rsv;
         u64 num_bytes;
         int ret;
-        int release = false;
+        bool release = false;
 
         src_rsv = trans->block_rsv;
         dst_rsv = &root->fs_info->delayed_block_rsv;
@@ -651,8 +658,13 @@ static int btrfs_delayed_inode_reserve_metadata(
                  */
                 if (ret == -EAGAIN)
                         ret = -ENOSPC;
-                if (!ret)
+                if (!ret) {
                         node->bytes_reserved = num_bytes;
+                        trace_btrfs_space_reservation(root->fs_info,
+                                                      "delayed_inode",
+                                                      btrfs_ino(inode),
+                                                      num_bytes, 1);
+                }
                 return ret;
         } else if (src_rsv == &root->fs_info->delalloc_block_rsv) {
                 spin_lock(&BTRFS_I(inode)->lock);
@@ -707,11 +719,17 @@ out:
          * reservation here.  I think it may be time for a documentation page on
          * how block rsvs. work.
          */
-        if (!ret)
+        if (!ret) {
+                trace_btrfs_space_reservation(root->fs_info, "delayed_inode",
+                                              btrfs_ino(inode), num_bytes, 1);
                 node->bytes_reserved = num_bytes;
+        }
 
-        if (release)
+        if (release) {
+                trace_btrfs_space_reservation(root->fs_info, "delalloc",
+                                              btrfs_ino(inode), num_bytes, 0);
                 btrfs_block_rsv_release(root, src_rsv, num_bytes);
+        }
 
         return ret;
 }
@@ -725,6 +743,8 @@ static void btrfs_delayed_inode_release_metadata(struct btrfs_root *root,
                 return;
 
         rsv = &root->fs_info->delayed_block_rsv;
+        trace_btrfs_space_reservation(root->fs_info, "delayed_inode",
+                                      node->inode_id, node->bytes_reserved, 0);
         btrfs_block_rsv_release(root, rsv,
                                 node->bytes_reserved);
         node->bytes_reserved = 0;
@@ -1372,13 +1392,6 @@ int btrfs_insert_delayed_dir_index(struct btrfs_trans_handle *trans,
                 goto release_node;
         }
 
-        ret = btrfs_delayed_item_reserve_metadata(trans, root, delayed_item);
-        /*
-         * we have reserved enough space when we start a new transaction,
-         * so reserving metadata failure is impossible
-         */
-        BUG_ON(ret);
-
         delayed_item->key.objectid = btrfs_ino(dir);
         btrfs_set_key_type(&delayed_item->key, BTRFS_DIR_INDEX_KEY);
         delayed_item->key.offset = index;
@@ -1391,6 +1404,14 @@ int btrfs_insert_delayed_dir_index(struct btrfs_trans_handle *trans,
         dir_item->type = type;
         memcpy((char *)(dir_item + 1), name, name_len);
 
+        ret = btrfs_delayed_item_reserve_metadata(trans, root, delayed_item);
+        /*
+         * we have reserved enough space when we start a new transaction,
+         * so reserving metadata failure is impossible
+         */
+        BUG_ON(ret);
+
+
         mutex_lock(&delayed_node->mutex);
         ret = __btrfs_add_delayed_insertion_item(delayed_node, delayed_item);
         if (unlikely(ret)) {
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
index 125cf76fcd08..66e4f29505a3 100644
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -101,6 +101,11 @@ static int comp_entry(struct btrfs_delayed_ref_node *ref2,
                 return -1;
         if (ref1->type > ref2->type)
                 return 1;
+        /* merging of sequenced refs is not allowed */
+        if (ref1->seq < ref2->seq)
+                return -1;
+        if (ref1->seq > ref2->seq)
+                return 1;
         if (ref1->type == BTRFS_TREE_BLOCK_REF_KEY ||
             ref1->type == BTRFS_SHARED_BLOCK_REF_KEY) {
                 return comp_tree_refs(btrfs_delayed_node_to_tree_ref(ref2),
@@ -150,16 +155,22 @@ static struct btrfs_delayed_ref_node *tree_insert(struct rb_root *root,
 
 /*
  * find an head entry based on bytenr. This returns the delayed ref
- * head if it was able to find one, or NULL if nothing was in that spot
+ * head if it was able to find one, or NULL if nothing was in that spot.
+ * If return_bigger is given, the next bigger entry is returned if no exact
+ * match is found.
  */
 static struct btrfs_delayed_ref_node *find_ref_head(struct rb_root *root,
                                   u64 bytenr,
-                                  struct btrfs_delayed_ref_node **last)
+                                  struct btrfs_delayed_ref_node **last,
+                                  int return_bigger)
 {
-        struct rb_node *n = root->rb_node;
+        struct rb_node *n;
         struct btrfs_delayed_ref_node *entry;
-        int cmp;
+        int cmp = 0;
 
+again:
+        n = root->rb_node;
+        entry = NULL;
         while (n) {
                 entry = rb_entry(n, struct btrfs_delayed_ref_node, rb_node);
                 WARN_ON(!entry->in_tree);
@@ -182,6 +193,19 @@ static struct btrfs_delayed_ref_node *find_ref_head(struct rb_root *root,
                 else
                         return entry;
         }
+        if (entry && return_bigger) {
+                if (cmp > 0) {
+                        n = rb_next(&entry->rb_node);
+                        if (!n)
+                                n = rb_first(root);
+                        entry = rb_entry(n, struct btrfs_delayed_ref_node,
+                                         rb_node);
+                        bytenr = entry->bytenr;
+                        return_bigger = 0;
+                        goto again;
+                }
+                return entry;
+        }
         return NULL;
 }
 
@@ -209,6 +233,24 @@ int btrfs_delayed_ref_lock(struct btrfs_trans_handle *trans,
         return 0;
 }
 
+int btrfs_check_delayed_seq(struct btrfs_delayed_ref_root *delayed_refs,
+                            u64 seq)
+{
+        struct seq_list *elem;
+
+        assert_spin_locked(&delayed_refs->lock);
+        if (list_empty(&delayed_refs->seq_head))
+                return 0;
+
+        elem = list_first_entry(&delayed_refs->seq_head, struct seq_list, list);
+        if (seq >= elem->seq) {
+                pr_debug("holding back delayed_ref %llu, lowest is %llu (%p)\n",
+                         seq, elem->seq, delayed_refs);
+                return 1;
+        }
+        return 0;
+}
+
 int btrfs_find_ref_cluster(struct btrfs_trans_handle *trans,
                            struct list_head *cluster, u64 start)
 {
@@ -223,20 +265,8 @@ int btrfs_find_ref_cluster(struct btrfs_trans_handle *trans,
                 node = rb_first(&delayed_refs->root);
         } else {
                 ref = NULL;
-                find_ref_head(&delayed_refs->root, start, &ref);
+                find_ref_head(&delayed_refs->root, start + 1, &ref, 1);
                 if (ref) {
-                        struct btrfs_delayed_ref_node *tmp;
-
-                        node = rb_prev(&ref->rb_node);
-                        while (node) {
-                                tmp = rb_entry(node,
-                                               struct btrfs_delayed_ref_node,
-                                               rb_node);
-                                if (tmp->bytenr < start)
-                                        break;
-                                ref = tmp;
-                                node = rb_prev(&ref->rb_node);
-                        }
                         node = &ref->rb_node;
                 } else
                         node = rb_first(&delayed_refs->root);
@@ -390,7 +420,8 @@ update_existing_head_ref(struct btrfs_delayed_ref_node *existing,
  * this does all the dirty work in terms of maintaining the correct
  * overall modification count.
  */
-static noinline int add_delayed_ref_head(struct btrfs_trans_handle *trans,
+static noinline int add_delayed_ref_head(struct btrfs_fs_info *fs_info,
+                                        struct btrfs_trans_handle *trans,
                                         struct btrfs_delayed_ref_node *ref,
                                         u64 bytenr, u64 num_bytes,
                                         int action, int is_data)
@@ -437,6 +468,7 @@ static noinline int add_delayed_ref_head(struct btrfs_trans_handle *trans,
         ref->action  = 0;
         ref->is_head = 1;
         ref->in_tree = 1;
+        ref->seq = 0;
 
         head_ref = btrfs_delayed_node_to_head(ref);
         head_ref->must_insert_reserved = must_insert_reserved;
@@ -468,14 +500,17 @@ static noinline int add_delayed_ref_head(struct btrfs_trans_handle *trans,
 /*
  * helper to insert a delayed tree ref into the rbtree.
  */
-static noinline int add_delayed_tree_ref(struct btrfs_trans_handle *trans,
+static noinline int add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+                                         struct btrfs_trans_handle *trans,
                                          struct btrfs_delayed_ref_node *ref,
                                          u64 bytenr, u64 num_bytes, u64 parent,
-                                         u64 ref_root, int level, int action)
+                                         u64 ref_root, int level, int action,
+                                         int for_cow)
 {
         struct btrfs_delayed_ref_node *existing;
         struct btrfs_delayed_tree_ref *full_ref;
         struct btrfs_delayed_ref_root *delayed_refs;
+        u64 seq = 0;
 
         if (action == BTRFS_ADD_DELAYED_EXTENT)
                 action = BTRFS_ADD_DELAYED_REF;
@@ -491,14 +526,17 @@ static noinline int add_delayed_tree_ref(struct btrfs_trans_handle *trans,
         ref->is_head = 0;
         ref->in_tree = 1;
 
+        if (need_ref_seq(for_cow, ref_root))
+                seq = inc_delayed_seq(delayed_refs);
+        ref->seq = seq;
+
         full_ref = btrfs_delayed_node_to_tree_ref(ref);
-        if (parent) {
-                full_ref->parent = parent;
+        full_ref->parent = parent;
+        full_ref->root = ref_root;
+        if (parent)
                 ref->type = BTRFS_SHARED_BLOCK_REF_KEY;
-        } else {
-                full_ref->root = ref_root;
+        else
                 ref->type = BTRFS_TREE_BLOCK_REF_KEY;
-        }
         full_ref->level = level;
 
         trace_btrfs_delayed_tree_ref(ref, full_ref, action);
@@ -522,15 +560,17 @@ static noinline int add_delayed_tree_ref(struct btrfs_trans_handle *trans,
 /*
  * helper to insert a delayed data ref into the rbtree.
  */
-static noinline int add_delayed_data_ref(struct btrfs_trans_handle *trans,
+static noinline int add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+                                         struct btrfs_trans_handle *trans,
                                          struct btrfs_delayed_ref_node *ref,
                                          u64 bytenr, u64 num_bytes, u64 parent,
                                          u64 ref_root, u64 owner, u64 offset,
-                                         int action)
+                                         int action, int for_cow)
 {
         struct btrfs_delayed_ref_node *existing;
         struct btrfs_delayed_data_ref *full_ref;
         struct btrfs_delayed_ref_root *delayed_refs;
+        u64 seq = 0;
 
         if (action == BTRFS_ADD_DELAYED_EXTENT)
                 action = BTRFS_ADD_DELAYED_REF;
@@ -546,14 +586,18 @@ static noinline int add_delayed_data_ref(struct btrfs_trans_handle *trans,
         ref->is_head = 0;
         ref->in_tree = 1;
 
+        if (need_ref_seq(for_cow, ref_root))
+                seq = inc_delayed_seq(delayed_refs);
+        ref->seq = seq;
+
         full_ref = btrfs_delayed_node_to_data_ref(ref);
-        if (parent) {
-                full_ref->parent = parent;
+        full_ref->parent = parent;
+        full_ref->root = ref_root;
+        if (parent)
                 ref->type = BTRFS_SHARED_DATA_REF_KEY;
-        } else {
-                full_ref->root = ref_root;
+        else
                 ref->type = BTRFS_EXTENT_DATA_REF_KEY;
-        }
+
         full_ref->objectid = owner;
         full_ref->offset = offset;
 
@@ -580,10 +624,12 @@ static noinline int add_delayed_data_ref(struct btrfs_trans_handle *trans,
  * to make sure the delayed ref is eventually processed before this
  * transaction commits.
  */
-int btrfs_add_delayed_tree_ref(struct btrfs_trans_handle *trans,
+int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+                               struct btrfs_trans_handle *trans,
                                u64 bytenr, u64 num_bytes, u64 parent,
                                u64 ref_root,  int level, int action,
-                               struct btrfs_delayed_extent_op *extent_op)
+                               struct btrfs_delayed_extent_op *extent_op,
+                               int for_cow)
 {
         struct btrfs_delayed_tree_ref *ref;
         struct btrfs_delayed_ref_head *head_ref;
@@ -610,13 +656,17 @@ int btrfs_add_delayed_tree_ref(struct btrfs_trans_handle *trans,
          * insert both the head node and the new ref without dropping
          * the spin lock
          */
-        ret = add_delayed_ref_head(trans, &head_ref->node, bytenr, num_bytes,
-                                   action, 0);
+        ret = add_delayed_ref_head(fs_info, trans, &head_ref->node, bytenr,
+                                   num_bytes, action, 0);
         BUG_ON(ret);
 
-        ret = add_delayed_tree_ref(trans, &ref->node, bytenr, num_bytes,
-                                   parent, ref_root, level, action);
+        ret = add_delayed_tree_ref(fs_info, trans, &ref->node, bytenr,
+                                   num_bytes, parent, ref_root, level, action,
+                                   for_cow);
         BUG_ON(ret);
+        if (!need_ref_seq(for_cow, ref_root) &&
+            waitqueue_active(&delayed_refs->seq_wait))
+                wake_up(&delayed_refs->seq_wait);
         spin_unlock(&delayed_refs->lock);
         return 0;
 }
@@ -624,11 +674,13 @@ int btrfs_add_delayed_tree_ref(struct btrfs_trans_handle *trans,
 /*
  * add a delayed data ref. it's similar to btrfs_add_delayed_tree_ref.
  */
-int btrfs_add_delayed_data_ref(struct btrfs_trans_handle *trans,
+int btrfs_add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+                               struct btrfs_trans_handle *trans,
                                u64 bytenr, u64 num_bytes,
                                u64 parent, u64 ref_root,
                                u64 owner, u64 offset, int action,
-                               struct btrfs_delayed_extent_op *extent_op)
+                               struct btrfs_delayed_extent_op *extent_op,
+                               int for_cow)
 {
         struct btrfs_delayed_data_ref *ref;
         struct btrfs_delayed_ref_head *head_ref;
@@ -655,18 +707,23 @@ int btrfs_add_delayed_data_ref(struct btrfs_trans_handle *trans,
          * insert both the head node and the new ref without dropping
          * the spin lock
          */
-        ret = add_delayed_ref_head(trans, &head_ref->node, bytenr, num_bytes,
-                                   action, 1);
+        ret = add_delayed_ref_head(fs_info, trans, &head_ref->node, bytenr,
+                                   num_bytes, action, 1);
         BUG_ON(ret);
 
-        ret = add_delayed_data_ref(trans, &ref->node, bytenr, num_bytes,
-                                   parent, ref_root, owner, offset, action);
+        ret = add_delayed_data_ref(fs_info, trans, &ref->node, bytenr,
+                                   num_bytes, parent, ref_root, owner, offset,
+                                   action, for_cow);
         BUG_ON(ret);
+        if (!need_ref_seq(for_cow, ref_root) &&
+            waitqueue_active(&delayed_refs->seq_wait))
+                wake_up(&delayed_refs->seq_wait);
         spin_unlock(&delayed_refs->lock);
         return 0;
 }
 
-int btrfs_add_delayed_extent_op(struct btrfs_trans_handle *trans,
+int btrfs_add_delayed_extent_op(struct btrfs_fs_info *fs_info,
+                                struct btrfs_trans_handle *trans,
                                 u64 bytenr, u64 num_bytes,
                                 struct btrfs_delayed_extent_op *extent_op)
 {
@@ -683,11 +740,13 @@ int btrfs_add_delayed_extent_op(struct btrfs_trans_handle *trans,
         delayed_refs = &trans->transaction->delayed_refs;
         spin_lock(&delayed_refs->lock);
 
-        ret = add_delayed_ref_head(trans, &head_ref->node, bytenr,
+        ret = add_delayed_ref_head(fs_info, trans, &head_ref->node, bytenr,
                                    num_bytes, BTRFS_UPDATE_DELAYED_HEAD,
                                    extent_op->is_data);
         BUG_ON(ret);
 
+        if (waitqueue_active(&delayed_refs->seq_wait))
+                wake_up(&delayed_refs->seq_wait);
         spin_unlock(&delayed_refs->lock);
         return 0;
 }
@@ -704,7 +763,7 @@ btrfs_find_delayed_ref_head(struct btrfs_trans_handle *trans, u64 bytenr)
         struct btrfs_delayed_ref_root *delayed_refs;
 
         delayed_refs = &trans->transaction->delayed_refs;
-        ref = find_ref_head(&delayed_refs->root, bytenr, NULL);
+        ref = find_ref_head(&delayed_refs->root, bytenr, NULL, 0);
         if (ref)
                 return btrfs_delayed_node_to_head(ref);
         return NULL;
diff --git a/fs/btrfs/delayed-ref.h b/fs/btrfs/delayed-ref.h
index e287e3b0eab0..d8f244d94925 100644
--- a/fs/btrfs/delayed-ref.h
+++ b/fs/btrfs/delayed-ref.h
@@ -33,6 +33,9 @@ struct btrfs_delayed_ref_node {
         /* the size of the extent */
         u64 num_bytes;
 
+        /* seq number to keep track of insertion order */
+        u64 seq;
+
         /* ref count on this data structure */
         atomic_t refs;
 
@@ -98,19 +101,15 @@ struct btrfs_delayed_ref_head {
 
 struct btrfs_delayed_tree_ref {
         struct btrfs_delayed_ref_node node;
-        union {
-                u64 root;
-                u64 parent;
-        };
+        u64 root;
+        u64 parent;
         int level;
 };
 
 struct btrfs_delayed_data_ref {
         struct btrfs_delayed_ref_node node;
-        union {
-                u64 root;
-                u64 parent;
-        };
+        u64 root;
+        u64 parent;
         u64 objectid;
         u64 offset;
 };
@@ -140,6 +139,26 @@ struct btrfs_delayed_ref_root {
         int flushing;
 
         u64 run_delayed_start;
+
+        /*
+         * seq number of delayed refs. We need to know if a backref was being
+         * added before the currently processed ref or afterwards.
+         */
+        u64 seq;
+
+        /*
+         * seq_list holds a list of all seq numbers that are currently being
+         * added to the list. While walking backrefs (btrfs_find_all_roots,
+         * qgroups), which might take some time, no newer ref must be processed,
+         * as it might influence the outcome of the walk.
+         */
+        struct list_head seq_head;
+
+        /*
+         * when the only refs we have in the list must not be processed, we want
+         * to wait for more refs to show up or for the end of backref walking.
+         */
+        wait_queue_head_t seq_wait;
 };
 
 static inline void btrfs_put_delayed_ref(struct btrfs_delayed_ref_node *ref)
@@ -151,16 +170,21 @@ static inline void btrfs_put_delayed_ref(struct btrfs_delayed_ref_node *ref)
         }
 }
 
-int btrfs_add_delayed_tree_ref(struct btrfs_trans_handle *trans,
+int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+                               struct btrfs_trans_handle *trans,
                                u64 bytenr, u64 num_bytes, u64 parent,
                                u64 ref_root, int level, int action,
-                               struct btrfs_delayed_extent_op *extent_op);
-int btrfs_add_delayed_data_ref(struct btrfs_trans_handle *trans,
+                               struct btrfs_delayed_extent_op *extent_op,
+                               int for_cow);
+int btrfs_add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+                               struct btrfs_trans_handle *trans,
                                u64 bytenr, u64 num_bytes,
                                u64 parent, u64 ref_root,
                                u64 owner, u64 offset, int action,
-                               struct btrfs_delayed_extent_op *extent_op);
-int btrfs_add_delayed_extent_op(struct btrfs_trans_handle *trans,
+                               struct btrfs_delayed_extent_op *extent_op,
+                               int for_cow);
+int btrfs_add_delayed_extent_op(struct btrfs_fs_info *fs_info,
+                                struct btrfs_trans_handle *trans,
                                 u64 bytenr, u64 num_bytes,
                                 struct btrfs_delayed_extent_op *extent_op);
 
@@ -170,6 +194,60 @@ int btrfs_delayed_ref_lock(struct btrfs_trans_handle *trans,
                            struct btrfs_delayed_ref_head *head);
 int btrfs_find_ref_cluster(struct btrfs_trans_handle *trans,
                            struct list_head *cluster, u64 search_start);
+
+struct seq_list {
+        struct list_head list;
+        u64 seq;
+};
+
+static inline u64 inc_delayed_seq(struct btrfs_delayed_ref_root *delayed_refs)
+{
+        assert_spin_locked(&delayed_refs->lock);
+        ++delayed_refs->seq;
+        return delayed_refs->seq;
+}
+
+static inline void
+btrfs_get_delayed_seq(struct btrfs_delayed_ref_root *delayed_refs,
+                      struct seq_list *elem)
+{
+        assert_spin_locked(&delayed_refs->lock);
+        elem->seq = delayed_refs->seq;
+        list_add_tail(&elem->list, &delayed_refs->seq_head);
+}
+
+static inline void
+btrfs_put_delayed_seq(struct btrfs_delayed_ref_root *delayed_refs,
+                      struct seq_list *elem)
+{
+        spin_lock(&delayed_refs->lock);
+        list_del(&elem->list);
+        wake_up(&delayed_refs->seq_wait);
+        spin_unlock(&delayed_refs->lock);
+}
+
+int btrfs_check_delayed_seq(struct btrfs_delayed_ref_root *delayed_refs,
+                            u64 seq);
+
+/*
+ * delayed refs with a ref_seq > 0 must be held back during backref walking.
+ * this only applies to items in one of the fs-trees. for_cow items never need
+ * to be held back, so they won't get a ref_seq number.
+ */
+static inline int need_ref_seq(int for_cow, u64 rootid)
+{
+        if (for_cow)
+                return 0;
+
+        if (rootid == BTRFS_FS_TREE_OBJECTID)
+                return 1;
+
+        if ((s64)rootid >= (s64)BTRFS_FIRST_FREE_OBJECTID)
+                return 1;
+
+        return 0;
+}
+
 /*
  * a node might live in a head or a regular ref, this lets you
  * test for the proper type to use.
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index f99a099a7747..7aa9cd36bf1b 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -43,6 +43,7 @@
 #include "tree-log.h"
 #include "free-space-cache.h"
 #include "inode-map.h"
+#include "check-integrity.h"
 
 static struct extent_io_ops btree_extent_io_ops;
 static void end_workqueue_fn(struct btrfs_work *work);
@@ -872,7 +873,8 @@ static int btree_submit_bio_hook(struct inode *inode, int rw, struct bio *bio,
 
 #ifdef CONFIG_MIGRATION
 static int btree_migratepage(struct address_space *mapping,
-                        struct page *newpage, struct page *page)
+                        struct page *newpage, struct page *page,
+                        enum migrate_mode mode)
 {
         /*
          * we can't safely write a btree page from here,
@@ -887,7 +889,7 @@ static int btree_migratepage(struct address_space *mapping,
         if (page_has_private(page) &&
             !try_to_release_page(page, GFP_KERNEL))
                 return -EAGAIN;
-        return migrate_page(mapping, newpage, page);
+        return migrate_page(mapping, newpage, page, mode);
 }
 #endif
 
@@ -1142,7 +1144,6 @@ static int __setup_root(u32 nodesize, u32 leafsize, u32 sectorsize,
         root->orphan_item_inserted = 0;
         root->orphan_cleanup_state = 0;
 
-        root->fs_info = fs_info;
         root->objectid = objectid;
         root->last_trans = 0;
         root->highest_objectid = 0;
@@ -1216,6 +1217,14 @@ static int find_and_setup_root(struct btrfs_root *tree_root,
         return 0;
 }
 
+static struct btrfs_root *btrfs_alloc_root(struct btrfs_fs_info *fs_info)
+{
+        struct btrfs_root *root = kzalloc(sizeof(*root), GFP_NOFS);
+        if (root)
+                root->fs_info = fs_info;
+        return root;
+}
+
 static struct btrfs_root *alloc_log_tree(struct btrfs_trans_handle *trans,
                                          struct btrfs_fs_info *fs_info)
 {
@@ -1223,7 +1232,7 @@ static struct btrfs_root *alloc_log_tree(struct btrfs_trans_handle *trans,
         struct btrfs_root *tree_root = fs_info->tree_root;
         struct extent_buffer *leaf;
 
-        root = kzalloc(sizeof(*root), GFP_NOFS);
+        root = btrfs_alloc_root(fs_info);
         if (!root)
                 return ERR_PTR(-ENOMEM);
 
@@ -1243,7 +1252,8 @@ static struct btrfs_root *alloc_log_tree(struct btrfs_trans_handle *trans,
         root->ref_cows = 0;
 
         leaf = btrfs_alloc_free_block(trans, root, root->leafsize, 0,
-                                      BTRFS_TREE_LOG_OBJECTID, NULL, 0, 0, 0);
+                                      BTRFS_TREE_LOG_OBJECTID, NULL,
+                                      0, 0, 0, 0);
         if (IS_ERR(leaf)) {
                 kfree(root);
                 return ERR_CAST(leaf);
@@ -1317,7 +1327,7 @@ struct btrfs_root *btrfs_read_fs_root_no_radix(struct btrfs_root *tree_root,
         u32 blocksize;
         int ret = 0;
 
-        root = kzalloc(sizeof(*root), GFP_NOFS);
+        root = btrfs_alloc_root(fs_info);
         if (!root)
                 return ERR_PTR(-ENOMEM);
         if (location->offset == (u64)-1) {
@@ -1873,9 +1883,9 @@ static void free_root_pointers(struct btrfs_fs_info *info, int chunk_root)
 }
 
 
-struct btrfs_root *open_ctree(struct super_block *sb,
-                              struct btrfs_fs_devices *fs_devices,
-                              char *options)
+int open_ctree(struct super_block *sb,
+               struct btrfs_fs_devices *fs_devices,
+               char *options)
 {
         u32 sectorsize;
         u32 nodesize;
@@ -1887,8 +1897,8 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         struct btrfs_key location;
         struct buffer_head *bh;
         struct btrfs_super_block *disk_super;
-        struct btrfs_root *tree_root = btrfs_sb(sb);
-        struct btrfs_fs_info *fs_info = tree_root->fs_info;
+        struct btrfs_fs_info *fs_info = btrfs_sb(sb);
+        struct btrfs_root *tree_root;
         struct btrfs_root *extent_root;
         struct btrfs_root *csum_root;
         struct btrfs_root *chunk_root;
@@ -1899,16 +1909,14 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         int num_backups_tried = 0;
         int backup_index = 0;
 
-        extent_root = fs_info->extent_root =
-                kzalloc(sizeof(struct btrfs_root), GFP_NOFS);
-        csum_root = fs_info->csum_root =
-                kzalloc(sizeof(struct btrfs_root), GFP_NOFS);
-        chunk_root = fs_info->chunk_root =
-                kzalloc(sizeof(struct btrfs_root), GFP_NOFS);
-        dev_root = fs_info->dev_root =
-                kzalloc(sizeof(struct btrfs_root), GFP_NOFS);
+        tree_root = fs_info->tree_root = btrfs_alloc_root(fs_info);
+        extent_root = fs_info->extent_root = btrfs_alloc_root(fs_info);
+        csum_root = fs_info->csum_root = btrfs_alloc_root(fs_info);
+        chunk_root = fs_info->chunk_root = btrfs_alloc_root(fs_info);
+        dev_root = fs_info->dev_root = btrfs_alloc_root(fs_info);
 
-        if (!extent_root || !csum_root || !chunk_root || !dev_root) {
+        if (!tree_root || !extent_root || !csum_root ||
+            !chunk_root || !dev_root) {
                 err = -ENOMEM;
                 goto fail;
         }
@@ -1997,6 +2005,17 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         init_waitqueue_head(&fs_info->scrub_pause_wait);
         init_rwsem(&fs_info->scrub_super_lock);
         fs_info->scrub_workers_refcnt = 0;
+#ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
+        fs_info->check_integrity_print_mask = 0;
+#endif
+
+        spin_lock_init(&fs_info->balance_lock);
+        mutex_init(&fs_info->balance_mutex);
+        atomic_set(&fs_info->balance_running, 0);
+        atomic_set(&fs_info->balance_pause_req, 0);
+        atomic_set(&fs_info->balance_cancel_req, 0);
+        fs_info->balance_ctl = NULL;
+        init_waitqueue_head(&fs_info->balance_wait_q);
 
         sb->s_blocksize = 4096;
         sb->s_blocksize_bits = blksize_bits(4096);
@@ -2266,9 +2285,7 @@ struct btrfs_root *open_ctree(struct super_block *sb,
            (unsigned long)btrfs_header_chunk_tree_uuid(chunk_root->node),
            BTRFS_UUID_SIZE);
 
-        mutex_lock(&fs_info->chunk_mutex);
         ret = btrfs_read_chunk_tree(chunk_root);
-        mutex_unlock(&fs_info->chunk_mutex);
         if (ret) {
                 printk(KERN_WARNING "btrfs: failed to read chunk tree on %s\n",
                        sb->s_id);
@@ -2317,9 +2334,6 @@ retry_root_backup:
 
         fs_info->generation = generation;
         fs_info->last_trans_committed = generation;
-        fs_info->data_alloc_profile = (u64)-1;
-        fs_info->metadata_alloc_profile = (u64)-1;
-        fs_info->system_alloc_profile = fs_info->metadata_alloc_profile;
 
         ret = btrfs_init_space_info(fs_info);
         if (ret) {
@@ -2352,6 +2366,19 @@ retry_root_backup:
                 btrfs_set_opt(fs_info->mount_opt, SSD);
         }
 
+#ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
+        if (btrfs_test_opt(tree_root, CHECK_INTEGRITY)) {
+                ret = btrfsic_mount(tree_root, fs_devices,
+                                    btrfs_test_opt(tree_root,
+                                        CHECK_INTEGRITY_INCLUDING_EXTENT_DATA) ?
+                                    1 : 0,
+                                    fs_info->check_integrity_print_mask);
+                if (ret)
+                        printk(KERN_WARNING "btrfs: failed to initialize"
+                               " integrity check module %s\n", sb->s_id);
+        }
+#endif
+
         /* do not make disk changes in broken FS */
         if (btrfs_super_log_root(disk_super) != 0 &&
             !(fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR)) {
@@ -2367,7 +2394,7 @@ retry_root_backup:
                      btrfs_level_size(tree_root,
                                       btrfs_super_log_root_level(disk_super));
 
-                log_tree_root = kzalloc(sizeof(struct btrfs_root), GFP_NOFS);
+                log_tree_root = btrfs_alloc_root(fs_info);
                 if (!log_tree_root) {
                         err = -ENOMEM;
                         goto fail_trans_kthread;
@@ -2422,13 +2449,17 @@ retry_root_backup:
                 if (!err)
                         err = btrfs_orphan_cleanup(fs_info->tree_root);
                 up_read(&fs_info->cleanup_work_sem);
+
+                if (!err)
+                        err = btrfs_recover_balance(fs_info->tree_root);
+
                 if (err) {
                         close_ctree(tree_root);
-                        return ERR_PTR(err);
+                        return err;
                 }
         }
 
-        return tree_root;
+        return 0;
 
 fail_trans_kthread:
         kthread_stop(fs_info->transaction_kthread);
@@ -2474,8 +2505,7 @@ fail_srcu:
         cleanup_srcu_struct(&fs_info->subvol_srcu);
 fail:
         btrfs_close_devices(fs_info->fs_devices);
-        free_fs_info(fs_info);
-        return ERR_PTR(err);
+        return err;
 
 recovery_tree_root:
         if (!btrfs_test_opt(tree_root, RECOVERY))
@@ -2630,7 +2660,7 @@ static int write_dev_supers(struct btrfs_device *device,
                  * we fua the first super.  The others we allow
                  * to go down lazy.
                  */
-                ret = submit_bh(WRITE_FUA, bh);
+                ret = btrfsic_submit_bh(WRITE_FUA, bh);
                 if (ret)
                         errors++;
         }
@@ -2707,7 +2737,7 @@ static int write_dev_flush(struct btrfs_device *device, int wait)
         device->flush_bio = bio;
 
         bio_get(bio);
-        submit_bio(WRITE_FLUSH, bio);
+        btrfsic_submit_bio(WRITE_FLUSH, bio);
 
         return 0;
 }
@@ -2971,6 +3001,9 @@ int close_ctree(struct btrfs_root *root)
         fs_info->closing = 1;
         smp_mb();
 
+        /* pause restriper - we want to resume on mount */
+        btrfs_pause_balance(root->fs_info);
+
         btrfs_scrub_cancel(root);
 
         /* wait for any defraggers to finish */
@@ -2978,7 +3011,7 @@ int close_ctree(struct btrfs_root *root)
                    (atomic_read(&fs_info->defrag_running) == 0));
 
         /* clear out the rbtree of defraggable inodes */
-        btrfs_run_defrag_inodes(root->fs_info);
+        btrfs_run_defrag_inodes(fs_info);
 
         /*
          * Here come 2 situations when btrfs is broken to flip readonly:
@@ -3007,8 +3040,8 @@ int close_ctree(struct btrfs_root *root)
 
         btrfs_put_block_group_cache(fs_info);
 
-        kthread_stop(root->fs_info->transaction_kthread);
-        kthread_stop(root->fs_info->cleaner_kthread);
+        kthread_stop(fs_info->transaction_kthread);
+        kthread_stop(fs_info->cleaner_kthread);
 
         fs_info->closing = 2;
         smp_mb();
@@ -3026,14 +3059,14 @@ int close_ctree(struct btrfs_root *root)
         free_extent_buffer(fs_info->extent_root->commit_root);
         free_extent_buffer(fs_info->tree_root->node);
         free_extent_buffer(fs_info->tree_root->commit_root);
-        free_extent_buffer(root->fs_info->chunk_root->node);
-        free_extent_buffer(root->fs_info->chunk_root->commit_root);
-        free_extent_buffer(root->fs_info->dev_root->node);
-        free_extent_buffer(root->fs_info->dev_root->commit_root);
-        free_extent_buffer(root->fs_info->csum_root->node);
-        free_extent_buffer(root->fs_info->csum_root->commit_root);
+        free_extent_buffer(fs_info->chunk_root->node);
+        free_extent_buffer(fs_info->chunk_root->commit_root);
+        free_extent_buffer(fs_info->dev_root->node);
+        free_extent_buffer(fs_info->dev_root->commit_root);
+        free_extent_buffer(fs_info->csum_root->node);
+        free_extent_buffer(fs_info->csum_root->commit_root);
 
-        btrfs_free_block_groups(root->fs_info);
+        btrfs_free_block_groups(fs_info);
 
         del_fs_roots(fs_info);
 
@@ -3053,14 +3086,17 @@ int close_ctree(struct btrfs_root *root)
         btrfs_stop_workers(&fs_info->caching_workers);
         btrfs_stop_workers(&fs_info->readahead_workers);
 
+#ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
+        if (btrfs_test_opt(root, CHECK_INTEGRITY))
+                btrfsic_unmount(root, fs_info->fs_devices);
+#endif
+
         btrfs_close_devices(fs_info->fs_devices);
         btrfs_mapping_tree_free(&fs_info->mapping_tree);
 
         bdi_destroy(&fs_info->bdi);
         cleanup_srcu_struct(&fs_info->subvol_srcu);
 
-        free_fs_info(fs_info);
-
         return 0;
 }
 
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index c99d0a8f13fa..e4bc4741319b 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -46,9 +46,9 @@ struct extent_buffer *btrfs_find_create_tree_block(struct btrfs_root *root,
                                                    u64 bytenr, u32 blocksize);
 int clean_tree_block(struct btrfs_trans_handle *trans,
                      struct btrfs_root *root, struct extent_buffer *buf);
-struct btrfs_root *open_ctree(struct super_block *sb,
-                              struct btrfs_fs_devices *fs_devices,
-                              char *options);
+int open_ctree(struct super_block *sb,
+               struct btrfs_fs_devices *fs_devices,
+               char *options);
 int close_ctree(struct btrfs_root *root);
 int write_ctree_super(struct btrfs_trans_handle *trans,
                       struct btrfs_root *root, int max_mirrors);
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 1b8dc33778f9..5f77166fd01c 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -67,7 +67,7 @@ static struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid,
                                        u64 root_objectid, u32 generation,
                                        int check_generation)
 {
-        struct btrfs_fs_info *fs_info = btrfs_sb(sb)->fs_info;
+        struct btrfs_fs_info *fs_info = btrfs_sb(sb);
         struct btrfs_root *root;
         struct inode *inode;
         struct btrfs_key key;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index f5fbe576d2ba..700879ed64cf 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -618,8 +618,7 @@ static struct btrfs_space_info *__find_space_info(struct btrfs_fs_info *info,
         struct list_head *head = &info->space_info;
         struct btrfs_space_info *found;
 
-        flags &= BTRFS_BLOCK_GROUP_DATA | BTRFS_BLOCK_GROUP_SYSTEM |
-                 BTRFS_BLOCK_GROUP_METADATA;
+        flags &= BTRFS_BLOCK_GROUP_TYPE_MASK;
 
         rcu_read_lock();
         list_for_each_entry_rcu(found, head, list) {
@@ -1872,20 +1871,24 @@ static int btrfs_discard_extent(struct btrfs_root *root, u64 bytenr,
 int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
                          struct btrfs_root *root,
                          u64 bytenr, u64 num_bytes, u64 parent,
-                         u64 root_objectid, u64 owner, u64 offset)
+                         u64 root_objectid, u64 owner, u64 offset, int for_cow)
 {
         int ret;
+        struct btrfs_fs_info *fs_info = root->fs_info;
+
         BUG_ON(owner < BTRFS_FIRST_FREE_OBJECTID &&
                root_objectid == BTRFS_TREE_LOG_OBJECTID);
 
         if (owner < BTRFS_FIRST_FREE_OBJECTID) {
-                ret = btrfs_add_delayed_tree_ref(trans, bytenr, num_bytes,
+                ret = btrfs_add_delayed_tree_ref(fs_info, trans, bytenr,
+                                        num_bytes,
                                         parent, root_objectid, (int)owner,
-                                        BTRFS_ADD_DELAYED_REF, NULL);
+                                        BTRFS_ADD_DELAYED_REF, NULL, for_cow);
         } else {
-                ret = btrfs_add_delayed_data_ref(trans, bytenr, num_bytes,
+                ret = btrfs_add_delayed_data_ref(fs_info, trans, bytenr,
+                                        num_bytes,
                                         parent, root_objectid, owner, offset,
-                                        BTRFS_ADD_DELAYED_REF, NULL);
+                                        BTRFS_ADD_DELAYED_REF, NULL, for_cow);
         }
         return ret;
 }
@@ -2233,6 +2236,28 @@ static noinline int run_clustered_refs(struct btrfs_trans_handle *trans,
                 }
 
                 /*
+                 * locked_ref is the head node, so we have to go one
+                 * node back for any delayed ref updates
+                 */
+                ref = select_delayed_ref(locked_ref);
+
+                if (ref && ref->seq &&
+                    btrfs_check_delayed_seq(delayed_refs, ref->seq)) {
+                        /*
+                         * there are still refs with lower seq numbers in the
+                         * process of being added. Don't run this ref yet.
+                         */
+                        list_del_init(&locked_ref->cluster);
+                        mutex_unlock(&locked_ref->mutex);
+                        locked_ref = NULL;
+                        delayed_refs->num_heads_ready++;
+                        spin_unlock(&delayed_refs->lock);
+                        cond_resched();
+                        spin_lock(&delayed_refs->lock);
+                        continue;
+                }
+
+                /*
                  * record the must insert reserved flag before we
                  * drop the spin lock.
                  */
@@ -2242,11 +2267,6 @@ static noinline int run_clustered_refs(struct btrfs_trans_handle *trans,
                 extent_op = locked_ref->extent_op;
                 locked_ref->extent_op = NULL;
 
-                /*
-                 * locked_ref is the head node, so we have to go one
-                 * node back for any delayed ref updates
-                 */
-                ref = select_delayed_ref(locked_ref);
                 if (!ref) {
                         /* All delayed refs have been processed, Go ahead
                          * and send the head node to run_one_delayed_ref,
@@ -2267,9 +2287,7 @@ static noinline int run_clustered_refs(struct btrfs_trans_handle *trans,
                                 BUG_ON(ret);
                                 kfree(extent_op);
 
-                                cond_resched();
-                                spin_lock(&delayed_refs->lock);
-                                continue;
+                                goto next;
                         }
 
                         list_del_init(&locked_ref->cluster);
@@ -2279,7 +2297,12 @@ static noinline int run_clustered_refs(struct btrfs_trans_handle *trans,
                 ref->in_tree = 0;
                 rb_erase(&ref->rb_node, &delayed_refs->root);
                 delayed_refs->num_entries--;
-
+                /*
+                 * we modified num_entries, but as we're currently running
+                 * delayed refs, skip
+                 *     wake_up(&delayed_refs->seq_wait);
+                 * here.
+                 */
                 spin_unlock(&delayed_refs->lock);
 
                 ret = run_one_delayed_ref(trans, root, ref, extent_op,
@@ -2289,13 +2312,34 @@ static noinline int run_clustered_refs(struct btrfs_trans_handle *trans,
                 btrfs_put_delayed_ref(ref);
                 kfree(extent_op);
                 count++;
-
+next:
+                do_chunk_alloc(trans, root->fs_info->extent_root,
+                               2 * 1024 * 1024,
+                               btrfs_get_alloc_profile(root, 0),
+                               CHUNK_ALLOC_NO_FORCE);
                 cond_resched();
                 spin_lock(&delayed_refs->lock);
         }
         return count;
 }
 
+
+static void wait_for_more_refs(struct btrfs_delayed_ref_root *delayed_refs,
+                        unsigned long num_refs)
+{
+        struct list_head *first_seq = delayed_refs->seq_head.next;
+
+        spin_unlock(&delayed_refs->lock);
+        pr_debug("waiting for more refs (num %ld, first %p)\n",
+                 num_refs, first_seq);
+        wait_event(delayed_refs->seq_wait,
+                   num_refs != delayed_refs->num_entries ||
+                   delayed_refs->seq_head.next != first_seq);
+        pr_debug("done waiting for more refs (num %ld, first %p)\n",
+                 delayed_refs->num_entries, delayed_refs->seq_head.next);
+        spin_lock(&delayed_refs->lock);
+}
+
 /*
  * this starts processing the delayed reference count updates and
  * extent insertions we have queued up so far.  count can be
@@ -2311,15 +2355,23 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
         struct btrfs_delayed_ref_node *ref;
         struct list_head cluster;
         int ret;
+        u64 delayed_start;
         int run_all = count == (unsigned long)-1;
         int run_most = 0;
+        unsigned long num_refs = 0;
+        int consider_waiting;
 
         if (root == root->fs_info->extent_root)
                 root = root->fs_info->tree_root;
 
+        do_chunk_alloc(trans, root->fs_info->extent_root,
+                       2 * 1024 * 1024, btrfs_get_alloc_profile(root, 0),
+                       CHUNK_ALLOC_NO_FORCE);
+
         delayed_refs = &trans->transaction->delayed_refs;
         INIT_LIST_HEAD(&cluster);
 again:
+        consider_waiting = 0;
         spin_lock(&delayed_refs->lock);
         if (count == 0) {
                 count = delayed_refs->num_entries * 2;
@@ -2336,11 +2388,35 @@ again:
                  * of refs to process starting at the first one we are able to
                  * lock
                  */
+                delayed_start = delayed_refs->run_delayed_start;
                 ret = btrfs_find_ref_cluster(trans, &cluster,
                                              delayed_refs->run_delayed_start);
                 if (ret)
                         break;
 
+                if (delayed_start >= delayed_refs->run_delayed_start) {
+                        if (consider_waiting == 0) {
+                                /*
+                                 * btrfs_find_ref_cluster looped. let's do one
+                                 * more cycle. if we don't run any delayed ref
+                                 * during that cycle (because we can't because
+                                 * all of them are blocked) and if the number of
+                                 * refs doesn't change, we avoid busy waiting.
+                                 */
+                                consider_waiting = 1;
+                                num_refs = delayed_refs->num_entries;
+                        } else {
+                                wait_for_more_refs(delayed_refs, num_refs);
+                                /*
+                                 * after waiting, things have changed. we
+                                 * dropped the lock and someone else might have
+                                 * run some refs, built new clusters and so on.
+                                 * therefore, we restart staleness detection.
+                                 */
+                                consider_waiting = 0;
+                        }
+                }
+
                 ret = run_clustered_refs(trans, root, &cluster);
                 BUG_ON(ret < 0);
 
@@ -2348,6 +2424,11 @@ again:
 
                 if (count == 0)
                         break;
+
+                if (ret || delayed_refs->run_delayed_start == 0) {
+                        /* refs were run, let's reset staleness detection */
+                        consider_waiting = 0;
+                }
         }
 
         if (run_all) {
@@ -2405,7 +2486,8 @@ int btrfs_set_disk_extent_flags(struct btrfs_trans_handle *trans,
         extent_op->update_key = 0;
         extent_op->is_data = is_data ? 1 : 0;
 
-        ret = btrfs_add_delayed_extent_op(trans, bytenr, num_bytes, extent_op);
+        ret = btrfs_add_delayed_extent_op(root->fs_info, trans, bytenr,
+                                          num_bytes, extent_op);
         if (ret)
                 kfree(extent_op);
         return ret;
@@ -2590,7 +2672,7 @@ out:
 static int __btrfs_mod_ref(struct btrfs_trans_handle *trans,
                            struct btrfs_root *root,
                            struct extent_buffer *buf,
-                           int full_backref, int inc)
+                           int full_backref, int inc, int for_cow)
 {
         u64 bytenr;
         u64 num_bytes;
@@ -2603,7 +2685,7 @@ static int __btrfs_mod_ref(struct btrfs_trans_handle *trans,
         int level;
         int ret = 0;
         int (*process_func)(struct btrfs_trans_handle *, struct btrfs_root *,
-                            u64, u64, u64, u64, u64, u64);
+                            u64, u64, u64, u64, u64, u64, int);
 
         ref_root = btrfs_header_owner(buf);
         nritems = btrfs_header_nritems(buf);
@@ -2640,14 +2722,15 @@ static int __btrfs_mod_ref(struct btrfs_trans_handle *trans,
                         key.offset -= btrfs_file_extent_offset(buf, fi);
                         ret = process_func(trans, root, bytenr, num_bytes,
                                            parent, ref_root, key.objectid,
-                                           key.offset);
+                                           key.offset, for_cow);
                         if (ret)
                                 goto fail;
                 } else {
                         bytenr = btrfs_node_blockptr(buf, i);
                         num_bytes = btrfs_level_size(root, level - 1);
                         ret = process_func(trans, root, bytenr, num_bytes,
-                                           parent, ref_root, level - 1, 0);
+                                           parent, ref_root, level - 1, 0,
+                                           for_cow);
                         if (ret)
                                 goto fail;
                 }
@@ -2659,15 +2742,15 @@ fail:
 }
 
 int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
-                  struct extent_buffer *buf, int full_backref)
+                  struct extent_buffer *buf, int full_backref, int for_cow)
 {
-        return __btrfs_mod_ref(trans, root, buf, full_backref, 1);
+        return __btrfs_mod_ref(trans, root, buf, full_backref, 1, for_cow);
 }
 
 int btrfs_dec_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
-                  struct extent_buffer *buf, int full_backref)
+                  struct extent_buffer *buf, int full_backref, int for_cow)
 {
-        return __btrfs_mod_ref(trans, root, buf, full_backref, 0);
+        return __btrfs_mod_ref(trans, root, buf, full_backref, 0, for_cow);
 }
 
 static int write_one_cache_group(struct btrfs_trans_handle *trans,
@@ -2993,9 +3076,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
                 INIT_LIST_HEAD(&found->block_groups[i]);
         init_rwsem(&found->groups_sem);
         spin_lock_init(&found->lock);
-        found->flags = flags & (BTRFS_BLOCK_GROUP_DATA |
-                                BTRFS_BLOCK_GROUP_SYSTEM |
-                                BTRFS_BLOCK_GROUP_METADATA);
+        found->flags = flags & BTRFS_BLOCK_GROUP_TYPE_MASK;
         found->total_bytes = total_bytes;
         found->disk_total = total_bytes * factor;
         found->bytes_used = bytes_used;
@@ -3016,20 +3097,27 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
 
 static void set_avail_alloc_bits(struct btrfs_fs_info *fs_info, u64 flags)
 {
-        u64 extra_flags = flags & (BTRFS_BLOCK_GROUP_RAID0 |
-                                   BTRFS_BLOCK_GROUP_RAID1 |
-                                   BTRFS_BLOCK_GROUP_RAID10 |
-                                   BTRFS_BLOCK_GROUP_DUP);
-        if (extra_flags) {
-                if (flags & BTRFS_BLOCK_GROUP_DATA)
-                        fs_info->avail_data_alloc_bits |= extra_flags;
-                if (flags & BTRFS_BLOCK_GROUP_METADATA)
-                        fs_info->avail_metadata_alloc_bits |= extra_flags;
-                if (flags & BTRFS_BLOCK_GROUP_SYSTEM)
-                        fs_info->avail_system_alloc_bits |= extra_flags;
-        }
+        u64 extra_flags = flags & BTRFS_BLOCK_GROUP_PROFILE_MASK;
+
+        /* chunk -> extended profile */
+        if (extra_flags == 0)
+                extra_flags = BTRFS_AVAIL_ALLOC_BIT_SINGLE;
+
+        if (flags & BTRFS_BLOCK_GROUP_DATA)
+                fs_info->avail_data_alloc_bits |= extra_flags;
+        if (flags & BTRFS_BLOCK_GROUP_METADATA)
+                fs_info->avail_metadata_alloc_bits |= extra_flags;
+        if (flags & BTRFS_BLOCK_GROUP_SYSTEM)
+                fs_info->avail_system_alloc_bits |= extra_flags;
 }
 
+/*
+ * @flags: available profiles in extended format (see ctree.h)
+ *
+ * Returns reduced profile in chunk format.  If profile changing is in
+ * progress (either running or paused) picks the target profile (if it's
+ * already available), otherwise falls back to plain reducing.
+ */
 u64 btrfs_reduce_alloc_profile(struct btrfs_root *root, u64 flags)
 {
         /*
@@ -3040,6 +3128,34 @@ u64 btrfs_reduce_alloc_profile(struct btrfs_root *root, u64 flags)
         u64 num_devices = root->fs_info->fs_devices->rw_devices +
                 root->fs_info->fs_devices->missing_devices;
 
+        /* pick restriper's target profile if it's available */
+        spin_lock(&root->fs_info->balance_lock);
+        if (root->fs_info->balance_ctl) {
+                struct btrfs_balance_control *bctl = root->fs_info->balance_ctl;
+                u64 tgt = 0;
+
+                if ((flags & BTRFS_BLOCK_GROUP_DATA) &&
+                    (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
+                    (flags & bctl->data.target)) {
+                        tgt = BTRFS_BLOCK_GROUP_DATA | bctl->data.target;
+                } else if ((flags & BTRFS_BLOCK_GROUP_SYSTEM) &&
+                           (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
+                           (flags & bctl->sys.target)) {
+                        tgt = BTRFS_BLOCK_GROUP_SYSTEM | bctl->sys.target;
+                } else if ((flags & BTRFS_BLOCK_GROUP_METADATA) &&
+                           (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
+                           (flags & bctl->meta.target)) {
+                        tgt = BTRFS_BLOCK_GROUP_METADATA | bctl->meta.target;
+                }
+
+                if (tgt) {
+                        spin_unlock(&root->fs_info->balance_lock);
+                        flags = tgt;
+                        goto out;
+                }
+        }
+        spin_unlock(&root->fs_info->balance_lock);
+
         if (num_devices == 1)
                 flags &= ~(BTRFS_BLOCK_GROUP_RAID1 | BTRFS_BLOCK_GROUP_RAID0);
         if (num_devices < 4)
@@ -3059,22 +3175,25 @@ u64 btrfs_reduce_alloc_profile(struct btrfs_root *root, u64 flags)
         if ((flags & BTRFS_BLOCK_GROUP_RAID0) &&
             ((flags & BTRFS_BLOCK_GROUP_RAID1) |
              (flags & BTRFS_BLOCK_GROUP_RAID10) |
-             (flags & BTRFS_BLOCK_GROUP_DUP)))
+             (flags & BTRFS_BLOCK_GROUP_DUP))) {
                 flags &= ~BTRFS_BLOCK_GROUP_RAID0;
+        }
+
+out:
+        /* extended -> chunk profile */
+        flags &= ~BTRFS_AVAIL_ALLOC_BIT_SINGLE;
         return flags;
 }
 
 static u64 get_alloc_profile(struct btrfs_root *root, u64 flags)
 {
         if (flags & BTRFS_BLOCK_GROUP_DATA)
-                flags |= root->fs_info->avail_data_alloc_bits &
-                         root->fs_info->data_alloc_profile;
+                flags |= root->fs_info->avail_data_alloc_bits;
         else if (flags & BTRFS_BLOCK_GROUP_SYSTEM)
-                flags |= root->fs_info->avail_system_alloc_bits &
-                         root->fs_info->system_alloc_profile;
+                flags |= root->fs_info->avail_system_alloc_bits;
         else if (flags & BTRFS_BLOCK_GROUP_METADATA)
-                flags |= root->fs_info->avail_metadata_alloc_bits &
-                         root->fs_info->metadata_alloc_profile;
+                flags |= root->fs_info->avail_metadata_alloc_bits;
+
         return btrfs_reduce_alloc_profile(root, flags);
 }
 
@@ -3191,6 +3310,8 @@ commit_trans:
                 return -ENOSPC;
         }
         data_sinfo->bytes_may_use += bytes;
+        trace_btrfs_space_reservation(root->fs_info, "space_info",
+                                      (u64)data_sinfo, bytes, 1);
         spin_unlock(&data_sinfo->lock);
 
         return 0;
@@ -3210,6 +3331,8 @@ void btrfs_free_reserved_data_space(struct inode *inode, u64 bytes)
         data_sinfo = BTRFS_I(inode)->space_info;
         spin_lock(&data_sinfo->lock);
         data_sinfo->bytes_may_use -= bytes;
+        trace_btrfs_space_reservation(root->fs_info, "space_info",
+                                      (u64)data_sinfo, bytes, 0);
         spin_unlock(&data_sinfo->lock);
 }
 
@@ -3257,27 +3380,15 @@ static int should_alloc_chunk(struct btrfs_root *root,
                 if (num_bytes - num_allocated < thresh)
                         return 1;
         }
-
-        /*
-         * we have two similar checks here, one based on percentage
-         * and once based on a hard number of 256MB.  The idea
-         * is that if we have a good amount of free
-         * room, don't allocate a chunk.  A good mount is
-         * less than 80% utilized of the chunks we have allocated,
-         * or more than 256MB free
-         */
-        if (num_allocated + alloc_bytes + 256 * 1024 * 1024 < num_bytes)
-                return 0;
-
-        if (num_allocated + alloc_bytes < div_factor(num_bytes, 8))
-                return 0;
-
         thresh = btrfs_super_total_bytes(root->fs_info->super_copy);
 
-        /* 256MB or 5% of the FS */
-        thresh = max_t(u64, 256 * 1024 * 1024, div_factor_fine(thresh, 5));
+        /* 256MB or 2% of the FS */
+        thresh = max_t(u64, 256 * 1024 * 1024, div_factor_fine(thresh, 2));
+        /* system chunks need a much small threshold */
+        if (sinfo->flags & BTRFS_BLOCK_GROUP_SYSTEM)
+                thresh = 32 * 1024 * 1024;
 
-        if (num_bytes > thresh && sinfo->bytes_used < div_factor(num_bytes, 3))
+        if (num_bytes > thresh && sinfo->bytes_used < div_factor(num_bytes, 8))
                 return 0;
         return 1;
 }
@@ -3291,7 +3402,7 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans,
         int wait_for_alloc = 0;
         int ret = 0;
 
-        flags = btrfs_reduce_alloc_profile(extent_root, flags);
+        BUG_ON(!profile_is_valid(flags, 0));
 
         space_info = __find_space_info(extent_root->fs_info, flags);
         if (!space_info) {
@@ -3582,6 +3693,10 @@ again:
         if (used <= space_info->total_bytes) {
                 if (used + orig_bytes <= space_info->total_bytes) {
                         space_info->bytes_may_use += orig_bytes;
+                        trace_btrfs_space_reservation(root->fs_info,
+                                                      "space_info",
+                                                      (u64)space_info,
+                                                      orig_bytes, 1);
                         ret = 0;
                 } else {
                         /*
@@ -3649,6 +3764,10 @@ again:
 
                 if (used + num_bytes < space_info->total_bytes + avail) {
                         space_info->bytes_may_use += orig_bytes;
+                        trace_btrfs_space_reservation(root->fs_info,
+                                                      "space_info",
+                                                      (u64)space_info,
+                                                      orig_bytes, 1);
                         ret = 0;
                 } else {
                         wait_ordered = true;
@@ -3755,7 +3874,8 @@ static void block_rsv_add_bytes(struct btrfs_block_rsv *block_rsv,
         spin_unlock(&block_rsv->lock);
 }
 
-static void block_rsv_release_bytes(struct btrfs_block_rsv *block_rsv,
+static void block_rsv_release_bytes(struct btrfs_fs_info *fs_info,
+                                    struct btrfs_block_rsv *block_rsv,
                                     struct btrfs_block_rsv *dest, u64 num_bytes)
 {
         struct btrfs_space_info *space_info = block_rsv->space_info;
@@ -3791,6 +3911,9 @@ static void block_rsv_release_bytes(struct btrfs_block_rsv *block_rsv,
                 if (num_bytes) {
                         spin_lock(&space_info->lock);
                         space_info->bytes_may_use -= num_bytes;
+                        trace_btrfs_space_reservation(fs_info, "space_info",
+                                                      (u64)space_info,
+                                                      num_bytes, 0);
                         space_info->reservation_progress++;
                         spin_unlock(&space_info->lock);
                 }
@@ -3947,7 +4070,8 @@ void btrfs_block_rsv_release(struct btrfs_root *root,
         if (global_rsv->full || global_rsv == block_rsv ||
             block_rsv->space_info != global_rsv->space_info)
                 global_rsv = NULL;
-        block_rsv_release_bytes(block_rsv, global_rsv, num_bytes);
+        block_rsv_release_bytes(root->fs_info, block_rsv, global_rsv,
+                                num_bytes);
 }
 
 /*
@@ -4006,11 +4130,15 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
                 num_bytes = sinfo->total_bytes - num_bytes;
                 block_rsv->reserved += num_bytes;
                 sinfo->bytes_may_use += num_bytes;
+                trace_btrfs_space_reservation(fs_info, "space_info",
+                                              (u64)sinfo, num_bytes, 1);
         }
 
         if (block_rsv->reserved >= block_rsv->size) {
                 num_bytes = block_rsv->reserved - block_rsv->size;
                 sinfo->bytes_may_use -= num_bytes;
+                trace_btrfs_space_reservation(fs_info, "space_info",
+                                              (u64)sinfo, num_bytes, 0);
                 sinfo->reservation_progress++;
                 block_rsv->reserved = block_rsv->size;
                 block_rsv->full = 1;
@@ -4045,7 +4173,8 @@ static void init_global_block_rsv(struct btrfs_fs_info *fs_info)
 
 static void release_global_block_rsv(struct btrfs_fs_info *fs_info)
 {
-        block_rsv_release_bytes(&fs_info->global_block_rsv, NULL, (u64)-1);
+        block_rsv_release_bytes(fs_info, &fs_info->global_block_rsv, NULL,
+                                (u64)-1);
         WARN_ON(fs_info->delalloc_block_rsv.size > 0);
         WARN_ON(fs_info->delalloc_block_rsv.reserved > 0);
         WARN_ON(fs_info->trans_block_rsv.size > 0);
@@ -4062,6 +4191,8 @@ void btrfs_trans_release_metadata(struct btrfs_trans_handle *trans,
         if (!trans->bytes_reserved)
                 return;
 
+        trace_btrfs_space_reservation(root->fs_info, "transaction", (u64)trans,
+                                      trans->bytes_reserved, 0);
         btrfs_block_rsv_release(root, trans->block_rsv, trans->bytes_reserved);
         trans->bytes_reserved = 0;
 }
@@ -4079,6 +4210,8 @@ int btrfs_orphan_reserve_metadata(struct btrfs_trans_handle *trans,
          * when we are truly done with the orphan item.
          */
         u64 num_bytes = btrfs_calc_trans_metadata_size(root, 1);
+        trace_btrfs_space_reservation(root->fs_info, "orphan",
+                                      btrfs_ino(inode), num_bytes, 1);
         return block_rsv_migrate_bytes(src_rsv, dst_rsv, num_bytes);
 }
 
@@ -4086,6 +4219,8 @@ void btrfs_orphan_release_metadata(struct inode *inode)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
         u64 num_bytes = btrfs_calc_trans_metadata_size(root, 1);
+        trace_btrfs_space_reservation(root->fs_info, "orphan",
+                                      btrfs_ino(inode), num_bytes, 0);
         btrfs_block_rsv_release(root, root->orphan_block_rsv, num_bytes);
 }
 
@@ -4213,12 +4348,11 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
         /* Need to be holding the i_mutex here if we aren't free space cache */
         if (btrfs_is_free_space_inode(root, inode))
                 flush = 0;
-        else
-                WARN_ON(!mutex_is_locked(&inode->i_mutex));
 
         if (flush && btrfs_transaction_in_commit(root->fs_info))
                 schedule_timeout(1);
 
+        mutex_lock(&BTRFS_I(inode)->delalloc_mutex);
         num_bytes = ALIGN(num_bytes, root->sectorsize);
 
         spin_lock(&BTRFS_I(inode)->lock);
@@ -4266,8 +4400,14 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
                 if (dropped)
                         to_free += btrfs_calc_trans_metadata_size(root, dropped);
 
-                if (to_free)
+                if (to_free) {
                         btrfs_block_rsv_release(root, block_rsv, to_free);
+                        trace_btrfs_space_reservation(root->fs_info,
+                                                      "delalloc",
+                                                      btrfs_ino(inode),
+                                                      to_free, 0);
+                }
+                mutex_unlock(&BTRFS_I(inode)->delalloc_mutex);
                 return ret;
         }
 
@@ -4278,7 +4418,11 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
         }
         BTRFS_I(inode)->reserved_extents += nr_extents;
         spin_unlock(&BTRFS_I(inode)->lock);
+        mutex_unlock(&BTRFS_I(inode)->delalloc_mutex);
 
+        if (to_reserve)
+                trace_btrfs_space_reservation(root->fs_info,"delalloc",
+                                              btrfs_ino(inode), to_reserve, 1);
         block_rsv_add_bytes(block_rsv, to_reserve, 1);
 
         return 0;
@@ -4308,6 +4452,8 @@ void btrfs_delalloc_release_metadata(struct inode *inode, u64 num_bytes)
         if (dropped > 0)
                 to_free += btrfs_calc_trans_metadata_size(root, dropped);
 
+        trace_btrfs_space_reservation(root->fs_info, "delalloc",
+                                      btrfs_ino(inode), to_free, 0);
         btrfs_block_rsv_release(root, &root->fs_info->delalloc_block_rsv,
                                 to_free);
 }
@@ -4562,7 +4708,10 @@ static int btrfs_update_reserved_bytes(struct btrfs_block_group_cache *cache,
                         cache->reserved += num_bytes;
                         space_info->bytes_reserved += num_bytes;
                         if (reserve == RESERVE_ALLOC) {
-                                BUG_ON(space_info->bytes_may_use < num_bytes);
+                                trace_btrfs_space_reservation(cache->fs_info,
+                                                              "space_info",
+                                                              (u64)space_info,
+                                                              num_bytes, 0);
                                 space_info->bytes_may_use -= num_bytes;
                         }
                 }
@@ -4928,6 +5077,8 @@ static noinline int check_ref_cleanup(struct btrfs_trans_handle *trans,
         rb_erase(&head->node.rb_node, &delayed_refs->root);
 
         delayed_refs->num_entries--;
+        if (waitqueue_active(&delayed_refs->seq_wait))
+                wake_up(&delayed_refs->seq_wait);
 
         /*
          * we don't take a ref on the node because we're removing it from the
@@ -4955,16 +5106,17 @@ out:
 void btrfs_free_tree_block(struct btrfs_trans_handle *trans,
                            struct btrfs_root *root,
                            struct extent_buffer *buf,
-                           u64 parent, int last_ref)
+                           u64 parent, int last_ref, int for_cow)
 {
         struct btrfs_block_group_cache *cache = NULL;
         int ret;
 
         if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID) {
-                ret = btrfs_add_delayed_tree_ref(trans, buf->start, buf->len,
-                                                parent, root->root_key.objectid,
-                                                btrfs_header_level(buf),
-                                                BTRFS_DROP_DELAYED_REF, NULL);
+                ret = btrfs_add_delayed_tree_ref(root->fs_info, trans,
+                                        buf->start, buf->len,
+                                        parent, root->root_key.objectid,
+                                        btrfs_header_level(buf),
+                                        BTRFS_DROP_DELAYED_REF, NULL, for_cow);
                 BUG_ON(ret);
         }
 
@@ -4999,12 +5151,12 @@ out:
         btrfs_put_block_group(cache);
 }
 
-int btrfs_free_extent(struct btrfs_trans_handle *trans,
-                      struct btrfs_root *root,
-                      u64 bytenr, u64 num_bytes, u64 parent,
-                      u64 root_objectid, u64 owner, u64 offset)
+int btrfs_free_extent(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+                      u64 bytenr, u64 num_bytes, u64 parent, u64 root_objectid,
+                      u64 owner, u64 offset, int for_cow)
 {
         int ret;
+        struct btrfs_fs_info *fs_info = root->fs_info;
 
         /*
          * tree log blocks never actually go into the extent allocation
@@ -5016,14 +5168,17 @@ int btrfs_free_extent(struct btrfs_trans_handle *trans,
                 btrfs_pin_extent(root, bytenr, num_bytes, 1);
                 ret = 0;
         } else if (owner < BTRFS_FIRST_FREE_OBJECTID) {
-                ret = btrfs_add_delayed_tree_ref(trans, bytenr, num_bytes,
+                ret = btrfs_add_delayed_tree_ref(fs_info, trans, bytenr,
+                                        num_bytes,
                                         parent, root_objectid, (int)owner,
-                                        BTRFS_DROP_DELAYED_REF, NULL);
+                                        BTRFS_DROP_DELAYED_REF, NULL, for_cow);
                 BUG_ON(ret);
         } else {
-                ret = btrfs_add_delayed_data_ref(trans, bytenr, num_bytes,
-                                        parent, root_objectid, owner,
-                                        offset, BTRFS_DROP_DELAYED_REF, NULL);
+                ret = btrfs_add_delayed_data_ref(fs_info, trans, bytenr,
+                                                num_bytes,
+                                                parent, root_objectid, owner,
+                                                offset, BTRFS_DROP_DELAYED_REF,
+                                                NULL, for_cow);
                 BUG_ON(ret);
         }
         return ret;
@@ -5146,6 +5301,8 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
         ins->objectid = 0;
         ins->offset = 0;
 
+        trace_find_free_extent(orig_root, num_bytes, empty_size, data);
+
         space_info = __find_space_info(root->fs_info, data);
         if (!space_info) {
                 printk(KERN_ERR "No space info for %llu\n", data);
@@ -5295,15 +5452,6 @@ alloc:
                 if (unlikely(block_group->ro))
                         goto loop;
 
