]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blobdiff - drivers/block/drbd/drbd_req.c
drbd: allow read requests to be retried after force-detach
[mirror_ubuntu-zesty-kernel.git] / drivers / block / drbd / drbd_req.c
index f708aa1809f0eaf8673bcb07d5fd5cbcf7545e79..c45479aaff8ec255ca7f029cc3b38544dd9df3a2 100644 (file)
@@ -85,18 +85,27 @@ static struct drbd_request *drbd_req_new(struct drbd_conf *mdev,
        INIT_LIST_HEAD(&req->tl_requests);
        INIT_LIST_HEAD(&req->w.list);
 
+       /* one reference to be put by __drbd_make_request */
+       atomic_set(&req->completion_ref, 1);
+       /* one kref as long as completion_ref > 0 */
+       kref_init(&req->kref);
        return req;
 }
 
-static void drbd_req_free(struct drbd_request *req)
+void drbd_req_destroy(struct kref *kref)
 {
-       mempool_free(req, drbd_request_mempool);
-}
-
-/* rw is bio_data_dir(), only READ or WRITE */
-static void _req_is_done(struct drbd_conf *mdev, struct drbd_request *req, const int rw)
-{
-       const unsigned long s = req->rq_state;
+       struct drbd_request *req = container_of(kref, struct drbd_request, kref);
+       struct drbd_conf *mdev = req->w.mdev;
+       const unsigned s = req->rq_state;
+
+       if ((req->master_bio && !(s & RQ_POSTPONED)) ||
+               atomic_read(&req->completion_ref) ||
+               (s & RQ_LOCAL_PENDING) ||
+               ((s & RQ_NET_MASK) && !(s & RQ_NET_DONE))) {
+               dev_err(DEV, "drbd_req_destroy: Logic BUG rq_state = 0x%x, completion_ref = %d\n",
+                               s, atomic_read(&req->completion_ref));
+               return;
+       }
 
        /* remove it from the transfer log.
         * well, only if it had been there in the first
@@ -109,7 +118,7 @@ static void _req_is_done(struct drbd_conf *mdev, struct drbd_request *req, const
        /* if it was a write, we may have to set the corresponding
         * bit(s) out-of-sync first. If it had a local part, we need to
         * release the reference to the activity log. */
-       if (rw == WRITE) {
+       if (s & RQ_WRITE) {
                /* Set out-of-sync unless both OK flags are set
                 * (local only or remote failed).
                 * Other places where we set out-of-sync:
@@ -143,52 +152,19 @@ static void _req_is_done(struct drbd_conf *mdev, struct drbd_request *req, const
                }
        }
 
-       if (s & RQ_POSTPONED)
-               drbd_restart_write(req);
-       else
-               drbd_req_free(req);
+       mempool_free(req, drbd_request_mempool);
 }
 
-static void queue_barrier(struct drbd_conf *mdev)
-{
-       struct drbd_tl_epoch *b;
-       struct drbd_tconn *tconn = mdev->tconn;
-
-       /* We are within the req_lock. Once we queued the barrier for sending,
-        * we set the CREATE_BARRIER bit. It is cleared as soon as a new
-        * barrier/epoch object is added. This is the only place this bit is
-        * set. It indicates that the barrier for this epoch is already queued,
-        * and no new epoch has been created yet. */
-       if (test_bit(CREATE_BARRIER, &tconn->flags))
-               return;
-
-       b = tconn->newest_tle;
-       b->w.cb = w_send_barrier;
-       b->w.mdev = mdev;
-       /* inc_ap_pending done here, so we won't
-        * get imbalanced on connection loss.
-        * dec_ap_pending will be done in got_BarrierAck
-        * or (on connection loss) in tl_clear.  */
-       inc_ap_pending(mdev);
-       drbd_queue_work(&tconn->data.work, &b->w);
-       set_bit(CREATE_BARRIER, &tconn->flags);
+static void wake_all_senders(struct drbd_tconn *tconn) {
+       wake_up(&tconn->sender_work.q_wait);
 }
 
-static void _about_to_complete_local_write(struct drbd_conf *mdev,
-       struct drbd_request *req)
+/* must hold resource->req_lock */
+static void start_new_tl_epoch(struct drbd_tconn *tconn)
 {
-       const unsigned long s = req->rq_state;
-
-       /* Before we can signal completion to the upper layers,
-        * we may need to close the current epoch.
-        * We can skip this, if this request has not even been sent, because we
-        * did not have a fully established connection yet/anymore, during
-        * bitmap exchange, or while we are C_AHEAD due to congestion policy.
-        */
-       if (mdev->state.conn >= C_CONNECTED &&
-           (s & RQ_NET_SENT) != 0 &&
-           req->epoch == mdev->tconn->newest_tle->br_number)
-               queue_barrier(mdev);
+       tconn->current_tle_writes = 0;
+       atomic_inc(&tconn->current_tle_nr);
+       wake_all_senders(tconn);
 }
 
 void complete_master_bio(struct drbd_conf *mdev,
@@ -212,46 +188,6 @@ static void drbd_remove_request_interval(struct rb_root *root,
                wake_up(&mdev->misc_wait);
 }
 
-static void maybe_wakeup_conflicting_requests(struct drbd_request *req)
-{
-       const unsigned long s = req->rq_state;
-       if (s & RQ_LOCAL_PENDING && !(s & RQ_LOCAL_ABORTED))
-               return;
-       if (req->i.waiting)
-               /* Retry all conflicting peer requests.  */
-               wake_up(&req->w.mdev->misc_wait);
-}
-
-static
-void req_may_be_done(struct drbd_request *req)
-{
-       const unsigned long s = req->rq_state;
-       struct drbd_conf *mdev = req->w.mdev;
-       int rw = req->rq_state & RQ_WRITE ? WRITE : READ;
-
-       /* req->master_bio still present means: Not yet completed.
-        *
-        * Unless this is RQ_POSTPONED, which will cause _req_is_done() to
-        * queue it on the retry workqueue instead of destroying it.
-        */
-       if (req->master_bio && !(s & RQ_POSTPONED))
-               return;
-
-       /* Local still pending, even though master_bio is already completed?
-        * may happen for RQ_LOCAL_ABORTED requests. */
-       if (s & RQ_LOCAL_PENDING)
-               return;
-
-       if ((s & RQ_NET_MASK) == 0 || (s & RQ_NET_DONE)) {
-               /* this is disconnected (local only) operation,
-                * or protocol A, B, or C P_BARRIER_ACK,
-                * or killed from the transfer log due to connection loss. */
-               _req_is_done(mdev, req, rw);
-       }
-       /* else: network part and not DONE yet. that is
-        * protocol A, B, or C, barrier ack still pending... */
-}
-
 /* Helper for __req_mod().
  * Set m->bio to the master bio, if it is fit to be completed,
  * or leave it alone (it is initialized to NULL in __req_mod),
@@ -259,11 +195,12 @@ void req_may_be_done(struct drbd_request *req)
  * If m->bio is set, the error status to be returned is placed in m->error.
  */
 static
-void req_may_be_completed(struct drbd_request *req, struct bio_and_error *m)
+void drbd_req_complete(struct drbd_request *req, struct bio_and_error *m)
 {
-       const unsigned long s = req->rq_state;
+       const unsigned s = req->rq_state;
        struct drbd_conf *mdev = req->w.mdev;
-       int rw = req->rq_state & RQ_WRITE ? WRITE : READ;
+       int rw;
+       int error, ok;
 
        /* we must not complete the master bio, while it is
         *      still being processed by _drbd_send_zc_bio (drbd_send_dblock)
@@ -274,81 +211,212 @@ void req_may_be_completed(struct drbd_request *req, struct bio_and_error *m)
         *      the receiver,
         *      the bio_endio completion callbacks.
         */
-       if (s & RQ_LOCAL_PENDING && !(s & RQ_LOCAL_ABORTED))
-               return;
-       if (s & RQ_NET_QUEUED)
+       if ((s & RQ_LOCAL_PENDING && !(s & RQ_LOCAL_ABORTED)) ||
+           (s & RQ_NET_QUEUED) || (s & RQ_NET_PENDING) ||
+           (s & RQ_COMPLETION_SUSP)) {
+               dev_err(DEV, "drbd_req_complete: Logic BUG rq_state = 0x%x\n", s);
                return;
-       if (s & RQ_NET_PENDING)
+       }
+
+       if (!req->master_bio) {
+               dev_err(DEV, "drbd_req_complete: Logic BUG, master_bio == NULL!\n");
                return;
+       }
 
