Patch for fail-back without fresh backup

*** a/src/backend/access/hash/hash.c
--- b/src/backend/access/hash/hash.c
***************
*** 287,293 **** hashgettuple(PG_FUNCTION_ARGS)
  			/*
  			 * Since this can be redone later if needed, mark as a hint.
  			 */
! 			MarkBufferDirtyHint(buf);
  		}
  
  		/*
--- 287,293 ----
  			/*
  			 * Since this can be redone later if needed, mark as a hint.
  			 */
! 			MarkBufferDirtyHint(buf, true);
  		}
  
  		/*
*** a/src/backend/access/heap/pruneheap.c
--- b/src/backend/access/heap/pruneheap.c
***************
*** 262,268 **** heap_page_prune(Relation relation, Buffer buffer, TransactionId OldestXmin,
  		{
  			((PageHeader) page)->pd_prune_xid = prstate.new_prune_xid;
  			PageClearFull(page);
! 			MarkBufferDirtyHint(buffer);
  		}
  	}
  
--- 262,268 ----
  		{
  			((PageHeader) page)->pd_prune_xid = prstate.new_prune_xid;
  			PageClearFull(page);
! 			MarkBufferDirtyHint(buffer, true);
  		}
  	}
  
*** a/src/backend/access/nbtree/nbtinsert.c
--- b/src/backend/access/nbtree/nbtinsert.c
***************
*** 413,421 **** _bt_check_unique(Relation rel, IndexTuple itup, Relation heapRel,
  					 * crucial. Be sure to mark the proper buffer dirty.
  					 */
  					if (nbuf != InvalidBuffer)
! 						MarkBufferDirtyHint(nbuf);
  					else
! 						MarkBufferDirtyHint(buf);
  				}
  			}
  		}
--- 413,421 ----
  					 * crucial. Be sure to mark the proper buffer dirty.
  					 */
  					if (nbuf != InvalidBuffer)
! 						MarkBufferDirtyHint(nbuf, true);
  					else
! 						MarkBufferDirtyHint(buf, true);
  				}
  			}
  		}
*** a/src/backend/access/nbtree/nbtree.c
--- b/src/backend/access/nbtree/nbtree.c
***************
*** 1052,1058 **** restart:
  				opaque->btpo_cycleid == vstate->cycleid)
  			{
  				opaque->btpo_cycleid = 0;
! 				MarkBufferDirtyHint(buf);
  			}
  		}
  
--- 1052,1058 ----
  				opaque->btpo_cycleid == vstate->cycleid)
  			{
  				opaque->btpo_cycleid = 0;
! 				MarkBufferDirtyHint(buf, true);
  			}
  		}
  
*** a/src/backend/access/nbtree/nbtutils.c
--- b/src/backend/access/nbtree/nbtutils.c
***************
*** 1789,1795 **** _bt_killitems(IndexScanDesc scan, bool haveLock)
  	if (killedsomething)
  	{
  		opaque->btpo_flags |= BTP_HAS_GARBAGE;
! 		MarkBufferDirtyHint(so->currPos.buf);
  	}
  
  	if (!haveLock)
--- 1789,1795 ----
  	if (killedsomething)
  	{
  		opaque->btpo_flags |= BTP_HAS_GARBAGE;
! 		MarkBufferDirtyHint(so->currPos.buf, true);
  	}
  
  	if (!haveLock)
*** a/src/backend/access/transam/xlog.c
--- b/src/backend/access/transam/xlog.c
***************
*** 7681,7692 **** XLogRestorePoint(const char *rpName)
   * records. In that case, multiple copies of the same block would be recorded
   * in separate WAL records by different backends, though that is still OK from
   * a correctness perspective.
-  *
-  * Note that this only works for buffers that fit the standard page model,
-  * i.e. those for which buffer_std == true
   */
  XLogRecPtr
! XLogSaveBufferForHint(Buffer buffer)
  {
  	XLogRecPtr	recptr = InvalidXLogRecPtr;
  	XLogRecPtr	lsn;
--- 7681,7689 ----
   * records. In that case, multiple copies of the same block would be recorded
   * in separate WAL records by different backends, though that is still OK from
   * a correctness perspective.
   */
  XLogRecPtr
! XLogSaveBufferForHint(Buffer buffer, bool buffer_std)
  {
  	XLogRecPtr	recptr = InvalidXLogRecPtr;
  	XLogRecPtr	lsn;
***************
*** 7708,7714 **** XLogSaveBufferForHint(Buffer buffer)
  	 * and reset rdata for any actual WAL record insert.
  	 */
  	rdata[0].buffer = buffer;
! 	rdata[0].buffer_std = true;
  
  	/*
  	 * Check buffer while not holding an exclusive lock.
--- 7705,7711 ----
  	 * and reset rdata for any actual WAL record insert.
  	 */
  	rdata[0].buffer = buffer;
! 	rdata[0].buffer_std = buffer_std;
  
  	/*
  	 * Check buffer while not holding an exclusive lock.
*** a/src/backend/commands/sequence.c
--- b/src/backend/commands/sequence.c
***************
*** 1118,1124 **** read_seq_tuple(SeqTable elm, Relation rel, Buffer *buf, HeapTuple seqtuple)
  		HeapTupleHeaderSetXmax(seqtuple->t_data, InvalidTransactionId);
  		seqtuple->t_data->t_infomask &= ~HEAP_XMAX_COMMITTED;
  		seqtuple->t_data->t_infomask |= HEAP_XMAX_INVALID;
! 		MarkBufferDirtyHint(*buf);
  	}
  
  	seq = (Form_pg_sequence) GETSTRUCT(seqtuple);
--- 1118,1124 ----
  		HeapTupleHeaderSetXmax(seqtuple->t_data, InvalidTransactionId);
  		seqtuple->t_data->t_infomask &= ~HEAP_XMAX_COMMITTED;
  		seqtuple->t_data->t_infomask |= HEAP_XMAX_INVALID;
! 		MarkBufferDirtyHint(*buf, true);
  	}
  
  	seq = (Form_pg_sequence) GETSTRUCT(seqtuple);
*** a/src/backend/storage/buffer/bufmgr.c
--- b/src/backend/storage/buffer/bufmgr.c
***************
*** 2587,2593 **** IncrBufferRefCount(Buffer buffer)
   *	  (due to a race condition), so it cannot be used for important changes.
   */
  void
! MarkBufferDirtyHint(Buffer buffer)
  {
  	volatile BufferDesc *bufHdr;
  	Page		page = BufferGetPage(buffer);
--- 2587,2593 ----
   *	  (due to a race condition), so it cannot be used for important changes.
   */
  void
! MarkBufferDirtyHint(Buffer buffer, bool buffer_std)
  {
  	volatile BufferDesc *bufHdr;
  	Page		page = BufferGetPage(buffer);
***************
*** 2671,2677 **** MarkBufferDirtyHint(Buffer buffer)
  			 * rather than full transactionids.
  			 */
  			MyPgXact->delayChkpt = delayChkpt = true;
! 			lsn = XLogSaveBufferForHint(buffer);
  		}
  
  		LockBufHdr(bufHdr);
--- 2671,2677 ----
  			 * rather than full transactionids.
  			 */
  			MyPgXact->delayChkpt = delayChkpt = true;
! 			lsn = XLogSaveBufferForHint(buffer, buffer_std);
  		}
  
  		LockBufHdr(bufHdr);
*** a/src/backend/storage/freespace/freespace.c
--- b/src/backend/storage/freespace/freespace.c
***************
*** 216,222 **** XLogRecordPageWithFreeSpace(RelFileNode rnode, BlockNumber heapBlk,
  		PageInit(page, BLCKSZ, 0);
  
  	if (fsm_set_avail(page, slot, new_cat))
! 		MarkBufferDirtyHint(buf);
  	UnlockReleaseBuffer(buf);
  }
  
--- 216,222 ----
  		PageInit(page, BLCKSZ, 0);
  
  	if (fsm_set_avail(page, slot, new_cat))
! 		MarkBufferDirtyHint(buf, false);
  	UnlockReleaseBuffer(buf);
  }
  
***************
*** 286,292 **** FreeSpaceMapTruncateRel(Relation rel, BlockNumber nblocks)
  			return;				/* nothing to do; the FSM was already smaller */
  		LockBuffer(buf, BUFFER_LOCK_EXCLUSIVE);
  		fsm_truncate_avail(BufferGetPage(buf), first_removed_slot);
! 		MarkBufferDirtyHint(buf);
  		UnlockReleaseBuffer(buf);
  
  		new_nfsmblocks = fsm_logical_to_physical(first_removed_address) + 1;
--- 286,292 ----
  			return;				/* nothing to do; the FSM was already smaller */
  		LockBuffer(buf, BUFFER_LOCK_EXCLUSIVE);
  		fsm_truncate_avail(BufferGetPage(buf), first_removed_slot);
! 		MarkBufferDirtyHint(buf, false);
  		UnlockReleaseBuffer(buf);
  
  		new_nfsmblocks = fsm_logical_to_physical(first_removed_address) + 1;
***************
*** 619,625 **** fsm_set_and_search(Relation rel, FSMAddress addr, uint16 slot,
  	page = BufferGetPage(buf);
  
  	if (fsm_set_avail(page, slot, newValue))
! 		MarkBufferDirtyHint(buf);
  
  	if (minValue != 0)
  	{
--- 619,625 ----
  	page = BufferGetPage(buf);
  
  	if (fsm_set_avail(page, slot, newValue))
! 		MarkBufferDirtyHint(buf, false);
  
  	if (minValue != 0)
  	{
***************
*** 770,776 **** fsm_vacuum_page(Relation rel, FSMAddress addr, bool *eof_p)
  			{
  				LockBuffer(buf, BUFFER_LOCK_EXCLUSIVE);
  				fsm_set_avail(BufferGetPage(buf), slot, child_avail);
! 				MarkBufferDirtyHint(buf);
  				LockBuffer(buf, BUFFER_LOCK_UNLOCK);
  			}
  		}
--- 770,776 ----
  			{
  				LockBuffer(buf, BUFFER_LOCK_EXCLUSIVE);
  				fsm_set_avail(BufferGetPage(buf), slot, child_avail);
! 				MarkBufferDirtyHint(buf, false);
  				LockBuffer(buf, BUFFER_LOCK_UNLOCK);
  			}
  		}
*** a/src/backend/storage/freespace/fsmpage.c
--- b/src/backend/storage/freespace/fsmpage.c
***************
*** 284,290 **** restart:
  				exclusive_lock_held = true;
  			}
  			fsm_rebuild_page(page);
! 			MarkBufferDirtyHint(buf);
  			goto restart;
  		}
  	}
--- 284,290 ----
  				exclusive_lock_held = true;
  			}
  			fsm_rebuild_page(page);
! 			MarkBufferDirtyHint(buf, false);
  			goto restart;
  		}
  	}
*** a/src/backend/utils/time/tqual.c
--- b/src/backend/utils/time/tqual.c
***************
*** 121,127 **** SetHintBits(HeapTupleHeader tuple, Buffer buffer,
  	}
  
  	tuple->t_infomask |= infomask;
! 	MarkBufferDirtyHint(buffer);
  }
  
  /*
--- 121,127 ----
  	}
  
  	tuple->t_infomask |= infomask;
! 	MarkBufferDirtyHint(buffer, true);
  }
  
  /*
*** a/src/include/access/xlog.h
--- b/src/include/access/xlog.h
***************
*** 267,273 **** extern bool XLogNeedsFlush(XLogRecPtr RecPtr);
  extern int	XLogFileInit(XLogSegNo segno, bool *use_existent, bool use_lock);
  extern int	XLogFileOpen(XLogSegNo segno);
  
! extern XLogRecPtr XLogSaveBufferForHint(Buffer buffer);
  
  extern void CheckXLogRemoved(XLogSegNo segno, TimeLineID tli);
  extern void XLogSetAsyncXactLSN(XLogRecPtr record);
--- 267,273 ----
  extern int	XLogFileInit(XLogSegNo segno, bool *use_existent, bool use_lock);
  extern int	XLogFileOpen(XLogSegNo segno);
  