-                spin_lock(&block_group->free_space_ctl->tree_lock);
-                if (cached &&
-                    block_group->free_space_ctl->free_space <
-                    num_bytes + empty_cluster + empty_size) {
-                        spin_unlock(&block_group->free_space_ctl->tree_lock);
-                        goto loop;
-                }
-                spin_unlock(&block_group->free_space_ctl->tree_lock);
-
                 /*
                  * Ok we want to try and use the cluster allocator, so
                  * lets look there
@@ -5331,6 +5479,8 @@ alloc:
                         if (offset) {
                                 /* we have a block, we're done */
                                 spin_unlock(&last_ptr->refill_lock);
+                                trace_btrfs_reserve_extent_cluster(root,
+                                        block_group, search_start, num_bytes);
                                 goto checks;
                         }
 
@@ -5349,8 +5499,15 @@ refill_cluster:
                          * plenty of times and not have found
                          * anything, so we are likely way too
                          * fragmented for the clustering stuff to find
-                         * anything.  */
-                        if (loop >= LOOP_NO_EMPTY_SIZE) {
+                         * anything.
+                         *
+                         * However, if the cluster is taken from the
+                         * current block group, release the cluster
+                         * first, so that we stand a better chance of
+                         * succeeding in the unclustered
+                         * allocation.  */
+                        if (loop >= LOOP_NO_EMPTY_SIZE &&
+                            last_ptr->block_group != block_group) {
                                 spin_unlock(&last_ptr->refill_lock);
                                 goto unclustered_alloc;
                         }
@@ -5361,6 +5518,11 @@ refill_cluster:
                          */
                         btrfs_return_cluster_to_free_space(NULL, last_ptr);
 
+                        if (loop >= LOOP_NO_EMPTY_SIZE) {
+                                spin_unlock(&last_ptr->refill_lock);
+                                goto unclustered_alloc;
+                        }
+
                         /* allocate a cluster in this block group */
                         ret = btrfs_find_space_cluster(trans, root,
                                                block_group, last_ptr,
@@ -5377,6 +5539,9 @@ refill_cluster:
                                 if (offset) {
                                         /* we found one, proceed */
                                         spin_unlock(&last_ptr->refill_lock);
+                                        trace_btrfs_reserve_extent_cluster(root,
+                                                block_group, search_start,
+                                                num_bytes);
                                         goto checks;
                                 }
                         } else if (!cached && loop > LOOP_CACHING_NOWAIT
@@ -5401,6 +5566,15 @@ refill_cluster:
                 }
 
 unclustered_alloc:
+                spin_lock(&block_group->free_space_ctl->tree_lock);
+                if (cached &&
+                    block_group->free_space_ctl->free_space <
+                    num_bytes + empty_cluster + empty_size) {
+                        spin_unlock(&block_group->free_space_ctl->tree_lock);
+                        goto loop;
+                }
+                spin_unlock(&block_group->free_space_ctl->tree_lock);
+
                 offset = btrfs_find_space_for_alloc(block_group, search_start,
                                                     num_bytes, empty_size);
                 /*
@@ -5438,9 +5612,6 @@ checks:
                         goto loop;
                 }
 
-                ins->objectid = search_start;
-                ins->offset = num_bytes;
-
                 if (offset < search_start)
                         btrfs_add_free_space(used_block_group, offset,
                                              search_start - offset);
@@ -5457,6 +5628,8 @@ checks:
                 ins->objectid = search_start;
                 ins->offset = num_bytes;
 
+                trace_btrfs_reserve_extent(orig_root, block_group,
+                                           search_start, num_bytes);
                 if (offset < search_start)
                         btrfs_add_free_space(used_block_group, offset,
                                              search_start - offset);
@@ -5842,9 +6015,10 @@ int btrfs_alloc_reserved_file_extent(struct btrfs_trans_handle *trans,
 
         BUG_ON(root_objectid == BTRFS_TREE_LOG_OBJECTID);
 
-        ret = btrfs_add_delayed_data_ref(trans, ins->objectid, ins->offset,
-                                         0, root_objectid, owner, offset,
-                                         BTRFS_ADD_DELAYED_EXTENT, NULL);
+        ret = btrfs_add_delayed_data_ref(root->fs_info, trans, ins->objectid,
+                                         ins->offset, 0,
+                                         root_objectid, owner, offset,
+                                         BTRFS_ADD_DELAYED_EXTENT, NULL, 0);
         return ret;
 }
 
@@ -5997,10 +6171,11 @@ use_block_rsv(struct btrfs_trans_handle *trans,
         return ERR_PTR(-ENOSPC);
 }
 
-static void unuse_block_rsv(struct btrfs_block_rsv *block_rsv, u32 blocksize)
+static void unuse_block_rsv(struct btrfs_fs_info *fs_info,
+                            struct btrfs_block_rsv *block_rsv, u32 blocksize)
 {
         block_rsv_add_bytes(block_rsv, blocksize, 0);
-        block_rsv_release_bytes(block_rsv, NULL, 0);
+        block_rsv_release_bytes(fs_info, block_rsv, NULL, 0);
 }
 
 /*
@@ -6014,7 +6189,7 @@ struct extent_buffer *btrfs_alloc_free_block(struct btrfs_trans_handle *trans,
                                         struct btrfs_root *root, u32 blocksize,
                                         u64 parent, u64 root_objectid,
                                         struct btrfs_disk_key *key, int level,
-                                        u64 hint, u64 empty_size)
+                                        u64 hint, u64 empty_size, int for_cow)
 {
         struct btrfs_key ins;
         struct btrfs_block_rsv *block_rsv;
@@ -6030,7 +6205,7 @@ struct extent_buffer *btrfs_alloc_free_block(struct btrfs_trans_handle *trans,
         ret = btrfs_reserve_extent(trans, root, blocksize, blocksize,
                                    empty_size, hint, (u64)-1, &ins, 0);
         if (ret) {
-                unuse_block_rsv(block_rsv, blocksize);
+                unuse_block_rsv(root->fs_info, block_rsv, blocksize);
                 return ERR_PTR(ret);
         }
 
@@ -6058,10 +6233,11 @@ struct extent_buffer *btrfs_alloc_free_block(struct btrfs_trans_handle *trans,
                 extent_op->update_flags = 1;
                 extent_op->is_data = 0;
 
-                ret = btrfs_add_delayed_tree_ref(trans, ins.objectid,
+                ret = btrfs_add_delayed_tree_ref(root->fs_info, trans,
+                                        ins.objectid,
                                         ins.offset, parent, root_objectid,
                                         level, BTRFS_ADD_DELAYED_EXTENT,
-                                        extent_op);
+                                        extent_op, for_cow);
                 BUG_ON(ret);
         }
         return buf;
@@ -6078,6 +6254,7 @@ struct walk_control {
         int keep_locks;
         int reada_slot;
         int reada_count;
+        int for_reloc;
 };
 
 #define DROP_REFERENCE  1
@@ -6216,9 +6393,9 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans,
         /* wc->stage == UPDATE_BACKREF */
         if (!(wc->flags[level] & flag)) {
                 BUG_ON(!path->locks[level]);
-                ret = btrfs_inc_ref(trans, root, eb, 1);
+                ret = btrfs_inc_ref(trans, root, eb, 1, wc->for_reloc);
                 BUG_ON(ret);
-                ret = btrfs_dec_ref(trans, root, eb, 0);
+                ret = btrfs_dec_ref(trans, root, eb, 0, wc->for_reloc);
                 BUG_ON(ret);
                 ret = btrfs_set_disk_extent_flags(trans, root, eb->start,
                                                   eb->len, flag, 0);
@@ -6362,7 +6539,7 @@ skip:
                 }
 
                 ret = btrfs_free_extent(trans, root, bytenr, blocksize, parent,
-                                        root->root_key.objectid, level - 1, 0);
+                                root->root_key.objectid, level - 1, 0, 0);
                 BUG_ON(ret);
         }
         btrfs_tree_unlock(next);
@@ -6436,9 +6613,11 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans,
         if (wc->refs[level] == 1) {
                 if (level == 0) {
                         if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF)
-                                ret = btrfs_dec_ref(trans, root, eb, 1);
+                                ret = btrfs_dec_ref(trans, root, eb, 1,
+                                                    wc->for_reloc);
                         else
-                                ret = btrfs_dec_ref(trans, root, eb, 0);
+                                ret = btrfs_dec_ref(trans, root, eb, 0,
+                                                    wc->for_reloc);
                         BUG_ON(ret);
                 }
                 /* make block locked assertion in clean_tree_block happy */
@@ -6465,7 +6644,7 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans,
                                btrfs_header_owner(path->nodes[level + 1]));
         }
 
-        btrfs_free_tree_block(trans, root, eb, parent, wc->refs[level] == 1);
+        btrfs_free_tree_block(trans, root, eb, parent, wc->refs[level] == 1, 0);
 out:
         wc->refs[level] = 0;
         wc->flags[level] = 0;
@@ -6549,7 +6728,8 @@ static noinline int walk_up_tree(struct btrfs_trans_handle *trans,
  * blocks are properly updated.
  */
 void btrfs_drop_snapshot(struct btrfs_root *root,
-                         struct btrfs_block_rsv *block_rsv, int update_ref)
+                         struct btrfs_block_rsv *block_rsv, int update_ref,
+                         int for_reloc)
 {
         struct btrfs_path *path;
         struct btrfs_trans_handle *trans;
@@ -6637,6 +6817,7 @@ void btrfs_drop_snapshot(struct btrfs_root *root,
         wc->stage = DROP_REFERENCE;
         wc->update_ref = update_ref;
         wc->keep_locks = 0;
+        wc->for_reloc = for_reloc;
         wc->reada_count = BTRFS_NODEPTRS_PER_BLOCK(root);
 
         while (1) {
@@ -6721,6 +6902,7 @@ out:
  * drop subtree rooted at tree block 'node'.
  *
  * NOTE: this function will unlock and release tree block 'node'
+ * only used by relocation code
  */
 int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
                         struct btrfs_root *root,
@@ -6765,6 +6947,7 @@ int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
         wc->stage = DROP_REFERENCE;
         wc->update_ref = 0;
         wc->keep_locks = 1;
+        wc->for_reloc = 1;
         wc->reada_count = BTRFS_NODEPTRS_PER_BLOCK(root);
 
         while (1) {
@@ -6792,6 +6975,29 @@ static u64 update_block_group_flags(struct btrfs_root *root, u64 flags)
         u64 stripped = BTRFS_BLOCK_GROUP_RAID0 |
                 BTRFS_BLOCK_GROUP_RAID1 | BTRFS_BLOCK_GROUP_RAID10;
 
+        if (root->fs_info->balance_ctl) {
+                struct btrfs_balance_control *bctl = root->fs_info->balance_ctl;
+                u64 tgt = 0;
+
+                /* pick restriper's target profile and return */
+                if (flags & BTRFS_BLOCK_GROUP_DATA &&
+                    bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) {
+                        tgt = BTRFS_BLOCK_GROUP_DATA | bctl->data.target;
+                } else if (flags & BTRFS_BLOCK_GROUP_SYSTEM &&
+                           bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) {
+                        tgt = BTRFS_BLOCK_GROUP_SYSTEM | bctl->sys.target;
+                } else if (flags & BTRFS_BLOCK_GROUP_METADATA &&
+                           bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) {
+                        tgt = BTRFS_BLOCK_GROUP_METADATA | bctl->meta.target;
+                }
+
+                if (tgt) {
+                        /* extended -> chunk profile */
+                        tgt &= ~BTRFS_AVAIL_ALLOC_BIT_SINGLE;
+                        return tgt;
+                }
+        }
+
         /*
          * we add in the count of missing devices because we want
          * to make sure that any RAID levels on a degraded FS
@@ -7085,7 +7291,7 @@ int btrfs_can_relocate(struct btrfs_root *root, u64 bytenr)
                  * space to fit our block group in.
                  */
                 if (device->total_bytes > device->bytes_used + min_free) {
-                        ret = find_free_dev_extent(NULL, device, min_free,
+                        ret = find_free_dev_extent(device, min_free,
                                                    &dev_offset, NULL);
                         if (!ret)
                                 dev_nr++;
@@ -7447,6 +7653,7 @@ int btrfs_make_block_group(struct btrfs_trans_handle *trans,
         ret = update_space_info(root->fs_info, cache->flags, size, bytes_used,
                                 &cache->space_info);
         BUG_ON(ret);
+        update_global_block_rsv(root->fs_info);
 
         spin_lock(&cache->space_info->lock);
         cache->space_info->bytes_readonly += cache->bytes_super;
@@ -7466,6 +7673,22 @@ int btrfs_make_block_group(struct btrfs_trans_handle *trans,
         return 0;
 }
 
+static void clear_avail_alloc_bits(struct btrfs_fs_info *fs_info, u64 flags)
+{
+        u64 extra_flags = flags & BTRFS_BLOCK_GROUP_PROFILE_MASK;
+
+        /* chunk -> extended profile */
+        if (extra_flags == 0)
+                extra_flags = BTRFS_AVAIL_ALLOC_BIT_SINGLE;
+
+        if (flags & BTRFS_BLOCK_GROUP_DATA)
+                fs_info->avail_data_alloc_bits &= ~extra_flags;
+        if (flags & BTRFS_BLOCK_GROUP_METADATA)
+                fs_info->avail_metadata_alloc_bits &= ~extra_flags;
+        if (flags & BTRFS_BLOCK_GROUP_SYSTEM)
+                fs_info->avail_system_alloc_bits &= ~extra_flags;
+}
+
 int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
                              struct btrfs_root *root, u64 group_start)
 {
@@ -7476,6 +7699,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
         struct btrfs_key key;
         struct inode *inode;
         int ret;
+        int index;
         int factor;
 
         root = root->fs_info->extent_root;
@@ -7491,6 +7715,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
         free_excluded_extents(root, block_group);
 
         memcpy(&key, &block_group->key, sizeof(key));
+        index = get_block_group_index(block_group);
         if (block_group->flags & (BTRFS_BLOCK_GROUP_DUP |
                                   BTRFS_BLOCK_GROUP_RAID1 |
                                   BTRFS_BLOCK_GROUP_RAID10))
@@ -7565,6 +7790,8 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
          * are still on the list after taking the semaphore
          */
         list_del_init(&block_group->list);
+        if (list_empty(&block_group->space_info->block_groups[index]))
+                clear_avail_alloc_bits(root->fs_info, block_group->flags);
         up_write(&block_group->space_info->groups_sem);
 
         if (block_group->cached == BTRFS_CACHE_STARTED)
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 49f3c9dc09f4..9d09a4f81875 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -18,6 +18,7 @@
 #include "ctree.h"
 #include "btrfs_inode.h"
 #include "volumes.h"
+#include "check-integrity.h"
 
 static struct kmem_cache *extent_state_cache;
 static struct kmem_cache *extent_buffer_cache;
@@ -1895,7 +1896,7 @@ int repair_io_failure(struct btrfs_mapping_tree *map_tree, u64 start,
         }
         bio->bi_bdev = dev->bdev;
         bio_add_page(bio, page, length, start-page_offset(page));
-        submit_bio(WRITE_SYNC, bio);
+        btrfsic_submit_bio(WRITE_SYNC, bio);
         wait_for_completion(&compl);
 
         if (!test_bit(BIO_UPTODATE, &bio->bi_flags)) {
@@ -2393,7 +2394,7 @@ static int submit_one_bio(int rw, struct bio *bio, int mirror_num,
                 ret = tree->ops->submit_bio_hook(page->mapping->host, rw, bio,
                                            mirror_num, bio_flags, start);
         else
-                submit_bio(rw, bio);
+                btrfsic_submit_bio(rw, bio);
 
         if (bio_flagged(bio, BIO_EOPNOTSUPP))
                 ret = -EOPNOTSUPP;
@@ -3579,6 +3580,7 @@ static struct extent_buffer *__alloc_extent_buffer(struct extent_io_tree *tree,
         atomic_set(&eb->blocking_writers, 0);
         atomic_set(&eb->spinning_readers, 0);
         atomic_set(&eb->spinning_writers, 0);
+        eb->lock_nested = 0;
         init_waitqueue_head(&eb->write_lock_wq);
         init_waitqueue_head(&eb->read_lock_wq);
 
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 7604c3001322..bc6a042cb6fc 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -129,6 +129,7 @@ struct extent_buffer {
         struct list_head leak_list;
         struct rcu_head rcu_head;
         atomic_t refs;
+        pid_t lock_owner;
 
         /* count of read lock holders on the extent buffer */
         atomic_t write_locks;
@@ -137,6 +138,7 @@ struct extent_buffer {
         atomic_t blocking_readers;
         atomic_t spinning_readers;
         atomic_t spinning_writers;
+        int lock_nested;
 
         /* protects write locks */
         rwlock_t lock;
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 034d98503229..859ba2dd8890 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -678,7 +678,7 @@ next_slot:
                                                 disk_bytenr, num_bytes, 0,
                                                 root->root_key.objectid,
                                                 new_key.objectid,
-                                                start - extent_offset);
+                                                start - extent_offset, 0);
                                 BUG_ON(ret);
                                 *hint_byte = disk_bytenr;
                         }
@@ -753,7 +753,7 @@ next_slot:
                                                 disk_bytenr, num_bytes, 0,
                                                 root->root_key.objectid,
                                                 key.objectid, key.offset -
-                                                extent_offset);
+                                                extent_offset, 0);
                                 BUG_ON(ret);
                                 inode_sub_bytes(inode,
                                                 extent_end - key.offset);
@@ -962,7 +962,7 @@ again:
 
                 ret = btrfs_inc_extent_ref(trans, root, bytenr, num_bytes, 0,
                                            root->root_key.objectid,
-                                           ino, orig_offset);
+                                           ino, orig_offset, 0);
                 BUG_ON(ret);
 
                 if (split == start) {
@@ -989,7 +989,7 @@ again:
                 del_nr++;
                 ret = btrfs_free_extent(trans, root, bytenr, num_bytes,
                                         0, root->root_key.objectid,
-                                        ino, orig_offset);
+                                        ino, orig_offset, 0);
                 BUG_ON(ret);
         }
         other_start = 0;
@@ -1006,7 +1006,7 @@ again:
                 del_nr++;
                 ret = btrfs_free_extent(trans, root, bytenr, num_bytes,
                                         0, root->root_key.objectid,
-                                        ino, orig_offset);
+                                        ino, orig_offset, 0);
                 BUG_ON(ret);
         }
         if (del_nr == 0) {
@@ -1274,7 +1274,6 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file,
                                                    dirty_pages);
                 if (dirty_pages < (root->leafsize >> PAGE_CACHE_SHIFT) + 1)
                         btrfs_btree_balance_dirty(root, 1);
-                btrfs_throttle(root);
 
                 pos += copied;
                 num_written += copied;
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 9a897bf79538..d20ff87ca603 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -319,9 +319,11 @@ static void io_ctl_drop_pages(struct io_ctl *io_ctl)
         io_ctl_unmap_page(io_ctl);
 
         for (i = 0; i < io_ctl->num_pages; i++) {
-                ClearPageChecked(io_ctl->pages[i]);
-                unlock_page(io_ctl->pages[i]);
-                page_cache_release(io_ctl->pages[i]);
+                if (io_ctl->pages[i]) {
+                        ClearPageChecked(io_ctl->pages[i]);
+                        unlock_page(io_ctl->pages[i]);
+                        page_cache_release(io_ctl->pages[i]);
+                }
         }
 }
 
@@ -635,7 +637,10 @@ int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
         if (!num_entries)
                 return 0;
 
-        io_ctl_init(&io_ctl, inode, root);
+        ret = io_ctl_init(&io_ctl, inode, root);
+        if (ret)
+                return ret;
+
         ret = readahead_cache(inode);
         if (ret)
                 goto out;
@@ -838,7 +843,7 @@ int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,
         struct io_ctl io_ctl;
         struct list_head bitmap_list;
         struct btrfs_key key;
-        u64 start, end, len;
+        u64 start, extent_start, extent_end, len;
         int entries = 0;
         int bitmaps = 0;
         int ret;
@@ -849,7 +854,9 @@ int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,
         if (!i_size_read(inode))
                 return -1;
 
-        io_ctl_init(&io_ctl, inode, root);
+        ret = io_ctl_init(&io_ctl, inode, root);
+        if (ret)
+                return -1;
 
         /* Get the cluster for this block_group if it exists */
         if (block_group && !list_empty(&block_group->cluster_list))
@@ -857,25 +864,12 @@ int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,
                                      struct btrfs_free_cluster,
                                      block_group_list);
 
-        /*
-         * We shouldn't have switched the pinned extents yet so this is the
-         * right one
-         */
-        unpin = root->fs_info->pinned_extents;
-
         /* Lock all pages first so we can lock the extent safely. */
         io_ctl_prepare_pages(&io_ctl, inode, 0);
 
         lock_extent_bits(&BTRFS_I(inode)->io_tree, 0, i_size_read(inode) - 1,
                          0, &cached_state, GFP_NOFS);
 
-        /*
-         * When searching for pinned extents, we need to start at our start
-         * offset.
-         */
-        if (block_group)
-                start = block_group->key.objectid;
-
         node = rb_first(&ctl->free_space_offset);
         if (!node && cluster) {
                 node = rb_first(&cluster->root);
@@ -918,9 +912,20 @@ int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,
          * We want to add any pinned extents to our free space cache
          * so we don't leak the space
          */
+
+        /*
+         * We shouldn't have switched the pinned extents yet so this is the
+         * right one
+         */
+        unpin = root->fs_info->pinned_extents;
+
+        if (block_group)
+                start = block_group->key.objectid;
+
         while (block_group && (start < block_group->key.objectid +
                                block_group->key.offset)) {
-                ret = find_first_extent_bit(unpin, start, &start, &end,
+                ret = find_first_extent_bit(unpin, start,
+                                            &extent_start, &extent_end,
                                             EXTENT_DIRTY);
                 if (ret) {
                         ret = 0;
@@ -928,20 +933,21 @@ int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,
                 }
 
                 /* This pinned extent is out of our range */
-                if (start >= block_group->key.objectid +
+                if (extent_start >= block_group->key.objectid +
                     block_group->key.offset)
                         break;
 
-                len = block_group->key.objectid +
-                        block_group->key.offset - start;
-                len = min(len, end + 1 - start);
+                extent_start = max(extent_start, start);
+                extent_end = min(block_group->key.objectid +
+                                 block_group->key.offset, extent_end + 1);
+                len = extent_end - extent_start;
 
                 entries++;
-                ret = io_ctl_add_entry(&io_ctl, start, len, NULL);
+                ret = io_ctl_add_entry(&io_ctl, extent_start, len, NULL);
                 if (ret)
                         goto out_nospc;
 
-                start = end + 1;
+                start = extent_end;
         }
 
         /* Write out the bitmaps */
@@ -2283,23 +2289,23 @@ out:
 static int btrfs_bitmap_cluster(struct btrfs_block_group_cache *block_group,
                                 struct btrfs_free_space *entry,
                                 struct btrfs_free_cluster *cluster,
-                                u64 offset, u64 bytes, u64 min_bytes)
+                                u64 offset, u64 bytes,
+                                u64 cont1_bytes, u64 min_bytes)
 {
         struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
         unsigned long next_zero;
         unsigned long i;
-        unsigned long search_bits;
-        unsigned long total_bits;
+        unsigned long want_bits;
+        unsigned long min_bits;
         unsigned long found_bits;
         unsigned long start = 0;
         unsigned long total_found = 0;
         int ret;
-        bool found = false;
 
         i = offset_to_bit(entry->offset, block_group->sectorsize,
                           max_t(u64, offset, entry->offset));
-        search_bits = bytes_to_bits(bytes, block_group->sectorsize);
-        total_bits = bytes_to_bits(min_bytes, block_group->sectorsize);
+        want_bits = bytes_to_bits(bytes, block_group->sectorsize);
+        min_bits = bytes_to_bits(min_bytes, block_group->sectorsize);
 
 again:
         found_bits = 0;
@@ -2308,7 +2314,7 @@ again:
              i = find_next_bit(entry->bitmap, BITS_PER_BITMAP, i + 1)) {
                 next_zero = find_next_zero_bit(entry->bitmap,
                                                BITS_PER_BITMAP, i);
-                if (next_zero - i >= search_bits) {
+                if (next_zero - i >= min_bits) {
                         found_bits = next_zero - i;
                         break;
                 }
@@ -2318,10 +2324,9 @@ again:
         if (!found_bits)
                 return -ENOSPC;
 
-        if (!found) {
+        if (!total_found) {
                 start = i;
                 cluster->max_size = 0;
-                found = true;
         }
 
         total_found += found_bits;
@@ -2329,13 +2334,8 @@ again:
         if (cluster->max_size < found_bits * block_group->sectorsize)
                 cluster->max_size = found_bits * block_group->sectorsize;
 
-        if (total_found < total_bits) {
-                i = find_next_bit(entry->bitmap, BITS_PER_BITMAP, next_zero);
-                if (i - start > total_bits * 2) {
-                        total_found = 0;
-                        cluster->max_size = 0;
-                        found = false;
-                }
+        if (total_found < want_bits || cluster->max_size < cont1_bytes) {
+                i = next_zero + 1;
                 goto again;
         }
 
@@ -2346,28 +2346,31 @@ again:
                                  &entry->offset_index, 1);
         BUG_ON(ret);
 
+        trace_btrfs_setup_cluster(block_group, cluster,
+                                  total_found * block_group->sectorsize, 1);
         return 0;
 }
 
 /*
  * This searches the block group for just extents to fill the cluster with.
+ * Try to find a cluster with at least bytes total bytes, at least one
+ * extent of cont1_bytes, and other clusters of at least min_bytes.
  */
 static noinline int
 setup_cluster_no_bitmap(struct btrfs_block_group_cache *block_group,
                         struct btrfs_free_cluster *cluster,
                         struct list_head *bitmaps, u64 offset, u64 bytes,
-                        u64 min_bytes)
+                        u64 cont1_bytes, u64 min_bytes)
 {
         struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
         struct btrfs_free_space *first = NULL;
         struct btrfs_free_space *entry = NULL;
-        struct btrfs_free_space *prev = NULL;
         struct btrfs_free_space *last;
         struct rb_node *node;
         u64 window_start;
         u64 window_free;
         u64 max_extent;
-        u64 max_gap = 128 * 1024;
+        u64 total_size = 0;
 
         entry = tree_search_offset(ctl, offset, 0, 1);
         if (!entry)
@@ -2377,8 +2380,8 @@ setup_cluster_no_bitmap(struct btrfs_block_group_cache *block_group,
          * We don't want bitmaps, so just move along until we find a normal
          * extent entry.
          */
-        while (entry->bitmap) {
-                if (list_empty(&entry->list))
+        while (entry->bitmap || entry->bytes < min_bytes) {
+                if (entry->bitmap && list_empty(&entry->list))
                         list_add_tail(&entry->list, bitmaps);
                 node = rb_next(&entry->offset_index);
                 if (!node)
@@ -2391,12 +2394,9 @@ setup_cluster_no_bitmap(struct btrfs_block_group_cache *block_group,
         max_extent = entry->bytes;
         first = entry;
         last = entry;
-        prev = entry;
 
-        while (window_free <= min_bytes) {
-                node = rb_next(&entry->offset_index);
-                if (!node)
-                        return -ENOSPC;
+        for (node = rb_next(&entry->offset_index); node;
+             node = rb_next(&entry->offset_index)) {
                 entry = rb_entry(node, struct btrfs_free_space, offset_index);
 
                 if (entry->bitmap) {
@@ -2405,26 +2405,18 @@ setup_cluster_no_bitmap(struct btrfs_block_group_cache *block_group,
                         continue;
                 }
 
-                /*
-                 * we haven't filled the empty size and the window is
-                 * very large.  reset and try again
-                 */
-                if (entry->offset - (prev->offset + prev->bytes) > max_gap ||
-                    entry->offset - window_start > (min_bytes * 2)) {
-                        first = entry;
-                        window_start = entry->offset;
-                        window_free = entry->bytes;
-                        last = entry;
+                if (entry->bytes < min_bytes)
+                        continue;
+
+                last = entry;
+                window_free += entry->bytes;
+                if (entry->bytes > max_extent)
                         max_extent = entry->bytes;
-                } else {
-                        last = entry;
-                        window_free += entry->bytes;
-                        if (entry->bytes > max_extent)
-                                max_extent = entry->bytes;
-                }
-                prev = entry;
         }
 
+        if (window_free < bytes || max_extent < cont1_bytes)
+                return -ENOSPC;
+
         cluster->window_start = first->offset;
 
         node = &first->offset_index;
@@ -2438,17 +2430,18 @@ setup_cluster_no_bitmap(struct btrfs_block_group_cache *block_group,
 
                 entry = rb_entry(node, struct btrfs_free_space, offset_index);
                 node = rb_next(&entry->offset_index);
-                if (entry->bitmap)
+                if (entry->bitmap || entry->bytes < min_bytes)
                         continue;
 
                 rb_erase(&entry->offset_index, &ctl->free_space_offset);
                 ret = tree_insert_offset(&cluster->root, entry->offset,
                                          &entry->offset_index, 0);
+                total_size += entry->bytes;
                 BUG_ON(ret);
         } while (node && entry != last);
 
         cluster->max_size = max_extent;
-
+        trace_btrfs_setup_cluster(block_group, cluster, total_size, 0);
         return 0;
 }
 
@@ -2460,7 +2453,7 @@ static noinline int
 setup_cluster_bitmap(struct btrfs_block_group_cache *block_group,
                      struct btrfs_free_cluster *cluster,
                      struct list_head *bitmaps, u64 offset, u64 bytes,
-                     u64 min_bytes)
+                     u64 cont1_bytes, u64 min_bytes)
 {
         struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
         struct btrfs_free_space *entry;
@@ -2485,7 +2478,7 @@ setup_cluster_bitmap(struct btrfs_block_group_cache *block_group,
                 if (entry->bytes < min_bytes)
                         continue;
                 ret = btrfs_bitmap_cluster(block_group, entry, cluster, offset,
-                                           bytes, min_bytes);
+                                           bytes, cont1_bytes, min_bytes);
                 if (!ret)
                         return 0;
         }
@@ -2499,7 +2492,7 @@ setup_cluster_bitmap(struct btrfs_block_group_cache *block_group,
 
 /*
  * here we try to find a cluster of blocks in a block group.  The goal
- * is to find at least bytes free and up to empty_size + bytes free.
+ * is to find at least bytes+empty_size.
  * We might not find them all in one contiguous area.
  *
  * returns zero and sets up cluster if things worked out, otherwise
@@ -2515,23 +2508,24 @@ int btrfs_find_space_cluster(struct btrfs_trans_handle *trans,
         struct btrfs_free_space *entry, *tmp;
         LIST_HEAD(bitmaps);
         u64 min_bytes;
+        u64 cont1_bytes;
         int ret;
 
-        /* for metadata, allow allocates with more holes */
+        /*
+         * Choose the minimum extent size we'll require for this
+         * cluster.  For SSD_SPREAD, don't allow any fragmentation.
+         * For metadata, allow allocates with smaller extents.  For
+         * data, keep it dense.
+         */
         if (btrfs_test_opt(root, SSD_SPREAD)) {
-                min_bytes = bytes + empty_size;
+                cont1_bytes = min_bytes = bytes + empty_size;
         } else if (block_group->flags & BTRFS_BLOCK_GROUP_METADATA) {
-                /*
-                 * we want to do larger allocations when we are
-                 * flushing out the delayed refs, it helps prevent
-                 * making more work as we go along.
-                 */
-                if (trans->transaction->delayed_refs.flushing)
-                        min_bytes = max(bytes, (bytes + empty_size) >> 1);
-                else
-                        min_bytes = max(bytes, (bytes + empty_size) >> 4);
-        } else
-                min_bytes = max(bytes, (bytes + empty_size) >> 2);
+                cont1_bytes = bytes;
+                min_bytes = block_group->sectorsize;
+        } else {
+                cont1_bytes = max(bytes, (bytes + empty_size) >> 2);
+                min_bytes = block_group->sectorsize;
+        }
 
         spin_lock(&ctl->tree_lock);
 
@@ -2539,7 +2533,7 @@ int btrfs_find_space_cluster(struct btrfs_trans_handle *trans,
          * If we know we don't have enough space to make a cluster don't even
          * bother doing all the work to try and find one.
          */
-        if (ctl->free_space < min_bytes) {
+        if (ctl->free_space < bytes) {
                 spin_unlock(&ctl->tree_lock);
                 return -ENOSPC;
         }
@@ -2552,11 +2546,17 @@ int btrfs_find_space_cluster(struct btrfs_trans_handle *trans,
                 goto out;
         }
 
+        trace_btrfs_find_cluster(block_group, offset, bytes, empty_size,
+                                 min_bytes);
+
+        INIT_LIST_HEAD(&bitmaps);
         ret = setup_cluster_no_bitmap(block_group, cluster, &bitmaps, offset,
-                                      bytes, min_bytes);
+                                      bytes + empty_size,
+                                      cont1_bytes, min_bytes);
         if (ret)
                 ret = setup_cluster_bitmap(block_group, cluster, &bitmaps,
-                                           offset, bytes, min_bytes);
+                                           offset, bytes + empty_size,
+                                           cont1_bytes, min_bytes);
 
         /* Clear our temporary list */
         list_for_each_entry_safe(entry, tmp, &bitmaps, list)
@@ -2567,6 +2567,8 @@ int btrfs_find_space_cluster(struct btrfs_trans_handle *trans,
                 list_add_tail(&cluster->block_group_list,
                               &block_group->cluster_list);
                 cluster->block_group = block_group;
+        } else {
+                trace_btrfs_failed_cluster_setup(block_group);
         }
 out:
         spin_unlock(&cluster->lock);
@@ -2588,17 +2590,57 @@ void btrfs_init_free_cluster(struct btrfs_free_cluster *cluster)
         cluster->block_group = NULL;
 }
 
-int btrfs_trim_block_group(struct btrfs_block_group_cache *block_group,
-                           u64 *trimmed, u64 start, u64 end, u64 minlen)
+static int do_trimming(struct btrfs_block_group_cache *block_group,
+                       u64 *total_trimmed, u64 start, u64 bytes,
+                       u64 reserved_start, u64 reserved_bytes)
 {
-        struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
-        struct btrfs_free_space *entry = NULL;
+        struct btrfs_space_info *space_info = block_group->space_info;
         struct btrfs_fs_info *fs_info = block_group->fs_info;
-        u64 bytes = 0;
-        u64 actually_trimmed;
-        int ret = 0;
+        int ret;
+        int update = 0;
+        u64 trimmed = 0;
 
-        *trimmed = 0;
+        spin_lock(&space_info->lock);
+        spin_lock(&block_group->lock);
+        if (!block_group->ro) {
+                block_group->reserved += reserved_bytes;
+                space_info->bytes_reserved += reserved_bytes;
+                update = 1;
+        }
+        spin_unlock(&block_group->lock);
+        spin_unlock(&space_info->lock);
+
+        ret = btrfs_error_discard_extent(fs_info->extent_root,
+                                         start, bytes, &trimmed);
+        if (!ret)
+                *total_trimmed += trimmed;
+
+        btrfs_add_free_space(block_group, reserved_start, reserved_bytes);
+
+        if (update) {
+                spin_lock(&space_info->lock);
+                spin_lock(&block_group->lock);
+                if (block_group->ro)
+                        space_info->bytes_readonly += reserved_bytes;
+                block_group->reserved -= reserved_bytes;
+                space_info->bytes_reserved -= reserved_bytes;
+                spin_unlock(&space_info->lock);
+                spin_unlock(&block_group->lock);
+        }
+
+        return ret;
+}
+
+static int trim_no_bitmap(struct btrfs_block_group_cache *block_group,
+                          u64 *total_trimmed, u64 start, u64 end, u64 minlen)
+{
+        struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
+        struct btrfs_free_space *entry;
+        struct rb_node *node;
+        int ret = 0;
+        u64 extent_start;
+        u64 extent_bytes;
+        u64 bytes;
 
         while (start < end) {
                 spin_lock(&ctl->tree_lock);
@@ -2609,81 +2651,118 @@ int btrfs_trim_block_group(struct btrfs_block_group_cache *block_group,
                 }
 
                 entry = tree_search_offset(ctl, start, 0, 1);
-                if (!entry)
-                        entry = tree_search_offset(ctl,
-                                                   offset_to_bitmap(ctl, start),
-                                                   1, 1);
-
-                if (!entry || entry->offset >= end) {
+                if (!entry) {
                         spin_unlock(&ctl->tree_lock);
                         break;
                 }
 
-                if (entry->bitmap) {
-                        ret = search_bitmap(ctl, entry, &start, &bytes);
-                        if (!ret) {
-                                if (start >= end) {
-                                        spin_unlock(&ctl->tree_lock);
-                                        break;
-                                }
-                                bytes = min(bytes, end - start);
-                                bitmap_clear_bits(ctl, entry, start, bytes);
-                                if (entry->bytes == 0)
-                                        free_bitmap(ctl, entry);
-                        } else {
-                                start = entry->offset + BITS_PER_BITMAP *
-                                        block_group->sectorsize;
+                /* skip bitmaps */
+                while (entry->bitmap) {
+                        node = rb_next(&entry->offset_index);
+                        if (!node) {
                                 spin_unlock(&ctl->tree_lock);
-                                ret = 0;
-                                continue;
+                                goto out;
                         }
-                } else {
-                        start = entry->offset;
-                        bytes = min(entry->bytes, end - start);
-                        unlink_free_space(ctl, entry);
-                        kmem_cache_free(btrfs_free_space_cachep, entry);
+                        entry = rb_entry(node, struct btrfs_free_space,
+                                         offset_index);
                 }
 
+                if (entry->offset >= end) {
+                        spin_unlock(&ctl->tree_lock);
+                        break;
+                }
+
+                extent_start = entry->offset;
+                extent_bytes = entry->bytes;
+                start = max(start, extent_start);
+                bytes = min(extent_start + extent_bytes, end) - start;
+                if (bytes < minlen) {
+                        spin_unlock(&ctl->tree_lock);
+                        goto next;
+                }
+
+                unlink_free_space(ctl, entry);
+                kmem_cache_free(btrfs_free_space_cachep, entry);
+
                 spin_unlock(&ctl->tree_lock);
 
-                if (bytes >= minlen) {
-                        struct btrfs_space_info *space_info;
-                        int update = 0;
-
-                        space_info = block_group->space_info;
-                        spin_lock(&space_info->lock);
-                        spin_lock(&block_group->lock);
-                        if (!block_group->ro) {
-                                block_group->reserved += bytes;
-                                space_info->bytes_reserved += bytes;
-                                update = 1;
-                        }
-                        spin_unlock(&block_group->lock);
-                        spin_unlock(&space_info->lock);
-
-                        ret = btrfs_error_discard_extent(fs_info->extent_root,
-                                                         start,
-                                                         bytes,
-                                                         &actually_trimmed);
-
-                        btrfs_add_free_space(block_group, start, bytes);
-                        if (update) {
-                                spin_lock(&space_info->lock);
-                                spin_lock(&block_group->lock);
-                                if (block_group->ro)
-                                        space_info->bytes_readonly += bytes;
-                                block_group->reserved -= bytes;
-                                space_info->bytes_reserved -= bytes;
-                                spin_unlock(&space_info->lock);
-                                spin_unlock(&block_group->lock);
-                        }
+                ret = do_trimming(block_group, total_trimmed, start, bytes,
+                                  extent_start, extent_bytes);
+                if (ret)
+                        break;
+next:
+                start += bytes;
 
-                        if (ret)
-                                break;
-                        *trimmed += actually_trimmed;
+                if (fatal_signal_pending(current)) {
+                        ret = -ERESTARTSYS;
+                        break;
+                }
+
+                cond_resched();
+        }
+out:
+        return ret;
+}
+
+static int trim_bitmaps(struct btrfs_block_group_cache *block_group,
+                        u64 *total_trimmed, u64 start, u64 end, u64 minlen)
+{
+        struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
+        struct btrfs_free_space *entry;
+        int ret = 0;
+        int ret2;
+        u64 bytes;
+        u64 offset = offset_to_bitmap(ctl, start);
+
+        while (offset < end) {
+                bool next_bitmap = false;
+
+                spin_lock(&ctl->tree_lock);
+
+                if (ctl->free_space < minlen) {
+                        spin_unlock(&ctl->tree_lock);
+                        break;
+                }
+
+                entry = tree_search_offset(ctl, offset, 1, 0);
+                if (!entry) {
+                        spin_unlock(&ctl->tree_lock);
+                        next_bitmap = true;
+                        goto next;
+                }
+
+                bytes = minlen;
+                ret2 = search_bitmap(ctl, entry, &start, &bytes);
+                if (ret2 || start >= end) {
+                        spin_unlock(&ctl->tree_lock);
+                        next_bitmap = true;
+                        goto next;
+                }
+
+                bytes = min(bytes, end - start);
+                if (bytes < minlen) {
+                        spin_unlock(&ctl->tree_lock);
+                        goto next;
+                }
+
+                bitmap_clear_bits(ctl, entry, start, bytes);
+                if (entry->bytes == 0)
+                        free_bitmap(ctl, entry);
+
+                spin_unlock(&ctl->tree_lock);
+
+                ret = do_trimming(block_group, total_trimmed, start, bytes,
+                                  start, bytes);
+                if (ret)
+                        break;
+next:
+                if (next_bitmap) {
+                        offset += BITS_PER_BITMAP * ctl->unit;
+                } else {
+                        start += bytes;
+                        if (start >= offset + BITS_PER_BITMAP * ctl->unit)
+                                offset += BITS_PER_BITMAP * ctl->unit;
                 }
-                start += bytes;
-                bytes = 0;
 
                 if (fatal_signal_pending(current)) {
                         ret = -ERESTARTSYS;
@@ -2696,6 +2775,22 @@ int btrfs_trim_block_group(struct btrfs_block_group_cache *block_group,
         return ret;
 }
 
+int btrfs_trim_block_group(struct btrfs_block_group_cache *block_group,
+                           u64 *trimmed, u64 start, u64 end, u64 minlen)
+{
+        int ret;
+
+        *trimmed = 0;
+
+        ret = trim_no_bitmap(block_group, trimmed, start, end, minlen);
+        if (ret)
+                return ret;
+
+        ret = trim_bitmaps(block_group, trimmed, start, end, minlen);
+
+        return ret;
+}
+
 /*
  * Find the left-most item in the cache tree, and then return the
  * smallest inode number in the item.
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index f8962a957d65..213ffa86ce1b 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -438,6 +438,8 @@ int btrfs_save_ino_cache(struct btrfs_root *root,
                                           trans->bytes_reserved);
         if (ret)
                 goto out;
+        trace_btrfs_space_reservation(root->fs_info, "ino_cache", (u64)trans,
+                                      trans->bytes_reserved, 1);
 again:
         inode = lookup_free_ino_inode(root, path);
         if (IS_ERR(inode) && PTR_ERR(inode) != -ENOENT) {
@@ -498,6 +500,8 @@ again:
 out_put:
         iput(inode);
 out_release:
+        trace_btrfs_space_reservation(root->fs_info, "ino_cache", (u64)trans,
+                                      trans->bytes_reserved, 0);
         btrfs_block_rsv_release(root, trans->block_rsv, trans->bytes_reserved);
 out:
         trans->block_rsv = rsv;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 81b235a61f8c..0da19a0ea00d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1951,12 +1951,28 @@ enum btrfs_orphan_cleanup_state {
 void btrfs_orphan_commit_root(struct btrfs_trans_handle *trans,
                               struct btrfs_root *root)
 {
+        struct btrfs_block_rsv *block_rsv;
         int ret;
 
         if (!list_empty(&root->orphan_list) ||
             root->orphan_cleanup_state != ORPHAN_CLEANUP_DONE)
                 return;
 
+        spin_lock(&root->orphan_lock);
+        if (!list_empty(&root->orphan_list)) {
+                spin_unlock(&root->orphan_lock);
+                return;
+        }
+
+        if (root->orphan_cleanup_state != ORPHAN_CLEANUP_DONE) {
+                spin_unlock(&root->orphan_lock);
+                return;
+        }
+
+        block_rsv = root->orphan_block_rsv;
+        root->orphan_block_rsv = NULL;
+        spin_unlock(&root->orphan_lock);
+
         if (root->orphan_item_inserted &&
             btrfs_root_refs(&root->root_item) > 0) {
                 ret = btrfs_del_orphan_item(trans, root->fs_info->tree_root,
@@ -1965,10 +1981,9 @@ void btrfs_orphan_commit_root(struct btrfs_trans_handle *trans,
                 root->orphan_item_inserted = 0;
         }
 
-        if (root->orphan_block_rsv) {
-                WARN_ON(root->orphan_block_rsv->size > 0);
-                btrfs_free_block_rsv(root, root->orphan_block_rsv);
-                root->orphan_block_rsv = NULL;
+        if (block_rsv) {
+                WARN_ON(block_rsv->size > 0);
+                btrfs_free_block_rsv(root, block_rsv);
         }
 }
 
@@ -2224,14 +2239,7 @@ int btrfs_orphan_cleanup(struct btrfs_root *root)
                                 continue;
                         }
                         nr_truncate++;
-                        /*
-                         * Need to hold the imutex for reservation purposes, not
-                         * a huge deal here but I have a WARN_ON in
-                         * btrfs_delalloc_reserve_space to catch offenders.
-                         */
-                        mutex_lock(&inode->i_mutex);
                         ret = btrfs_truncate(inode);
-                        mutex_unlock(&inode->i_mutex);
                 } else {
                         nr_unlink++;
                 }
@@ -2845,7 +2853,7 @@ static void __unlink_end_trans(struct btrfs_trans_handle *trans,
                 BUG_ON(!root->fs_info->enospc_unlink);
                 root->fs_info->enospc_unlink = 0;
         }
-        btrfs_end_transaction_throttle(trans, root);
+        btrfs_end_transaction(trans, root);
 }
 
 static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
@@ -3009,7 +3017,6 @@ int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
         int pending_del_nr = 0;
         int pending_del_slot = 0;
         int extent_type = -1;
-        int encoding;
         int ret;
         int err = 0;
         u64 ino = btrfs_ino(inode);
@@ -3059,7 +3066,6 @@ search_again:
                 leaf = path->nodes[0];
                 btrfs_item_key_to_cpu(leaf, &found_key, path->slots[0]);
                 found_type = btrfs_key_type(&found_key);
-                encoding = 0;
 
                 if (found_key.objectid != ino)
                         break;
@@ -3072,10 +3078,6 @@ search_again:
                         fi = btrfs_item_ptr(leaf, path->slots[0],
                                             struct btrfs_file_extent_item);
                         extent_type = btrfs_file_extent_type(leaf, fi);
-                        encoding = btrfs_file_extent_compression(leaf, fi);
-                        encoding |= btrfs_file_extent_encryption(leaf, fi);
-                        encoding |= btrfs_file_extent_other_encoding(leaf, fi);
-
                         if (extent_type != BTRFS_FILE_EXTENT_INLINE) {
                                 item_end +=
                                     btrfs_file_extent_num_bytes(leaf, fi);
@@ -3103,7 +3105,7 @@ search_again:
                 if (extent_type != BTRFS_FILE_EXTENT_INLINE) {
                         u64 num_dec;
                         extent_start = btrfs_file_extent_disk_bytenr(leaf, fi);
-                        if (!del_item && !encoding) {
+                        if (!del_item) {
                                 u64 orig_num_bytes =
                                         btrfs_file_extent_num_bytes(leaf, fi);
                                 extent_num_bytes = new_size -
@@ -3179,7 +3181,7 @@ delete:
                         ret = btrfs_free_extent(trans, root, extent_start,
                                                 extent_num_bytes, 0,
                                                 btrfs_header_owner(leaf),
-                                                ino, extent_offset);
+                                                ino, extent_offset, 0);
                         BUG_ON(ret);
                 }
 
@@ -3434,7 +3436,7 @@ static int btrfs_setsize(struct inode *inode, loff_t newsize)
                 i_size_write(inode, newsize);
                 btrfs_ordered_update_i_size(inode, i_size_read(inode), NULL);
                 ret = btrfs_update_inode(trans, root, inode);
-                btrfs_end_transaction_throttle(trans, root);
+                btrfs_end_transaction(trans, root);
         } else {
 
                 /*
@@ -4655,7 +4657,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
         }
 out_unlock:
         nr = trans->blocks_used;
-        btrfs_end_transaction_throttle(trans, root);
+        btrfs_end_transaction(trans, root);
         btrfs_btree_balance_dirty(root, nr);
         if (drop_inode) {
                 inode_dec_link_count(inode);
@@ -4723,7 +4725,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
         }
 out_unlock:
         nr = trans->blocks_used;
-        btrfs_end_transaction_throttle(trans, root);
+        btrfs_end_transaction(trans, root);
         if (drop_inode) {
                 inode_dec_link_count(inode);
                 iput(inode);
@@ -4782,7 +4784,7 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
         }
 
         nr = trans->blocks_used;
-        btrfs_end_transaction_throttle(trans, root);
+        btrfs_end_transaction(trans, root);
 fail:
         if (drop_inode) {
                 inode_dec_link_count(inode);
@@ -4848,7 +4850,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
 
 out_fail:
         nr = trans->blocks_used;
-        btrfs_end_transaction_throttle(trans, root);
+        btrfs_end_transaction(trans, root);
         if (drop_on_err)
                 iput(inode);
         btrfs_btree_balance_dirty(root, nr);
@@ -5121,7 +5123,7 @@ again:
                         }
                         flush_dcache_page(page);
                 } else if (create && PageUptodate(page)) {
-                        WARN_ON(1);
+                        BUG();
                         if (!trans) {
                                 kunmap(page);
                                 free_extent_map(em);
@@ -6402,10 +6404,7 @@ int btrfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
         u64 page_start;
         u64 page_end;
 
-        /* Need this to keep space reservations serialized */
-        mutex_lock(&inode->i_mutex);
         ret  = btrfs_delalloc_reserve_space(inode, PAGE_CACHE_SIZE);
-        mutex_unlock(&inode->i_mutex);
         if (!ret)
                 ret = btrfs_update_time(vma->vm_file);
         if (ret) {
@@ -6494,8 +6493,8 @@ out_unlock:
         if (!ret)
                 return VM_FAULT_LOCKED;
         unlock_page(page);
-        btrfs_delalloc_release_space(inode, PAGE_CACHE_SIZE);
 out:
+        btrfs_delalloc_release_space(inode, PAGE_CACHE_SIZE);
         return ret;
 }
 
@@ -6668,7 +6667,7 @@ end_trans:
                         err = ret;
 
                 nr = trans->blocks_used;
-                ret = btrfs_end_transaction_throttle(trans, root);
+                ret = btrfs_end_transaction(trans, root);
                 btrfs_btree_balance_dirty(root, nr);
         }
 
@@ -6749,6 +6748,7 @@ struct inode *btrfs_alloc_inode(struct super_block *sb)
         extent_io_tree_init(&ei->io_tree, &inode->i_data);
         extent_io_tree_init(&ei->io_failure_tree, &inode->i_data);
         mutex_init(&ei->log_mutex);
+        mutex_init(&ei->delalloc_mutex);
         btrfs_ordered_inode_tree_init(&ei->ordered_tree);
         INIT_LIST_HEAD(&ei->i_orphan);
         INIT_LIST_HEAD(&ei->delalloc_inodes);
@@ -7074,7 +7074,7 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 btrfs_end_log_trans(root);
         }
 out_fail:
-        btrfs_end_transaction_throttle(trans, root);
+        btrfs_end_transaction(trans, root);
 out_notrans:
         if (old_ino == BTRFS_FIRST_FREE_OBJECTID)
                 up_read(&root->fs_info->subvol_sem);
@@ -7246,7 +7246,7 @@ out_unlock:
         if (!err)
                 d_instantiate(dentry, inode);
         nr = trans->blocks_used;
-        btrfs_end_transaction_throttle(trans, root);
+        btrfs_end_transaction(trans, root);
         if (drop_inode) {
                 inode_dec_link_count(inode);
                 iput(inode);
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 5441ff1480fd..ab620014bcc3 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -176,6 +176,8 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg)
         struct btrfs_trans_handle *trans;
         unsigned int flags, oldflags;
         int ret;
+        u64 ip_oldflags;
+        unsigned int i_oldflags;
 
         if (btrfs_root_readonly(root))
                 return -EROFS;
@@ -192,6 +194,9 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg)
 
         mutex_lock(&inode->i_mutex);
 
+        ip_oldflags = ip->flags;
+        i_oldflags = inode->i_flags;
+
         flags = btrfs_mask_flags(inode->i_mode, flags);
         oldflags = btrfs_flags_to_ioctl(ip->flags);
         if ((flags ^ oldflags) & (FS_APPEND_FL | FS_IMMUTABLE_FL)) {
@@ -249,19 +254,24 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg)
                 ip->flags &= ~(BTRFS_INODE_COMPRESS | BTRFS_INODE_NOCOMPRESS);
         }
 
-        trans = btrfs_join_transaction(root);
-        BUG_ON(IS_ERR(trans));
+        trans = btrfs_start_transaction(root, 1);
+        if (IS_ERR(trans)) {
+                ret = PTR_ERR(trans);
+                goto out_drop;
+        }
 
         btrfs_update_iflags(inode);
         inode->i_ctime = CURRENT_TIME;
         ret = btrfs_update_inode(trans, root, inode);
-        BUG_ON(ret);
 
         btrfs_end_transaction(trans, root);
+ out_drop:
+        if (ret) {
+                ip->flags = ip_oldflags;
+                inode->i_flags = i_oldflags;
+        }
 
         mnt_drop_write_file(file);
-
-        ret = 0;
  out_unlock:
         mutex_unlock(&inode->i_mutex);
         return ret;
@@ -276,14 +286,13 @@ static int btrfs_ioctl_getversion(struct file *file, int __user *arg)
 
 static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
 {
-        struct btrfs_root *root = fdentry(file)->d_sb->s_fs_info;
-        struct btrfs_fs_info *fs_info = root->fs_info;
+        struct btrfs_fs_info *fs_info = btrfs_sb(fdentry(file)->d_sb);
         struct btrfs_device *device;
         struct request_queue *q;
         struct fstrim_range range;
         u64 minlen = ULLONG_MAX;
         u64 num_devices = 0;
-        u64 total_bytes = btrfs_super_total_bytes(root->fs_info->super_copy);
+        u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
         int ret;
 
         if (!capable(CAP_SYS_ADMIN))
@@ -312,7 +321,7 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
 
         range.len = min(range.len, total_bytes - range.start);
         range.minlen = max(range.minlen, minlen);
-        ret = btrfs_trim_fs(root, &range);
+        ret = btrfs_trim_fs(fs_info->tree_root, &range);
         if (ret < 0)
                 return ret;
 
@@ -358,7 +367,7 @@ static noinline int create_subvol(struct btrfs_root *root,
                 return PTR_ERR(trans);
 
         leaf = btrfs_alloc_free_block(trans, root, root->leafsize,
-                                      0, objectid, NULL, 0, 0, 0);
+                                      0, objectid, NULL, 0, 0, 0, 0);
         if (IS_ERR(leaf)) {
                 ret = PTR_ERR(leaf);
                 goto fail;
@@ -858,10 +867,8 @@ static int cluster_pages_for_defrag(struct inode *inode,
                 return 0;
         file_end = (isize - 1) >> PAGE_CACHE_SHIFT;
 
-        mutex_lock(&inode->i_mutex);
         ret = btrfs_delalloc_reserve_space(inode,
                                            num_pages << PAGE_CACHE_SHIFT);
-        mutex_unlock(&inode->i_mutex);
         if (ret)
                 return ret;
 again:
@@ -1203,13 +1210,21 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        mutex_lock(&root->fs_info->volume_mutex);
+        if (root->fs_info->balance_ctl) {
+                printk(KERN_INFO "btrfs: balance in progress\n");
+                ret = -EINVAL;
+                goto out;
+        }
+
         vol_args = memdup_user(arg, sizeof(*vol_args));
-        if (IS_ERR(vol_args))
-                return PTR_ERR(vol_args);
+        if (IS_ERR(vol_args)) {
+                ret = PTR_ERR(vol_args);
+                goto out;
+        }
 
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
 
-        mutex_lock(&root->fs_info->volume_mutex);
         sizestr = vol_args->name;
         devstr = strchr(sizestr, ':');
         if (devstr) {
@@ -1226,7 +1241,7 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
                 printk(KERN_INFO "btrfs: resizer unable to find device %llu\n",
                        (unsigned long long)devid);
                 ret = -EINVAL;
-                goto out_unlock;
+                goto out_free;
         }
         if (!strcmp(sizestr, "max"))
                 new_size = device->bdev->bd_inode->i_size;
@@ -1241,7 +1256,7 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
                 new_size = memparse(sizestr, NULL);
                 if (new_size == 0) {
                         ret = -EINVAL;
-                        goto out_unlock;
+                        goto out_free;
                 }
         }
 
@@ -1250,7 +1265,7 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
         if (mod < 0) {
                 if (new_size > old_size) {
                         ret = -EINVAL;
-                        goto out_unlock;
+                        goto out_free;
                 }
                 new_size = old_size - new_size;
         } else if (mod > 0) {
@@ -1259,11 +1274,11 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
 
         if (new_size < 256 * 1024 * 1024) {
                 ret = -EINVAL;
-                goto out_unlock;
+                goto out_free;
         }
         if (new_size > device->bdev->bd_inode->i_size) {
                 ret = -EFBIG;
-                goto out_unlock;
+                goto out_free;
         }
 
         do_div(new_size, root->sectorsize);
@@ -1276,7 +1291,7 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
                 trans = btrfs_start_transaction(root, 0);
                 if (IS_ERR(trans)) {
                         ret = PTR_ERR(trans);
-                        goto out_unlock;
+                        goto out_free;
                 }
                 ret = btrfs_grow_device(trans, device, new_size);
                 btrfs_commit_transaction(trans, root);
@@ -1284,9 +1299,10 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
                 ret = btrfs_shrink_device(device, new_size);
         }
 
-out_unlock:
-        mutex_unlock(&root->fs_info->volume_mutex);
+out_free:
         kfree(vol_args);
+out:
+        mutex_unlock(&root->fs_info->volume_mutex);
         return ret;
 }
 
@@ -2052,14 +2068,25 @@ static long btrfs_ioctl_add_dev(struct btrfs_root *root, void __user *arg)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        mutex_lock(&root->fs_info->volume_mutex);
+        if (root->fs_info->balance_ctl) {
+                printk(KERN_INFO "btrfs: balance in progress\n");
+                ret = -EINVAL;
+                goto out;
+        }
+
         vol_args = memdup_user(arg, sizeof(*vol_args));
-        if (IS_ERR(vol_args))
-                return PTR_ERR(vol_args);
+        if (IS_ERR(vol_args)) {
+                ret = PTR_ERR(vol_args);
+                goto out;
+        }
 
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         ret = btrfs_init_new_device(root, vol_args->name);
 
         kfree(vol_args);
+out:
+        mutex_unlock(&root->fs_info->volume_mutex);
         return ret;
 }
 
@@ -2074,14 +2101,25 @@ static long btrfs_ioctl_rm_dev(struct btrfs_root *root, void __user *arg)
         if (root->fs_info->sb->s_flags & MS_RDONLY)
                 return -EROFS;
 
+        mutex_lock(&root->fs_info->volume_mutex);
+        if (root->fs_info->balance_ctl) {
+                printk(KERN_INFO "btrfs: balance in progress\n");
+                ret = -EINVAL;
+                goto out;
+        }
+
         vol_args = memdup_user(arg, sizeof(*vol_args));
-        if (IS_ERR(vol_args))
-                return PTR_ERR(vol_args);
+        if (IS_ERR(vol_args)) {
+                ret = PTR_ERR(vol_args);
+                goto out;
+        }
 
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         ret = btrfs_rm_device(root, vol_args->name);
 
         kfree(vol_args);
+out:
+        mutex_unlock(&root->fs_info->volume_mutex);
         return ret;
 }
 
@@ -2427,7 +2465,8 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                                                         disko, diskl, 0,
                                                         root->root_key.objectid,
                                                         btrfs_ino(inode),
-                                                        new_key.offset - datao);
+                                                        new_key.offset - datao,
+                                                        0);
                                         BUG_ON(ret);
                                 }
                         } else if (type == BTRFS_FILE_EXTENT_INLINE) {
@@ -2977,7 +3016,7 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_root *root,
 {
         int ret = 0;
         int size;
-        u64 extent_offset;
+        u64 extent_item_pos;
         struct btrfs_ioctl_logical_ino_args *loi;
         struct btrfs_data_container *inodes = NULL;
         struct btrfs_path *path = NULL;
@@ -3008,15 +3047,17 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_root *root,
         }
 
         ret = extent_from_logical(root->fs_info, loi->logical, path, &key);
+        btrfs_release_path(path);
 
         if (ret & BTRFS_EXTENT_FLAG_TREE_BLOCK)
                 ret = -ENOENT;
         if (ret < 0)
                 goto out;
 
-        extent_offset = loi->logical - key.objectid;
+        extent_item_pos = loi->logical - key.objectid;
         ret = iterate_extent_inodes(root->fs_info, path, key.objectid,
-                                        extent_offset, build_ino_list, inodes);
+                                        extent_item_pos, build_ino_list,
+                                        inodes);
 
         if (ret < 0)
                 goto out;
@@ -3034,6 +3075,163 @@ out:
         return ret;
 }
 
+void update_ioctl_balance_args(struct btrfs_fs_info *fs_info, int lock,
+                               struct btrfs_ioctl_balance_args *bargs)
+{
+        struct btrfs_balance_control *bctl = fs_info->balance_ctl;
+
+        bargs->flags = bctl->flags;
+
+        if (atomic_read(&fs_info->balance_running))
+                bargs->state |= BTRFS_BALANCE_STATE_RUNNING;
+        if (atomic_read(&fs_info->balance_pause_req))
+                bargs->state |= BTRFS_BALANCE_STATE_PAUSE_REQ;
+        if (atomic_read(&fs_info->balance_cancel_req))
+                bargs->state |= BTRFS_BALANCE_STATE_CANCEL_REQ;
+
+        memcpy(&bargs->data, &bctl->data, sizeof(bargs->data));
+        memcpy(&bargs->meta, &bctl->meta, sizeof(bargs->meta));
+        memcpy(&bargs->sys, &bctl->sys, sizeof(bargs->sys));
+
+        if (lock) {
+                spin_lock(&fs_info->balance_lock);
+                memcpy(&bargs->stat, &bctl->stat, sizeof(bargs->stat));
+                spin_unlock(&fs_info->balance_lock);
+        } else {
+                memcpy(&bargs->stat, &bctl->stat, sizeof(bargs->stat));
+        }
+}
+
+static long btrfs_ioctl_balance(struct btrfs_root *root, void __user *arg)
+{
+        struct btrfs_fs_info *fs_info = root->fs_info;
+        struct btrfs_ioctl_balance_args *bargs;
+        struct btrfs_balance_control *bctl;
+        int ret;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        if (fs_info->sb->s_flags & MS_RDONLY)
+                return -EROFS;
+
+        mutex_lock(&fs_info->volume_mutex);
+        mutex_lock(&fs_info->balance_mutex);
+
+        if (arg) {
+                bargs = memdup_user(arg, sizeof(*bargs));
+                if (IS_ERR(bargs)) {
+                        ret = PTR_ERR(bargs);
+                        goto out;
+                }
+
+                if (bargs->flags & BTRFS_BALANCE_RESUME) {
+                        if (!fs_info->balance_ctl) {
+                                ret = -ENOTCONN;
+                                goto out_bargs;
+                        }
+
+                        bctl = fs_info->balance_ctl;
+                        spin_lock(&fs_info->balance_lock);
+                        bctl->flags |= BTRFS_BALANCE_RESUME;
+                        spin_unlock(&fs_info->balance_lock);
+
+                        goto do_balance;
+                }
+        } else {
+                bargs = NULL;
+        }
+
+        if (fs_info->balance_ctl) {
+                ret = -EINPROGRESS;
+                goto out_bargs;
+        }
+
+        bctl = kzalloc(sizeof(*bctl), GFP_NOFS);
+        if (!bctl) {
+                ret = -ENOMEM;
+                goto out_bargs;
+        }
+
+        bctl->fs_info = fs_info;
+        if (arg) {
+                memcpy(&bctl->data, &bargs->data, sizeof(bctl->data));
+                memcpy(&bctl->meta, &bargs->meta, sizeof(bctl->meta));
+                memcpy(&bctl->sys, &bargs->sys, sizeof(bctl->sys));
+
+                bctl->flags = bargs->flags;
+        } else {
+                /* balance everything - no filters */
+                bctl->flags |= BTRFS_BALANCE_TYPE_MASK;
+        }
+
+do_balance:
+        ret = btrfs_balance(bctl, bargs);
+        /*
+         * bctl is freed in __cancel_balance or in free_fs_info if
+         * restriper was paused all the way until unmount
+         */
+        if (arg) {
+                if (copy_to_user(arg, bargs, sizeof(*bargs)))
+                        ret = -EFAULT;
+        }
+
+out_bargs:
+        kfree(bargs);
+out:
+        mutex_unlock(&fs_info->balance_mutex);
+        mutex_unlock(&fs_info->volume_mutex);
+        return ret;
+}
+
+static long btrfs_ioctl_balance_ctl(struct btrfs_root *root, int cmd)
+{
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        switch (cmd) {
+        case BTRFS_BALANCE_CTL_PAUSE:
+                return btrfs_pause_balance(root->fs_info);
+        case BTRFS_BALANCE_CTL_CANCEL:
+                return btrfs_cancel_balance(root->fs_info);
+        }
+
+        return -EINVAL;
+}
+
+static long btrfs_ioctl_balance_progress(struct btrfs_root *root,
+                                         void __user *arg)
+{
+        struct btrfs_fs_info *fs_info = root->fs_info;
+        struct btrfs_ioctl_balance_args *bargs;
+        int ret = 0;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        mutex_lock(&fs_info->balance_mutex);
+        if (!fs_info->balance_ctl) {
+                ret = -ENOTCONN;
+                goto out;
+        }
+
+        bargs = kzalloc(sizeof(*bargs), GFP_NOFS);
+        if (!bargs) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        update_ioctl_balance_args(fs_info, 1, bargs);
+
+        if (copy_to_user(arg, bargs, sizeof(*bargs)))
+                ret = -EFAULT;
+
+        kfree(bargs);
+out:
+        mutex_unlock(&fs_info->balance_mutex);
+        return ret;
+}
+
 long btrfs_ioctl(struct file *file, unsigned int
                 cmd, unsigned long arg)
 {
@@ -3078,7 +3276,7 @@ long btrfs_ioctl(struct file *file, unsigned int
         case BTRFS_IOC_DEV_INFO:
                 return btrfs_ioctl_dev_info(root, argp);
         case BTRFS_IOC_BALANCE:
-                return btrfs_balance(root->fs_info->dev_root);
+                return btrfs_ioctl_balance(root, NULL);
         case BTRFS_IOC_CLONE:
                 return btrfs_ioctl_clone(file, arg, 0, 0, 0);
         case BTRFS_IOC_CLONE_RANGE:
@@ -3110,6 +3308,12 @@ long btrfs_ioctl(struct file *file, unsigned int
                 return btrfs_ioctl_scrub_cancel(root, argp);
         case BTRFS_IOC_SCRUB_PROGRESS:
                 return btrfs_ioctl_scrub_progress(root, argp);
+        case BTRFS_IOC_BALANCE_V2:
+                return btrfs_ioctl_balance(root, argp);
+        case BTRFS_IOC_BALANCE_CTL:
+                return btrfs_ioctl_balance_ctl(root, arg);
+        case BTRFS_IOC_BALANCE_PROGRESS:
+                return btrfs_ioctl_balance_progress(root, argp);
         }
 
         return -ENOTTY;
diff --git a/fs/btrfs/ioctl.h b/fs/btrfs/ioctl.h
index 252ae9915de8..4f69028a68c4 100644
--- a/fs/btrfs/ioctl.h
+++ b/fs/btrfs/ioctl.h
@@ -109,6 +109,55 @@ struct btrfs_ioctl_fs_info_args {
         __u64 reserved[124];                    /* pad to 1k */
 };
 