-       if (req->master_bio) {
-               /* this is DATA_RECEIVED (remote read)
-                * or protocol C P_WRITE_ACK
-                * or protocol B P_RECV_ACK
-                * or protocol A "HANDED_OVER_TO_NETWORK" (SendAck)
-                * or canceled or failed,
-                * or killed from the transfer log due to connection loss.
-                */
+       rw = bio_rw(req->master_bio);
+
+       /*
+        * figure out whether to report success or failure.
+        *
+        * report success when at least one of the operations succeeded.
+        * or, to put the other way,
+        * only report failure, when both operations failed.
+        *
+        * what to do about the failures is handled elsewhere.
+        * what we need to do here is just: complete the master_bio.
+        *
+        * local completion error, if any, has been stored as ERR_PTR
+        * in private_bio within drbd_request_endio.
+        */
+       ok = (s & RQ_LOCAL_OK) || (s & RQ_NET_OK);
+       error = PTR_ERR(req->private_bio);
+
+       /* remove the request from the conflict detection
+        * respective block_id verification hash */
+       if (!drbd_interval_empty(&req->i)) {
+               struct rb_root *root;
 
-               /*
-                * figure out whether to report success or failure.
-                *
-                * report success when at least one of the operations succeeded.
-                * or, to put the other way,
-                * only report failure, when both operations failed.
-                *
-                * what to do about the failures is handled elsewhere.
-                * what we need to do here is just: complete the master_bio.
-                *
-                * local completion error, if any, has been stored as ERR_PTR
-                * in private_bio within drbd_request_endio.
-                */
-               int ok = (s & RQ_LOCAL_OK) || (s & RQ_NET_OK);
-               int error = PTR_ERR(req->private_bio);
-
-               /* remove the request from the conflict detection
-                * respective block_id verification hash */
-               if (!drbd_interval_empty(&req->i)) {
-                       struct rb_root *root;
-
-                       if (rw == WRITE)
-                               root = &mdev->write_requests;
-                       else
-                               root = &mdev->read_requests;
-                       drbd_remove_request_interval(root, req);
-               } else if (!(s & RQ_POSTPONED))
-                       D_ASSERT((s & (RQ_NET_MASK & ~RQ_NET_DONE)) == 0);
-
-               /* for writes we need to do some extra housekeeping */
                if (rw == WRITE)
-                       _about_to_complete_local_write(mdev, req);
-
-               /* Update disk stats */
-               _drbd_end_io_acct(mdev, req);
-
-               if (!(s & RQ_POSTPONED)) {
-                       m->error = ok ? 0 : (error ?: -EIO);
-                       m->bio = req->master_bio;
-                       req->master_bio = NULL;
-               } else {
-                       /* Assert that this will be _req_is_done()
-                        * with this very invokation. */
-                       /* FIXME:
-                        * what about (RQ_LOCAL_PENDING | RQ_LOCAL_ABORTED)?
-                        */
-                       D_ASSERT(!(s & RQ_LOCAL_PENDING));
-                       D_ASSERT(s & RQ_NET_DONE);
-               }
+                       root = &mdev->write_requests;
+               else
+                       root = &mdev->read_requests;
+               drbd_remove_request_interval(root, req);
+       } else if (!(s & RQ_POSTPONED))
+               D_ASSERT((s & (RQ_NET_MASK & ~RQ_NET_DONE)) == 0);
+
+       /* Before we can signal completion to the upper layers,
+        * we may need to close the current transfer log epoch.
+        * We are within the request lock, so we can simply compare
+        * the request epoch number with the current transfer log
+        * epoch number.  If they match, increase the current_tle_nr,
+        * and reset the transfer log epoch write_cnt.
+        */
+       if (rw == WRITE &&
+           req->epoch == atomic_read(&mdev->tconn->current_tle_nr))
+               start_new_tl_epoch(mdev->tconn);
+
+       /* Update disk stats */
+       _drbd_end_io_acct(mdev, req);
+
+       /* If READ failed,
+        * have it be pushed back to the retry work queue,
+        * so it will re-enter __drbd_make_request(),
+        * and be re-assigned to a suitable local or remote path,
+        * or failed if we do not have access to good data anymore.
+        *
+        * Unless it was failed early by __drbd_make_request(),
+        * because no path was available, in which case
+        * it was not even added to the transfer_log.
+        *
+        * READA may fail, and will not be retried.
+        *
+        * WRITE should have used all available paths already.
+        */
+       if (!ok && rw == READ && !list_empty(&req->tl_requests))
+               req->rq_state |= RQ_POSTPONED;
+
+       if (!(req->rq_state & RQ_POSTPONED)) {
+               m->error = ok ? 0 : (error ?: -EIO);
+               m->bio = req->master_bio;
+               req->master_bio = NULL;
        }
-       req_may_be_done(req);
 }
 
-static void req_may_be_completed_not_susp(struct drbd_request *req, struct bio_and_error *m)
+static int drbd_req_put_completion_ref(struct drbd_request *req, struct bio_and_error *m, int put)
 {
        struct drbd_conf *mdev = req->w.mdev;
+       D_ASSERT(m || (req->rq_state & RQ_POSTPONED));
+
+       if (!atomic_sub_and_test(put, &req->completion_ref))
+               return 0;
+
+       if (drbd_suspended(mdev)) {
+               /* We do not allow completion while suspended.  Re-get a
+                * reference, so whatever happens when this is resumed
+                * may put and complete. */
+
+               D_ASSERT(!(req->rq_state & RQ_COMPLETION_SUSP));
+               req->rq_state |= RQ_COMPLETION_SUSP;
+               atomic_inc(&req->completion_ref);
+               return 0;
+       }
+
+       /* else */
+       drbd_req_complete(req, m);
+
+       if (req->rq_state & RQ_POSTPONED) {
+               /* don't destroy the req object just yet,
+                * but queue it for retry */
+               drbd_restart_request(req);
+               return 0;
+       }
+
+       return 1;
+}
+
+/* I'd like this to be the only place that manipulates
+ * req->completion_ref and req->kref. */
+static void mod_rq_state(struct drbd_request *req, struct bio_and_error *m,
+               int clear, int set)
+{
+       struct drbd_conf *mdev = req->w.mdev;
+       unsigned s = req->rq_state;
+       int c_put = 0;
+       int k_put = 0;
+
+       /* apply */
+
+       req->rq_state &= ~clear;
+       req->rq_state |= set;
+
+       /* no change? */
+       if (req->rq_state == s)
+               return;
+
+       /* intent: get references */
 