! extern XLogRecPtr XLogSaveBufferForHint(Buffer buffer, bool buffer_std);
  
  extern void CheckXLogRemoved(XLogSegNo segno, TimeLineID tli);
  extern void XLogSetAsyncXactLSN(XLogRecPtr record);
*** a/src/include/storage/bufmgr.h
--- b/src/include/storage/bufmgr.h
***************
*** 204,210 **** extern Size BufferShmemSize(void);
  extern void BufferGetTag(Buffer buffer, RelFileNode *rnode,
  			 ForkNumber *forknum, BlockNumber *blknum);
  
! extern void MarkBufferDirtyHint(Buffer buffer);
  
  extern void UnlockBuffers(void);
  extern void LockBuffer(Buffer buffer, int mode);
--- 204,210 ----
  extern void BufferGetTag(Buffer buffer, RelFileNode *rnode,
  			 ForkNumber *forknum, BlockNumber *blknum);
  
! extern void MarkBufferDirtyHint(Buffer buffer, bool buffer_std);
  
  extern void UnlockBuffers(void);
  extern void LockBuffer(Buffer buffer, int mode);

*** a/src/backend/access/hash/hash.c
--- b/src/backend/access/hash/hash.c
***************
*** 287,293 **** hashgettuple(PG_FUNCTION_ARGS)
  			/*
  			 * Since this can be redone later if needed, mark as a hint.
  			 */
! 			MarkBufferDirtyHint(buf);
  		}
  
  		/*
--- 287,293 ----
  			/*
  			 * Since this can be redone later if needed, mark as a hint.
  			 */
! 			MarkBufferDirtyHint(buf, true);
  		}
  
  		/*
*** a/src/backend/access/heap/pruneheap.c
--- b/src/backend/access/heap/pruneheap.c
***************
*** 262,268 **** heap_page_prune(Relation relation, Buffer buffer, TransactionId OldestXmin,
  		{
  			((PageHeader) page)->pd_prune_xid = prstate.new_prune_xid;
  			PageClearFull(page);
! 			MarkBufferDirtyHint(buffer);
  		}
  	}
  
--- 262,268 ----
  		{
  			((PageHeader) page)->pd_prune_xid = prstate.new_prune_xid;
  			PageClearFull(page);
! 			MarkBufferDirtyHint(buffer, true);
  		}
  	}
  
*** a/src/backend/access/nbtree/nbtinsert.c
--- b/src/backend/access/nbtree/nbtinsert.c
***************
*** 413,421 **** _bt_check_unique(Relation rel, IndexTuple itup, Relation heapRel,
  					 * crucial. Be sure to mark the proper buffer dirty.
  					 */
  					if (nbuf != InvalidBuffer)
! 						MarkBufferDirtyHint(nbuf);
  					else
! 						MarkBufferDirtyHint(buf);
  				}
  			}
  		}
--- 413,421 ----
  					 * crucial. Be sure to mark the proper buffer dirty.
  					 */
  					if (nbuf != InvalidBuffer)
! 						MarkBufferDirtyHint(nbuf, true);
  					else
! 						MarkBufferDirtyHint(buf, true);
  				}
  			}
  		}
*** a/src/backend/access/nbtree/nbtree.c
--- b/src/backend/access/nbtree/nbtree.c
***************
*** 1052,1058 **** restart:
  				opaque->btpo_cycleid == vstate->cycleid)
  			{
  				opaque->btpo_cycleid = 0;
! 				MarkBufferDirtyHint(buf);
  			}
  		}
  
--- 1052,1058 ----
  				opaque->btpo_cycleid == vstate->cycleid)
  			{
  				opaque->btpo_cycleid = 0;
! 				MarkBufferDirtyHint(buf, true);
  			}
  		}
  
*** a/src/backend/access/nbtree/nbtutils.c
--- b/src/backend/access/nbtree/nbtutils.c
***************
*** 1789,1795 **** _bt_killitems(IndexScanDesc scan, bool haveLock)
  	if (killedsomething)
  	{
  		opaque->btpo_flags |= BTP_HAS_GARBAGE;
! 		MarkBufferDirtyHint(so->currPos.buf);
  	}
  
  	if (!haveLock)
--- 1789,1795 ----
  	if (killedsomething)
  	{
  		opaque->btpo_flags |= BTP_HAS_GARBAGE;
! 		MarkBufferDirtyHint(so->currPos.buf, true);
  	}
  
  	if (!haveLock)
*** a/src/backend/access/rmgrdesc/xlogdesc.c
--- b/src/backend/access/rmgrdesc/xlogdesc.c
***************
*** 82,92 **** xlog_desc(StringInfo buf, uint8 xl_info, char *rec)
  		appendStringInfo(buf, "restore point: %s", xlrec->rp_name);
  
  	}
! 	else if (info == XLOG_HINT)
  	{
  		BkpBlock   *bkp = (BkpBlock *) rec;
  
! 		appendStringInfo(buf, "page hint: %s block %u",
  						 relpathperm(bkp->node, bkp->fork),
  						 bkp->block);
  	}
--- 82,92 ----
  		appendStringInfo(buf, "restore point: %s", xlrec->rp_name);
  
  	}
! 	else if (info == XLOG_FPI)
  	{
  		BkpBlock   *bkp = (BkpBlock *) rec;
  
! 		appendStringInfo(buf, "full-page image: %s block %u",
  						 relpathperm(bkp->node, bkp->fork),
  						 bkp->block);
  	}
*** a/src/backend/access/transam/xlog.c
--- b/src/backend/access/transam/xlog.c
***************
*** 7681,7692 **** XLogRestorePoint(const char *rpName)
   * records. In that case, multiple copies of the same block would be recorded
   * in separate WAL records by different backends, though that is still OK from
   * a correctness perspective.
-  *
-  * Note that this only works for buffers that fit the standard page model,
-  * i.e. those for which buffer_std == true
   */
  XLogRecPtr
! XLogSaveBufferForHint(Buffer buffer)
  {
  	XLogRecPtr	recptr = InvalidXLogRecPtr;
  	XLogRecPtr	lsn;
--- 7681,7689 ----
   * records. In that case, multiple copies of the same block would be recorded
   * in separate WAL records by different backends, though that is still OK from
   * a correctness perspective.
   */
  XLogRecPtr
! XLogSaveBufferForHint(Buffer buffer, bool buffer_std)
  {
  	XLogRecPtr	recptr = InvalidXLogRecPtr;
  	XLogRecPtr	lsn;
***************
*** 7708,7714 **** XLogSaveBufferForHint(Buffer buffer)
  	 * and reset rdata for any actual WAL record insert.
  	 */
  	rdata[0].buffer = buffer;
! 	rdata[0].buffer_std = true;
  
  	/*
  	 * Check buffer while not holding an exclusive lock.
--- 7705,7711 ----
  	 * and reset rdata for any actual WAL record insert.
  	 */
  	rdata[0].buffer = buffer;
! 	rdata[0].buffer_std = buffer_std;
  
  	/*
  	 * Check buffer while not holding an exclusive lock.
***************
*** 7722,7727 **** XLogSaveBufferForHint(Buffer buffer)
--- 7719,7727 ----
  		 * Copy buffer so we don't have to worry about concurrent hint bit or
  		 * lsn updates. We assume pd_lower/upper cannot be changed without an
  		 * exclusive lock, so the contents bkp are not racy.
+ 		 *
+ 		 * With buffer_std set to false, XLogCheckBuffer() sets hole_length and
+ 		 * hole_offset to 0; so the following code is safe for either case.
  		 */
  		memcpy(copied_buffer, origdata, bkpb.hole_offset);
  		memcpy(copied_buffer + bkpb.hole_offset,
***************
*** 7744,7750 **** XLogSaveBufferForHint(Buffer buffer)
  		rdata[1].buffer = InvalidBuffer;
  		rdata[1].next = NULL;
  
! 		recptr = XLogInsert(RM_XLOG_ID, XLOG_HINT, rdata);
  	}
  
  	return recptr;
--- 7744,7750 ----
  		rdata[1].buffer = InvalidBuffer;
  		rdata[1].next = NULL;
  
! 		recptr = XLogInsert(RM_XLOG_ID, XLOG_FPI, rdata);
  	}
  
  	return recptr;
***************
*** 8109,8122 **** xlog_redo(XLogRecPtr lsn, XLogRecord *record)
  	{
  		/* nothing to do here */
  	}
! 	else if (info == XLOG_HINT)
  	{
  		char	   *data;
  		BkpBlock	bkpb;
  
  		/*
! 		 * Hint bit records contain a backup block stored "inline" in the
! 		 * normal data since the locking when writing hint records isn't
  		 * sufficient to use the normal backup block mechanism, which assumes
  		 * exclusive lock on the buffer supplied.
  		 *
--- 8109,8122 ----
  	{
  		/* nothing to do here */
  	}
! 	else if (info == XLOG_FPI)
  	{
  		char	   *data;
  		BkpBlock	bkpb;
  
  		/*
! 		 * Full-page image (FPI) records contain a backup block stored "inline"
! 		 * in the normal data since the locking when writing hint records isn't
  		 * sufficient to use the normal backup block mechanism, which assumes
  		 * exclusive lock on the buffer supplied.
  		 *
*** a/src/backend/commands/sequence.c
--- b/src/backend/commands/sequence.c
***************
*** 1118,1124 **** read_seq_tuple(SeqTable elm, Relation rel, Buffer *buf, HeapTuple seqtuple)
  		HeapTupleHeaderSetXmax(seqtuple->t_data, InvalidTransactionId);
  		seqtuple->t_data->t_infomask &= ~HEAP_XMAX_COMMITTED;
  		seqtuple->t_data->t_infomask |= HEAP_XMAX_INVALID;
! 		MarkBufferDirtyHint(*buf);
  	}
  
  	seq = (Form_pg_sequence) GETSTRUCT(seqtuple);
--- 1118,1124 ----
  		HeapTupleHeaderSetXmax(seqtuple->t_data, InvalidTransactionId);
  		seqtuple->t_data->t_infomask &= ~HEAP_XMAX_COMMITTED;
  		seqtuple->t_data->t_infomask |= HEAP_XMAX_INVALID;
! 		MarkBufferDirtyHint(*buf, true);
  	}
  
  	seq = (Form_pg_sequence) GETSTRUCT(seqtuple);
*** a/src/backend/storage/buffer/bufmgr.c
--- b/src/backend/storage/buffer/bufmgr.c
***************
*** 2587,2593 **** IncrBufferRefCount(Buffer buffer)
   *	  (due to a race condition), so it cannot be used for important changes.
   */
  void
! MarkBufferDirtyHint(Buffer buffer)
  {
  	volatile BufferDesc *bufHdr;
  	Page		page = BufferGetPage(buffer);
--- 2587,2593 ----
   *	  (due to a race condition), so it cannot be used for important changes.
   */
  void
! MarkBufferDirtyHint(Buffer buffer, bool buffer_std)
  {
  	volatile BufferDesc *bufHdr;
  	Page		page = BufferGetPage(buffer);
***************
*** 2671,2677 **** MarkBufferDirtyHint(Buffer buffer)
  			 * rather than full transactionids.
  			 */
  			MyPgXact->delayChkpt = delayChkpt = true;
! 			lsn = XLogSaveBufferForHint(buffer);
  		}
  
  		LockBufHdr(bufHdr);
--- 2671,2677 ----
  			 * rather than full transactionids.
  			 */
  			MyPgXact->delayChkpt = delayChkpt = true;
! 			lsn = XLogSaveBufferForHint(buffer, buffer_std);
  		}
  
  		LockBufHdr(bufHdr);
*** a/src/backend/storage/freespace/freespace.c
--- b/src/backend/storage/freespace/freespace.c
***************
*** 216,222 **** XLogRecordPageWithFreeSpace(RelFileNode rnode, BlockNumber heapBlk,
  		PageInit(page, BLCKSZ, 0);
  
  	if (fsm_set_avail(page, slot, new_cat))
! 		MarkBufferDirtyHint(buf);
  	UnlockReleaseBuffer(buf);
  }
  