+/* balance control ioctl modes */
+#define BTRFS_BALANCE_CTL_PAUSE         1
+#define BTRFS_BALANCE_CTL_CANCEL        2
+
+/*
+ * this is packed, because it should be exactly the same as its disk
+ * byte order counterpart (struct btrfs_disk_balance_args)
+ */
+struct btrfs_balance_args {
+        __u64 profiles;
+        __u64 usage;
+        __u64 devid;
+        __u64 pstart;
+        __u64 pend;
+        __u64 vstart;
+        __u64 vend;
+
+        __u64 target;
+
+        __u64 flags;
+
+        __u64 unused[8];
+} __attribute__ ((__packed__));
+
+/* report balance progress to userspace */
+struct btrfs_balance_progress {
+        __u64 expected;         /* estimated # of chunks that will be
+                                 * relocated to fulfill the request */
+        __u64 considered;       /* # of chunks we have considered so far */
+        __u64 completed;        /* # of chunks relocated so far */
+};
+
+#define BTRFS_BALANCE_STATE_RUNNING     (1ULL << 0)
+#define BTRFS_BALANCE_STATE_PAUSE_REQ   (1ULL << 1)
+#define BTRFS_BALANCE_STATE_CANCEL_REQ  (1ULL << 2)
+
+struct btrfs_ioctl_balance_args {
+        __u64 flags;                            /* in/out */
+        __u64 state;                            /* out */
+
+        struct btrfs_balance_args data;         /* in/out */
+        struct btrfs_balance_args meta;         /* in/out */
+        struct btrfs_balance_args sys;          /* in/out */
+
+        struct btrfs_balance_progress stat;     /* out */
+
+        __u64 unused[72];                       /* pad to 1k */
+};
+
 #define BTRFS_INO_LOOKUP_PATH_MAX 4080
 struct btrfs_ioctl_ino_lookup_args {
         __u64 treeid;
@@ -272,6 +321,11 @@ struct btrfs_ioctl_logical_ino_args {
                                  struct btrfs_ioctl_dev_info_args)
 #define BTRFS_IOC_FS_INFO _IOR(BTRFS_IOCTL_MAGIC, 31, \
                                struct btrfs_ioctl_fs_info_args)
+#define BTRFS_IOC_BALANCE_V2 _IOWR(BTRFS_IOCTL_MAGIC, 32, \
+                                   struct btrfs_ioctl_balance_args)
+#define BTRFS_IOC_BALANCE_CTL _IOW(BTRFS_IOCTL_MAGIC, 33, int)
+#define BTRFS_IOC_BALANCE_PROGRESS _IOR(BTRFS_IOCTL_MAGIC, 34, \
+                                        struct btrfs_ioctl_balance_args)
 #define BTRFS_IOC_INO_PATHS _IOWR(BTRFS_IOCTL_MAGIC, 35, \
                                         struct btrfs_ioctl_ino_path_args)
 #define BTRFS_IOC_LOGICAL_INO _IOWR(BTRFS_IOCTL_MAGIC, 36, \
diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
index d77b67c4b275..5e178d8f7167 100644
--- a/fs/btrfs/locking.c
+++ b/fs/btrfs/locking.c
@@ -33,6 +33,14 @@ void btrfs_assert_tree_read_locked(struct extent_buffer *eb);
  */
 void btrfs_set_lock_blocking_rw(struct extent_buffer *eb, int rw)
 {
+        if (eb->lock_nested) {
+                read_lock(&eb->lock);
+                if (eb->lock_nested && current->pid == eb->lock_owner) {
+                        read_unlock(&eb->lock);
+                        return;
+                }
+                read_unlock(&eb->lock);
+        }
         if (rw == BTRFS_WRITE_LOCK) {
                 if (atomic_read(&eb->blocking_writers) == 0) {
                         WARN_ON(atomic_read(&eb->spinning_writers) != 1);
@@ -57,6 +65,14 @@ void btrfs_set_lock_blocking_rw(struct extent_buffer *eb, int rw)
  */
 void btrfs_clear_lock_blocking_rw(struct extent_buffer *eb, int rw)
 {
+        if (eb->lock_nested) {
+                read_lock(&eb->lock);
+                if (&eb->lock_nested && current->pid == eb->lock_owner) {
+                        read_unlock(&eb->lock);
+                        return;
+                }
+                read_unlock(&eb->lock);
+        }
         if (rw == BTRFS_WRITE_LOCK_BLOCKING) {
                 BUG_ON(atomic_read(&eb->blocking_writers) != 1);
                 write_lock(&eb->lock);
@@ -81,12 +97,25 @@ void btrfs_clear_lock_blocking_rw(struct extent_buffer *eb, int rw)
 void btrfs_tree_read_lock(struct extent_buffer *eb)
 {
 again:
+        read_lock(&eb->lock);
+        if (atomic_read(&eb->blocking_writers) &&
+            current->pid == eb->lock_owner) {
+                /*
+                 * This extent is already write-locked by our thread. We allow
+                 * an additional read lock to be added because it's for the same
+                 * thread. btrfs_find_all_roots() depends on this as it may be
+                 * called on a partly (write-)locked tree.
+                 */
+                BUG_ON(eb->lock_nested);
+                eb->lock_nested = 1;
+                read_unlock(&eb->lock);
+                return;
+        }
+        read_unlock(&eb->lock);
         wait_event(eb->write_lock_wq, atomic_read(&eb->blocking_writers) == 0);
         read_lock(&eb->lock);
         if (atomic_read(&eb->blocking_writers)) {
                 read_unlock(&eb->lock);
-                wait_event(eb->write_lock_wq,
-                           atomic_read(&eb->blocking_writers) == 0);
                 goto again;
         }
         atomic_inc(&eb->read_locks);
@@ -129,6 +158,7 @@ int btrfs_try_tree_write_lock(struct extent_buffer *eb)
         }
         atomic_inc(&eb->write_locks);
         atomic_inc(&eb->spinning_writers);
+        eb->lock_owner = current->pid;
         return 1;
 }
 
@@ -137,6 +167,15 @@ int btrfs_try_tree_write_lock(struct extent_buffer *eb)
  */
 void btrfs_tree_read_unlock(struct extent_buffer *eb)
 {
+        if (eb->lock_nested) {
+                read_lock(&eb->lock);
+                if (eb->lock_nested && current->pid == eb->lock_owner) {
+                        eb->lock_nested = 0;
+                        read_unlock(&eb->lock);
+                        return;
+                }
+                read_unlock(&eb->lock);
+        }
         btrfs_assert_tree_read_locked(eb);
         WARN_ON(atomic_read(&eb->spinning_readers) == 0);
         atomic_dec(&eb->spinning_readers);
@@ -149,6 +188,15 @@ void btrfs_tree_read_unlock(struct extent_buffer *eb)
  */
 void btrfs_tree_read_unlock_blocking(struct extent_buffer *eb)
 {
+        if (eb->lock_nested) {
+                read_lock(&eb->lock);
+                if (eb->lock_nested && current->pid == eb->lock_owner) {
+                        eb->lock_nested = 0;
+                        read_unlock(&eb->lock);
+                        return;
+                }
+                read_unlock(&eb->lock);
+        }
         btrfs_assert_tree_read_locked(eb);
         WARN_ON(atomic_read(&eb->blocking_readers) == 0);
         if (atomic_dec_and_test(&eb->blocking_readers))
@@ -181,6 +229,7 @@ again:
         WARN_ON(atomic_read(&eb->spinning_writers));
         atomic_inc(&eb->spinning_writers);
         atomic_inc(&eb->write_locks);
+        eb->lock_owner = current->pid;
         return 0;
 }
 
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index cfb55434a469..8c1aae2c845d 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1604,12 +1604,12 @@ int replace_file_extents(struct btrfs_trans_handle *trans,
                 ret = btrfs_inc_extent_ref(trans, root, new_bytenr,
                                            num_bytes, parent,
                                            btrfs_header_owner(leaf),
-                                           key.objectid, key.offset);
+                                           key.objectid, key.offset, 1);
                 BUG_ON(ret);
 
                 ret = btrfs_free_extent(trans, root, bytenr, num_bytes,
                                         parent, btrfs_header_owner(leaf),
-                                        key.objectid, key.offset);
+                                        key.objectid, key.offset, 1);
                 BUG_ON(ret);
         }
         if (dirty)
@@ -1778,21 +1778,23 @@ again:
 
                 ret = btrfs_inc_extent_ref(trans, src, old_bytenr, blocksize,
                                         path->nodes[level]->start,
-                                        src->root_key.objectid, level - 1, 0);
+                                        src->root_key.objectid, level - 1, 0,
+                                        1);
                 BUG_ON(ret);
                 ret = btrfs_inc_extent_ref(trans, dest, new_bytenr, blocksize,
                                         0, dest->root_key.objectid, level - 1,
-                                        0);
+                                        0, 1);
                 BUG_ON(ret);
 
                 ret = btrfs_free_extent(trans, src, new_bytenr, blocksize,
                                         path->nodes[level]->start,
-                                        src->root_key.objectid, level - 1, 0);
+                                        src->root_key.objectid, level - 1, 0,
+                                        1);
                 BUG_ON(ret);
 
                 ret = btrfs_free_extent(trans, dest, old_bytenr, blocksize,
                                         0, dest->root_key.objectid, level - 1,
-                                        0);
+                                        0, 1);
                 BUG_ON(ret);
 
                 btrfs_unlock_up_safe(path, 0);
@@ -2244,7 +2246,7 @@ again:
                 } else {
                         list_del_init(&reloc_root->root_list);
                 }
-                btrfs_drop_snapshot(reloc_root, rc->block_rsv, 0);
+                btrfs_drop_snapshot(reloc_root, rc->block_rsv, 0, 1);
         }
 
         if (found) {
@@ -2558,7 +2560,7 @@ static int do_relocation(struct btrfs_trans_handle *trans,
                                                 node->eb->start, blocksize,
                                                 upper->eb->start,
                                                 btrfs_header_owner(upper->eb),
-                                                node->level, 0);
+                                                node->level, 0, 1);
                         BUG_ON(ret);
 
                         ret = btrfs_drop_subtree(trans, root, eb, upper->eb);
@@ -2947,9 +2949,7 @@ static int relocate_file_extent_cluster(struct inode *inode,
         index = (cluster->start - offset) >> PAGE_CACHE_SHIFT;
         last_index = (cluster->end - offset) >> PAGE_CACHE_SHIFT;
         while (index <= last_index) {
-                mutex_lock(&inode->i_mutex);
                 ret = btrfs_delalloc_reserve_metadata(inode, PAGE_CACHE_SIZE);
-                mutex_unlock(&inode->i_mutex);
                 if (ret)
                         goto out;
 
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index ddf2c90d3fc0..9770cc5bfb76 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -25,6 +25,7 @@
 #include "transaction.h"
 #include "backref.h"
 #include "extent_io.h"
+#include "check-integrity.h"
 
 /*
  * This is only the first step towards a full-features scrub. It reads all
@@ -309,7 +310,7 @@ static void scrub_print_warning(const char *errstr, struct scrub_bio *sbio,
         u8 ref_level;
         unsigned long ptr = 0;
         const int bufsize = 4096;
-        u64 extent_offset;
+        u64 extent_item_pos;
 
         path = btrfs_alloc_path();
 
@@ -329,12 +330,13 @@ static void scrub_print_warning(const char *errstr, struct scrub_bio *sbio,
         if (ret < 0)
                 goto out;
 
-        extent_offset = swarn.logical - found_key.objectid;
+        extent_item_pos = swarn.logical - found_key.objectid;
         swarn.extent_item_size = found_key.offset;
 
         eb = path->nodes[0];
         ei = btrfs_item_ptr(eb, path->slots[0], struct btrfs_extent_item);
         item_size = btrfs_item_size_nr(eb, path->slots[0]);
+        btrfs_release_path(path);
 
         if (ret & BTRFS_EXTENT_FLAG_TREE_BLOCK) {
                 do {
@@ -351,7 +353,7 @@ static void scrub_print_warning(const char *errstr, struct scrub_bio *sbio,
         } else {
                 swarn.path = path;
                 iterate_extent_inodes(fs_info, path, found_key.objectid,
-                                        extent_offset,
+                                        extent_item_pos,
                                         scrub_print_warning_inode, &swarn);
         }
 
@@ -732,7 +734,7 @@ static int scrub_fixup_io(int rw, struct block_device *bdev, sector_t sector,
         bio_add_page(bio, page, PAGE_SIZE, 0);
         bio->bi_end_io = scrub_fixup_end_io;
         bio->bi_private = &complete;
-        submit_bio(rw, bio);
+        btrfsic_submit_bio(rw, bio);
 
         /* this will also unplug the queue */
         wait_for_completion(&complete);
@@ -958,7 +960,7 @@ static int scrub_submit(struct scrub_dev *sdev)
         sdev->curr = -1;
         atomic_inc(&sdev->in_flight);
 
-        submit_bio(READ, sbio->bio);
+        btrfsic_submit_bio(READ, sbio->bio);
 
         return 0;
 }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index ae488aa1966a..3ce97b217cbe 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -147,13 +147,13 @@ void __btrfs_std_error(struct btrfs_fs_info *fs_info, const char *function,
 
 static void btrfs_put_super(struct super_block *sb)
 {
-        struct btrfs_root *root = btrfs_sb(sb);
-        int ret;
-
-        ret = close_ctree(root);
-        sb->s_fs_info = NULL;
-
-        (void)ret; /* FIXME: need to fix VFS to return error? */
+        (void)close_ctree(btrfs_sb(sb)->tree_root);
+        /* FIXME: need to fix VFS to return error? */
+        /* AV: return it _where_?  ->put_super() can be triggered by any number
+         * of async events, up to and including delivery of SIGKILL to the
+         * last process that kept it busy.  Or segfault in the aforementioned
+         * process...  Whom would you report that to?
+         */
 }
 
 enum {
@@ -163,8 +163,11 @@ enum {
         Opt_compress_type, Opt_compress_force, Opt_compress_force_type,
         Opt_notreelog, Opt_ratio, Opt_flushoncommit, Opt_discard,
         Opt_space_cache, Opt_clear_cache, Opt_user_subvol_rm_allowed,
-        Opt_enospc_debug, Opt_subvolrootid, Opt_defrag,
-        Opt_inode_cache, Opt_no_space_cache, Opt_recovery, Opt_err,
+        Opt_enospc_debug, Opt_subvolrootid, Opt_defrag, Opt_inode_cache,
+        Opt_no_space_cache, Opt_recovery, Opt_skip_balance,
+        Opt_check_integrity, Opt_check_integrity_including_extent_data,
+        Opt_check_integrity_print_mask,
+        Opt_err,
 };
 
 static match_table_t tokens = {
@@ -199,6 +202,10 @@ static match_table_t tokens = {
         {Opt_inode_cache, "inode_cache"},
         {Opt_no_space_cache, "nospace_cache"},
         {Opt_recovery, "recovery"},
+        {Opt_skip_balance, "skip_balance"},
+        {Opt_check_integrity, "check_int"},
+        {Opt_check_integrity_including_extent_data, "check_int_data"},
+        {Opt_check_integrity_print_mask, "check_int_print_mask=%d"},
         {Opt_err, NULL},
 };
 
@@ -397,6 +404,40 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                         printk(KERN_INFO "btrfs: enabling auto recovery");
                         btrfs_set_opt(info->mount_opt, RECOVERY);
                         break;
+                case Opt_skip_balance:
+                        btrfs_set_opt(info->mount_opt, SKIP_BALANCE);
+                        break;
+#ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
+                case Opt_check_integrity_including_extent_data:
+                        printk(KERN_INFO "btrfs: enabling check integrity"
+                               " including extent data\n");
+                        btrfs_set_opt(info->mount_opt,
+                                      CHECK_INTEGRITY_INCLUDING_EXTENT_DATA);
+                        btrfs_set_opt(info->mount_opt, CHECK_INTEGRITY);
+                        break;
+                case Opt_check_integrity:
+                        printk(KERN_INFO "btrfs: enabling check integrity\n");
+                        btrfs_set_opt(info->mount_opt, CHECK_INTEGRITY);
+                        break;
+                case Opt_check_integrity_print_mask:
+                        intarg = 0;
+                        match_int(&args[0], &intarg);
+                        if (intarg) {
+                                info->check_integrity_print_mask = intarg;
+                                printk(KERN_INFO "btrfs:"
+                                       " check_integrity_print_mask 0x%x\n",
+                                       info->check_integrity_print_mask);
+                        }
+                        break;
+#else
+                case Opt_check_integrity_including_extent_data:
+                case Opt_check_integrity:
+                case Opt_check_integrity_print_mask:
+                        printk(KERN_ERR "btrfs: support for check_integrity*"
+                               " not compiled in!\n");
+                        ret = -EINVAL;
+                        goto out;
+#endif
                 case Opt_err:
                         printk(KERN_INFO "btrfs: unrecognized mount option "
                                "'%s'\n", p);
@@ -500,7 +541,8 @@ out:
 static struct dentry *get_default_root(struct super_block *sb,
                                        u64 subvol_objectid)
 {
-        struct btrfs_root *root = sb->s_fs_info;
+        struct btrfs_fs_info *fs_info = btrfs_sb(sb);
+        struct btrfs_root *root = fs_info->tree_root;
         struct btrfs_root *new_root;
         struct btrfs_dir_item *di;
         struct btrfs_path *path;
@@ -530,7 +572,7 @@ static struct dentry *get_default_root(struct super_block *sb,
          * will mount by default if we haven't been given a specific subvolume
          * to mount.
          */
-        dir_id = btrfs_super_root_dir(root->fs_info->super_copy);
+        dir_id = btrfs_super_root_dir(fs_info->super_copy);
         di = btrfs_lookup_dir_item(NULL, root, path, dir_id, "default", 7, 0);
         if (IS_ERR(di)) {
                 btrfs_free_path(path);
@@ -544,7 +586,7 @@ static struct dentry *get_default_root(struct super_block *sb,
                  */
                 btrfs_free_path(path);
                 dir_id = BTRFS_FIRST_FREE_OBJECTID;
-                new_root = root->fs_info->fs_root;
+                new_root = fs_info->fs_root;
                 goto setup_root;
         }
 
@@ -552,7 +594,7 @@ static struct dentry *get_default_root(struct super_block *sb,
         btrfs_free_path(path);
 
 find_root:
-        new_root = btrfs_read_fs_root_no_name(root->fs_info, &location);
+        new_root = btrfs_read_fs_root_no_name(fs_info, &location);
         if (IS_ERR(new_root))
                 return ERR_CAST(new_root);
 
@@ -588,7 +630,7 @@ static int btrfs_fill_super(struct super_block *sb,
 {
         struct inode *inode;
         struct dentry *root_dentry;
-        struct btrfs_root *tree_root;
+        struct btrfs_fs_info *fs_info = btrfs_sb(sb);
         struct btrfs_key key;
         int err;
 
@@ -603,18 +645,16 @@ static int btrfs_fill_super(struct super_block *sb,
         sb->s_flags |= MS_POSIXACL;
 #endif
 
-        tree_root = open_ctree(sb, fs_devices, (char *)data);
-
-        if (IS_ERR(tree_root)) {
+        err = open_ctree(sb, fs_devices, (char *)data);
+        if (err) {
                 printk("btrfs: open_ctree failed\n");
-                return PTR_ERR(tree_root);
+                return err;
         }
-        sb->s_fs_info = tree_root;
 
         key.objectid = BTRFS_FIRST_FREE_OBJECTID;
         key.type = BTRFS_INODE_ITEM_KEY;
         key.offset = 0;
-        inode = btrfs_iget(sb, &key, tree_root->fs_info->fs_root, NULL);
+        inode = btrfs_iget(sb, &key, fs_info->fs_root, NULL);
         if (IS_ERR(inode)) {
                 err = PTR_ERR(inode);
                 goto fail_close;
@@ -631,23 +671,25 @@ static int btrfs_fill_super(struct super_block *sb,
 
         save_mount_options(sb, data);
         cleancache_init_fs(sb);
+        sb->s_flags |= MS_ACTIVE;
         return 0;
 
 fail_close:
-        close_ctree(tree_root);
+        close_ctree(fs_info->tree_root);
         return err;
 }
 
 int btrfs_sync_fs(struct super_block *sb, int wait)
 {
         struct btrfs_trans_handle *trans;
-        struct btrfs_root *root = btrfs_sb(sb);
+        struct btrfs_fs_info *fs_info = btrfs_sb(sb);
+        struct btrfs_root *root = fs_info->tree_root;
         int ret;
 
         trace_btrfs_sync_fs(wait);
 
         if (!wait) {
-                filemap_flush(root->fs_info->btree_inode->i_mapping);
+                filemap_flush(fs_info->btree_inode->i_mapping);
                 return 0;
         }
 
@@ -663,8 +705,8 @@ int btrfs_sync_fs(struct super_block *sb, int wait)
 
 static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry)
 {
-        struct btrfs_root *root = btrfs_sb(dentry->d_sb);
-        struct btrfs_fs_info *info = root->fs_info;
+        struct btrfs_fs_info *info = btrfs_sb(dentry->d_sb);
+        struct btrfs_root *root = info->tree_root;
         char *compress_type;
 
         if (btrfs_test_opt(root, DEGRADED))
@@ -722,28 +764,25 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry)
                 seq_puts(seq, ",autodefrag");
         if (btrfs_test_opt(root, INODE_MAP_CACHE))
                 seq_puts(seq, ",inode_cache");
+        if (btrfs_test_opt(root, SKIP_BALANCE))
+                seq_puts(seq, ",skip_balance");
         return 0;
 }
 
 static int btrfs_test_super(struct super_block *s, void *data)
 {
-        struct btrfs_root *test_root = data;
-        struct btrfs_root *root = btrfs_sb(s);
+        struct btrfs_fs_info *p = data;
+        struct btrfs_fs_info *fs_info = btrfs_sb(s);
 
-        /*
-         * If this super block is going away, return false as it
-         * can't match as an existing super block.
-         */
-        if (!atomic_read(&s->s_active))
-                return 0;
-        return root->fs_info->fs_devices == test_root->fs_info->fs_devices;
+        return fs_info->fs_devices == p->fs_devices;
 }
 
 static int btrfs_set_super(struct super_block *s, void *data)
 {
-        s->s_fs_info = data;
-
-        return set_anon_super(s, data);
+        int err = set_anon_super(s, data);
+        if (!err)
+                s->s_fs_info = data;
+        return err;
 }
 
 /*
@@ -903,12 +942,6 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
         if (!fs_info)
                 return ERR_PTR(-ENOMEM);
 
-        fs_info->tree_root = kzalloc(sizeof(struct btrfs_root), GFP_NOFS);
-        if (!fs_info->tree_root) {
-                error = -ENOMEM;
-                goto error_fs_info;
-        }
-        fs_info->tree_root->fs_info = fs_info;
         fs_info->fs_devices = fs_devices;
 
         fs_info->super_copy = kzalloc(BTRFS_SUPER_INFO_SIZE, GFP_NOFS);
@@ -928,43 +961,30 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
         }
 
         bdev = fs_devices->latest_bdev;
-        s = sget(fs_type, btrfs_test_super, btrfs_set_super,
-                 fs_info->tree_root);
+        s = sget(fs_type, btrfs_test_super, btrfs_set_super, fs_info);
         if (IS_ERR(s)) {
                 error = PTR_ERR(s);
                 goto error_close_devices;
         }
 
         if (s->s_root) {
-                if ((flags ^ s->s_flags) & MS_RDONLY) {
-                        deactivate_locked_super(s);
-                        error = -EBUSY;
-                        goto error_close_devices;
-                }
-
                 btrfs_close_devices(fs_devices);
                 free_fs_info(fs_info);
+                if ((flags ^ s->s_flags) & MS_RDONLY)
+                        error = -EBUSY;
         } else {
                 char b[BDEVNAME_SIZE];
 
                 s->s_flags = flags | MS_NOSEC;
                 strlcpy(s->s_id, bdevname(bdev, b), sizeof(s->s_id));
-                btrfs_sb(s)->fs_info->bdev_holder = fs_type;
+                btrfs_sb(s)->bdev_holder = fs_type;
                 error = btrfs_fill_super(s, fs_devices, data,
                                          flags & MS_SILENT ? 1 : 0);
-                if (error) {
-                        deactivate_locked_super(s);
-                        return ERR_PTR(error);
-                }
-
-                s->s_flags |= MS_ACTIVE;
         }
 
-        root = get_default_root(s, subvol_objectid);
-        if (IS_ERR(root)) {
+        root = !error ? get_default_root(s, subvol_objectid) : ERR_PTR(error);
+        if (IS_ERR(root))
                 deactivate_locked_super(s);
-                return root;
-        }
 
         return root;
 
@@ -977,7 +997,8 @@ error_fs_info:
 
 static int btrfs_remount(struct super_block *sb, int *flags, char *data)
 {
-        struct btrfs_root *root = btrfs_sb(sb);
+        struct btrfs_fs_info *fs_info = btrfs_sb(sb);
+        struct btrfs_root *root = fs_info->tree_root;
         int ret;
 
         ret = btrfs_parse_options(root, data);
@@ -993,13 +1014,13 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
                 ret =  btrfs_commit_super(root);
                 WARN_ON(ret);
         } else {
-                if (root->fs_info->fs_devices->rw_devices == 0)
+                if (fs_info->fs_devices->rw_devices == 0)
                         return -EACCES;
 
-                if (btrfs_super_log_root(root->fs_info->super_copy) != 0)
+                if (btrfs_super_log_root(fs_info->super_copy) != 0)
                         return -EINVAL;
 
-                ret = btrfs_cleanup_fs_roots(root->fs_info);
+                ret = btrfs_cleanup_fs_roots(fs_info);
                 WARN_ON(ret);
 
                 /* recover relocation */
@@ -1168,18 +1189,18 @@ static int btrfs_calc_avail_data_space(struct btrfs_root *root, u64 *free_bytes)
 
 static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
-        struct btrfs_root *root = btrfs_sb(dentry->d_sb);
-        struct btrfs_super_block *disk_super = root->fs_info->super_copy;
-        struct list_head *head = &root->fs_info->space_info;
+        struct btrfs_fs_info *fs_info = btrfs_sb(dentry->d_sb);
+        struct btrfs_super_block *disk_super = fs_info->super_copy;
+        struct list_head *head = &fs_info->space_info;
         struct btrfs_space_info *found;
         u64 total_used = 0;
         u64 total_free_data = 0;
         int bits = dentry->d_sb->s_blocksize_bits;
-        __be32 *fsid = (__be32 *)root->fs_info->fsid;
+        __be32 *fsid = (__be32 *)fs_info->fsid;
         int ret;
 
         /* holding chunk_muext to avoid allocating new chunks */
-        mutex_lock(&root->fs_info->chunk_mutex);
+        mutex_lock(&fs_info->chunk_mutex);
         rcu_read_lock();
         list_for_each_entry_rcu(found, head, list) {
                 if (found->flags & BTRFS_BLOCK_GROUP_DATA) {
@@ -1198,14 +1219,14 @@ static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
         buf->f_bsize = dentry->d_sb->s_blocksize;
         buf->f_type = BTRFS_SUPER_MAGIC;
         buf->f_bavail = total_free_data;
-        ret = btrfs_calc_avail_data_space(root, &total_free_data);
+        ret = btrfs_calc_avail_data_space(fs_info->tree_root, &total_free_data);
         if (ret) {
-                mutex_unlock(&root->fs_info->chunk_mutex);
+                mutex_unlock(&fs_info->chunk_mutex);
                 return ret;
         }
         buf->f_bavail += total_free_data;
         buf->f_bavail = buf->f_bavail >> bits;
-        mutex_unlock(&root->fs_info->chunk_mutex);
+        mutex_unlock(&fs_info->chunk_mutex);
 
         /* We treat it as constant endianness (it doesn't matter _which_)
            because we want the fsid to come out the same whether mounted
@@ -1219,11 +1240,18 @@ static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
         return 0;
 }
 
+static void btrfs_kill_super(struct super_block *sb)
+{
+        struct btrfs_fs_info *fs_info = btrfs_sb(sb);
+        kill_anon_super(sb);
+        free_fs_info(fs_info);
+}
+
 static struct file_system_type btrfs_fs_type = {
         .owner          = THIS_MODULE,
         .name           = "btrfs",
         .mount          = btrfs_mount,
-        .kill_sb        = kill_anon_super,
+        .kill_sb        = btrfs_kill_super,
         .fs_flags       = FS_REQUIRES_DEV,
 };
 
@@ -1257,17 +1285,17 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
 
 static int btrfs_freeze(struct super_block *sb)
 {
-        struct btrfs_root *root = btrfs_sb(sb);
-        mutex_lock(&root->fs_info->transaction_kthread_mutex);
-        mutex_lock(&root->fs_info->cleaner_mutex);
+        struct btrfs_fs_info *fs_info = btrfs_sb(sb);
+        mutex_lock(&fs_info->transaction_kthread_mutex);
+        mutex_lock(&fs_info->cleaner_mutex);
         return 0;
 }
 
 static int btrfs_unfreeze(struct super_block *sb)
 {
-        struct btrfs_root *root = btrfs_sb(sb);
-        mutex_unlock(&root->fs_info->cleaner_mutex);
-        mutex_unlock(&root->fs_info->transaction_kthread_mutex);
+        struct btrfs_fs_info *fs_info = btrfs_sb(sb);
+        mutex_unlock(&fs_info->cleaner_mutex);
+        mutex_unlock(&fs_info->transaction_kthread_mutex);
         return 0;
 }
 
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 81376d94cd3c..287a6728b1ad 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -36,6 +36,8 @@ static noinline void put_transaction(struct btrfs_transaction *transaction)
         WARN_ON(atomic_read(&transaction->use_count) == 0);
         if (atomic_dec_and_test(&transaction->use_count)) {
                 BUG_ON(!list_empty(&transaction->list));
+                WARN_ON(transaction->delayed_refs.root.rb_node);
+                WARN_ON(!list_empty(&transaction->delayed_refs.seq_head));
                 memset(transaction, 0, sizeof(*transaction));
                 kmem_cache_free(btrfs_transaction_cachep, transaction);
         }
@@ -108,8 +110,11 @@ loop:
         cur_trans->delayed_refs.num_heads = 0;
         cur_trans->delayed_refs.flushing = 0;
         cur_trans->delayed_refs.run_delayed_start = 0;
+        cur_trans->delayed_refs.seq = 1;
+        init_waitqueue_head(&cur_trans->delayed_refs.seq_wait);
         spin_lock_init(&cur_trans->commit_lock);
         spin_lock_init(&cur_trans->delayed_refs.lock);
+        INIT_LIST_HEAD(&cur_trans->delayed_refs.seq_head);
 
         INIT_LIST_HEAD(&cur_trans->pending_snapshots);
         list_add_tail(&cur_trans->list, &root->fs_info->trans_list);
@@ -321,6 +326,8 @@ again:
         }
 
         if (num_bytes) {
+                trace_btrfs_space_reservation(root->fs_info, "transaction",
+                                              (u64)h, num_bytes, 1);
                 h->block_rsv = &root->fs_info->trans_block_rsv;
                 h->bytes_reserved = num_bytes;
         }
@@ -467,19 +474,12 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
 
         btrfs_trans_release_metadata(trans, root);
         trans->block_rsv = NULL;
-        while (count < 4) {
+        while (count < 2) {
                 unsigned long cur = trans->delayed_ref_updates;
                 trans->delayed_ref_updates = 0;
                 if (cur &&
                     trans->transaction->delayed_refs.num_heads_ready > 64) {
                         trans->delayed_ref_updates = 0;
-
-                        /*
-                         * do a full flush if the transaction is trying
-                         * to close
-                         */
-                        if (trans->transaction->delayed_refs.flushing)
-                                cur = 0;
                         btrfs_run_delayed_refs(trans, root, cur);
                 } else {
                         break;
@@ -1393,9 +1393,9 @@ int btrfs_clean_old_snapshots(struct btrfs_root *root)
 
                 if (btrfs_header_backref_rev(root->node) <
                     BTRFS_MIXED_BACKREF_REV)
-                        btrfs_drop_snapshot(root, NULL, 0);
+                        btrfs_drop_snapshot(root, NULL, 0, 0);
                 else
-                        btrfs_drop_snapshot(root, NULL, 1);
+                        btrfs_drop_snapshot(root, NULL, 1, 0);
         }
         return 0;
 }
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 3568374d419d..cb877e0886a7 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -589,7 +589,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
                                 ret = btrfs_inc_extent_ref(trans, root,
                                                 ins.objectid, ins.offset,
                                                 0, root->root_key.objectid,
-                                                key->objectid, offset);
+                                                key->objectid, offset, 0);
                                 BUG_ON(ret);
                         } else {
                                 /*
diff --git a/fs/btrfs/ulist.c b/fs/btrfs/ulist.c
new file mode 100644
index 000000000000..12f5147bd2b1
--- /dev/null
+++ b/fs/btrfs/ulist.c
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2011 STRATO AG
+ * written by Arne Jansen <sensille@gmx.net>
+ * Distributed under the GNU GPL license version 2.
+ */
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include "ulist.h"
+
+/*
+ * ulist is a generic data structure to hold a collection of unique u64
+ * values. The only operations it supports is adding to the list and
+ * enumerating it.
+ * It is possible to store an auxiliary value along with the key.
+ *
+ * The implementation is preliminary and can probably be sped up
+ * significantly. A first step would be to store the values in an rbtree
+ * as soon as ULIST_SIZE is exceeded.
+ *
+ * A sample usage for ulists is the enumeration of directed graphs without
+ * visiting a node twice. The pseudo-code could look like this:
+ *
+ * ulist = ulist_alloc();
+ * ulist_add(ulist, root);
+ * elem = NULL;
+ *
+ * while ((elem = ulist_next(ulist, elem)) {
+ *      for (all child nodes n in elem)
+ *              ulist_add(ulist, n);
+ *      do something useful with the node;
+ * }
+ * ulist_free(ulist);
+ *
+ * This assumes the graph nodes are adressable by u64. This stems from the
+ * usage for tree enumeration in btrfs, where the logical addresses are
+ * 64 bit.
+ *
+ * It is also useful for tree enumeration which could be done elegantly
+ * recursively, but is not possible due to kernel stack limitations. The
+ * loop would be similar to the above.
+ */
+
+/**
+ * ulist_init - freshly initialize a ulist
+ * @ulist:      the ulist to initialize
+ *
+ * Note: don't use this function to init an already used ulist, use
+ * ulist_reinit instead.
+ */
+void ulist_init(struct ulist *ulist)
+{
+        ulist->nnodes = 0;
+        ulist->nodes = ulist->int_nodes;
+        ulist->nodes_alloced = ULIST_SIZE;
+}
+EXPORT_SYMBOL(ulist_init);
+
+/**
+ * ulist_fini - free up additionally allocated memory for the ulist
+ * @ulist:      the ulist from which to free the additional memory
+ *
+ * This is useful in cases where the base 'struct ulist' has been statically
+ * allocated.
+ */
+void ulist_fini(struct ulist *ulist)
+{
+        /*
+         * The first ULIST_SIZE elements are stored inline in struct ulist.
+         * Only if more elements are alocated they need to be freed.
+         */
+        if (ulist->nodes_alloced > ULIST_SIZE)
+                kfree(ulist->nodes);
+        ulist->nodes_alloced = 0;       /* in case ulist_fini is called twice */
+}
+EXPORT_SYMBOL(ulist_fini);
+
+/**
+ * ulist_reinit - prepare a ulist for reuse
+ * @ulist:      ulist to be reused
+ *
+ * Free up all additional memory allocated for the list elements and reinit
+ * the ulist.
+ */
+void ulist_reinit(struct ulist *ulist)
+{
+        ulist_fini(ulist);
+        ulist_init(ulist);
+}
+EXPORT_SYMBOL(ulist_reinit);
+
+/**
+ * ulist_alloc - dynamically allocate a ulist
+ * @gfp_mask:   allocation flags to for base allocation
+ *
+ * The allocated ulist will be returned in an initialized state.
+ */
+struct ulist *ulist_alloc(unsigned long gfp_mask)
+{
+        struct ulist *ulist = kmalloc(sizeof(*ulist), gfp_mask);
+
+        if (!ulist)
+                return NULL;
+
+        ulist_init(ulist);
+
+        return ulist;
+}
+EXPORT_SYMBOL(ulist_alloc);
+
+/**
+ * ulist_free - free dynamically allocated ulist
+ * @ulist:      ulist to free
+ *
+ * It is not necessary to call ulist_fini before.
+ */
+void ulist_free(struct ulist *ulist)
+{
+        if (!ulist)
+                return;
+        ulist_fini(ulist);
+        kfree(ulist);
+}
+EXPORT_SYMBOL(ulist_free);
+
+/**
+ * ulist_add - add an element to the ulist
+ * @ulist:      ulist to add the element to
+ * @val:        value to add to ulist
+ * @aux:        auxiliary value to store along with val
+ * @gfp_mask:   flags to use for allocation
+ *
+ * Note: locking must be provided by the caller. In case of rwlocks write
+ *       locking is needed
+ *
+ * Add an element to a ulist. The @val will only be added if it doesn't
+ * already exist. If it is added, the auxiliary value @aux is stored along with
+ * it. In case @val already exists in the ulist, @aux is ignored, even if
+ * it differs from the already stored value.
+ *
+ * ulist_add returns 0 if @val already exists in ulist and 1 if @val has been
+ * inserted.
+ * In case of allocation failure -ENOMEM is returned and the ulist stays
+ * unaltered.
+ */
+int ulist_add(struct ulist *ulist, u64 val, unsigned long aux,
+              unsigned long gfp_mask)
+{
+        int i;
+
+        for (i = 0; i < ulist->nnodes; ++i) {
+                if (ulist->nodes[i].val == val)
+                        return 0;
+        }
+
+        if (ulist->nnodes >= ulist->nodes_alloced) {
+                u64 new_alloced = ulist->nodes_alloced + 128;
+                struct ulist_node *new_nodes;
+                void *old = NULL;
+
+                /*
+                 * if nodes_alloced == ULIST_SIZE no memory has been allocated
+                 * yet, so pass NULL to krealloc
+                 */
+                if (ulist->nodes_alloced > ULIST_SIZE)
+                        old = ulist->nodes;
+
+                new_nodes = krealloc(old, sizeof(*new_nodes) * new_alloced,
+                                     gfp_mask);
+                if (!new_nodes)
+                        return -ENOMEM;
+
+                if (!old)
+                        memcpy(new_nodes, ulist->int_nodes,
+                               sizeof(ulist->int_nodes));
+
+                ulist->nodes = new_nodes;
+                ulist->nodes_alloced = new_alloced;
+        }
+        ulist->nodes[ulist->nnodes].val = val;
+        ulist->nodes[ulist->nnodes].aux = aux;
+        ++ulist->nnodes;
+
+        return 1;
+}
+EXPORT_SYMBOL(ulist_add);
+
+/**
+ * ulist_next - iterate ulist
+ * @ulist:      ulist to iterate
+ * @prev:       previously returned element or %NULL to start iteration
+ *
+ * Note: locking must be provided by the caller. In case of rwlocks only read
+ *       locking is needed
+ *
+ * This function is used to iterate an ulist. The iteration is started with
+ * @prev = %NULL. It returns the next element from the ulist or %NULL when the
+ * end is reached. No guarantee is made with respect to the order in which
+ * the elements are returned. They might neither be returned in order of
+ * addition nor in ascending order.
+ * It is allowed to call ulist_add during an enumeration. Newly added items
+ * are guaranteed to show up in the running enumeration.
+ */
+struct ulist_node *ulist_next(struct ulist *ulist, struct ulist_node *prev)
+{
+        int next;
+
+        if (ulist->nnodes == 0)
+                return NULL;
+
+        if (!prev)
+                return &ulist->nodes[0];
+
+        next = (prev - ulist->nodes) + 1;
+        if (next < 0 || next >= ulist->nnodes)
+                return NULL;
+
+        return &ulist->nodes[next];
+}
+EXPORT_SYMBOL(ulist_next);
diff --git a/fs/btrfs/ulist.h b/fs/btrfs/ulist.h
new file mode 100644
index 000000000000..2e25dec58ec0
--- /dev/null
+++ b/fs/btrfs/ulist.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2011 STRATO AG
+ * written by Arne Jansen <sensille@gmx.net>
+ * Distributed under the GNU GPL license version 2.
+ *
+ */
+
+#ifndef __ULIST__
+#define __ULIST__
+
+/*
+ * ulist is a generic data structure to hold a collection of unique u64
+ * values. The only operations it supports is adding to the list and
+ * enumerating it.
+ * It is possible to store an auxiliary value along with the key.
+ *
+ * The implementation is preliminary and can probably be sped up
+ * significantly. A first step would be to store the values in an rbtree
+ * as soon as ULIST_SIZE is exceeded.
+ */
+
+/*
+ * number of elements statically allocated inside struct ulist
+ */
+#define ULIST_SIZE 16
+
+/*
+ * element of the list
+ */
+struct ulist_node {
+        u64 val;                /* value to store */
+        unsigned long aux;      /* auxiliary value saved along with the val */
+};
+
+struct ulist {
+        /*
+         * number of elements stored in list
+         */
+        unsigned long nnodes;
+
+        /*
+         * number of nodes we already have room for
+         */
+        unsigned long nodes_alloced;
+
+        /*
+         * pointer to the array storing the elements. The first ULIST_SIZE
+         * elements are stored inline. In this case the it points to int_nodes.
+         * After exceeding ULIST_SIZE, dynamic memory is allocated.
+         */
+        struct ulist_node *nodes;
+
+        /*
+         * inline storage space for the first ULIST_SIZE entries
+         */
+        struct ulist_node int_nodes[ULIST_SIZE];
+};
+
+void ulist_init(struct ulist *ulist);
+void ulist_fini(struct ulist *ulist);
+void ulist_reinit(struct ulist *ulist);
+struct ulist *ulist_alloc(unsigned long gfp_mask);
+void ulist_free(struct ulist *ulist);
+int ulist_add(struct ulist *ulist, u64 val, unsigned long aux,
+              unsigned long gfp_mask);
+struct ulist_node *ulist_next(struct ulist *ulist, struct ulist_node *prev);
+
+#endif
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index f4b839fd3c9d..0b4e2af7954d 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -23,6 +23,7 @@
 #include <linux/random.h>
 #include <linux/iocontext.h>
 #include <linux/capability.h>
+#include <linux/kthread.h>
 #include <asm/div64.h>
 #include "compat.h"
 #include "ctree.h"
@@ -32,6 +33,7 @@
 #include "print-tree.h"
 #include "volumes.h"
 #include "async-thread.h"
+#include "check-integrity.h"
 
 static int init_first_rw_device(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
@@ -246,7 +248,7 @@ loop_lock:
                         sync_pending = 0;
                 }
 
-                submit_bio(cur->bi_rw, cur);
+                btrfsic_submit_bio(cur->bi_rw, cur);
                 num_run++;
                 batch_run++;
                 if (need_resched())
@@ -706,8 +708,6 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder,
         u64 devid;
         u64 transid;
 
-        mutex_lock(&uuid_mutex);
-
         flags |= FMODE_EXCL;
         bdev = blkdev_get_by_path(path, flags, holder);
 
@@ -716,6 +716,7 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder,
                 goto error;
         }
 
+        mutex_lock(&uuid_mutex);
         ret = set_blocksize(bdev, 4096);
         if (ret)
                 goto error_close;
@@ -737,9 +738,9 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder,
 
         brelse(bh);
 error_close:
+        mutex_unlock(&uuid_mutex);
         blkdev_put(bdev, flags);
 error:
-        mutex_unlock(&uuid_mutex);
         return ret;
 }
 
@@ -829,7 +830,6 @@ out:
 
 /*
  * find_free_dev_extent - find free space in the specified device
- * @trans:      transaction handler
  * @device:     the device which we search the free space in
  * @num_bytes:  the size of the free space that we need
  * @start:      store the start of the free space.
@@ -848,8 +848,7 @@ out:
  * But if we don't find suitable free space, it is used to store the size of
  * the max free space.
  */
-int find_free_dev_extent(struct btrfs_trans_handle *trans,
-                         struct btrfs_device *device, u64 num_bytes,
+int find_free_dev_extent(struct btrfs_device *device, u64 num_bytes,
                          u64 *start, u64 *len)
 {
         struct btrfs_key key;
@@ -893,7 +892,7 @@ int find_free_dev_extent(struct btrfs_trans_handle *trans,
         key.offset = search_start;
         key.type = BTRFS_DEV_EXTENT_KEY;
 
-        ret = btrfs_search_slot(trans, root, &key, path, 0, 0);
+        ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
         if (ret < 0)
                 goto out;
         if (ret > 0) {
@@ -1282,7 +1281,6 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
         bool clear_super = false;
 
         mutex_lock(&uuid_mutex);
-        mutex_lock(&root->fs_info->volume_mutex);
 
         all_avail = root->fs_info->avail_data_alloc_bits |
                 root->fs_info->avail_system_alloc_bits |
@@ -1452,7 +1450,6 @@ error_close:
         if (bdev)
                 blkdev_put(bdev, FMODE_READ | FMODE_EXCL);
 out:
-        mutex_unlock(&root->fs_info->volume_mutex);
         mutex_unlock(&uuid_mutex);
         return ret;
 error_undo:
@@ -1469,8 +1466,7 @@ error_undo:
 /*
  * does all the dirty work required for changing file system's UUID.
  */
-static int btrfs_prepare_sprout(struct btrfs_trans_handle *trans,
-                                struct btrfs_root *root)
+static int btrfs_prepare_sprout(struct btrfs_root *root)
 {
         struct btrfs_fs_devices *fs_devices = root->fs_info->fs_devices;
         struct btrfs_fs_devices *old_devices;
@@ -1629,7 +1625,6 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         }
 
         filemap_write_and_wait(bdev->bd_inode->i_mapping);
-        mutex_lock(&root->fs_info->volume_mutex);
 
         devices = &root->fs_info->fs_devices->devices;
         /*
@@ -1695,7 +1690,7 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
 
         if (seeding_dev) {
                 sb->s_flags &= ~MS_RDONLY;
-                ret = btrfs_prepare_sprout(trans, root);
+                ret = btrfs_prepare_sprout(root);
                 BUG_ON(ret);
         }
 
@@ -1757,8 +1752,7 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
                 ret = btrfs_relocate_sys_chunks(root);
                 BUG_ON(ret);
         }
-out:
-        mutex_unlock(&root->fs_info->volume_mutex);
+
         return ret;
 error:
         blkdev_put(bdev, FMODE_EXCL);
@@ -1766,7 +1760,7 @@ error:
                 mutex_unlock(&uuid_mutex);
                 up_write(&sb->s_umount);
         }
-        goto out;
+        return ret;
 }
 
 static noinline int btrfs_update_device(struct btrfs_trans_handle *trans,
@@ -2077,6 +2071,362 @@ error:
         return ret;
 }
 
+static int insert_balance_item(struct btrfs_root *root,
+                               struct btrfs_balance_control *bctl)
+{
+        struct btrfs_trans_handle *trans;
+        struct btrfs_balance_item *item;
+        struct btrfs_disk_balance_args disk_bargs;
+        struct btrfs_path *path;
+        struct extent_buffer *leaf;
+        struct btrfs_key key;
+        int ret, err;
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
+        trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans)) {
+                btrfs_free_path(path);
+                return PTR_ERR(trans);
+        }
+
+        key.objectid = BTRFS_BALANCE_OBJECTID;
+        key.type = BTRFS_BALANCE_ITEM_KEY;
+        key.offset = 0;
+
+        ret = btrfs_insert_empty_item(trans, root, path, &key,
+                                      sizeof(*item));
+        if (ret)
+                goto out;
+
+        leaf = path->nodes[0];
+        item = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_balance_item);
+
+        memset_extent_buffer(leaf, 0, (unsigned long)item, sizeof(*item));
+
+        btrfs_cpu_balance_args_to_disk(&disk_bargs, &bctl->data);
+        btrfs_set_balance_data(leaf, item, &disk_bargs);
+        btrfs_cpu_balance_args_to_disk(&disk_bargs, &bctl->meta);
+        btrfs_set_balance_meta(leaf, item, &disk_bargs);
+        btrfs_cpu_balance_args_to_disk(&disk_bargs, &bctl->sys);
+        btrfs_set_balance_sys(leaf, item, &disk_bargs);
+
+        btrfs_set_balance_flags(leaf, item, bctl->flags);
+
+        btrfs_mark_buffer_dirty(leaf);
+out:
+        btrfs_free_path(path);
+        err = btrfs_commit_transaction(trans, root);
+        if (err && !ret)
+                ret = err;
+        return ret;
+}
+
+static int del_balance_item(struct btrfs_root *root)
+{
+        struct btrfs_trans_handle *trans;
+        struct btrfs_path *path;
+        struct btrfs_key key;
+        int ret, err;
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
+        trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans)) {
+                btrfs_free_path(path);
+                return PTR_ERR(trans);
+        }
+
+        key.objectid = BTRFS_BALANCE_OBJECTID;
+        key.type = BTRFS_BALANCE_ITEM_KEY;
+        key.offset = 0;
+
+        ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
+        if (ret < 0)
+                goto out;
+        if (ret > 0) {
+                ret = -ENOENT;
+                goto out;
+        }
+
+        ret = btrfs_del_item(trans, root, path);
+out:
+        btrfs_free_path(path);
+        err = btrfs_commit_transaction(trans, root);
+        if (err && !ret)
+                ret = err;
+        return ret;
+}
+
+/*
+ * This is a heuristic used to reduce the number of chunks balanced on
+ * resume after balance was interrupted.
+ */
+static void update_balance_args(struct btrfs_balance_control *bctl)
+{
+        /*
+         * Turn on soft mode for chunk types that were being converted.
+         */
+        if (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT)
+                bctl->data.flags |= BTRFS_BALANCE_ARGS_SOFT;
+        if (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT)
+                bctl->sys.flags |= BTRFS_BALANCE_ARGS_SOFT;
+        if (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT)
+                bctl->meta.flags |= BTRFS_BALANCE_ARGS_SOFT;
+
+        /*
+         * Turn on usage filter if is not already used.  The idea is
+         * that chunks that we have already balanced should be
+         * reasonably full.  Don't do it for chunks that are being
+         * converted - that will keep us from relocating unconverted
+         * (albeit full) chunks.
+         */
+        if (!(bctl->data.flags & BTRFS_BALANCE_ARGS_USAGE) &&
+            !(bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT)) {
+                bctl->data.flags |= BTRFS_BALANCE_ARGS_USAGE;
+                bctl->data.usage = 90;
+        }
+        if (!(bctl->sys.flags & BTRFS_BALANCE_ARGS_USAGE) &&
+            !(bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT)) {
+                bctl->sys.flags |= BTRFS_BALANCE_ARGS_USAGE;
+                bctl->sys.usage = 90;
+        }
+        if (!(bctl->meta.flags & BTRFS_BALANCE_ARGS_USAGE) &&
+            !(bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT)) {
+                bctl->meta.flags |= BTRFS_BALANCE_ARGS_USAGE;
+                bctl->meta.usage = 90;
+        }
+}
+
+/*
+ * Should be called with both balance and volume mutexes held to
+ * serialize other volume operations (add_dev/rm_dev/resize) with
+ * restriper.  Same goes for unset_balance_control.
+ */
+static void set_balance_control(struct btrfs_balance_control *bctl)
+{
+        struct btrfs_fs_info *fs_info = bctl->fs_info;
+
+        BUG_ON(fs_info->balance_ctl);
+
+        spin_lock(&fs_info->balance_lock);
+        fs_info->balance_ctl = bctl;
+        spin_unlock(&fs_info->balance_lock);
+}
+
+static void unset_balance_control(struct btrfs_fs_info *fs_info)
+{
+        struct btrfs_balance_control *bctl = fs_info->balance_ctl;
+
+        BUG_ON(!fs_info->balance_ctl);
+
+        spin_lock(&fs_info->balance_lock);
+        fs_info->balance_ctl = NULL;
+        spin_unlock(&fs_info->balance_lock);
+
+        kfree(bctl);
+}
+
+/*
+ * Balance filters.  Return 1 if chunk should be filtered out
+ * (should not be balanced).
+ */
+static int chunk_profiles_filter(u64 chunk_profile,
+                                 struct btrfs_balance_args *bargs)
+{
+        chunk_profile &= BTRFS_BLOCK_GROUP_PROFILE_MASK;
+
+        if (chunk_profile == 0)
+                chunk_profile = BTRFS_AVAIL_ALLOC_BIT_SINGLE;
+
+        if (bargs->profiles & chunk_profile)
+                return 0;
+
+        return 1;
+}
+
+static u64 div_factor_fine(u64 num, int factor)
+{
+        if (factor <= 0)
+                return 0;
+        if (factor >= 100)
+                return num;
+
+        num *= factor;
+        do_div(num, 100);
+        return num;
+}
+
+static int chunk_usage_filter(struct btrfs_fs_info *fs_info, u64 chunk_offset,
+                              struct btrfs_balance_args *bargs)
+{
+        struct btrfs_block_group_cache *cache;
+        u64 chunk_used, user_thresh;
+        int ret = 1;
+
+        cache = btrfs_lookup_block_group(fs_info, chunk_offset);
+        chunk_used = btrfs_block_group_used(&cache->item);
+
+        user_thresh = div_factor_fine(cache->key.offset, bargs->usage);
+        if (chunk_used < user_thresh)
+                ret = 0;
+
+        btrfs_put_block_group(cache);
+        return ret;
+}
+
+static int chunk_devid_filter(struct extent_buffer *leaf,
+                              struct btrfs_chunk *chunk,
+                              struct btrfs_balance_args *bargs)
+{
+        struct btrfs_stripe *stripe;
+        int num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
+        int i;
+
+        for (i = 0; i < num_stripes; i++) {
+                stripe = btrfs_stripe_nr(chunk, i);
+                if (btrfs_stripe_devid(leaf, stripe) == bargs->devid)
+                        return 0;
+        }
+
+        return 1;
+}
+
+/* [pstart, pend) */
+static int chunk_drange_filter(struct extent_buffer *leaf,
+                               struct btrfs_chunk *chunk,
+                               u64 chunk_offset,
+                               struct btrfs_balance_args *bargs)
+{
+        struct btrfs_stripe *stripe;
+        int num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
+        u64 stripe_offset;
+        u64 stripe_length;
+        int factor;
+        int i;
+
+        if (!(bargs->flags & BTRFS_BALANCE_ARGS_DEVID))
+                return 0;
+
+        if (btrfs_chunk_type(leaf, chunk) & (BTRFS_BLOCK_GROUP_DUP |
+             BTRFS_BLOCK_GROUP_RAID1 | BTRFS_BLOCK_GROUP_RAID10))
+                factor = 2;
+        else
+                factor = 1;
+        factor = num_stripes / factor;
+
+        for (i = 0; i < num_stripes; i++) {
+                stripe = btrfs_stripe_nr(chunk, i);
+                if (btrfs_stripe_devid(leaf, stripe) != bargs->devid)
+                        continue;
+
+                stripe_offset = btrfs_stripe_offset(leaf, stripe);
+                stripe_length = btrfs_chunk_length(leaf, chunk);
+                do_div(stripe_length, factor);
+
+                if (stripe_offset < bargs->pend &&
+                    stripe_offset + stripe_length > bargs->pstart)
+                        return 0;
+        }
+
+        return 1;
+}
+
+/* [vstart, vend) */
+static int chunk_vrange_filter(struct extent_buffer *leaf,
+                               struct btrfs_chunk *chunk,
+                               u64 chunk_offset,
+                               struct btrfs_balance_args *bargs)
+{
+        if (chunk_offset < bargs->vend &&
+            chunk_offset + btrfs_chunk_length(leaf, chunk) > bargs->vstart)
+                /* at least part of the chunk is inside this vrange */
+                return 0;
+
+        return 1;
+}
+
+static int chunk_soft_convert_filter(u64 chunk_profile,
+                                     struct btrfs_balance_args *bargs)
+{
+        if (!(bargs->flags & BTRFS_BALANCE_ARGS_CONVERT))
+                return 0;
+
+        chunk_profile &= BTRFS_BLOCK_GROUP_PROFILE_MASK;
+
+        if (chunk_profile == 0)
+                chunk_profile = BTRFS_AVAIL_ALLOC_BIT_SINGLE;
+
+        if (bargs->target & chunk_profile)
+                return 1;
+
+        return 0;
+}
+
+static int should_balance_chunk(struct btrfs_root *root,
+                                struct extent_buffer *leaf,
+                                struct btrfs_chunk *chunk, u64 chunk_offset)
+{
+        struct btrfs_balance_control *bctl = root->fs_info->balance_ctl;
+        struct btrfs_balance_args *bargs = NULL;
+        u64 chunk_type = btrfs_chunk_type(leaf, chunk);
+
+        /* type filter */
+        if (!((chunk_type & BTRFS_BLOCK_GROUP_TYPE_MASK) &
+              (bctl->flags & BTRFS_BALANCE_TYPE_MASK))) {
+                return 0;
+        }
+
+        if (chunk_type & BTRFS_BLOCK_GROUP_DATA)
+                bargs = &bctl->data;
+        else if (chunk_type & BTRFS_BLOCK_GROUP_SYSTEM)
+                bargs = &bctl->sys;
+        else if (chunk_type & BTRFS_BLOCK_GROUP_METADATA)
+                bargs = &bctl->meta;
+
+        /* profiles filter */
+        if ((bargs->flags & BTRFS_BALANCE_ARGS_PROFILES) &&
+            chunk_profiles_filter(chunk_type, bargs)) {
+                return 0;
+        }
+
+        /* usage filter */
+        if ((bargs->flags & BTRFS_BALANCE_ARGS_USAGE) &&
+            chunk_usage_filter(bctl->fs_info, chunk_offset, bargs)) {
+                return 0;
+        }
+
+        /* devid filter */
+        if ((bargs->flags & BTRFS_BALANCE_ARGS_DEVID) &&
+            chunk_devid_filter(leaf, chunk, bargs)) {
+                return 0;
+        }
+
+        /* drange filter, makes sense only with devid filter */
+        if ((bargs->flags & BTRFS_BALANCE_ARGS_DRANGE) &&
+            chunk_drange_filter(leaf, chunk, chunk_offset, bargs)) {
+                return 0;
+        }
+
+        /* vrange filter */
+        if ((bargs->flags & BTRFS_BALANCE_ARGS_VRANGE) &&
+            chunk_vrange_filter(leaf, chunk, chunk_offset, bargs)) {
+                return 0;
+        }
+
+        /* soft profile changing mode */
+        if ((bargs->flags & BTRFS_BALANCE_ARGS_SOFT) &&
+            chunk_soft_convert_filter(chunk_type, bargs)) {
+                return 0;
+        }
+
+        return 1;
+}
+
 static u64 div_factor(u64 num, int factor)
 {
         if (factor == 10)
@@ -2086,29 +2436,28 @@ static u64 div_factor(u64 num, int factor)
         return num;
 }
 
-int btrfs_balance(struct btrfs_root *dev_root)
+static int __btrfs_balance(struct btrfs_fs_info *fs_info)
 {
-        int ret;
-        struct list_head *devices = &dev_root->fs_info->fs_devices->devices;
+        struct btrfs_balance_control *bctl = fs_info->balance_ctl;
+        struct btrfs_root *chunk_root = fs_info->chunk_root;
+        struct btrfs_root *dev_root = fs_info->dev_root;
+        struct list_head *devices;
         struct btrfs_device *device;
         u64 old_size;
         u64 size_to_free;
+        struct btrfs_chunk *chunk;
         struct btrfs_path *path;
         struct btrfs_key key;
-        struct btrfs_root *chunk_root = dev_root->fs_info->chunk_root;
-        struct btrfs_trans_handle *trans;
         struct btrfs_key found_key;
-
-        if (dev_root->fs_info->sb->s_flags & MS_RDONLY)
-                return -EROFS;
-
-        if (!capable(CAP_SYS_ADMIN))
-                return -EPERM;
-
-        mutex_lock(&dev_root->fs_info->volume_mutex);
-        dev_root = dev_root->fs_info->dev_root;
+        struct btrfs_trans_handle *trans;
+        struct extent_buffer *leaf;
+        int slot;
+        int ret;
+        int enospc_errors = 0;
+        bool counting = true;
 
         /* step one make some room on all the devices */
+        devices = &fs_info->fs_devices->devices;
         list_for_each_entry(device, devices, dev_list) {
                 old_size = device->total_bytes;
                 size_to_free = div_factor(old_size, 1);
@@ -2137,11 +2486,23 @@ int btrfs_balance(struct btrfs_root *dev_root)
                 ret = -ENOMEM;
                 goto error;
         }
+
+        /* zero out stat counters */
+        spin_lock(&fs_info->balance_lock);
+        memset(&bctl->stat, 0, sizeof(bctl->stat));
+        spin_unlock(&fs_info->balance_lock);
+again:
         key.objectid = BTRFS_FIRST_CHUNK_TREE_OBJECTID;
         key.offset = (u64)-1;
         key.type = BTRFS_CHUNK_ITEM_KEY;
 
         while (1) {
+                if ((!counting && atomic_read(&fs_info->balance_pause_req)) ||
+                    atomic_read(&fs_info->balance_cancel_req)) {
+                        ret = -ECANCELED;
+                        goto error;
+                }
+
                 ret = btrfs_search_slot(NULL, chunk_root, &key, path, 0, 0);
                 if (ret < 0)
                         goto error;
@@ -2151,15 +2512,19 @@ int btrfs_balance(struct btrfs_root *dev_root)
                  * failed
                  */
                 if (ret == 0)
-                        break;
+                        BUG(); /* FIXME break ? */
 
                 ret = btrfs_previous_item(chunk_root, path, 0,
                                           BTRFS_CHUNK_ITEM_KEY);
-                if (ret)
+                if (ret) {
+                        ret = 0;
                         break;
+                }
+
+                leaf = path->nodes[0];
+                slot = path->slots[0];
+                btrfs_item_key_to_cpu(leaf, &found_key, slot);
 
-                btrfs_item_key_to_cpu(path->nodes[0], &found_key,
-                                      path->slots[0]);
                 if (found_key.objectid != key.objectid)
                         break;
 
@@ -2167,22 +2532,375 @@ int btrfs_balance(struct btrfs_root *dev_root)
                 if (found_key.offset == 0)
                         break;
 
+                chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk);
+
+                if (!counting) {
+                        spin_lock(&fs_info->balance_lock);
+                        bctl->stat.considered++;
+                        spin_unlock(&fs_info->balance_lock);
+                }
+
+                ret = should_balance_chunk(chunk_root, leaf, chunk,
+                                           found_key.offset);
                 btrfs_release_path(path);
+                if (!ret)
+                        goto loop;
+
+                if (counting) {
+                        spin_lock(&fs_info->balance_lock);
+                        bctl->stat.expected++;
+                        spin_unlock(&fs_info->balance_lock);
+                        goto loop;
+                }
+
                 ret = btrfs_relocate_chunk(chunk_root,
                                            chunk_root->root_key.objectid,
                                            found_key.objectid,
                                            found_key.offset);
                 if (ret && ret != -ENOSPC)
                         goto error;
+                if (ret == -ENOSPC) {
+                        enospc_errors++;
+                } else {
+                        spin_lock(&fs_info->balance_lock);
+                        bctl->stat.completed++;
+                        spin_unlock(&fs_info->balance_lock);
+                }
+loop:
                 key.offset = found_key.offset - 1;
         }
-        ret = 0;
+
+        if (counting) {
+                btrfs_release_path(path);
+                counting = false;
+                goto again;
+        }
 error:
         btrfs_free_path(path);
-        mutex_unlock(&dev_root->fs_info->volume_mutex);
+        if (enospc_errors) {
+                printk(KERN_INFO "btrfs: %d enospc errors during balance\n",
+                       enospc_errors);
+                if (!ret)
+                        ret = -ENOSPC;
+        }
+
         return ret;
 }
 