-       if (!drbd_suspended(mdev))
-               req_may_be_completed(req, m);
+       if (!(s & RQ_LOCAL_PENDING) && (set & RQ_LOCAL_PENDING))
+               atomic_inc(&req->completion_ref);
+
+       if (!(s & RQ_NET_PENDING) && (set & RQ_NET_PENDING)) {
+               inc_ap_pending(mdev);
+               atomic_inc(&req->completion_ref);
+       }
+
+       if (!(s & RQ_NET_QUEUED) && (set & RQ_NET_QUEUED))
+               atomic_inc(&req->completion_ref);
+
+       if (!(s & RQ_EXP_BARR_ACK) && (set & RQ_EXP_BARR_ACK))
+               kref_get(&req->kref); /* wait for the DONE */
+
+       if (!(s & RQ_NET_SENT) && (set & RQ_NET_SENT))
+               atomic_add(req->i.size >> 9, &mdev->ap_in_flight);
+
+       /* progress: put references */
+
+       if ((s & RQ_COMPLETION_SUSP) && (clear & RQ_COMPLETION_SUSP))
+               ++c_put;
+
+       if (!(s & RQ_LOCAL_ABORTED) && (set & RQ_LOCAL_ABORTED)) {
+               D_ASSERT(req->rq_state & RQ_LOCAL_PENDING);
+               /* local completion may still come in later,
+                * we need to keep the req object around. */
+               kref_get(&req->kref);
+               ++c_put;
+       }
+
+       if ((s & RQ_LOCAL_PENDING) && (clear & RQ_LOCAL_PENDING)) {
+               if (req->rq_state & RQ_LOCAL_ABORTED)
+                       ++k_put;
+               else
+                       ++c_put;
+       }
+
+       if ((s & RQ_NET_PENDING) && (clear & RQ_NET_PENDING)) {
+               dec_ap_pending(mdev);
+               ++c_put;
+       }
+
+       if ((s & RQ_NET_QUEUED) && (clear & RQ_NET_QUEUED))
+               ++c_put;
+
+       if ((s & RQ_EXP_BARR_ACK) && !(s & RQ_NET_DONE) && (set & RQ_NET_DONE)) {
+               if (req->rq_state & RQ_NET_SENT)
+                       atomic_sub(req->i.size >> 9, &mdev->ap_in_flight);
+               ++k_put;
+       }
+
+       /* potentially complete and destroy */
+
+       if (k_put || c_put) {
+               /* Completion does it's own kref_put.  If we are going to
+                * kref_sub below, we need req to be still around then. */
+               int at_least = k_put + !!c_put;
+               int refcount = atomic_read(&req->kref.refcount);
+               if (refcount < at_least)
+                       dev_err(DEV,
+                               "mod_rq_state: Logic BUG: %x -> %x: refcount = %d, should be >= %d\n",
+                               s, req->rq_state, refcount, at_least);
+       }
+
+       /* If we made progress, retry conflicting peer requests, if any. */
+       if (req->i.waiting)
+               wake_up(&mdev->misc_wait);
+
+       if (c_put)
+               k_put += drbd_req_put_completion_ref(req, m, c_put);
+       if (k_put)
+               kref_sub(&req->kref, k_put, drbd_req_destroy);
 }
 
 /* obviously this could be coded as many single functions
@@ -388,7 +456,6 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                /* reached via __drbd_make_request
                 * and from w_read_retry_remote */
                D_ASSERT(!(req->rq_state & RQ_NET_MASK));
-               req->rq_state |= RQ_NET_PENDING;
                rcu_read_lock();
                nc = rcu_dereference(mdev->tconn->net_conf);
                p = nc->wire_protocol;
@@ -396,13 +463,13 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                req->rq_state |=
                        p == DRBD_PROT_C ? RQ_EXP_WRITE_ACK :
                        p == DRBD_PROT_B ? RQ_EXP_RECEIVE_ACK : 0;
-               inc_ap_pending(mdev);
+               mod_rq_state(req, m, 0, RQ_NET_PENDING);
                break;
 
        case TO_BE_SUBMITTED: /* locally */
                /* reached via __drbd_make_request */
                D_ASSERT(!(req->rq_state & RQ_LOCAL_MASK));
-               req->rq_state |= RQ_LOCAL_PENDING;
+               mod_rq_state(req, m, 0, RQ_LOCAL_PENDING);
                break;
 
        case COMPLETED_OK:
@@ -411,61 +478,25 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                else
                        mdev->read_cnt += req->i.size >> 9;
 
-               req->rq_state |= (RQ_LOCAL_COMPLETED|RQ_LOCAL_OK);
-               req->rq_state &= ~RQ_LOCAL_PENDING;
-
-               maybe_wakeup_conflicting_requests(req);
-               req_may_be_completed_not_susp(req, m);
+               mod_rq_state(req, m, RQ_LOCAL_PENDING,
+                               RQ_LOCAL_COMPLETED|RQ_LOCAL_OK);
                break;
 
        case ABORT_DISK_IO:
-               req->rq_state |= RQ_LOCAL_ABORTED;
-               if (req->rq_state & RQ_WRITE)
-                       req_may_be_completed_not_susp(req, m);
-               else
-                       goto goto_queue_for_net_read;
+               mod_rq_state(req, m, 0, RQ_LOCAL_ABORTED);
                break;
 
+       case READ_COMPLETED_WITH_ERROR:
+               drbd_set_out_of_sync(mdev, req->i.sector, req->i.size);
+               /* fall through. */
        case WRITE_COMPLETED_WITH_ERROR:
-               req->rq_state |= RQ_LOCAL_COMPLETED;
-               req->rq_state &= ~RQ_LOCAL_PENDING;
-
                __drbd_chk_io_error(mdev, false);
-               maybe_wakeup_conflicting_requests(req);
-               req_may_be_completed_not_susp(req, m);
-               break;
-
+               /* fall through. */
        case READ_AHEAD_COMPLETED_WITH_ERROR:
-               /* it is legal to fail READA */
-               req->rq_state |= RQ_LOCAL_COMPLETED;
-               req->rq_state &= ~RQ_LOCAL_PENDING;
-               req_may_be_completed_not_susp(req, m);
+               /* it is legal to fail READA, no __drbd_chk_io_error in that case. */
+               mod_rq_state(req, m, RQ_LOCAL_PENDING, RQ_LOCAL_COMPLETED);
                break;
 
-       case READ_COMPLETED_WITH_ERROR:
-               drbd_set_out_of_sync(mdev, req->i.sector, req->i.size);
-
-               req->rq_state |= RQ_LOCAL_COMPLETED;
-               req->rq_state &= ~RQ_LOCAL_PENDING;
-
-               D_ASSERT(!(req->rq_state & RQ_NET_MASK));
-
-               __drbd_chk_io_error(mdev, false);
-
-       goto_queue_for_net_read:
-
-               /* no point in retrying if there is no good remote data,
-                * or we have no connection. */
-               if (mdev->state.pdsk != D_UP_TO_DATE) {
-                       req_may_be_completed_not_susp(req, m);
-                       break;
-               }
-
-               /* _req_mod(req,TO_BE_SENT); oops, recursion... */
-               req->rq_state |= RQ_NET_PENDING;
-               inc_ap_pending(mdev);
-               /* fall through: _req_mod(req,QUEUE_FOR_NET_READ); */
-
        case QUEUE_FOR_NET_READ:
                /* READ or READA, and
                 * no local disk,
@@ -476,18 +507,17 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
 
                /* So we can verify the handle in the answer packet.
                 * Corresponding drbd_remove_request_interval is in
-                * req_may_be_completed() */
+                * drbd_req_complete() */
                D_ASSERT(drbd_interval_empty(&req->i));
                drbd_insert_interval(&mdev->read_requests, &req->i);
 
                set_bit(UNPLUG_REMOTE, &mdev->flags);
 
                D_ASSERT(req->rq_state & RQ_NET_PENDING);
-               req->rq_state |= RQ_NET_QUEUED;
-               req->w.cb = (req->rq_state & RQ_LOCAL_MASK)
-                       ? w_read_retry_remote
-                       : w_send_read_req;
-               drbd_queue_work(&mdev->tconn->data.work, &req->w);
+               D_ASSERT((req->rq_state & RQ_LOCAL_MASK) == 0);
+               mod_rq_state(req, m, 0, RQ_NET_QUEUED);
+               req->w.cb = w_send_read_req;
+               drbd_queue_work(&mdev->tconn->sender_work, &req->w);
                break;
 
        case QUEUE_FOR_NET_WRITE:
@@ -495,7 +525,7 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                /* from __drbd_make_request only */
 
                /* Corresponding drbd_remove_request_interval is in
-                * req_may_be_completed() */
+                * drbd_req_complete() */
                D_ASSERT(drbd_interval_empty(&req->i));
                drbd_insert_interval(&mdev->write_requests, &req->i);
 
@@ -518,35 +548,26 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                 * hurting performance. */
                set_bit(UNPLUG_REMOTE, &mdev->flags);
 