--- 216,222 ----
  		PageInit(page, BLCKSZ, 0);
  
  	if (fsm_set_avail(page, slot, new_cat))
! 		MarkBufferDirtyHint(buf, false);
  	UnlockReleaseBuffer(buf);
  }
  
***************
*** 286,292 **** FreeSpaceMapTruncateRel(Relation rel, BlockNumber nblocks)
  			return;				/* nothing to do; the FSM was already smaller */
  		LockBuffer(buf, BUFFER_LOCK_EXCLUSIVE);
  		fsm_truncate_avail(BufferGetPage(buf), first_removed_slot);
! 		MarkBufferDirtyHint(buf);
  		UnlockReleaseBuffer(buf);
  
  		new_nfsmblocks = fsm_logical_to_physical(first_removed_address) + 1;
--- 286,292 ----
  			return;				/* nothing to do; the FSM was already smaller */
  		LockBuffer(buf, BUFFER_LOCK_EXCLUSIVE);
  		fsm_truncate_avail(BufferGetPage(buf), first_removed_slot);
! 		MarkBufferDirtyHint(buf, false);
  		UnlockReleaseBuffer(buf);
  
  		new_nfsmblocks = fsm_logical_to_physical(first_removed_address) + 1;
***************
*** 619,625 **** fsm_set_and_search(Relation rel, FSMAddress addr, uint16 slot,
  	page = BufferGetPage(buf);
  
  	if (fsm_set_avail(page, slot, newValue))
! 		MarkBufferDirtyHint(buf);
  
  	if (minValue != 0)
  	{
--- 619,625 ----
  	page = BufferGetPage(buf);
  
  	if (fsm_set_avail(page, slot, newValue))
! 		MarkBufferDirtyHint(buf, false);
  
  	if (minValue != 0)
  	{
***************
*** 770,776 **** fsm_vacuum_page(Relation rel, FSMAddress addr, bool *eof_p)
  			{
  				LockBuffer(buf, BUFFER_LOCK_EXCLUSIVE);
  				fsm_set_avail(BufferGetPage(buf), slot, child_avail);
! 				MarkBufferDirtyHint(buf);
  				LockBuffer(buf, BUFFER_LOCK_UNLOCK);
  			}
  		}
--- 770,776 ----
  			{
  				LockBuffer(buf, BUFFER_LOCK_EXCLUSIVE);
  				fsm_set_avail(BufferGetPage(buf), slot, child_avail);
! 				MarkBufferDirtyHint(buf, false);
  				LockBuffer(buf, BUFFER_LOCK_UNLOCK);
  			}
  		}
*** a/src/backend/storage/freespace/fsmpage.c
--- b/src/backend/storage/freespace/fsmpage.c
***************
*** 284,290 **** restart:
  				exclusive_lock_held = true;
  			}
  			fsm_rebuild_page(page);
! 			MarkBufferDirtyHint(buf);
  			goto restart;
  		}
  	}
--- 284,290 ----
  				exclusive_lock_held = true;
  			}
  			fsm_rebuild_page(page);
! 			MarkBufferDirtyHint(buf, false);
  			goto restart;
  		}
  	}
*** a/src/backend/utils/time/tqual.c
--- b/src/backend/utils/time/tqual.c
***************
*** 121,127 **** SetHintBits(HeapTupleHeader tuple, Buffer buffer,
  	}
  
  	tuple->t_infomask |= infomask;
! 	MarkBufferDirtyHint(buffer);
  }
  
  /*
--- 121,127 ----
  	}
  
  	tuple->t_infomask |= infomask;
! 	MarkBufferDirtyHint(buffer, true);
  }
  
  /*
*** a/src/include/access/xlog.h
--- b/src/include/access/xlog.h
***************
*** 267,273 **** extern bool XLogNeedsFlush(XLogRecPtr RecPtr);
  extern int	XLogFileInit(XLogSegNo segno, bool *use_existent, bool use_lock);
  extern int	XLogFileOpen(XLogSegNo segno);
  
! extern XLogRecPtr XLogSaveBufferForHint(Buffer buffer);
  
  extern void CheckXLogRemoved(XLogSegNo segno, TimeLineID tli);
  extern void XLogSetAsyncXactLSN(XLogRecPtr record);
--- 267,273 ----
  extern int	XLogFileInit(XLogSegNo segno, bool *use_existent, bool use_lock);
  extern int	XLogFileOpen(XLogSegNo segno);
  
! extern XLogRecPtr XLogSaveBufferForHint(Buffer buffer, bool buffer_std);
  
  extern void CheckXLogRemoved(XLogSegNo segno, TimeLineID tli);
  extern void XLogSetAsyncXactLSN(XLogRecPtr record);
*** a/src/include/catalog/pg_control.h
--- b/src/include/catalog/pg_control.h
***************
*** 67,73 **** typedef struct CheckPoint
  #define XLOG_RESTORE_POINT				0x70
  #define XLOG_FPW_CHANGE					0x80
  #define XLOG_END_OF_RECOVERY			0x90
! #define XLOG_HINT						0xA0
  
  
  /*
--- 67,73 ----
  #define XLOG_RESTORE_POINT				0x70
  #define XLOG_FPW_CHANGE					0x80
  #define XLOG_END_OF_RECOVERY			0x90
! #define XLOG_FPI						0xA0
  
  
  /*
*** a/src/include/storage/bufmgr.h
--- b/src/include/storage/bufmgr.h
***************
*** 204,210 **** extern Size BufferShmemSize(void);
  extern void BufferGetTag(Buffer buffer, RelFileNode *rnode,
  			 ForkNumber *forknum, BlockNumber *blknum);
  
! extern void MarkBufferDirtyHint(Buffer buffer);
  
  extern void UnlockBuffers(void);
  extern void LockBuffer(Buffer buffer, int mode);
--- 204,210 ----
  extern void BufferGetTag(Buffer buffer, RelFileNode *rnode,
  			 ForkNumber *forknum, BlockNumber *blknum);
  
! extern void MarkBufferDirtyHint(Buffer buffer, bool buffer_std);
  
  extern void UnlockBuffers(void);
  extern void LockBuffer(Buffer buffer, int mode);

*** a/src/backend/access/transam/clog.c
--- b/src/backend/access/transam/clog.c
***************
*** 722,728 **** WriteTruncateXlogRec(int pageno)
  	rdata.buffer = InvalidBuffer;
  	rdata.next = NULL;
  	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
! 	XLogFlush(recptr);
  }
  
  /*
--- 722,728 ----
  	rdata.buffer = InvalidBuffer;
  	rdata.next = NULL;
  	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
! 	XLogFlush(recptr, true, false);
  }
  
  /*
*** a/src/backend/access/transam/slru.c
--- b/src/backend/access/transam/slru.c
***************
*** 696,704 **** SlruPhysicalWritePage(SlruCtl ctl, int pageno, int slotno, SlruFlush fdata)
  			 * XLogFlush were to fail, we must PANIC.  This isn't much of a
  			 * restriction because XLogFlush is just about all critical
  			 * section anyway, but let's make sure.
  			 */
  			START_CRIT_SECTION();
! 			XLogFlush(max_lsn);
  			END_CRIT_SECTION();
  		}
  	}
--- 696,706 ----
  			 * XLogFlush were to fail, we must PANIC.  This isn't much of a
  			 * restriction because XLogFlush is just about all critical
  			 * section anyway, but let's make sure.
+ 			 * Also wait for the synchronous standby to receive WAL upto
+ 			 * max_lsn.
  			 */
  			START_CRIT_SECTION();
! 			XLogFlush(max_lsn, true, true);
  			END_CRIT_SECTION();
  		}
  	}
*** a/src/backend/access/transam/twophase.c
--- b/src/backend/access/transam/twophase.c
***************
*** 1049,1055 **** EndPrepare(GlobalTransaction gxact)
  
  	gxact->prepare_lsn = XLogInsert(RM_XACT_ID, XLOG_XACT_PREPARE,
  									records.head);
! 	XLogFlush(gxact->prepare_lsn);
  
  	/* If we crash now, we have prepared: WAL replay will fix things */
  
--- 1049,1062 ----
  
  	gxact->prepare_lsn = XLogInsert(RM_XACT_ID, XLOG_XACT_PREPARE,
  									records.head);
! 
! 	/*
! 	 * Wait for synchronous replication, if required.
! 	 *
! 	 * Note that at this stage we have marked the prepare, but still show as
! 	 * running in the procarray (twice!) and continue to hold locks.
! 	 */
! 	XLogFlush(gxact->prepare_lsn, false, true);
  
  	/* If we crash now, we have prepared: WAL replay will fix things */
  
***************
*** 1090,1103 **** EndPrepare(GlobalTransaction gxact)
  
  	END_CRIT_SECTION();
  
- 	/*
- 	 * Wait for synchronous replication, if required.
- 	 *
- 	 * Note that at this stage we have marked the prepare, but still show as
- 	 * running in the procarray (twice!) and continue to hold locks.
- 	 */
- 	SyncRepWaitForLSN(gxact->prepare_lsn);
- 
  	records.tail = records.head = NULL;
  }
  
--- 1097,1102 ----
***************
*** 2046,2053 **** RecordTransactionCommitPrepared(TransactionId xid,
  	 * a contradiction)
  	 */
  
! 	/* Flush XLOG to disk */
! 	XLogFlush(recptr);
  
  	/* Mark the transaction committed in pg_clog */
  	TransactionIdCommitTree(xid, nchildren, children);
--- 2045,2058 ----
  	 * a contradiction)
  	 */
  
! 	/*
! 	 * Flush XLOG to disk,
! 	 * Wait for synchronous replication, if required.
! 	 *
! 	 * Note that at this stage we have marked clog, but still show as running
! 	 * in the procarray and continue to hold locks.
! 	 */
! 	XLogFlush(recptr, false, true);
  
  	/* Mark the transaction committed in pg_clog */
  	TransactionIdCommitTree(xid, nchildren, children);
***************
*** 2056,2069 **** RecordTransactionCommitPrepared(TransactionId xid,
  	MyPgXact->delayChkpt = false;
  
  	END_CRIT_SECTION();
- 
- 	/*
- 	 * Wait for synchronous replication, if required.
- 	 *
- 	 * Note that at this stage we have marked clog, but still show as running
- 	 * in the procarray and continue to hold locks.
- 	 */
- 	SyncRepWaitForLSN(recptr);
  }
  
  /*
--- 2061,2066 ----
***************
*** 2126,2133 **** RecordTransactionAbortPrepared(TransactionId xid,
  
  	recptr = XLogInsert(RM_XACT_ID, XLOG_XACT_ABORT_PREPARED, rdata);
  
! 	/* Always flush, since we're about to remove the 2PC state file */
! 	XLogFlush(recptr);
  
  	/*
  	 * Mark the transaction aborted in clog.  This is not absolutely necessary
--- 2123,2136 ----
  
  	recptr = XLogInsert(RM_XACT_ID, XLOG_XACT_ABORT_PREPARED, rdata);
  
! 	/*
! 	 * Always flush, since we're about to remove the 2PC state file.
! 	 * Wait for synchronous replication, if required.
! 	 *
! 	 * Note that at this stage we have marked clog, but still show as running
! 	 * in the procarray and continue to hold locks.
! 	 */
! 	XLogFlush(recptr, false, true);
  
  	/*
  	 * Mark the transaction aborted in clog.  This is not absolutely necessary
***************
*** 2136,2147 **** RecordTransactionAbortPrepared(TransactionId xid,
  	TransactionIdAbortTree(xid, nchildren, children);
  
  	END_CRIT_SECTION();
- 
- 	/*
- 	 * Wait for synchronous replication, if required.
- 	 *
- 	 * Note that at this stage we have marked clog, but still show as running
- 	 * in the procarray and continue to hold locks.
- 	 */
- 	SyncRepWaitForLSN(recptr);
  }
--- 2139,2142 ----
*** a/src/backend/access/transam/xact.c
--- b/src/backend/access/transam/xact.c
***************
*** 965,970 **** RecordTransactionCommit(void)
--- 965,971 ----
  	SharedInvalidationMessage *invalMessages = NULL;
  	bool		RelcacheInitFileInval = false;
  	bool		wrote_xlog;
+ 	bool		ret = false;
  