+static inline int balance_need_close(struct btrfs_fs_info *fs_info)
+{
+        /* cancel requested || normal exit path */
+        return atomic_read(&fs_info->balance_cancel_req) ||
+                (atomic_read(&fs_info->balance_pause_req) == 0 &&
+                 atomic_read(&fs_info->balance_cancel_req) == 0);
+}
+
+static void __cancel_balance(struct btrfs_fs_info *fs_info)
+{
+        int ret;
+
+        unset_balance_control(fs_info);
+        ret = del_balance_item(fs_info->tree_root);
+        BUG_ON(ret);
+}
+
+void update_ioctl_balance_args(struct btrfs_fs_info *fs_info, int lock,
+                               struct btrfs_ioctl_balance_args *bargs);
+
+/*
+ * Should be called with both balance and volume mutexes held
+ */
+int btrfs_balance(struct btrfs_balance_control *bctl,
+                  struct btrfs_ioctl_balance_args *bargs)
+{
+        struct btrfs_fs_info *fs_info = bctl->fs_info;
+        u64 allowed;
+        int ret;
+
+        if (btrfs_fs_closing(fs_info) ||
+            atomic_read(&fs_info->balance_pause_req) ||
+            atomic_read(&fs_info->balance_cancel_req)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        /*
+         * In case of mixed groups both data and meta should be picked,
+         * and identical options should be given for both of them.
+         */
+        allowed = btrfs_super_incompat_flags(fs_info->super_copy);
+        if ((allowed & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS) &&
+            (bctl->flags & (BTRFS_BALANCE_DATA | BTRFS_BALANCE_METADATA))) {
+                if (!(bctl->flags & BTRFS_BALANCE_DATA) ||
+                    !(bctl->flags & BTRFS_BALANCE_METADATA) ||
+                    memcmp(&bctl->data, &bctl->meta, sizeof(bctl->data))) {
+                        printk(KERN_ERR "btrfs: with mixed groups data and "
+                               "metadata balance options must be the same\n");
+                        ret = -EINVAL;
+                        goto out;
+                }
+        }
+
+        /*
+         * Profile changing sanity checks.  Skip them if a simple
+         * balance is requested.
+         */
+        if (!((bctl->data.flags | bctl->sys.flags | bctl->meta.flags) &
+              BTRFS_BALANCE_ARGS_CONVERT))
+                goto do_balance;
+
+        allowed = BTRFS_AVAIL_ALLOC_BIT_SINGLE;
+        if (fs_info->fs_devices->num_devices == 1)
+                allowed |= BTRFS_BLOCK_GROUP_DUP;
+        else if (fs_info->fs_devices->num_devices < 4)
+                allowed |= (BTRFS_BLOCK_GROUP_RAID0 | BTRFS_BLOCK_GROUP_RAID1);
+        else
+                allowed |= (BTRFS_BLOCK_GROUP_RAID0 | BTRFS_BLOCK_GROUP_RAID1 |
+                                BTRFS_BLOCK_GROUP_RAID10);
+
+        if (!profile_is_valid(bctl->data.target, 1) ||
+            bctl->data.target & ~allowed) {
+                printk(KERN_ERR "btrfs: unable to start balance with target "
+                       "data profile %llu\n",
+                       (unsigned long long)bctl->data.target);
+                ret = -EINVAL;
+                goto out;
+        }
+        if (!profile_is_valid(bctl->meta.target, 1) ||
+            bctl->meta.target & ~allowed) {
+                printk(KERN_ERR "btrfs: unable to start balance with target "
+                       "metadata profile %llu\n",
+                       (unsigned long long)bctl->meta.target);
+                ret = -EINVAL;
+                goto out;
+        }
+        if (!profile_is_valid(bctl->sys.target, 1) ||
+            bctl->sys.target & ~allowed) {
+                printk(KERN_ERR "btrfs: unable to start balance with target "
+                       "system profile %llu\n",
+                       (unsigned long long)bctl->sys.target);
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (bctl->data.target & BTRFS_BLOCK_GROUP_DUP) {
+                printk(KERN_ERR "btrfs: dup for data is not allowed\n");
+                ret = -EINVAL;
+                goto out;
+        }
+
+        /* allow to reduce meta or sys integrity only if force set */
+        allowed = BTRFS_BLOCK_GROUP_DUP | BTRFS_BLOCK_GROUP_RAID1 |
+                        BTRFS_BLOCK_GROUP_RAID10;
+        if (((bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
+             (fs_info->avail_system_alloc_bits & allowed) &&
+             !(bctl->sys.target & allowed)) ||
+            ((bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
+             (fs_info->avail_metadata_alloc_bits & allowed) &&
+             !(bctl->meta.target & allowed))) {
+                if (bctl->flags & BTRFS_BALANCE_FORCE) {
+                        printk(KERN_INFO "btrfs: force reducing metadata "
+                               "integrity\n");
+                } else {
+                        printk(KERN_ERR "btrfs: balance will reduce metadata "
+                               "integrity, use force if you want this\n");
+                        ret = -EINVAL;
+                        goto out;
+                }
+        }
+
+do_balance:
+        ret = insert_balance_item(fs_info->tree_root, bctl);
+        if (ret && ret != -EEXIST)
+                goto out;
+
+        if (!(bctl->flags & BTRFS_BALANCE_RESUME)) {
+                BUG_ON(ret == -EEXIST);
+                set_balance_control(bctl);
+        } else {
+                BUG_ON(ret != -EEXIST);
+                spin_lock(&fs_info->balance_lock);
+                update_balance_args(bctl);
+                spin_unlock(&fs_info->balance_lock);
+        }
+
+        atomic_inc(&fs_info->balance_running);
+        mutex_unlock(&fs_info->balance_mutex);
+
+        ret = __btrfs_balance(fs_info);
+
+        mutex_lock(&fs_info->balance_mutex);
+        atomic_dec(&fs_info->balance_running);
+
+        if (bargs) {
+                memset(bargs, 0, sizeof(*bargs));
+                update_ioctl_balance_args(fs_info, 0, bargs);
+        }
+
+        if ((ret && ret != -ECANCELED && ret != -ENOSPC) ||
+            balance_need_close(fs_info)) {
+                __cancel_balance(fs_info);
+        }
+
+        wake_up(&fs_info->balance_wait_q);
+
+        return ret;
+out:
+        if (bctl->flags & BTRFS_BALANCE_RESUME)
+                __cancel_balance(fs_info);
+        else
+                kfree(bctl);
+        return ret;
+}
+
+static int balance_kthread(void *data)
+{
+        struct btrfs_balance_control *bctl =
+                        (struct btrfs_balance_control *)data;
+        struct btrfs_fs_info *fs_info = bctl->fs_info;
+        int ret = 0;
+
+        mutex_lock(&fs_info->volume_mutex);
+        mutex_lock(&fs_info->balance_mutex);
+
+        set_balance_control(bctl);
+
+        if (btrfs_test_opt(fs_info->tree_root, SKIP_BALANCE)) {
+                printk(KERN_INFO "btrfs: force skipping balance\n");
+        } else {
+                printk(KERN_INFO "btrfs: continuing balance\n");
+                ret = btrfs_balance(bctl, NULL);
+        }
+
+        mutex_unlock(&fs_info->balance_mutex);
+        mutex_unlock(&fs_info->volume_mutex);
+        return ret;
+}
+
+int btrfs_recover_balance(struct btrfs_root *tree_root)
+{
+        struct task_struct *tsk;
+        struct btrfs_balance_control *bctl;
+        struct btrfs_balance_item *item;
+        struct btrfs_disk_balance_args disk_bargs;
+        struct btrfs_path *path;
+        struct extent_buffer *leaf;
+        struct btrfs_key key;
+        int ret;
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
+        bctl = kzalloc(sizeof(*bctl), GFP_NOFS);
+        if (!bctl) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        key.objectid = BTRFS_BALANCE_OBJECTID;
+        key.type = BTRFS_BALANCE_ITEM_KEY;
+        key.offset = 0;
+
+        ret = btrfs_search_slot(NULL, tree_root, &key, path, 0, 0);
+        if (ret < 0)
+                goto out_bctl;
+        if (ret > 0) { /* ret = -ENOENT; */
+                ret = 0;
+                goto out_bctl;
+        }
+
+        leaf = path->nodes[0];
+        item = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_balance_item);
+
+        bctl->fs_info = tree_root->fs_info;
+        bctl->flags = btrfs_balance_flags(leaf, item) | BTRFS_BALANCE_RESUME;
+
+        btrfs_balance_data(leaf, item, &disk_bargs);
+        btrfs_disk_balance_args_to_cpu(&bctl->data, &disk_bargs);
+        btrfs_balance_meta(leaf, item, &disk_bargs);
+        btrfs_disk_balance_args_to_cpu(&bctl->meta, &disk_bargs);
+        btrfs_balance_sys(leaf, item, &disk_bargs);
+        btrfs_disk_balance_args_to_cpu(&bctl->sys, &disk_bargs);
+
+        tsk = kthread_run(balance_kthread, bctl, "btrfs-balance");
+        if (IS_ERR(tsk))
+                ret = PTR_ERR(tsk);
+        else
+                goto out;
+
+out_bctl:
+        kfree(bctl);
+out:
+        btrfs_free_path(path);
+        return ret;
+}
+
+int btrfs_pause_balance(struct btrfs_fs_info *fs_info)
+{
+        int ret = 0;
+
+        mutex_lock(&fs_info->balance_mutex);
+        if (!fs_info->balance_ctl) {
+                mutex_unlock(&fs_info->balance_mutex);
+                return -ENOTCONN;
+        }
+
+        if (atomic_read(&fs_info->balance_running)) {
+                atomic_inc(&fs_info->balance_pause_req);
+                mutex_unlock(&fs_info->balance_mutex);
+
+                wait_event(fs_info->balance_wait_q,
+                           atomic_read(&fs_info->balance_running) == 0);
+
+                mutex_lock(&fs_info->balance_mutex);
+                /* we are good with balance_ctl ripped off from under us */
+                BUG_ON(atomic_read(&fs_info->balance_running));
+                atomic_dec(&fs_info->balance_pause_req);
+        } else {
+                ret = -ENOTCONN;
+        }
+
+        mutex_unlock(&fs_info->balance_mutex);
+        return ret;
+}
+
+int btrfs_cancel_balance(struct btrfs_fs_info *fs_info)
+{
+        mutex_lock(&fs_info->balance_mutex);
+        if (!fs_info->balance_ctl) {
+                mutex_unlock(&fs_info->balance_mutex);
+                return -ENOTCONN;
+        }
+
+        atomic_inc(&fs_info->balance_cancel_req);
+        /*
+         * if we are running just wait and return, balance item is
+         * deleted in btrfs_balance in this case
+         */
+        if (atomic_read(&fs_info->balance_running)) {
+                mutex_unlock(&fs_info->balance_mutex);
+                wait_event(fs_info->balance_wait_q,
+                           atomic_read(&fs_info->balance_running) == 0);
+                mutex_lock(&fs_info->balance_mutex);
+        } else {
+                /* __cancel_balance needs volume_mutex */
+                mutex_unlock(&fs_info->balance_mutex);
+                mutex_lock(&fs_info->volume_mutex);
+                mutex_lock(&fs_info->balance_mutex);
+
+                if (fs_info->balance_ctl)
+                        __cancel_balance(fs_info);
+
+                mutex_unlock(&fs_info->volume_mutex);
+        }
+
+        BUG_ON(fs_info->balance_ctl || atomic_read(&fs_info->balance_running));
+        atomic_dec(&fs_info->balance_cancel_req);
+        mutex_unlock(&fs_info->balance_mutex);
+        return 0;
+}
+
 /*
  * shrinking a device means finding all of the device extents past
  * the new size, and then following the back refs to the chunks.
@@ -2323,8 +3041,7 @@ done:
         return ret;
 }
 
-static int btrfs_add_system_chunk(struct btrfs_trans_handle *trans,
-                           struct btrfs_root *root,
+static int btrfs_add_system_chunk(struct btrfs_root *root,
                            struct btrfs_key *key,
                            struct btrfs_chunk *chunk, int item_size)
 {
@@ -2441,10 +3158,14 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
                 max_stripe_size = 1024 * 1024 * 1024;
                 max_chunk_size = 10 * max_stripe_size;
         } else if (type & BTRFS_BLOCK_GROUP_METADATA) {
-                max_stripe_size = 256 * 1024 * 1024;
+                /* for larger filesystems, use larger metadata chunks */
+                if (fs_devices->total_rw_bytes > 50ULL * 1024 * 1024 * 1024)
+                        max_stripe_size = 1024 * 1024 * 1024;
+                else
+                        max_stripe_size = 256 * 1024 * 1024;
                 max_chunk_size = max_stripe_size;
         } else if (type & BTRFS_BLOCK_GROUP_SYSTEM) {
-                max_stripe_size = 8 * 1024 * 1024;
+                max_stripe_size = 32 * 1024 * 1024;
                 max_chunk_size = 2 * max_stripe_size;
         } else {
                 printk(KERN_ERR "btrfs: invalid chunk type 0x%llx requested\n",
@@ -2496,7 +3217,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
                 if (total_avail == 0)
                         continue;
 
-                ret = find_free_dev_extent(trans, device,
+                ret = find_free_dev_extent(device,
                                            max_stripe_size * dev_stripes,
                                            &dev_offset, &max_avail);
                 if (ret && ret != -ENOSPC)
@@ -2687,7 +3408,7 @@ static int __finish_chunk_alloc(struct btrfs_trans_handle *trans,
         BUG_ON(ret);
 
         if (map->type & BTRFS_BLOCK_GROUP_SYSTEM) {
-                ret = btrfs_add_system_chunk(trans, chunk_root, &key, chunk,
+                ret = btrfs_add_system_chunk(chunk_root, &key, chunk,
                                              item_size);
                 BUG_ON(ret);
         }
@@ -2752,8 +3473,7 @@ static noinline int init_first_rw_device(struct btrfs_trans_handle *trans,
                 return ret;
 
         alloc_profile = BTRFS_BLOCK_GROUP_METADATA |
-                        (fs_info->metadata_alloc_profile &
-                         fs_info->avail_metadata_alloc_bits);
+                                fs_info->avail_metadata_alloc_bits;
         alloc_profile = btrfs_reduce_alloc_profile(root, alloc_profile);
 
         ret = __btrfs_alloc_chunk(trans, extent_root, &map, &chunk_size,
@@ -2763,8 +3483,7 @@ static noinline int init_first_rw_device(struct btrfs_trans_handle *trans,
         sys_chunk_offset = chunk_offset + chunk_size;
 
         alloc_profile = BTRFS_BLOCK_GROUP_SYSTEM |
-                        (fs_info->system_alloc_profile &
-                         fs_info->avail_system_alloc_bits);
+                                fs_info->avail_system_alloc_bits;
         alloc_profile = btrfs_reduce_alloc_profile(root, alloc_profile);
 
         ret = __btrfs_alloc_chunk(trans, extent_root, &sys_map,
@@ -2901,26 +3620,13 @@ static int __btrfs_map_block(struct btrfs_mapping_tree *map_tree, int rw,
         u64 stripe_nr;
         u64 stripe_nr_orig;
         u64 stripe_nr_end;
-        int stripes_allocated = 8;
-        int stripes_required = 1;
         int stripe_index;
         int i;
+        int ret = 0;
         int num_stripes;
         int max_errors = 0;
         struct btrfs_bio *bbio = NULL;
 
-        if (bbio_ret && !(rw & (REQ_WRITE | REQ_DISCARD)))
-                stripes_allocated = 1;
-again:
-        if (bbio_ret) {
-                bbio = kzalloc(btrfs_bio_size(stripes_allocated),
-                                GFP_NOFS);
-                if (!bbio)
-                        return -ENOMEM;
-
-                atomic_set(&bbio->error, 0);
-        }
-
         read_lock(&em_tree->lock);
         em = lookup_extent_mapping(em_tree, logical, *length);
         read_unlock(&em_tree->lock);
@@ -2939,32 +3645,6 @@ again:
         if (mirror_num > map->num_stripes)
                 mirror_num = 0;
 
-        /* if our btrfs_bio struct is too small, back off and try again */
-        if (rw & REQ_WRITE) {
-                if (map->type & (BTRFS_BLOCK_GROUP_RAID1 |
-                                 BTRFS_BLOCK_GROUP_DUP)) {
-                        stripes_required = map->num_stripes;
-                        max_errors = 1;
-                } else if (map->type & BTRFS_BLOCK_GROUP_RAID10) {
-                        stripes_required = map->sub_stripes;
-                        max_errors = 1;
-                }
-        }
-        if (rw & REQ_DISCARD) {
-                if (map->type & (BTRFS_BLOCK_GROUP_RAID0 |
-                                 BTRFS_BLOCK_GROUP_RAID1 |
-                                 BTRFS_BLOCK_GROUP_DUP |
-                                 BTRFS_BLOCK_GROUP_RAID10)) {
-                        stripes_required = map->num_stripes;
-                }
-        }
-        if (bbio_ret && (rw & (REQ_WRITE | REQ_DISCARD)) &&
-            stripes_allocated < stripes_required) {
-                stripes_allocated = map->num_stripes;
-                free_extent_map(em);
-                kfree(bbio);
-                goto again;
-        }
         stripe_nr = offset;
         /*
          * stripe_nr counts the total number of stripes we have to stride
@@ -2980,10 +3660,7 @@ again:
 
         if (rw & REQ_DISCARD)
                 *length = min_t(u64, em->len - offset, *length);
-        else if (map->type & (BTRFS_BLOCK_GROUP_RAID0 |
-                              BTRFS_BLOCK_GROUP_RAID1 |
-                              BTRFS_BLOCK_GROUP_RAID10 |
-                              BTRFS_BLOCK_GROUP_DUP)) {
+        else if (map->type & BTRFS_BLOCK_GROUP_PROFILE_MASK) {
                 /* we limit the length of each bio to what fits in a stripe */
                 *length = min_t(u64, em->len - offset,
                                 map->stripe_len - stripe_offset);
@@ -3059,81 +3736,55 @@ again:
         }
         BUG_ON(stripe_index >= map->num_stripes);
 
+        bbio = kzalloc(btrfs_bio_size(num_stripes), GFP_NOFS);
+        if (!bbio) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        atomic_set(&bbio->error, 0);
+
         if (rw & REQ_DISCARD) {
+                int factor = 0;
+                int sub_stripes = 0;
+                u64 stripes_per_dev = 0;
+                u32 remaining_stripes = 0;
+
+                if (map->type &
+                    (BTRFS_BLOCK_GROUP_RAID0 | BTRFS_BLOCK_GROUP_RAID10)) {
+                        if (map->type & BTRFS_BLOCK_GROUP_RAID0)
+                                sub_stripes = 1;
+                        else
+                                sub_stripes = map->sub_stripes;
+
+                        factor = map->num_stripes / sub_stripes;
+                        stripes_per_dev = div_u64_rem(stripe_nr_end -
+                                                      stripe_nr_orig,
+                                                      factor,
+                                                      &remaining_stripes);
+                }
+
                 for (i = 0; i < num_stripes; i++) {
                         bbio->stripes[i].physical =
                                 map->stripes[stripe_index].physical +
                                 stripe_offset + stripe_nr * map->stripe_len;
                         bbio->stripes[i].dev = map->stripes[stripe_index].dev;
 
-                        if (map->type & BTRFS_BLOCK_GROUP_RAID0) {
-                                u64 stripes;
-                                u32 last_stripe = 0;
-                                int j;
-
-                                div_u64_rem(stripe_nr_end - 1,
-                                            map->num_stripes,
-                                            &last_stripe);
-
-                                for (j = 0; j < map->num_stripes; j++) {
-                                        u32 test;
-
-                                        div_u64_rem(stripe_nr_end - 1 - j,
-                                                    map->num_stripes, &test);
-                                        if (test == stripe_index)
-                                                break;
-                                }
-                                stripes = stripe_nr_end - 1 - j;
-                                do_div(stripes, map->num_stripes);
-                                bbio->stripes[i].length = map->stripe_len *
-                                        (stripes - stripe_nr + 1);
-
-                                if (i == 0) {
-                                        bbio->stripes[i].length -=
-                                                stripe_offset;
-                                        stripe_offset = 0;
-                                }
-                                if (stripe_index == last_stripe)
-                                        bbio->stripes[i].length -=
-                                                stripe_end_offset;
-                        } else if (map->type & BTRFS_BLOCK_GROUP_RAID10) {
-                                u64 stripes;
-                                int j;
-                                int factor = map->num_stripes /
-                                             map->sub_stripes;
-                                u32 last_stripe = 0;
-
-                                div_u64_rem(stripe_nr_end - 1,
-                                            factor, &last_stripe);
-                                last_stripe *= map->sub_stripes;
-
-                                for (j = 0; j < factor; j++) {
-                                        u32 test;
-
-                                        div_u64_rem(stripe_nr_end - 1 - j,
-                                                    factor, &test);
-
-                                        if (test ==
-                                            stripe_index / map->sub_stripes)
-                                                break;
-                                }
-                                stripes = stripe_nr_end - 1 - j;
-                                do_div(stripes, factor);
-                                bbio->stripes[i].length = map->stripe_len *
-                                        (stripes - stripe_nr + 1);
-
-                                if (i < map->sub_stripes) {
+                        if (map->type & (BTRFS_BLOCK_GROUP_RAID0 |
+                                         BTRFS_BLOCK_GROUP_RAID10)) {
+                                bbio->stripes[i].length = stripes_per_dev *
+                                                          map->stripe_len;
+                                if (i / sub_stripes < remaining_stripes)
+                                        bbio->stripes[i].length +=
+                                                map->stripe_len;
+                                if (i < sub_stripes)
                                         bbio->stripes[i].length -=
                                                 stripe_offset;
-                                        if (i == map->sub_stripes - 1)
-                                                stripe_offset = 0;
-                                }
-                                if (stripe_index >= last_stripe &&
-                                    stripe_index <= (last_stripe +
-                                                     map->sub_stripes - 1)) {
+                                if ((i / sub_stripes + 1) %
+                                    sub_stripes == remaining_stripes)
                                         bbio->stripes[i].length -=
                                                 stripe_end_offset;
-                                }
+                                if (i == sub_stripes - 1)
+                                        stripe_offset = 0;
                         } else
                                 bbio->stripes[i].length = *length;
 
@@ -3155,15 +3806,22 @@ again:
                         stripe_index++;
                 }
         }
-        if (bbio_ret) {
-                *bbio_ret = bbio;
-                bbio->num_stripes = num_stripes;
-                bbio->max_errors = max_errors;
-                bbio->mirror_num = mirror_num;
+
+        if (rw & REQ_WRITE) {
+                if (map->type & (BTRFS_BLOCK_GROUP_RAID1 |
+                                 BTRFS_BLOCK_GROUP_RAID10 |
+                                 BTRFS_BLOCK_GROUP_DUP)) {
+                        max_errors = 1;
+                }
         }
+
+        *bbio_ret = bbio;
+        bbio->num_stripes = num_stripes;
+        bbio->max_errors = max_errors;
+        bbio->mirror_num = mirror_num;
 out:
         free_extent_map(em);
-        return 0;
+        return ret;
 }
 
 int btrfs_map_block(struct btrfs_mapping_tree *map_tree, int rw,
@@ -3304,7 +3962,7 @@ static noinline int schedule_bio(struct btrfs_root *root,
         /* don't bother with additional async steps for reads, right now */
         if (!(rw & REQ_WRITE)) {
                 bio_get(bio);
-                submit_bio(rw, bio);
+                btrfsic_submit_bio(rw, bio);
                 bio_put(bio);
                 return 0;
         }
@@ -3399,7 +4057,7 @@ int btrfs_map_bio(struct btrfs_root *root, int rw, struct bio *bio,
                         if (async_submit)
                                 schedule_bio(root, dev, rw, bio);
                         else
-                                submit_bio(rw, bio);
+                                btrfsic_submit_bio(rw, bio);
                 } else {
                         bio->bi_bdev = root->fs_info->fs_devices->latest_bdev;
                         bio->bi_sector = logical >> 9;
@@ -3568,7 +4226,7 @@ static int open_seed_devices(struct btrfs_root *root, u8 *fsid)
         struct btrfs_fs_devices *fs_devices;
         int ret;
 
-        mutex_lock(&uuid_mutex);
+        BUG_ON(!mutex_is_locked(&uuid_mutex));
 
         fs_devices = root->fs_info->fs_devices->seed;
         while (fs_devices) {
@@ -3606,7 +4264,6 @@ static int open_seed_devices(struct btrfs_root *root, u8 *fsid)
         fs_devices->seed = root->fs_info->fs_devices->seed;
         root->fs_info->fs_devices->seed = fs_devices;
 out:
-        mutex_unlock(&uuid_mutex);
         return ret;
 }
 
@@ -3749,6 +4406,9 @@ int btrfs_read_chunk_tree(struct btrfs_root *root)
         if (!path)
                 return -ENOMEM;
 
+        mutex_lock(&uuid_mutex);
+        lock_chunks(root);
+
         /* first we search for all of the device items, and then we
          * read in all of the chunk items.  This way we can create chunk
          * mappings that reference all of the devices that are afound
@@ -3799,6 +4459,9 @@ again:
         }
         ret = 0;
 error:
+        unlock_chunks(root);
+        mutex_unlock(&uuid_mutex);
+
         btrfs_free_path(path);
         return ret;
 }
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 78f2d4d4f37f..19ac95048b88 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -186,6 +186,51 @@ struct map_lookup {
 #define map_lookup_size(n) (sizeof(struct map_lookup) + \
                             (sizeof(struct btrfs_bio_stripe) * (n)))
 
+/*
+ * Restriper's general type filter
+ */
+#define BTRFS_BALANCE_DATA              (1ULL << 0)
+#define BTRFS_BALANCE_SYSTEM            (1ULL << 1)
+#define BTRFS_BALANCE_METADATA          (1ULL << 2)
+
+#define BTRFS_BALANCE_TYPE_MASK         (BTRFS_BALANCE_DATA |       \
+                                         BTRFS_BALANCE_SYSTEM |     \
+                                         BTRFS_BALANCE_METADATA)
+
+#define BTRFS_BALANCE_FORCE             (1ULL << 3)
+#define BTRFS_BALANCE_RESUME            (1ULL << 4)
+
+/*
+ * Balance filters
+ */
+#define BTRFS_BALANCE_ARGS_PROFILES     (1ULL << 0)
+#define BTRFS_BALANCE_ARGS_USAGE        (1ULL << 1)
+#define BTRFS_BALANCE_ARGS_DEVID        (1ULL << 2)
+#define BTRFS_BALANCE_ARGS_DRANGE       (1ULL << 3)
+#define BTRFS_BALANCE_ARGS_VRANGE       (1ULL << 4)
+
+/*
+ * Profile changing flags.  When SOFT is set we won't relocate chunk if
+ * it already has the target profile (even though it may be
+ * half-filled).
+ */
+#define BTRFS_BALANCE_ARGS_CONVERT      (1ULL << 8)
+#define BTRFS_BALANCE_ARGS_SOFT         (1ULL << 9)
+
+struct btrfs_balance_args;
+struct btrfs_balance_progress;
+struct btrfs_balance_control {
+        struct btrfs_fs_info *fs_info;
+
+        struct btrfs_balance_args data;
+        struct btrfs_balance_args meta;
+        struct btrfs_balance_args sys;
+
+        u64 flags;
+
+        struct btrfs_balance_progress stat;
+};
+
 int btrfs_account_dev_extents_size(struct btrfs_device *device, u64 start,
                                    u64 end, u64 *length);
 
@@ -228,9 +273,12 @@ struct btrfs_device *btrfs_find_device(struct btrfs_root *root, u64 devid,
                                        u8 *uuid, u8 *fsid);
 int btrfs_shrink_device(struct btrfs_device *device, u64 new_size);
 int btrfs_init_new_device(struct btrfs_root *root, char *path);
-int btrfs_balance(struct btrfs_root *dev_root);
+int btrfs_balance(struct btrfs_balance_control *bctl,
+                  struct btrfs_ioctl_balance_args *bargs);
+int btrfs_recover_balance(struct btrfs_root *tree_root);
+int btrfs_pause_balance(struct btrfs_fs_info *fs_info);
+int btrfs_cancel_balance(struct btrfs_fs_info *fs_info);
 int btrfs_chunk_readonly(struct btrfs_root *root, u64 chunk_offset);
-int find_free_dev_extent(struct btrfs_trans_handle *trans,
-                         struct btrfs_device *device, u64 num_bytes,
+int find_free_dev_extent(struct btrfs_device *device, u64 num_bytes,
                          u64 *start, u64 *max_avail);
 #endif
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index 3848b04e310e..e7a5659087e6 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -200,7 +200,7 @@ int __btrfs_setxattr(struct btrfs_trans_handle *trans,
         ret = btrfs_update_inode(trans, root, inode);
         BUG_ON(ret);
 out:
-        btrfs_end_transaction_throttle(trans, root);
+        btrfs_end_transaction(trans, root);
         return ret;
 }
 
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 74fd74719dc2..618246bc2196 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -973,7 +973,7 @@ static int dentry_lease_is_valid(struct dentry *dentry)
 
         spin_lock(&dentry->d_lock);
         di = ceph_dentry(dentry);
-        if (di && di->lease_session) {
+        if (di->lease_session) {
                 s = di->lease_session;
                 spin_lock(&s->s_cap_lock);
                 gen = s->s_cap_gen;
@@ -1072,13 +1072,11 @@ static void ceph_d_release(struct dentry *dentry)
         struct ceph_dentry_info *di = ceph_dentry(dentry);
 
         dout("d_release %p\n", dentry);
-        if (di) {
-                ceph_dentry_lru_del(dentry);
-                if (di->lease_session)
-                        ceph_put_mds_session(di->lease_session);
-                kmem_cache_free(ceph_dentry_cachep, di);
-                dentry->d_fsdata = NULL;
-        }
+        ceph_dentry_lru_del(dentry);
+        if (di->lease_session)
+                ceph_put_mds_session(di->lease_session);
+        kmem_cache_free(ceph_dentry_cachep, di);
+        dentry->d_fsdata = NULL;
 }
 
 static int ceph_snapdir_d_revalidate(struct dentry *dentry,
@@ -1096,17 +1094,36 @@ static int ceph_snapdir_d_revalidate(struct dentry *dentry,
  */
 void ceph_dir_set_complete(struct inode *inode)
 {
-        /* not yet implemented */
+        struct dentry *dentry = d_find_any_alias(inode);
+        
+        if (dentry && ceph_dentry(dentry) &&
+            ceph_test_mount_opt(ceph_sb_to_client(dentry->d_sb), DCACHE)) {
+                dout(" marking %p (%p) complete\n", inode, dentry);
+                set_bit(CEPH_D_COMPLETE, &ceph_dentry(dentry)->flags);
+        }
+        dput(dentry);
 }
 
 void ceph_dir_clear_complete(struct inode *inode)
 {
-        /* not yet implemented */
+        struct dentry *dentry = d_find_any_alias(inode);
+
+        if (dentry && ceph_dentry(dentry)) {
+                dout(" marking %p (%p) complete\n", inode, dentry);
+                set_bit(CEPH_D_COMPLETE, &ceph_dentry(dentry)->flags);
+        }
+        dput(dentry);
 }
 
 bool ceph_dir_test_complete(struct inode *inode)
 {
-        /* not yet implemented */
+        struct dentry *dentry = d_find_any_alias(inode);
+
+        if (dentry && ceph_dentry(dentry)) {
+                dout(" marking %p (%p) NOT complete\n", inode, dentry);
+                clear_bit(CEPH_D_COMPLETE, &ceph_dentry(dentry)->flags);
+        }
+        dput(dentry);
         return false;
 }
 
@@ -1220,6 +1237,7 @@ static int ceph_dir_fsync(struct file *file, loff_t start, loff_t end,
         do {
                 ceph_mdsc_get_request(req);
                 spin_unlock(&ci->i_unsafe_lock);
+
                 dout("dir_fsync %p wait on tid %llu (until %llu)\n",
                      inode, req->r_tid, last_tid);
                 if (req->r_timeout) {
@@ -1232,9 +1250,9 @@ static int ceph_dir_fsync(struct file *file, loff_t start, loff_t end,
                 } else {
                         wait_for_completion(&req->r_safe_completion);
                 }
-                spin_lock(&ci->i_unsafe_lock);
                 ceph_mdsc_put_request(req);
 
+                spin_lock(&ci->i_unsafe_lock);
                 if (ret || list_empty(head))
                         break;
                 req = list_entry(head->next,
@@ -1259,13 +1277,11 @@ void ceph_dentry_lru_add(struct dentry *dn)
 
         dout("dentry_lru_add %p %p '%.*s'\n", di, dn,
              dn->d_name.len, dn->d_name.name);
-        if (di) {
-                mdsc = ceph_sb_to_client(dn->d_sb)->mdsc;
-                spin_lock(&mdsc->dentry_lru_lock);
-                list_add_tail(&di->lru, &mdsc->dentry_lru);
-                mdsc->num_dentry++;
-                spin_unlock(&mdsc->dentry_lru_lock);
-        }
+        mdsc = ceph_sb_to_client(dn->d_sb)->mdsc;
+        spin_lock(&mdsc->dentry_lru_lock);
+        list_add_tail(&di->lru, &mdsc->dentry_lru);
+        mdsc->num_dentry++;
+        spin_unlock(&mdsc->dentry_lru_lock);
 }
 
 void ceph_dentry_lru_touch(struct dentry *dn)
@@ -1275,12 +1291,10 @@ void ceph_dentry_lru_touch(struct dentry *dn)
 
         dout("dentry_lru_touch %p %p '%.*s' (offset %lld)\n", di, dn,
              dn->d_name.len, dn->d_name.name, di->offset);
-        if (di) {
-                mdsc = ceph_sb_to_client(dn->d_sb)->mdsc;
-                spin_lock(&mdsc->dentry_lru_lock);
-                list_move_tail(&di->lru, &mdsc->dentry_lru);
-                spin_unlock(&mdsc->dentry_lru_lock);
-        }
+        mdsc = ceph_sb_to_client(dn->d_sb)->mdsc;
+        spin_lock(&mdsc->dentry_lru_lock);
+        list_move_tail(&di->lru, &mdsc->dentry_lru);
+        spin_unlock(&mdsc->dentry_lru_lock);
 }
 
 void ceph_dentry_lru_del(struct dentry *dn)
@@ -1290,13 +1304,11 @@ void ceph_dentry_lru_del(struct dentry *dn)
 
         dout("dentry_lru_del %p %p '%.*s'\n", di, dn,
              dn->d_name.len, dn->d_name.name);
-        if (di) {
-                mdsc = ceph_sb_to_client(dn->d_sb)->mdsc;
-                spin_lock(&mdsc->dentry_lru_lock);
-                list_del_init(&di->lru);
-                mdsc->num_dentry--;
-                spin_unlock(&mdsc->dentry_lru_lock);
-        }
+        mdsc = ceph_sb_to_client(dn->d_sb)->mdsc;
+        spin_lock(&mdsc->dentry_lru_lock);
+        list_del_init(&di->lru);
+        mdsc->num_dentry--;
+        spin_unlock(&mdsc->dentry_lru_lock);
 }
 
 /*
diff --git a/fs/ceph/export.c b/fs/ceph/export.c
index 9fbcdecaaccd..fbb2a643ef10 100644
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -56,9 +56,7 @@ static int ceph_encode_fh(struct dentry *dentry, u32 *rawfh, int *max_len,
                 return -EINVAL;
 
         spin_lock(&dentry->d_lock);
-        parent = dget(dentry->d_parent);
-        spin_unlock(&dentry->d_lock);
-
+        parent = dentry->d_parent;
         if (*max_len >= connected_handle_length) {
                 dout("encode_fh %p connectable\n", dentry);
                 cfh->ino = ceph_ino(dentry->d_inode);
@@ -81,7 +79,7 @@ static int ceph_encode_fh(struct dentry *dentry, u32 *rawfh, int *max_len,
                 *max_len = handle_length;
                 type = 255;
         }
-        dput(parent);
+        spin_unlock(&dentry->d_lock);
         return type;
 }
 
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 25283e7a37f8..2c489378b4cd 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -850,11 +850,12 @@ static void ceph_set_dentry_offset(struct dentry *dn)
 {
         struct dentry *dir = dn->d_parent;
         struct inode *inode = dir->d_inode;
-        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_inode_info *ci;
         struct ceph_dentry_info *di;
 
         BUG_ON(!inode);
 
+        ci = ceph_inode(inode);
         di = ceph_dentry(dn);
 
         spin_lock(&ci->i_ceph_lock);
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 6203d805eb45..23ab6a3f1825 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2772,7 +2772,7 @@ static void handle_lease(struct ceph_mds_client *mdsc,
         di = ceph_dentry(dentry);
         switch (h->action) {
         case CEPH_MDS_LEASE_REVOKE:
-                if (di && di->lease_session == session) {
+                if (di->lease_session == session) {
                         if (ceph_seq_cmp(di->lease_seq, seq) > 0)
                                 h->seq = cpu_to_le32(di->lease_seq);
                         __ceph_mdsc_drop_dentry_lease(dentry);
@@ -2781,7 +2781,7 @@ static void handle_lease(struct ceph_mds_client *mdsc,
                 break;
 
         case CEPH_MDS_LEASE_RENEW:
-                if (di && di->lease_session == session &&
+                if (di->lease_session == session &&
                     di->lease_gen == session->s_cap_gen &&
                     di->lease_renew_from &&
                     di->lease_renew_after == 0) {
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 48f61a12af66..00de2c9568cd 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -131,6 +131,8 @@ enum {
         Opt_rbytes,
         Opt_norbytes,
         Opt_noasyncreaddir,
+        Opt_dcache,
+        Opt_nodcache,
         Opt_ino32,
 };
 
@@ -152,6 +154,8 @@ static match_table_t fsopt_tokens = {
         {Opt_rbytes, "rbytes"},
         {Opt_norbytes, "norbytes"},
         {Opt_noasyncreaddir, "noasyncreaddir"},
+        {Opt_dcache, "dcache"},
+        {Opt_nodcache, "nodcache"},
         {Opt_ino32, "ino32"},
         {-1, NULL}
 };
@@ -231,6 +235,12 @@ static int parse_fsopt_token(char *c, void *private)
         case Opt_noasyncreaddir:
                 fsopt->flags |= CEPH_MOUNT_OPT_NOASYNCREADDIR;
                 break;
+        case Opt_dcache:
+                fsopt->flags |= CEPH_MOUNT_OPT_DCACHE;
+                break;
+        case Opt_nodcache:
+                fsopt->flags &= ~CEPH_MOUNT_OPT_DCACHE;
+                break;
         case Opt_ino32:
                 fsopt->flags |= CEPH_MOUNT_OPT_INO32;
                 break;
@@ -377,6 +387,10 @@ static int ceph_show_options(struct seq_file *m, struct dentry *root)
                 seq_puts(m, ",norbytes");
         if (fsopt->flags & CEPH_MOUNT_OPT_NOASYNCREADDIR)
                 seq_puts(m, ",noasyncreaddir");
+        if (fsopt->flags & CEPH_MOUNT_OPT_DCACHE)
+                seq_puts(m, ",dcache");
+        else
+                seq_puts(m, ",nodcache");
 
         if (fsopt->wsize)
                 seq_printf(m, ",wsize=%d", fsopt->wsize);
@@ -647,10 +661,10 @@ static struct dentry *open_root_dentry(struct ceph_fs_client *fsc,
                                 root = ERR_PTR(-ENOMEM);
                                 goto out;
                         }
-                        ceph_init_dentry(root);
                 } else {
                         root = d_obtain_alias(inode);
                 }
+                ceph_init_dentry(root);
                 dout("open_root_inode success, root dentry is %p\n", root);
         } else {
                 root = ERR_PTR(err);
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index cb3652b37271..1421f3d875a2 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -28,6 +28,7 @@
 #define CEPH_MOUNT_OPT_RBYTES          (1<<5) /* dir st_bytes = rbytes */
 #define CEPH_MOUNT_OPT_NOASYNCREADDIR  (1<<7) /* no dcache readdir */
 #define CEPH_MOUNT_OPT_INO32           (1<<8) /* 32 bit inos */
+#define CEPH_MOUNT_OPT_DCACHE          (1<<9) /* use dcache for readdir etc */
 
 #define CEPH_MOUNT_OPT_DEFAULT    (CEPH_MOUNT_OPT_RBYTES)
 
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index a5e36e4488a7..857214ae8c08 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -818,6 +818,7 @@ int ceph_removexattr(struct dentry *dentry, const char *name)
         struct ceph_vxattr_cb *vxattrs = ceph_inode_vxattrs(inode);
         int issued;
         int err;
+        int required_blob_size;
         int dirty;
 
         if (ceph_snap(inode) != CEPH_NOSNAP)
@@ -833,14 +834,34 @@ int ceph_removexattr(struct dentry *dentry, const char *name)
                         return -EOPNOTSUPP;
         }
 
+        err = -ENOMEM;
         spin_lock(&ci->i_ceph_lock);
         __build_xattrs(inode);
+retry:
         issued = __ceph_caps_issued(ci, NULL);
         dout("removexattr %p issued %s\n", inode, ceph_cap_string(issued));
 
         if (!(issued & CEPH_CAP_XATTR_EXCL))
                 goto do_sync;
 
+        required_blob_size = __get_required_blob_size(ci, 0, 0);
+
+        if (!ci->i_xattrs.prealloc_blob ||
+            required_blob_size > ci->i_xattrs.prealloc_blob->alloc_len) {
+                struct ceph_buffer *blob;
+
+                spin_unlock(&ci->i_ceph_lock);
+                dout(" preaallocating new blob size=%d\n", required_blob_size);
+                blob = ceph_buffer_new(required_blob_size, GFP_NOFS);
+                if (!blob)
+                        goto out;
+                spin_lock(&ci->i_ceph_lock);
+                if (ci->i_xattrs.prealloc_blob)
+                        ceph_buffer_put(ci->i_xattrs.prealloc_blob);
+                ci->i_xattrs.prealloc_blob = blob;
+                goto retry;
+        }
+
         err = __remove_xattr_by_name(ceph_inode(inode), name);
         dirty = __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
         ci->i_xattrs.dirty = true;
@@ -853,6 +874,7 @@ int ceph_removexattr(struct dentry *dentry, const char *name)
 do_sync:
         spin_unlock(&ci->i_ceph_lock);
         err = ceph_send_removexattr(dentry, name);
+out:
         return err;
 }
 
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index a10e428b32b4..a26bea10e81b 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -105,6 +105,7 @@
 
 #include <linux/hiddev.h>
 
+#define __DVB_CORE__
 #include <linux/dvb/audio.h>
 #include <linux/dvb/dmx.h>
 #include <linux/dvb/frontend.h>
diff --git a/fs/dcache.c b/fs/dcache.c
index 616fedff011a..16a53cc2cc02 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1475,7 +1475,14 @@ static struct dentry * __d_find_any_alias(struct inode *inode)
         return alias;
 }
 
-static struct dentry * d_find_any_alias(struct inode *inode)
+/**
+ * d_find_any_alias - find any alias for a given inode
+ * @inode: inode to find an alias for
+ *
+ * If any aliases exist for the given inode, take and return a
+ * reference for one of them.  If no aliases exist, return %NULL.
+ */
+struct dentry *d_find_any_alias(struct inode *inode)
 {
         struct dentry *de;
 
@@ -1484,7 +1491,7 @@ static struct dentry * d_find_any_alias(struct inode *inode)
         spin_unlock(&inode->i_lock);
         return de;
 }
-
+EXPORT_SYMBOL(d_find_any_alias);
 
 /**
  * d_obtain_alias - find or allocate a dentry for a given inode
diff --git a/fs/direct-io.c b/fs/direct-io.c
index d740ab67ff6e..4a588dbd11bf 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -36,6 +36,7 @@
 #include <linux/rwsem.h>
 #include <linux/uio.h>
 #include <linux/atomic.h>
+#include <linux/prefetch.h>
 
 /*
  * How many user pages to map in one call to get_user_pages().  This determines
@@ -580,9 +581,8 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
 {
         int ret;
         sector_t fs_startblk;   /* Into file, in filesystem-sized blocks */
+        sector_t fs_endblk;     /* Into file, in filesystem-sized blocks */
         unsigned long fs_count; /* Number of filesystem-sized blocks */
-        unsigned long dio_count;/* Number of dio_block-sized blocks */
-        unsigned long blkmask;
         int create;
 
         /*
@@ -593,11 +593,9 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
         if (ret == 0) {
                 BUG_ON(sdio->block_in_file >= sdio->final_block_in_request);
                 fs_startblk = sdio->block_in_file >> sdio->blkfactor;
-                dio_count = sdio->final_block_in_request - sdio->block_in_file;
-                fs_count = dio_count >> sdio->blkfactor;
-                blkmask = (1 << sdio->blkfactor) - 1;
-                if (dio_count & blkmask)        
-                        fs_count++;
+                fs_endblk = (sdio->final_block_in_request - 1) >>
+                                        sdio->blkfactor;
+                fs_count = fs_endblk - fs_startblk + 1;
 
                 map_bh->b_state = 0;
                 map_bh->b_size = fs_count << dio->inode->i_blkbits;
@@ -1090,8 +1088,8 @@ static inline int drop_refcount(struct dio *dio)
  * individual fields and will generate much worse code. This is important
  * for the whole file.
  */
-ssize_t
-__blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
+static inline ssize_t
+do_blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
         struct block_device *bdev, const struct iovec *iov, loff_t offset, 
         unsigned long nr_segs, get_block_t get_block, dio_iodone_t end_io,
         dio_submit_t submit_io, int flags)
@@ -1100,7 +1098,6 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
         size_t size;
         unsigned long addr;
         unsigned blkbits = inode->i_blkbits;
-        unsigned bdev_blkbits = 0;
         unsigned blocksize_mask = (1 << blkbits) - 1;
         ssize_t retval = -EINVAL;
         loff_t end = offset;
@@ -1113,12 +1110,14 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
         if (rw & WRITE)
                 rw = WRITE_ODIRECT;
 
-        if (bdev)
-                bdev_blkbits = blksize_bits(bdev_logical_block_size(bdev));
+        /*
+         * Avoid references to bdev if not absolutely needed to give
+         * the early prefetch in the caller enough time.
+         */
 
         if (offset & blocksize_mask) {
                 if (bdev)
-                         blkbits = bdev_blkbits;
+                        blkbits = blksize_bits(bdev_logical_block_size(bdev));
                 blocksize_mask = (1 << blkbits) - 1;
                 if (offset & blocksize_mask)
                         goto out;
@@ -1129,11 +1128,13 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
                 addr = (unsigned long)iov[seg].iov_base;
                 size = iov[seg].iov_len;
                 end += size;
-                if ((addr & blocksize_mask) || (size & blocksize_mask))  {
+                if (unlikely((addr & blocksize_mask) ||
+                             (size & blocksize_mask))) {
                         if (bdev)
-                                 blkbits = bdev_blkbits;
+                                blkbits = blksize_bits(
+                                         bdev_logical_block_size(bdev));
                         blocksize_mask = (1 << blkbits) - 1;
-                        if ((addr & blocksize_mask) || (size & blocksize_mask))  
+                        if ((addr & blocksize_mask) || (size & blocksize_mask))
                                 goto out;
                 }
         }
@@ -1316,6 +1317,30 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
 out:
         return retval;
 }
+
+ssize_t
+__blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
+        struct block_device *bdev, const struct iovec *iov, loff_t offset,
+        unsigned long nr_segs, get_block_t get_block, dio_iodone_t end_io,
+        dio_submit_t submit_io, int flags)
+{
+        /*
+         * The block device state is needed in the end to finally
+         * submit everything.  Since it's likely to be cache cold
+         * prefetch it here as first thing to hide some of the
+         * latency.
+         *
+         * Attempt to prefetch the pieces we likely need later.
+         */
+        prefetch(&bdev->bd_disk->part_tbl);
+        prefetch(bdev->bd_queue);
+        prefetch((char *)bdev->bd_queue + SMP_CACHE_BYTES);
+
+        return do_blockdev_direct_IO(rw, iocb, inode, bdev, iov, offset,
+                                     nr_segs, get_block, end_io,
+                                     submit_io, flags);
+}
+
 EXPORT_SYMBOL(__blockdev_direct_IO);
 
 static __init int dio_init(void)
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 828e750af23a..aabdfc38cf24 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -197,6 +197,12 @@ struct eventpoll {
 
         /* The user that created the eventpoll descriptor */
         struct user_struct *user;
+
+        struct file *file;
+
+        /* used to optimize loop detection check */
+        int visited;
+        struct list_head visited_list_link;
 };
 
 /* Wait structure used by the poll hooks */
@@ -255,6 +261,15 @@ static struct kmem_cache *epi_cache __read_mostly;
 /* Slab cache used to allocate "struct eppoll_entry" */
 static struct kmem_cache *pwq_cache __read_mostly;
 
+/* Visited nodes during ep_loop_check(), so we can unset them when we finish */
+static LIST_HEAD(visited_list);
+
+/*
+ * List of files with newly added links, where we may need to limit the number
+ * of emanating paths. Protected by the epmutex.
+ */
+static LIST_HEAD(tfile_check_list);
+
 #ifdef CONFIG_SYSCTL
 
 #include <linux/sysctl.h>
@@ -276,6 +291,12 @@ ctl_table epoll_table[] = {
 };
 #endif /* CONFIG_SYSCTL */
 
+static const struct file_operations eventpoll_fops;
+
+static inline int is_file_epoll(struct file *f)
+{
+        return f->f_op == &eventpoll_fops;
+}
 
 /* Setup the structure that is used as key for the RB tree */
 static inline void ep_set_ffd(struct epoll_filefd *ffd,
@@ -711,12 +732,6 @@ static const struct file_operations eventpoll_fops = {
         .llseek         = noop_llseek,
 };
 
-/* Fast test to see if the file is an eventpoll file */
-static inline int is_file_epoll(struct file *f)
-{
-        return f->f_op == &eventpoll_fops;
-}
-
 /*
  * This is called from eventpoll_release() to unlink files from the eventpoll
  * interface. We need to have this facility to cleanup correctly files that are
@@ -926,6 +941,99 @@ static void ep_rbtree_insert(struct eventpoll *ep, struct epitem *epi)
         rb_insert_color(&epi->rbn, &ep->rbr);
 }
 
+
+
+#define PATH_ARR_SIZE 5
+/*
+ * These are the number paths of length 1 to 5, that we are allowing to emanate
+ * from a single file of interest. For example, we allow 1000 paths of length
+ * 1, to emanate from each file of interest. This essentially represents the
+ * potential wakeup paths, which need to be limited in order to avoid massive
+ * uncontrolled wakeup storms. The common use case should be a single ep which
+ * is connected to n file sources. In this case each file source has 1 path
+ * of length 1. Thus, the numbers below should be more than sufficient. These
+ * path limits are enforced during an EPOLL_CTL_ADD operation, since a modify
+ * and delete can't add additional paths. Protected by the epmutex.
+ */
+static const int path_limits[PATH_ARR_SIZE] = { 1000, 500, 100, 50, 10 };
+static int path_count[PATH_ARR_SIZE];
+
+static int path_count_inc(int nests)
+{
+        if (++path_count[nests] > path_limits[nests])
+                return -1;
+        return 0;
+}
+
+static void path_count_init(void)
+{
+        int i;
+
+        for (i = 0; i < PATH_ARR_SIZE; i++)
+                path_count[i] = 0;
+}
+
+static int reverse_path_check_proc(void *priv, void *cookie, int call_nests)
+{
+        int error = 0;
+        struct file *file = priv;
+        struct file *child_file;
+        struct epitem *epi;
+
+        list_for_each_entry(epi, &file->f_ep_links, fllink) {
+                child_file = epi->ep->file;
+                if (is_file_epoll(child_file)) {
+                        if (list_empty(&child_file->f_ep_links)) {
+                                if (path_count_inc(call_nests)) {
+                                        error = -1;
+                                        break;
+                                }
+                        } else {
+                                error = ep_call_nested(&poll_loop_ncalls,
+                                                        EP_MAX_NESTS,
+                                                        reverse_path_check_proc,
+                                                        child_file, child_file,
+                                                        current);
+                        }
+                        if (error != 0)
+                                break;
+                } else {
+                        printk(KERN_ERR "reverse_path_check_proc: "
+                                "file is not an ep!\n");
+                }
+        }
+        return error;
+}
+
+/**
+ * reverse_path_check - The tfile_check_list is list of file *, which have
+ *                      links that are proposed to be newly added. We need to
+ *                      make sure that those added links don't add too many
+ *                      paths such that we will spend all our time waking up
+ *                      eventpoll objects.
+ *
+ * Returns: Returns zero if the proposed links don't create too many paths,
+ *          -1 otherwise.
+ */
+static int reverse_path_check(void)
+{
+        int length = 0;
+        int error = 0;
+        struct file *current_file;
+
+        /* let's call this for all tfiles */
+        list_for_each_entry(current_file, &tfile_check_list, f_tfile_llink) {
+                length++;
+                path_count_init();
+                error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+                                        reverse_path_check_proc, current_file,
+                                        current_file, current);
+                if (error)
+                        break;
+        }
+        return error;
+}
+
 /*
  * Must be called with "mtx" held.
  */
@@ -987,6 +1095,11 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
          */
         ep_rbtree_insert(ep, epi);
 
+        /* now check if we've created too many backpaths */
+        error = -EINVAL;
+        if (reverse_path_check())
+                goto error_remove_epi;
+
         /* We have to drop the new item inside our item list to keep track of it */
         spin_lock_irqsave(&ep->lock, flags);
 
@@ -1011,6 +1124,14 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
 
         return 0;
 
+error_remove_epi:
+        spin_lock(&tfile->f_lock);
+        if (ep_is_linked(&epi->fllink))
+                list_del_init(&epi->fllink);
+        spin_unlock(&tfile->f_lock);
+
+        rb_erase(&epi->rbn, &ep->rbr);
+
 error_unregister:
         ep_unregister_pollwait(ep, epi);
 
@@ -1275,18 +1396,36 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
         int error = 0;
         struct file *file = priv;
         struct eventpoll *ep = file->private_data;
+        struct eventpoll *ep_tovisit;
         struct rb_node *rbp;
         struct epitem *epi;
 
         mutex_lock_nested(&ep->mtx, call_nests + 1);
+        ep->visited = 1;
+        list_add(&ep->visited_list_link, &visited_list);
         for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
                 epi = rb_entry(rbp, struct epitem, rbn);
                 if (unlikely(is_file_epoll(epi->ffd.file))) {
+                        ep_tovisit = epi->ffd.file->private_data;
+                        if (ep_tovisit->visited)
+                                continue;
                         error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
-                                               ep_loop_check_proc, epi->ffd.file,
-                                               epi->ffd.file->private_data, current);
+                                        ep_loop_check_proc, epi->ffd.file,
+                                        ep_tovisit, current);
                         if (error != 0)
                                 break;
+                } else {
+                        /*
+                         * If we've reached a file that is not associated with
+                         * an ep, then we need to check if the newly added
+                         * links are going to add too many wakeup paths. We do
+                         * this by adding it to the tfile_check_list, if it's
+                         * not already there, and calling reverse_path_check()
+                         * during ep_insert().
+                         */
+                        if (list_empty(&epi->ffd.file->f_tfile_llink))
+                                list_add(&epi->ffd.file->f_tfile_llink,
+                                         &tfile_check_list);
                 }
         }
         mutex_unlock(&ep->mtx);
@@ -1307,8 +1446,31 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
  */
 static int ep_loop_check(struct eventpoll *ep, struct file *file)
 {
-        return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+        int ret;
+        struct eventpoll *ep_cur, *ep_next;
+
+        ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
                               ep_loop_check_proc, file, ep, current);
+        /* clear visited list */
+        list_for_each_entry_safe(ep_cur, ep_next, &visited_list,
+                                                        visited_list_link) {
+                ep_cur->visited = 0;
+                list_del(&ep_cur->visited_list_link);
+        }
+        return ret;
+}
+
+static void clear_tfile_check_list(void)
+{
+        struct file *file;
+
+        /* first clear the tfile_check_list */
+        while (!list_empty(&tfile_check_list)) {
+                file = list_first_entry(&tfile_check_list, struct file,
+                                        f_tfile_llink);
+                list_del_init(&file->f_tfile_llink);
+        }
+        INIT_LIST_HEAD(&tfile_check_list);
 }
 
 /*
@@ -1316,8 +1478,9 @@ static int ep_loop_check(struct eventpoll *ep, struct file *file)
  */
 SYSCALL_DEFINE1(epoll_create1, int, flags)
 {
-        int error;
+        int error, fd;
         struct eventpoll *ep = NULL;
+        struct file *file;
 
         /* Check the EPOLL_* constant for consistency.  */
         BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
@@ -1334,11 +1497,25 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
          * Creates all the items needed to setup an eventpoll file. That is,
          * a file structure and a free file descriptor.
          */
-        error = anon_inode_getfd("[eventpoll]", &eventpoll_fops, ep,
+        fd = get_unused_fd_flags(O_RDWR | (flags & O_CLOEXEC));
+        if (fd < 0) {
+                error = fd;
+                goto out_free_ep;
+        }
+        file = anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep,
                                  O_RDWR | (flags & O_CLOEXEC));
-        if (error < 0)
-                ep_free(ep);
-
+        if (IS_ERR(file)) {
+                error = PTR_ERR(file);
+                goto out_free_fd;
+        }
+        fd_install(fd, file);
+        ep->file = file;
+        return fd;
+
+out_free_fd:
+        put_unused_fd(fd);
+out_free_ep:
+        ep_free(ep);
         return error;
 }
 
@@ -1404,21 +1581,27 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
         /*
          * When we insert an epoll file descriptor, inside another epoll file
          * descriptor, there is the change of creating closed loops, which are
-         * better be handled here, than in more critical paths.
+         * better be handled here, than in more critical paths. While we are
+         * checking for loops we also determine the list of files reachable
+         * and hang them on the tfile_check_list, so we can check that we
+         * haven't created too many possible wakeup paths.
          *
-         * We hold epmutex across the loop check and the insert in this case, in
-         * order to prevent two separate inserts from racing and each doing the
-         * insert "at the same time" such that ep_loop_check passes on both
-         * before either one does the insert, thereby creating a cycle.
+         * We need to hold the epmutex across both ep_insert and ep_remove
+         * b/c we want to make sure we are looking at a coherent view of
+         * epoll network.
          */
-        if (unlikely(is_file_epoll(tfile) && op == EPOLL_CTL_ADD)) {
+        if (op == EPOLL_CTL_ADD || op == EPOLL_CTL_DEL) {
                 mutex_lock(&epmutex);
                 did_lock_epmutex = 1;
-                error = -ELOOP;
-                if (ep_loop_check(ep, tfile) != 0)
-                        goto error_tgt_fput;
         }
-
+        if (op == EPOLL_CTL_ADD) {
+                if (is_file_epoll(tfile)) {
+                        error = -ELOOP;
+                        if (ep_loop_check(ep, tfile) != 0)
+                                goto error_tgt_fput;
+                } else
+                        list_add(&tfile->f_tfile_llink, &tfile_check_list);
+        }
 
         mutex_lock_nested(&ep->mtx, 0);
 
@@ -1437,6 +1620,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                         error = ep_insert(ep, &epds, tfile, fd);
                 } else
                         error = -EEXIST;
+                clear_tfile_check_list();
                 break;
         case EPOLL_CTL_DEL:
                 if (epi)
@@ -1455,7 +1639,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
         mutex_unlock(&ep->mtx);
 
 error_tgt_fput:
-        if (unlikely(did_lock_epmutex))
+        if (did_lock_epmutex)
                 mutex_unlock(&epmutex);
 
         fput(tfile);
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 2aaf3eaaf13d..5f3368ab0fa9 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1378,7 +1378,59 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
         down_read(&fc->killsb);
         err = -ENOENT;
         if (fc->sb)
-                err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
+                err = fuse_reverse_inval_entry(fc->sb, outarg.parent, 0, &name);
+        up_read(&fc->killsb);
+        kfree(buf);
+        return err;
+
+err:
+        kfree(buf);
+        fuse_copy_finish(cs);
+        return err;
+}
+
+static int fuse_notify_delete(struct fuse_conn *fc, unsigned int size,
+                              struct fuse_copy_state *cs)
+{
+        struct fuse_notify_delete_out outarg;
+        int err = -ENOMEM;
+        char *buf;
+        struct qstr name;
+
+        buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
+        if (!buf)
+                goto err;
+
+        err = -EINVAL;
+        if (size < sizeof(outarg))
+                goto err;
+
+        err = fuse_copy_one(cs, &outarg, sizeof(outarg));
+        if (err)
+                goto err;
+
+        err = -ENAMETOOLONG;
+        if (outarg.namelen > FUSE_NAME_MAX)
+                goto err;
+
+        err = -EINVAL;
+        if (size != sizeof(outarg) + outarg.namelen + 1)
+                goto err;
+
+        name.name = buf;
+        name.len = outarg.namelen;
+        err = fuse_copy_one(cs, buf, outarg.namelen + 1);
+        if (err)
+                goto err;
+        fuse_copy_finish(cs);
+        buf[outarg.namelen] = 0;
+        name.hash = full_name_hash(name.name, name.len);
+
+        down_read(&fc->killsb);
+        err = -ENOENT;
+        if (fc->sb)
+                err = fuse_reverse_inval_entry(fc->sb, outarg.parent,
+                                               outarg.child, &name);
         up_read(&fc->killsb);
         kfree(buf);
         return err;
@@ -1597,6 +1649,9 @@ static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
         case FUSE_NOTIFY_RETRIEVE:
                 return fuse_notify_retrieve(fc, size, cs);
 
+        case FUSE_NOTIFY_DELETE:
+                return fuse_notify_delete(fc, size, cs);
+
         default:
                 fuse_copy_finish(cs);
                 return -EINVAL;
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 5ddd6ea8f839..206632887bb4 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -868,7 +868,7 @@ int fuse_update_attributes(struct inode *inode, struct kstat *stat,
 }
 
 int fuse_reverse_inval_entry(struct super_block *sb, u64 parent_nodeid,
-                             struct qstr *name)
+                             u64 child_nodeid, struct qstr *name)
 {
         int err = -ENOTDIR;
         struct inode *parent;
@@ -895,8 +895,36 @@ int fuse_reverse_inval_entry(struct super_block *sb, u64 parent_nodeid,
 
         fuse_invalidate_attr(parent);
         fuse_invalidate_entry(entry);
+
+        if (child_nodeid != 0 && entry->d_inode) {
+                mutex_lock(&entry->d_inode->i_mutex);
+                if (get_node_id(entry->d_inode) != child_nodeid) {
+                        err = -ENOENT;
+                        goto badentry;
+                }
+                if (d_mountpoint(entry)) {
+                        err = -EBUSY;
+                        goto badentry;
+                }
+                if (S_ISDIR(entry->d_inode->i_mode)) {
+                        shrink_dcache_parent(entry);
+                        if (!simple_empty(entry)) {
+                                err = -ENOTEMPTY;
+                                goto badentry;
+                        }
+                        entry->d_inode->i_flags |= S_DEAD;
+                }
+                dont_mount(entry);
+                clear_nlink(entry->d_inode);
+                err = 0;
+ badentry:
+                mutex_unlock(&entry->d_inode->i_mutex);
+                if (!err)
+                        d_delete(entry);
+        } else {
+                err = 0;
+        }
         dput(entry);
-        err = 0;
 
  unlock:
         mutex_unlock(&parent->i_mutex);
@@ -1182,6 +1210,30 @@ static int fuse_dir_fsync(struct file *file, loff_t start, loff_t end,
         return fuse_fsync_common(file, start, end, datasync, 1);
 }
 
+static long fuse_dir_ioctl(struct file *file, unsigned int cmd,
+                            unsigned long arg)
+{
+        struct fuse_conn *fc = get_fuse_conn(file->f_mapping->host);
+
+        /* FUSE_IOCTL_DIR only supported for API version >= 7.18 */
+        if (fc->minor < 18)
+                return -ENOTTY;
+
+        return fuse_ioctl_common(file, cmd, arg, FUSE_IOCTL_DIR);
+}
+
+static long fuse_dir_compat_ioctl(struct file *file, unsigned int cmd,
+                                   unsigned long arg)
+{
+        struct fuse_conn *fc = get_fuse_conn(file->f_mapping->host);
+
+        if (fc->minor < 18)
+                return -ENOTTY;
+
+        return fuse_ioctl_common(file, cmd, arg,
+                                 FUSE_IOCTL_COMPAT | FUSE_IOCTL_DIR);
+}
+
 static bool update_mtime(unsigned ivalid)
 {
         /* Always update if mtime is explicitly set  */
@@ -1596,6 +1648,8 @@ static const struct file_operations fuse_dir_operations = {
         .open           = fuse_dir_open,
         .release        = fuse_dir_release,
         .fsync          = fuse_dir_fsync,
+        .unlocked_ioctl = fuse_dir_ioctl,
+        .compat_ioctl   = fuse_dir_compat_ioctl,
 };
 
 static const struct inode_operations fuse_common_inode_operations = {
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 0c84100acd44..4a199fd93fbd 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1555,48 +1555,16 @@ static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin)
         loff_t retval;
         struct inode *inode = file->f_path.dentry->d_inode;
 
-        mutex_lock(&inode->i_mutex);
-        if (origin != SEEK_CUR && origin != SEEK_SET) {
-                retval = fuse_update_attributes(inode, NULL, file, NULL);
-                if (retval)
-                        goto exit;
-        }
+        /* No i_mutex protection necessary for SEEK_CUR and SEEK_SET */
+        if (origin == SEEK_CUR || origin == SEEK_SET)
+                return generic_file_llseek(file, offset, origin);
 
-        switch (origin) {
-        case SEEK_END:
-                offset += i_size_read(inode);
-                break;
-        case SEEK_CUR:
-                if (offset == 0) {
-                        retval = file->f_pos;
-                        goto exit;
-                }
-                offset += file->f_pos;
-                break;
-        case SEEK_DATA:
-                if (offset >= i_size_read(inode)) {
-                        retval = -ENXIO;
-                        goto exit;
-                }
-                break;
-        case SEEK_HOLE:
-                if (offset >= i_size_read(inode)) {
-                        retval = -ENXIO;
-                        goto exit;
-                }
-                offset = i_size_read(inode);
-                break;
-        }
-        retval = -EINVAL;
-        if (offset >= 0 && offset <= inode->i_sb->s_maxbytes) {
-                if (offset != file->f_pos) {
-                        file->f_pos = offset;
-                        file->f_version = 0;
-                }
-                retval = offset;
-        }
-exit:
+        mutex_lock(&inode->i_mutex);
+        retval = fuse_update_attributes(inode, NULL, file, NULL);
+        if (!retval)
+                retval = generic_file_llseek(file, offset, origin);
         mutex_unlock(&inode->i_mutex);
+
         return retval;
 }
 
@@ -1808,7 +1776,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
         BUILD_BUG_ON(sizeof(struct fuse_ioctl_iovec) * FUSE_IOCTL_MAX_IOV > PAGE_SIZE);
 
         err = -ENOMEM;
-        pages = kzalloc(sizeof(pages[0]) * FUSE_MAX_PAGES_PER_REQ, GFP_KERNEL);
+        pages = kcalloc(FUSE_MAX_PAGES_PER_REQ, sizeof(pages[0]), GFP_KERNEL);
         iov_page = (struct iovec *) __get_free_page(GFP_KERNEL);
         if (!pages || !iov_page)
                 goto out;
@@ -1958,8 +1926,8 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
 }
 EXPORT_SYMBOL_GPL(fuse_do_ioctl);
 
-static long fuse_file_ioctl_common(struct file *file, unsigned int cmd,
-                                   unsigned long arg, unsigned int flags)
+long fuse_ioctl_common(struct file *file, unsigned int cmd,
+                       unsigned long arg, unsigned int flags)
 {
         struct inode *inode = file->f_dentry->d_inode;
         struct fuse_conn *fc = get_fuse_conn(inode);
@@ -1976,13 +1944,13 @@ static long fuse_file_ioctl_common(struct file *file, unsigned int cmd,
 static long fuse_file_ioctl(struct file *file, unsigned int cmd,
                             unsigned long arg)
 {
-        return fuse_file_ioctl_common(file, cmd, arg, 0);
+        return fuse_ioctl_common(file, cmd, arg, 0);
 }
 
 static long fuse_file_compat_ioctl(struct file *file, unsigned int cmd,
                                    unsigned long arg)
 {
-        return fuse_file_ioctl_common(file, cmd, arg, FUSE_IOCTL_COMPAT);
+        return fuse_ioctl_common(file, cmd, arg, FUSE_IOCTL_COMPAT);
 }
 
 /*
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 1964da0257d9..572cefc78012 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -755,9 +755,15 @@ int fuse_reverse_inval_inode(struct super_block *sb, u64 nodeid,
 /**
  * File-system tells the kernel to invalidate parent attributes and
  * the dentry matching parent/name.
+ *
+ * If the child_nodeid is non-zero and:
+ *    - matches the inode number for the dentry matching parent/name,
+ *    - is not a mount point
+ *    - is a file or oan empty directory
+ * then the dentry is unhashed (d_delete()).
  */
 int fuse_reverse_inval_entry(struct super_block *sb, u64 parent_nodeid,
-                             struct qstr *name);
+                             u64 child_nodeid, struct qstr *name);
 
 int fuse_do_open(struct fuse_conn *fc, u64 nodeid, struct file *file,
                  bool isdir);
@@ -765,6 +771,8 @@ ssize_t fuse_direct_io(struct file *file, const char __user *buf,
                        size_t count, loff_t *ppos, int write);
 long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
                    unsigned int flags);
+long fuse_ioctl_common(struct file *file, unsigned int cmd,
+                       unsigned long arg, unsigned int flags);
 unsigned fuse_file_poll(struct file *file, poll_table *wait);
 int fuse_dev_release(struct inode *inode, struct file *file);
 
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 88e8a23d0026..376816fcd040 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1353,7 +1353,7 @@ void gfs2_glock_complete(struct gfs2_glock *gl, int ret)
         spin_lock(&gl->gl_spin);
         gl->gl_reply = ret;
 
-        if (unlikely(test_bit(DFL_BLOCK_LOCKS, &ls->ls_flags))) {
+        if (unlikely(test_bit(DFL_BLOCK_LOCKS, &ls->ls_recover_flags))) {
                 if (gfs2_should_freeze(gl)) {
                         set_bit(GLF_FROZEN, &gl->gl_flags);
                         spin_unlock(&gl->gl_spin);
diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h
index 2553b858a72e..307ac31df781 100644
--- a/fs/gfs2/glock.h
+++ b/fs/gfs2/glock.h
@@ -121,8 +121,11 @@ enum {
 
 struct lm_lockops {
         const char *lm_proto_name;
-        int (*lm_mount) (struct gfs2_sbd *sdp, const char *fsname);
-        void (*lm_unmount) (struct gfs2_sbd *sdp);
+        int (*lm_mount) (struct gfs2_sbd *sdp, const char *table);
+        void (*lm_first_done) (struct gfs2_sbd *sdp);
+        void (*lm_recovery_result) (struct gfs2_sbd *sdp, unsigned int jid,
+                                    unsigned int result);
+        void (*lm_unmount) (struct gfs2_sbd *sdp);
         void (*lm_withdraw) (struct gfs2_sbd *sdp);
         void (*lm_put_lock) (struct gfs2_glock *gl);
         int (*lm_lock) (struct gfs2_glock *gl, unsigned int req_state,
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index e1d3bb59945c..97742a7ea9cc 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -139,8 +139,45 @@ struct gfs2_bufdata {
 #define GDLM_STRNAME_BYTES      25
 #define GDLM_LVB_SIZE           32
 