-               /* see __drbd_make_request,
-                * just after it grabs the req_lock */
-               D_ASSERT(test_bit(CREATE_BARRIER, &mdev->tconn->flags) == 0);
-
-               req->epoch = mdev->tconn->newest_tle->br_number;
-
-               /* increment size of current epoch */
-               mdev->tconn->newest_tle->n_writes++;
-
                /* queue work item to send data */
                D_ASSERT(req->rq_state & RQ_NET_PENDING);
-               req->rq_state |= RQ_NET_QUEUED;
+               mod_rq_state(req, m, 0, RQ_NET_QUEUED|RQ_EXP_BARR_ACK);
                req->w.cb =  w_send_dblock;
-               drbd_queue_work(&mdev->tconn->data.work, &req->w);
+               drbd_queue_work(&mdev->tconn->sender_work, &req->w);
 
                /* close the epoch, in case it outgrew the limit */
                rcu_read_lock();
                nc = rcu_dereference(mdev->tconn->net_conf);
                p = nc->max_epoch_size;
                rcu_read_unlock();
-               if (mdev->tconn->newest_tle->n_writes >= p)
-                       queue_barrier(mdev);
+               if (mdev->tconn->current_tle_writes >= p)
+                       start_new_tl_epoch(mdev->tconn);
 
                break;
 
        case QUEUE_FOR_SEND_OOS:
-               req->rq_state |= RQ_NET_QUEUED;
+               mod_rq_state(req, m, 0, RQ_NET_QUEUED);
                req->w.cb =  w_send_out_of_sync;
-               drbd_queue_work(&mdev->tconn->data.work, &req->w);
+               drbd_queue_work(&mdev->tconn->sender_work, &req->w);
                break;
 
        case READ_RETRY_REMOTE_CANCELED:
@@ -554,75 +575,54 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
        case SEND_FAILED:
                /* real cleanup will be done from tl_clear.  just update flags
                 * so it is no longer marked as on the worker queue */
-               req->rq_state &= ~RQ_NET_QUEUED;
-               /* if we did it right, tl_clear should be scheduled only after
-                * this, so this should not be necessary! */
-               req_may_be_completed_not_susp(req, m);
+               mod_rq_state(req, m, RQ_NET_QUEUED, 0);
                break;
 
        case HANDED_OVER_TO_NETWORK:
                /* assert something? */
-               if (bio_data_dir(req->master_bio) == WRITE)
-                       atomic_add(req->i.size >> 9, &mdev->ap_in_flight);
-
                if (bio_data_dir(req->master_bio) == WRITE &&
                    !(req->rq_state & (RQ_EXP_RECEIVE_ACK | RQ_EXP_WRITE_ACK))) {
                        /* this is what is dangerous about protocol A:
                         * pretend it was successfully written on the peer. */
-                       if (req->rq_state & RQ_NET_PENDING) {
-                               dec_ap_pending(mdev);
-                               req->rq_state &= ~RQ_NET_PENDING;
-                               req->rq_state |= RQ_NET_OK;
-                       } /* else: neg-ack was faster... */
+                       if (req->rq_state & RQ_NET_PENDING)
+                               mod_rq_state(req, m, RQ_NET_PENDING, RQ_NET_OK);
+                       /* else: neg-ack was faster... */
                        /* it is still not yet RQ_NET_DONE until the
                         * corresponding epoch barrier got acked as well,
                         * so we know what to dirty on connection loss */
                }
-               req->rq_state &= ~RQ_NET_QUEUED;
-               req->rq_state |= RQ_NET_SENT;
-               req_may_be_completed_not_susp(req, m);
+               mod_rq_state(req, m, RQ_NET_QUEUED, RQ_NET_SENT);
                break;
 
        case OOS_HANDED_TO_NETWORK:
                /* Was not set PENDING, no longer QUEUED, so is now DONE
                 * as far as this connection is concerned. */
-               req->rq_state &= ~RQ_NET_QUEUED;
-               req->rq_state |= RQ_NET_DONE;
-               req_may_be_completed_not_susp(req, m);
+               mod_rq_state(req, m, RQ_NET_QUEUED, RQ_NET_DONE);
                break;
 
        case CONNECTION_LOST_WHILE_PENDING:
                /* transfer log cleanup after connection loss */
-               /* assert something? */
-               if (req->rq_state & RQ_NET_PENDING)
-                       dec_ap_pending(mdev);
-
-               p = !(req->rq_state & RQ_WRITE) && req->rq_state & RQ_NET_PENDING;
-
-               req->rq_state &= ~(RQ_NET_OK|RQ_NET_PENDING);
-               req->rq_state |= RQ_NET_DONE;
-               if (req->rq_state & RQ_NET_SENT && req->rq_state & RQ_WRITE)
-                       atomic_sub(req->i.size >> 9, &mdev->ap_in_flight);
-
-               /* if it is still queued, we may not complete it here.
-                * it will be canceled soon. */
-               if (!(req->rq_state & RQ_NET_QUEUED)) {
-                       if (p)
-                               goto goto_read_retry_local;
-                       req_may_be_completed(req, m); /* Allowed while state.susp */
-               }
+               mod_rq_state(req, m,
+                               RQ_NET_OK|RQ_NET_PENDING|RQ_COMPLETION_SUSP,
+                               RQ_NET_DONE);
                break;
 
        case DISCARD_WRITE:
                /* for discarded conflicting writes of multiple primaries,
                 * there is no need to keep anything in the tl, potential
-                * node crashes are covered by the activity log. */
-               req->rq_state |= RQ_NET_DONE;
-               /* fall through */
+                * node crashes are covered by the activity log.
+                *
+                * If this request had been marked as RQ_POSTPONED before,
+                * it will actually not be discarded, but "restarted",
+                * resubmitted from the retry worker context. */
+               D_ASSERT(req->rq_state & RQ_NET_PENDING);
+               D_ASSERT(req->rq_state & RQ_EXP_WRITE_ACK);
+               mod_rq_state(req, m, RQ_NET_PENDING, RQ_NET_DONE|RQ_NET_OK);
+               break;
+
        case WRITE_ACKED_BY_PEER_AND_SIS:
+               req->rq_state |= RQ_NET_SIS;
        case WRITE_ACKED_BY_PEER:
-               if (what == WRITE_ACKED_BY_PEER_AND_SIS)
-                       req->rq_state |= RQ_NET_SIS;
                D_ASSERT(req->rq_state & RQ_EXP_WRITE_ACK);
                /* protocol C; successfully written on peer.
                 * Nothing more to do here.
@@ -636,13 +636,8 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                 * see also notes above in HANDED_OVER_TO_NETWORK about
                 * protocol != C */
        ack_common:
-               req->rq_state |= RQ_NET_OK;
                D_ASSERT(req->rq_state & RQ_NET_PENDING);
-               dec_ap_pending(mdev);
-               atomic_sub(req->i.size >> 9, &mdev->ap_in_flight);
-               req->rq_state &= ~RQ_NET_PENDING;
-               maybe_wakeup_conflicting_requests(req);
-               req_may_be_completed_not_susp(req, m);
+               mod_rq_state(req, m, RQ_NET_PENDING, RQ_NET_OK);
                break;
 
        case POSTPONE_WRITE:
@@ -653,79 +648,61 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                 */
                D_ASSERT(req->rq_state & RQ_NET_PENDING);
                req->rq_state |= RQ_POSTPONED;
-               maybe_wakeup_conflicting_requests(req);
-               req_may_be_completed_not_susp(req, m);
+               if (req->i.waiting)
+                       wake_up(&mdev->misc_wait);
+               /* Do not clear RQ_NET_PENDING. This request will make further
+                * progress via restart_conflicting_writes() or
+                * fail_postponed_requests(). Hopefully. */
                break;
 
        case NEG_ACKED:
-               /* assert something? */
-               if (req->rq_state & RQ_NET_PENDING) {
-                       dec_ap_pending(mdev);
-                       if (req->rq_state & RQ_WRITE)
-                               atomic_sub(req->i.size >> 9, &mdev->ap_in_flight);
-               }
-               req->rq_state &= ~(RQ_NET_OK|RQ_NET_PENDING);
-
-               req->rq_state |= RQ_NET_DONE;
-
-               if (!(req->rq_state & RQ_WRITE))
-                       goto goto_read_retry_local;
-
-               maybe_wakeup_conflicting_requests(req);
-               req_may_be_completed_not_susp(req, m);
-               /* else: done by HANDED_OVER_TO_NETWORK */
-               break;
-
-       goto_read_retry_local:
-               if (!drbd_may_do_local_read(mdev, req->i.sector, req->i.size)) {
-                       req_may_be_completed_not_susp(req, m);
-                       break;
-               }
-               D_ASSERT(!(req->rq_state & RQ_LOCAL_PENDING));
-               req->rq_state |= RQ_LOCAL_PENDING;
-
-               get_ldev(mdev);
-               req->w.cb = w_restart_disk_io;
-               drbd_queue_work(&mdev->tconn->data.work, &req->w);
+               mod_rq_state(req, m, RQ_NET_OK|RQ_NET_PENDING, RQ_NET_DONE);
                break;
 
        case FAIL_FROZEN_DISK_IO:
                if (!(req->rq_state & RQ_LOCAL_COMPLETED))
                        break;
-
-               req_may_be_completed(req, m); /* Allowed while state.susp */
+               mod_rq_state(req, m, RQ_COMPLETION_SUSP, 0);
                break;
 
        case RESTART_FROZEN_DISK_IO:
                if (!(req->rq_state & RQ_LOCAL_COMPLETED))
                        break;
 