  	/* Get data needed for commit record */
  	nrels = smgrGetPendingDeletes(true, &rels);
***************
*** 1143,1150 **** RecordTransactionCommit(void)
  	if ((wrote_xlog && synchronous_commit > SYNCHRONOUS_COMMIT_OFF) ||
  		forceSyncCommit || nrels > 0)
  	{
! 		XLogFlush(XactLastRecEnd);
! 
  		/*
  		 * Now we may update the CLOG, if we wrote a COMMIT record above
  		 */
--- 1144,1151 ----
  	if ((wrote_xlog && synchronous_commit > SYNCHRONOUS_COMMIT_OFF) ||
  		forceSyncCommit || nrels > 0)
  	{
! 		XLogFlush(XactLastRecEnd, false, true);
! 		ret = true;
  		/*
  		 * Now we may update the CLOG, if we wrote a COMMIT record above
  		 */
***************
*** 1195,1201 **** RecordTransactionCommit(void)
  	 * in the procarray and continue to hold locks.
  	 */
  	if (wrote_xlog)
! 		SyncRepWaitForLSN(XactLastRecEnd);
  
  	/* Reset XactLastRecEnd until the next transaction writes something */
  	XactLastRecEnd = 0;
--- 1196,1202 ----
  	 * in the procarray and continue to hold locks.
  	 */
  	if (wrote_xlog)
! 		SyncRepWaitForLSN(XactLastRecEnd, false, !ret);
  
  	/* Reset XactLastRecEnd until the next transaction writes something */
  	XactLastRecEnd = 0;
***************
*** 4663,4669 **** xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
  		 * after deletion, but that would leave a small window where the
  		 * WAL-first rule would be violated.
  		 */
! 		XLogFlush(lsn);
  
  		for (i = 0; i < nrels; i++)
  		{
--- 4664,4670 ----
  		 * after deletion, but that would leave a small window where the
  		 * WAL-first rule would be violated.
  		 */
! 		XLogFlush(lsn, true, true);
  
  		for (i = 0; i < nrels; i++)
  		{
***************
*** 4690,4696 **** xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
  	 * for any user that requested ForceSyncCommit().
  	 */
  	if (XactCompletionForceSyncCommit(xinfo))
! 		XLogFlush(lsn);
  
  }
  
--- 4691,4697 ----
  	 * for any user that requested ForceSyncCommit().
  	 */
  	if (XactCompletionForceSyncCommit(xinfo))
! 		XLogFlush(lsn, true, false);
  
  }
  
*** a/src/backend/access/transam/xlog.c
--- b/src/backend/access/transam/xlog.c
***************
*** 1898,1904 **** UpdateMinRecoveryPoint(XLogRecPtr lsn, bool force)
   * already held, and we try to avoid acquiring it if possible.
   */
  void
! XLogFlush(XLogRecPtr record)
  {
  	XLogRecPtr	WriteRqstPtr;
  	XLogwrtRqst WriteRqst;
--- 1898,1904 ----
   * already held, and we try to avoid acquiring it if possible.
   */
  void
! XLogFlush(XLogRecPtr record, bool ForDataFlush, bool Wait)
  {
  	XLogRecPtr	WriteRqstPtr;
  	XLogwrtRqst WriteRqst;
***************
*** 2033,2038 **** XLogFlush(XLogRecPtr record)
--- 2033,2040 ----
  	/* wake up walsenders now that we've released heavily contended locks */
  	WalSndWakeupProcessRequests();
  
+ 	SyncRepWaitForLSN(WriteRqstPtr, ForDataFlush, Wait);
+ 
  	/*
  	 * If we still haven't flushed to the request point then we have a
  	 * problem; most likely, the requested flush point is past end of XLOG.
***************
*** 7092,7098 **** CreateCheckPoint(int flags)
  						XLOG_CHECKPOINT_ONLINE,
  						&rdata);
  
! 	XLogFlush(recptr);
  
  	/*
  	 * We mustn't write any new WAL after a shutdown checkpoint, or it will be
--- 7094,7105 ----
  						XLOG_CHECKPOINT_ONLINE,
  						&rdata);
  
! 	/*
! 	 * At this point, ensure that the synchronous standby has received the
! 	 * checkpoint WAL. Otherwise failure after the control file update will
! 	 * cause the master to start from a location not known to the standby
! 	 */
! 	XLogFlush(recptr, true, !shutdown);
  
  	/*
  	 * We mustn't write any new WAL after a shutdown checkpoint, or it will be
***************
*** 7249,7255 **** CreateEndOfRecoveryRecord(void)
  
  	recptr = XLogInsert(RM_XLOG_ID, XLOG_END_OF_RECOVERY, &rdata);
  
! 	XLogFlush(recptr);
  
  	/*
  	 * Update the control file so that crash recovery can follow the timeline
--- 7256,7262 ----
  
  	recptr = XLogInsert(RM_XLOG_ID, XLOG_END_OF_RECOVERY, &rdata);
  
! 	XLogFlush(recptr, true, true);
  
  	/*
  	 * Update the control file so that crash recovery can follow the timeline
*** a/src/backend/catalog/storage.c
--- b/src/backend/catalog/storage.c
***************
*** 285,293 **** RelationTruncate(Relation rel, BlockNumber nblocks)
  		 * or visibility map. If we crashed during that window, we'd be left
  		 * with a truncated heap, but the FSM or visibility map would still
  		 * contain entries for the non-existent heap pages.
  		 */
  		if (fsm || vm)
! 			XLogFlush(lsn);
  	}
  
  	/* Do the real work */
--- 285,297 ----
  		 * or visibility map. If we crashed during that window, we'd be left
  		 * with a truncated heap, but the FSM or visibility map would still
  		 * contain entries for the non-existent heap pages.
+ 		 *
+ 		 * Also ensure that the WAL is received by the synchronous standby.
+ 		 * Otherwise, we may have a situation where the heap is truncated, but
+ 		 * the action never replayed on the standby
  		 */
  		if (fsm || vm)
! 			XLogFlush(lsn, true, true);
  	}
  
  	/* Do the real work */
***************
*** 519,525 **** smgr_redo(XLogRecPtr lsn, XLogRecord *record)
  		 * after truncation, but that would leave a small window where the
  		 * WAL-first rule could be violated.
  		 */
! 		XLogFlush(lsn);
  
  		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
  
--- 523,529 ----
  		 * after truncation, but that would leave a small window where the
  		 * WAL-first rule could be violated.
  		 */
! 		XLogFlush(lsn, true, false);
  
  		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
  
*** a/src/backend/replication/syncrep.c
--- b/src/backend/replication/syncrep.c
***************
*** 65,70 **** char	   *SyncRepStandbyNames;
--- 65,72 ----
  static bool announce_next_takeover = true;
  
  static int	SyncRepWaitMode = SYNC_REP_NO_WAIT;
+ static int	SyncTransferMode = SYNC_REP_NO_WAIT;
+ int		synchronous_transfer = SYNCHRONOUS_TRANSFER_COMMIT;
  
  static void SyncRepQueueInsert(int mode);
  static void SyncRepCancelWait(void);
***************
*** 85,109 **** static bool SyncRepQueueIsOrderedByLSN(int mode);
   * Wait for synchronous replication, if requested by user.
   *
   * Initially backends start in state SYNC_REP_NOT_WAITING and then
!  * change that state to SYNC_REP_WAITING before adding ourselves
!  * to the wait queue. During SyncRepWakeQueue() a WALSender changes
!  * the state to SYNC_REP_WAIT_COMPLETE once replication is confirmed.
!  * This backend then resets its state to SYNC_REP_NOT_WAITING.
   */
! void
! SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  {
  	char	   *new_status = NULL;
  	const char *old_status;
! 	int			mode = SyncRepWaitMode;
  
  	/*
  	 * Fast exit if user has not requested sync replication, or there are no
  	 * sync replication standby names defined. Note that those standbys don't
  	 * need to be connected.
  	 */
! 	if (!SyncRepRequested() || !SyncStandbysDefined())
! 		return;
  
  	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
  	Assert(WalSndCtl != NULL);
--- 87,147 ----
   * Wait for synchronous replication, if requested by user.
   *
   * Initially backends start in state SYNC_REP_NOT_WAITING and then
!  * change that state to SYNC_REP_WAITING/SYNC_REP_WAITING_FOR_DATA_FLUSH
!  * before adding ourselves to the wait queue. During SyncRepWakeQueue() a
!  * WALSender changes the state to SYNC_REP_WAIT_COMPLETE once replication is
!  * confirmed. This backend then resets its state to SYNC_REP_NOT_WAITING.
!  *
!  * ForDataFlush - if TRUE, we wait for the flushing data page.
!  * Otherwise wait for the sync standby
!  *
!  * Wait - if FALSE, we don't actually wait, but tell the caller whether or not
!  * the standby has already made progressed upto the given XactCommitLSN
!  *
!  * Return TRUE if either the sync standby is not
!  * configured/turned off OR the standby has made enough progress
   */
! bool
! SyncRepWaitForLSN(XLogRecPtr XactCommitLSN, bool ForDataFlush, bool Wait)
  {
  	char	   *new_status = NULL;
  	const char *old_status;
! 	int			mode = !ForDataFlush ? SyncRepWaitMode : SyncTransferMode;
! 	bool		ret;
  
  	/*
  	 * Fast exit if user has not requested sync replication, or there are no
  	 * sync replication standby names defined. Note that those standbys don't
  	 * need to be connected.
  	 */
! 	if ((!SyncRepRequested() || !SyncStandbysDefined()) &&
! 	    !SyncTransRequested() && !ForDataFlush)
! 		return true;
! 
! 	/*
! 	 * If the caller has specified ForDataFlush, but synchronous transfer
! 	 * is not specified or its turned off, exit.
! 	 *
! 	 * We would like to allow the failback safe mechanism even for cascaded
! 	 * standbys as well. But we can't really wait for the standby to catch
! 	 * up until we reach a consistent state since the standbys won't be
! 	 * even able to connect without us reaching in that state (XXX Confirm)
! 	 */
! 	if ((!SyncTransRequested()) && ForDataFlush)
! 		return true;
! 
! 	/*
! 	 * If the caller has not specified ForDataFlush, but synchronous commit
! 	 * is skipped by values of synchronous_transfer, exit.
! 	 */
! 	if (IsSyncRepSkipped() && !ForDataFlush)
! 		return true;
! 
! 	/*
! 	 *Exit if we are told not to block on the standby.
! 	 */
! 	if (!Wait)
! 		return false;
  
  	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
  	Assert(WalSndCtl != NULL);
***************
*** 119,129 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  	 * condition but we'll be fetching that cache line anyway so its likely to
  	 * be a low cost check.
  	 */
! 	if (!WalSndCtl->sync_standbys_defined ||
! 		XactCommitLSN <= WalSndCtl->lsn[mode])
  	{
  		LWLockRelease(SyncRepLock);
! 		return;
  	}
  
  	/*
--- 157,166 ----
  	 * condition but we'll be fetching that cache line anyway so its likely to
  	 * be a low cost check.
  	 */
! 	if ((!ForDataFlush && !WalSndCtl->sync_standbys_defined) || XactCommitLSN <= WalSndCtl->lsn[mode])
  	{
  		LWLockRelease(SyncRepLock);
! 		return true;
  	}
  
  	/*
***************
*** 150,155 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 187,194 ----
  		new_status[len] = '\0'; /* truncate off " waiting ..." */
  	}
  
+ 	ret = false;
+ 
  	/*
  	 * Wait for specified LSN to be confirmed.
  	 *
***************
*** 186,192 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 225,234 ----
  			LWLockRelease(SyncRepLock);
  		}
  		if (syncRepState == SYNC_REP_WAIT_COMPLETE)
+ 		{
+ 			ret = true;
  			break;
+ 		}
  