+/*
+ * ls_recover_flags:
+ *
+ * DFL_BLOCK_LOCKS: dlm is in recovery and will grant locks that had been
+ * held by failed nodes whose journals need recovery.  Those locks should
+ * only be used for journal recovery until the journal recovery is done.
+ * This is set by the dlm recover_prep callback and cleared by the
+ * gfs2_control thread when journal recovery is complete.  To avoid
+ * races between recover_prep setting and gfs2_control clearing, recover_spin
+ * is held while changing this bit and reading/writing recover_block
+ * and recover_start.
+ *
+ * DFL_NO_DLM_OPS: dlm lockspace ops/callbacks are not being used.
+ *
+ * DFL_FIRST_MOUNT: this node is the first to mount this fs and is doing
+ * recovery of all journals before allowing other nodes to mount the fs.
+ * This is cleared when FIRST_MOUNT_DONE is set.
+ *
+ * DFL_FIRST_MOUNT_DONE: this node was the first mounter, and has finished
+ * recovery of all journals, and now allows other nodes to mount the fs.
+ *
+ * DFL_MOUNT_DONE: gdlm_mount has completed successfully and cleared
+ * BLOCK_LOCKS for the first time.  The gfs2_control thread should now
+ * control clearing BLOCK_LOCKS for further recoveries.
+ *
+ * DFL_UNMOUNT: gdlm_unmount sets to keep sdp off gfs2_control_wq.
+ *
+ * DFL_DLM_RECOVERY: set while dlm is in recovery, between recover_prep()
+ * and recover_done(), i.e. set while recover_block == recover_start.
+ */
+
 enum {
         DFL_BLOCK_LOCKS         = 0,
+        DFL_NO_DLM_OPS          = 1,
+        DFL_FIRST_MOUNT         = 2,
+        DFL_FIRST_MOUNT_DONE    = 3,
+        DFL_MOUNT_DONE          = 4,
+        DFL_UNMOUNT             = 5,
+        DFL_DLM_RECOVERY        = 6,
 };
 
 struct lm_lockname {
@@ -392,6 +429,7 @@ struct gfs2_jdesc {
 #define JDF_RECOVERY 1
         unsigned int jd_jid;
         unsigned int jd_blocks;
+        int jd_recover_error;
 };
 
 struct gfs2_statfs_change_host {
@@ -461,6 +499,7 @@ enum {
         SDF_NORECOVERY          = 4,
         SDF_DEMOTE              = 5,
         SDF_NOJOURNALID         = 6,
+        SDF_RORECOVERY          = 7, /* read only recovery */
 };
 
 #define GFS2_FSNAME_LEN         256
@@ -499,14 +538,26 @@ struct gfs2_sb_host {
 struct lm_lockstruct {
         int ls_jid;
         unsigned int ls_first;
-        unsigned int ls_first_done;
         unsigned int ls_nodir;
         const struct lm_lockops *ls_ops;
-        unsigned long ls_flags;
         dlm_lockspace_t *ls_dlm;
 
-        int ls_recover_jid_done;
-        int ls_recover_jid_status;
+        int ls_recover_jid_done;   /* These two are deprecated, */
+        int ls_recover_jid_status; /* used previously by gfs_controld */
+
+        struct dlm_lksb ls_mounted_lksb; /* mounted_lock */
+        struct dlm_lksb ls_control_lksb; /* control_lock */
+        char ls_control_lvb[GDLM_LVB_SIZE]; /* control_lock lvb */
+        struct completion ls_sync_wait; /* {control,mounted}_{lock,unlock} */
+
+        spinlock_t ls_recover_spin; /* protects following fields */
+        unsigned long ls_recover_flags; /* DFL_ */
+        uint32_t ls_recover_mount; /* gen in first recover_done cb */
+        uint32_t ls_recover_start; /* gen in last recover_done cb */
+        uint32_t ls_recover_block; /* copy recover_start in last recover_prep */
+        uint32_t ls_recover_size; /* size of recover_submit, recover_result */
+        uint32_t *ls_recover_submit; /* gen in last recover_slot cb per jid */
+        uint32_t *ls_recover_result; /* result of last jid recovery */
 };
 
 struct gfs2_sbd {
@@ -544,6 +595,7 @@ struct gfs2_sbd {
         wait_queue_head_t sd_glock_wait;
         atomic_t sd_glock_disposal;
         struct completion sd_locking_init;
+        struct delayed_work sd_control_work;
 
         /* Inode Stuff */
 
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 017960cf1d7a..a7d611b93f0f 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -599,9 +599,7 @@ static int link_dinode(struct gfs2_inode *dip, const struct qstr *name,
         error = gfs2_meta_inode_buffer(ip, &dibh);
         if (error)
                 goto fail_end_trans;
-        inc_nlink(&ip->i_inode);
-        if (S_ISDIR(ip->i_inode.i_mode))
-                inc_nlink(&ip->i_inode);
+        set_nlink(&ip->i_inode, S_ISDIR(ip->i_inode.i_mode) ? 2 : 1);
         gfs2_trans_add_bh(ip->i_gl, dibh, 1);
         gfs2_dinode_out(ip, dibh->b_data);
         brelse(dibh);
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index ce85b62bc0a2..8944d1e32ab5 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) Sistina Software, Inc.  1997-2003 All rights reserved.
- * Copyright (C) 2004-2009 Red Hat, Inc.  All rights reserved.
+ * Copyright 2004-2011 Red Hat, Inc.
  *
  * This copyrighted material is made available to anyone wishing to use,
  * modify, copy, or redistribute it subject to the terms and conditions
@@ -11,12 +11,15 @@
 #include <linux/dlm.h>
 #include <linux/slab.h>
 #include <linux/types.h>
+#include <linux/delay.h>
 #include <linux/gfs2_ondisk.h>
 
 #include "incore.h"
 #include "glock.h"
 #include "util.h"
+#include "sys.h"
 
+extern struct workqueue_struct *gfs2_control_wq;
 
 static void gdlm_ast(void *arg)
 {
@@ -185,34 +188,1002 @@ static void gdlm_cancel(struct gfs2_glock *gl)
         dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, DLM_LKF_CANCEL, NULL, gl);
 }
 
-static int gdlm_mount(struct gfs2_sbd *sdp, const char *fsname)
+/*
+ * dlm/gfs2 recovery coordination using dlm_recover callbacks
+ *
+ *  1. dlm_controld sees lockspace members change
+ *  2. dlm_controld blocks dlm-kernel locking activity
+ *  3. dlm_controld within dlm-kernel notifies gfs2 (recover_prep)
+ *  4. dlm_controld starts and finishes its own user level recovery
+ *  5. dlm_controld starts dlm-kernel dlm_recoverd to do kernel recovery
+ *  6. dlm_recoverd notifies gfs2 of failed nodes (recover_slot)
+ *  7. dlm_recoverd does its own lock recovery
+ *  8. dlm_recoverd unblocks dlm-kernel locking activity
+ *  9. dlm_recoverd notifies gfs2 when done (recover_done with new generation)
+ * 10. gfs2_control updates control_lock lvb with new generation and jid bits
+ * 11. gfs2_control enqueues journals for gfs2_recover to recover (maybe none)
+ * 12. gfs2_recover dequeues and recovers journals of failed nodes
+ * 13. gfs2_recover provides recovery results to gfs2_control (recovery_result)
+ * 14. gfs2_control updates control_lock lvb jid bits for recovered journals
+ * 15. gfs2_control unblocks normal locking when all journals are recovered
+ *
+ * - failures during recovery
+ *
+ * recover_prep() may set BLOCK_LOCKS (step 3) again before gfs2_control
+ * clears BLOCK_LOCKS (step 15), e.g. another node fails while still
+ * recovering for a prior failure.  gfs2_control needs a way to detect
+ * this so it can leave BLOCK_LOCKS set in step 15.  This is managed using
+ * the recover_block and recover_start values.
+ *
+ * recover_done() provides a new lockspace generation number each time it
+ * is called (step 9).  This generation number is saved as recover_start.
+ * When recover_prep() is called, it sets BLOCK_LOCKS and sets
+ * recover_block = recover_start.  So, while recover_block is equal to
+ * recover_start, BLOCK_LOCKS should remain set.  (recover_spin must
+ * be held around the BLOCK_LOCKS/recover_block/recover_start logic.)
+ *
+ * - more specific gfs2 steps in sequence above
+ *
+ *  3. recover_prep sets BLOCK_LOCKS and sets recover_block = recover_start
+ *  6. recover_slot records any failed jids (maybe none)
+ *  9. recover_done sets recover_start = new generation number
+ * 10. gfs2_control sets control_lock lvb = new gen + bits for failed jids
+ * 12. gfs2_recover does journal recoveries for failed jids identified above
+ * 14. gfs2_control clears control_lock lvb bits for recovered jids
+ * 15. gfs2_control checks if recover_block == recover_start (step 3 occured
+ *     again) then do nothing, otherwise if recover_start > recover_block
+ *     then clear BLOCK_LOCKS.
+ *
+ * - parallel recovery steps across all nodes
+ *
+ * All nodes attempt to update the control_lock lvb with the new generation
+ * number and jid bits, but only the first to get the control_lock EX will
+ * do so; others will see that it's already done (lvb already contains new
+ * generation number.)
+ *
+ * . All nodes get the same recover_prep/recover_slot/recover_done callbacks
+ * . All nodes attempt to set control_lock lvb gen + bits for the new gen
+ * . One node gets control_lock first and writes the lvb, others see it's done
+ * . All nodes attempt to recover jids for which they see control_lock bits set
+ * . One node succeeds for a jid, and that one clears the jid bit in the lvb
+ * . All nodes will eventually see all lvb bits clear and unblock locks
+ *
+ * - is there a problem with clearing an lvb bit that should be set
+ *   and missing a journal recovery?
+ *
+ * 1. jid fails
+ * 2. lvb bit set for step 1
+ * 3. jid recovered for step 1
+ * 4. jid taken again (new mount)
+ * 5. jid fails (for step 4)
+ * 6. lvb bit set for step 5 (will already be set)
+ * 7. lvb bit cleared for step 3
+ *
+ * This is not a problem because the failure in step 5 does not
+ * require recovery, because the mount in step 4 could not have
+ * progressed far enough to unblock locks and access the fs.  The
+ * control_mount() function waits for all recoveries to be complete
+ * for the latest lockspace generation before ever unblocking locks
+ * and returning.  The mount in step 4 waits until the recovery in
+ * step 1 is done.
+ *
+ * - special case of first mounter: first node to mount the fs
+ *
+ * The first node to mount a gfs2 fs needs to check all the journals
+ * and recover any that need recovery before other nodes are allowed
+ * to mount the fs.  (Others may begin mounting, but they must wait
+ * for the first mounter to be done before taking locks on the fs
+ * or accessing the fs.)  This has two parts:
+ *
+ * 1. The mounted_lock tells a node it's the first to mount the fs.
+ * Each node holds the mounted_lock in PR while it's mounted.
+ * Each node tries to acquire the mounted_lock in EX when it mounts.
+ * If a node is granted the mounted_lock EX it means there are no
+ * other mounted nodes (no PR locks exist), and it is the first mounter.
+ * The mounted_lock is demoted to PR when first recovery is done, so
+ * others will fail to get an EX lock, but will get a PR lock.
+ *
+ * 2. The control_lock blocks others in control_mount() while the first
+ * mounter is doing first mount recovery of all journals.
+ * A mounting node needs to acquire control_lock in EX mode before
+ * it can proceed.  The first mounter holds control_lock in EX while doing
+ * the first mount recovery, blocking mounts from other nodes, then demotes
+ * control_lock to NL when it's done (others_may_mount/first_done),
+ * allowing other nodes to continue mounting.
+ *
+ * first mounter:
+ * control_lock EX/NOQUEUE success
+ * mounted_lock EX/NOQUEUE success (no other PR, so no other mounters)
+ * set first=1
+ * do first mounter recovery
+ * mounted_lock EX->PR
+ * control_lock EX->NL, write lvb generation
+ *
+ * other mounter:
+ * control_lock EX/NOQUEUE success (if fail -EAGAIN, retry)
+ * mounted_lock EX/NOQUEUE fail -EAGAIN (expected due to other mounters PR)
+ * mounted_lock PR/NOQUEUE success
+ * read lvb generation
+ * control_lock EX->NL
+ * set first=0
+ *
+ * - mount during recovery
+ *
+ * If a node mounts while others are doing recovery (not first mounter),
+ * the mounting node will get its initial recover_done() callback without
+ * having seen any previous failures/callbacks.
+ *
+ * It must wait for all recoveries preceding its mount to be finished
+ * before it unblocks locks.  It does this by repeating the "other mounter"
+ * steps above until the lvb generation number is >= its mount generation
+ * number (from initial recover_done) and all lvb bits are clear.
+ *
+ * - control_lock lvb format
+ *
+ * 4 bytes generation number: the latest dlm lockspace generation number
+ * from recover_done callback.  Indicates the jid bitmap has been updated
+ * to reflect all slot failures through that generation.
+ * 4 bytes unused.
+ * GDLM_LVB_SIZE-8 bytes of jid bit map. If bit N is set, it indicates
+ * that jid N needs recovery.
+ */
+
+#define JID_BITMAP_OFFSET 8 /* 4 byte generation number + 4 byte unused */
+
+static void control_lvb_read(struct lm_lockstruct *ls, uint32_t *lvb_gen,
+                             char *lvb_bits)
+{
+        uint32_t gen;
+        memcpy(lvb_bits, ls->ls_control_lvb, GDLM_LVB_SIZE);
+        memcpy(&gen, lvb_bits, sizeof(uint32_t));
+        *lvb_gen = le32_to_cpu(gen);
+}
+
+static void control_lvb_write(struct lm_lockstruct *ls, uint32_t lvb_gen,
+                              char *lvb_bits)
+{
+        uint32_t gen;
+        memcpy(ls->ls_control_lvb, lvb_bits, GDLM_LVB_SIZE);
+        gen = cpu_to_le32(lvb_gen);
+        memcpy(ls->ls_control_lvb, &gen, sizeof(uint32_t));
+}
+
+static int all_jid_bits_clear(char *lvb)
+{
+        int i;
+        for (i = JID_BITMAP_OFFSET; i < GDLM_LVB_SIZE; i++) {
+                if (lvb[i])
+                        return 0;
+        }
+        return 1;
+}
+
+static void sync_wait_cb(void *arg)
+{
+        struct lm_lockstruct *ls = arg;
+        complete(&ls->ls_sync_wait);
+}
+
+static int sync_unlock(struct gfs2_sbd *sdp, struct dlm_lksb *lksb, char *name)
 {
         struct lm_lockstruct *ls = &sdp->sd_lockstruct;
         int error;
 
-        if (fsname == NULL) {
-                fs_info(sdp, "no fsname found\n");
-                return -EINVAL;
+        error = dlm_unlock(ls->ls_dlm, lksb->sb_lkid, 0, lksb, ls);
+        if (error) {
+                fs_err(sdp, "%s lkid %x error %d\n",
+                       name, lksb->sb_lkid, error);
+                return error;
+        }
+
+        wait_for_completion(&ls->ls_sync_wait);
+
+        if (lksb->sb_status != -DLM_EUNLOCK) {
+                fs_err(sdp, "%s lkid %x status %d\n",
+                       name, lksb->sb_lkid, lksb->sb_status);
+                return -1;
+        }
+        return 0;
+}
+
+static int sync_lock(struct gfs2_sbd *sdp, int mode, uint32_t flags,
+                     unsigned int num, struct dlm_lksb *lksb, char *name)
+{
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        char strname[GDLM_STRNAME_BYTES];
+        int error, status;
+
+        memset(strname, 0, GDLM_STRNAME_BYTES);
+        snprintf(strname, GDLM_STRNAME_BYTES, "%8x%16x", LM_TYPE_NONDISK, num);
+
+        error = dlm_lock(ls->ls_dlm, mode, lksb, flags,
+                         strname, GDLM_STRNAME_BYTES - 1,
+                         0, sync_wait_cb, ls, NULL);
+        if (error) {
+                fs_err(sdp, "%s lkid %x flags %x mode %d error %d\n",
+                       name, lksb->sb_lkid, flags, mode, error);
+                return error;
+        }
+
+        wait_for_completion(&ls->ls_sync_wait);
+
+        status = lksb->sb_status;
+
+        if (status && status != -EAGAIN) {
+                fs_err(sdp, "%s lkid %x flags %x mode %d status %d\n",
+                       name, lksb->sb_lkid, flags, mode, status);
+        }
+
+        return status;
+}
+
+static int mounted_unlock(struct gfs2_sbd *sdp)
+{
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        return sync_unlock(sdp, &ls->ls_mounted_lksb, "mounted_lock");
+}
+
+static int mounted_lock(struct gfs2_sbd *sdp, int mode, uint32_t flags)
+{
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        return sync_lock(sdp, mode, flags, GFS2_MOUNTED_LOCK,
+                         &ls->ls_mounted_lksb, "mounted_lock");
+}
+
+static int control_unlock(struct gfs2_sbd *sdp)
+{
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        return sync_unlock(sdp, &ls->ls_control_lksb, "control_lock");
+}
+
+static int control_lock(struct gfs2_sbd *sdp, int mode, uint32_t flags)
+{
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        return sync_lock(sdp, mode, flags, GFS2_CONTROL_LOCK,
+                         &ls->ls_control_lksb, "control_lock");
+}
+
+static void gfs2_control_func(struct work_struct *work)
+{
+        struct gfs2_sbd *sdp = container_of(work, struct gfs2_sbd, sd_control_work.work);
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        char lvb_bits[GDLM_LVB_SIZE];
+        uint32_t block_gen, start_gen, lvb_gen, flags;
+        int recover_set = 0;
+        int write_lvb = 0;
+        int recover_size;
+        int i, error;
+
+        spin_lock(&ls->ls_recover_spin);
+        /*
+         * No MOUNT_DONE means we're still mounting; control_mount()
+         * will set this flag, after which this thread will take over
+         * all further clearing of BLOCK_LOCKS.
+         *
+         * FIRST_MOUNT means this node is doing first mounter recovery,
+         * for which recovery control is handled by
+         * control_mount()/control_first_done(), not this thread.
+         */
+        if (!test_bit(DFL_MOUNT_DONE, &ls->ls_recover_flags) ||
+             test_bit(DFL_FIRST_MOUNT, &ls->ls_recover_flags)) {
+                spin_unlock(&ls->ls_recover_spin);
+                return;
+        }
+        block_gen = ls->ls_recover_block;
+        start_gen = ls->ls_recover_start;
+        spin_unlock(&ls->ls_recover_spin);
+
+        /*
+         * Equal block_gen and start_gen implies we are between
+         * recover_prep and recover_done callbacks, which means
+         * dlm recovery is in progress and dlm locking is blocked.
+         * There's no point trying to do any work until recover_done.
+         */
+
+        if (block_gen == start_gen)
+                return;
+
+        /*
+         * Propagate recover_submit[] and recover_result[] to lvb:
+         * dlm_recoverd adds to recover_submit[] jids needing recovery
+         * gfs2_recover adds to recover_result[] journal recovery results
+         *
+         * set lvb bit for jids in recover_submit[] if the lvb has not
+         * yet been updated for the generation of the failure
+         *
+         * clear lvb bit for jids in recover_result[] if the result of
+         * the journal recovery is SUCCESS
+         */
+
+        error = control_lock(sdp, DLM_LOCK_EX, DLM_LKF_CONVERT|DLM_LKF_VALBLK);
+        if (error) {
+                fs_err(sdp, "control lock EX error %d\n", error);
+                return;
+        }
+
+        control_lvb_read(ls, &lvb_gen, lvb_bits);
+
+        spin_lock(&ls->ls_recover_spin);
+        if (block_gen != ls->ls_recover_block ||
+            start_gen != ls->ls_recover_start) {
+                fs_info(sdp, "recover generation %u block1 %u %u\n",
+                        start_gen, block_gen, ls->ls_recover_block);
+                spin_unlock(&ls->ls_recover_spin);
+                control_lock(sdp, DLM_LOCK_NL, DLM_LKF_CONVERT);
+                return;
+        }
+
+        recover_size = ls->ls_recover_size;
+
+        if (lvb_gen <= start_gen) {
+                /*
+                 * Clear lvb bits for jids we've successfully recovered.
+                 * Because all nodes attempt to recover failed journals,
+                 * a journal can be recovered multiple times successfully
+                 * in succession.  Only the first will really do recovery,
+                 * the others find it clean, but still report a successful
+                 * recovery.  So, another node may have already recovered
+                 * the jid and cleared the lvb bit for it.
+                 */
+                for (i = 0; i < recover_size; i++) {
+                        if (ls->ls_recover_result[i] != LM_RD_SUCCESS)
+                                continue;
+
+                        ls->ls_recover_result[i] = 0;
+
+                        if (!test_bit_le(i, lvb_bits + JID_BITMAP_OFFSET))
+                                continue;
+
+                        __clear_bit_le(i, lvb_bits + JID_BITMAP_OFFSET);
+                        write_lvb = 1;
+                }
+        }
+
+        if (lvb_gen == start_gen) {
+                /*
+                 * Failed slots before start_gen are already set in lvb.
+                 */
+                for (i = 0; i < recover_size; i++) {
+                        if (!ls->ls_recover_submit[i])
+                                continue;
+                        if (ls->ls_recover_submit[i] < lvb_gen)
+                                ls->ls_recover_submit[i] = 0;
+                }
+        } else if (lvb_gen < start_gen) {
+                /*
+                 * Failed slots before start_gen are not yet set in lvb.
+                 */
+                for (i = 0; i < recover_size; i++) {
+                        if (!ls->ls_recover_submit[i])
+                                continue;
+                        if (ls->ls_recover_submit[i] < start_gen) {
+                                ls->ls_recover_submit[i] = 0;
+                                __set_bit_le(i, lvb_bits + JID_BITMAP_OFFSET);
+                        }
+                }
+                /* even if there are no bits to set, we need to write the
+                   latest generation to the lvb */
+                write_lvb = 1;
+        } else {
+                /*
+                 * we should be getting a recover_done() for lvb_gen soon
+                 */
+        }
+        spin_unlock(&ls->ls_recover_spin);
+
+        if (write_lvb) {
+                control_lvb_write(ls, start_gen, lvb_bits);
+                flags = DLM_LKF_CONVERT | DLM_LKF_VALBLK;
+        } else {
+                flags = DLM_LKF_CONVERT;
+        }
+
+        error = control_lock(sdp, DLM_LOCK_NL, flags);
+        if (error) {
+                fs_err(sdp, "control lock NL error %d\n", error);
+                return;
+        }
+
+        /*
+         * Everyone will see jid bits set in the lvb, run gfs2_recover_set(),
+         * and clear a jid bit in the lvb if the recovery is a success.
+         * Eventually all journals will be recovered, all jid bits will
+         * be cleared in the lvb, and everyone will clear BLOCK_LOCKS.
+         */
+
+        for (i = 0; i < recover_size; i++) {
+                if (test_bit_le(i, lvb_bits + JID_BITMAP_OFFSET)) {
+                        fs_info(sdp, "recover generation %u jid %d\n",
+                                start_gen, i);
+                        gfs2_recover_set(sdp, i);
+                        recover_set++;
+                }
+        }
+        if (recover_set)
+                return;
+
+        /*
+         * No more jid bits set in lvb, all recovery is done, unblock locks
+         * (unless a new recover_prep callback has occured blocking locks
+         * again while working above)
+         */
+
+        spin_lock(&ls->ls_recover_spin);
+        if (ls->ls_recover_block == block_gen &&
+            ls->ls_recover_start == start_gen) {
+                clear_bit(DFL_BLOCK_LOCKS, &ls->ls_recover_flags);
+                spin_unlock(&ls->ls_recover_spin);
+                fs_info(sdp, "recover generation %u done\n", start_gen);
+                gfs2_glock_thaw(sdp);
+        } else {
+                fs_info(sdp, "recover generation %u block2 %u %u\n",
+                        start_gen, block_gen, ls->ls_recover_block);
+                spin_unlock(&ls->ls_recover_spin);
+        }
+}
+
+static int control_mount(struct gfs2_sbd *sdp)
+{
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        char lvb_bits[GDLM_LVB_SIZE];
+        uint32_t start_gen, block_gen, mount_gen, lvb_gen;
+        int mounted_mode;
+        int retries = 0;
+        int error;
+
+        memset(&ls->ls_mounted_lksb, 0, sizeof(struct dlm_lksb));
+        memset(&ls->ls_control_lksb, 0, sizeof(struct dlm_lksb));
+        memset(&ls->ls_control_lvb, 0, GDLM_LVB_SIZE);
+        ls->ls_control_lksb.sb_lvbptr = ls->ls_control_lvb;
+        init_completion(&ls->ls_sync_wait);
+
+        set_bit(DFL_BLOCK_LOCKS, &ls->ls_recover_flags);
+
+        error = control_lock(sdp, DLM_LOCK_NL, DLM_LKF_VALBLK);
+        if (error) {
+                fs_err(sdp, "control_mount control_lock NL error %d\n", error);
+                return error;
+        }
+
+        error = mounted_lock(sdp, DLM_LOCK_NL, 0);
+        if (error) {
+                fs_err(sdp, "control_mount mounted_lock NL error %d\n", error);
+                control_unlock(sdp);
+                return error;
+        }
+        mounted_mode = DLM_LOCK_NL;
+
+restart:
+        if (retries++ && signal_pending(current)) {
+                error = -EINTR;
+                goto fail;
+        }
+
+        /*
+         * We always start with both locks in NL. control_lock is
+         * demoted to NL below so we don't need to do it here.
+         */
+
+        if (mounted_mode != DLM_LOCK_NL) {
+                error = mounted_lock(sdp, DLM_LOCK_NL, DLM_LKF_CONVERT);
+                if (error)
+                        goto fail;
+                mounted_mode = DLM_LOCK_NL;
+        }
+
+        /*
+         * Other nodes need to do some work in dlm recovery and gfs2_control
+         * before the recover_done and control_lock will be ready for us below.
+         * A delay here is not required but often avoids having to retry.
+         */
+
+        msleep_interruptible(500);
+
+        /*
+         * Acquire control_lock in EX and mounted_lock in either EX or PR.
+         * control_lock lvb keeps track of any pending journal recoveries.
+         * mounted_lock indicates if any other nodes have the fs mounted.
+         */
+
+        error = control_lock(sdp, DLM_LOCK_EX, DLM_LKF_CONVERT|DLM_LKF_NOQUEUE|DLM_LKF_VALBLK);
+        if (error == -EAGAIN) {
+                goto restart;
+        } else if (error) {
+                fs_err(sdp, "control_mount control_lock EX error %d\n", error);
+                goto fail;
+        }
+
+        error = mounted_lock(sdp, DLM_LOCK_EX, DLM_LKF_CONVERT|DLM_LKF_NOQUEUE);
+        if (!error) {
+                mounted_mode = DLM_LOCK_EX;
+                goto locks_done;
+        } else if (error != -EAGAIN) {
+                fs_err(sdp, "control_mount mounted_lock EX error %d\n", error);
+                goto fail;
+        }
+
+        error = mounted_lock(sdp, DLM_LOCK_PR, DLM_LKF_CONVERT|DLM_LKF_NOQUEUE);
+        if (!error) {
+                mounted_mode = DLM_LOCK_PR;
+                goto locks_done;
+        } else {
+                /* not even -EAGAIN should happen here */
+                fs_err(sdp, "control_mount mounted_lock PR error %d\n", error);
+                goto fail;
+        }
+
+locks_done:
+        /*
+         * If we got both locks above in EX, then we're the first mounter.
+         * If not, then we need to wait for the control_lock lvb to be
+         * updated by other mounted nodes to reflect our mount generation.
+         *
+         * In simple first mounter cases, first mounter will see zero lvb_gen,
+         * but in cases where all existing nodes leave/fail before mounting
+         * nodes finish control_mount, then all nodes will be mounting and
+         * lvb_gen will be non-zero.
+         */
+
+        control_lvb_read(ls, &lvb_gen, lvb_bits);
+
+        if (lvb_gen == 0xFFFFFFFF) {
+                /* special value to force mount attempts to fail */
+                fs_err(sdp, "control_mount control_lock disabled\n");
+                error = -EINVAL;
+                goto fail;
+        }
+
+        if (mounted_mode == DLM_LOCK_EX) {
+                /* first mounter, keep both EX while doing first recovery */
+                spin_lock(&ls->ls_recover_spin);
+                clear_bit(DFL_BLOCK_LOCKS, &ls->ls_recover_flags);
+                set_bit(DFL_MOUNT_DONE, &ls->ls_recover_flags);
+                set_bit(DFL_FIRST_MOUNT, &ls->ls_recover_flags);
+                spin_unlock(&ls->ls_recover_spin);
+                fs_info(sdp, "first mounter control generation %u\n", lvb_gen);
+                return 0;
+        }
+
+        error = control_lock(sdp, DLM_LOCK_NL, DLM_LKF_CONVERT);
+        if (error)
+                goto fail;
+
+        /*
+         * We are not first mounter, now we need to wait for the control_lock
+         * lvb generation to be >= the generation from our first recover_done
+         * and all lvb bits to be clear (no pending journal recoveries.)
+         */
+
+        if (!all_jid_bits_clear(lvb_bits)) {
+                /* journals need recovery, wait until all are clear */
+                fs_info(sdp, "control_mount wait for journal recovery\n");
+                goto restart;
+        }
+
+        spin_lock(&ls->ls_recover_spin);
+        block_gen = ls->ls_recover_block;
+        start_gen = ls->ls_recover_start;
+        mount_gen = ls->ls_recover_mount;
+
+        if (lvb_gen < mount_gen) {
+                /* wait for mounted nodes to update control_lock lvb to our
+                   generation, which might include new recovery bits set */
+                fs_info(sdp, "control_mount wait1 block %u start %u mount %u "
+                        "lvb %u flags %lx\n", block_gen, start_gen, mount_gen,
+                        lvb_gen, ls->ls_recover_flags);
+                spin_unlock(&ls->ls_recover_spin);
+                goto restart;
+        }
+
+        if (lvb_gen != start_gen) {
+                /* wait for mounted nodes to update control_lock lvb to the
+                   latest recovery generation */
+                fs_info(sdp, "control_mount wait2 block %u start %u mount %u "
+                        "lvb %u flags %lx\n", block_gen, start_gen, mount_gen,
+                        lvb_gen, ls->ls_recover_flags);
+                spin_unlock(&ls->ls_recover_spin);
+                goto restart;
+        }
+
+        if (block_gen == start_gen) {
+                /* dlm recovery in progress, wait for it to finish */
+                fs_info(sdp, "control_mount wait3 block %u start %u mount %u "
+                        "lvb %u flags %lx\n", block_gen, start_gen, mount_gen,
+                        lvb_gen, ls->ls_recover_flags);
+                spin_unlock(&ls->ls_recover_spin);
+                goto restart;
         }
 
-        error = dlm_new_lockspace(fsname, NULL, 
-                                  DLM_LSFL_FS | DLM_LSFL_NEWEXCL |
-                                  (ls->ls_nodir ? DLM_LSFL_NODIR : 0),
-                                  GDLM_LVB_SIZE, NULL, NULL, NULL, &ls->ls_dlm);
+        clear_bit(DFL_BLOCK_LOCKS, &ls->ls_recover_flags);
+        set_bit(DFL_MOUNT_DONE, &ls->ls_recover_flags);
+        memset(ls->ls_recover_submit, 0, ls->ls_recover_size*sizeof(uint32_t));
+        memset(ls->ls_recover_result, 0, ls->ls_recover_size*sizeof(uint32_t));
+        spin_unlock(&ls->ls_recover_spin);
+        return 0;
+
+fail:
+        mounted_unlock(sdp);
+        control_unlock(sdp);
+        return error;
+}
+
+static int dlm_recovery_wait(void *word)
+{
+        schedule();
+        return 0;
+}
+
+static int control_first_done(struct gfs2_sbd *sdp)
+{
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        char lvb_bits[GDLM_LVB_SIZE];
+        uint32_t start_gen, block_gen;
+        int error;
+
+restart:
+        spin_lock(&ls->ls_recover_spin);
+        start_gen = ls->ls_recover_start;
+        block_gen = ls->ls_recover_block;
+
+        if (test_bit(DFL_BLOCK_LOCKS, &ls->ls_recover_flags) ||
+            !test_bit(DFL_MOUNT_DONE, &ls->ls_recover_flags) ||
+            !test_bit(DFL_FIRST_MOUNT, &ls->ls_recover_flags)) {
+                /* sanity check, should not happen */
+                fs_err(sdp, "control_first_done start %u block %u flags %lx\n",
+                       start_gen, block_gen, ls->ls_recover_flags);
+                spin_unlock(&ls->ls_recover_spin);
+                control_unlock(sdp);
+                return -1;
+        }
+
+        if (start_gen == block_gen) {
+                /*
+                 * Wait for the end of a dlm recovery cycle to switch from
+                 * first mounter recovery.  We can ignore any recover_slot
+                 * callbacks between the recover_prep and next recover_done
+                 * because we are still the first mounter and any failed nodes
+                 * have not fully mounted, so they don't need recovery.
+                 */
+                spin_unlock(&ls->ls_recover_spin);
+                fs_info(sdp, "control_first_done wait gen %u\n", start_gen);
+
+                wait_on_bit(&ls->ls_recover_flags, DFL_DLM_RECOVERY,
+                            dlm_recovery_wait, TASK_UNINTERRUPTIBLE);
+                goto restart;
+        }
+
+        clear_bit(DFL_FIRST_MOUNT, &ls->ls_recover_flags);
+        set_bit(DFL_FIRST_MOUNT_DONE, &ls->ls_recover_flags);
+        memset(ls->ls_recover_submit, 0, ls->ls_recover_size*sizeof(uint32_t));
+        memset(ls->ls_recover_result, 0, ls->ls_recover_size*sizeof(uint32_t));
+        spin_unlock(&ls->ls_recover_spin);
+
+        memset(lvb_bits, 0, sizeof(lvb_bits));
+        control_lvb_write(ls, start_gen, lvb_bits);
+
+        error = mounted_lock(sdp, DLM_LOCK_PR, DLM_LKF_CONVERT);
+        if (error)
+                fs_err(sdp, "control_first_done mounted PR error %d\n", error);
+
+        error = control_lock(sdp, DLM_LOCK_NL, DLM_LKF_CONVERT|DLM_LKF_VALBLK);
         if (error)
-                printk(KERN_ERR "dlm_new_lockspace error %d", error);
+                fs_err(sdp, "control_first_done control NL error %d\n", error);
 
         return error;
 }
 
+/*
+ * Expand static jid arrays if necessary (by increments of RECOVER_SIZE_INC)
+ * to accomodate the largest slot number.  (NB dlm slot numbers start at 1,
+ * gfs2 jids start at 0, so jid = slot - 1)
+ */
+
+#define RECOVER_SIZE_INC 16
+
+static int set_recover_size(struct gfs2_sbd *sdp, struct dlm_slot *slots,
+                            int num_slots)
+{
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        uint32_t *submit = NULL;
+        uint32_t *result = NULL;
+        uint32_t old_size, new_size;
+        int i, max_jid;
+
+        max_jid = 0;
+        for (i = 0; i < num_slots; i++) {
+                if (max_jid < slots[i].slot - 1)
+                        max_jid = slots[i].slot - 1;
+        }
+
+        old_size = ls->ls_recover_size;
+
+        if (old_size >= max_jid + 1)
+                return 0;
+
+        new_size = old_size + RECOVER_SIZE_INC;
+
+        submit = kzalloc(new_size * sizeof(uint32_t), GFP_NOFS);
+        result = kzalloc(new_size * sizeof(uint32_t), GFP_NOFS);
+        if (!submit || !result) {
+                kfree(submit);
+                kfree(result);
+                return -ENOMEM;
+        }
+
+        spin_lock(&ls->ls_recover_spin);
+        memcpy(submit, ls->ls_recover_submit, old_size * sizeof(uint32_t));
+        memcpy(result, ls->ls_recover_result, old_size * sizeof(uint32_t));
+        kfree(ls->ls_recover_submit);
+        kfree(ls->ls_recover_result);
+        ls->ls_recover_submit = submit;
+        ls->ls_recover_result = result;
+        ls->ls_recover_size = new_size;
+        spin_unlock(&ls->ls_recover_spin);
+        return 0;
+}
+
+static void free_recover_size(struct lm_lockstruct *ls)
+{
+        kfree(ls->ls_recover_submit);
+        kfree(ls->ls_recover_result);
+        ls->ls_recover_submit = NULL;
+        ls->ls_recover_result = NULL;
+        ls->ls_recover_size = 0;
+}
+
+/* dlm calls before it does lock recovery */
+
+static void gdlm_recover_prep(void *arg)
+{
+        struct gfs2_sbd *sdp = arg;
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+
+        spin_lock(&ls->ls_recover_spin);
+        ls->ls_recover_block = ls->ls_recover_start;
+        set_bit(DFL_DLM_RECOVERY, &ls->ls_recover_flags);
+
+        if (!test_bit(DFL_MOUNT_DONE, &ls->ls_recover_flags) ||
+             test_bit(DFL_FIRST_MOUNT, &ls->ls_recover_flags)) {
+                spin_unlock(&ls->ls_recover_spin);
+                return;
+        }
+        set_bit(DFL_BLOCK_LOCKS, &ls->ls_recover_flags);
+        spin_unlock(&ls->ls_recover_spin);
+}
+
+/* dlm calls after recover_prep has been completed on all lockspace members;
+   identifies slot/jid of failed member */
+
+static void gdlm_recover_slot(void *arg, struct dlm_slot *slot)
+{
+        struct gfs2_sbd *sdp = arg;
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        int jid = slot->slot - 1;
+
+        spin_lock(&ls->ls_recover_spin);
+        if (ls->ls_recover_size < jid + 1) {
+                fs_err(sdp, "recover_slot jid %d gen %u short size %d",
+                       jid, ls->ls_recover_block, ls->ls_recover_size);
+                spin_unlock(&ls->ls_recover_spin);
+                return;
+        }
+
+        if (ls->ls_recover_submit[jid]) {
+                fs_info(sdp, "recover_slot jid %d gen %u prev %u",
+                        jid, ls->ls_recover_block, ls->ls_recover_submit[jid]);
+        }
+        ls->ls_recover_submit[jid] = ls->ls_recover_block;
+        spin_unlock(&ls->ls_recover_spin);
+}
+
+/* dlm calls after recover_slot and after it completes lock recovery */
+
+static void gdlm_recover_done(void *arg, struct dlm_slot *slots, int num_slots,
+                              int our_slot, uint32_t generation)
+{
+        struct gfs2_sbd *sdp = arg;
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+
+        /* ensure the ls jid arrays are large enough */
+        set_recover_size(sdp, slots, num_slots);
+
+        spin_lock(&ls->ls_recover_spin);
+        ls->ls_recover_start = generation;
+
+        if (!ls->ls_recover_mount) {
+                ls->ls_recover_mount = generation;
+                ls->ls_jid = our_slot - 1;
+        }
+
+        if (!test_bit(DFL_UNMOUNT, &ls->ls_recover_flags))
+                queue_delayed_work(gfs2_control_wq, &sdp->sd_control_work, 0);
+
+        clear_bit(DFL_DLM_RECOVERY, &ls->ls_recover_flags);
+        smp_mb__after_clear_bit();
+        wake_up_bit(&ls->ls_recover_flags, DFL_DLM_RECOVERY);
+        spin_unlock(&ls->ls_recover_spin);
+}
+
+/* gfs2_recover thread has a journal recovery result */
+
+static void gdlm_recovery_result(struct gfs2_sbd *sdp, unsigned int jid,
+                                 unsigned int result)
+{
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+
+        if (test_bit(DFL_NO_DLM_OPS, &ls->ls_recover_flags))
+                return;
+
+        /* don't care about the recovery of own journal during mount */
+        if (jid == ls->ls_jid)
+                return;
+
+        spin_lock(&ls->ls_recover_spin);
+        if (test_bit(DFL_FIRST_MOUNT, &ls->ls_recover_flags)) {
+                spin_unlock(&ls->ls_recover_spin);
+                return;
+        }
+        if (ls->ls_recover_size < jid + 1) {
+                fs_err(sdp, "recovery_result jid %d short size %d",
+                       jid, ls->ls_recover_size);
+                spin_unlock(&ls->ls_recover_spin);
+                return;
+        }
+
+        fs_info(sdp, "recover jid %d result %s\n", jid,
+                result == LM_RD_GAVEUP ? "busy" : "success");
+
+        ls->ls_recover_result[jid] = result;
+
+        /* GAVEUP means another node is recovering the journal; delay our
+           next attempt to recover it, to give the other node a chance to
+           finish before trying again */
+
+        if (!test_bit(DFL_UNMOUNT, &ls->ls_recover_flags))
+                queue_delayed_work(gfs2_control_wq, &sdp->sd_control_work,
+                                   result == LM_RD_GAVEUP ? HZ : 0);
+        spin_unlock(&ls->ls_recover_spin);
+}
+
+const struct dlm_lockspace_ops gdlm_lockspace_ops = {
+        .recover_prep = gdlm_recover_prep,
+        .recover_slot = gdlm_recover_slot,
+        .recover_done = gdlm_recover_done,
+};
+
+static int gdlm_mount(struct gfs2_sbd *sdp, const char *table)
+{
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        char cluster[GFS2_LOCKNAME_LEN];
+        const char *fsname;
+        uint32_t flags;
+        int error, ops_result;
+
+        /*
+         * initialize everything
+         */
+
+        INIT_DELAYED_WORK(&sdp->sd_control_work, gfs2_control_func);
+        spin_lock_init(&ls->ls_recover_spin);
+        ls->ls_recover_flags = 0;
+        ls->ls_recover_mount = 0;
+        ls->ls_recover_start = 0;
+        ls->ls_recover_block = 0;
+        ls->ls_recover_size = 0;
+        ls->ls_recover_submit = NULL;
+        ls->ls_recover_result = NULL;
+
+        error = set_recover_size(sdp, NULL, 0);
+        if (error)
+                goto fail;
+
+        /*
+         * prepare dlm_new_lockspace args
+         */
+
+        fsname = strchr(table, ':');
+        if (!fsname) {
+                fs_info(sdp, "no fsname found\n");
+                error = -EINVAL;
+                goto fail_free;
+        }
+        memset(cluster, 0, sizeof(cluster));
+        memcpy(cluster, table, strlen(table) - strlen(fsname));
+        fsname++;
+
+        flags = DLM_LSFL_FS | DLM_LSFL_NEWEXCL;
+        if (ls->ls_nodir)
+                flags |= DLM_LSFL_NODIR;
+
+        /*
+         * create/join lockspace
+         */
+
+        error = dlm_new_lockspace(fsname, cluster, flags, GDLM_LVB_SIZE,
+                                  &gdlm_lockspace_ops, sdp, &ops_result,
+                                  &ls->ls_dlm);
+        if (error) {
+                fs_err(sdp, "dlm_new_lockspace error %d\n", error);
+                goto fail_free;
+        }
+
+        if (ops_result < 0) {
+                /*
+                 * dlm does not support ops callbacks,
+                 * old dlm_controld/gfs_controld are used, try without ops.
+                 */
+                fs_info(sdp, "dlm lockspace ops not used\n");
+                free_recover_size(ls);
+                set_bit(DFL_NO_DLM_OPS, &ls->ls_recover_flags);
+                return 0;
+        }
+
+        if (!test_bit(SDF_NOJOURNALID, &sdp->sd_flags)) {
+                fs_err(sdp, "dlm lockspace ops disallow jid preset\n");
+                error = -EINVAL;
+                goto fail_release;
+        }
+
+        /*
+         * control_mount() uses control_lock to determine first mounter,
+         * and for later mounts, waits for any recoveries to be cleared.
+         */
+
+        error = control_mount(sdp);
+        if (error) {
+                fs_err(sdp, "mount control error %d\n", error);
+                goto fail_release;
+        }
+
+        ls->ls_first = !!test_bit(DFL_FIRST_MOUNT, &ls->ls_recover_flags);
+        clear_bit(SDF_NOJOURNALID, &sdp->sd_flags);
+        smp_mb__after_clear_bit();
+        wake_up_bit(&sdp->sd_flags, SDF_NOJOURNALID);
+        return 0;
+
+fail_release:
+        dlm_release_lockspace(ls->ls_dlm, 2);
+fail_free:
+        free_recover_size(ls);
+fail:
+        return error;
+}
+
+static void gdlm_first_done(struct gfs2_sbd *sdp)
+{
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        int error;
+
+        if (test_bit(DFL_NO_DLM_OPS, &ls->ls_recover_flags))
+                return;
+
+        error = control_first_done(sdp);
+        if (error)
+                fs_err(sdp, "mount first_done error %d\n", error);
+}
+
 static void gdlm_unmount(struct gfs2_sbd *sdp)
 {
         struct lm_lockstruct *ls = &sdp->sd_lockstruct;
 
+        if (test_bit(DFL_NO_DLM_OPS, &ls->ls_recover_flags))
+                goto release;
+
+        /* wait for gfs2_control_wq to be done with this mount */
+
+        spin_lock(&ls->ls_recover_spin);
+        set_bit(DFL_UNMOUNT, &ls->ls_recover_flags);
+        spin_unlock(&ls->ls_recover_spin);
+        flush_delayed_work_sync(&sdp->sd_control_work);
+
+        /* mounted_lock and control_lock will be purged in dlm recovery */
+release:
         if (ls->ls_dlm) {
                 dlm_release_lockspace(ls->ls_dlm, 2);
                 ls->ls_dlm = NULL;
         }
+
+        free_recover_size(ls);
 }
 
 static const match_table_t dlm_tokens = {
@@ -226,6 +1197,8 @@ static const match_table_t dlm_tokens = {
 const struct lm_lockops gfs2_dlm_ops = {
         .lm_proto_name = "lock_dlm",
         .lm_mount = gdlm_mount,
+        .lm_first_done = gdlm_first_done,
+        .lm_recovery_result = gdlm_recovery_result,
         .lm_unmount = gdlm_unmount,
         .lm_put_lock = gdlm_put_lock,
         .lm_lock = gdlm_lock,
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index c150298e2d8e..a8d9bcd0e19c 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -28,6 +28,8 @@
 #include "recovery.h"
 #include "dir.h"
 
+struct workqueue_struct *gfs2_control_wq;
+
 static struct shrinker qd_shrinker = {
         .shrink = gfs2_shrink_qd_memory,
         .seeks = DEFAULT_SEEKS,
@@ -146,12 +148,19 @@ static int __init init_gfs2_fs(void)
         if (!gfs_recovery_wq)
                 goto fail_wq;
 
+        gfs2_control_wq = alloc_workqueue("gfs2_control",
+                               WQ_NON_REENTRANT | WQ_UNBOUND | WQ_FREEZABLE, 0);
+        if (!gfs2_control_wq)
+                goto fail_control;
+
         gfs2_register_debugfs();
 
         printk("GFS2 installed\n");
 
         return 0;
 
+fail_control:
+        destroy_workqueue(gfs_recovery_wq);
 fail_wq:
         unregister_filesystem(&gfs2meta_fs_type);
 fail_unregister:
@@ -195,6 +204,7 @@ static void __exit exit_gfs2_fs(void)
         unregister_filesystem(&gfs2_fs_type);
         unregister_filesystem(&gfs2meta_fs_type);
         destroy_workqueue(gfs_recovery_wq);
+        destroy_workqueue(gfs2_control_wq);
 
         rcu_barrier();
 
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index fe72e79e6ff9..6aacf3f230a2 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -562,8 +562,12 @@ static void gfs2_others_may_mount(struct gfs2_sbd *sdp)
 {
         char *message = "FIRSTMOUNT=Done";
         char *envp[] = { message, NULL };
-        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
-        ls->ls_first_done = 1;
+
+        fs_info(sdp, "first mount done, others may mount\n");
+
+        if (sdp->sd_lockstruct.ls_ops->lm_first_done)
+                sdp->sd_lockstruct.ls_ops->lm_first_done(sdp);
+
         kobject_uevent_env(&sdp->sd_kobj, KOBJ_CHANGE, envp);
 }
 
@@ -944,7 +948,6 @@ static int gfs2_lm_mount(struct gfs2_sbd *sdp, int silent)
         struct gfs2_args *args = &sdp->sd_args;
         const char *proto = sdp->sd_proto_name;
         const char *table = sdp->sd_table_name;
-        const char *fsname;
         char *o, *options;
         int ret;
 
@@ -1004,21 +1007,12 @@ hostdata_error:
                 }
         }
 
-        if (sdp->sd_args.ar_spectator)
-                snprintf(sdp->sd_fsname, GFS2_FSNAME_LEN, "%s.s", table);
-        else
-                snprintf(sdp->sd_fsname, GFS2_FSNAME_LEN, "%s.%u", table,
-                         sdp->sd_lockstruct.ls_jid);
-
-        fsname = strchr(table, ':');
-        if (fsname)
-                fsname++;
         if (lm->lm_mount == NULL) {
                 fs_info(sdp, "Now mounting FS...\n");
                 complete_all(&sdp->sd_locking_init);
                 return 0;
         }
-        ret = lm->lm_mount(sdp, fsname);
+        ret = lm->lm_mount(sdp, table);
         if (ret == 0)
                 fs_info(sdp, "Joined cluster. Now mounting FS...\n");
         complete_all(&sdp->sd_locking_init);
@@ -1084,7 +1078,7 @@ static int fill_super(struct super_block *sb, struct gfs2_args *args, int silent
 
         if (sdp->sd_args.ar_spectator) {
                 sb->s_flags |= MS_RDONLY;
-                set_bit(SDF_NORECOVERY, &sdp->sd_flags);
+                set_bit(SDF_RORECOVERY, &sdp->sd_flags);
         }
         if (sdp->sd_args.ar_posix_acl)
                 sb->s_flags |= MS_POSIXACL;
@@ -1124,6 +1118,8 @@ static int fill_super(struct super_block *sb, struct gfs2_args *args, int silent
         if (error)
                 goto fail;
 
+        snprintf(sdp->sd_fsname, GFS2_FSNAME_LEN, "%s", sdp->sd_table_name);
+
         gfs2_create_debugfs_file(sdp);
 
         error = gfs2_sys_fs_add(sdp);
@@ -1160,6 +1156,13 @@ static int fill_super(struct super_block *sb, struct gfs2_args *args, int silent
                 goto fail_sb;
         }
 
+        if (sdp->sd_args.ar_spectator)
+                snprintf(sdp->sd_fsname, GFS2_FSNAME_LEN, "%s.s",
+                         sdp->sd_table_name);
+        else
+                snprintf(sdp->sd_fsname, GFS2_FSNAME_LEN, "%s.%u",
+                         sdp->sd_table_name, sdp->sd_lockstruct.ls_jid);
+
         error = init_inodes(sdp, DO);
         if (error)
                 goto fail_sb;
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index f2a02edcac8f..963b2d75200c 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -436,12 +436,16 @@ static void gfs2_recovery_done(struct gfs2_sbd *sdp, unsigned int jid,
         char env_status[20];
         char *envp[] = { env_jid, env_status, NULL };
         struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+
         ls->ls_recover_jid_done = jid;
         ls->ls_recover_jid_status = message;
         sprintf(env_jid, "JID=%d", jid);
         sprintf(env_status, "RECOVERY=%s",
                 message == LM_RD_SUCCESS ? "Done" : "Failed");
         kobject_uevent_env(&sdp->sd_kobj, KOBJ_CHANGE, envp);
+
+        if (sdp->sd_lockstruct.ls_ops->lm_recovery_result)
+                sdp->sd_lockstruct.ls_ops->lm_recovery_result(sdp, jid, message);
 }
 
 void gfs2_recover_func(struct work_struct *work)
@@ -512,7 +516,9 @@ void gfs2_recover_func(struct work_struct *work)
                 if (error)
                         goto fail_gunlock_ji;
 
-                if (test_bit(SDF_JOURNAL_CHECKED, &sdp->sd_flags)) {
+                if (test_bit(SDF_RORECOVERY, &sdp->sd_flags)) {
+                        ro = 1;
+                } else if (test_bit(SDF_JOURNAL_CHECKED, &sdp->sd_flags)) {
                         if (!test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags))
                                 ro = 1;
                 } else {
@@ -577,6 +583,7 @@ fail_gunlock_j:
 
         fs_info(sdp, "jid=%u: %s\n", jd->jd_jid, (error) ? "Failed" : "Done");
 fail:
+        jd->jd_recover_error = error;
         gfs2_recovery_done(sdp, jd->jd_jid, LM_RD_GAVEUP);
 done:
         clear_bit(JDF_RECOVERY, &jd->jd_flags);
@@ -605,6 +612,6 @@ int gfs2_recover_journal(struct gfs2_jdesc *jd, bool wait)
                 wait_on_bit(&jd->jd_flags, JDF_RECOVERY, gfs2_recovery_wait,
                             TASK_UNINTERRUPTIBLE);
 
-        return 0;
+        return wait ? jd->jd_recover_error : 0;
 }
 
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 22234627f684..981bfa32121a 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -1108,9 +1108,9 @@ void gfs2_inplace_release(struct gfs2_inode *ip)
 {
         struct gfs2_blkreserv *rs = ip->i_res;
 
-        gfs2_blkrsv_put(ip);
         if (rs->rs_rgd_gh.gh_gl)
                 gfs2_glock_dq_uninit(&rs->rs_rgd_gh);
+        gfs2_blkrsv_put(ip);
 }
 
 /**
diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index 443cabcfcd23..d33172c291ba 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -298,7 +298,7 @@ static ssize_t block_show(struct gfs2_sbd *sdp, char *buf)
         ssize_t ret;
         int val = 0;
 
-        if (test_bit(DFL_BLOCK_LOCKS, &ls->ls_flags))
+        if (test_bit(DFL_BLOCK_LOCKS, &ls->ls_recover_flags))
                 val = 1;
         ret = sprintf(buf, "%d\n", val);
         return ret;
@@ -313,9 +313,9 @@ static ssize_t block_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
         val = simple_strtol(buf, NULL, 0);
 
         if (val == 1)
-                set_bit(DFL_BLOCK_LOCKS, &ls->ls_flags);
+                set_bit(DFL_BLOCK_LOCKS, &ls->ls_recover_flags);
         else if (val == 0) {
-                clear_bit(DFL_BLOCK_LOCKS, &ls->ls_flags);
+                clear_bit(DFL_BLOCK_LOCKS, &ls->ls_recover_flags);
                 smp_mb__after_clear_bit();
                 gfs2_glock_thaw(sdp);
         } else {
@@ -350,8 +350,8 @@ static ssize_t lkfirst_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
                 goto out;
         if (sdp->sd_lockstruct.ls_ops->lm_mount == NULL)
                 goto out;
-        sdp->sd_lockstruct.ls_first = first;
-        rv = 0;
+        sdp->sd_lockstruct.ls_first = first;
+        rv = 0;
 out:
         spin_unlock(&sdp->sd_jindex_spin);
         return rv ? rv : len;
@@ -360,19 +360,14 @@ out:
 static ssize_t first_done_show(struct gfs2_sbd *sdp, char *buf)
 {
         struct lm_lockstruct *ls = &sdp->sd_lockstruct;
-        return sprintf(buf, "%d\n", ls->ls_first_done);
+        return sprintf(buf, "%d\n", !!test_bit(DFL_FIRST_MOUNT_DONE, &ls->ls_recover_flags));
 }
 
-static ssize_t recover_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
+int gfs2_recover_set(struct gfs2_sbd *sdp, unsigned jid)
 {
-        unsigned jid;
         struct gfs2_jdesc *jd;
         int rv;
 
-        rv = sscanf(buf, "%u", &jid);
-        if (rv != 1)
-                return -EINVAL;
-
         rv = -ESHUTDOWN;
         spin_lock(&sdp->sd_jindex_spin);
         if (test_bit(SDF_NORECOVERY, &sdp->sd_flags))
@@ -389,6 +384,20 @@ static ssize_t recover_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
         }
 out:
         spin_unlock(&sdp->sd_jindex_spin);
+        return rv;
+}
+
+static ssize_t recover_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
+{
+        unsigned jid;
+        int rv;
+
+        rv = sscanf(buf, "%u", &jid);
+        if (rv != 1)
+                return -EINVAL;
+
+        rv = gfs2_recover_set(sdp, jid);
+
         return rv ? rv : len;
 }
 
diff --git a/fs/gfs2/sys.h b/fs/gfs2/sys.h
index e94560e836d7..79182d6ad6ac 100644
--- a/fs/gfs2/sys.h
+++ b/fs/gfs2/sys.h
@@ -19,5 +19,7 @@ void gfs2_sys_fs_del(struct gfs2_sbd *sdp);
 int gfs2_sys_init(void);
 void gfs2_sys_uninit(void);
 
+int gfs2_recover_set(struct gfs2_sbd *sdp, unsigned jid);
+
 #endif /* __SYS_DOT_H__ */
 
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index e425ad9d0490..1e85a7ac0217 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -583,7 +583,8 @@ static int hugetlbfs_set_page_dirty(struct page *page)
 }
 
 static int hugetlbfs_migrate_page(struct address_space *mapping,
-                                struct page *newpage, struct page *page)
+                                struct page *newpage, struct page *page,
+                                enum migrate_mode mode)
 {
         int rc;
 
diff --git a/fs/inode.c b/fs/inode.c
index 4fa4f0916af9..fb10d86ffad7 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -322,9 +322,6 @@ EXPORT_SYMBOL(clear_nlink);
 void set_nlink(struct inode *inode, unsigned int nlink)
 {
         if (!nlink) {
-                printk_ratelimited(KERN_INFO
-                        "set_nlink() clearing i_nlink on %s inode %li\n",
-                        inode->i_sb->s_type->name, inode->i_ino);
                 clear_nlink(inode);
         } else {
                 /* Yes, some filesystems do change nlink from zero to one */
diff --git a/fs/ioprio.c b/fs/ioprio.c
index f79dab83e17b..f84b380d65e5 100644
--- a/fs/ioprio.c
+++ b/fs/ioprio.c
@@ -48,28 +48,12 @@ int set_task_ioprio(struct task_struct *task, int ioprio)
         if (err)
                 return err;
 
-        task_lock(task);
-        do {
-                ioc = task->io_context;
-                /* see wmb() in current_io_context() */
-                smp_read_barrier_depends();
-                if (ioc)
-                        break;
-
-                ioc = alloc_io_context(GFP_ATOMIC, -1);
-                if (!ioc) {
-                        err = -ENOMEM;
-                        break;
-                }
-                task->io_context = ioc;
-        } while (1);
-
-        if (!err) {
-                ioc->ioprio = ioprio;
-                ioc->ioprio_changed = 1;
+        ioc = get_task_io_context(task, GFP_ATOMIC, NUMA_NO_NODE);
+        if (ioc) {
+                ioc_ioprio_changed(ioc, ioprio);
+                put_io_context(ioc, NULL);
         }
 
-        task_unlock(task);
         return err;
 }
 EXPORT_SYMBOL_GPL(set_task_ioprio);
diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
index 23d7451b2938..65ba36b80a9e 100644
--- a/fs/lockd/mon.c
+++ b/fs/lockd/mon.c
@@ -55,7 +55,7 @@ static				DEFINE_SPINLOCK(nsm_lock);
  * Local NSM state
  */
 u32     __read_mostly           nsm_local_state;
-int     __read_mostly           nsm_use_hostnames;
+bool    __read_mostly           nsm_use_hostnames;
 
 static inline struct sockaddr *nsm_addr(const struct nsm_handle *nsm)
 {
diff --git a/fs/mpage.c b/fs/mpage.c
index fdfae9fa98cd..643e9f55ef29 100644
--- a/fs/mpage.c
+++ b/fs/mpage.c
@@ -371,9 +371,6 @@ mpage_readpages(struct address_space *mapping, struct list_head *pages,
         sector_t last_block_in_bio = 0;
         struct buffer_head map_bh;
         unsigned long first_logical_block = 0;
-        struct blk_plug plug;
-
-        blk_start_plug(&plug);
 
         map_bh.b_state = 0;
         map_bh.b_size = 0;
@@ -395,7 +392,6 @@ mpage_readpages(struct address_space *mapping, struct list_head *pages,
         BUG_ON(!list_empty(pages));
         if (bio)
                 mpage_bio_submit(READ, bio);
-        blk_finish_plug(&plug);
         return 0;
 }
 EXPORT_SYMBOL(mpage_readpages);
diff --git a/fs/namei.c b/fs/namei.c
index c283a1ec008e..208c6aa4a989 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -140,21 +140,19 @@ static int do_getname(const char __user *filename, char *page)
 
 static char *getname_flags(const char __user *filename, int flags, int *empty)
 {
-        char *tmp, *result;
-
-        result = ERR_PTR(-ENOMEM);
-        tmp = __getname();
-        if (tmp)  {
-                int retval = do_getname(filename, tmp);
-
-                result = tmp;
-                if (retval < 0) {
-                        if (retval == -ENOENT && empty)
-                                *empty = 1;
-                        if (retval != -ENOENT || !(flags & LOOKUP_EMPTY)) {
-                                __putname(tmp);
-                                result = ERR_PTR(retval);
-                        }
+        char *result = __getname();
+        int retval;
+
+        if (!result)
+                return ERR_PTR(-ENOMEM);
+
+        retval = do_getname(filename, result);
+        if (retval < 0) {
+                if (retval == -ENOENT && empty)
+                        *empty = 1;
+                if (retval != -ENOENT || !(flags & LOOKUP_EMPTY)) {
+                        __putname(result);
+                        return ERR_PTR(retval);
                 }
         }
         audit_getname(result);
diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
index 281ae95932c9..48cfac31f64c 100644
--- a/fs/nfs/blocklayout/blocklayout.c
+++ b/fs/nfs/blocklayout/blocklayout.c
@@ -90,9 +90,9 @@ static int is_writable(struct pnfs_block_extent *be, sector_t isect)
  */
 struct parallel_io {
         struct kref refcnt;
-        struct rpc_call_ops call_ops;
-        void (*pnfs_callback) (void *data);
+        void (*pnfs_callback) (void *data, int num_se);
         void *data;
+        int bse_count;
 };
 
 static inline struct parallel_io *alloc_parallel(void *data)
@@ -103,6 +103,7 @@ static inline struct parallel_io *alloc_parallel(void *data)
         if (rv) {
                 rv->data = data;
                 kref_init(&rv->refcnt);
+                rv->bse_count = 0;
         }
         return rv;
 }
@@ -117,7 +118,7 @@ static void destroy_parallel(struct kref *kref)
         struct parallel_io *p = container_of(kref, struct parallel_io, refcnt);
 
         dprintk("%s enter\n", __func__);
-        p->pnfs_callback(p->data);
+        p->pnfs_callback(p->data, p->bse_count);
         kfree(p);
 }
 
@@ -146,14 +147,19 @@ static struct bio *bl_alloc_init_bio(int npg, sector_t isect,
 {
         struct bio *bio;
 
+        npg = min(npg, BIO_MAX_PAGES);
         bio = bio_alloc(GFP_NOIO, npg);
-        if (!bio)
-                return NULL;
+        if (!bio && (current->flags & PF_MEMALLOC)) {
+                while (!bio && (npg /= 2))
+                        bio = bio_alloc(GFP_NOIO, npg);
+        }
 
-        bio->bi_sector = isect - be->be_f_offset + be->be_v_offset;
-        bio->bi_bdev = be->be_mdev;
-        bio->bi_end_io = end_io;
-        bio->bi_private = par;
+        if (bio) {
+                bio->bi_sector = isect - be->be_f_offset + be->be_v_offset;
+                bio->bi_bdev = be->be_mdev;
+                bio->bi_end_io = end_io;
+                bio->bi_private = par;
+        }
         return bio;
 }
 
@@ -212,22 +218,15 @@ static void bl_read_cleanup(struct work_struct *work)
 }
 
 static void
-bl_end_par_io_read(void *data)
+bl_end_par_io_read(void *data, int unused)
 {
         struct nfs_read_data *rdata = data;
 
+        rdata->task.tk_status = rdata->pnfs_error;
         INIT_WORK(&rdata->task.u.tk_work, bl_read_cleanup);
         schedule_work(&rdata->task.u.tk_work);
 }
 
-/* We don't want normal .rpc_call_done callback used, so we replace it
- * with this stub.
- */
-static void bl_rpc_do_nothing(struct rpc_task *task, void *calldata)
-{
-        return;
-}
-
 static enum pnfs_try_status
 bl_read_pagelist(struct nfs_read_data *rdata)
 {
@@ -247,8 +246,6 @@ bl_read_pagelist(struct nfs_read_data *rdata)
         par = alloc_parallel(rdata);
         if (!par)
                 goto use_mds;
-        par->call_ops = *rdata->mds_ops;
-        par->call_ops.rpc_call_done = bl_rpc_do_nothing;
         par->pnfs_callback = bl_end_par_io_read;
         /* At this point, we can no longer jump to use_mds */
 
@@ -322,6 +319,7 @@ static void mark_extents_written(struct pnfs_block_layout *bl,
 {
         sector_t isect, end;
         struct pnfs_block_extent *be;
+        struct pnfs_block_short_extent *se;
 
         dprintk("%s(%llu, %u)\n", __func__, offset, count);
         if (count == 0)
@@ -334,8 +332,11 @@ static void mark_extents_written(struct pnfs_block_layout *bl,
                 be = bl_find_get_extent(bl, isect, NULL);
                 BUG_ON(!be); /* FIXME */
                 len = min(end, be->be_f_offset + be->be_length) - isect;
-                if (be->be_state == PNFS_BLOCK_INVALID_DATA)
-                        bl_mark_for_commit(be, isect, len); /* What if fails? */
+                if (be->be_state == PNFS_BLOCK_INVALID_DATA) {
+                        se = bl_pop_one_short_extent(be->be_inval);
+                        BUG_ON(!se);
+                        bl_mark_for_commit(be, isect, len, se);
+                }
                 isect += len;
                 bl_put_extent(be);
         }
@@ -357,7 +358,8 @@ static void bl_end_io_write_zero(struct bio *bio, int err)
                 end_page_writeback(page);
                 page_cache_release(page);
         } while (bvec >= bio->bi_io_vec);
-        if (!uptodate) {
+
+        if (unlikely(!uptodate)) {
                 if (!wdata->pnfs_error)
                         wdata->pnfs_error = -EIO;
                 pnfs_set_lo_fail(wdata->lseg);
@@ -366,7 +368,6 @@ static void bl_end_io_write_zero(struct bio *bio, int err)
         put_parallel(par);
 }
 
-/* This is basically copied from mpage_end_io_read */
 static void bl_end_io_write(struct bio *bio, int err)
 {
         struct parallel_io *par = bio->bi_private;
@@ -392,7 +393,7 @@ static void bl_write_cleanup(struct work_struct *work)
         dprintk("%s enter\n", __func__);
         task = container_of(work, struct rpc_task, u.tk_work);
         wdata = container_of(task, struct nfs_write_data, task);
-        if (!wdata->pnfs_error) {
+        if (likely(!wdata->pnfs_error)) {
                 /* Marks for LAYOUTCOMMIT */
                 mark_extents_written(BLK_LSEG2EXT(wdata->lseg),
                                      wdata->args.offset, wdata->args.count);
@@ -401,11 +402,16 @@ static void bl_write_cleanup(struct work_struct *work)
 }
 