-               req->rq_state &= ~RQ_LOCAL_COMPLETED;
+               mod_rq_state(req, m,
+                               RQ_COMPLETION_SUSP|RQ_LOCAL_COMPLETED,
+                               RQ_LOCAL_PENDING);
 
                rv = MR_READ;
                if (bio_data_dir(req->master_bio) == WRITE)
                        rv = MR_WRITE;
 
-               get_ldev(mdev);
+               get_ldev(mdev); /* always succeeds in this call path */
                req->w.cb = w_restart_disk_io;
-               drbd_queue_work(&mdev->tconn->data.work, &req->w);
+               drbd_queue_work(&mdev->tconn->sender_work, &req->w);
                break;
 
        case RESEND:
                /* If RQ_NET_OK is already set, we got a P_WRITE_ACK or P_RECV_ACK
-                  before the connection loss (B&C only); only P_BARRIER_ACK was missing.
+                  before the connection loss (B&C only); only P_BARRIER_ACK
+                  (or the local completion?) was missing when we suspended.
                   Throwing them out of the TL here by pretending we got a BARRIER_ACK.
                   During connection handshake, we ensure that the peer was not rebooted. */
                if (!(req->rq_state & RQ_NET_OK)) {
+                       /* FIXME could this possibly be a req->w.cb == w_send_out_of_sync?
+                        * in that case we must not set RQ_NET_PENDING. */
+
+                       mod_rq_state(req, m, RQ_COMPLETION_SUSP, RQ_NET_QUEUED|RQ_NET_PENDING);
                        if (req->w.cb) {
-                               drbd_queue_work(&mdev->tconn->data.work, &req->w);
+                               drbd_queue_work(&mdev->tconn->sender_work, &req->w);
                                rv = req->rq_state & RQ_WRITE ? MR_WRITE : MR_READ;
-                       }
+                       } /* else: FIXME can this happen? */
                        break;
                }
                /* else, fall through to BARRIER_ACKED */
 
        case BARRIER_ACKED:
+               /* barrier ack for READ requests does not make sense */
                if (!(req->rq_state & RQ_WRITE))
                        break;
 
@@ -734,22 +711,18 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                         * this is bad, because if the connection is lost now,
                         * we won't be able to clean them up... */
                        dev_err(DEV, "FIXME (BARRIER_ACKED but pending)\n");
-                       list_move(&req->tl_requests, &mdev->tconn->out_of_sequence_requests);
-               }
-               if ((req->rq_state & RQ_NET_MASK) != 0) {
-                       req->rq_state |= RQ_NET_DONE;
-                       if (!(req->rq_state & (RQ_EXP_RECEIVE_ACK | RQ_EXP_WRITE_ACK)))
-                               atomic_sub(req->i.size>>9, &mdev->ap_in_flight);
                }
-               req_may_be_done(req); /* Allowed while state.susp */
+               /* Allowed to complete requests, even while suspended.
+                * As this is called for all requests within a matching epoch,
+                * we need to filter, and only set RQ_NET_DONE for those that
+                * have actually been on the wire. */
+               mod_rq_state(req, m, RQ_COMPLETION_SUSP,
+                               (req->rq_state & RQ_NET_MASK) ? RQ_NET_DONE : 0);
                break;
 
        case DATA_RECEIVED:
                D_ASSERT(req->rq_state & RQ_NET_PENDING);
-               dec_ap_pending(mdev);
-               req->rq_state &= ~RQ_NET_PENDING;
-               req->rq_state |= (RQ_NET_OK|RQ_NET_DONE);
-               req_may_be_completed_not_susp(req, m);
+               mod_rq_state(req, m, RQ_NET_PENDING, RQ_NET_OK|RQ_NET_DONE);
                break;
        };
 
@@ -783,19 +756,12 @@ static bool drbd_may_do_local_read(struct drbd_conf *mdev, sector_t sector, int
        return drbd_bm_count_bits(mdev, sbnr, ebnr) == 0;
 }
 
-static bool remote_due_to_read_balancing(struct drbd_conf *mdev, sector_t sector)
+static bool remote_due_to_read_balancing(struct drbd_conf *mdev, sector_t sector,
+               enum drbd_read_balancing rbm)
 {
-       enum drbd_read_balancing rbm;
        struct backing_dev_info *bdi;
        int stripe_shift;
 
-       if (mdev->state.pdsk < D_UP_TO_DATE)
-               return false;
-
-       rcu_read_lock();
-       rbm = rcu_dereference(mdev->ldev->disk_conf)->read_balancing;
-       rcu_read_unlock();
-
        switch (rbm) {
        case RB_CONGESTED_REMOTE:
                bdi = &mdev->ldev->backing_bdev->bd_disk->queue->backing_dev_info;
@@ -827,35 +793,189 @@ static bool remote_due_to_read_balancing(struct drbd_conf *mdev, sector_t sector
  * The write_requests tree contains all active write requests which we
  * currently know about.  Wait for any requests to complete which conflict with
  * the new one.
+ *
+ * Only way out: remove the conflicting intervals from the tree.
  */
-static int complete_conflicting_writes(struct drbd_conf *mdev,
-                                      sector_t sector, int size)
+static void complete_conflicting_writes(struct drbd_request *req)
 {
-       for(;;) {
-               struct drbd_interval *i;
-               int err;
+       DEFINE_WAIT(wait);
+       struct drbd_conf *mdev = req->w.mdev;
+       struct drbd_interval *i;
+       sector_t sector = req->i.sector;
+       int size = req->i.size;
+
+       i = drbd_find_overlap(&mdev->write_requests, sector, size);
+       if (!i)
+               return;
 