  		/*
  		 * If a wait for synchronous replication is pending, we can neither
***************
*** 263,268 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 305,312 ----
  		set_ps_display(new_status, false);
  		pfree(new_status);
  	}
+ 
+ 	return ret;
  }
  
  /*
***************
*** 370,375 **** SyncRepReleaseWaiters(void)
--- 414,420 ----
  	volatile WalSnd *syncWalSnd = NULL;
  	int			numwrite = 0;
  	int			numflush = 0;
+ 	int			numdataflush = 0;
  	int			priority = 0;
  	int			i;
  
***************
*** 379,389 **** SyncRepReleaseWaiters(void)
  	 * up, still running base backup or the current flush position is still
  	 * invalid, then leave quickly also.
  	 */
! 	if (MyWalSnd->sync_standby_priority == 0 ||
! 		MyWalSnd->state < WALSNDSTATE_STREAMING ||
  		XLogRecPtrIsInvalid(MyWalSnd->flush))
  		return;
- 
  	/*
  	 * We're a potential sync standby. Release waiters if we are the highest
  	 * priority standby. If there are multiple standbys with same priorities
--- 424,433 ----
  	 * up, still running base backup or the current flush position is still
  	 * invalid, then leave quickly also.
  	 */
! 
! 	if (MyWalSnd->state < WALSNDSTATE_STREAMING ||
  		XLogRecPtrIsInvalid(MyWalSnd->flush))
  		return;
  	/*
  	 * We're a potential sync standby. Release waiters if we are the highest
  	 * priority standby. If there are multiple standbys with same priorities
***************
*** 399,405 **** SyncRepReleaseWaiters(void)
  
  		if (walsnd->pid != 0 &&
  			walsnd->state == WALSNDSTATE_STREAMING &&
- 			walsnd->sync_standby_priority > 0 &&
  			(priority == 0 ||
  			 priority > walsnd->sync_standby_priority) &&
  			!XLogRecPtrIsInvalid(walsnd->flush))
--- 443,448 ----
***************
*** 428,449 **** SyncRepReleaseWaiters(void)
  	 * Set the lsn first so that when we wake backends they will release up to
  	 * this location.
  	 */
! 	if (walsndctl->lsn[SYNC_REP_WAIT_WRITE] < MyWalSnd->write)
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_WRITE] = MyWalSnd->write;
  		numwrite = SyncRepWakeQueue(false, SYNC_REP_WAIT_WRITE);
  	}
! 	if (walsndctl->lsn[SYNC_REP_WAIT_FLUSH] < MyWalSnd->flush)
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
  		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
  	}
  
  	LWLockRelease(SyncRepLock);
  
  	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X",
  		 numwrite, (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
! 	   numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
  
  	/*
  	 * If we are managing the highest priority standby, though we weren't
--- 471,497 ----
  	 * Set the lsn first so that when we wake backends they will release up to
  	 * this location.
  	 */
! 	if (walsndctl->lsn[SYNC_REP_WAIT_WRITE] <= MyWalSnd->write)
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_WRITE] = MyWalSnd->write;
  		numwrite = SyncRepWakeQueue(false, SYNC_REP_WAIT_WRITE);
  	}
! 	if (walsndctl->lsn[SYNC_REP_WAIT_FLUSH] <= MyWalSnd->flush)
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
  		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
  	}
+ 	if (walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] <= MyWalSnd->flush)
+ 	{
+ 		walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] = MyWalSnd->flush;
+ 		numdataflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_DATA_FLUSH);
+ 	}
  
  	LWLockRelease(SyncRepLock);
  
  	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X",
  		 numwrite, (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
! 		 numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
  
  	/*
  	 * If we are managing the highest priority standby, though we weren't
***************
*** 709,711 **** assign_synchronous_commit(int newval, void *extra)
--- 757,774 ----
  			break;
  	}
  }
+ 
+ void
+ assign_synchronous_transfer(int newval, void *extra)
+ {
+ 	switch (newval)
+ 	{
+ 		case SYNCHRONOUS_TRANSFER_ALL:
+ 		case SYNCHRONOUS_TRANSFER_DATA_FLUSH:
+ 			SyncTransferMode = SYNC_REP_WAIT_DATA_FLUSH;
+ 			break;
+ 		default:
+ 			SyncTransferMode = SYNC_REP_NO_WAIT;
+ 			break;
+ 	}
+ }
*** a/src/backend/storage/buffer/bufmgr.c
--- b/src/backend/storage/buffer/bufmgr.c
***************
*** 41,46 ****
--- 41,47 ----
  #include "pg_trace.h"
  #include "pgstat.h"
  #include "postmaster/bgwriter.h"
+ #include "replication/syncrep.h"
  #include "storage/buf_internals.h"
  #include "storage/bufmgr.h"
  #include "storage/ipc.h"
***************
*** 1975,1981 **** FlushBuffer(volatile BufferDesc *buf, SMgrRelation reln)
  	 * skip the flush if the buffer isn't permanent.
  	 */
  	if (buf->flags & BM_PERMANENT)
! 		XLogFlush(recptr);
  
  	/*
  	 * Now it's safe to write buffer to disk. Note that no one else should
--- 1976,1982 ----
  	 * skip the flush if the buffer isn't permanent.
  	 */
  	if (buf->flags & BM_PERMANENT)
! 		XLogFlush(recptr, true, true);
  
  	/*
  	 * Now it's safe to write buffer to disk. Note that no one else should
*** a/src/backend/utils/cache/relmapper.c
--- b/src/backend/utils/cache/relmapper.c
***************
*** 721,727 **** write_relmap_file(bool shared, RelMapFile *newmap,
  		lsn = XLogInsert(RM_RELMAP_ID, XLOG_RELMAP_UPDATE, rdata);
  
  		/* As always, WAL must hit the disk before the data update does */
! 		XLogFlush(lsn);
  	}
  
  	errno = 0;
--- 721,732 ----
  		lsn = XLogInsert(RM_RELMAP_ID, XLOG_RELMAP_UPDATE, rdata);
  
  		/* As always, WAL must hit the disk before the data update does */
! 		XLogFlush(lsn, true, false);
! 
! 		/*
! 		 * XXX Should we also wait for the failback safe standby to receive the
! 		 * WAL ?
! 		 */
  	}
  
  	errno = 0;
*** a/src/backend/utils/misc/guc.c
--- b/src/backend/utils/misc/guc.c
***************
*** 381,386 **** static const struct config_enum_entry synchronous_commit_options[] = {
--- 381,398 ----
  };
  
  /*
+  * Although only "all", "data_flush", and "commit" are documented, we
+  * accept all the likely variants of "off".
+  */
+ static const struct config_enum_entry synchronous_transfer_options[] = {
+ 	{"all", SYNCHRONOUS_TRANSFER_ALL, false},
+ 	{"data_flush", SYNCHRONOUS_TRANSFER_DATA_FLUSH, false},
+ 	{"commit", SYNCHRONOUS_TRANSFER_COMMIT, true},
+ 	{"0", SYNCHRONOUS_TRANSFER_COMMIT, true},
+ 	{NULL, 0, false}
+ };
+ 
+ /*
   * Options for enum values stored in other modules
   */
  extern const struct config_enum_entry wal_level_options[];
***************
*** 3266,3271 **** static struct config_enum ConfigureNamesEnum[] =
--- 3278,3293 ----
  	},
  
  	{
+ 		{"synchronous_transfer", PGC_SIGHUP, WAL_SETTINGS,
+ 			gettext_noop("Sets the data flush synchronization level"),
+ 			NULL
+ 		},
+ 		&synchronous_transfer,
+ 		SYNCHRONOUS_TRANSFER_COMMIT, synchronous_transfer_options,
+ 		NULL, assign_synchronous_transfer, NULL
+ 	},
+ 
+ 	{
  		{"trace_recovery_messages", PGC_SIGHUP, DEVELOPER_OPTIONS,
  			gettext_noop("Enables logging of recovery-related debugging information."),
  			gettext_noop("Each level includes all the levels that follow it. The later"
*** a/src/backend/utils/misc/postgresql.conf.sample
--- b/src/backend/utils/misc/postgresql.conf.sample
***************
*** 220,225 ****
--- 220,227 ----
  #synchronous_standby_names = ''	# standby servers that provide sync rep
  				# comma-separated list of application_name
  				# from standby(s); '*' = all
+ #synchronous_transfer = commit	# data page synchronization level
+ 				# commit, data_flush or all
  #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
  
  # - Standby Servers -
*** a/src/backend/utils/time/tqual.c
--- b/src/backend/utils/time/tqual.c
***************
*** 62,67 ****
--- 62,68 ----
  #include "access/subtrans.h"
  #include "access/transam.h"
  #include "access/xact.h"
+ #include "replication/syncrep.h"
  #include "storage/bufmgr.h"
  #include "storage/procarray.h"
  #include "utils/tqual.h"
***************
*** 118,123 **** SetHintBits(HeapTupleHeader tuple, Buffer buffer,
--- 119,133 ----
  
  		if (XLogNeedsFlush(commitLSN) && BufferIsPermanent(buffer))
  			return;				/* not flushed yet, so don't set hint */
+ 
+ 		/*
+ 		 * If synchronous_transfer is configured to data_flush or all, we should
+ 		 * also check if the commit WAL record has made to the standby before
+ 		 * allowing hint bit updates. We should not wait for the standby to receive
+ 		 * the WAL since its OK to delay hint bit updates
+ 		 */
+ 		if (!SyncRepWaitForLSN(commitLSN, true, false))
+ 			return;
  	}
  
  	tuple->t_infomask |= infomask;
*** a/src/include/access/xlog.h
--- b/src/include/access/xlog.h
***************
*** 261,267 **** typedef struct CheckpointStatsData
  extern CheckpointStatsData CheckpointStats;
  
  extern XLogRecPtr XLogInsert(RmgrId rmid, uint8 info, XLogRecData *rdata);
! extern void XLogFlush(XLogRecPtr RecPtr);
  extern bool XLogBackgroundFlush(void);
  extern bool XLogNeedsFlush(XLogRecPtr RecPtr);
  extern int	XLogFileInit(XLogSegNo segno, bool *use_existent, bool use_lock);
--- 261,267 ----
  extern CheckpointStatsData CheckpointStats;
  
  extern XLogRecPtr XLogInsert(RmgrId rmid, uint8 info, XLogRecData *rdata);
! extern void XLogFlush(XLogRecPtr RecPtr, bool ForDataFush, bool Wait);
  extern bool XLogBackgroundFlush(void);
  extern bool XLogNeedsFlush(XLogRecPtr RecPtr);
  extern int	XLogFileInit(XLogSegNo segno, bool *use_existent, bool use_lock);
*** a/src/include/replication/syncrep.h
--- b/src/include/replication/syncrep.h
***************
*** 19,41 ****
  #define SyncRepRequested() \
  	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
  
  /* SyncRepWaitMode */
! #define SYNC_REP_NO_WAIT		-1
! #define SYNC_REP_WAIT_WRITE		0
! #define SYNC_REP_WAIT_FLUSH		1
  
! #define NUM_SYNC_REP_WAIT_MODE	2
  
  /* syncRepState */
! #define SYNC_REP_NOT_WAITING		0
! #define SYNC_REP_WAITING			1
! #define SYNC_REP_WAIT_COMPLETE		2
  
  /* user-settable parameters for synchronous replication */
  extern char *SyncRepStandbyNames;
  
  /* called by user backend */
! extern void SyncRepWaitForLSN(XLogRecPtr XactCommitLSN);
  
  /* called at backend exit */
  extern void SyncRepCleanupAtProcExit(void);
--- 19,60 ----
  #define SyncRepRequested() \
  	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
  