 /* Called when last of bios associated with a bl_write_pagelist call finishes */
-static void bl_end_par_io_write(void *data)
+static void bl_end_par_io_write(void *data, int num_se)
 {
         struct nfs_write_data *wdata = data;
 
-        wdata->task.tk_status = 0;
+        if (unlikely(wdata->pnfs_error)) {
+                bl_free_short_extents(&BLK_LSEG2EXT(wdata->lseg)->bl_inval,
+                                        num_se);
+        }
+
+        wdata->task.tk_status = wdata->pnfs_error;
         wdata->verf.committed = NFS_FILE_SYNC;
         INIT_WORK(&wdata->task.u.tk_work, bl_write_cleanup);
         schedule_work(&wdata->task.u.tk_work);
@@ -484,6 +490,55 @@ cleanup:
         return ret;
 }
 
+/* Find or create a zeroing page marked being writeback.
+ * Return ERR_PTR on error, NULL to indicate skip this page and page itself
+ * to indicate write out.
+ */
+static struct page *
+bl_find_get_zeroing_page(struct inode *inode, pgoff_t index,
+                        struct pnfs_block_extent *cow_read)
+{
+        struct page *page;
+        int locked = 0;
+        page = find_get_page(inode->i_mapping, index);
+        if (page)
+                goto check_page;
+
+        page = find_or_create_page(inode->i_mapping, index, GFP_NOFS);
+        if (unlikely(!page)) {
+                dprintk("%s oom\n", __func__);
+                return ERR_PTR(-ENOMEM);
+        }
+        locked = 1;
+
+check_page:
+        /* PageDirty: Other will write this out
+         * PageWriteback: Other is writing this out
+         * PageUptodate: It was read before
+         */
+        if (PageDirty(page) || PageWriteback(page)) {
+                print_page(page);
+                if (locked)
+                        unlock_page(page);
+                page_cache_release(page);
+                return NULL;
+        }
+
+        if (!locked) {
+                lock_page(page);
+                locked = 1;
+                goto check_page;
+        }
+        if (!PageUptodate(page)) {
+                /* New page, readin or zero it */
+                init_page_for_write(page, cow_read);
+        }
+        set_page_writeback(page);
+        unlock_page(page);
+
+        return page;
+}
+
 static enum pnfs_try_status
 bl_write_pagelist(struct nfs_write_data *wdata, int sync)
 {
@@ -508,9 +563,7 @@ bl_write_pagelist(struct nfs_write_data *wdata, int sync)
          */
         par = alloc_parallel(wdata);
         if (!par)
-                return PNFS_NOT_ATTEMPTED;
-        par->call_ops = *wdata->mds_ops;
-        par->call_ops.rpc_call_done = bl_rpc_do_nothing;
+                goto out_mds;
         par->pnfs_callback = bl_end_par_io_write;
         /* At this point, have to be more careful with error handling */
 
@@ -518,12 +571,15 @@ bl_write_pagelist(struct nfs_write_data *wdata, int sync)
         be = bl_find_get_extent(BLK_LSEG2EXT(wdata->lseg), isect, &cow_read);
         if (!be || !is_writable(be, isect)) {
                 dprintk("%s no matching extents!\n", __func__);
-                wdata->pnfs_error = -EINVAL;
-                goto out;
+                goto out_mds;
         }
 
         /* First page inside INVALID extent */
         if (be->be_state == PNFS_BLOCK_INVALID_DATA) {
+                if (likely(!bl_push_one_short_extent(be->be_inval)))
+                        par->bse_count++;
+                else
+                        goto out_mds;
                 temp = offset >> PAGE_CACHE_SHIFT;
                 npg_zero = do_div(temp, npg_per_block);
                 isect = (sector_t) (((offset - npg_zero * PAGE_CACHE_SIZE) &
@@ -543,36 +599,16 @@ fill_invalid_ext:
                         dprintk("%s zero %dth page: index %lu isect %llu\n",
                                 __func__, npg_zero, index,
                                 (unsigned long long)isect);
-                        page =
-                            find_or_create_page(wdata->inode->i_mapping, index,
-                                                GFP_NOFS);
-                        if (!page) {
-                                dprintk("%s oom\n", __func__);
-                                wdata->pnfs_error = -ENOMEM;
+                        page = bl_find_get_zeroing_page(wdata->inode, index,
+                                                        cow_read);
+                        if (unlikely(IS_ERR(page))) {
+                                wdata->pnfs_error = PTR_ERR(page);
                                 goto out;
-                        }
-
-                        /* PageDirty: Other will write this out
-                         * PageWriteback: Other is writing this out
-                         * PageUptodate: It was read before
-                         * sector_initialized: already written out
-                         */
-                        if (PageDirty(page) || PageWriteback(page)) {
-                                print_page(page);
-                                unlock_page(page);
-                                page_cache_release(page);
+                        } else if (page == NULL)
                                 goto next_page;
-                        }
-                        if (!PageUptodate(page)) {
-                                /* New page, readin or zero it */
-                                init_page_for_write(page, cow_read);
-                        }
-                        set_page_writeback(page);
-                        unlock_page(page);
 
                         ret = bl_mark_sectors_init(be->be_inval, isect,
-                                                       PAGE_CACHE_SECTORS,
-                                                       NULL);
+                                                       PAGE_CACHE_SECTORS);
                         if (unlikely(ret)) {
                                 dprintk("%s bl_mark_sectors_init fail %d\n",
                                         __func__, ret);
@@ -581,6 +617,19 @@ fill_invalid_ext:
                                 wdata->pnfs_error = ret;
                                 goto out;
                         }
+                        if (likely(!bl_push_one_short_extent(be->be_inval)))
+                                par->bse_count++;
+                        else {
+                                end_page_writeback(page);
+                                page_cache_release(page);
+                                wdata->pnfs_error = -ENOMEM;
+                                goto out;
+                        }
+                        /* FIXME: This should be done in bi_end_io */
+                        mark_extents_written(BLK_LSEG2EXT(wdata->lseg),
+                                             page->index << PAGE_CACHE_SHIFT,
+                                             PAGE_CACHE_SIZE);
+
                         bio = bl_add_page_to_bio(bio, npg_zero, WRITE,
                                                  isect, page, be,
                                                  bl_end_io_write_zero, par);
@@ -589,10 +638,6 @@ fill_invalid_ext:
                                 bio = NULL;
                                 goto out;
                         }
-                        /* FIXME: This should be done in bi_end_io */
-                        mark_extents_written(BLK_LSEG2EXT(wdata->lseg),
-                                             page->index << PAGE_CACHE_SHIFT,
-                                             PAGE_CACHE_SIZE);
 next_page:
                         isect += PAGE_CACHE_SECTORS;
                         extent_length -= PAGE_CACHE_SECTORS;
@@ -616,13 +661,21 @@ next_page:
                                 wdata->pnfs_error = -EINVAL;
                                 goto out;
                         }
+                        if (be->be_state == PNFS_BLOCK_INVALID_DATA) {
+                                if (likely(!bl_push_one_short_extent(
+                                                                be->be_inval)))
+                                        par->bse_count++;
+                                else {
+                                        wdata->pnfs_error = -ENOMEM;
+                                        goto out;
+                                }
+                        }
                         extent_length = be->be_length -
                             (isect - be->be_f_offset);
                 }
                 if (be->be_state == PNFS_BLOCK_INVALID_DATA) {
                         ret = bl_mark_sectors_init(be->be_inval, isect,
-                                                       PAGE_CACHE_SECTORS,
-                                                       NULL);
+                                                       PAGE_CACHE_SECTORS);
                         if (unlikely(ret)) {
                                 dprintk("%s bl_mark_sectors_init fail %d\n",
                                         __func__, ret);
@@ -664,6 +717,10 @@ out:
         bl_submit_bio(WRITE, bio);
         put_parallel(par);
         return PNFS_ATTEMPTED;
+out_mds:
+        bl_put_extent(be);
+        kfree(par);
+        return PNFS_NOT_ATTEMPTED;
 }
 
 /* FIXME - range ignored */
@@ -690,11 +747,17 @@ static void
 release_inval_marks(struct pnfs_inval_markings *marks)
 {
         struct pnfs_inval_tracking *pos, *temp;
+        struct pnfs_block_short_extent *se, *stemp;
 
         list_for_each_entry_safe(pos, temp, &marks->im_tree.mtt_stub, it_link) {
                 list_del(&pos->it_link);
                 kfree(pos);
         }
+
+        list_for_each_entry_safe(se, stemp, &marks->im_extents, bse_node) {
+                list_del(&se->bse_node);
+                kfree(se);
+        }
         return;
 }
 
@@ -779,16 +842,13 @@ bl_cleanup_layoutcommit(struct nfs4_layoutcommit_data *lcdata)
 static void free_blk_mountid(struct block_mount_id *mid)
 {
         if (mid) {
-                struct pnfs_block_dev *dev;
-                spin_lock(&mid->bm_lock);
-                while (!list_empty(&mid->bm_devlist)) {
-                        dev = list_first_entry(&mid->bm_devlist,
-                                               struct pnfs_block_dev,
-                                               bm_node);
+                struct pnfs_block_dev *dev, *tmp;
+
+                /* No need to take bm_lock as we are last user freeing bm_devlist */
+                list_for_each_entry_safe(dev, tmp, &mid->bm_devlist, bm_node) {
                         list_del(&dev->bm_node);
                         bl_free_block_dev(dev);
                 }
-                spin_unlock(&mid->bm_lock);
                 kfree(mid);
         }
 }
diff --git a/fs/nfs/blocklayout/blocklayout.h b/fs/nfs/blocklayout/blocklayout.h
index 42acf7ef5992..e31a2df28e70 100644
--- a/fs/nfs/blocklayout/blocklayout.h
+++ b/fs/nfs/blocklayout/blocklayout.h
@@ -70,6 +70,7 @@ struct pnfs_inval_markings {
         spinlock_t      im_lock;
         struct my_tree  im_tree;        /* Sectors that need LAYOUTCOMMIT */
         sector_t        im_block_size;  /* Server blocksize in sectors */
+        struct list_head im_extents;    /* Short extents for INVAL->RW conversion */
 };
 
 struct pnfs_inval_tracking {
@@ -105,6 +106,7 @@ BL_INIT_INVAL_MARKS(struct pnfs_inval_markings *marks, sector_t blocksize)
 {
         spin_lock_init(&marks->im_lock);
         INIT_LIST_HEAD(&marks->im_tree.mtt_stub);
+        INIT_LIST_HEAD(&marks->im_extents);
         marks->im_block_size = blocksize;
         marks->im_tree.mtt_step_size = min((sector_t)PAGE_CACHE_SECTORS,
                                            blocksize);
@@ -186,8 +188,7 @@ struct pnfs_block_extent *
 bl_find_get_extent(struct pnfs_block_layout *bl, sector_t isect,
                 struct pnfs_block_extent **cow_read);
 int bl_mark_sectors_init(struct pnfs_inval_markings *marks,
-                             sector_t offset, sector_t length,
-                             sector_t **pages);
+                             sector_t offset, sector_t length);
 void bl_put_extent(struct pnfs_block_extent *be);
 struct pnfs_block_extent *bl_alloc_extent(void);
 int bl_is_sector_init(struct pnfs_inval_markings *marks, sector_t isect);
@@ -200,6 +201,11 @@ void clean_pnfs_block_layoutupdate(struct pnfs_block_layout *bl,
 int bl_add_merge_extent(struct pnfs_block_layout *bl,
                          struct pnfs_block_extent *new);
 int bl_mark_for_commit(struct pnfs_block_extent *be,
-                        sector_t offset, sector_t length);
+                        sector_t offset, sector_t length,
+                        struct pnfs_block_short_extent *new);
+int bl_push_one_short_extent(struct pnfs_inval_markings *marks);
+struct pnfs_block_short_extent *
+bl_pop_one_short_extent(struct pnfs_inval_markings *marks);
+void bl_free_short_extents(struct pnfs_inval_markings *marks, int num_to_free);
 
 #endif /* FS_NFS_NFS4BLOCKLAYOUT_H */
diff --git a/fs/nfs/blocklayout/extents.c b/fs/nfs/blocklayout/extents.c
index 19fa7b0b8c00..1abac09f7cd5 100644
--- a/fs/nfs/blocklayout/extents.c
+++ b/fs/nfs/blocklayout/extents.c
@@ -110,13 +110,7 @@ static int _add_entry(struct my_tree *tree, u64 s, int32_t tag,
                 return 0;
         } else {
                 struct pnfs_inval_tracking *new;
-                if (storage)
-                        new = storage;
-                else {
-                        new = kmalloc(sizeof(*new), GFP_NOFS);
-                        if (!new)
-                                return -ENOMEM;
-                }
+                new = storage;
                 new->it_sector = s;
                 new->it_tags = (1 << tag);
                 list_add(&new->it_link, &pos->it_link);
@@ -139,11 +133,13 @@ static int _set_range(struct my_tree *tree, int32_t tag, u64 s, u64 length)
 }
 
 /* Ensure that future operations on given range of tree will not malloc */
-static int _preload_range(struct my_tree *tree, u64 offset, u64 length)
+static int _preload_range(struct pnfs_inval_markings *marks,
+                u64 offset, u64 length)
 {
         u64 start, end, s;
         int count, i, used = 0, status = -ENOMEM;
         struct pnfs_inval_tracking **storage;
+        struct my_tree  *tree = &marks->im_tree;
 
         dprintk("%s(%llu, %llu) enter\n", __func__, offset, length);
         start = normalize(offset, tree->mtt_step_size);
@@ -161,12 +157,11 @@ static int _preload_range(struct my_tree *tree, u64 offset, u64 length)
                         goto out_cleanup;
         }
 
-        /* Now need lock - HOW??? */
-
+        spin_lock_bh(&marks->im_lock);
         for (s = start; s < end; s += tree->mtt_step_size)
                 used += _add_entry(tree, s, INTERNAL_EXISTS, storage[used]);
+        spin_unlock_bh(&marks->im_lock);
 
-        /* Unlock - HOW??? */
         status = 0;
 
  out_cleanup:
@@ -179,41 +174,14 @@ static int _preload_range(struct my_tree *tree, u64 offset, u64 length)
         return status;
 }
 
-static void set_needs_init(sector_t *array, sector_t offset)
-{
-        sector_t *p = array;
-
-        dprintk("%s enter\n", __func__);
-        if (!p)
-                return;
-        while (*p < offset)
-                p++;
-        if (*p == offset)
-                return;
-        else if (*p == ~0) {
-                *p++ = offset;
-                *p = ~0;
-                return;
-        } else {
-                sector_t *save = p;
-                dprintk("%s Adding %llu\n", __func__, (u64)offset);
-                while (*p != ~0)
-                        p++;
-                p++;
-                memmove(save + 1, save, (char *)p - (char *)save);
-                *save = offset;
-                return;
-        }
-}
-
 /* We are relying on page lock to serialize this */
 int bl_is_sector_init(struct pnfs_inval_markings *marks, sector_t isect)
 {
         int rv;
 
-        spin_lock(&marks->im_lock);
+        spin_lock_bh(&marks->im_lock);
         rv = _has_tag(&marks->im_tree, isect, EXTENT_INITIALIZED);
-        spin_unlock(&marks->im_lock);
+        spin_unlock_bh(&marks->im_lock);
         return rv;
 }
 
@@ -253,78 +221,39 @@ static int is_range_written(struct pnfs_inval_markings *marks,
 {
         int rv;
 
-        spin_lock(&marks->im_lock);
+        spin_lock_bh(&marks->im_lock);
         rv = _range_has_tag(&marks->im_tree, start, end, EXTENT_WRITTEN);
-        spin_unlock(&marks->im_lock);
+        spin_unlock_bh(&marks->im_lock);
         return rv;
 }
 
 /* Marks sectors in [offest, offset_length) as having been initialized.
  * All lengths are step-aligned, where step is min(pagesize, blocksize).
- * Notes where partial block is initialized, and helps prepare it for
- * complete initialization later.
+ * Currently assumes offset is page-aligned
  */
-/* Currently assumes offset is page-aligned */
 int bl_mark_sectors_init(struct pnfs_inval_markings *marks,
-                             sector_t offset, sector_t length,
-                             sector_t **pages)
+                             sector_t offset, sector_t length)
 {
-        sector_t s, start, end;
-        sector_t *array = NULL; /* Pages to mark */
+        sector_t start, end;
 
         dprintk("%s(offset=%llu,len=%llu) enter\n",
                 __func__, (u64)offset, (u64)length);
-        s = max((sector_t) 3,
-                2 * (marks->im_block_size / (PAGE_CACHE_SECTORS)));
-        dprintk("%s set max=%llu\n", __func__, (u64)s);
-        if (pages) {
-                array = kmalloc(s * sizeof(sector_t), GFP_NOFS);
-                if (!array)
-                        goto outerr;
-                array[0] = ~0;
-        }
 
         start = normalize(offset, marks->im_block_size);
         end = normalize_up(offset + length, marks->im_block_size);
-        if (_preload_range(&marks->im_tree, start, end - start))
+        if (_preload_range(marks, start, end - start))
                 goto outerr;
 
-        spin_lock(&marks->im_lock);
-
-        for (s = normalize_up(start, PAGE_CACHE_SECTORS);
-             s < offset; s += PAGE_CACHE_SECTORS) {
-                dprintk("%s pre-area pages\n", __func__);
-                /* Portion of used block is not initialized */
-                if (!_has_tag(&marks->im_tree, s, EXTENT_INITIALIZED))
-                        set_needs_init(array, s);
-        }
+        spin_lock_bh(&marks->im_lock);
         if (_set_range(&marks->im_tree, EXTENT_INITIALIZED, offset, length))
                 goto out_unlock;
-        for (s = normalize_up(offset + length, PAGE_CACHE_SECTORS);
-             s < end; s += PAGE_CACHE_SECTORS) {
-                dprintk("%s post-area pages\n", __func__);
-                if (!_has_tag(&marks->im_tree, s, EXTENT_INITIALIZED))
-                        set_needs_init(array, s);
-        }
-
-        spin_unlock(&marks->im_lock);
+        spin_unlock_bh(&marks->im_lock);
 
-        if (pages) {
-                if (array[0] == ~0) {
-                        kfree(array);
-                        *pages = NULL;
-                } else
-                        *pages = array;
-        }
         return 0;
 
- out_unlock:
-        spin_unlock(&marks->im_lock);
- outerr:
-        if (pages) {
-                kfree(array);
-                *pages = NULL;
-        }
+out_unlock:
+        spin_unlock_bh(&marks->im_lock);
+outerr:
         return -ENOMEM;
 }
 
@@ -338,9 +267,9 @@ static int mark_written_sectors(struct pnfs_inval_markings *marks,
 
         dprintk("%s(offset=%llu,len=%llu) enter\n", __func__,
                 (u64)offset, (u64)length);
-        spin_lock(&marks->im_lock);
+        spin_lock_bh(&marks->im_lock);
         status = _set_range(&marks->im_tree, EXTENT_WRITTEN, offset, length);
-        spin_unlock(&marks->im_lock);
+        spin_unlock_bh(&marks->im_lock);
         return status;
 }
 
@@ -440,20 +369,18 @@ static void add_to_commitlist(struct pnfs_block_layout *bl,
 
 /* Note the range described by offset, length is guaranteed to be contained
  * within be.
+ * new will be freed, either by this function or add_to_commitlist if they
+ * decide not to use it, or after LAYOUTCOMMIT uses it in the commitlist.
  */
 int bl_mark_for_commit(struct pnfs_block_extent *be,
-                    sector_t offset, sector_t length)
+                    sector_t offset, sector_t length,
+                    struct pnfs_block_short_extent *new)
 {
         sector_t new_end, end = offset + length;
-        struct pnfs_block_short_extent *new;
         struct pnfs_block_layout *bl = container_of(be->be_inval,
                                                     struct pnfs_block_layout,
                                                     bl_inval);
 
-        new = kmalloc(sizeof(*new), GFP_NOFS);
-        if (!new)
-                return -ENOMEM;
-
         mark_written_sectors(be->be_inval, offset, length);
         /* We want to add the range to commit list, but it must be
          * block-normalized, and verified that the normalized range has
@@ -483,9 +410,6 @@ int bl_mark_for_commit(struct pnfs_block_extent *be,
         new->bse_mdev = be->be_mdev;
 
         spin_lock(&bl->bl_ext_lock);
-        /* new will be freed, either by add_to_commitlist if it decides not
-         * to use it, or after LAYOUTCOMMIT uses it in the commitlist.
-         */
         add_to_commitlist(bl, new);
         spin_unlock(&bl->bl_ext_lock);
         return 0;
@@ -933,3 +857,53 @@ clean_pnfs_block_layoutupdate(struct pnfs_block_layout *bl,
                 }
         }
 }
+
+int bl_push_one_short_extent(struct pnfs_inval_markings *marks)
+{
+        struct pnfs_block_short_extent *new;
+
+        new = kmalloc(sizeof(*new), GFP_NOFS);
+        if (unlikely(!new))
+                return -ENOMEM;
+
+        spin_lock_bh(&marks->im_lock);
+        list_add(&new->bse_node, &marks->im_extents);
+        spin_unlock_bh(&marks->im_lock);
+
+        return 0;
+}
+
+struct pnfs_block_short_extent *
+bl_pop_one_short_extent(struct pnfs_inval_markings *marks)
+{
+        struct pnfs_block_short_extent *rv = NULL;
+
+        spin_lock_bh(&marks->im_lock);
+        if (!list_empty(&marks->im_extents)) {
+                rv = list_entry((&marks->im_extents)->next,
+                                struct pnfs_block_short_extent, bse_node);
+                list_del_init(&rv->bse_node);
+        }
+        spin_unlock_bh(&marks->im_lock);
+
+        return rv;
+}
+
+void bl_free_short_extents(struct pnfs_inval_markings *marks, int num_to_free)
+{
+        struct pnfs_block_short_extent *se = NULL, *tmp;
+
+        if (num_to_free <= 0)
+                return;
+
+        spin_lock(&marks->im_lock);
+        list_for_each_entry_safe(se, tmp, &marks->im_extents, bse_node) {
+                list_del(&se->bse_node);
+                kfree(se);
+                if (--num_to_free == 0)
+                        break;
+        }
+        spin_unlock(&marks->im_lock);
+
+        BUG_ON(num_to_free > 0);
+}
diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
index 07df5f1d85e5..c89d3b9e483c 100644
--- a/fs/nfs/callback.h
+++ b/fs/nfs/callback.h
@@ -162,7 +162,7 @@ struct cb_layoutrecallargs {
         };
 };
 
-extern unsigned nfs4_callback_layoutrecall(
+extern __be32 nfs4_callback_layoutrecall(
         struct cb_layoutrecallargs *args,
         void *dummy, struct cb_process_state *cps);
 
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 726e59a9e50f..d50b2742f23b 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -305,6 +305,10 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
         n = ntohl(*p++);
         if (n <= 0)
                 goto out;
+        if (n > ULONG_MAX / sizeof(*args->devs)) {
+                status = htonl(NFS4ERR_BADXDR);
+                goto out;
+        }
 
         args->devs = kmalloc(n * sizeof(*args->devs), GFP_KERNEL);
         if (!args->devs) {
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 277dfaf2e99a..31778f74357d 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -84,7 +84,7 @@ retry:
 /*
  * Turn off NFSv4 uid/gid mapping when using AUTH_SYS
  */
-static int nfs4_disable_idmapping = 1;
+static bool nfs4_disable_idmapping = true;
 
 /*
  * RPC cruft for NFS
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 25c3bfad7953..f649fba8c384 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -57,7 +57,7 @@
 #define NFS_64_BIT_INODE_NUMBERS_ENABLED        1
 
 /* Default is to see 64-bit inode numbers */
-static int enable_ino64 = NFS_64_BIT_INODE_NUMBERS_ENABLED;
+static bool enable_ino64 = NFS_64_BIT_INODE_NUMBERS_ENABLED;
 
 static void nfs_invalidate_inode(struct inode *);
 static int nfs_update_inode(struct inode *, struct nfs_fattr *);
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 5ee92538b063..8102db9b926c 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -332,7 +332,7 @@ void nfs_commit_release_pages(struct nfs_write_data *data);
 
 #ifdef CONFIG_MIGRATION
 extern int nfs_migrate_page(struct address_space *,
-                struct page *, struct page *);
+                struct page *, struct page *, enum migrate_mode);
 #else
 #define nfs_migrate_page NULL
 #endif
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index ed388aae9689..8ae91908f5aa 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -382,7 +382,7 @@ decode_ds_addr(struct xdr_stream *streamp, gfp_t gfp_flags)
 {
         struct nfs4_pnfs_ds_addr *da = NULL;
         char *buf, *portstr;
-        u32 port;
+        __be16 port;
         int nlen, rlen;
         int tmp[2];
         __be32 *p;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 75366dc89686..f0c849c98fe4 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3587,7 +3587,7 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
                 res.acl_flags |= NFS4_ACL_LEN_REQUEST;
         resp_buf = page_address(pages[0]);
 
-        dprintk("%s  buf %p buflen %ld npages %d args.acl_len %ld\n",
+        dprintk("%s  buf %p buflen %zu npages %d args.acl_len %zu\n",
                 __func__, buf, buflen, npages, args.acl_len);
         ret = nfs4_call_sync(NFS_SERVER(inode)->client, NFS_SERVER(inode),
                              &msg, &args.seq_args, &res.seq_res, 0);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 0c3885255f97..834f0fe96f89 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1688,7 +1688,7 @@ out_error:
 
 #ifdef CONFIG_MIGRATION
 int nfs_migrate_page(struct address_space *mapping, struct page *newpage,
-                struct page *page)
+                struct page *page, enum migrate_mode mode)
 {
         /*
          * If PagePrivate is set, then the page is currently associated with
@@ -1703,7 +1703,7 @@ int nfs_migrate_page(struct address_space *mapping, struct page *newpage,
 
         nfs_fscache_release_page(page, GFP_KERNEL);
 
-        return migrate_page(mapping, newpage, page);
+        return migrate_page(mapping, newpage, page, mode);
 }
 #endif
 
diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig
index 10e6366608f2..8df1ea4a6ff9 100644
--- a/fs/nfsd/Kconfig
+++ b/fs/nfsd/Kconfig
@@ -80,3 +80,13 @@ config NFSD_V4
           available from http://linux-nfs.org/.
 
           If unsure, say N.
+
+config NFSD_FAULT_INJECTION
+        bool "NFS server manual fault injection"
+        depends on NFSD_V4 && DEBUG_KERNEL
+        help
+          This option enables support for manually injecting faults
+          into the NFS server.  This is intended to be used for
+          testing error recovery on the NFS client.
+
+          If unsure, say N.
diff --git a/fs/nfsd/Makefile b/fs/nfsd/Makefile
index 9b118ee20193..af32ef06b4fe 100644
--- a/fs/nfsd/Makefile
+++ b/fs/nfsd/Makefile
@@ -6,6 +6,7 @@ obj-$(CONFIG_NFSD)	+= nfsd.o
 
 nfsd-y                  := nfssvc.o nfsctl.o nfsproc.o nfsfh.o vfs.o \
                            export.o auth.o lockd.o nfscache.o nfsxdr.o stats.o
+nfsd-$(CONFIG_NFSD_FAULT_INJECTION) += fault_inject.o
 nfsd-$(CONFIG_NFSD_V2_ACL) += nfs2acl.o
 nfsd-$(CONFIG_NFSD_V3)  += nfs3proc.o nfs3xdr.o
 nfsd-$(CONFIG_NFSD_V3_ACL) += nfs3acl.o
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 62f3b9074e84..cf8a6bd062fa 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -87,7 +87,7 @@ static int expkey_parse(struct cache_detail *cd, char *mesg, int mlen)
         struct svc_expkey key;
         struct svc_expkey *ek = NULL;
 
-        if (mesg[mlen-1] != '\n')
+        if (mlen < 1 || mesg[mlen-1] != '\n')
                 return -EINVAL;
         mesg[mlen-1] = 0;
 
@@ -1226,12 +1226,12 @@ nfsd_export_init(void)
         int rv;
         dprintk("nfsd: initializing export module.\n");
 
-        rv = cache_register(&svc_export_cache);
+        rv = cache_register_net(&svc_export_cache, &init_net);
         if (rv)
                 return rv;
-        rv = cache_register(&svc_expkey_cache);
+        rv = cache_register_net(&svc_expkey_cache, &init_net);
         if (rv)
-                cache_unregister(&svc_export_cache);
+                cache_unregister_net(&svc_export_cache, &init_net);
         return rv;
 
 }
@@ -1255,8 +1255,8 @@ nfsd_export_shutdown(void)
 
         dprintk("nfsd: shutting down export module.\n");
 
-        cache_unregister(&svc_expkey_cache);
-        cache_unregister(&svc_export_cache);
+        cache_unregister_net(&svc_expkey_cache, &init_net);
+        cache_unregister_net(&svc_export_cache, &init_net);
         svcauth_unix_purge();
 
         dprintk("nfsd: export shutdown complete.\n");
diff --git a/fs/nfsd/fault_inject.c b/fs/nfsd/fault_inject.c
new file mode 100644
index 000000000000..ce7f0758d84c
--- /dev/null
+++ b/fs/nfsd/fault_inject.c
@@ -0,0 +1,91 @@
+/*
+ * Copyright (c) 2011 Bryan Schumaker <bjschuma@netapp.com>
+ *
+ * Uses debugfs to create fault injection points for client testing
+ */
+
+#include <linux/types.h>
+#include <linux/fs.h>
+#include <linux/debugfs.h>
+#include <linux/module.h>
+
+#include "state.h"
+#include "fault_inject.h"
+
+struct nfsd_fault_inject_op {
+        char *file;
+        void (*func)(u64);
+};
+
+static struct nfsd_fault_inject_op inject_ops[] = {
+        {
+                .file   = "forget_clients",
+                .func   = nfsd_forget_clients,
+        },
+        {
+                .file   = "forget_locks",
+                .func   = nfsd_forget_locks,
+        },
+        {
+                .file   = "forget_openowners",
+                .func   = nfsd_forget_openowners,
+        },
+        {
+                .file   = "forget_delegations",
+                .func   = nfsd_forget_delegations,
+        },
+        {
+                .file   = "recall_delegations",
+                .func   = nfsd_recall_delegations,
+        },
+};
+
+static long int NUM_INJECT_OPS = sizeof(inject_ops) / sizeof(struct nfsd_fault_inject_op);
+static struct dentry *debug_dir;
+
+static int nfsd_inject_set(void *op_ptr, u64 val)
+{
+        struct nfsd_fault_inject_op *op = op_ptr;
+
+        if (val == 0)
+                printk(KERN_INFO "NFSD Fault Injection: %s (all)", op->file);
+        else
+                printk(KERN_INFO "NFSD Fault Injection: %s (n = %llu)", op->file, val);
+
+        op->func(val);
+        return 0;
+}
+
+static int nfsd_inject_get(void *data, u64 *val)
+{
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_nfsd, nfsd_inject_get, nfsd_inject_set, "%llu\n");
+
+void nfsd_fault_inject_cleanup(void)
+{
+        debugfs_remove_recursive(debug_dir);
+}
+
+int nfsd_fault_inject_init(void)
+{
+        unsigned int i;
+        struct nfsd_fault_inject_op *op;
+        mode_t mode = S_IFREG | S_IRUSR | S_IWUSR;
+
+        debug_dir = debugfs_create_dir("nfsd", NULL);
+        if (!debug_dir)
+                goto fail;
+
+        for (i = 0; i < NUM_INJECT_OPS; i++) {
+                op = &inject_ops[i];
+                if (!debugfs_create_file(op->file, mode, debug_dir, op, &fops_nfsd))
+                        goto fail;
+        }
+        return 0;
+
+fail:
+        nfsd_fault_inject_cleanup();
+        return -ENOMEM;
+}
diff --git a/fs/nfsd/fault_inject.h b/fs/nfsd/fault_inject.h
new file mode 100644
index 000000000000..90bd0570956c
--- /dev/null
+++ b/fs/nfsd/fault_inject.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2011 Bryan Schumaker <bjschuma@netapp.com>
+ *
+ * Function definitions for fault injection
+ */
+
+#ifndef LINUX_NFSD_FAULT_INJECT_H
+#define LINUX_NFSD_FAULT_INJECT_H
+
+#ifdef CONFIG_NFSD_FAULT_INJECTION
+int nfsd_fault_inject_init(void);
+void nfsd_fault_inject_cleanup(void);
+void nfsd_forget_clients(u64);
+void nfsd_forget_locks(u64);
+void nfsd_forget_openowners(u64);
+void nfsd_forget_delegations(u64);
+void nfsd_recall_delegations(u64);
+#else /* CONFIG_NFSD_FAULT_INJECTION */
+static inline int nfsd_fault_inject_init(void) { return 0; }
+static inline void nfsd_fault_inject_cleanup(void) {}
+static inline void nfsd_forget_clients(u64 num) {}
+static inline void nfsd_forget_locks(u64 num) {}
+static inline void nfsd_forget_openowners(u64 num) {}
+static inline void nfsd_forget_delegations(u64 num) {}
+static inline void nfsd_recall_delegations(u64 num) {}
+#endif /* CONFIG_NFSD_FAULT_INJECTION */
+
+#endif /* LINUX_NFSD_FAULT_INJECT_H */
diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
index 55780a22fdbd..94096273cd6c 100644
--- a/fs/nfsd/nfs4idmap.c
+++ b/fs/nfsd/nfs4idmap.c
@@ -36,6 +36,7 @@
 #include <linux/seq_file.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
+#include <net/net_namespace.h>
 #include "idmap.h"
 #include "nfsd.h"
 
@@ -466,20 +467,20 @@ nfsd_idmap_init(void)
 {
         int rv;
 
-        rv = cache_register(&idtoname_cache);
+        rv = cache_register_net(&idtoname_cache, &init_net);
         if (rv)
                 return rv;
-        rv = cache_register(&nametoid_cache);
+        rv = cache_register_net(&nametoid_cache, &init_net);
         if (rv)
-                cache_unregister(&idtoname_cache);
+                cache_unregister_net(&idtoname_cache, &init_net);
         return rv;
 }
 
 void
 nfsd_idmap_shutdown(void)
 {
-        cache_unregister(&idtoname_cache);
-        cache_unregister(&nametoid_cache);
+        cache_unregister_net(&idtoname_cache, &init_net);
+        cache_unregister_net(&nametoid_cache, &init_net);
 }
 
 static int
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index c5e28ed8bca0..896da74ec563 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -266,10 +266,6 @@ do_open_fhandle(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_
 {
         __be32 status;
 
-        /* Only reclaims from previously confirmed clients are valid */
-        if ((status = nfs4_check_open_reclaim(&open->op_clientid)))
-                return status;
-
         /* We don't know the target directory, and therefore can not
         * set the change info
         */
@@ -373,6 +369,9 @@ nfsd4_open(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                         break;
                 case NFS4_OPEN_CLAIM_PREVIOUS:
                         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
+                        status = nfs4_check_open_reclaim(&open->op_clientid);
+                        if (status)
+                                goto out;
                 case NFS4_OPEN_CLAIM_FH:
                 case NFS4_OPEN_CLAIM_DELEG_CUR_FH:
                         status = do_open_fhandle(rqstp, &cstate->current_fh,
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 80a0be9ed008..0b3e875d1abd 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -117,8 +117,7 @@ out_no_tfm:
         return status;
 }
 
-int
-nfsd4_create_clid_dir(struct nfs4_client *clp)
+void nfsd4_create_clid_dir(struct nfs4_client *clp)
 {
         const struct cred *original_cred;
         char *dname = clp->cl_recdir;
@@ -127,13 +126,14 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
 
         dprintk("NFSD: nfsd4_create_clid_dir for \"%s\"\n", dname);
 
-        if (!rec_file || clp->cl_firststate)
-                return 0;
-
+        if (clp->cl_firststate)
+                return;
         clp->cl_firststate = 1;
+        if (!rec_file)
+                return;
         status = nfs4_save_creds(&original_cred);
         if (status < 0)
-                return status;
+                return;
 
         dir = rec_file->f_path.dentry;
         /* lock the parent */
@@ -144,8 +144,15 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
                 status = PTR_ERR(dentry);
                 goto out_unlock;
         }
-        status = -EEXIST;
         if (dentry->d_inode)
+                /*
+                 * In the 4.1 case, where we're called from
+                 * reclaim_complete(), records from the previous reboot
+                 * may still be left, so this is OK.
+                 *
+                 * In the 4.0 case, we should never get here; but we may
+                 * as well be forgiving and just succeed silently.
+                 */
                 goto out_put;
         status = mnt_want_write_file(rec_file);
         if (status)
@@ -164,7 +171,6 @@ out_unlock:
                                 " and is writeable", status,
                                 user_recovery_dirname);
         nfs4_reset_creds(original_cred);
-        return status;
 }
 
 typedef int (recdir_func)(struct dentry *, struct dentry *);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 9ca16dc09e04..e8c98f009670 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -49,12 +49,20 @@
 time_t nfsd4_lease = 90;     /* default lease time */
 time_t nfsd4_grace = 90;
 static time_t boot_time;
-static stateid_t zerostateid;             /* bits all 0 */
-static stateid_t onestateid;              /* bits all 1 */
+
+#define all_ones {{~0,~0},~0}
+static const stateid_t one_stateid = {
+        .si_generation = ~0,
+        .si_opaque = all_ones,
+};
+static const stateid_t zero_stateid = {
+        /* all fields zero */
+};
+
 static u64 current_sessionid = 1;
 
-#define ZERO_STATEID(stateid) (!memcmp((stateid), &zerostateid, sizeof(stateid_t)))
-#define ONE_STATEID(stateid)  (!memcmp((stateid), &onestateid, sizeof(stateid_t)))
+#define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
+#define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
 
 /* forward declarations */
 static int check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner);
@@ -133,21 +141,21 @@ unsigned int max_delegations;
  * Open owner state (share locks)
  */
 
-/* hash tables for open owners */
-#define OPEN_OWNER_HASH_BITS              8
-#define OPEN_OWNER_HASH_SIZE             (1 << OPEN_OWNER_HASH_BITS)
-#define OPEN_OWNER_HASH_MASK             (OPEN_OWNER_HASH_SIZE - 1)
+/* hash tables for lock and open owners */
+#define OWNER_HASH_BITS              8
+#define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
+#define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 
-static unsigned int open_ownerstr_hashval(u32 clientid, struct xdr_netobj *ownername)
+static unsigned int ownerstr_hashval(u32 clientid, struct xdr_netobj *ownername)
 {
         unsigned int ret;
 
         ret = opaque_hashval(ownername->data, ownername->len);
         ret += clientid;
-        return ret & OPEN_OWNER_HASH_MASK;
+        return ret & OWNER_HASH_MASK;
 }
 
-static struct list_head open_ownerstr_hashtbl[OPEN_OWNER_HASH_SIZE];
+static struct list_head ownerstr_hashtbl[OWNER_HASH_SIZE];
 
 /* hash table for nfs4_file */
 #define FILE_HASH_BITS                   8
@@ -514,6 +522,7 @@ static void unhash_lockowner(struct nfs4_lockowner *lo)
 
         list_del(&lo->lo_owner.so_strhash);
         list_del(&lo->lo_perstateid);
+        list_del(&lo->lo_owner_ino_hash);
         while (!list_empty(&lo->lo_owner.so_stateids)) {
                 stp = list_first_entry(&lo->lo_owner.so_stateids,
                                 struct nfs4_ol_stateid, st_perstateowner);
@@ -985,12 +994,11 @@ static struct nfs4_client *alloc_client(struct xdr_netobj name)
         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
         if (clp == NULL)
                 return NULL;
-        clp->cl_name.data = kmalloc(name.len, GFP_KERNEL);
+        clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
         if (clp->cl_name.data == NULL) {
                 kfree(clp);
                 return NULL;
         }
-        memcpy(clp->cl_name.data, name.data, name.len);
         clp->cl_name.len = name.len;
         return clp;
 }
@@ -1058,7 +1066,6 @@ expire_client(struct nfs4_client *clp)
         spin_unlock(&recall_lock);
         while (!list_empty(&reaplist)) {
                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
-                list_del_init(&dp->dl_recall_lru);
                 unhash_delegation(dp);
         }
         while (!list_empty(&clp->cl_openowners)) {
@@ -2301,7 +2308,7 @@ nfsd4_free_slabs(void)
         nfsd4_free_slab(&deleg_slab);
 }
 
-static int
+int
 nfsd4_init_slabs(void)
 {
         openowner_slab = kmem_cache_create("nfsd4_openowners",
@@ -2373,7 +2380,7 @@ static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj
 
 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
 {
-        list_add(&oo->oo_owner.so_strhash, &open_ownerstr_hashtbl[strhashval]);
+        list_add(&oo->oo_owner.so_strhash, &ownerstr_hashtbl[strhashval]);
         list_add(&oo->oo_perclient, &clp->cl_openowners);
 }
 
@@ -2436,7 +2443,9 @@ find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open)
         struct nfs4_stateowner *so;
         struct nfs4_openowner *oo;
 
-        list_for_each_entry(so, &open_ownerstr_hashtbl[hashval], so_strhash) {
+        list_for_each_entry(so, &ownerstr_hashtbl[hashval], so_strhash) {
+                if (!so->so_is_open_owner)
+                        continue;
                 if (same_owner_str(so, &open->op_owner, &open->op_clientid)) {
                         oo = openowner(so);
                         renew_client(oo->oo_owner.so_client);
@@ -2580,7 +2589,7 @@ nfsd4_process_open1(struct nfsd4_compound_state *cstate,
         if (open->op_file == NULL)
                 return nfserr_jukebox;
 
-        strhashval = open_ownerstr_hashval(clientid->cl_id, &open->op_owner);
+        strhashval = ownerstr_hashval(clientid->cl_id, &open->op_owner);
         oo = find_openstateowner_str(strhashval, open);
         open->op_openowner = oo;
         if (!oo) {
@@ -3123,7 +3132,6 @@ nfs4_laundromat(void)
         spin_unlock(&recall_lock);
         list_for_each_safe(pos, next, &reaplist) {
                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
-                list_del_init(&dp->dl_recall_lru);
                 unhash_delegation(dp);
         }
         test_val = nfsd4_lease;
@@ -3718,13 +3726,11 @@ out:
 }
 
 
-/* 
- * Lock owner state (byte-range locks)
- */
 #define LOFF_OVERFLOW(start, len)      ((u64)(len) > ~(u64)(start))
-#define LOCK_HASH_BITS              8
-#define LOCK_HASH_SIZE             (1 << LOCK_HASH_BITS)
-#define LOCK_HASH_MASK             (LOCK_HASH_SIZE - 1)
+
+#define LOCKOWNER_INO_HASH_BITS 8
+#define LOCKOWNER_INO_HASH_SIZE (1 << LOCKOWNER_INO_HASH_BITS)
+#define LOCKOWNER_INO_HASH_MASK (LOCKOWNER_INO_HASH_SIZE - 1)
 
 static inline u64
 end_offset(u64 start, u64 len)
@@ -3746,16 +3752,14 @@ last_byte_offset(u64 start, u64 len)
         return end > start ? end - 1: NFS4_MAX_UINT64;
 }
 
-static inline unsigned int
-lock_ownerstr_hashval(struct inode *inode, u32 cl_id,
-                struct xdr_netobj *ownername)
+static unsigned int lockowner_ino_hashval(struct inode *inode, u32 cl_id, struct xdr_netobj *ownername)
 {
         return (file_hashval(inode) + cl_id
                         + opaque_hashval(ownername->data, ownername->len))
-                & LOCK_HASH_MASK;
+                & LOCKOWNER_INO_HASH_MASK;
 }
 
-static struct list_head lock_ownerstr_hashtbl[LOCK_HASH_SIZE];
+static struct list_head lockowner_ino_hashtbl[LOCKOWNER_INO_HASH_SIZE];
 
 /*
  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
@@ -3809,23 +3813,39 @@ nevermind:
                 deny->ld_type = NFS4_WRITE_LT;
 }
 
+static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, clientid_t *clid, struct xdr_netobj *owner)
+{
+        struct nfs4_ol_stateid *lst;
+
+        if (!same_owner_str(&lo->lo_owner, owner, clid))
+                return false;
+        lst = list_first_entry(&lo->lo_owner.so_stateids,
+                               struct nfs4_ol_stateid, st_perstateowner);
+        return lst->st_file->fi_inode == inode;
+}
+
 static struct nfs4_lockowner *
 find_lockowner_str(struct inode *inode, clientid_t *clid,
                 struct xdr_netobj *owner)
 {
-        unsigned int hashval = lock_ownerstr_hashval(inode, clid->cl_id, owner);
-        struct nfs4_stateowner *op;
+        unsigned int hashval = lockowner_ino_hashval(inode, clid->cl_id, owner);
+        struct nfs4_lockowner *lo;
 
-        list_for_each_entry(op, &lock_ownerstr_hashtbl[hashval], so_strhash) {
-                if (same_owner_str(op, owner, clid))
-                        return lockowner(op);
+        list_for_each_entry(lo, &lockowner_ino_hashtbl[hashval], lo_owner_ino_hash) {
+                if (same_lockowner_ino(lo, inode, clid, owner))
+                        return lo;
         }
         return NULL;
 }
 
 static void hash_lockowner(struct nfs4_lockowner *lo, unsigned int strhashval, struct nfs4_client *clp, struct nfs4_ol_stateid *open_stp)
 {
-        list_add(&lo->lo_owner.so_strhash, &lock_ownerstr_hashtbl[strhashval]);
+        struct inode *inode = open_stp->st_file->fi_inode;
+        unsigned int inohash = lockowner_ino_hashval(inode,
+                        clp->cl_clientid.cl_id, &lo->lo_owner.so_owner);
+
+        list_add(&lo->lo_owner.so_strhash, &ownerstr_hashtbl[strhashval]);
+        list_add(&lo->lo_owner_ino_hash, &lockowner_ino_hashtbl[inohash]);
         list_add(&lo->lo_perstateid, &open_stp->st_lockowners);
 }
 
@@ -3834,7 +3854,7 @@ static void hash_lockowner(struct nfs4_lockowner *lo, unsigned int strhashval, s
  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has 
  * occurred. 
  *
- * strhashval = lock_ownerstr_hashval 
+ * strhashval = ownerstr_hashval
  */
 
 static struct nfs4_lockowner *
@@ -3892,6 +3912,37 @@ static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
         __set_bit(access, &lock_stp->st_access_bmap);
 }
 
+__be32 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, struct nfs4_ol_stateid *ost, struct nfsd4_lock *lock, struct nfs4_ol_stateid **lst, bool *new)
+{
+        struct nfs4_file *fi = ost->st_file;
+        struct nfs4_openowner *oo = openowner(ost->st_stateowner);
+        struct nfs4_client *cl = oo->oo_owner.so_client;
+        struct nfs4_lockowner *lo;
+        unsigned int strhashval;
+
+        lo = find_lockowner_str(fi->fi_inode, &cl->cl_clientid, &lock->v.new.owner);
+        if (lo) {
+                if (!cstate->minorversion)
+                        return nfserr_bad_seqid;
+                /* XXX: a lockowner always has exactly one stateid: */
+                *lst = list_first_entry(&lo->lo_owner.so_stateids,
+                                struct nfs4_ol_stateid, st_perstateowner);
+                return nfs_ok;
+        }
+        strhashval = ownerstr_hashval(cl->cl_clientid.cl_id,
+                        &lock->v.new.owner);
+        lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
+        if (lo == NULL)
+                return nfserr_jukebox;
+        *lst = alloc_init_lock_stateid(lo, fi, ost);
+        if (*lst == NULL) {
+                release_lockowner(lo);
+                return nfserr_jukebox;
+        }
+        *new = true;
+        return nfs_ok;
+}
+
 /*
  *  LOCK operation 
  */
@@ -3907,7 +3958,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         struct file_lock file_lock;
         struct file_lock conflock;
         __be32 status = 0;
-        unsigned int strhashval;
+        bool new_state = false;
         int lkflg;
         int err;
 
@@ -3933,10 +3984,15 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                  * lock stateid.
                  */
                 struct nfs4_ol_stateid *open_stp = NULL;
-                
+
+                if (nfsd4_has_session(cstate))
+                        /* See rfc 5661 18.10.3: given clientid is ignored: */
+                        memcpy(&lock->v.new.clientid,
+                                &cstate->session->se_client->cl_clientid,
+                                sizeof(clientid_t));
+
                 status = nfserr_stale_clientid;
-                if (!nfsd4_has_session(cstate) &&
-                    STALE_CLIENTID(&lock->lk_new_clientid))
+                if (STALE_CLIENTID(&lock->lk_new_clientid))
                         goto out;
 
                 /* validate and update open stateid and open seqid */
@@ -3948,25 +4004,12 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                         goto out;
                 open_sop = openowner(open_stp->st_stateowner);
                 status = nfserr_bad_stateid;
-                if (!nfsd4_has_session(cstate) &&
-                        !same_clid(&open_sop->oo_owner.so_client->cl_clientid,
+                if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
                                                 &lock->v.new.clientid))
                         goto out;
-                /* create lockowner and lock stateid */
-                fp = open_stp->st_file;
-                strhashval = lock_ownerstr_hashval(fp->fi_inode,
-                                open_sop->oo_owner.so_client->cl_clientid.cl_id,
-                                &lock->v.new.owner);
-                /* XXX: Do we need to check for duplicate stateowners on
-                 * the same file, or should they just be allowed (and
-                 * create new stateids)? */
-                status = nfserr_jukebox;
-                lock_sop = alloc_init_lock_stateowner(strhashval,
-                                open_sop->oo_owner.so_client, open_stp, lock);
-                if (lock_sop == NULL)
-                        goto out;
-                lock_stp = alloc_init_lock_stateid(lock_sop, fp, open_stp);
-                if (lock_stp == NULL)
+                status = lookup_or_create_lock_state(cstate, open_stp, lock,
+                                                        &lock_stp, &new_state);
+                if (status)
                         goto out;
         } else {
                 /* lock (lock owner + lock stateid) already exists */
@@ -3976,10 +4019,9 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                                        NFS4_LOCK_STID, &lock_stp);
                 if (status)
                         goto out;
-                lock_sop = lockowner(lock_stp->st_stateowner);
-                fp = lock_stp->st_file;
         }
-        /* lock_sop and lock_stp have been created or found */
+        lock_sop = lockowner(lock_stp->st_stateowner);
+        fp = lock_stp->st_file;
 
         lkflg = setlkflg(lock->lk_type);
         status = nfs4_check_openmode(lock_stp, lkflg);
@@ -4054,7 +4096,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 break;
         }
 out:
-        if (status && lock->lk_is_new && lock_sop)
+        if (status && new_state)
                 release_lockowner(lock_sop);
         if (!cstate->replay_owner)
                 nfs4_unlock_state();
@@ -4251,7 +4293,7 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp,
         struct nfs4_ol_stateid *stp;
         struct xdr_netobj *owner = &rlockowner->rl_owner;
         struct list_head matches;
-        int i;
+        unsigned int hashval = ownerstr_hashval(clid->cl_id, owner);
         __be32 status;
 
         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
@@ -4266,22 +4308,19 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp,
         nfs4_lock_state();
 
         status = nfserr_locks_held;
-        /* XXX: we're doing a linear search through all the lockowners.
-         * Yipes!  For now we'll just hope clients aren't really using
-         * release_lockowner much, but eventually we have to fix these
-         * data structures. */
         INIT_LIST_HEAD(&matches);
-        for (i = 0; i < LOCK_HASH_SIZE; i++) {
-                list_for_each_entry(sop, &lock_ownerstr_hashtbl[i], so_strhash) {
-                        if (!same_owner_str(sop, owner, clid))
-                                continue;
-                        list_for_each_entry(stp, &sop->so_stateids,
-                                        st_perstateowner) {
-                                lo = lockowner(sop);
-                                if (check_for_locks(stp->st_file, lo))
-                                        goto out;
-                                list_add(&lo->lo_list, &matches);
-                        }
+
+        list_for_each_entry(sop, &ownerstr_hashtbl[hashval], so_strhash) {
+                if (sop->so_is_open_owner)
+                        continue;
+                if (!same_owner_str(sop, owner, clid))
+                        continue;
+                list_for_each_entry(stp, &sop->so_stateids,
+                                st_perstateowner) {
+                        lo = lockowner(sop);
+                        if (check_for_locks(stp->st_file, lo))
+                                goto out;
+                        list_add(&lo->lo_list, &matches);
                 }
         }
         /* Clients probably won't expect us to return with some (but not all)
@@ -4394,16 +4433,127 @@ nfs4_check_open_reclaim(clientid_t *clid)
         return nfs4_find_reclaim_client(clid) ? nfs_ok : nfserr_reclaim_bad;
 }
 
+#ifdef CONFIG_NFSD_FAULT_INJECTION
+
+void nfsd_forget_clients(u64 num)
+{
+        struct nfs4_client *clp, *next;
+        int count = 0;
+
+        nfs4_lock_state();
+        list_for_each_entry_safe(clp, next, &client_lru, cl_lru) {
+                nfsd4_remove_clid_dir(clp);
+                expire_client(clp);
+                if (++count == num)
+                        break;
+        }
+        nfs4_unlock_state();
+
+        printk(KERN_INFO "NFSD: Forgot %d clients", count);
+}
+
+static void release_lockowner_sop(struct nfs4_stateowner *sop)
+{
+        release_lockowner(lockowner(sop));
+}
+
+static void release_openowner_sop(struct nfs4_stateowner *sop)
+{
+        release_openowner(openowner(sop));
+}
+
+static int nfsd_release_n_owners(u64 num, bool is_open_owner,
+                                void (*release_sop)(struct nfs4_stateowner *))
+{
+        int i, count = 0;
+        struct nfs4_stateowner *sop, *next;
+
+        for (i = 0; i < OWNER_HASH_SIZE; i++) {
+                list_for_each_entry_safe(sop, next, &ownerstr_hashtbl[i], so_strhash) {
+                        if (sop->so_is_open_owner != is_open_owner)
+                                continue;
+                        release_sop(sop);
+                        if (++count == num)
+                                return count;
+                }
+        }
+        return count;
+}
+
+void nfsd_forget_locks(u64 num)
+{
+        int count;
+
+        nfs4_lock_state();
+        count = nfsd_release_n_owners(num, false, release_lockowner_sop);
+        nfs4_unlock_state();
+
+        printk(KERN_INFO "NFSD: Forgot %d locks", count);
+}
+
+void nfsd_forget_openowners(u64 num)
+{
+        int count;
+
+        nfs4_lock_state();
+        count = nfsd_release_n_owners(num, true, release_openowner_sop);
+        nfs4_unlock_state();
+
+        printk(KERN_INFO "NFSD: Forgot %d open owners", count);
+}
+
+int nfsd_process_n_delegations(u64 num, void (*deleg_func)(struct nfs4_delegation *))
+{
+        int i, count = 0;
+        struct nfs4_file *fp, *fnext;
+        struct nfs4_delegation *dp, *dnext;
+
+        for (i = 0; i < FILE_HASH_SIZE; i++) {
+                list_for_each_entry_safe(fp, fnext, &file_hashtbl[i], fi_hash) {
+                        list_for_each_entry_safe(dp, dnext, &fp->fi_delegations, dl_perfile) {
+                                deleg_func(dp);
+                                if (++count == num)
+                                        return count;
+                        }
+                }
+        }
+
+        return count;
+}
+
+void nfsd_forget_delegations(u64 num)
+{
+        unsigned int count;
+
+        nfs4_lock_state();
+        count = nfsd_process_n_delegations(num, unhash_delegation);
+        nfs4_unlock_state();
+
+        printk(KERN_INFO "NFSD: Forgot %d delegations", count);
+}
+
+void nfsd_recall_delegations(u64 num)
+{
+        unsigned int count;
+
+        nfs4_lock_state();
+        spin_lock(&recall_lock);
+        count = nfsd_process_n_delegations(num, nfsd_break_one_deleg);
+        spin_unlock(&recall_lock);
+        nfs4_unlock_state();
+
+        printk(KERN_INFO "NFSD: Recalled %d delegations", count);
+}
+
+#endif /* CONFIG_NFSD_FAULT_INJECTION */
+
 /* initialization to perform at module load time: */
 
-int
+void
 nfs4_state_init(void)
 {
-        int i, status;
+        int i;
 
-        status = nfsd4_init_slabs();
-        if (status)
-                return status;
         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
                 INIT_LIST_HEAD(&conf_id_hashtbl[i]);
                 INIT_LIST_HEAD(&conf_str_hashtbl[i]);
@@ -4416,18 +4566,15 @@ nfs4_state_init(void)
         for (i = 0; i < FILE_HASH_SIZE; i++) {
                 INIT_LIST_HEAD(&file_hashtbl[i]);
         }
-        for (i = 0; i < OPEN_OWNER_HASH_SIZE; i++) {
-                INIT_LIST_HEAD(&open_ownerstr_hashtbl[i]);
-        }
-        for (i = 0; i < LOCK_HASH_SIZE; i++) {
-                INIT_LIST_HEAD(&lock_ownerstr_hashtbl[i]);
+        for (i = 0; i < OWNER_HASH_SIZE; i++) {
+                INIT_LIST_HEAD(&ownerstr_hashtbl[i]);
         }
-        memset(&onestateid, ~0, sizeof(stateid_t));
+        for (i = 0; i < LOCKOWNER_INO_HASH_SIZE; i++)
+                INIT_LIST_HEAD(&lockowner_ino_hashtbl[i]);
         INIT_LIST_HEAD(&close_lru);
         INIT_LIST_HEAD(&client_lru);
         INIT_LIST_HEAD(&del_recall_lru);
         reclaim_str_hashtbl_size = 0;
-        return 0;
 }
 
 static void
@@ -4526,7 +4673,6 @@ __nfs4_state_shutdown(void)
         spin_unlock(&recall_lock);
         list_for_each_safe(pos, next, &reaplist) {
                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
-                list_del_init(&dp->dl_recall_lru);
                 unhash_delegation(dp);
         }
 
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index b6fa792d6b85..0ec5a1b9700e 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -215,10 +215,9 @@ defer_free(struct nfsd4_compoundargs *argp,
 static char *savemem(struct nfsd4_compoundargs *argp, __be32 *p, int nbytes)
 {
         if (p == argp->tmp) {
-                p = kmalloc(nbytes, GFP_KERNEL);
+                p = kmemdup(argp->tmp, nbytes, GFP_KERNEL);
                 if (!p)
                         return NULL;
-                memcpy(p, argp->tmp, nbytes);
         } else {
                 BUG_ON(p != argp->tmpp);
                 argp->tmpp = NULL;
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index bb4a11d58a5a..748eda93ce59 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -18,6 +18,7 @@
 #include "idmap.h"
 #include "nfsd.h"
 #include "cache.h"
+#include "fault_inject.h"
 
 /*
  *      We have a single directory with several nodes in it.
@@ -1128,9 +1129,13 @@ static int __init init_nfsd(void)
         int retval;
         printk(KERN_INFO "Installing knfsd (copyright (C) 1996 okir@monad.swb.de).\n");
 
-        retval = nfs4_state_init(); /* nfs4 locking state */
+        retval = nfsd4_init_slabs();
         if (retval)
                 return retval;
+        nfs4_state_init();
+        retval = nfsd_fault_inject_init(); /* nfsd fault injection controls */
+        if (retval)
+                goto out_free_slabs;
         nfsd_stat_init();       /* Statistics */
         retval = nfsd_reply_cache_init();
         if (retval)
@@ -1161,6 +1166,8 @@ out_free_cache:
         nfsd_reply_cache_shutdown();
 out_free_stat:
         nfsd_stat_shutdown();
+        nfsd_fault_inject_cleanup();
+out_free_slabs:
         nfsd4_free_slabs();
         return retval;
 }
@@ -1175,6 +1182,7 @@ static void __exit exit_nfsd(void)
         nfsd_lockd_shutdown();
         nfsd_idmap_shutdown();
         nfsd4_free_slabs();
+        nfsd_fault_inject_cleanup();
         unregister_filesystem(&nfsd_fs_type);
 }
 
diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
index 58134a23fdfb..1d1e8589b4ce 100644
--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -104,14 +104,16 @@ static inline int nfsd_v4client(struct svc_rqst *rq)
  */
 #ifdef CONFIG_NFSD_V4
 extern unsigned int max_delegations;
-int nfs4_state_init(void);
+void nfs4_state_init(void);
+int nfsd4_init_slabs(void);
 void nfsd4_free_slabs(void);
 int nfs4_state_start(void);
 void nfs4_state_shutdown(void);
 void nfs4_reset_lease(time_t leasetime);
 int nfs4_reset_recoverydir(char *recdir);
 #else
-static inline int nfs4_state_init(void) { return 0; }
+static inline void nfs4_state_init(void) { }
+static inline int nfsd4_init_slabs(void) { return 0; }
 static inline void nfsd4_free_slabs(void) { }
 static inline int nfs4_state_start(void) { return 0; }
 static inline void nfs4_state_shutdown(void) { }
@@ -338,15 +340,15 @@ static inline u32 nfsd_suppattrs2(u32 minorversion)
 }
 
 /* These will return ERR_INVAL if specified in GETATTR or READDIR. */
-#define NFSD_WRITEONLY_ATTRS_WORD1                                                          \
-(FATTR4_WORD1_TIME_ACCESS_SET   | FATTR4_WORD1_TIME_MODIFY_SET)
+#define NFSD_WRITEONLY_ATTRS_WORD1 \
+        (FATTR4_WORD1_TIME_ACCESS_SET   | FATTR4_WORD1_TIME_MODIFY_SET)
 
 /* These are the only attrs allowed in CREATE/OPEN/SETATTR. */
-#define NFSD_WRITEABLE_ATTRS_WORD0                                                          \
-(FATTR4_WORD0_SIZE              | FATTR4_WORD0_ACL                                         )
-#define NFSD_WRITEABLE_ATTRS_WORD1                                                          \
-(FATTR4_WORD1_MODE              | FATTR4_WORD1_OWNER         | FATTR4_WORD1_OWNER_GROUP     \
- | FATTR4_WORD1_TIME_ACCESS_SET | FATTR4_WORD1_TIME_MODIFY_SET)
+#define NFSD_WRITEABLE_ATTRS_WORD0 \
+        (FATTR4_WORD0_SIZE | FATTR4_WORD0_ACL)
+#define NFSD_WRITEABLE_ATTRS_WORD1 \
+        (FATTR4_WORD1_MODE | FATTR4_WORD1_OWNER | FATTR4_WORD1_OWNER_GROUP \
+        | FATTR4_WORD1_TIME_ACCESS_SET | FATTR4_WORD1_TIME_MODIFY_SET)
 #define NFSD_WRITEABLE_ATTRS_WORD2 0
 
 #define NFSD_SUPPATTR_EXCLCREAT_WORD0 \
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index a3cf38476a1b..ffb5df1db94f 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -366,6 +366,7 @@ struct nfs4_openowner {
 
 struct nfs4_lockowner {
         struct nfs4_stateowner  lo_owner; /* must be first element */
+        struct list_head        lo_owner_ino_hash; /* hash by owner,file */
         struct list_head        lo_perstateid; /* for lockowners only */
         struct list_head        lo_list; /* for temporary uses */
 };
@@ -482,7 +483,7 @@ extern void nfsd4_shutdown_recdir(void);
 extern int nfs4_client_to_reclaim(const char *name);
 extern int nfs4_has_reclaimed_state(const char *name, bool use_exchange_id);
 extern void nfsd4_recdir_purge_old(void);
-extern int nfsd4_create_clid_dir(struct nfs4_client *clp);
+extern void nfsd4_create_clid_dir(struct nfs4_client *clp);
 extern void nfsd4_remove_clid_dir(struct nfs4_client *clp);
 extern void release_session_client(struct nfsd4_session *);
 extern __be32 nfs4_validate_stateid(struct nfs4_client *, stateid_t *);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index d25a723b68ad..edf6d3ed8777 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -594,8 +594,19 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry, struct nfs4_ac
         return error;
 }
 
-#define NFSD_XATTR_JUNCTION_PREFIX XATTR_TRUSTED_PREFIX "junction."
-#define NFSD_XATTR_JUNCTION_TYPE NFSD_XATTR_JUNCTION_PREFIX "type"
+/*
+ * NFS junction information is stored in an extended attribute.
+ */
+#define NFSD_JUNCTION_XATTR_NAME        XATTR_TRUSTED_PREFIX "junction.nfs"
+
+/**
+ * nfsd4_is_junction - Test if an object could be an NFS junction
+ *
+ * @dentry: object to test
+ *
+ * Returns 1 if "dentry" appears to contain NFS junction information.
+ * Otherwise 0 is returned.
+ */
 int nfsd4_is_junction(struct dentry *dentry)
 {
         struct inode *inode = dentry->d_inode;
@@ -606,7 +617,7 @@ int nfsd4_is_junction(struct dentry *dentry)
                 return 0;
         if (!(inode->i_mode & S_ISVTX))
                 return 0;
-        if (vfs_getxattr(dentry, NFSD_XATTR_JUNCTION_TYPE, NULL, 0) <= 0)
+        if (vfs_getxattr(dentry, NFSD_JUNCTION_XATTR_NAME, NULL, 0) <= 0)
                 return 0;
         return 1;
 }
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index e14587d55689..f104d565b682 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -135,9 +135,6 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
 
         mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
 
-        /* 1 from caller and 1 for being on i_list/g_list */
-        BUG_ON(atomic_read(&mark->refcnt) < 2);
-
         spin_lock(&group->mark_lock);
 
         if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) {
@@ -182,6 +179,11 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
                 iput(inode);
 
         /*
+         * We don't necessarily have a ref on mark from caller so the above iput
+         * may have already destroyed it.  Don't touch from now on.
+         */
+
+        /*
          * it's possible that this group tried to destroy itself, but this
          * this mark was simultaneously being freed by inode.  If that's the
          * case, we finish freeing the group here.
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 608be4516091..5a4a8af5c406 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -3198,7 +3198,7 @@ MODULE_DESCRIPTION("NTFS 1.2/3.x driver - Copyright (c) 2001-2011 Anton Altaparm
 MODULE_VERSION(NTFS_VERSION);
 MODULE_LICENSE("GPL");
 #ifdef DEBUG
-module_param(debug_msgs, bool, 0);
+module_param(debug_msgs, bint, 0);
 MODULE_PARM_DESC(debug_msgs, "Enable debug messages.");
 #endif
 
diff --git a/fs/pipe.c b/fs/pipe.c
index f0e485d54e64..a932ced92a16 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1137,7 +1137,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
         if (nr_pages < pipe->nrbufs)
                 return -EBUSY;
 
-        bufs = kcalloc(nr_pages, sizeof(struct pipe_buffer), GFP_KERNEL);
+        bufs = kcalloc(nr_pages, sizeof(*bufs), GFP_KERNEL | __GFP_NOWARN);
         if (unlikely(!bufs))
                 return -ENOMEM;
 