+       for (;;) {
+               prepare_to_wait(&mdev->misc_wait, &wait, TASK_UNINTERRUPTIBLE);
                i = drbd_find_overlap(&mdev->write_requests, sector, size);
                if (!i)
-                       return 0;
-               err = drbd_wait_misc(mdev, i);
-               if (err)
-                       return err;
+                       break;
+               /* Indicate to wake up device->misc_wait on progress.  */
+               i->waiting = true;
+               spin_unlock_irq(&mdev->tconn->req_lock);
+               schedule();
+               spin_lock_irq(&mdev->tconn->req_lock);
+       }
+       finish_wait(&mdev->misc_wait, &wait);
+}
+
+/* called within req_lock and rcu_read_lock() */
+static bool conn_check_congested(struct drbd_conf *mdev)
+{
+       struct drbd_tconn *tconn = mdev->tconn;
+       struct net_conf *nc;
+       bool congested = false;
+       enum drbd_on_congestion on_congestion;
+
+       nc = rcu_dereference(tconn->net_conf);
+       on_congestion = nc ? nc->on_congestion : OC_BLOCK;
+       if (on_congestion == OC_BLOCK ||
+           tconn->agreed_pro_version < 96)
+               return false;
+
+       if (nc->cong_fill &&
+           atomic_read(&mdev->ap_in_flight) >= nc->cong_fill) {
+               dev_info(DEV, "Congestion-fill threshold reached\n");
+               congested = true;
+       }
+
+       if (mdev->act_log->used >= nc->cong_extents) {
+               dev_info(DEV, "Congestion-extents threshold reached\n");
+               congested = true;
+       }
+
+       if (congested) {
+               if (mdev->tconn->current_tle_writes)
+                       /* start a new epoch for non-mirrored writes */
+                       start_new_tl_epoch(mdev->tconn);
+
+               if (on_congestion == OC_PULL_AHEAD)
+                       _drbd_set_state(_NS(mdev, conn, C_AHEAD), 0, NULL);
+               else  /*nc->on_congestion == OC_DISCONNECT */
+                       _drbd_set_state(_NS(mdev, conn, C_DISCONNECTING), 0, NULL);
+       }
+
+       return congested;
+}
+
+/* If this returns false, and req->private_bio is still set,
+ * this should be submitted locally.
+ *
+ * If it returns false, but req->private_bio is not set,
+ * we do not have access to good data :(
+ *
+ * Otherwise, this destroys req->private_bio, if any,
+ * and returns true.
+ */
+static bool do_remote_read(struct drbd_request *req)
+{
+       struct drbd_conf *mdev = req->w.mdev;
+       enum drbd_read_balancing rbm;
+
+       if (req->private_bio) {
+               if (!drbd_may_do_local_read(mdev,
+                                       req->i.sector, req->i.size)) {
+                       bio_put(req->private_bio);
+                       req->private_bio = NULL;
+                       put_ldev(mdev);
+               }
+       }
+
+       if (mdev->state.pdsk != D_UP_TO_DATE)
+               return false;
+
+       if (req->private_bio == NULL)
+               return true;
+
+       /* TODO: improve read balancing decisions, take into account drbd
+        * protocol, pending requests etc. */
+
+       rcu_read_lock();
+       rbm = rcu_dereference(mdev->ldev->disk_conf)->read_balancing;
+       rcu_read_unlock();
+
+       if (rbm == RB_PREFER_LOCAL && req->private_bio)
+               return false; /* submit locally */
+
+       if (remote_due_to_read_balancing(mdev, req->i.sector, rbm)) {
+               if (req->private_bio) {
+                       bio_put(req->private_bio);
+                       req->private_bio = NULL;
+                       put_ldev(mdev);
+               }
+               return true;
        }
+
+       return false;
 }
 
-int __drbd_make_request(struct drbd_conf *mdev, struct bio *bio, unsigned long start_time)
+/* returns number of connections (== 1, for drbd 8.4)
+ * expected to actually write this data,
+ * which does NOT include those that we are L_AHEAD for. */
+static int drbd_process_write_request(struct drbd_request *req)
 {
+       struct drbd_conf *mdev = req->w.mdev;
+       int remote, send_oos;
+
+       rcu_read_lock();
+       remote = drbd_should_do_remote(mdev->state);
+       if (remote) {
+               conn_check_congested(mdev);
+               remote = drbd_should_do_remote(mdev->state);
+       }
+       send_oos = drbd_should_send_out_of_sync(mdev->state);
+       rcu_read_unlock();
+
+       if (!remote && !send_oos)
+               return 0;
+
+       D_ASSERT(!(remote && send_oos));
+
+       if (remote) {
+               _req_mod(req, TO_BE_SENT);
+               _req_mod(req, QUEUE_FOR_NET_WRITE);
+       } else if (drbd_set_out_of_sync(mdev, req->i.sector, req->i.size))
+               _req_mod(req, QUEUE_FOR_SEND_OOS);
+
+       return remote;
+}
+
+static void
+drbd_submit_req_private_bio(struct drbd_request *req)
+{
+       struct drbd_conf *mdev = req->w.mdev;
+       struct bio *bio = req->private_bio;
        const int rw = bio_rw(bio);
-       const int size = bio->bi_size;
-       const sector_t sector = bio->bi_sector;
-       struct drbd_tl_epoch *b = NULL;
+
+       bio->bi_bdev = mdev->ldev->backing_bdev;
+
+       /* State may have changed since we grabbed our reference on the
+        * ->ldev member. Double check, and short-circuit to endio.
+        * In case the last activity log transaction failed to get on
+        * stable storage, and this is a WRITE, we may not even submit
+        * this bio. */
+       if (get_ldev(mdev)) {
+               if (drbd_insert_fault(mdev,
+                                     rw == WRITE ? DRBD_FAULT_DT_WR
+                                   : rw == READ  ? DRBD_FAULT_DT_RD
+                                   :               DRBD_FAULT_DT_RA))
+                       bio_endio(bio, -EIO);
+               else
+                       generic_make_request(bio);
+               put_ldev(mdev);
+       } else
+               bio_endio(bio, -EIO);
+}
+
+void __drbd_make_request(struct drbd_conf *mdev, struct bio *bio, unsigned long start_time)
+{
+       const int rw = bio_rw(bio);
+       struct bio_and_error m = { NULL, };
        struct drbd_request *req;
-       struct net_conf *nc;
-       int local, remote, send_oos = 0;
-       int err;
-       int ret = 0;
-       union drbd_dev_state s;
+       bool no_remote = false;
 
        /* allocate outside of all locks; */
        req = drbd_req_new(mdev, bio);
@@ -865,272 +985,100 @@ int __drbd_make_request(struct drbd_conf *mdev, struct bio *bio, unsigned long s
                 * if user cannot handle io errors, that's not our business. */
                dev_err(DEV, "could not kmalloc() req\n");
                bio_endio(bio, -ENOMEM);
-               return 0;
+               return;
        }
        req->start_time = start_time;
 
-       local = get_ldev(mdev);
-       if (!local) {
-               bio_put(req->private_bio); /* or we get a bio leak */
+       if (!get_ldev(mdev)) {
+               bio_put(req->private_bio);
                req->private_bio = NULL;
        }
-       if (rw == WRITE) {
-               remote = 1;
-       } else {
-               /* READ || READA */
-               if (local) {
-                       if (!drbd_may_do_local_read(mdev, sector, size) ||
-                           remote_due_to_read_balancing(mdev, sector)) {
-                               /* we could kick the syncer to
-                                * sync this extent asap, wait for
-                                * it, then continue locally.
-                                * Or just issue the request remotely.
-                                */
-                               local = 0;
-                               bio_put(req->private_bio);
-                               req->private_bio = NULL;
-                               put_ldev(mdev);
-                       }
-               }
-               remote = !local && mdev->state.pdsk >= D_UP_TO_DATE;
-       }
-
-       /* If we have a disk, but a READA request is mapped to remote,
-        * we are R_PRIMARY, D_INCONSISTENT, SyncTarget.
-        * Just fail that READA request right here.
-        *
-        * THINK: maybe fail all READA when not local?
-        *        or make this configurable...
-        *        if network is slow, READA won't do any good.
-        */
-       if (rw == READA && mdev->state.disk >= D_INCONSISTENT && !local) {
-               err = -EWOULDBLOCK;
-               goto fail_and_free_req;
-       }
 
        /* For WRITES going to the local disk, grab a reference on the target
         * extent.  This waits for any resync activity in the corresponding
         * resync extent to finish, and, if necessary, pulls in the target
         * extent into the activity log, which involves further disk io because
         * of transactional on-disk meta data updates. */
-       if (rw == WRITE && local && !test_bit(AL_SUSPENDED, &mdev->flags)) {
+       if (rw == WRITE && req->private_bio
+       && !test_bit(AL_SUSPENDED, &mdev->flags)) {
                req->rq_state |= RQ_IN_ACT_LOG;
                drbd_al_begin_io(mdev, &req->i);
        }
 