+ #define SyncTransRequested() \
+ 	(max_wal_senders > 0 && synchronous_transfer > SYNCHRONOUS_TRANSFER_COMMIT)
+ 
+ #define IsSyncRepSkipped() \
+ 	(max_wal_senders > 0 && synchronous_transfer ==  SYNCHRONOUS_TRANSFER_DATA_FLUSH)
+ 
  /* SyncRepWaitMode */
! #define SYNC_REP_NO_WAIT					-1
! #define SYNC_REP_WAIT_WRITE					0
! #define SYNC_REP_WAIT_FLUSH					1
! #define SYNC_REP_WAIT_DATA_FLUSH	2
  
! #define NUM_SYNC_REP_WAIT_MODE				3
  
  /* syncRepState */
! #define SYNC_REP_NOT_WAITING					0
! #define SYNC_REP_WAITING						1
! #define SYNC_REP_WAIT_COMPLETE					2
! 
! typedef enum
! {
! 	SYNCHRONOUS_TRANSFER_COMMIT,		/* no wait for flush data page */
! 	SYNCHRONOUS_TRANSFER_DATA_FLUSH,	/* wait for data page flush only
! 										 * no wait for WAL */
! 	SYNCHRONOUS_TRANSFER_ALL	        /* wait for data page flush */
! }	SynchronousTransferLevel;
  
  /* user-settable parameters for synchronous replication */
  extern char *SyncRepStandbyNames;
  
+ /* user-settable parameters for failback safe replication */
+ extern int	synchronous_transfer;
+ 
  /* called by user backend */
! extern bool SyncRepWaitForLSN(XLogRecPtr XactCommitLSN,
! 		bool ForDataFlush, bool Wait);
  
  /* called at backend exit */
  extern void SyncRepCleanupAtProcExit(void);
***************
*** 52,56 **** extern int	SyncRepWakeQueue(bool all, int mode);
--- 71,76 ----
  
  extern bool check_synchronous_standby_names(char **newval, void **extra, GucSource source);
  extern void assign_synchronous_commit(int newval, void *extra);
+ extern void assign_synchronous_transfer(int newval, void *extra);
  
  #endif   /* _SYNCREP_H */

*** a/src/backend/access/transam/clog.c
--- b/src/backend/access/transam/clog.c
***************
*** 722,728 **** WriteTruncateXlogRec(int pageno)
  	rdata.buffer = InvalidBuffer;
  	rdata.next = NULL;
  	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
! 	XLogFlush(recptr);
  }
  
  /*
--- 722,728 ----
  	rdata.buffer = InvalidBuffer;
  	rdata.next = NULL;
  	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
! 	XLogFlush(recptr, true, false);
  }
  
  /*
*** a/src/backend/access/transam/slru.c
--- b/src/backend/access/transam/slru.c
***************
*** 696,704 **** SlruPhysicalWritePage(SlruCtl ctl, int pageno, int slotno, SlruFlush fdata)
  			 * XLogFlush were to fail, we must PANIC.  This isn't much of a
  			 * restriction because XLogFlush is just about all critical
  			 * section anyway, but let's make sure.
  			 */
  			START_CRIT_SECTION();
! 			XLogFlush(max_lsn);
  			END_CRIT_SECTION();
  		}
  	}
--- 696,706 ----
  			 * XLogFlush were to fail, we must PANIC.  This isn't much of a
  			 * restriction because XLogFlush is just about all critical
  			 * section anyway, but let's make sure.
+ 			 * Also wait for the synchronous standby to receive WAL upto
+ 			 * max_lsn.
  			 */
  			START_CRIT_SECTION();
! 			XLogFlush(max_lsn, true, true);
  			END_CRIT_SECTION();
  		}
  	}
*** a/src/backend/access/transam/twophase.c
--- b/src/backend/access/transam/twophase.c
***************
*** 1049,1055 **** EndPrepare(GlobalTransaction gxact)
  
  	gxact->prepare_lsn = XLogInsert(RM_XACT_ID, XLOG_XACT_PREPARE,
  									records.head);
! 	XLogFlush(gxact->prepare_lsn);
  
  	/* If we crash now, we have prepared: WAL replay will fix things */
  
--- 1049,1062 ----
  
  	gxact->prepare_lsn = XLogInsert(RM_XACT_ID, XLOG_XACT_PREPARE,
  									records.head);
! 
! 	/*
! 	 * Wait for synchronous replication, if required.
! 	 *
! 	 * Note that at this stage we have marked the prepare, but still show as
! 	 * running in the procarray (twice!) and continue to hold locks.
! 	 */
! 	XLogFlush(gxact->prepare_lsn, false, true);
  
  	/* If we crash now, we have prepared: WAL replay will fix things */
  
***************
*** 1090,1103 **** EndPrepare(GlobalTransaction gxact)
  
  	END_CRIT_SECTION();
  
- 	/*
- 	 * Wait for synchronous replication, if required.
- 	 *
- 	 * Note that at this stage we have marked the prepare, but still show as
- 	 * running in the procarray (twice!) and continue to hold locks.
- 	 */
- 	SyncRepWaitForLSN(gxact->prepare_lsn);
- 
  	records.tail = records.head = NULL;
  }
  
--- 1097,1102 ----
***************
*** 2046,2053 **** RecordTransactionCommitPrepared(TransactionId xid,
  	 * a contradiction)
  	 */
  
! 	/* Flush XLOG to disk */
! 	XLogFlush(recptr);
  
  	/* Mark the transaction committed in pg_clog */
  	TransactionIdCommitTree(xid, nchildren, children);
--- 2045,2058 ----
  	 * a contradiction)
  	 */
  
! 	/*
! 	 * Flush XLOG to disk,
! 	 * Wait for synchronous replication, if required.
! 	 *
! 	 * Note that at this stage we have marked clog, but still show as running
! 	 * in the procarray and continue to hold locks.
! 	 */
! 	XLogFlush(recptr, false, true);
  
  	/* Mark the transaction committed in pg_clog */
  	TransactionIdCommitTree(xid, nchildren, children);
***************
*** 2056,2069 **** RecordTransactionCommitPrepared(TransactionId xid,
  	MyPgXact->delayChkpt = false;
  
  	END_CRIT_SECTION();
- 
- 	/*
- 	 * Wait for synchronous replication, if required.
- 	 *
- 	 * Note that at this stage we have marked clog, but still show as running
- 	 * in the procarray and continue to hold locks.
- 	 */
- 	SyncRepWaitForLSN(recptr);
  }
  
  /*
--- 2061,2066 ----
***************
*** 2126,2133 **** RecordTransactionAbortPrepared(TransactionId xid,
  
  	recptr = XLogInsert(RM_XACT_ID, XLOG_XACT_ABORT_PREPARED, rdata);
  
! 	/* Always flush, since we're about to remove the 2PC state file */
! 	XLogFlush(recptr);
  
  	/*
  	 * Mark the transaction aborted in clog.  This is not absolutely necessary
--- 2123,2136 ----
  
  	recptr = XLogInsert(RM_XACT_ID, XLOG_XACT_ABORT_PREPARED, rdata);
  
! 	/*
! 	 * Always flush, since we're about to remove the 2PC state file.
! 	 * Wait for synchronous replication, if required.
! 	 *
! 	 * Note that at this stage we have marked clog, but still show as running
! 	 * in the procarray and continue to hold locks.
! 	 */
! 	XLogFlush(recptr, false, true);
  
  	/*
  	 * Mark the transaction aborted in clog.  This is not absolutely necessary
***************
*** 2136,2147 **** RecordTransactionAbortPrepared(TransactionId xid,
  	TransactionIdAbortTree(xid, nchildren, children);
  
  	END_CRIT_SECTION();
- 
- 	/*
- 	 * Wait for synchronous replication, if required.
- 	 *
- 	 * Note that at this stage we have marked clog, but still show as running
- 	 * in the procarray and continue to hold locks.
- 	 */
- 	SyncRepWaitForLSN(recptr);
  }
--- 2139,2142 ----
*** a/src/backend/access/transam/xact.c
--- b/src/backend/access/transam/xact.c
***************
*** 965,970 **** RecordTransactionCommit(void)
--- 965,971 ----
  	SharedInvalidationMessage *invalMessages = NULL;
  	bool		RelcacheInitFileInval = false;
  	bool		wrote_xlog;
+ 	bool		ret = false;
  
  	/* Get data needed for commit record */
  	nrels = smgrGetPendingDeletes(true, &rels);
***************
*** 1143,1150 **** RecordTransactionCommit(void)
  	if ((wrote_xlog && synchronous_commit > SYNCHRONOUS_COMMIT_OFF) ||
  		forceSyncCommit || nrels > 0)
  	{
! 		XLogFlush(XactLastRecEnd);
! 
  		/*
  		 * Now we may update the CLOG, if we wrote a COMMIT record above
  		 */
--- 1144,1151 ----
  	if ((wrote_xlog && synchronous_commit > SYNCHRONOUS_COMMIT_OFF) ||
  		forceSyncCommit || nrels > 0)
  	{
! 		XLogFlush(XactLastRecEnd, false, true);
! 		ret = true;
  		/*
  		 * Now we may update the CLOG, if we wrote a COMMIT record above
  		 */
***************
*** 1195,1201 **** RecordTransactionCommit(void)
  	 * in the procarray and continue to hold locks.
  	 */
  	if (wrote_xlog)
! 		SyncRepWaitForLSN(XactLastRecEnd);
  
  	/* Reset XactLastRecEnd until the next transaction writes something */
  	XactLastRecEnd = 0;
--- 1196,1202 ----
  	 * in the procarray and continue to hold locks.
  	 */
  	if (wrote_xlog)
! 		SyncRepWaitForLSN(XactLastRecEnd, false, !ret);
  
  	/* Reset XactLastRecEnd until the next transaction writes something */
  	XactLastRecEnd = 0;
***************
*** 4663,4669 **** xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
  		 * after deletion, but that would leave a small window where the
  		 * WAL-first rule would be violated.
  		 */
! 		XLogFlush(lsn);
  
  		for (i = 0; i < nrels; i++)
  		{
--- 4664,4670 ----
  		 * after deletion, but that would leave a small window where the
  		 * WAL-first rule would be violated.
  		 */
! 		XLogFlush(lsn, true, true);
  
  		for (i = 0; i < nrels; i++)
  		{
***************
*** 4690,4696 **** xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
  	 * for any user that requested ForceSyncCommit().
  	 */
  	if (XactCompletionForceSyncCommit(xinfo))
! 		XLogFlush(lsn);
  
  }
  
--- 4691,4697 ----
  	 * for any user that requested ForceSyncCommit().
  	 */
  	if (XactCompletionForceSyncCommit(xinfo))
! 		XLogFlush(lsn, true, false);
  
  }
  
*** a/src/backend/access/transam/xlog.c
--- b/src/backend/access/transam/xlog.c
***************
*** 1224,1230 **** begin:;
  	if (isLogSwitch)
  	{
  		TRACE_POSTGRESQL_XLOG_SWITCH();
! 		XLogFlush(EndPos);
  		/*
  		 * Even though we reserved the rest of the segment for us, which is
  		 * reflected in EndPos, we return a pointer to just the end of the
--- 1224,1230 ----
  	if (isLogSwitch)
  	{
  		TRACE_POSTGRESQL_XLOG_SWITCH();
! 		XLogFlush(EndPos, true, true);
  		/*
  		 * Even though we reserved the rest of the segment for us, which is
  		 * reflected in EndPos, we return a pointer to just the end of the
***************
*** 2996,3002 **** UpdateMinRecoveryPoint(XLogRecPtr lsn, bool force)
   * already held, and we try to avoid acquiring it if possible.
   */
  void
! XLogFlush(XLogRecPtr record)
  {
  	XLogRecPtr	WriteRqstPtr;
  	XLogwrtRqst WriteRqst;
--- 2996,3002 ----
   * already held, and we try to avoid acquiring it if possible.
   */
  void
! XLogFlush(XLogRecPtr record, bool ForDataFlush, bool Wait)
  {
  	XLogRecPtr	WriteRqstPtr;
  	XLogwrtRqst WriteRqst;
***************
*** 3134,3139 **** XLogFlush(XLogRecPtr record)
--- 3134,3141 ----
  	/* wake up walsenders now that we've released heavily contended locks */
  	WalSndWakeupProcessRequests();
  