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 8c344f037bd0..c602b8d20f06 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -380,7 +380,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
 
         state = *get_task_state(task);
         vsize = eip = esp = 0;
-        permitted = ptrace_may_access(task, PTRACE_MODE_READ);
+        permitted = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT);
         mm = get_task_mm(task);
         if (mm) {
                 vsize = task_vsize(mm);
@@ -464,7 +464,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
 
         seq_printf(m, "%d (%s) %c %d %d %d %d %d %u %lu \
 %lu %lu %lu %lu %lu %ld %ld %ld %ld %d 0 %llu %lu %ld %lu %lu %lu %lu %lu \
-%lu %lu %lu %lu %lu %lu %lu %lu %d %d %u %u %llu %lu %ld\n",
+%lu %lu %lu %lu %lu %lu %lu %lu %d %d %u %u %llu %lu %ld %lu %lu %lu\n",
                 pid_nr_ns(pid, ns),
                 tcomm,
                 state,
@@ -511,7 +511,10 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                 task->policy,
                 (unsigned long long)delayacct_blkio_ticks(task),
                 cputime_to_clock_t(gtime),
-                cputime_to_clock_t(cgtime));
+                cputime_to_clock_t(cgtime),
+                (mm && permitted) ? mm->start_data : 0,
+                (mm && permitted) ? mm->end_data : 0,
+                (mm && permitted) ? mm->start_brk : 0);
         if (mm)
                 mmput(mm);
         return 0;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 8173dfd89cb2..9cde9edf9c4d 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -198,65 +198,7 @@ static int proc_root_link(struct dentry *dentry, struct path *path)
         return result;
 }
 
-static struct mm_struct *__check_mem_permission(struct task_struct *task)
-{
-        struct mm_struct *mm;
-
-        mm = get_task_mm(task);
-        if (!mm)
-                return ERR_PTR(-EINVAL);
-
-        /*
-         * A task can always look at itself, in case it chooses
-         * to use system calls instead of load instructions.
-         */
-        if (task == current)
-                return mm;
-
-        /*
-         * If current is actively ptrace'ing, and would also be
-         * permitted to freshly attach with ptrace now, permit it.
-         */
-        if (task_is_stopped_or_traced(task)) {
-                int match;
-                rcu_read_lock();
-                match = (ptrace_parent(task) == current);
-                rcu_read_unlock();
-                if (match && ptrace_may_access(task, PTRACE_MODE_ATTACH))
-                        return mm;
-        }
-
-        /*
-         * No one else is allowed.
-         */
-        mmput(mm);
-        return ERR_PTR(-EPERM);
-}
-
-/*
- * If current may access user memory in @task return a reference to the
- * corresponding mm, otherwise ERR_PTR.
- */
-static struct mm_struct *check_mem_permission(struct task_struct *task)
-{
-        struct mm_struct *mm;
-        int err;
-
-        /*
-         * Avoid racing if task exec's as we might get a new mm but validate
-         * against old credentials.
-         */
-        err = mutex_lock_killable(&task->signal->cred_guard_mutex);
-        if (err)
-                return ERR_PTR(err);
-
-        mm = __check_mem_permission(task);
-        mutex_unlock(&task->signal->cred_guard_mutex);
-
-        return mm;
-}
-
-struct mm_struct *mm_for_maps(struct task_struct *task)
+static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
 {
         struct mm_struct *mm;
         int err;
@@ -267,7 +209,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
 
         mm = get_task_mm(task);
         if (mm && mm != current->mm &&
-                        !ptrace_may_access(task, PTRACE_MODE_READ)) {
+                        !ptrace_may_access(task, mode)) {
                 mmput(mm);
                 mm = ERR_PTR(-EACCES);
         }
@@ -276,6 +218,11 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
         return mm;
 }
 
+struct mm_struct *mm_for_maps(struct task_struct *task)
+{
+        return mm_access(task, PTRACE_MODE_READ);
+}
+
 static int proc_pid_cmdline(struct task_struct *task, char * buffer)
 {
         int res = 0;
@@ -654,6 +601,8 @@ static int proc_pid_permission(struct inode *inode, int mask)
         bool has_perms;
 
         task = get_proc_task(inode);
+        if (!task)
+                return -ESRCH;
         has_perms = has_pid_permissions(pid, task, 1);
         put_task_struct(task);
 
@@ -750,38 +699,39 @@ static const struct file_operations proc_single_file_operations = {
 
 static int mem_open(struct inode* inode, struct file* file)
 {
-        file->private_data = (void*)((long)current->self_exec_id);
+        struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
+        struct mm_struct *mm;
+
+        if (!task)
+                return -ESRCH;
+
+        mm = mm_access(task, PTRACE_MODE_ATTACH);
+        put_task_struct(task);
+
+        if (IS_ERR(mm))
+                return PTR_ERR(mm);
+
         /* OK to pass negative loff_t, we can catch out-of-range */
         file->f_mode |= FMODE_UNSIGNED_OFFSET;
+        file->private_data = mm;
+
         return 0;
 }
 
 static ssize_t mem_read(struct file * file, char __user * buf,
                         size_t count, loff_t *ppos)
 {
-        struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
+        int ret;
         char *page;
         unsigned long src = *ppos;
-        int ret = -ESRCH;
-        struct mm_struct *mm;
+        struct mm_struct *mm = file->private_data;
 
-        if (!task)
-                goto out_no_task;
+        if (!mm)
+                return 0;
 
-        ret = -ENOMEM;
         page = (char *)__get_free_page(GFP_TEMPORARY);
         if (!page)
-                goto out;
-
-        mm = check_mem_permission(task);
-        ret = PTR_ERR(mm);
-        if (IS_ERR(mm))
-                goto out_free;
-
-        ret = -EIO;
- 
-        if (file->private_data != (void*)((long)current->self_exec_id))
-                goto out_put;
+                return -ENOMEM;
 
         ret = 0;
  
@@ -808,13 +758,7 @@ static ssize_t mem_read(struct file * file, char __user * buf,
         }
         *ppos = src;
 
-out_put:
-        mmput(mm);
-out_free:
         free_page((unsigned long) page);
-out:
-        put_task_struct(task);
-out_no_task:
         return ret;
 }
 
@@ -823,27 +767,15 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
 {
         int copied;
         char *page;
-        struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
         unsigned long dst = *ppos;
-        struct mm_struct *mm;
+        struct mm_struct *mm = file->private_data;
 
-        copied = -ESRCH;
-        if (!task)
-                goto out_no_task;
+        if (!mm)
+                return 0;
 
-        copied = -ENOMEM;
         page = (char *)__get_free_page(GFP_TEMPORARY);
         if (!page)
-                goto out_task;
-
-        mm = check_mem_permission(task);
-        copied = PTR_ERR(mm);
-        if (IS_ERR(mm))
-                goto out_free;
-
-        copied = -EIO;
-        if (file->private_data != (void *)((long)current->self_exec_id))
-                goto out_mm;
+                return -ENOMEM;
 
         copied = 0;
         while (count > 0) {
@@ -867,13 +799,7 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
         }
         *ppos = dst;
 
-out_mm:
-        mmput(mm);
-out_free:
         free_page((unsigned long) page);
-out_task:
-        put_task_struct(task);
-out_no_task:
         return copied;
 }
 
@@ -893,11 +819,20 @@ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
         return file->f_pos;
 }
 
+static int mem_release(struct inode *inode, struct file *file)
+{
+        struct mm_struct *mm = file->private_data;
+
+        mmput(mm);
+        return 0;
+}
+
 static const struct file_operations proc_mem_operations = {
         .llseek         = mem_lseek,
         .read           = mem_read,
         .write          = mem_write,
         .open           = mem_open,
+        .release        = mem_release,
 };
 
 static ssize_t environ_read(struct file *file, char __user *buf,
@@ -1197,9 +1132,6 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
         ssize_t length;
         uid_t loginuid;
 
-        if (!capable(CAP_AUDIT_CONTROL))
-                return -EPERM;
-
         rcu_read_lock();
         if (current != pid_task(proc_pid(inode), PIDTYPE_PID)) {
                 rcu_read_unlock();
@@ -1228,7 +1160,7 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
                 goto out_free_page;
 
         }
-        length = audit_set_loginuid(current, loginuid);
+        length = audit_set_loginuid(loginuid);
         if (likely(length == 0))
                 length = count;
 
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index d76ca6ae2b1b..121f77cfef76 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -77,6 +77,8 @@ static int show_stat(struct seq_file *p, void *v)
                 steal += kcpustat_cpu(i).cpustat[CPUTIME_STEAL];
                 guest += kcpustat_cpu(i).cpustat[CPUTIME_GUEST];
                 guest_nice += kcpustat_cpu(i).cpustat[CPUTIME_GUEST_NICE];
+                sum += kstat_cpu_irqs_sum(i);
+                sum += arch_irq_stat_cpu(i);
 
                 for (j = 0; j < NR_SOFTIRQS; j++) {
                         unsigned int softirq_stat = kstat_softirqs_cpu(j, i);
diff --git a/fs/qnx4/inode.c b/fs/qnx4/inode.c
index 2bfd987f4853..6b009548d2e0 100644
--- a/fs/qnx4/inode.c
+++ b/fs/qnx4/inode.c
@@ -179,47 +179,33 @@ static const char *qnx4_checkroot(struct super_block *sb)
         struct qnx4_inode_entry *rootdir;
         int rd, rl;
         int i, j;
-        int found = 0;
 
-        if (*(qnx4_sb(sb)->sb->RootDir.di_fname) != '/') {
+        if (*(qnx4_sb(sb)->sb->RootDir.di_fname) != '/')
                 return "no qnx4 filesystem (no root dir).";
-        } else {
-                QNX4DEBUG((KERN_NOTICE "QNX4 filesystem found on dev %s.\n", sb->s_id));
-                rd = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_blk) - 1;
-                rl = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_size);
-                for (j = 0; j < rl; j++) {
-                        bh = sb_bread(sb, rd + j);      /* root dir, first block */
-                        if (bh == NULL) {
-                                return "unable to read root entry.";
-                        }
-                        for (i = 0; i < QNX4_INODES_PER_BLOCK; i++) {
-                                rootdir = (struct qnx4_inode_entry *) (bh->b_data + i * QNX4_DIR_ENTRY_SIZE);
-                                if (rootdir->di_fname != NULL) {
-                                        QNX4DEBUG((KERN_INFO "rootdir entry found : [%s]\n", rootdir->di_fname));
-                                        if (!strcmp(rootdir->di_fname,
-                                                    QNX4_BMNAME)) {
-                                                found = 1;
-                                                qnx4_sb(sb)->BitMap = kmemdup(rootdir,
-                                                                              sizeof(struct qnx4_inode_entry),
-                                                                              GFP_KERNEL);
-                                                if (!qnx4_sb(sb)->BitMap) {
-                                                        brelse (bh);
-                                                        return "not enough memory for bitmap inode";
-                                                }/* keep bitmap inode known */
-                                                break;
-                                        }
-                                }
-                        }
+        QNX4DEBUG((KERN_NOTICE "QNX4 filesystem found on dev %s.\n", sb->s_id));
+        rd = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_blk) - 1;
+        rl = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_size);
+        for (j = 0; j < rl; j++) {
+                bh = sb_bread(sb, rd + j);      /* root dir, first block */
+                if (bh == NULL)
+                        return "unable to read root entry.";
+                rootdir = (struct qnx4_inode_entry *) bh->b_data;
+                for (i = 0; i < QNX4_INODES_PER_BLOCK; i++, rootdir++) {
+                        QNX4DEBUG((KERN_INFO "rootdir entry found : [%s]\n", rootdir->di_fname));
+                        if (strcmp(rootdir->di_fname, QNX4_BMNAME) != 0)
+                                continue;
+                        qnx4_sb(sb)->BitMap = kmemdup(rootdir,
+                                                      sizeof(struct qnx4_inode_entry),
+                                                      GFP_KERNEL);
                         brelse(bh);
-                        if (found != 0) {
-                                break;
-                        }
-                }
-                if (found == 0) {
-                        return "bitmap file not found.";
+                        if (!qnx4_sb(sb)->BitMap)
+                                return "not enough memory for bitmap inode";
+                        /* keep bitmap inode known */
+                        return NULL;
                 }
+                brelse(bh);
         }
-        return NULL;
+        return "bitmap file not found.";
 }
 
 static int qnx4_fill_super(struct super_block *s, void *data, int silent)
@@ -270,7 +256,7 @@ static int qnx4_fill_super(struct super_block *s, void *data, int silent)
         if (IS_ERR(root)) {
                 printk(KERN_ERR "qnx4: get inode failed\n");
                 ret = PTR_ERR(root);
-                goto out;
+                goto outb;
         }
 
         ret = -ENOMEM;
@@ -283,6 +269,8 @@ static int qnx4_fill_super(struct super_block *s, void *data, int silent)
 
       outi:
         iput(root);
+      outb:
+        kfree(qs->BitMap);
       out:
         brelse(bh);
       outnobh:
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index f744be98cd5a..af0b73802592 100644
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -70,11 +70,15 @@ struct squashfs_cache_entry *squashfs_cache_get(struct super_block *sb,
         spin_lock(&cache->lock);
 
         while (1) {
-                for (i = 0; i < cache->entries; i++)
-                        if (cache->entry[i].block == block)
+                for (i = cache->curr_blk, n = 0; n < cache->entries; n++) {
+                        if (cache->entry[i].block == block) {
+                                cache->curr_blk = i;
                                 break;
+                        }
+                        i = (i + 1) % cache->entries;
+                }
 
-                if (i == cache->entries) {
+                if (n == cache->entries) {
                         /*
                          * Block not in cache, if all cache entries are used
                          * go to sleep waiting for one to become available.
@@ -245,6 +249,7 @@ struct squashfs_cache *squashfs_cache_init(char *name, int entries,
                 goto cleanup;
         }
 
+        cache->curr_blk = 0;
         cache->next_blk = 0;
         cache->unused = entries;
         cache->entries = entries;
@@ -332,17 +337,20 @@ int squashfs_read_metadata(struct super_block *sb, void *buffer,
                 u64 *block, int *offset, int length)
 {
         struct squashfs_sb_info *msblk = sb->s_fs_info;
-        int bytes, copied = length;
+        int bytes, res = length;
         struct squashfs_cache_entry *entry;
 
         TRACE("Entered squashfs_read_metadata [%llx:%x]\n", *block, *offset);
 
         while (length) {
                 entry = squashfs_cache_get(sb, msblk->block_cache, *block, 0);
-                if (entry->error)
-                        return entry->error;
-                else if (*offset >= entry->length)
-                        return -EIO;
+                if (entry->error) {
+                        res = entry->error;
+                        goto error;
+                } else if (*offset >= entry->length) {
+                        res = -EIO;
+                        goto error;
+                }
 
                 bytes = squashfs_copy_data(buffer, entry, *offset, length);
                 if (buffer)
@@ -358,7 +366,11 @@ int squashfs_read_metadata(struct super_block *sb, void *buffer,
                 squashfs_cache_put(entry);
         }
 
-        return copied;
+        return res;
+
+error:
+        squashfs_cache_put(entry);
+        return res;
 }
 
 
diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c
index fd7b3b3bda13..81afbccfa843 100644
--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -208,8 +208,8 @@ int squashfs_read_inode(struct inode *inode, long long ino)
                 inode->i_op = &squashfs_inode_ops;
                 inode->i_fop = &generic_ro_fops;
                 inode->i_mode |= S_IFREG;
-                inode->i_blocks = ((inode->i_size -
-                                le64_to_cpu(sqsh_ino->sparse) - 1) >> 9) + 1;
+                inode->i_blocks = (inode->i_size -
+                                le64_to_cpu(sqsh_ino->sparse) + 511) >> 9;
 
                 squashfs_i(inode)->fragment_block = frag_blk;
                 squashfs_i(inode)->fragment_size = frag_size;
diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
index 651f0b31d296..52934a22f296 100644
--- a/fs/squashfs/squashfs_fs_sb.h
+++ b/fs/squashfs/squashfs_fs_sb.h
@@ -28,6 +28,7 @@
 struct squashfs_cache {
         char                    *name;
         int                     entries;
+        int                     curr_blk;
         int                     next_blk;
         int                     num_waiters;
         int                     unused;
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index d0858c2d9a47..ecaa2f7bdb8f 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -290,7 +290,7 @@ handle_fragments:
 
 check_directory_table:
         /* Sanity check directory_table */
-        if (msblk->directory_table >= next_table) {
+        if (msblk->directory_table > next_table) {
                 err = -EINVAL;
                 goto failed_mount;
         }
diff --git a/fs/super.c b/fs/super.c
index de41e1e46f09..6015c02296b7 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1186,6 +1186,8 @@ int freeze_super(struct super_block *sb)
                         printk(KERN_ERR
                                 "VFS:Filesystem freeze failed\n");
                         sb->s_frozen = SB_UNFROZEN;
+                        smp_wmb();
+                        wake_up(&sb->s_wait_unfrozen);
                         deactivate_locked_super(sb);
                         return ret;
                 }
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index b09ba2dd8b62..f922cbacdb96 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -38,9 +38,6 @@
 
 DEFINE_SPINLOCK(dbg_lock);
 
-static char dbg_key_buf0[128];
-static char dbg_key_buf1[128];
-
 static const char *get_key_fmt(int fmt)
 {
         switch (fmt) {
@@ -103,8 +100,8 @@ static const char *get_dent_type(int type)
         }
 }
 
-static void sprintf_key(const struct ubifs_info *c, const union ubifs_key *key,
-                        char *buffer)
+const char *dbg_snprintf_key(const struct ubifs_info *c,
+                             const union ubifs_key *key, char *buffer, int len)
 {
         char *p = buffer;
         int type = key_type(c, key);
@@ -112,45 +109,34 @@ static void sprintf_key(const struct ubifs_info *c, const union ubifs_key *key,
         if (c->key_fmt == UBIFS_SIMPLE_KEY_FMT) {
                 switch (type) {
                 case UBIFS_INO_KEY:
-                        sprintf(p, "(%lu, %s)", (unsigned long)key_inum(c, key),
-                               get_key_type(type));
+                        len -= snprintf(p, len, "(%lu, %s)",
+                                        (unsigned long)key_inum(c, key),
+                                        get_key_type(type));
                         break;
                 case UBIFS_DENT_KEY:
                 case UBIFS_XENT_KEY:
-                        sprintf(p, "(%lu, %s, %#08x)",
-                                (unsigned long)key_inum(c, key),
-                                get_key_type(type), key_hash(c, key));
+                        len -= snprintf(p, len, "(%lu, %s, %#08x)",
+                                        (unsigned long)key_inum(c, key),
+                                        get_key_type(type), key_hash(c, key));
                         break;
                 case UBIFS_DATA_KEY:
-                        sprintf(p, "(%lu, %s, %u)",
-                                (unsigned long)key_inum(c, key),
-                                get_key_type(type), key_block(c, key));
+                        len -= snprintf(p, len, "(%lu, %s, %u)",
+                                        (unsigned long)key_inum(c, key),
+                                        get_key_type(type), key_block(c, key));
                         break;
                 case UBIFS_TRUN_KEY:
-                        sprintf(p, "(%lu, %s)",
-                                (unsigned long)key_inum(c, key),
-                                get_key_type(type));
+                        len -= snprintf(p, len, "(%lu, %s)",
+                                        (unsigned long)key_inum(c, key),
+                                        get_key_type(type));
                         break;
                 default:
-                        sprintf(p, "(bad key type: %#08x, %#08x)",
-                                key->u32[0], key->u32[1]);
+                        len -= snprintf(p, len, "(bad key type: %#08x, %#08x)",
+                                        key->u32[0], key->u32[1]);
                 }
         } else
-                sprintf(p, "bad key format %d", c->key_fmt);
-}
-
-const char *dbg_key_str0(const struct ubifs_info *c, const union ubifs_key *key)
-{
-        /* dbg_lock must be held */
-        sprintf_key(c, key, dbg_key_buf0);
-        return dbg_key_buf0;
-}
-
-const char *dbg_key_str1(const struct ubifs_info *c, const union ubifs_key *key)
-{
-        /* dbg_lock must be held */
-        sprintf_key(c, key, dbg_key_buf1);
-        return dbg_key_buf1;
+                len -= snprintf(p, len, "bad key format %d", c->key_fmt);
+        ubifs_assert(len > 0);
+        return p;
 }
 
 const char *dbg_ntype(int type)
@@ -319,6 +305,7 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
         int i, n;
         union ubifs_key key;
         const struct ubifs_ch *ch = node;
+        char key_buf[DBG_KEY_BUF_LEN];
 
         if (dbg_is_tst_rcvry(c))
                 return;
@@ -474,7 +461,8 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
                 const struct ubifs_ino_node *ino = node;
 
                 key_read(c, &ino->key, &key);
-                printk(KERN_DEBUG "\tkey            %s\n", DBGKEY(&key));
+                printk(KERN_DEBUG "\tkey            %s\n",
+                       dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
                 printk(KERN_DEBUG "\tcreat_sqnum    %llu\n",
                        (unsigned long long)le64_to_cpu(ino->creat_sqnum));
                 printk(KERN_DEBUG "\tsize           %llu\n",
@@ -517,7 +505,8 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
                 int nlen = le16_to_cpu(dent->nlen);
 
                 key_read(c, &dent->key, &key);
-                printk(KERN_DEBUG "\tkey            %s\n", DBGKEY(&key));
+                printk(KERN_DEBUG "\tkey            %s\n",
+                       dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
                 printk(KERN_DEBUG "\tinum           %llu\n",
                        (unsigned long long)le64_to_cpu(dent->inum));
                 printk(KERN_DEBUG "\ttype           %d\n", (int)dent->type);
@@ -541,7 +530,8 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
                 int dlen = le32_to_cpu(ch->len) - UBIFS_DATA_NODE_SZ;
 
                 key_read(c, &dn->key, &key);
-                printk(KERN_DEBUG "\tkey            %s\n", DBGKEY(&key));
+                printk(KERN_DEBUG "\tkey            %s\n",
+                       dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
                 printk(KERN_DEBUG "\tsize           %u\n",
                        le32_to_cpu(dn->size));
                 printk(KERN_DEBUG "\tcompr_typ      %d\n",
@@ -582,7 +572,9 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
                         key_read(c, &br->key, &key);
                         printk(KERN_DEBUG "\t%d: LEB %d:%d len %d key %s\n",
                                i, le32_to_cpu(br->lnum), le32_to_cpu(br->offs),
-                               le32_to_cpu(br->len), DBGKEY(&key));
+                               le32_to_cpu(br->len),
+                               dbg_snprintf_key(c, &key, key_buf,
+                                                DBG_KEY_BUF_LEN));
                 }
                 break;
         }
@@ -934,6 +926,7 @@ void dbg_dump_znode(const struct ubifs_info *c,
 {
         int n;
         const struct ubifs_zbranch *zbr;
+        char key_buf[DBG_KEY_BUF_LEN];
 
         spin_lock(&dbg_lock);
         if (znode->parent)
@@ -958,12 +951,16 @@ void dbg_dump_znode(const struct ubifs_info *c,
                         printk(KERN_DEBUG "\t%d: znode %p LEB %d:%d len %d key "
                                           "%s\n", n, zbr->znode, zbr->lnum,
                                           zbr->offs, zbr->len,
-                                          DBGKEY(&zbr->key));
+                                          dbg_snprintf_key(c, &zbr->key,
+                                                           key_buf,
+                                                           DBG_KEY_BUF_LEN));
                 else
                         printk(KERN_DEBUG "\t%d: LNC %p LEB %d:%d len %d key "
                                           "%s\n", n, zbr->znode, zbr->lnum,
                                           zbr->offs, zbr->len,
-                                          DBGKEY(&zbr->key));
+                                          dbg_snprintf_key(c, &zbr->key,
+                                                           key_buf,
+                                                           DBG_KEY_BUF_LEN));
         }
         spin_unlock(&dbg_lock);
 }
@@ -1260,6 +1257,7 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
         int err, nlen1, nlen2, cmp;
         struct ubifs_dent_node *dent1, *dent2;
         union ubifs_key key;
+        char key_buf[DBG_KEY_BUF_LEN];
 
         ubifs_assert(!keys_cmp(c, &zbr1->key, &zbr2->key));
         dent1 = kmalloc(UBIFS_MAX_DENT_NODE_SZ, GFP_NOFS);
@@ -1290,9 +1288,11 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
         key_read(c, &dent1->key, &key);
         if (keys_cmp(c, &zbr1->key, &key)) {
                 dbg_err("1st entry at %d:%d has key %s", zbr1->lnum,
-                        zbr1->offs, DBGKEY(&key));
+                        zbr1->offs, dbg_snprintf_key(c, &key, key_buf,
+                                                     DBG_KEY_BUF_LEN));
                 dbg_err("but it should have key %s according to tnc",
-                        DBGKEY(&zbr1->key));
+                        dbg_snprintf_key(c, &zbr1->key, key_buf,
+                                         DBG_KEY_BUF_LEN));
                 dbg_dump_node(c, dent1);
                 goto out_free;
         }
@@ -1300,9 +1300,11 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
         key_read(c, &dent2->key, &key);
         if (keys_cmp(c, &zbr2->key, &key)) {
                 dbg_err("2nd entry at %d:%d has key %s", zbr1->lnum,
-                        zbr1->offs, DBGKEY(&key));
+                        zbr1->offs, dbg_snprintf_key(c, &key, key_buf,
+                                                     DBG_KEY_BUF_LEN));
                 dbg_err("but it should have key %s according to tnc",
-                        DBGKEY(&zbr2->key));
+                        dbg_snprintf_key(c, &zbr2->key, key_buf,
+                                         DBG_KEY_BUF_LEN));
                 dbg_dump_node(c, dent2);
                 goto out_free;
         }
@@ -1319,7 +1321,7 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
                 dbg_err("2 xent/dent nodes with the same name");
         else
                 dbg_err("bad order of colliding key %s",
-                        DBGKEY(&key));
+                        dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
 
         ubifs_msg("first node at %d:%d\n", zbr1->lnum, zbr1->offs);
         dbg_dump_node(c, dent1);
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index 8d9c46810189..ad1a6fee6010 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -169,40 +169,39 @@ struct ubifs_global_debug_info {
         spin_unlock(&dbg_lock);                                                \
 } while (0)
 
-const char *dbg_key_str0(const struct ubifs_info *c,
-                         const union ubifs_key *key);
-const char *dbg_key_str1(const struct ubifs_info *c,
-                         const union ubifs_key *key);
-
-/*
- * DBGKEY macros require @dbg_lock to be held, which it is in the dbg message
- * macros.
- */
-#define DBGKEY(key) dbg_key_str0(c, (key))
-#define DBGKEY1(key) dbg_key_str1(c, (key))
-
-extern spinlock_t dbg_lock;
-
-#define ubifs_dbg_msg(type, fmt, ...) do {                        \
-        spin_lock(&dbg_lock);                                     \
-        pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__); \
-        spin_unlock(&dbg_lock);                                   \
+#define ubifs_dbg_msg(type, fmt, ...) \
+        pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__)
+
+#define DBG_KEY_BUF_LEN 32
+#define ubifs_dbg_msg_key(type, key, fmt, ...) do {                            \
+        char __tmp_key_buf[DBG_KEY_BUF_LEN];                                   \
+        pr_debug("UBIFS DBG " type ": " fmt "%s\n", ##__VA_ARGS__,             \
+                 dbg_snprintf_key(c, key, __tmp_key_buf, DBG_KEY_BUF_LEN));    \
 } while (0)
 
 /* Just a debugging messages not related to any specific UBIFS subsystem */
-#define dbg_msg(fmt, ...)   ubifs_dbg_msg("msg", fmt, ##__VA_ARGS__)
+#define dbg_msg(fmt, ...)                                                      \
+        printk(KERN_DEBUG "UBIFS DBG (pid %d): %s: " fmt "\n", current->pid,   \
+               __func__, ##__VA_ARGS__)
+
 /* General messages */
 #define dbg_gen(fmt, ...)   ubifs_dbg_msg("gen", fmt, ##__VA_ARGS__)
 /* Additional journal messages */
 #define dbg_jnl(fmt, ...)   ubifs_dbg_msg("jnl", fmt, ##__VA_ARGS__)
+#define dbg_jnlk(key, fmt, ...) \
+        ubifs_dbg_msg_key("jnl", key, fmt, ##__VA_ARGS__)
 /* Additional TNC messages */
 #define dbg_tnc(fmt, ...)   ubifs_dbg_msg("tnc", fmt, ##__VA_ARGS__)
+#define dbg_tnck(key, fmt, ...) \
+        ubifs_dbg_msg_key("tnc", key, fmt, ##__VA_ARGS__)
 /* Additional lprops messages */
 #define dbg_lp(fmt, ...)    ubifs_dbg_msg("lp", fmt, ##__VA_ARGS__)
 /* Additional LEB find messages */
 #define dbg_find(fmt, ...)  ubifs_dbg_msg("find", fmt, ##__VA_ARGS__)
 /* Additional mount messages */
 #define dbg_mnt(fmt, ...)   ubifs_dbg_msg("mnt", fmt, ##__VA_ARGS__)
+#define dbg_mntk(key, fmt, ...) \
+        ubifs_dbg_msg_key("mnt", key, fmt, ##__VA_ARGS__)
 /* Additional I/O messages */
 #define dbg_io(fmt, ...)    ubifs_dbg_msg("io", fmt, ##__VA_ARGS__)
 /* Additional commit messages */
@@ -218,6 +217,7 @@ extern spinlock_t dbg_lock;
 /* Additional recovery messages */
 #define dbg_rcvry(fmt, ...) ubifs_dbg_msg("rcvry", fmt, ##__VA_ARGS__)
 
+extern spinlock_t dbg_lock;
 extern struct ubifs_global_debug_info ubifs_dbg;
 
 static inline int dbg_is_chk_gen(const struct ubifs_info *c)
@@ -258,6 +258,8 @@ const char *dbg_cstate(int cmt_state);
 const char *dbg_jhead(int jhead);
 const char *dbg_get_key_dump(const struct ubifs_info *c,
                              const union ubifs_key *key);
+const char *dbg_snprintf_key(const struct ubifs_info *c,
+                             const union ubifs_key *key, char *buffer, int len);
 void dbg_dump_inode(struct ubifs_info *c, const struct inode *inode);
 void dbg_dump_node(const struct ubifs_info *c, const void *node);
 void dbg_dump_lpt_node(const struct ubifs_info *c, void *node, int lnum,
@@ -345,20 +347,23 @@ void dbg_debugfs_exit_fs(struct ubifs_info *c);
 #define dbg_dump_stack()
 #define ubifs_assert_cmt_locked(c)
 
-#define dbg_msg(fmt, ...)   ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_gen(fmt, ...)   ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_jnl(fmt, ...)   ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_tnc(fmt, ...)   ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_lp(fmt, ...)    ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_find(fmt, ...)  ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_mnt(fmt, ...)   ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_io(fmt, ...)    ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_cmt(fmt, ...)   ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_budg(fmt, ...)  ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_log(fmt, ...)   ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_gc(fmt, ...)    ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_scan(fmt, ...)  ubifs_dbg_msg(fmt, ##__VA_ARGS__)
-#define dbg_rcvry(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_msg(fmt, ...)       ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_gen(fmt, ...)       ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_jnl(fmt, ...)       ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_jnlk(key, fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_tnc(fmt, ...)       ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_tnck(key, fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_lp(fmt, ...)        ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_find(fmt, ...)      ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_mnt(fmt, ...)       ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_mntk(key, fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_io(fmt, ...)        ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_cmt(fmt, ...)       ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_budg(fmt, ...)      ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_log(fmt, ...)       ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_gc(fmt, ...)        ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_scan(fmt, ...)      ubifs_dbg_msg(fmt, ##__VA_ARGS__)
+#define dbg_rcvry(fmt, ...)     ubifs_dbg_msg(fmt, ##__VA_ARGS__)
 
 static inline int ubifs_debugging_init(struct ubifs_info *c)      { return 0; }
 static inline void ubifs_debugging_exit(struct ubifs_info *c)     { return; }
@@ -368,6 +373,10 @@ static inline const char *dbg_jhead(int jhead)                    { return ""; }
 static inline const char *
 dbg_get_key_dump(const struct ubifs_info *c,
                  const union ubifs_key *key)                      { return ""; }
+static inline const char *
+dbg_snprintf_key(const struct ubifs_info *c,
+                 const union ubifs_key *key, char *buffer,
+                 int len)                                         { return ""; }
 static inline void dbg_dump_inode(struct ubifs_info *c,
                                   const struct inode *inode)      { return; }
 static inline void dbg_dump_node(const struct ubifs_info *c,
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index cef0460f4c54..2f438ab2e7a2 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -697,9 +697,8 @@ int ubifs_jnl_write_data(struct ubifs_info *c, const struct inode *inode,
         int dlen = COMPRESSED_DATA_NODE_BUF_SZ, allocated = 1;
         struct ubifs_inode *ui = ubifs_inode(inode);
 
-        dbg_jnl("ino %lu, blk %u, len %d, key %s",
-                (unsigned long)key_inum(c, key), key_block(c, key), len,
-                DBGKEY(key));
+        dbg_jnlk(key, "ino %lu, blk %u, len %d, key ",
+                (unsigned long)key_inum(c, key), key_block(c, key), len);
         ubifs_assert(len <= UBIFS_BLOCK_SIZE);
 
         data = kmalloc(dlen, GFP_NOFS | __GFP_NOWARN);
@@ -1177,7 +1176,7 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode,
                 dn = (void *)trun + UBIFS_TRUN_NODE_SZ;
                 blk = new_size >> UBIFS_BLOCK_SHIFT;
                 data_key_init(c, &key, inum, blk);
-                dbg_jnl("last block key %s", DBGKEY(&key));
+                dbg_jnlk(&key, "last block key ");
                 err = ubifs_tnc_lookup(c, &key, dn);
                 if (err == -ENOENT)
                         dlen = 0; /* Not found (so it is a hole) */
diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
index ccabaf1164b3..b007637f0406 100644
--- a/fs/ubifs/replay.c
+++ b/fs/ubifs/replay.c
@@ -221,8 +221,8 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
 {
         int err;
 
-        dbg_mnt("LEB %d:%d len %d deletion %d sqnum %llu %s", r->lnum,
-                r->offs, r->len, r->deletion, r->sqnum, DBGKEY(&r->key));
+        dbg_mntk(&r->key, "LEB %d:%d len %d deletion %d sqnum %llu key ",
+                 r->lnum, r->offs, r->len, r->deletion, r->sqnum);
 
         /* Set c->replay_sqnum to help deal with dangling branches. */
         c->replay_sqnum = r->sqnum;
@@ -361,7 +361,7 @@ static int insert_node(struct ubifs_info *c, int lnum, int offs, int len,
 {
         struct replay_entry *r;
 
-        dbg_mnt("add LEB %d:%d, key %s", lnum, offs, DBGKEY(key));
+        dbg_mntk(key, "add LEB %d:%d, key ", lnum, offs);
 
         if (key_inum(c, key) >= c->highest_inum)
                 c->highest_inum = key_inum(c, key);
@@ -409,7 +409,7 @@ static int insert_dent(struct ubifs_info *c, int lnum, int offs, int len,
         struct replay_entry *r;
         char *nbuf;
 
-        dbg_mnt("add LEB %d:%d, key %s", lnum, offs, DBGKEY(key));
+        dbg_mntk(key, "add LEB %d:%d, key ", lnum, offs);
         if (key_inum(c, key) >= c->highest_inum)
                 c->highest_inum = key_inum(c, key);
 
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index e14ee53159db..16ad84d8402f 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -505,7 +505,7 @@ static int fallible_read_node(struct ubifs_info *c, const union ubifs_key *key,
 {
         int ret;
 
-        dbg_tnc("LEB %d:%d, key %s", zbr->lnum, zbr->offs, DBGKEY(key));
+        dbg_tnck(key, "LEB %d:%d, key ", zbr->lnum, zbr->offs);
 
         ret = try_read_node(c, node, key_type(c, key), zbr->len, zbr->lnum,
                             zbr->offs);
@@ -519,8 +519,8 @@ static int fallible_read_node(struct ubifs_info *c, const union ubifs_key *key,
                         ret = 0;
         }
         if (ret == 0 && c->replaying)
-                dbg_mnt("dangling branch LEB %d:%d len %d, key %s",
-                        zbr->lnum, zbr->offs, zbr->len, DBGKEY(key));
+                dbg_mntk(key, "dangling branch LEB %d:%d len %d, key ",
+                        zbr->lnum, zbr->offs, zbr->len);
         return ret;
 }
 
@@ -995,9 +995,9 @@ static int fallible_resolve_collision(struct ubifs_info *c,
         if (adding || !o_znode)
                 return 0;
 
-        dbg_mnt("dangling match LEB %d:%d len %d %s",
+        dbg_mntk(key, "dangling match LEB %d:%d len %d key ",
                 o_znode->zbranch[o_n].lnum, o_znode->zbranch[o_n].offs,
-                o_znode->zbranch[o_n].len, DBGKEY(key));
+                o_znode->zbranch[o_n].len);
         *zn = o_znode;
         *n = o_n;
         return 1;
@@ -1179,7 +1179,7 @@ int ubifs_lookup_level0(struct ubifs_info *c, const union ubifs_key *key,
         struct ubifs_znode *znode;
         unsigned long time = get_seconds();
 
-        dbg_tnc("search key %s", DBGKEY(key));
+        dbg_tnck(key, "search key ");
         ubifs_assert(key_type(c, key) < UBIFS_INVALID_KEY);
 
         znode = c->zroot.znode;
@@ -1315,7 +1315,7 @@ static int lookup_level0_dirty(struct ubifs_info *c, const union ubifs_key *key,
         struct ubifs_znode *znode;
         unsigned long time = get_seconds();
 
-        dbg_tnc("search and dirty key %s", DBGKEY(key));
+        dbg_tnck(key, "search and dirty key ");
 
         znode = c->zroot.znode;
         if (unlikely(!znode)) {
@@ -1722,8 +1722,8 @@ static int validate_data_node(struct ubifs_info *c, void *buf,
         if (!keys_eq(c, &zbr->key, &key1)) {
                 ubifs_err("bad key in node at LEB %d:%d",
                           zbr->lnum, zbr->offs);
-                dbg_tnc("looked for key %s found node's key %s",
-                        DBGKEY(&zbr->key), DBGKEY1(&key1));
+                dbg_tnck(&zbr->key, "looked for key ");
+                dbg_tnck(&key1, "found node's key ");
                 goto out_err;
         }
 
@@ -1776,7 +1776,7 @@ int ubifs_tnc_bulk_read(struct ubifs_info *c, struct bu_info *bu)
                 ubifs_err("failed to read from LEB %d:%d, error %d",
                           lnum, offs, err);
                 dbg_dump_stack();
-                dbg_tnc("key %s", DBGKEY(&bu->key));
+                dbg_tnck(&bu->key, "key ");
                 return err;
         }
 
@@ -1811,7 +1811,7 @@ static int do_lookup_nm(struct ubifs_info *c, const union ubifs_key *key,
         int found, n, err;
         struct ubifs_znode *znode;
 
-        dbg_tnc("name '%.*s' key %s", nm->len, nm->name, DBGKEY(key));
+        dbg_tnck(key, "name '%.*s' key ", nm->len, nm->name);
         mutex_lock(&c->tnc_mutex);
         found = ubifs_lookup_level0(c, key, &znode, &n);
         if (!found) {
@@ -1985,8 +1985,7 @@ again:
         zp = znode->parent;
         if (znode->child_cnt < c->fanout) {
                 ubifs_assert(n != c->fanout);
-                dbg_tnc("inserted at %d level %d, key %s", n, znode->level,
-                        DBGKEY(key));
+                dbg_tnck(key, "inserted at %d level %d, key ", n, znode->level);
 
                 insert_zbranch(znode, zbr, n);
 
@@ -2001,7 +2000,7 @@ again:
          * Unfortunately, @znode does not have more empty slots and we have to
          * split it.
          */
-        dbg_tnc("splitting level %d, key %s", znode->level, DBGKEY(key));
+        dbg_tnck(key, "splitting level %d, key ", znode->level);
 
         if (znode->alt)
                 /*
@@ -2095,7 +2094,7 @@ do_split:
         }
 
         /* Insert new key and branch */
-        dbg_tnc("inserting at %d level %d, key %s", n, zn->level, DBGKEY(key));
+        dbg_tnck(key, "inserting at %d level %d, key ", n, zn->level);
 
         insert_zbranch(zi, zbr, n);
 
@@ -2171,7 +2170,7 @@ int ubifs_tnc_add(struct ubifs_info *c, const union ubifs_key *key, int lnum,
         struct ubifs_znode *znode;
 
         mutex_lock(&c->tnc_mutex);
-        dbg_tnc("%d:%d, len %d, key %s", lnum, offs, len, DBGKEY(key));
+        dbg_tnck(key, "%d:%d, len %d, key ", lnum, offs, len);
         found = lookup_level0_dirty(c, key, &znode, &n);
         if (!found) {
                 struct ubifs_zbranch zbr;
@@ -2220,8 +2219,8 @@ int ubifs_tnc_replace(struct ubifs_info *c, const union ubifs_key *key,
         struct ubifs_znode *znode;
 
         mutex_lock(&c->tnc_mutex);
-        dbg_tnc("old LEB %d:%d, new LEB %d:%d, len %d, key %s", old_lnum,
-                old_offs, lnum, offs, len, DBGKEY(key));
+        dbg_tnck(key, "old LEB %d:%d, new LEB %d:%d, len %d, key ", old_lnum,
+                 old_offs, lnum, offs, len);
         found = lookup_level0_dirty(c, key, &znode, &n);
         if (found < 0) {
                 err = found;
@@ -2303,8 +2302,8 @@ int ubifs_tnc_add_nm(struct ubifs_info *c, const union ubifs_key *key,
         struct ubifs_znode *znode;
 
         mutex_lock(&c->tnc_mutex);
-        dbg_tnc("LEB %d:%d, name '%.*s', key %s", lnum, offs, nm->len, nm->name,
-                DBGKEY(key));
+        dbg_tnck(key, "LEB %d:%d, name '%.*s', key ",
+                 lnum, offs, nm->len, nm->name);
         found = lookup_level0_dirty(c, key, &znode, &n);
         if (found < 0) {
                 err = found;
@@ -2397,7 +2396,7 @@ static int tnc_delete(struct ubifs_info *c, struct ubifs_znode *znode, int n)
         /* Delete without merge for now */
         ubifs_assert(znode->level == 0);
         ubifs_assert(n >= 0 && n < c->fanout);
-        dbg_tnc("deleting %s", DBGKEY(&znode->zbranch[n].key));
+        dbg_tnck(&znode->zbranch[n].key, "deleting key ");
 
         zbr = &znode->zbranch[n];
         lnc_free(zbr);
@@ -2507,7 +2506,7 @@ int ubifs_tnc_remove(struct ubifs_info *c, const union ubifs_key *key)
         struct ubifs_znode *znode;
 
         mutex_lock(&c->tnc_mutex);
-        dbg_tnc("key %s", DBGKEY(key));
+        dbg_tnck(key, "key ");
         found = lookup_level0_dirty(c, key, &znode, &n);
         if (found < 0) {
                 err = found;
@@ -2538,7 +2537,7 @@ int ubifs_tnc_remove_nm(struct ubifs_info *c, const union ubifs_key *key,
         struct ubifs_znode *znode;
 
         mutex_lock(&c->tnc_mutex);
-        dbg_tnc("%.*s, key %s", nm->len, nm->name, DBGKEY(key));
+        dbg_tnck(key, "%.*s, key ", nm->len, nm->name);
         err = lookup_level0_dirty(c, key, &znode, &n);
         if (err < 0)
                 goto out_unlock;
@@ -2653,7 +2652,7 @@ int ubifs_tnc_remove_range(struct ubifs_info *c, union ubifs_key *from_key,
                                 dbg_dump_znode(c, znode);
                                 goto out_unlock;
                         }
-                        dbg_tnc("removing %s", DBGKEY(key));
+                        dbg_tnck(key, "removing key ");
                 }
                 if (k) {
                         for (i = n + 1 + k; i < znode->child_cnt; i++)
@@ -2773,7 +2772,7 @@ struct ubifs_dent_node *ubifs_tnc_next_ent(struct ubifs_info *c,
         struct ubifs_zbranch *zbr;
         union ubifs_key *dkey;
 
-        dbg_tnc("%s %s", nm->name ? (char *)nm->name : "(lowest)", DBGKEY(key));
+        dbg_tnck(key, "%s ", nm->name ? (char *)nm->name : "(lowest)");
         ubifs_assert(is_hash_key(c, key));
 
         mutex_lock(&c->tnc_mutex);
@@ -3332,9 +3331,9 @@ int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
 
 out_dump:
         block = key_block(c, key);
-        ubifs_err("inode %lu has size %lld, but there are data at offset %lld "
-                  "(data key %s)", (unsigned long)inode->i_ino, size,
-                  ((loff_t)block) << UBIFS_BLOCK_SHIFT, DBGKEY(key));
+        ubifs_err("inode %lu has size %lld, but there are data at offset %lld",
+                  (unsigned long)inode->i_ino, size,
+                  ((loff_t)block) << UBIFS_BLOCK_SHIFT);
         mutex_unlock(&c->tnc_mutex);
         dbg_dump_inode(c, inode);
         dbg_dump_stack();
diff --git a/fs/ubifs/tnc_misc.c b/fs/ubifs/tnc_misc.c
index b48db999903e..dc28fe6ec07a 100644
--- a/fs/ubifs/tnc_misc.c
+++ b/fs/ubifs/tnc_misc.c
@@ -328,8 +328,8 @@ static int read_znode(struct ubifs_info *c, int lnum, int offs, int len,
                 case UBIFS_XENT_KEY:
                         break;
                 default:
-                        dbg_msg("bad key type at slot %d: %s", i,
-                                DBGKEY(&zbr->key));
+                        dbg_msg("bad key type at slot %d: %d",
+                                i, key_type(c, &zbr->key));
                         err = 3;
                         goto out_dump;
                 }
@@ -475,7 +475,7 @@ int ubifs_tnc_read_node(struct ubifs_info *c, struct ubifs_zbranch *zbr,
                                       zbr->offs);
 
         if (err) {
-                dbg_tnc("key %s", DBGKEY(key));
+                dbg_tnck(key, "key ");
                 return err;
         }
 
@@ -484,8 +484,8 @@ int ubifs_tnc_read_node(struct ubifs_info *c, struct ubifs_zbranch *zbr,
         if (!keys_eq(c, key, &key1)) {
                 ubifs_err("bad key in node at LEB %d:%d",
                           zbr->lnum, zbr->offs);
-                dbg_tnc("looked for key %s found node's key %s",
-                        DBGKEY(key), DBGKEY1(&key1));
+                dbg_tnck(key, "looked for key ");
+                dbg_tnck(&key1, "but found node's key ");
                 dbg_dump_node(c, node);
                 return -EINVAL;
         }
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 574d4ee9b625..74b9baf36ac3 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -111,8 +111,7 @@ xfs_ioend_new_eof(
         xfs_fsize_t             bsize;
 
         bsize = ioend->io_offset + ioend->io_size;
-        isize = MAX(ip->i_size, ip->i_new_size);
-        isize = MIN(isize, bsize);
+        isize = MIN(i_size_read(VFS_I(ip)), bsize);
         return isize > ip->i_d.di_size ? isize : 0;
 }
 
@@ -126,11 +125,7 @@ static inline bool xfs_ioend_is_append(struct xfs_ioend *ioend)
 }
 
 /*
- * Update on-disk file size now that data has been written to disk.  The
- * current in-memory file size is i_size.  If a write is beyond eof i_new_size
- * will be the intended file size until i_size is updated.  If this write does
- * not extend all the way to the valid file size then restrict this update to
- * the end of the write.
+ * Update on-disk file size now that data has been written to disk.
  *
  * This function does not block as blocking on the inode lock in IO completion
  * can lead to IO completion order dependency deadlocks.. If it can't get the
@@ -1279,6 +1274,15 @@ xfs_end_io_direct_write(
         struct xfs_ioend        *ioend = iocb->private;
 
         /*
+         * While the generic direct I/O code updates the inode size, it does
+         * so only after the end_io handler is called, which means our
+         * end_io handler thinks the on-disk size is outside the in-core
+         * size.  To prevent this just update it a little bit earlier here.
+         */
+        if (offset + size > i_size_read(ioend->io_inode))
+                i_size_write(ioend->io_inode, offset + size);
+
+        /*
          * blockdev_direct_IO can return an error even after the I/O
          * completion handler was called.  Thus we need to protect
          * against double-freeing.
@@ -1340,12 +1344,11 @@ xfs_vm_write_failed(
 
         if (to > inode->i_size) {
                 /*
-                 * punch out the delalloc blocks we have already allocated. We
-                 * don't call xfs_setattr() to do this as we may be in the
-                 * middle of a multi-iovec write and so the vfs inode->i_size
-                 * will not match the xfs ip->i_size and so it will zero too
-                 * much. Hence we jus truncate the page cache to zero what is
-                 * necessary and punch the delalloc blocks directly.
+                 * Punch out the delalloc blocks we have already allocated.
+                 *
+                 * Don't bother with xfs_setattr given that nothing can have
+                 * made it to disk yet as the page is still locked at this
+                 * point.
                  */
                 struct xfs_inode        *ip = XFS_I(inode);
                 xfs_fileoff_t           start_fsb;
diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c
index 1e5d97f86ea8..08b9ac644c31 100644
--- a/fs/xfs/xfs_attr.c
+++ b/fs/xfs/xfs_attr.c
@@ -827,10 +827,6 @@ xfs_attr_inactive(xfs_inode_t *dp)
         if (error)
                 goto out;
 
-        /*
-         * Commit the last in the sequence of transactions.
-         */
-        xfs_trans_log_inode(trans, dp, XFS_ILOG_CORE);
         error = xfs_trans_commit(trans, XFS_TRANS_RELEASE_LOG_RES);
         xfs_iunlock(dp, XFS_ILOCK_EXCL);
 
diff --git a/fs/xfs/xfs_attr_leaf.c b/fs/xfs/xfs_attr_leaf.c
index c1b55e596551..d25eafd4d28d 100644
--- a/fs/xfs/xfs_attr_leaf.c
+++ b/fs/xfs/xfs_attr_leaf.c
@@ -271,10 +271,6 @@ xfs_attr_shortform_add(xfs_da_args_t *args, int forkoff)
         dp = args->dp;
         mp = dp->i_mount;
         dp->i_d.di_forkoff = forkoff;
-        dp->i_df.if_ext_max =
-                XFS_IFORK_DSIZE(dp) / (uint)sizeof(xfs_bmbt_rec_t);
-        dp->i_afp->if_ext_max =
-                XFS_IFORK_ASIZE(dp) / (uint)sizeof(xfs_bmbt_rec_t);
 
         ifp = dp->i_afp;
         ASSERT(ifp->if_flags & XFS_IFINLINE);
@@ -326,7 +322,6 @@ xfs_attr_fork_reset(
         ASSERT(ip->i_d.di_anextents == 0);
         ASSERT(ip->i_afp == NULL);
 
-        ip->i_df.if_ext_max = XFS_IFORK_DSIZE(ip) / sizeof(xfs_bmbt_rec_t);
         xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
 }
 
@@ -389,10 +384,6 @@ xfs_attr_shortform_remove(xfs_da_args_t *args)
                                 (args->op_flags & XFS_DA_OP_ADDNAME) ||
                                 !(mp->m_flags & XFS_MOUNT_ATTR2) ||
                                 dp->i_d.di_format == XFS_DINODE_FMT_BTREE);
-                dp->i_afp->if_ext_max =
-                        XFS_IFORK_ASIZE(dp) / (uint)sizeof(xfs_bmbt_rec_t);
-                dp->i_df.if_ext_max =
-                        XFS_IFORK_DSIZE(dp) / (uint)sizeof(xfs_bmbt_rec_t);
                 xfs_trans_log_inode(args->trans, dp,
                                         XFS_ILOG_CORE | XFS_ILOG_ADATA);
         }
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index d0ab78837057..188ef2fbd628 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -249,7 +249,27 @@ xfs_bmbt_lookup_ge(
 }
 
 /*
-* Update the record referred to by cur to the value given
+ * Check if the inode needs to be converted to btree format.
+ */
+static inline bool xfs_bmap_needs_btree(struct xfs_inode *ip, int whichfork)
+{
+        return XFS_IFORK_FORMAT(ip, whichfork) == XFS_DINODE_FMT_EXTENTS &&
+                XFS_IFORK_NEXTENTS(ip, whichfork) >
+                        XFS_IFORK_MAXEXT(ip, whichfork);
+}
+
+/*
+ * Check if the inode should be converted to extent format.
+ */
+static inline bool xfs_bmap_wants_extents(struct xfs_inode *ip, int whichfork)
+{
+        return XFS_IFORK_FORMAT(ip, whichfork) == XFS_DINODE_FMT_BTREE &&
+                XFS_IFORK_NEXTENTS(ip, whichfork) <=
+                        XFS_IFORK_MAXEXT(ip, whichfork);
+}
+
+/*
+ * Update the record referred to by cur to the value given
  * by [off, bno, len, state].
  * This either works (return 0) or gets an EFSCORRUPTED error.
  */
@@ -683,8 +703,8 @@ xfs_bmap_add_extent_delay_real(
                                 goto done;
                         XFS_WANT_CORRUPTED_GOTO(i == 1, done);
                 }
-                if (bma->ip->i_d.di_format == XFS_DINODE_FMT_EXTENTS &&
-                    bma->ip->i_d.di_nextents > bma->ip->i_df.if_ext_max) {
+
+                if (xfs_bmap_needs_btree(bma->ip, XFS_DATA_FORK)) {
                         error = xfs_bmap_extents_to_btree(bma->tp, bma->ip,
                                         bma->firstblock, bma->flist,
                                         &bma->cur, 1, &tmp_rval, XFS_DATA_FORK);
@@ -767,8 +787,8 @@ xfs_bmap_add_extent_delay_real(
                                 goto done;
                         XFS_WANT_CORRUPTED_GOTO(i == 1, done);
                 }
-                if (bma->ip->i_d.di_format == XFS_DINODE_FMT_EXTENTS &&
-                    bma->ip->i_d.di_nextents > bma->ip->i_df.if_ext_max) {
+
+                if (xfs_bmap_needs_btree(bma->ip, XFS_DATA_FORK)) {
                         error = xfs_bmap_extents_to_btree(bma->tp, bma->ip,
                                 bma->firstblock, bma->flist, &bma->cur, 1,
                                 &tmp_rval, XFS_DATA_FORK);
@@ -836,8 +856,8 @@ xfs_bmap_add_extent_delay_real(
                                 goto done;
                         XFS_WANT_CORRUPTED_GOTO(i == 1, done);
                 }
-                if (bma->ip->i_d.di_format == XFS_DINODE_FMT_EXTENTS &&
-                    bma->ip->i_d.di_nextents > bma->ip->i_df.if_ext_max) {
+
+                if (xfs_bmap_needs_btree(bma->ip, XFS_DATA_FORK)) {
                         error = xfs_bmap_extents_to_btree(bma->tp, bma->ip,
                                         bma->firstblock, bma->flist, &bma->cur,
                                         1, &tmp_rval, XFS_DATA_FORK);
@@ -884,8 +904,7 @@ xfs_bmap_add_extent_delay_real(
         }
 
         /* convert to a btree if necessary */
-        if (XFS_IFORK_FORMAT(bma->ip, XFS_DATA_FORK) == XFS_DINODE_FMT_EXTENTS &&
-            XFS_IFORK_NEXTENTS(bma->ip, XFS_DATA_FORK) > ifp->if_ext_max) {
+        if (xfs_bmap_needs_btree(bma->ip, XFS_DATA_FORK)) {
                 int     tmp_logflags;   /* partial log flag return val */
 
                 ASSERT(bma->cur == NULL);
@@ -1421,8 +1440,7 @@ xfs_bmap_add_extent_unwritten_real(
         }
 
         /* convert to a btree if necessary */
-        if (XFS_IFORK_FORMAT(ip, XFS_DATA_FORK) == XFS_DINODE_FMT_EXTENTS &&
-            XFS_IFORK_NEXTENTS(ip, XFS_DATA_FORK) > ifp->if_ext_max) {
+        if (xfs_bmap_needs_btree(ip, XFS_DATA_FORK)) {
                 int     tmp_logflags;   /* partial log flag return val */
 
                 ASSERT(cur == NULL);
@@ -1812,8 +1830,7 @@ xfs_bmap_add_extent_hole_real(
         }
 
         /* convert to a btree if necessary */
-        if (XFS_IFORK_FORMAT(bma->ip, whichfork) == XFS_DINODE_FMT_EXTENTS &&
-            XFS_IFORK_NEXTENTS(bma->ip, whichfork) > ifp->if_ext_max) {
+        if (xfs_bmap_needs_btree(bma->ip, whichfork)) {
                 int     tmp_logflags;   /* partial log flag return val */
 
                 ASSERT(bma->cur == NULL);
@@ -3037,8 +3054,7 @@ xfs_bmap_extents_to_btree(
 
         ifp = XFS_IFORK_PTR(ip, whichfork);
         ASSERT(XFS_IFORK_FORMAT(ip, whichfork) == XFS_DINODE_FMT_EXTENTS);
-        ASSERT(ifp->if_ext_max ==
-               XFS_IFORK_SIZE(ip, whichfork) / (uint)sizeof(xfs_bmbt_rec_t));
+
         /*
          * Make space in the inode incore.
          */
@@ -3184,13 +3200,8 @@ xfs_bmap_forkoff_reset(
             ip->i_d.di_format != XFS_DINODE_FMT_BTREE) {
                 uint    dfl_forkoff = xfs_default_attroffset(ip) >> 3;
 
-                if (dfl_forkoff > ip->i_d.di_forkoff) {
+                if (dfl_forkoff > ip->i_d.di_forkoff)
                         ip->i_d.di_forkoff = dfl_forkoff;
-                        ip->i_df.if_ext_max =
-                                XFS_IFORK_DSIZE(ip) / sizeof(xfs_bmbt_rec_t);
-                        ip->i_afp->if_ext_max =
-                                XFS_IFORK_ASIZE(ip) / sizeof(xfs_bmbt_rec_t);
-                }
         }
 }
 
@@ -3430,8 +3441,6 @@ xfs_bmap_add_attrfork(
         int                     error;          /* error return value */
 
         ASSERT(XFS_IFORK_Q(ip) == 0);
-        ASSERT(ip->i_df.if_ext_max ==
-               XFS_IFORK_DSIZE(ip) / (uint)sizeof(xfs_bmbt_rec_t));
 
         mp = ip->i_mount;
         ASSERT(!XFS_NOT_DQATTACHED(mp, ip));
@@ -3486,12 +3495,9 @@ xfs_bmap_add_attrfork(
                 error = XFS_ERROR(EINVAL);
                 goto error1;
         }
-        ip->i_df.if_ext_max =
-                XFS_IFORK_DSIZE(ip) / (uint)sizeof(xfs_bmbt_rec_t);
+
         ASSERT(ip->i_afp == NULL);
         ip->i_afp = kmem_zone_zalloc(xfs_ifork_zone, KM_SLEEP);
-        ip->i_afp->if_ext_max =
-                XFS_IFORK_ASIZE(ip) / (uint)sizeof(xfs_bmbt_rec_t);
         ip->i_afp->if_flags = XFS_IFEXTENTS;
         logflags = 0;
         xfs_bmap_init(&flist, &firstblock);
@@ -3535,20 +3541,17 @@ xfs_bmap_add_attrfork(
                 } else
                         spin_unlock(&mp->m_sb_lock);
         }
-        if ((error = xfs_bmap_finish(&tp, &flist, &committed)))
+
+        error = xfs_bmap_finish(&tp, &flist, &committed);
+        if (error)
                 goto error2;
-        error = xfs_trans_commit(tp, XFS_TRANS_RELEASE_LOG_RES);
-        ASSERT(ip->i_df.if_ext_max ==
-               XFS_IFORK_DSIZE(ip) / (uint)sizeof(xfs_bmbt_rec_t));
-        return error;
+        return xfs_trans_commit(tp, XFS_TRANS_RELEASE_LOG_RES);
 error2:
         xfs_bmap_cancel(&flist);
 error1:
         xfs_iunlock(ip, XFS_ILOCK_EXCL);
 error0:
         xfs_trans_cancel(tp, XFS_TRANS_RELEASE_LOG_RES|XFS_TRANS_ABORT);
-        ASSERT(ip->i_df.if_ext_max ==
-               XFS_IFORK_DSIZE(ip) / (uint)sizeof(xfs_bmbt_rec_t));
         return error;
 }
 
@@ -3994,11 +3997,8 @@ xfs_bmap_one_block(
         xfs_bmbt_irec_t s;              /* internal version of extent */
 
 #ifndef DEBUG
-        if (whichfork == XFS_DATA_FORK) {
-                return S_ISREG(ip->i_d.di_mode) ?
-                        (ip->i_size == ip->i_mount->m_sb.sb_blocksize) :
-                        (ip->i_d.di_size == ip->i_mount->m_sb.sb_blocksize);
-        }
+        if (whichfork == XFS_DATA_FORK)
+                return XFS_ISIZE(ip) == ip->i_mount->m_sb.sb_blocksize;
 #endif  /* !DEBUG */
         if (XFS_IFORK_NEXTENTS(ip, whichfork) != 1)
                 return 0;
@@ -4010,7 +4010,7 @@ xfs_bmap_one_block(
         xfs_bmbt_get_all(ep, &s);
         rval = s.br_startoff == 0 && s.br_blockcount == 1;
         if (rval && whichfork == XFS_DATA_FORK)
-                ASSERT(ip->i_size == ip->i_mount->m_sb.sb_blocksize);
+                ASSERT(XFS_ISIZE(ip) == ip->i_mount->m_sb.sb_blocksize);
         return rval;
 }
 
@@ -4379,8 +4379,6 @@ xfs_bmapi_read(
         XFS_STATS_INC(xs_blk_mapr);
 
         ifp = XFS_IFORK_PTR(ip, whichfork);
-        ASSERT(ifp->if_ext_max ==
-               XFS_IFORK_SIZE(ip, whichfork) / (uint)sizeof(xfs_bmbt_rec_t));
 
         if (!(ifp->if_flags & XFS_IFEXTENTS)) {
                 error = xfs_iread_extents(NULL, ip, whichfork);
@@ -4871,8 +4869,6 @@ xfs_bmapi_write(
                 return XFS_ERROR(EIO);
 
         ifp = XFS_IFORK_PTR(ip, whichfork);
-        ASSERT(ifp->if_ext_max ==
-               XFS_IFORK_SIZE(ip, whichfork) / (uint)sizeof(xfs_bmbt_rec_t));
 
         XFS_STATS_INC(xs_blk_mapw);
 
@@ -4981,8 +4977,7 @@ xfs_bmapi_write(
         /*
          * Transform from btree to extents, give it cur.
          */
-        if (XFS_IFORK_FORMAT(ip, whichfork) == XFS_DINODE_FMT_BTREE &&
-            XFS_IFORK_NEXTENTS(ip, whichfork) <= ifp->if_ext_max) {
+        if (xfs_bmap_wants_extents(ip, whichfork)) {
                 int             tmp_logflags = 0;
 
                 ASSERT(bma.cur);
@@ -4992,10 +4987,10 @@ xfs_bmapi_write(
                 if (error)
                         goto error0;
         }
-        ASSERT(ifp->if_ext_max ==
-               XFS_IFORK_SIZE(ip, whichfork) / (uint)sizeof(xfs_bmbt_rec_t));
+
         ASSERT(XFS_IFORK_FORMAT(ip, whichfork) != XFS_DINODE_FMT_BTREE ||
-               XFS_IFORK_NEXTENTS(ip, whichfork) > ifp->if_ext_max);
+               XFS_IFORK_NEXTENTS(ip, whichfork) >
+                XFS_IFORK_MAXEXT(ip, whichfork));
         error = 0;
 error0:
         /*
@@ -5095,8 +5090,7 @@ xfs_bunmapi(
 
         ASSERT(len > 0);
         ASSERT(nexts >= 0);
-        ASSERT(ifp->if_ext_max ==
-               XFS_IFORK_SIZE(ip, whichfork) / (uint)sizeof(xfs_bmbt_rec_t));
+
         if (!(ifp->if_flags & XFS_IFEXTENTS) &&
             (error = xfs_iread_extents(tp, ip, whichfork)))
                 return error;
@@ -5322,7 +5316,8 @@ xfs_bunmapi(
                  */
                 if (!wasdel && xfs_trans_get_block_res(tp) == 0 &&
                     XFS_IFORK_FORMAT(ip, whichfork) == XFS_DINODE_FMT_EXTENTS &&
-                    XFS_IFORK_NEXTENTS(ip, whichfork) >= ifp->if_ext_max &&
+                    XFS_IFORK_NEXTENTS(ip, whichfork) >= /* Note the >= */
+                        XFS_IFORK_MAXEXT(ip, whichfork) &&
                     del.br_startoff > got.br_startoff &&
                     del.br_startoff + del.br_blockcount <
                     got.br_startoff + got.br_blockcount) {
@@ -5353,13 +5348,11 @@ nodelete:
                 }
         }
         *done = bno == (xfs_fileoff_t)-1 || bno < start || lastx < 0;
-        ASSERT(ifp->if_ext_max ==
-               XFS_IFORK_SIZE(ip, whichfork) / (uint)sizeof(xfs_bmbt_rec_t));
+
         /*
          * Convert to a btree if necessary.
          */
-        if (XFS_IFORK_FORMAT(ip, whichfork) == XFS_DINODE_FMT_EXTENTS &&
-            XFS_IFORK_NEXTENTS(ip, whichfork) > ifp->if_ext_max) {
+        if (xfs_bmap_needs_btree(ip, whichfork)) {
                 ASSERT(cur == NULL);
                 error = xfs_bmap_extents_to_btree(tp, ip, firstblock, flist,
                         &cur, 0, &tmp_logflags, whichfork);
@@ -5370,8 +5363,7 @@ nodelete:
         /*
          * transform from btree to extents, give it cur
          */
-        else if (XFS_IFORK_FORMAT(ip, whichfork) == XFS_DINODE_FMT_BTREE &&
-                 XFS_IFORK_NEXTENTS(ip, whichfork) <= ifp->if_ext_max) {
+        else if (xfs_bmap_wants_extents(ip, whichfork)) {
                 ASSERT(cur != NULL);
                 error = xfs_bmap_btree_to_extents(tp, ip, cur, &tmp_logflags,
                         whichfork);
@@ -5382,8 +5374,6 @@ nodelete:
         /*
          * transform from extents to local?
          */
-        ASSERT(ifp->if_ext_max ==
-               XFS_IFORK_SIZE(ip, whichfork) / (uint)sizeof(xfs_bmbt_rec_t));
         error = 0;
 error0:
         /*
@@ -5434,7 +5424,7 @@ xfs_getbmapx_fix_eof_hole(
         if (startblock == HOLESTARTBLOCK) {
                 mp = ip->i_mount;
                 out->bmv_block = -1;
-                fixlen = XFS_FSB_TO_BB(mp, XFS_B_TO_FSB(mp, ip->i_size));
+                fixlen = XFS_FSB_TO_BB(mp, XFS_B_TO_FSB(mp, XFS_ISIZE(ip)));
                 fixlen -= out->bmv_offset;
                 if (prealloced && out->bmv_offset + out->bmv_length == end) {
                         /* Came to hole at EOF. Trim it. */
@@ -5522,7 +5512,7 @@ xfs_getbmap(
                         fixlen = XFS_MAXIOFFSET(mp);
                 } else {
                         prealloced = 0;
-                        fixlen = ip->i_size;
+                        fixlen = XFS_ISIZE(ip);
                 }
         }
 
@@ -5551,7 +5541,7 @@ xfs_getbmap(
 
         xfs_ilock(ip, XFS_IOLOCK_SHARED);
         if (whichfork == XFS_DATA_FORK && !(iflags & BMV_IF_DELALLOC)) {
-                if (ip->i_delayed_blks || ip->i_size > ip->i_d.di_size) {
+                if (ip->i_delayed_blks || XFS_ISIZE(ip) > ip->i_d.di_size) {
                         error = xfs_flush_pages(ip, 0, -1, 0, FI_REMAPF);
                         if (error)
                                 goto out_unlock_iolock;
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 654dc6f05bac..dd974a55c77d 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -163,12 +163,14 @@ xfs_swap_extents_check_format(
 