-       s = mdev->state;
-       remote = remote && drbd_should_do_remote(s);
-       send_oos = rw == WRITE && drbd_should_send_out_of_sync(s);
-       D_ASSERT(!(remote && send_oos));
-
-       if (!(local || remote) && !drbd_suspended(mdev)) {
-               if (__ratelimit(&drbd_ratelimit_state))
-                       dev_err(DEV, "IO ERROR: neither local nor remote disk\n");
-               err = -EIO;
-               goto fail_free_complete;
-       }
-
-       /* For WRITE request, we have to make sure that we have an
-        * unused_spare_tle, in case we need to start a new epoch.
-        * I try to be smart and avoid to pre-allocate always "just in case",
-        * but there is a race between testing the bit and pointer outside the
-        * spinlock, and grabbing the spinlock.
-        * if we lost that race, we retry.  */
-       if (rw == WRITE && (remote || send_oos) &&
-           mdev->tconn->unused_spare_tle == NULL &&
-           test_bit(CREATE_BARRIER, &mdev->tconn->flags)) {
-allocate_barrier:
-               b = kmalloc(sizeof(struct drbd_tl_epoch), GFP_NOIO);
-               if (!b) {
-                       dev_err(DEV, "Failed to alloc barrier.\n");
-                       err = -ENOMEM;
-                       goto fail_free_complete;
-               }
-       }
-
-       /* GOOD, everything prepared, grab the spin_lock */
        spin_lock_irq(&mdev->tconn->req_lock);
-
        if (rw == WRITE) {
-               err = complete_conflicting_writes(mdev, sector, size);
-               if (err) {
-                       if (err != -ERESTARTSYS)
-                               _conn_request_state(mdev->tconn,
-                                                   NS(conn, C_TIMEOUT),
-                                                   CS_HARD);
-                       spin_unlock_irq(&mdev->tconn->req_lock);
-                       err = -EIO;
-                       goto fail_free_complete;
-               }
-       }
-
-       if (drbd_suspended(mdev)) {
-               /* If we got suspended, use the retry mechanism in
-                  drbd_make_request() to restart processing of this
-                  bio. In the next call to drbd_make_request
-                  we sleep in inc_ap_bio() */
-               ret = 1;
-               spin_unlock_irq(&mdev->tconn->req_lock);
-               goto fail_free_complete;
+               /* This may temporarily give up the req_lock,
+                * but will re-aquire it before it returns here.
+                * Needs to be before the check on drbd_suspended() */
+               complete_conflicting_writes(req);
        }
 
-       if (remote || send_oos) {
-               remote = drbd_should_do_remote(mdev->state);
-               send_oos = rw == WRITE && drbd_should_send_out_of_sync(mdev->state);
-               D_ASSERT(!(remote && send_oos));
+       /* no more giving up req_lock from now on! */
 
-               if (!(remote || send_oos))
-                       dev_warn(DEV, "lost connection while grabbing the req_lock!\n");
-               if (!(local || remote)) {
-                       dev_err(DEV, "IO ERROR: neither local nor remote disk\n");
-                       spin_unlock_irq(&mdev->tconn->req_lock);
-                       err = -EIO;
-                       goto fail_free_complete;
+       if (drbd_suspended(mdev)) {
+               /* push back and retry: */
+               req->rq_state |= RQ_POSTPONED;
+               if (req->private_bio) {
+                       bio_put(req->private_bio);
+                       req->private_bio = NULL;
                }
+               goto out;
        }
 
-       if (b && mdev->tconn->unused_spare_tle == NULL) {
-               mdev->tconn->unused_spare_tle = b;
-               b = NULL;
-       }
-       if (rw == WRITE && (remote || send_oos) &&
-           mdev->tconn->unused_spare_tle == NULL &&
-           test_bit(CREATE_BARRIER, &mdev->tconn->flags)) {
-               /* someone closed the current epoch
-                * while we were grabbing the spinlock */
-               spin_unlock_irq(&mdev->tconn->req_lock);
-               goto allocate_barrier;
-       }
-
-
        /* Update disk stats */
        _drbd_start_io_acct(mdev, req, bio);
 
-       /* _maybe_start_new_epoch(mdev);
-        * If we need to generate a write barrier packet, we have to add the
-        * new epoch (barrier) object, and queue the barrier packet for sending,
-        * and queue the req's data after it _within the same lock_, otherwise
-        * we have race conditions were the reorder domains could be mixed up.
-        *
-        * Even read requests may start a new epoch and queue the corresponding
-        * barrier packet.  To get the write ordering right, we only have to
-        * make sure that, if this is a write request and it triggered a
-        * barrier packet, this request is queued within the same spinlock. */
-       if ((remote || send_oos) && mdev->tconn->unused_spare_tle &&
-           test_and_clear_bit(CREATE_BARRIER, &mdev->tconn->flags)) {
-               _tl_add_barrier(mdev->tconn, mdev->tconn->unused_spare_tle);
-               mdev->tconn->unused_spare_tle = NULL;
-       } else {
-               D_ASSERT(!(remote && rw == WRITE &&
-                          test_bit(CREATE_BARRIER, &mdev->tconn->flags)));
+       /* We fail READ/READA early, if we can not serve it.
+        * We must do this before req is registered on any lists.
+        * Otherwise, drbd_req_complete() will queue failed READ for retry. */
+       if (rw != WRITE) {
+               if (!do_remote_read(req) && !req->private_bio)
+                       goto nodata;
        }
 
-       /* NOTE
-        * Actually, 'local' may be wrong here already, since we may have failed
-        * to write to the meta data, and may become wrong anytime because of
-        * local io-error for some other request, which would lead to us
-        * "detaching" the local disk.
-        *
-        * 'remote' may become wrong any time because the network could fail.
-        *
-        * This is a harmless race condition, though, since it is handled
-        * correctly at the appropriate places; so it just defers the failure
-        * of the respective operation.
-        */
+       /* which transfer log epoch does this belong to? */
+       req->epoch = atomic_read(&mdev->tconn->current_tle_nr);
+       if (rw == WRITE)
+               mdev->tconn->current_tle_writes++;
 
-       /* mark them early for readability.
-        * this just sets some state flags. */
-       if (remote)
-               _req_mod(req, TO_BE_SENT);
-       if (local)
-               _req_mod(req, TO_BE_SUBMITTED);
+       list_add_tail(&req->tl_requests, &mdev->tconn->transfer_log);
 
-       list_add_tail(&req->tl_requests, &mdev->tconn->newest_tle->requests);
-
-       /* NOTE remote first: to get the concurrent write detection right,
-        * we must register the request before start of local IO.  */
-       if (remote) {
-               /* either WRITE and C_CONNECTED,
-                * or READ, and no local disk,
-                * or READ, but not in sync.
-                */
-               _req_mod(req, (rw == WRITE)
-                               ? QUEUE_FOR_NET_WRITE
-                               : QUEUE_FOR_NET_READ);
-       }
-       if (send_oos && drbd_set_out_of_sync(mdev, sector, size))
-               _req_mod(req, QUEUE_FOR_SEND_OOS);
-
-       rcu_read_lock();
-       nc = rcu_dereference(mdev->tconn->net_conf);
-       if (remote &&
-           nc->on_congestion != OC_BLOCK && mdev->tconn->agreed_pro_version >= 96) {
-               int congested = 0;
-
-               if (nc->cong_fill &&
-                   atomic_read(&mdev->ap_in_flight) >= nc->cong_fill) {
-                       dev_info(DEV, "Congestion-fill threshold reached\n");
-                       congested = 1;
-               }
-
-               if (mdev->act_log->used >= nc->cong_extents) {
-                       dev_info(DEV, "Congestion-extents threshold reached\n");
-                       congested = 1;
-               }
-
-               if (congested) {
-                       queue_barrier(mdev); /* last barrier, after mirrored writes */
-
-                       if (nc->on_congestion == OC_PULL_AHEAD)
-                               _drbd_set_state(_NS(mdev, conn, C_AHEAD), 0, NULL);
-                       else  /*nc->on_congestion == OC_DISCONNECT */
-                               _drbd_set_state(_NS(mdev, conn, C_DISCONNECTING), 0, NULL);
-               }
-       }
-       rcu_read_unlock();
-
-       spin_unlock_irq(&mdev->tconn->req_lock);
-       kfree(b); /* if someone else has beaten us to it... */
-
-       if (local) {
-               req->private_bio->bi_bdev = mdev->ldev->backing_bdev;
-
-               /* State may have changed since we grabbed our reference on the
-                * mdev->ldev member. Double check, and short-circuit to endio.
-                * In case the last activity log transaction failed to get on
-                * stable storage, and this is a WRITE, we may not even submit
-                * this bio. */
-               if (get_ldev(mdev)) {
-                       if (drbd_insert_fault(mdev,   rw == WRITE ? DRBD_FAULT_DT_WR
-                                                   : rw == READ  ? DRBD_FAULT_DT_RD
-                                                   :               DRBD_FAULT_DT_RA))
-                               bio_endio(req->private_bio, -EIO);
-                       else
-                               generic_make_request(req->private_bio);
-                       put_ldev(mdev);
+       if (rw == WRITE) {
+               if (!drbd_process_write_request(req))
+                       no_remote = true;
+       } else {
+               /* We either have a private_bio, or we can read from remote.
+                * Otherwise we had done the goto nodata above. */
+               if (req->private_bio == NULL) {
+                       _req_mod(req, TO_BE_SENT);
+                       _req_mod(req, QUEUE_FOR_NET_READ);
                } else
-                       bio_endio(req->private_bio, -EIO);
+                       no_remote = true;
        }
 