+ 	SyncRepWaitForLSN(WriteRqstPtr, ForDataFlush, Wait);
+ 
  	/*
  	 * If we still haven't flushed to the request point then we have a
  	 * problem; most likely, the requested flush point is past end of XLOG.
***************
*** 8230,8236 **** CreateCheckPoint(int flags)
  						XLOG_CHECKPOINT_ONLINE,
  						&rdata);
  
! 	XLogFlush(recptr);
  
  	/*
  	 * We mustn't write any new WAL after a shutdown checkpoint, or it will be
--- 8232,8243 ----
  						XLOG_CHECKPOINT_ONLINE,
  						&rdata);
  
! 	/*
! 	 * At this point, ensure that the synchronous standby has received the
! 	 * checkpoint WAL. Otherwise failure after the control file update will
! 	 * cause the master to start from a location not known to the standby
! 	 */
! 	XLogFlush(recptr, true, !shutdown);
  
  	/*
  	 * We mustn't write any new WAL after a shutdown checkpoint, or it will be
***************
*** 8387,8393 **** CreateEndOfRecoveryRecord(void)
  
  	recptr = XLogInsert(RM_XLOG_ID, XLOG_END_OF_RECOVERY, &rdata);
  
! 	XLogFlush(recptr);
  
  	/*
  	 * Update the control file so that crash recovery can follow the timeline
--- 8394,8400 ----
  
  	recptr = XLogInsert(RM_XLOG_ID, XLOG_END_OF_RECOVERY, &rdata);
  
! 	XLogFlush(recptr, true, true);
  
  	/*
  	 * Update the control file so that crash recovery can follow the timeline
*** a/src/backend/catalog/storage.c
--- b/src/backend/catalog/storage.c
***************
*** 285,293 **** RelationTruncate(Relation rel, BlockNumber nblocks)
  		 * or visibility map. If we crashed during that window, we'd be left
  		 * with a truncated heap, but the FSM or visibility map would still
  		 * contain entries for the non-existent heap pages.
  		 */
  		if (fsm || vm)
! 			XLogFlush(lsn);
  	}
  
  	/* Do the real work */
--- 285,297 ----
  		 * or visibility map. If we crashed during that window, we'd be left
  		 * with a truncated heap, but the FSM or visibility map would still
  		 * contain entries for the non-existent heap pages.
+ 		 *
+ 		 * Also ensure that the WAL is received by the synchronous standby.
+ 		 * Otherwise, we may have a situation where the heap is truncated, but
+ 		 * the action never replayed on the standby
  		 */
  		if (fsm || vm)
! 			XLogFlush(lsn, true, true);
  	}
  
  	/* Do the real work */
***************
*** 519,525 **** smgr_redo(XLogRecPtr lsn, XLogRecord *record)
  		 * after truncation, but that would leave a small window where the
  		 * WAL-first rule could be violated.
  		 */
! 		XLogFlush(lsn);
  
  		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
  
--- 523,529 ----
  		 * after truncation, but that would leave a small window where the
  		 * WAL-first rule could be violated.
  		 */
! 		XLogFlush(lsn, true, false);
  
  		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
  
*** a/src/backend/replication/syncrep.c
--- b/src/backend/replication/syncrep.c
***************
*** 65,70 **** char	   *SyncRepStandbyNames;
--- 65,72 ----
  static bool announce_next_takeover = true;
  
  static int	SyncRepWaitMode = SYNC_REP_NO_WAIT;
+ static int	SyncTransferMode = SYNC_REP_NO_WAIT;
+ int		synchronous_transfer = SYNCHRONOUS_TRANSFER_COMMIT;
  
  static void SyncRepQueueInsert(int mode);
  static void SyncRepCancelWait(void);
***************
*** 85,109 **** static bool SyncRepQueueIsOrderedByLSN(int mode);
   * Wait for synchronous replication, if requested by user.
   *
   * Initially backends start in state SYNC_REP_NOT_WAITING and then
!  * change that state to SYNC_REP_WAITING before adding ourselves
!  * to the wait queue. During SyncRepWakeQueue() a WALSender changes
!  * the state to SYNC_REP_WAIT_COMPLETE once replication is confirmed.
!  * This backend then resets its state to SYNC_REP_NOT_WAITING.
   */
! void
! SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  {
  	char	   *new_status = NULL;
  	const char *old_status;
! 	int			mode = SyncRepWaitMode;
  
  	/*
  	 * Fast exit if user has not requested sync replication, or there are no
  	 * sync replication standby names defined. Note that those standbys don't
  	 * need to be connected.
  	 */
! 	if (!SyncRepRequested() || !SyncStandbysDefined())
! 		return;
  
  	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
  	Assert(WalSndCtl != NULL);
--- 87,141 ----
   * Wait for synchronous replication, if requested by user.
   *
   * Initially backends start in state SYNC_REP_NOT_WAITING and then
!  * change that state to SYNC_REP_WAITING/SYNC_REP_WAITING_FOR_DATA_FLUSH
!  * before adding ourselves to the wait queue. During SyncRepWakeQueue() a
!  * WALSender changes the state to SYNC_REP_WAIT_COMPLETE once replication is
!  * confirmed. This backend then resets its state to SYNC_REP_NOT_WAITING.
!  *
!  * ForDataFlush - if TRUE, we wait for the flushing data page.
!  * Otherwise wait for the sync standby
!  *
!  * Wait - if FALSE, we don't actually wait, but tell the caller whether or not
!  * the standby has already made progressed upto the given XactCommitLSN
!  *
!  * Return TRUE if either the sync standby is not
!  * configured/turned off OR the standby has made enough progress
   */
! bool
! SyncRepWaitForLSN(XLogRecPtr XactCommitLSN, bool ForDataFlush, bool Wait)
  {
  	char	   *new_status = NULL;
  	const char *old_status;
! 	int			mode = !ForDataFlush ? SyncRepWaitMode : SyncTransferMode;
! 	bool		ret;
  
  	/*
  	 * Fast exit if user has not requested sync replication, or there are no
  	 * sync replication standby names defined. Note that those standbys don't
  	 * need to be connected.
  	 */
! 	if ((!SyncRepRequested() || !SyncStandbysDefined()) &&
! 	    !SyncTransRequested() && !ForDataFlush)
! 		return true;
! 
! 	/*
! 	 * If the caller has specified ForDataFlush, but synchronous transfer
! 	 * is not specified or its turned off, exit.
! 	 *
! 	 * We would like to allow the failback safe mechanism even for cascaded
! 	 * standbys as well. But we can't really wait for the standby to catch
! 	 * up until we reach a consistent state since the standbys won't be
! 	 * even able to connect without us reaching in that state (XXX Confirm)
! 	 */
! 	if ((!SyncTransRequested()) && ForDataFlush)
! 		return true;
! 
! 	/*
! 	 * If the caller has not specified ForDataFlush, but synchronous commit
! 	 * is skipped by values of synchronous_transfer, exit.
! 	 */
! 	if (IsSyncRepSkipped() && !ForDataFlush)
! 		return true;
  
  	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
  	Assert(WalSndCtl != NULL);
***************
*** 118,129 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  	 * Also check that the standby hasn't already replied. Unlikely race
  	 * condition but we'll be fetching that cache line anyway so its likely to
  	 * be a low cost check.
  	 */
! 	if (!WalSndCtl->sync_standbys_defined ||
! 		XactCommitLSN <= WalSndCtl->lsn[mode])
  	{
  		LWLockRelease(SyncRepLock);
! 		return;
  	}
  
  	/*
--- 150,163 ----
  	 * Also check that the standby hasn't already replied. Unlikely race
  	 * condition but we'll be fetching that cache line anyway so its likely to
  	 * be a low cost check.
+ 	 * And if we are told not to block on the standby, exit
  	 */
! 	if ((!ForDataFlush && !WalSndCtl->sync_standbys_defined) ||
! 		XactCommitLSN <= WalSndCtl->lsn[mode] ||
! 		!Wait)
  	{
  		LWLockRelease(SyncRepLock);
! 		return true;
  	}
  
  	/*
***************
*** 150,155 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 184,191 ----
  		new_status[len] = '\0'; /* truncate off " waiting ..." */
  	}
  
+ 	ret = false;
+ 
  	/*
  	 * Wait for specified LSN to be confirmed.
  	 *
***************
*** 186,192 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 222,231 ----
  			LWLockRelease(SyncRepLock);
  		}
  		if (syncRepState == SYNC_REP_WAIT_COMPLETE)
+ 		{
+ 			ret = true;
  			break;
+ 		}
  
  		/*
  		 * If a wait for synchronous replication is pending, we can neither
***************
*** 263,268 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 302,309 ----
  		set_ps_display(new_status, false);
  		pfree(new_status);
  	}
+ 
+ 	return ret;
  }
  
  /*
***************
*** 370,375 **** SyncRepReleaseWaiters(void)
--- 411,417 ----
  	volatile WalSnd *syncWalSnd = NULL;
  	int			numwrite = 0;
  	int			numflush = 0;
+ 	int			numdataflush = 0;
  	int			priority = 0;
  	int			i;
  
***************
*** 379,389 **** SyncRepReleaseWaiters(void)
  	 * up, still running base backup or the current flush position is still
  	 * invalid, then leave quickly also.
  	 */
! 	if (MyWalSnd->sync_standby_priority == 0 ||
! 		MyWalSnd->state < WALSNDSTATE_STREAMING ||
  		XLogRecPtrIsInvalid(MyWalSnd->flush))
  		return;
- 
  	/*
  	 * We're a potential sync standby. Release waiters if we are the highest
  	 * priority standby. If there are multiple standbys with same priorities
--- 421,430 ----
  	 * up, still running base backup or the current flush position is still
  	 * invalid, then leave quickly also.
  	 */
! 
! 	if (MyWalSnd->state < WALSNDSTATE_STREAMING ||
  		XLogRecPtrIsInvalid(MyWalSnd->flush))
  		return;
  	/*
  	 * We're a potential sync standby. Release waiters if we are the highest
  	 * priority standby. If there are multiple standbys with same priorities
***************
*** 399,405 **** SyncRepReleaseWaiters(void)
  
  		if (walsnd->pid != 0 &&
  			walsnd->state == WALSNDSTATE_STREAMING &&
- 			walsnd->sync_standby_priority > 0 &&
  			(priority == 0 ||
  			 priority > walsnd->sync_standby_priority) &&
  			!XLogRecPtrIsInvalid(walsnd->flush))
--- 440,445 ----
***************
*** 428,449 **** SyncRepReleaseWaiters(void)
  	 * Set the lsn first so that when we wake backends they will release up to
  	 * this location.
  	 */
! 	if (walsndctl->lsn[SYNC_REP_WAIT_WRITE] < MyWalSnd->write)
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_WRITE] = MyWalSnd->write;
  		numwrite = SyncRepWakeQueue(false, SYNC_REP_WAIT_WRITE);
  	}
! 	if (walsndctl->lsn[SYNC_REP_WAIT_FLUSH] < MyWalSnd->flush)
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
  		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
  	}
  
  	LWLockRelease(SyncRepLock);
  
  	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X",
  		 numwrite, (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
! 	   numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
  
  	/*
  	 * If we are managing the highest priority standby, though we weren't
--- 468,494 ----
  	 * Set the lsn first so that when we wake backends they will release up to
  	 * this location.
  	 */
! 	if (walsndctl->lsn[SYNC_REP_WAIT_WRITE] <= MyWalSnd->write)
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_WRITE] = MyWalSnd->write;
  		numwrite = SyncRepWakeQueue(false, SYNC_REP_WAIT_WRITE);
  	}
! 	if (walsndctl->lsn[SYNC_REP_WAIT_FLUSH] <= MyWalSnd->flush)
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
  		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
  	}
+ 	if (walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] <= MyWalSnd->flush)
+ 	{
+ 		walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] = MyWalSnd->flush;
+ 		numdataflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_DATA_FLUSH);
+ 	}
  
  	LWLockRelease(SyncRepLock);
  