         /* Check temp in extent form to max in target */
         if (tip->i_d.di_format == XFS_DINODE_FMT_EXTENTS &&
-            XFS_IFORK_NEXTENTS(tip, XFS_DATA_FORK) > ip->i_df.if_ext_max)
+            XFS_IFORK_NEXTENTS(tip, XFS_DATA_FORK) >
+                        XFS_IFORK_MAXEXT(ip, XFS_DATA_FORK))
                 return EINVAL;
 
         /* Check target in extent form to max in temp */
         if (ip->i_d.di_format == XFS_DINODE_FMT_EXTENTS &&
-            XFS_IFORK_NEXTENTS(ip, XFS_DATA_FORK) > tip->i_df.if_ext_max)
+            XFS_IFORK_NEXTENTS(ip, XFS_DATA_FORK) >
+                        XFS_IFORK_MAXEXT(tip, XFS_DATA_FORK))
                 return EINVAL;
 
         /*
@@ -180,18 +182,25 @@ xfs_swap_extents_check_format(
          * (a common defrag case) which will occur when the temp inode is in
          * extent format...
          */
-        if (tip->i_d.di_format == XFS_DINODE_FMT_BTREE &&
-            ((XFS_IFORK_BOFF(ip) &&
-              tip->i_df.if_broot_bytes > XFS_IFORK_BOFF(ip)) ||
-             XFS_IFORK_NEXTENTS(tip, XFS_DATA_FORK) <= ip->i_df.if_ext_max))
-                return EINVAL;
+        if (tip->i_d.di_format == XFS_DINODE_FMT_BTREE) {
+                if (XFS_IFORK_BOFF(ip) &&
+                    tip->i_df.if_broot_bytes > XFS_IFORK_BOFF(ip))
+                        return EINVAL;
+                if (XFS_IFORK_NEXTENTS(tip, XFS_DATA_FORK) <=
+                    XFS_IFORK_MAXEXT(ip, XFS_DATA_FORK))
+                        return EINVAL;
+        }
 
         /* Reciprocal target->temp btree format checks */
-        if (ip->i_d.di_format == XFS_DINODE_FMT_BTREE &&
-            ((XFS_IFORK_BOFF(tip) &&
-              ip->i_df.if_broot_bytes > XFS_IFORK_BOFF(tip)) ||
-             XFS_IFORK_NEXTENTS(ip, XFS_DATA_FORK) <= tip->i_df.if_ext_max))
-                return EINVAL;
+        if (ip->i_d.di_format == XFS_DINODE_FMT_BTREE) {
+                if (XFS_IFORK_BOFF(tip) &&
+                    ip->i_df.if_broot_bytes > XFS_IFORK_BOFF(tip))
+                        return EINVAL;
+
+                if (XFS_IFORK_NEXTENTS(ip, XFS_DATA_FORK) <=
+                    XFS_IFORK_MAXEXT(tip, XFS_DATA_FORK))
+                        return EINVAL;
+        }
 
         return 0;
 }
@@ -349,16 +358,6 @@ xfs_swap_extents(
         *tifp = *tempifp;       /* struct copy */
 
         /*
-         * Fix the in-memory data fork values that are dependent on the fork
-         * offset in the inode. We can't assume they remain the same as attr2
-         * has dynamic fork offsets.
-         */
-        ifp->if_ext_max = XFS_IFORK_SIZE(ip, XFS_DATA_FORK) /
-                                        (uint)sizeof(xfs_bmbt_rec_t);
-        tifp->if_ext_max = XFS_IFORK_SIZE(tip, XFS_DATA_FORK) /
-                                        (uint)sizeof(xfs_bmbt_rec_t);
-
-        /*
          * Fix the on-disk inode values
          */
         tmp = (__uint64_t)ip->i_d.di_nblocks;
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index f675f3d9d7b3..7e5bc872f2b4 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -327,7 +327,7 @@ xfs_file_aio_read(
                                 mp->m_rtdev_targp : mp->m_ddev_targp;
                 if ((iocb->ki_pos & target->bt_smask) ||
                     (size & target->bt_smask)) {
-                        if (iocb->ki_pos == ip->i_size)
+                        if (iocb->ki_pos == i_size_read(inode))
                                 return 0;
                         return -XFS_ERROR(EINVAL);
                 }
@@ -412,51 +412,6 @@ xfs_file_splice_read(
         return ret;
 }
 
-STATIC void
-xfs_aio_write_isize_update(
-        struct inode    *inode,
-        loff_t          *ppos,
-        ssize_t         bytes_written)
-{
-        struct xfs_inode        *ip = XFS_I(inode);
-        xfs_fsize_t             isize = i_size_read(inode);
-
-        if (bytes_written > 0)
-                XFS_STATS_ADD(xs_write_bytes, bytes_written);
-
-        if (unlikely(bytes_written < 0 && bytes_written != -EFAULT &&
-                                        *ppos > isize))
-                *ppos = isize;
-
-        if (*ppos > ip->i_size) {
-                xfs_rw_ilock(ip, XFS_ILOCK_EXCL);
-                if (*ppos > ip->i_size)
-                        ip->i_size = *ppos;
-                xfs_rw_iunlock(ip, XFS_ILOCK_EXCL);
-        }
-}
-
-/*
- * If this was a direct or synchronous I/O that failed (such as ENOSPC) then
- * part of the I/O may have been written to disk before the error occurred.  In
- * this case the on-disk file size may have been adjusted beyond the in-memory
- * file size and now needs to be truncated back.
- */
-STATIC void
-xfs_aio_write_newsize_update(
-        struct xfs_inode        *ip,
-        xfs_fsize_t             new_size)
-{
-        if (new_size == ip->i_new_size) {
-                xfs_rw_ilock(ip, XFS_ILOCK_EXCL);
-                if (new_size == ip->i_new_size)
-                        ip->i_new_size = 0;
-                if (ip->i_d.di_size > ip->i_size)
-                        ip->i_d.di_size = ip->i_size;
-                xfs_rw_iunlock(ip, XFS_ILOCK_EXCL);
-        }
-}
-
 /*
  * xfs_file_splice_write() does not use xfs_rw_ilock() because
  * generic_file_splice_write() takes the i_mutex itself. This, in theory,
@@ -475,7 +430,6 @@ xfs_file_splice_write(
 {
         struct inode            *inode = outfilp->f_mapping->host;
         struct xfs_inode        *ip = XFS_I(inode);
-        xfs_fsize_t             new_size;
         int                     ioflags = 0;
         ssize_t                 ret;
 
@@ -489,19 +443,12 @@ xfs_file_splice_write(
 
         xfs_ilock(ip, XFS_IOLOCK_EXCL);
 
-        new_size = *ppos + count;
-
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
-        if (new_size > ip->i_size)
-                ip->i_new_size = new_size;
-        xfs_iunlock(ip, XFS_ILOCK_EXCL);
-
         trace_xfs_file_splice_write(ip, count, *ppos, ioflags);
 
         ret = generic_file_splice_write(pipe, outfilp, ppos, count, flags);
+        if (ret > 0)
+                XFS_STATS_ADD(xs_write_bytes, ret);
 
-        xfs_aio_write_isize_update(inode, ppos, ret);
-        xfs_aio_write_newsize_update(ip, new_size);
         xfs_iunlock(ip, XFS_IOLOCK_EXCL);
         return ret;
 }
@@ -689,28 +636,26 @@ out_lock:
 /*
  * Common pre-write limit and setup checks.
  *
- * Returns with iolock held according to @iolock.
+ * Called with the iolocked held either shared and exclusive according to
+ * @iolock, and returns with it held.  Might upgrade the iolock to exclusive
+ * if called for a direct write beyond i_size.
  */
 STATIC ssize_t
 xfs_file_aio_write_checks(
         struct file             *file,
         loff_t                  *pos,
         size_t                  *count,
-        xfs_fsize_t             *new_sizep,
         int                     *iolock)
 {
         struct inode            *inode = file->f_mapping->host;
         struct xfs_inode        *ip = XFS_I(inode);
-        xfs_fsize_t             new_size;
         int                     error = 0;
 
         xfs_rw_ilock(ip, XFS_ILOCK_EXCL);
-        *new_sizep = 0;
 restart:
         error = generic_write_checks(file, pos, count, S_ISBLK(inode->i_mode));
         if (error) {
-                xfs_rw_iunlock(ip, XFS_ILOCK_EXCL | *iolock);
-                *iolock = 0;
+                xfs_rw_iunlock(ip, XFS_ILOCK_EXCL);
                 return error;
         }
 
@@ -720,36 +665,21 @@ restart:
         /*
          * If the offset is beyond the size of the file, we need to zero any
          * blocks that fall between the existing EOF and the start of this
-         * write. There is no need to issue zeroing if another in-flght IO ends
-         * at or before this one If zeronig is needed and we are currently
-         * holding the iolock shared, we need to update it to exclusive which
-         * involves dropping all locks and relocking to maintain correct locking
-         * order. If we do this, restart the function to ensure all checks and
-         * values are still valid.
+         * write.  If zeroing is needed and we are currently holding the
+         * iolock shared, we need to update it to exclusive which involves
+         * dropping all locks and relocking to maintain correct locking order.
+         * If we do this, restart the function to ensure all checks and values
+         * are still valid.
          */
-        if ((ip->i_new_size && *pos > ip->i_new_size) ||
-            (!ip->i_new_size && *pos > ip->i_size)) {
+        if (*pos > i_size_read(inode)) {
                 if (*iolock == XFS_IOLOCK_SHARED) {
                         xfs_rw_iunlock(ip, XFS_ILOCK_EXCL | *iolock);
                         *iolock = XFS_IOLOCK_EXCL;
                         xfs_rw_ilock(ip, XFS_ILOCK_EXCL | *iolock);
                         goto restart;
                 }
-                error = -xfs_zero_eof(ip, *pos, ip->i_size);
+                error = -xfs_zero_eof(ip, *pos, i_size_read(inode));
         }
-
-        /*
-         * If this IO extends beyond EOF, we may need to update ip->i_new_size.
-         * We have already zeroed space beyond EOF (if necessary).  Only update
-         * ip->i_new_size if this IO ends beyond any other in-flight writes.
-         */
-        new_size = *pos + *count;
-        if (new_size > ip->i_size) {
-                if (new_size > ip->i_new_size)
-                        ip->i_new_size = new_size;
-                *new_sizep = new_size;
-        }
-
         xfs_rw_iunlock(ip, XFS_ILOCK_EXCL);
         if (error)
                 return error;
@@ -794,9 +724,7 @@ xfs_file_dio_aio_write(
         const struct iovec      *iovp,
         unsigned long           nr_segs,
         loff_t                  pos,
-        size_t                  ocount,
-        xfs_fsize_t             *new_size,
-        int                     *iolock)
+        size_t                  ocount)
 {
         struct file             *file = iocb->ki_filp;
         struct address_space    *mapping = file->f_mapping;
@@ -806,10 +734,10 @@ xfs_file_dio_aio_write(
         ssize_t                 ret = 0;
         size_t                  count = ocount;
         int                     unaligned_io = 0;
+        int                     iolock;
         struct xfs_buftarg      *target = XFS_IS_REALTIME_INODE(ip) ?
                                         mp->m_rtdev_targp : mp->m_ddev_targp;
 
-        *iolock = 0;
         if ((pos & target->bt_smask) || (count & target->bt_smask))
                 return -XFS_ERROR(EINVAL);
 
@@ -824,31 +752,31 @@ xfs_file_dio_aio_write(
          * EOF zeroing cases and fill out the new inode size as appropriate.
          */
         if (unaligned_io || mapping->nrpages)
-                *iolock = XFS_IOLOCK_EXCL;
+                iolock = XFS_IOLOCK_EXCL;
         else
-                *iolock = XFS_IOLOCK_SHARED;
-        xfs_rw_ilock(ip, *iolock);
+                iolock = XFS_IOLOCK_SHARED;
+        xfs_rw_ilock(ip, iolock);
 
         /*
          * Recheck if there are cached pages that need invalidate after we got
          * the iolock to protect against other threads adding new pages while
          * we were waiting for the iolock.
          */
-        if (mapping->nrpages && *iolock == XFS_IOLOCK_SHARED) {
-                xfs_rw_iunlock(ip, *iolock);
-                *iolock = XFS_IOLOCK_EXCL;
-                xfs_rw_ilock(ip, *iolock);
+        if (mapping->nrpages && iolock == XFS_IOLOCK_SHARED) {
+                xfs_rw_iunlock(ip, iolock);
+                iolock = XFS_IOLOCK_EXCL;
+                xfs_rw_ilock(ip, iolock);
         }
 
-        ret = xfs_file_aio_write_checks(file, &pos, &count, new_size, iolock);
+        ret = xfs_file_aio_write_checks(file, &pos, &count, &iolock);
         if (ret)
-                return ret;
+                goto out;
 
         if (mapping->nrpages) {
                 ret = -xfs_flushinval_pages(ip, (pos & PAGE_CACHE_MASK), -1,
                                                         FI_REMAPF_LOCKED);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
         /*
@@ -857,15 +785,18 @@ xfs_file_dio_aio_write(
          */
         if (unaligned_io)
                 inode_dio_wait(inode);
-        else if (*iolock == XFS_IOLOCK_EXCL) {
+        else if (iolock == XFS_IOLOCK_EXCL) {
                 xfs_rw_ilock_demote(ip, XFS_IOLOCK_EXCL);
-                *iolock = XFS_IOLOCK_SHARED;
+                iolock = XFS_IOLOCK_SHARED;
         }
 
         trace_xfs_file_direct_write(ip, count, iocb->ki_pos, 0);
         ret = generic_file_direct_write(iocb, iovp,
                         &nr_segs, pos, &iocb->ki_pos, count, ocount);
 
+out:
+        xfs_rw_iunlock(ip, iolock);
+
         /* No fallback to buffered IO on errors for XFS. */
         ASSERT(ret < 0 || ret == count);
         return ret;
@@ -877,9 +808,7 @@ xfs_file_buffered_aio_write(
         const struct iovec      *iovp,
         unsigned long           nr_segs,
         loff_t                  pos,
-        size_t                  ocount,
-        xfs_fsize_t             *new_size,
-        int                     *iolock)
+        size_t                  ocount)
 {
         struct file             *file = iocb->ki_filp;
         struct address_space    *mapping = file->f_mapping;
@@ -887,14 +816,14 @@ xfs_file_buffered_aio_write(
         struct xfs_inode        *ip = XFS_I(inode);
         ssize_t                 ret;
         int                     enospc = 0;
+        int                     iolock = XFS_IOLOCK_EXCL;
         size_t                  count = ocount;
 
-        *iolock = XFS_IOLOCK_EXCL;
-        xfs_rw_ilock(ip, *iolock);
+        xfs_rw_ilock(ip, iolock);
 
-        ret = xfs_file_aio_write_checks(file, &pos, &count, new_size, iolock);
+        ret = xfs_file_aio_write_checks(file, &pos, &count, &iolock);
         if (ret)
-                return ret;
+                goto out;
 
         /* We can write back this queue in page reclaim */
         current->backing_dev_info = mapping->backing_dev_info;
@@ -908,13 +837,15 @@ write_retry:
          * page locks and retry *once*
          */
         if (ret == -ENOSPC && !enospc) {
-                ret = -xfs_flush_pages(ip, 0, -1, 0, FI_NONE);
-                if (ret)
-                        return ret;
                 enospc = 1;
-                goto write_retry;
+                ret = -xfs_flush_pages(ip, 0, -1, 0, FI_NONE);
+                if (!ret)
+                        goto write_retry;
         }
+
         current->backing_dev_info = NULL;
+out:
+        xfs_rw_iunlock(ip, iolock);
         return ret;
 }
 
@@ -930,9 +861,7 @@ xfs_file_aio_write(
         struct inode            *inode = mapping->host;
         struct xfs_inode        *ip = XFS_I(inode);
         ssize_t                 ret;
-        int                     iolock;
         size_t                  ocount = 0;
-        xfs_fsize_t             new_size = 0;
 
         XFS_STATS_INC(xs_write_calls);
 
@@ -951,33 +880,22 @@ xfs_file_aio_write(
                 return -EIO;
 
         if (unlikely(file->f_flags & O_DIRECT))
-                ret = xfs_file_dio_aio_write(iocb, iovp, nr_segs, pos,
-                                                ocount, &new_size, &iolock);
+                ret = xfs_file_dio_aio_write(iocb, iovp, nr_segs, pos, ocount);
         else
                 ret = xfs_file_buffered_aio_write(iocb, iovp, nr_segs, pos,
-                                                ocount, &new_size, &iolock);
-
-        xfs_aio_write_isize_update(inode, &iocb->ki_pos, ret);
+                                                  ocount);
 
-        if (ret <= 0)
-                goto out_unlock;
+        if (ret > 0) {
+                ssize_t err;
 
-        /* Handle various SYNC-type writes */
-        if ((file->f_flags & O_DSYNC) || IS_SYNC(inode)) {
-                loff_t end = pos + ret - 1;
-                int error;
+                XFS_STATS_ADD(xs_write_bytes, ret);
 
-                xfs_rw_iunlock(ip, iolock);
-                error = xfs_file_fsync(file, pos, end,
-                                      (file->f_flags & __O_SYNC) ? 0 : 1);
-                xfs_rw_ilock(ip, iolock);
-                if (error)
-                        ret = error;
+                /* Handle various SYNC-type writes */
+                err = generic_write_sync(file, pos, ret);
+                if (err < 0)
+                        ret = err;
         }
 
-out_unlock:
-        xfs_aio_write_newsize_update(ip, new_size);
-        xfs_rw_iunlock(ip, iolock);
         return ret;
 }
 
diff --git a/fs/xfs/xfs_fs_subr.c b/fs/xfs/xfs_fs_subr.c
index ed88ed16811c..652b875a9d4c 100644
--- a/fs/xfs/xfs_fs_subr.c
+++ b/fs/xfs/xfs_fs_subr.c
@@ -90,7 +90,7 @@ xfs_wait_on_pages(
 
         if (mapping_tagged(mapping, PAGECACHE_TAG_WRITEBACK)) {
                 return -filemap_fdatawait_range(mapping, first,
-                                        last == -1 ? ip->i_size - 1 : last);
+                                        last == -1 ? XFS_ISIZE(ip) - 1 : last);
         }
         return 0;
 }
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index 3960a066d7ff..8c3e46394d48 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -77,7 +77,7 @@ xfs_inode_alloc(
 
         ASSERT(atomic_read(&ip->i_pincount) == 0);
         ASSERT(!spin_is_locked(&ip->i_flags_lock));
-        ASSERT(completion_done(&ip->i_flush));
+        ASSERT(!xfs_isiflocked(ip));
         ASSERT(ip->i_ino == 0);
 
         mrlock_init(&ip->i_iolock, MRLOCK_BARRIER, "xfsio", ip->i_ino);
@@ -94,8 +94,6 @@ xfs_inode_alloc(
         ip->i_update_core = 0;
         ip->i_delayed_blks = 0;
         memset(&ip->i_d, 0, sizeof(xfs_icdinode_t));
-        ip->i_size = 0;
-        ip->i_new_size = 0;
 
         return ip;
 }
@@ -150,7 +148,7 @@ xfs_inode_free(
         /* asserts to verify all state is correct here */
         ASSERT(atomic_read(&ip->i_pincount) == 0);
         ASSERT(!spin_is_locked(&ip->i_flags_lock));
-        ASSERT(completion_done(&ip->i_flush));
+        ASSERT(!xfs_isiflocked(ip));
 
         /*
          * Because we use RCU freeing we need to ensure the inode always
@@ -450,8 +448,6 @@ again:
 
         *ipp = ip;
 
-        ASSERT(ip->i_df.if_ext_max ==
-               XFS_IFORK_DSIZE(ip) / sizeof(xfs_bmbt_rec_t));
         /*
          * If we have a real type for an on-disk inode, we can set ops(&unlock)
          * now.  If it's a new inode being created, xfs_ialloc will handle it.
@@ -715,3 +711,19 @@ xfs_isilocked(
         return 0;
 }
 #endif
+
+void
+__xfs_iflock(
+        struct xfs_inode        *ip)
+{
+        wait_queue_head_t *wq = bit_waitqueue(&ip->i_flags, __XFS_IFLOCK_BIT);
+        DEFINE_WAIT_BIT(wait, &ip->i_flags, __XFS_IFLOCK_BIT);
+
+        do {
+                prepare_to_wait_exclusive(wq, &wait.wait, TASK_UNINTERRUPTIBLE);
+                if (xfs_isiflocked(ip))
+                        io_schedule();
+        } while (!xfs_iflock_nowait(ip));
+
+        finish_wait(wq, &wait.wait);
+}
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 9dda7cc32848..b21022499c2e 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -299,11 +299,8 @@ xfs_iformat(
 {
         xfs_attr_shortform_t    *atp;
         int                     size;
-        int                     error;
+        int                     error = 0;
         xfs_fsize_t             di_size;
-        ip->i_df.if_ext_max =
-                XFS_IFORK_DSIZE(ip) / (uint)sizeof(xfs_bmbt_rec_t);
-        error = 0;
 
         if (unlikely(be32_to_cpu(dip->di_nextents) +
                      be16_to_cpu(dip->di_anextents) >
@@ -350,7 +347,6 @@ xfs_iformat(
                         return XFS_ERROR(EFSCORRUPTED);
                 }
                 ip->i_d.di_size = 0;
-                ip->i_size = 0;
                 ip->i_df.if_u2.if_rdev = xfs_dinode_get_rdev(dip);
                 break;
 
@@ -409,10 +405,10 @@ xfs_iformat(
         }
         if (!XFS_DFORK_Q(dip))
                 return 0;
+
         ASSERT(ip->i_afp == NULL);
         ip->i_afp = kmem_zone_zalloc(xfs_ifork_zone, KM_SLEEP | KM_NOFS);
-        ip->i_afp->if_ext_max =
-                XFS_IFORK_ASIZE(ip) / (uint)sizeof(xfs_bmbt_rec_t);
+
         switch (dip->di_aformat) {
         case XFS_DINODE_FMT_LOCAL:
                 atp = (xfs_attr_shortform_t *)XFS_DFORK_APTR(dip);
@@ -604,10 +600,11 @@ xfs_iformat_btree(
          * or the number of extents is greater than the number of
          * blocks.
          */
-        if (unlikely(XFS_IFORK_NEXTENTS(ip, whichfork) <= ifp->if_ext_max
-            || XFS_BMDR_SPACE_CALC(nrecs) >
-                        XFS_DFORK_SIZE(dip, ip->i_mount, whichfork)
-            || XFS_IFORK_NEXTENTS(ip, whichfork) > ip->i_d.di_nblocks)) {
+        if (unlikely(XFS_IFORK_NEXTENTS(ip, whichfork) <=
+                        XFS_IFORK_MAXEXT(ip, whichfork) ||
+                     XFS_BMDR_SPACE_CALC(nrecs) >
+                        XFS_DFORK_SIZE(dip, ip->i_mount, whichfork) ||
+                     XFS_IFORK_NEXTENTS(ip, whichfork) > ip->i_d.di_nblocks)) {
                 xfs_warn(ip->i_mount, "corrupt inode %Lu (btree).",
                         (unsigned long long) ip->i_ino);
                 XFS_CORRUPTION_ERROR("xfs_iformat_btree", XFS_ERRLEVEL_LOW,
@@ -835,12 +832,6 @@ xfs_iread(
                  * with the uninitialized part of it.
                  */
                 ip->i_d.di_mode = 0;
-                /*
-                 * Initialize the per-fork minima and maxima for a new
-                 * inode here.  xfs_iformat will do it for old inodes.
-                 */
-                ip->i_df.if_ext_max =
-                        XFS_IFORK_DSIZE(ip) / (uint)sizeof(xfs_bmbt_rec_t);
         }
 
         /*
@@ -861,7 +852,6 @@ xfs_iread(
         }
 
         ip->i_delayed_blks = 0;
-        ip->i_size = ip->i_d.di_size;
 
         /*
          * Mark the buffer containing the inode as something to keep
@@ -1051,7 +1041,6 @@ xfs_ialloc(
         }
 
         ip->i_d.di_size = 0;
-        ip->i_size = 0;
         ip->i_d.di_nextents = 0;
         ASSERT(ip->i_d.di_nblocks == 0);
 
@@ -1166,52 +1155,6 @@ xfs_ialloc(
 }
 
 /*
- * Check to make sure that there are no blocks allocated to the
- * file beyond the size of the file.  We don't check this for
- * files with fixed size extents or real time extents, but we
- * at least do it for regular files.
- */
-#ifdef DEBUG
-STATIC void
-xfs_isize_check(
-        struct xfs_inode        *ip,
-        xfs_fsize_t             isize)
-{
-        struct xfs_mount        *mp = ip->i_mount;
-        xfs_fileoff_t           map_first;
-        int                     nimaps;
-        xfs_bmbt_irec_t         imaps[2];
-        int                     error;
-
-        if (!S_ISREG(ip->i_d.di_mode))
-                return;
-
-        if (XFS_IS_REALTIME_INODE(ip))
-                return;
-
-        if (ip->i_d.di_flags & XFS_DIFLAG_EXTSIZE)
-                return;
-
-        nimaps = 2;
-        map_first = XFS_B_TO_FSB(mp, (xfs_ufsize_t)isize);
-        /*
-         * The filesystem could be shutting down, so bmapi may return
-         * an error.
-         */
-        error = xfs_bmapi_read(ip, map_first,
-                         (XFS_B_TO_FSB(mp,
-                               (xfs_ufsize_t)XFS_MAXIOFFSET(mp)) - map_first),
-                         imaps, &nimaps, XFS_BMAPI_ENTIRE);
-        if (error)
-                return;
-        ASSERT(nimaps == 1);
-        ASSERT(imaps[0].br_startblock == HOLESTARTBLOCK);
-}
-#else   /* DEBUG */
-#define xfs_isize_check(ip, isize)
-#endif  /* DEBUG */
-
-/*
  * Free up the underlying blocks past new_size.  The new size must be smaller
  * than the current size.  This routine can be used both for the attribute and
  * data fork, and does not modify the inode size, which is left to the caller.
@@ -1252,12 +1195,14 @@ xfs_itruncate_extents(
         int                     done = 0;
 
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_IOLOCK_EXCL));
-        ASSERT(new_size <= ip->i_size);
+        ASSERT(new_size <= XFS_ISIZE(ip));
         ASSERT(tp->t_flags & XFS_TRANS_PERM_LOG_RES);
         ASSERT(ip->i_itemp != NULL);
         ASSERT(ip->i_itemp->ili_lock_flags == 0);
         ASSERT(!XFS_NOT_DQATTACHED(mp, ip));
 
+        trace_xfs_itruncate_extents_start(ip, new_size);
+
         /*
          * Since it is possible for space to become allocated beyond
          * the end of the file (in a crash where the space is allocated
@@ -1325,6 +1270,14 @@ xfs_itruncate_extents(
                         goto out;
         }
 
+        /*
+         * Always re-log the inode so that our permanent transaction can keep
+         * on rolling it forward in the log.
+         */
+        xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+
+        trace_xfs_itruncate_extents_end(ip, new_size);
+
 out:
         *tpp = tp;
         return error;
@@ -1338,74 +1291,6 @@ out_bmap_cancel:
         goto out;
 }
 
-int
-xfs_itruncate_data(
-        struct xfs_trans        **tpp,
-        struct xfs_inode        *ip,
-        xfs_fsize_t             new_size)
-{
-        int                     error;
-
-        trace_xfs_itruncate_data_start(ip, new_size);
-
-        /*
-         * The first thing we do is set the size to new_size permanently on
-         * disk.  This way we don't have to worry about anyone ever being able
-         * to look at the data being freed even in the face of a crash.
-         * What we're getting around here is the case where we free a block, it
-         * is allocated to another file, it is written to, and then we crash.
-         * If the new data gets written to the file but the log buffers
-         * containing the free and reallocation don't, then we'd end up with
-         * garbage in the blocks being freed.  As long as we make the new_size
-         * permanent before actually freeing any blocks it doesn't matter if
-         * they get written to.
-         */
-        if (ip->i_d.di_nextents > 0) {
-                /*
-                 * If we are not changing the file size then do not update
-                 * the on-disk file size - we may be called from
-                 * xfs_inactive_free_eofblocks().  If we update the on-disk
-                 * file size and then the system crashes before the contents
-                 * of the file are flushed to disk then the files may be
-                 * full of holes (ie NULL files bug).
-                 */
-                if (ip->i_size != new_size) {
-                        ip->i_d.di_size = new_size;
-                        ip->i_size = new_size;
-                        xfs_trans_log_inode(*tpp, ip, XFS_ILOG_CORE);
-                }
-        }
-
-        error = xfs_itruncate_extents(tpp, ip, XFS_DATA_FORK, new_size);
-        if (error)
-                return error;
-
-        /*
-         * If we are not changing the file size then do not update the on-disk
-         * file size - we may be called from xfs_inactive_free_eofblocks().
-         * If we update the on-disk file size and then the system crashes
-         * before the contents of the file are flushed to disk then the files
-         * may be full of holes (ie NULL files bug).
-         */
-        xfs_isize_check(ip, new_size);
-        if (ip->i_size != new_size) {
-                ip->i_d.di_size = new_size;
-                ip->i_size = new_size;
-        }
-
-        ASSERT(new_size != 0 || ip->i_delayed_blks == 0);
-        ASSERT(new_size != 0 || ip->i_d.di_nextents == 0);
-
-        /*
-         * Always re-log the inode so that our permanent transaction can keep
-         * on rolling it forward in the log.
-         */
-        xfs_trans_log_inode(*tpp, ip, XFS_ILOG_CORE);
-
-        trace_xfs_itruncate_data_end(ip, new_size);
-        return 0;
-}
-
 /*
  * This is called when the inode's link count goes to 0.
  * We place the on-disk inode on a list in the AGI.  It
@@ -1824,8 +1709,7 @@ xfs_ifree(
         ASSERT(ip->i_d.di_nlink == 0);
         ASSERT(ip->i_d.di_nextents == 0);
         ASSERT(ip->i_d.di_anextents == 0);
-        ASSERT((ip->i_d.di_size == 0 && ip->i_size == 0) ||
-               (!S_ISREG(ip->i_d.di_mode)));
+        ASSERT(ip->i_d.di_size == 0 || !S_ISREG(ip->i_d.di_mode));
         ASSERT(ip->i_d.di_nblocks == 0);
 
         /*
@@ -1844,8 +1728,6 @@ xfs_ifree(
         ip->i_d.di_flags = 0;
         ip->i_d.di_dmevmask = 0;
         ip->i_d.di_forkoff = 0;         /* mark the attr fork not in use */
-        ip->i_df.if_ext_max =
-                XFS_IFORK_DSIZE(ip) / (uint)sizeof(xfs_bmbt_rec_t);
         ip->i_d.di_format = XFS_DINODE_FMT_EXTENTS;
         ip->i_d.di_aformat = XFS_DINODE_FMT_EXTENTS;
         /*
@@ -2151,7 +2033,7 @@ xfs_idestroy_fork(
  * once someone is waiting for it to be unpinned.
  */
 static void
-xfs_iunpin_nowait(
+xfs_iunpin(
         struct xfs_inode        *ip)
 {
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_ILOCK_SHARED));
@@ -2163,14 +2045,29 @@ xfs_iunpin_nowait(
 
 }
 
+static void
+__xfs_iunpin_wait(
+        struct xfs_inode        *ip)
+{
+        wait_queue_head_t *wq = bit_waitqueue(&ip->i_flags, __XFS_IPINNED_BIT);
+        DEFINE_WAIT_BIT(wait, &ip->i_flags, __XFS_IPINNED_BIT);
+
+        xfs_iunpin(ip);
+
+        do {
+                prepare_to_wait(wq, &wait.wait, TASK_UNINTERRUPTIBLE);
+                if (xfs_ipincount(ip))
+                        io_schedule();
+        } while (xfs_ipincount(ip));
+        finish_wait(wq, &wait.wait);
+}
+
 void
 xfs_iunpin_wait(
         struct xfs_inode        *ip)
 {
-        if (xfs_ipincount(ip)) {
-                xfs_iunpin_nowait(ip);
-                wait_event(ip->i_ipin_wait, (xfs_ipincount(ip) == 0));
-        }
+        if (xfs_ipincount(ip))
+                __xfs_iunpin_wait(ip);
 }
 
 /*
@@ -2510,9 +2407,9 @@ xfs_iflush(
         XFS_STATS_INC(xs_iflush_count);
 
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_ILOCK_SHARED));
-        ASSERT(!completion_done(&ip->i_flush));
+        ASSERT(xfs_isiflocked(ip));
         ASSERT(ip->i_d.di_format != XFS_DINODE_FMT_BTREE ||
-               ip->i_d.di_nextents > ip->i_df.if_ext_max);
+               ip->i_d.di_nextents > XFS_IFORK_MAXEXT(ip, XFS_DATA_FORK));
 
         iip = ip->i_itemp;
         mp = ip->i_mount;
@@ -2529,7 +2426,7 @@ xfs_iflush(
          * out for us if they occur after the log force completes.
          */
         if (!(flags & SYNC_WAIT) && xfs_ipincount(ip)) {
-                xfs_iunpin_nowait(ip);
+                xfs_iunpin(ip);
                 xfs_ifunlock(ip);
                 return EAGAIN;
         }
@@ -2626,9 +2523,9 @@ xfs_iflush_int(
 #endif
 
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_ILOCK_SHARED));
-        ASSERT(!completion_done(&ip->i_flush));
+        ASSERT(xfs_isiflocked(ip));
         ASSERT(ip->i_d.di_format != XFS_DINODE_FMT_BTREE ||
-               ip->i_d.di_nextents > ip->i_df.if_ext_max);
+               ip->i_d.di_nextents > XFS_IFORK_MAXEXT(ip, XFS_DATA_FORK));
 
         iip = ip->i_itemp;
         mp = ip->i_mount;
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index f0e6b151ba37..2f27b7454085 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -66,7 +66,6 @@ typedef struct xfs_ifork {
         struct xfs_btree_block  *if_broot;      /* file's incore btree root */
         short                   if_broot_bytes; /* bytes allocated for root */
         unsigned char           if_flags;       /* per-fork flags */
-        unsigned char           if_ext_max;     /* max # of extent records */
         union {
                 xfs_bmbt_rec_host_t *if_extents;/* linear map file exts */
                 xfs_ext_irec_t  *if_ext_irec;   /* irec map file exts */
@@ -206,12 +205,12 @@ typedef struct xfs_icdinode {
         ((w) == XFS_DATA_FORK ? \
                 ((ip)->i_d.di_nextents = (n)) : \
                 ((ip)->i_d.di_anextents = (n)))
-
+#define XFS_IFORK_MAXEXT(ip, w) \
+        (XFS_IFORK_SIZE(ip, w) / sizeof(xfs_bmbt_rec_t))
 
 
 #ifdef __KERNEL__
 
-struct bhv_desc;
 struct xfs_buf;
 struct xfs_bmap_free;
 struct xfs_bmbt_irec;
@@ -220,12 +219,6 @@ struct xfs_mount;
 struct xfs_trans;
 struct xfs_dquot;
 
-typedef struct dm_attrs_s {
-        __uint32_t      da_dmevmask;    /* DMIG event mask */
-        __uint16_t      da_dmstate;     /* DMIG state info */
-        __uint16_t      da_pad;         /* DMIG extra padding */
-} dm_attrs_t;
-
 typedef struct xfs_inode {
         /* Inode linking and identification information. */
         struct xfs_mount        *i_mount;       /* fs mount struct ptr */
@@ -244,27 +237,19 @@ typedef struct xfs_inode {
         struct xfs_inode_log_item *i_itemp;     /* logging information */
         mrlock_t                i_lock;         /* inode lock */
         mrlock_t                i_iolock;       /* inode IO lock */
-        struct completion       i_flush;        /* inode flush completion q */
         atomic_t                i_pincount;     /* inode pin count */
-        wait_queue_head_t       i_ipin_wait;    /* inode pinning wait queue */
         spinlock_t              i_flags_lock;   /* inode i_flags lock */
         /* Miscellaneous state. */
-        unsigned short          i_flags;        /* see defined flags below */
+        unsigned long           i_flags;        /* see defined flags below */
         unsigned char           i_update_core;  /* timestamps/size is dirty */
         unsigned int            i_delayed_blks; /* count of delay alloc blks */
 
         xfs_icdinode_t          i_d;            /* most of ondisk inode */
 
-        xfs_fsize_t             i_size;         /* in-memory size */
-        xfs_fsize_t             i_new_size;     /* size when write completes */
-
         /* VFS inode */
         struct inode            i_vnode;        /* embedded VFS inode */
 } xfs_inode_t;
 
-#define XFS_ISIZE(ip)   S_ISREG((ip)->i_d.di_mode) ? \
-                                (ip)->i_size : (ip)->i_d.di_size;
-
 /* Convert from vfs inode to xfs inode */
 static inline struct xfs_inode *XFS_I(struct inode *inode)
 {
@@ -278,6 +263,18 @@ static inline struct inode *VFS_I(struct xfs_inode *ip)
 }
 
 /*
+ * For regular files we only update the on-disk filesize when actually
+ * writing data back to disk.  Until then only the copy in the VFS inode
+ * is uptodate.
+ */
+static inline xfs_fsize_t XFS_ISIZE(struct xfs_inode *ip)
+{
+        if (S_ISREG(ip->i_d.di_mode))
+                return i_size_read(VFS_I(ip));
+        return ip->i_d.di_size;
+}
+
+/*
  * i_flags helper functions
  */
 static inline void
@@ -331,6 +328,19 @@ xfs_iflags_test_and_clear(xfs_inode_t *ip, unsigned short flags)
         return ret;
 }
 
+static inline int
+xfs_iflags_test_and_set(xfs_inode_t *ip, unsigned short flags)
+{
+        int ret;
+
+        spin_lock(&ip->i_flags_lock);
+        ret = ip->i_flags & flags;
+        if (!ret)
+                ip->i_flags |= flags;
+        spin_unlock(&ip->i_flags_lock);
+        return ret;
+}
+
 /*
  * Project quota id helpers (previously projid was 16bit only
  * and using two 16bit values to hold new 32bit projid was chosen
@@ -351,35 +361,19 @@ xfs_set_projid(struct xfs_inode *ip,
 }
 
 /*
- * Manage the i_flush queue embedded in the inode.  This completion
- * queue synchronizes processes attempting to flush the in-core
- * inode back to disk.
- */
-static inline void xfs_iflock(xfs_inode_t *ip)
-{
-        wait_for_completion(&ip->i_flush);
-}
-
-static inline int xfs_iflock_nowait(xfs_inode_t *ip)
-{
-        return try_wait_for_completion(&ip->i_flush);
-}
-
-static inline void xfs_ifunlock(xfs_inode_t *ip)
-{
-        complete(&ip->i_flush);
-}
-
-/*
  * In-core inode flags.
  */
-#define XFS_IRECLAIM            0x0001  /* started reclaiming this inode */
-#define XFS_ISTALE              0x0002  /* inode has been staled */
-#define XFS_IRECLAIMABLE        0x0004  /* inode can be reclaimed */
-#define XFS_INEW                0x0008  /* inode has just been allocated */
-#define XFS_IFILESTREAM         0x0010  /* inode is in a filestream directory */
-#define XFS_ITRUNCATED          0x0020  /* truncated down so flush-on-close */
-#define XFS_IDIRTY_RELEASE      0x0040  /* dirty release already seen */
+#define XFS_IRECLAIM            (1 << 0) /* started reclaiming this inode */
+#define XFS_ISTALE              (1 << 1) /* inode has been staled */
+#define XFS_IRECLAIMABLE        (1 << 2) /* inode can be reclaimed */
+#define XFS_INEW                (1 << 3) /* inode has just been allocated */
+#define XFS_IFILESTREAM         (1 << 4) /* inode is in a filestream dir. */
+#define XFS_ITRUNCATED          (1 << 5) /* truncated down so flush-on-close */
+#define XFS_IDIRTY_RELEASE      (1 << 6) /* dirty release already seen */
+#define __XFS_IFLOCK_BIT        7        /* inode is being flushed right now */
+#define XFS_IFLOCK              (1 << __XFS_IFLOCK_BIT)
+#define __XFS_IPINNED_BIT       8        /* wakeup key for zero pin count */
+#define XFS_IPINNED             (1 << __XFS_IPINNED_BIT)
 
 /*
  * Per-lifetime flags need to be reset when re-using a reclaimable inode during
@@ -392,6 +386,34 @@ static inline void xfs_ifunlock(xfs_inode_t *ip)
          XFS_IFILESTREAM);
 
 /*
+ * Synchronize processes attempting to flush the in-core inode back to disk.
+ */
+
+extern void __xfs_iflock(struct xfs_inode *ip);
+
+static inline int xfs_iflock_nowait(struct xfs_inode *ip)
+{
+        return !xfs_iflags_test_and_set(ip, XFS_IFLOCK);
+}
+
+static inline void xfs_iflock(struct xfs_inode *ip)
+{
+        if (!xfs_iflock_nowait(ip))
+                __xfs_iflock(ip);
+}
+
+static inline void xfs_ifunlock(struct xfs_inode *ip)
+{
+        xfs_iflags_clear(ip, XFS_IFLOCK);
+        wake_up_bit(&ip->i_flags, __XFS_IFLOCK_BIT);
+}
+
+static inline int xfs_isiflocked(struct xfs_inode *ip)
+{
+        return xfs_iflags_test(ip, XFS_IFLOCK);
+}
+
+/*
  * Flags for inode locking.
  * Bit ranges:  1<<1  - 1<<16-1 -- iolock/ilock modes (bitfield)
  *              1<<16 - 1<<32-1 -- lockdep annotation (integers)
@@ -491,8 +513,6 @@ int		xfs_ifree(struct xfs_trans *, xfs_inode_t *,
                            struct xfs_bmap_free *);
 int             xfs_itruncate_extents(struct xfs_trans **, struct xfs_inode *,
                                       int, xfs_fsize_t);
-int             xfs_itruncate_data(struct xfs_trans **, struct xfs_inode *,
-                                   xfs_fsize_t);
 int             xfs_iunlink(struct xfs_trans *, xfs_inode_t *);
 
 void            xfs_iext_realloc(xfs_inode_t *, int, int);
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index cfd6c7f8cc3c..91d71dcd4852 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -79,8 +79,6 @@ xfs_inode_item_size(
                 break;
 
         case XFS_DINODE_FMT_BTREE:
-                ASSERT(ip->i_df.if_ext_max ==
-                       XFS_IFORK_DSIZE(ip) / (uint)sizeof(xfs_bmbt_rec_t));
                 iip->ili_format.ilf_fields &=
                         ~(XFS_ILOG_DDATA | XFS_ILOG_DEXT |
                           XFS_ILOG_DEV | XFS_ILOG_UUID);
@@ -557,7 +555,7 @@ xfs_inode_item_unpin(
         trace_xfs_inode_unpin(ip, _RET_IP_);
         ASSERT(atomic_read(&ip->i_pincount) > 0);
         if (atomic_dec_and_test(&ip->i_pincount))
-                wake_up(&ip->i_ipin_wait);
+                wake_up_bit(&ip->i_flags, __XFS_IPINNED_BIT);
 }
 
 /*
@@ -719,7 +717,7 @@ xfs_inode_item_pushbuf(
          * If a flush is not in progress anymore, chances are that the
          * inode was taken off the AIL. So, just get out.
          */
-        if (completion_done(&ip->i_flush) ||
+        if (!xfs_isiflocked(ip) ||
             !(lip->li_flags & XFS_LI_IN_AIL)) {
                 xfs_iunlock(ip, XFS_ILOCK_SHARED);
                 return true;
@@ -752,7 +750,7 @@ xfs_inode_item_push(
         struct xfs_inode        *ip = iip->ili_inode;
 
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_SHARED));
-        ASSERT(!completion_done(&ip->i_flush));
+        ASSERT(xfs_isiflocked(ip));
 
         /*
          * Since we were able to lock the inode's flush lock and
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 9afa282aa937..246c7d57c6f9 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -57,26 +57,26 @@ xfs_iomap_eof_align_last_fsb(
         xfs_fileoff_t   *last_fsb)
 {
         xfs_fileoff_t   new_last_fsb = 0;
-        xfs_extlen_t    align;
+        xfs_extlen_t    align = 0;
         int             eof, error;
 
-        if (XFS_IS_REALTIME_INODE(ip))
-                ;
-        /*
-         * If mounted with the "-o swalloc" option, roundup the allocation
-         * request to a stripe width boundary if the file size is >=
-         * stripe width and we are allocating past the allocation eof.
-         */
-        else if (mp->m_swidth && (mp->m_flags & XFS_MOUNT_SWALLOC) &&
-                (ip->i_size >= XFS_FSB_TO_B(mp, mp->m_swidth)))
-                new_last_fsb = roundup_64(*last_fsb, mp->m_swidth);
-        /*
-         * Roundup the allocation request to a stripe unit (m_dalign) boundary
-         * if the file size is >= stripe unit size, and we are allocating past
-         * the allocation eof.
-         */
-        else if (mp->m_dalign && (ip->i_size >= XFS_FSB_TO_B(mp, mp->m_dalign)))
-                new_last_fsb = roundup_64(*last_fsb, mp->m_dalign);
+        if (!XFS_IS_REALTIME_INODE(ip)) {
+                /*
+                 * Round up the allocation request to a stripe unit
+                 * (m_dalign) boundary if the file size is >= stripe unit
+                 * size, and we are allocating past the allocation eof.
+                 *
+                 * If mounted with the "-o swalloc" option the alignment is
+                 * increased from the strip unit size to the stripe width.
+                 */
+                if (mp->m_swidth && (mp->m_flags & XFS_MOUNT_SWALLOC))
+                        align = mp->m_swidth;
+                else if (mp->m_dalign)
+                        align = mp->m_dalign;
+
+                if (align && XFS_ISIZE(ip) >= XFS_FSB_TO_B(mp, align))
+                        new_last_fsb = roundup_64(*last_fsb, align);
+        }
 
         /*
          * Always round up the allocation request to an extent boundary
@@ -154,7 +154,7 @@ xfs_iomap_write_direct(
 
         offset_fsb = XFS_B_TO_FSBT(mp, offset);
         last_fsb = XFS_B_TO_FSB(mp, ((xfs_ufsize_t)(offset + count)));
-        if ((offset + count) > ip->i_size) {
+        if ((offset + count) > XFS_ISIZE(ip)) {
                 error = xfs_iomap_eof_align_last_fsb(mp, ip, extsz, &last_fsb);
                 if (error)
                         goto error_out;
@@ -211,7 +211,7 @@ xfs_iomap_write_direct(
         xfs_trans_ijoin(tp, ip, 0);
 
         bmapi_flag = 0;
-        if (offset < ip->i_size || extsz)
+        if (offset < XFS_ISIZE(ip) || extsz)
                 bmapi_flag |= XFS_BMAPI_PREALLOC;
 
         /*
@@ -286,7 +286,7 @@ xfs_iomap_eof_want_preallocate(
         int             found_delalloc = 0;
 
         *prealloc = 0;
-        if ((offset + count) <= ip->i_size)
+        if (offset + count <= XFS_ISIZE(ip))
                 return 0;
 
         /*
@@ -340,7 +340,7 @@ xfs_iomap_prealloc_size(
                  * if we pass in alloc_blocks = 0. Hence the "+ 1" to
                  * ensure we always pass in a non-zero value.
                  */
-                alloc_blocks = XFS_B_TO_FSB(mp, ip->i_size) + 1;
+                alloc_blocks = XFS_B_TO_FSB(mp, XFS_ISIZE(ip)) + 1;
                 alloc_blocks = XFS_FILEOFF_MIN(MAXEXTLEN,
                                         rounddown_pow_of_two(alloc_blocks));
 
@@ -564,7 +564,7 @@ xfs_iomap_write_allocate(
                          * back....
                          */
                         nimaps = 1;
-                        end_fsb = XFS_B_TO_FSB(mp, ip->i_size);
+                        end_fsb = XFS_B_TO_FSB(mp, XFS_ISIZE(ip));
                         error = xfs_bmap_last_offset(NULL, ip, &last_block,
                                                         XFS_DATA_FORK);
                         if (error)
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index f9babd179223..ab302539e5b9 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -750,6 +750,7 @@ xfs_setattr_size(
         struct xfs_mount        *mp = ip->i_mount;
         struct inode            *inode = VFS_I(ip);
         int                     mask = iattr->ia_valid;
+        xfs_off_t               oldsize, newsize;
         struct xfs_trans        *tp;
         int                     error;
         uint                    lock_flags;
@@ -777,11 +778,13 @@ xfs_setattr_size(
                 lock_flags |= XFS_IOLOCK_EXCL;
         xfs_ilock(ip, lock_flags);
 
+        oldsize = inode->i_size;
+        newsize = iattr->ia_size;
+
         /*
          * Short circuit the truncate case for zero length files.
          */
-        if (iattr->ia_size == 0 &&
-            ip->i_size == 0 && ip->i_d.di_nextents == 0) {
+        if (newsize == 0 && oldsize == 0 && ip->i_d.di_nextents == 0) {
                 if (!(mask & (ATTR_CTIME|ATTR_MTIME)))
                         goto out_unlock;
 
@@ -807,14 +810,14 @@ xfs_setattr_size(
          * the inode to the transaction, because the inode cannot be unlocked
          * once it is a part of the transaction.
          */
-        if (iattr->ia_size > ip->i_size) {
+        if (newsize > oldsize) {
                 /*
                  * Do the first part of growing a file: zero any data in the
                  * last block that is beyond the old EOF.  We need to do this
                  * before the inode is joined to the transaction to modify
                  * i_size.
                  */
-                error = xfs_zero_eof(ip, iattr->ia_size, ip->i_size);
+                error = xfs_zero_eof(ip, newsize, oldsize);
                 if (error)
                         goto out_unlock;
         }
@@ -833,8 +836,8 @@ xfs_setattr_size(
          * here and prevents waiting for other data not within the range we
          * care about here.
          */
-        if (ip->i_size != ip->i_d.di_size && iattr->ia_size > ip->i_d.di_size) {
-                error = xfs_flush_pages(ip, ip->i_d.di_size, iattr->ia_size, 0,
+        if (oldsize != ip->i_d.di_size && newsize > ip->i_d.di_size) {
+                error = xfs_flush_pages(ip, ip->i_d.di_size, newsize, 0,
                                         FI_NONE);
                 if (error)
                         goto out_unlock;
@@ -845,8 +848,7 @@ xfs_setattr_size(
          */
         inode_dio_wait(inode);
 
-        error = -block_truncate_page(inode->i_mapping, iattr->ia_size,
-                                     xfs_get_blocks);
+        error = -block_truncate_page(inode->i_mapping, newsize, xfs_get_blocks);
         if (error)
                 goto out_unlock;
 
@@ -857,7 +859,7 @@ xfs_setattr_size(
         if (error)
                 goto out_trans_cancel;
 
-        truncate_setsize(inode, iattr->ia_size);
+        truncate_setsize(inode, newsize);
 
         commit_flags = XFS_TRANS_RELEASE_LOG_RES;
         lock_flags |= XFS_ILOCK_EXCL;
@@ -876,19 +878,29 @@ xfs_setattr_size(
          * these flags set.  For all other operations the VFS set these flags
          * explicitly if it wants a timestamp update.
          */
-        if (iattr->ia_size != ip->i_size &&
-            (!(mask & (ATTR_CTIME | ATTR_MTIME)))) {
+        if (newsize != oldsize && (!(mask & (ATTR_CTIME | ATTR_MTIME)))) {
                 iattr->ia_ctime = iattr->ia_mtime =
                         current_fs_time(inode->i_sb);
                 mask |= ATTR_CTIME | ATTR_MTIME;
         }
 
-        if (iattr->ia_size > ip->i_size) {
-                ip->i_d.di_size = iattr->ia_size;
-                ip->i_size = iattr->ia_size;
-        } else if (iattr->ia_size <= ip->i_size ||
-                   (iattr->ia_size == 0 && ip->i_d.di_nextents)) {
-                error = xfs_itruncate_data(&tp, ip, iattr->ia_size);
+        /*
+         * The first thing we do is set the size to new_size permanently on
+         * disk.  This way we don't have to worry about anyone ever being able
+         * to look at the data being freed even in the face of a crash.
+         * What we're getting around here is the case where we free a block, it
+         * is allocated to another file, it is written to, and then we crash.
+         * If the new data gets written to the file but the log buffers
+         * containing the free and reallocation don't, then we'd end up with
+         * garbage in the blocks being freed.  As long as we make the new size
+         * permanent before actually freeing any blocks it doesn't matter if
+         * they get written to.
+         */
+        ip->i_d.di_size = newsize;
+        xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+
+        if (newsize <= oldsize) {
+                error = xfs_itruncate_extents(&tp, ip, XFS_DATA_FORK, newsize);
                 if (error)
                         goto out_trans_abort;
 
diff --git a/fs/xfs/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c
index 5cc3dde1bc90..eafbcff81f3a 100644
--- a/fs/xfs/xfs_qm_syscalls.c
+++ b/fs/xfs/xfs_qm_syscalls.c
@@ -31,6 +31,7 @@
 #include "xfs_mount.h"
 #include "xfs_bmap_btree.h"
 #include "xfs_inode.h"
+#include "xfs_inode_item.h"
 #include "xfs_itable.h"
 #include "xfs_bmap.h"
 #include "xfs_rtalloc.h"
@@ -263,13 +264,18 @@ xfs_qm_scall_trunc_qfile(
         xfs_ilock(ip, XFS_ILOCK_EXCL);
         xfs_trans_ijoin(tp, ip, 0);
 
-        error = xfs_itruncate_data(&tp, ip, 0);
+        ip->i_d.di_size = 0;
+        xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+
+        error = xfs_itruncate_extents(&tp, ip, XFS_DATA_FORK, 0);
         if (error) {
                 xfs_trans_cancel(tp, XFS_TRANS_RELEASE_LOG_RES |
                                      XFS_TRANS_ABORT);
                 goto out_unlock;
         }
 
+        ASSERT(ip->i_d.di_nextents == 0);
+
         xfs_trans_ichgtime(tp, ip, XFS_ICHGTIME_MOD | XFS_ICHGTIME_CHG);
         error = xfs_trans_commit(tp, XFS_TRANS_RELEASE_LOG_RES);
 
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 281961c1d81a..ee5b695c99a7 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -828,14 +828,6 @@ xfs_fs_inode_init_once(
         /* xfs inode */
         atomic_set(&ip->i_pincount, 0);
         spin_lock_init(&ip->i_flags_lock);
-        init_waitqueue_head(&ip->i_ipin_wait);
-        /*
-         * Because we want to use a counting completion, complete
-         * the flush completion once to allow a single access to
-         * the flush completion without blocking.
-         */
-        init_completion(&ip->i_flush);
-        complete(&ip->i_flush);
 
         mrlock_init(&ip->i_lock, MRLOCK_ALLOW_EQUAL_PRI|MRLOCK_BARRIER,
                      "xfsino", ip->i_ino);
diff --git a/fs/xfs/xfs_sync.c b/fs/xfs/xfs_sync.c
index 72c01a1c16e7..40b75eecd2b4 100644
--- a/fs/xfs/xfs_sync.c
+++ b/fs/xfs/xfs_sync.c
@@ -707,14 +707,13 @@ xfs_reclaim_inode_grab(
                 return 1;
 
         /*
-         * do some unlocked checks first to avoid unnecessary lock traffic.
-         * The first is a flush lock check, the second is a already in reclaim
-         * check. Only do these checks if we are not going to block on locks.
+         * If we are asked for non-blocking operation, do unlocked checks to
+         * see if the inode already is being flushed or in reclaim to avoid
+         * lock traffic.
          */
         if ((flags & SYNC_TRYLOCK) &&
-            (!ip->i_flush.done || __xfs_iflags_test(ip, XFS_IRECLAIM))) {
+            __xfs_iflags_test(ip, XFS_IFLOCK | XFS_IRECLAIM))
                 return 1;
-        }
 
         /*
          * The radix tree lock here protects a thread in xfs_iget from racing
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index a9d5b1e06efe..6b6df5802e95 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -891,7 +891,6 @@ DECLARE_EVENT_CLASS(xfs_file_class,
                 __field(dev_t, dev)
                 __field(xfs_ino_t, ino)
                 __field(xfs_fsize_t, size)
-                __field(xfs_fsize_t, new_size)
                 __field(loff_t, offset)
                 __field(size_t, count)
                 __field(int, flags)
@@ -900,17 +899,15 @@ DECLARE_EVENT_CLASS(xfs_file_class,
                 __entry->dev = VFS_I(ip)->i_sb->s_dev;
                 __entry->ino = ip->i_ino;
                 __entry->size = ip->i_d.di_size;
-                __entry->new_size = ip->i_new_size;
                 __entry->offset = offset;
                 __entry->count = count;
                 __entry->flags = flags;
         ),
-        TP_printk("dev %d:%d ino 0x%llx size 0x%llx new_size 0x%llx "
+        TP_printk("dev %d:%d ino 0x%llx size 0x%llx "
                   "offset 0x%llx count 0x%zx ioflags %s",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->size,
-                  __entry->new_size,
                   __entry->offset,
                   __entry->count,
                   __print_flags(__entry->flags, "|", XFS_IO_FLAGS))
@@ -978,7 +975,6 @@ DECLARE_EVENT_CLASS(xfs_imap_class,
                 __field(dev_t, dev)
                 __field(xfs_ino_t, ino)
                 __field(loff_t, size)
-                __field(loff_t, new_size)
                 __field(loff_t, offset)
                 __field(size_t, count)
                 __field(int, type)
@@ -990,7 +986,6 @@ DECLARE_EVENT_CLASS(xfs_imap_class,
                 __entry->dev = VFS_I(ip)->i_sb->s_dev;
                 __entry->ino = ip->i_ino;
                 __entry->size = ip->i_d.di_size;
-                __entry->new_size = ip->i_new_size;
                 __entry->offset = offset;
                 __entry->count = count;
                 __entry->type = type;
@@ -998,13 +993,11 @@ DECLARE_EVENT_CLASS(xfs_imap_class,
                 __entry->startblock = irec ? irec->br_startblock : 0;
                 __entry->blockcount = irec ? irec->br_blockcount : 0;
         ),
-        TP_printk("dev %d:%d ino 0x%llx size 0x%llx new_size 0x%llx "
-                  "offset 0x%llx count %zd type %s "
-                  "startoff 0x%llx startblock %lld blockcount 0x%llx",
+        TP_printk("dev %d:%d ino 0x%llx size 0x%llx offset 0x%llx count %zd "
+                  "type %s startoff 0x%llx startblock %lld blockcount 0x%llx",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->size,
-                  __entry->new_size,
                   __entry->offset,
                   __entry->count,
                   __print_symbolic(__entry->type, XFS_IO_TYPES),
@@ -1031,26 +1024,23 @@ DECLARE_EVENT_CLASS(xfs_simple_io_class,
                 __field(xfs_ino_t, ino)
                 __field(loff_t, isize)
                 __field(loff_t, disize)
-                __field(loff_t, new_size)
                 __field(loff_t, offset)
                 __field(size_t, count)
         ),
         TP_fast_assign(
                 __entry->dev = VFS_I(ip)->i_sb->s_dev;
                 __entry->ino = ip->i_ino;
-                __entry->isize = ip->i_size;
+                __entry->isize = VFS_I(ip)->i_size;
                 __entry->disize = ip->i_d.di_size;
-                __entry->new_size = ip->i_new_size;
                 __entry->offset = offset;
                 __entry->count = count;
         ),
-        TP_printk("dev %d:%d ino 0x%llx isize 0x%llx disize 0x%llx new_size 0x%llx "
+        TP_printk("dev %d:%d ino 0x%llx isize 0x%llx disize 0x%llx "
                   "offset 0x%llx count %zd",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->isize,
                   __entry->disize,
-                  __entry->new_size,
                   __entry->offset,
                   __entry->count)
 );
@@ -1090,8 +1080,8 @@ DECLARE_EVENT_CLASS(xfs_itrunc_class,
 DEFINE_EVENT(xfs_itrunc_class, name, \
         TP_PROTO(struct xfs_inode *ip, xfs_fsize_t new_size), \
         TP_ARGS(ip, new_size))
-DEFINE_ITRUNC_EVENT(xfs_itruncate_data_start);
-DEFINE_ITRUNC_EVENT(xfs_itruncate_data_end);
+DEFINE_ITRUNC_EVENT(xfs_itruncate_extents_start);
+DEFINE_ITRUNC_EVENT(xfs_itruncate_extents_end);
 
 TRACE_EVENT(xfs_pagecache_inval,
         TP_PROTO(struct xfs_inode *ip, xfs_off_t start, xfs_off_t finish),
@@ -1568,7 +1558,6 @@ DECLARE_EVENT_CLASS(xfs_swap_extent_class,
                 __field(xfs_ino_t, ino)
                 __field(int, format)
                 __field(int, nex)
-                __field(int, max_nex)
                 __field(int, broot_size)
                 __field(int, fork_off)
         ),
@@ -1578,18 +1567,16 @@ DECLARE_EVENT_CLASS(xfs_swap_extent_class,
                 __entry->ino = ip->i_ino;
                 __entry->format = ip->i_d.di_format;
                 __entry->nex = ip->i_d.di_nextents;
-                __entry->max_nex = ip->i_df.if_ext_max;
                 __entry->broot_size = ip->i_df.if_broot_bytes;
                 __entry->fork_off = XFS_IFORK_BOFF(ip);
         ),
         TP_printk("dev %d:%d ino 0x%llx (%s), %s format, num_extents %d, "
-                  "Max in-fork extents %d, broot size %d, fork offset %d",
+                  "broot size %d, fork offset %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __print_symbolic(__entry->which, XFS_SWAPEXT_INODES),
                   __print_symbolic(__entry->format, XFS_INODE_FORMAT_STR),
                   __entry->nex,
-                  __entry->max_nex,
                   __entry->broot_size,
                   __entry->fork_off)
 )
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index f2fea868d4db..0cf52da9d246 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -175,7 +175,7 @@ xfs_free_eofblocks(
          * Figure out if there are any blocks beyond the end
          * of the file.  If not, then there is nothing to do.
          */
-        end_fsb = XFS_B_TO_FSB(mp, ((xfs_ufsize_t)ip->i_size));
+        end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)XFS_ISIZE(ip));
         last_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)XFS_MAXIOFFSET(mp));
         if (last_fsb <= end_fsb)
                 return 0;
@@ -226,7 +226,14 @@ xfs_free_eofblocks(
                 xfs_ilock(ip, XFS_ILOCK_EXCL);
                 xfs_trans_ijoin(tp, ip, 0);
 
-                error = xfs_itruncate_data(&tp, ip, ip->i_size);
+                /*
+                 * Do not update the on-disk file size.  If we update the
+                 * on-disk file size and then the system crashes before the
+                 * contents of the file are flushed to disk then the files
+                 * may be full of holes (ie NULL files bug).
+                 */
+                error = xfs_itruncate_extents(&tp, ip, XFS_DATA_FORK,
+                                              XFS_ISIZE(ip));
                 if (error) {
                         /*
                          * If we get an error at this point we simply don't
@@ -540,8 +547,8 @@ xfs_release(
                 return 0;
 
         if ((S_ISREG(ip->i_d.di_mode) &&
-             ((ip->i_size > 0) || (VN_CACHED(VFS_I(ip)) > 0 ||
-               ip->i_delayed_blks > 0)) &&
+             (VFS_I(ip)->i_size > 0 ||
+              (VN_CACHED(VFS_I(ip)) > 0 || ip->i_delayed_blks > 0)) &&
              (ip->i_df.if_flags & XFS_IFEXTENTS))  &&
             (!(ip->i_d.di_flags & (XFS_DIFLAG_PREALLOC | XFS_DIFLAG_APPEND)))) {
 
@@ -618,7 +625,7 @@ xfs_inactive(
          * only one with a reference to the inode.
          */
         truncate = ((ip->i_d.di_nlink == 0) &&
-            ((ip->i_d.di_size != 0) || (ip->i_size != 0) ||
+            ((ip->i_d.di_size != 0) || XFS_ISIZE(ip) != 0 ||
              (ip->i_d.di_nextents > 0) || (ip->i_delayed_blks > 0)) &&
             S_ISREG(ip->i_d.di_mode));
 
@@ -632,12 +639,12 @@ xfs_inactive(
 
         if (ip->i_d.di_nlink != 0) {
                 if ((S_ISREG(ip->i_d.di_mode) &&
-                     ((ip->i_size > 0) || (VN_CACHED(VFS_I(ip)) > 0 ||
-                       ip->i_delayed_blks > 0)) &&
-                      (ip->i_df.if_flags & XFS_IFEXTENTS) &&
-                     (!(ip->i_d.di_flags &
+                    (VFS_I(ip)->i_size > 0 ||
+                     (VN_CACHED(VFS_I(ip)) > 0 || ip->i_delayed_blks > 0)) &&
+                    (ip->i_df.if_flags & XFS_IFEXTENTS) &&
+                    (!(ip->i_d.di_flags &
                                 (XFS_DIFLAG_PREALLOC | XFS_DIFLAG_APPEND)) ||
-                      (ip->i_delayed_blks != 0)))) {
+                     ip->i_delayed_blks != 0))) {
                         error = xfs_free_eofblocks(mp, ip, 0);
                         if (error)
                                 return VN_INACTIVE_CACHE;
@@ -670,13 +677,18 @@ xfs_inactive(
                 xfs_ilock(ip, XFS_ILOCK_EXCL);
                 xfs_trans_ijoin(tp, ip, 0);
 
-                error = xfs_itruncate_data(&tp, ip, 0);
+                ip->i_d.di_size = 0;
+                xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+
+                error = xfs_itruncate_extents(&tp, ip, XFS_DATA_FORK, 0);
                 if (error) {
                         xfs_trans_cancel(tp,
                                 XFS_TRANS_RELEASE_LOG_RES | XFS_TRANS_ABORT);
                         xfs_iunlock(ip, XFS_IOLOCK_EXCL | XFS_ILOCK_EXCL);
                         return VN_INACTIVE_CACHE;
                 }
+
+                ASSERT(ip->i_d.di_nextents == 0);
         } else if (S_ISLNK(ip->i_d.di_mode)) {
 
                 /*
@@ -1961,11 +1973,11 @@ xfs_zero_remaining_bytes(
          * since nothing can read beyond eof.  The space will
          * be zeroed when the file is extended anyway.
          */
-        if (startoff >= ip->i_size)
+        if (startoff >= XFS_ISIZE(ip))
                 return 0;
 
-        if (endoff > ip->i_size)
-                endoff = ip->i_size;
+        if (endoff > XFS_ISIZE(ip))
+                endoff = XFS_ISIZE(ip);
 
         bp = xfs_buf_get_uncached(XFS_IS_REALTIME_INODE(ip) ?
                                         mp->m_rtdev_targp : mp->m_ddev_targp,
@@ -2260,7 +2272,7 @@ xfs_change_file_space(
                 bf->l_start += offset;
                 break;
         case 2: /*SEEK_END*/
-                bf->l_start += ip->i_size;
+                bf->l_start += XFS_ISIZE(ip);
                 break;
         default:
                 return XFS_ERROR(EINVAL);
@@ -2277,7 +2289,7 @@ xfs_change_file_space(
         bf->l_whence = 0;
 
         startoffset = bf->l_start;
-        fsize = ip->i_size;
+        fsize = XFS_ISIZE(ip);
 
         /*
          * XFS_IOC_RESVSP and XFS_IOC_UNRESVSP will reserve or unreserve