-       return 0;
-
-fail_free_complete:
-       if (req->rq_state & RQ_IN_ACT_LOG)
-               drbd_al_complete_io(mdev, &req->i);
-fail_and_free_req:
-       if (local) {
-               bio_put(req->private_bio);
-               req->private_bio = NULL;
-               put_ldev(mdev);
+       if (req->private_bio) {
+               /* needs to be marked within the same spinlock */
+               _req_mod(req, TO_BE_SUBMITTED);
+               /* but we need to give up the spinlock to submit */
+               spin_unlock_irq(&mdev->tconn->req_lock);
+               drbd_submit_req_private_bio(req);
+               spin_lock_irq(&mdev->tconn->req_lock);
+       } else if (no_remote) {
+nodata:
+               if (__ratelimit(&drbd_ratelimit_state))
+                       dev_err(DEV, "IO ERROR: neither local nor remote disk\n");
+               /* A write may have been queued for send_oos, however.
+                * So we can not simply free it, we must go through drbd_req_put_completion_ref() */
        }
-       if (!ret)
-               bio_endio(bio, err);
 
-       drbd_req_free(req);
-       dec_ap_bio(mdev);
-       kfree(b);
+out:
+       if (drbd_req_put_completion_ref(req, &m, 1))
+               kref_put(&req->kref, drbd_req_destroy);
+       spin_unlock_irq(&mdev->tconn->req_lock);
 
-       return ret;
+       if (m.bio)
+               complete_master_bio(mdev, &m);
+       return;
 }
 
 int drbd_make_request(struct request_queue *q, struct bio *bio)
@@ -1146,9 +1094,8 @@ int drbd_make_request(struct request_queue *q, struct bio *bio)
        D_ASSERT(bio->bi_size > 0);
        D_ASSERT(IS_ALIGNED(bio->bi_size, 512));
 
-       do {
-               inc_ap_bio(mdev);
-       } while (__drbd_make_request(mdev, bio, start_time));
+       inc_ap_bio(mdev);
+       __drbd_make_request(mdev, bio, start_time);
 
        return 0;
 }
@@ -1184,20 +1131,33 @@ int drbd_merge_bvec(struct request_queue *q, struct bvec_merge_data *bvm, struct
        return limit;
 }
 
+struct drbd_request *find_oldest_request(struct drbd_tconn *tconn)
+{
+       /* Walk the transfer log,
+        * and find the oldest not yet completed request */
+       struct drbd_request *r;
+       list_for_each_entry(r, &tconn->transfer_log, tl_requests) {
+               if (atomic_read(&r->completion_ref))
+                       return r;
+       }
+       return NULL;
+}
+
 void request_timer_fn(unsigned long data)
 {
        struct drbd_conf *mdev = (struct drbd_conf *) data;
        struct drbd_tconn *tconn = mdev->tconn;
        struct drbd_request *req; /* oldest request */
-       struct list_head *le;
        struct net_conf *nc;
        unsigned long ent = 0, dt = 0, et, nt; /* effective timeout = ko_count * timeout */
+       unsigned long now;
 
        rcu_read_lock();
        nc = rcu_dereference(tconn->net_conf);
-       ent = nc ? nc->timeout * HZ/10 * nc->ko_count : 0;
+       if (nc && mdev->state.conn >= C_WF_REPORT_PARAMS)
+               ent = nc->timeout * HZ/10 * nc->ko_count;
 
-       if (get_ldev(mdev)) {
+       if (get_ldev(mdev)) { /* implicit state.disk >= D_INCONSISTENT */
                dt = rcu_dereference(mdev->ldev->disk_conf)->disk_timeout * HZ / 10;
                put_ldev(mdev);
        }
@@ -1205,32 +1165,48 @@ void request_timer_fn(unsigned long data)
 
        et = min_not_zero(dt, ent);
 
-       if (!et || (mdev->state.conn < C_WF_REPORT_PARAMS && mdev->state.disk <= D_FAILED))
+       if (!et)
                return; /* Recurring timer stopped */
 
+       now = jiffies;
+
        spin_lock_irq(&tconn->req_lock);
-       le = &tconn->oldest_tle->requests;
-       if (list_empty(le)) {
+       req = find_oldest_request(tconn);
+       if (!req) {
                spin_unlock_irq(&tconn->req_lock);
-               mod_timer(&mdev->request_timer, jiffies + et);
+               mod_timer(&mdev->request_timer, now + et);
                return;
        }
 
-       le = le->prev;
-       req = list_entry(le, struct drbd_request, tl_requests);
-       if (ent && req->rq_state & RQ_NET_PENDING) {
-               if (time_is_before_eq_jiffies(req->start_time + ent)) {
-                       dev_warn(DEV, "Remote failed to finish a request within ko-count * timeout\n");
-                       _drbd_set_state(_NS(mdev, conn, C_TIMEOUT), CS_VERBOSE | CS_HARD, NULL);
-               }
+       /* The request is considered timed out, if
+        * - we have some effective timeout from the configuration,
+        *   with above state restrictions applied,
+        * - the oldest request is waiting for a response from the network
+        *   resp. the local disk,
+        * - the oldest request is in fact older than the effective timeout,
+        * - the connection was established (resp. disk was attached)
+        *   for longer than the timeout already.
+        * Note that for 32bit jiffies and very stable connections/disks,
+        * we may have a wrap around, which is catched by
+        *   !time_in_range(now, last_..._jif, last_..._jif + timeout).
+        *
+        * Side effect: once per 32bit wrap-around interval, which means every
+        * ~198 days with 250 HZ, we have a window where the timeout would need
+        * to expire twice (worst case) to become effective. Good enough.
+        */
+       if (ent && req->rq_state & RQ_NET_PENDING &&
+                time_after(now, req->start_time + ent) &&
+               !time_in_range(now, tconn->last_reconnect_jif, tconn->last_reconnect_jif + ent)) {
+               dev_warn(DEV, "Remote failed to finish a request within ko-count * timeout\n");
+               _drbd_set_state(_NS(mdev, conn, C_TIMEOUT), CS_VERBOSE | CS_HARD, NULL);
        }
-       if (dt && req->rq_state & RQ_LOCAL_PENDING && req->w.mdev == mdev) {
-               if (time_is_before_eq_jiffies(req->start_time + dt)) {
-                       dev_warn(DEV, "Local backing device failed to meet the disk-timeout\n");
-                       __drbd_chk_io_error(mdev, 1);
-               }
+       if (dt && req->rq_state & RQ_LOCAL_PENDING && req->w.mdev == mdev &&
+                time_after(now, req->start_time + dt) &&
+               !time_in_range(now, mdev->last_reattach_jif, mdev->last_reattach_jif + dt)) {
+               dev_warn(DEV, "Local backing device failed to meet the disk-timeout\n");
+               __drbd_chk_io_error(mdev, 1);
        }
-       nt = (time_is_before_eq_jiffies(req->start_time + et) ? jiffies : req->start_time) + et;
+       nt = (time_after(now, req->start_time + et) ? now : req->start_time) + et;
        spin_unlock_irq(&tconn->req_lock);
        mod_timer(&mdev->request_timer, nt);
 }