  	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X",
  		 numwrite, (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
! 		 numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
  
  	/*
  	 * If we are managing the highest priority standby, though we weren't
***************
*** 709,711 **** assign_synchronous_commit(int newval, void *extra)
--- 754,771 ----
  			break;
  	}
  }
+ 
+ void
+ assign_synchronous_transfer(int newval, void *extra)
+ {
+ 	switch (newval)
+ 	{
+ 		case SYNCHRONOUS_TRANSFER_ALL:
+ 		case SYNCHRONOUS_TRANSFER_DATA_FLUSH:
+ 			SyncTransferMode = SYNC_REP_WAIT_DATA_FLUSH;
+ 			break;
+ 		default:
+ 			SyncTransferMode = SYNC_REP_NO_WAIT;
+ 			break;
+ 	}
+ }
*** a/src/backend/storage/buffer/bufmgr.c
--- b/src/backend/storage/buffer/bufmgr.c
***************
*** 41,46 ****
--- 41,47 ----
  #include "pg_trace.h"
  #include "pgstat.h"
  #include "postmaster/bgwriter.h"
+ #include "replication/syncrep.h"
  #include "storage/buf_internals.h"
  #include "storage/bufmgr.h"
  #include "storage/ipc.h"
***************
*** 1975,1981 **** FlushBuffer(volatile BufferDesc *buf, SMgrRelation reln)
  	 * skip the flush if the buffer isn't permanent.
  	 */
  	if (buf->flags & BM_PERMANENT)
! 		XLogFlush(recptr);
  
  	/*
  	 * Now it's safe to write buffer to disk. Note that no one else should
--- 1976,1982 ----
  	 * skip the flush if the buffer isn't permanent.
  	 */
  	if (buf->flags & BM_PERMANENT)
! 		XLogFlush(recptr, true, true);
  
  	/*
  	 * Now it's safe to write buffer to disk. Note that no one else should
*** a/src/backend/utils/cache/relmapper.c
--- b/src/backend/utils/cache/relmapper.c
***************
*** 721,727 **** write_relmap_file(bool shared, RelMapFile *newmap,
  		lsn = XLogInsert(RM_RELMAP_ID, XLOG_RELMAP_UPDATE, rdata);
  
  		/* As always, WAL must hit the disk before the data update does */
! 		XLogFlush(lsn);
  	}
  
  	errno = 0;
--- 721,732 ----
  		lsn = XLogInsert(RM_RELMAP_ID, XLOG_RELMAP_UPDATE, rdata);
  
  		/* As always, WAL must hit the disk before the data update does */
! 		XLogFlush(lsn, true, false);
! 
! 		/*
! 		 * XXX Should we also wait for the failback safe standby to receive the
! 		 * WAL ?
! 		 */
  	}
  
  	errno = 0;
*** a/src/backend/utils/misc/guc.c
--- b/src/backend/utils/misc/guc.c
***************
*** 381,386 **** static const struct config_enum_entry synchronous_commit_options[] = {
--- 381,398 ----
  };
  
  /*
+  * Although only "all", "data_flush", and "commit" are documented, we
+  * accept all the likely variants of "off".
+  */
+ static const struct config_enum_entry synchronous_transfer_options[] = {
+ 	{"all", SYNCHRONOUS_TRANSFER_ALL, false},
+ 	{"data_flush", SYNCHRONOUS_TRANSFER_DATA_FLUSH, false},
+ 	{"commit", SYNCHRONOUS_TRANSFER_COMMIT, true},
+ 	{"0", SYNCHRONOUS_TRANSFER_COMMIT, true},
+ 	{NULL, 0, false}
+ };
+ 
+ /*
   * Options for enum values stored in other modules
   */
  extern const struct config_enum_entry wal_level_options[];
***************
*** 3277,3282 **** static struct config_enum ConfigureNamesEnum[] =
--- 3289,3304 ----
  	},
  
  	{
+ 		{"synchronous_transfer", PGC_SIGHUP, WAL_SETTINGS,
+ 			gettext_noop("Sets the data flush synchronization level"),
+ 			NULL
+ 		},
+ 		&synchronous_transfer,
+ 		SYNCHRONOUS_TRANSFER_COMMIT, synchronous_transfer_options,
+ 		NULL, assign_synchronous_transfer, NULL
+ 	},
+ 
+ 	{
  		{"trace_recovery_messages", PGC_SIGHUP, DEVELOPER_OPTIONS,
  			gettext_noop("Enables logging of recovery-related debugging information."),
  			gettext_noop("Each level includes all the levels that follow it. The later"
*** a/src/backend/utils/misc/postgresql.conf.sample
--- b/src/backend/utils/misc/postgresql.conf.sample
***************
*** 220,225 ****
--- 220,227 ----
  #synchronous_standby_names = ''	# standby servers that provide sync rep
  				# comma-separated list of application_name
  				# from standby(s); '*' = all
+ #synchronous_transfer = commit	# data page synchronization level
+ 				# commit, data_flush or all
  #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
  
  # - Standby Servers -
*** a/src/backend/utils/time/tqual.c
--- b/src/backend/utils/time/tqual.c
***************
*** 62,67 ****
--- 62,68 ----
  #include "access/subtrans.h"
  #include "access/transam.h"
  #include "access/xact.h"
+ #include "replication/syncrep.h"
  #include "storage/bufmgr.h"
  #include "storage/procarray.h"
  #include "utils/tqual.h"
***************
*** 118,123 **** SetHintBits(HeapTupleHeader tuple, Buffer buffer,
--- 119,133 ----
  
  		if (XLogNeedsFlush(commitLSN) && BufferIsPermanent(buffer))
  			return;				/* not flushed yet, so don't set hint */
+ 
+ 		/*
+ 		 * If synchronous_transfer is configured to data_flush or all, we should
+ 		 * also check if the commit WAL record has made to the standby before
+ 		 * allowing hint bit updates. We should not wait for the standby to receive
+ 		 * the WAL since its OK to delay hint bit updates
+ 		 */
+ 		if (!SyncRepWaitForLSN(commitLSN, true, false))
+ 			return;
  	}
  
  	tuple->t_infomask |= infomask;
*** a/src/include/access/xlog.h
--- b/src/include/access/xlog.h
***************
*** 262,268 **** typedef struct CheckpointStatsData
  extern CheckpointStatsData CheckpointStats;
  
  extern XLogRecPtr XLogInsert(RmgrId rmid, uint8 info, XLogRecData *rdata);
! extern void XLogFlush(XLogRecPtr RecPtr);
  extern bool XLogBackgroundFlush(void);
  extern bool XLogNeedsFlush(XLogRecPtr RecPtr);
  extern int	XLogFileInit(XLogSegNo segno, bool *use_existent, bool use_lock);
--- 262,268 ----
  extern CheckpointStatsData CheckpointStats;
  
  extern XLogRecPtr XLogInsert(RmgrId rmid, uint8 info, XLogRecData *rdata);
! extern void XLogFlush(XLogRecPtr RecPtr, bool ForDataFush, bool Wait);
  extern bool XLogBackgroundFlush(void);
  extern bool XLogNeedsFlush(XLogRecPtr RecPtr);
  extern int	XLogFileInit(XLogSegNo segno, bool *use_existent, bool use_lock);
*** a/src/include/replication/syncrep.h
--- b/src/include/replication/syncrep.h
***************
*** 19,41 ****
  #define SyncRepRequested() \
  	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
  
  /* SyncRepWaitMode */
! #define SYNC_REP_NO_WAIT		-1
! #define SYNC_REP_WAIT_WRITE		0
! #define SYNC_REP_WAIT_FLUSH		1
  
! #define NUM_SYNC_REP_WAIT_MODE	2
  
  /* syncRepState */
! #define SYNC_REP_NOT_WAITING		0
! #define SYNC_REP_WAITING			1
! #define SYNC_REP_WAIT_COMPLETE		2
  
  /* user-settable parameters for synchronous replication */
  extern char *SyncRepStandbyNames;
  
  /* called by user backend */
! extern void SyncRepWaitForLSN(XLogRecPtr XactCommitLSN);
  
  /* called at backend exit */
  extern void SyncRepCleanupAtProcExit(void);
--- 19,60 ----
  #define SyncRepRequested() \
  	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
  
+ #define SyncTransRequested() \
+ 	(max_wal_senders > 0 && synchronous_transfer > SYNCHRONOUS_TRANSFER_COMMIT)
+ 
+ #define IsSyncRepSkipped() \
+ 	(max_wal_senders > 0 && synchronous_transfer ==  SYNCHRONOUS_TRANSFER_DATA_FLUSH)
+ 
  /* SyncRepWaitMode */
! #define SYNC_REP_NO_WAIT					-1
! #define SYNC_REP_WAIT_WRITE					0
! #define SYNC_REP_WAIT_FLUSH					1
! #define SYNC_REP_WAIT_DATA_FLUSH	2
  
! #define NUM_SYNC_REP_WAIT_MODE				3
  
  /* syncRepState */
! #define SYNC_REP_NOT_WAITING					0
! #define SYNC_REP_WAITING						1
! #define SYNC_REP_WAIT_COMPLETE					2
! 
! typedef enum
! {
! 	SYNCHRONOUS_TRANSFER_COMMIT,		/* no wait for flush data page */
! 	SYNCHRONOUS_TRANSFER_DATA_FLUSH,	/* wait for data page flush only
! 										 * no wait for WAL */
! 	SYNCHRONOUS_TRANSFER_ALL	        /* wait for data page flush */
! }	SynchronousTransferLevel;
  
  /* user-settable parameters for synchronous replication */
  extern char *SyncRepStandbyNames;
  
+ /* user-settable parameters for failback safe replication */
+ extern int	synchronous_transfer;
+ 
  /* called by user backend */
! extern bool SyncRepWaitForLSN(XLogRecPtr XactCommitLSN,
! 		bool ForDataFlush, bool Wait);
  
  /* called at backend exit */
  extern void SyncRepCleanupAtProcExit(void);
***************
*** 52,56 **** extern int	SyncRepWakeQueue(bool all, int mode);
--- 71,76 ----
  
  extern bool check_synchronous_standby_names(char **newval, void **extra, GucSource source);
  extern void assign_synchronous_commit(int newval, void *extra);
+ extern void assign_synchronous_transfer(int newval, void *extra);
  
  #endif   /* _SYNCREP_H */

diff --git a/src/backend/access/transam/clog.c b/src/backend/access/transam/clog.c
index cb95aa3..05ac0fa 100644
--- a/src/backend/access/transam/clog.c
+++ b/src/backend/access/transam/clog.c
@@ -722,7 +722,7 @@ WriteTruncateXlogRec(int pageno)
 	rdata.buffer = InvalidBuffer;
 	rdata.next = NULL;
 	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
-	XLogFlush(recptr);
+	XLogFlush(recptr, true, true);
 }
 
 /*
diff --git a/src/backend/access/transam/slru.c b/src/backend/access/transam/slru.c
index 5a8f654..452af68 100644
--- a/src/backend/access/transam/slru.c
+++ b/src/backend/access/transam/slru.c
@@ -696,9 +696,11 @@ SlruPhysicalWritePage(SlruCtl ctl, int pageno, int slotno, SlruFlush fdata)
 			 * XLogFlush were to fail, we must PANIC.  This isn't much of a
 			 * restriction because XLogFlush is just about all critical
 			 * section anyway, but let's make sure.
+			 * Also wait for the synchronous standby to receive WAL upto
+			 * max_lsn.
 			 */
 			START_CRIT_SECTION();
-			XLogFlush(max_lsn);
+			XLogFlush(max_lsn, true, true);
 			END_CRIT_SECTION();
 		}
 	}
diff --git a/src/backend/access/transam/twophase.c b/src/backend/access/transam/twophase.c
index e975f8d..0c235c9 100644
--- a/src/backend/access/transam/twophase.c
+++ b/src/backend/access/transam/twophase.c
@@ -1049,7 +1049,14 @@ EndPrepare(GlobalTransaction gxact)
 
 	gxact->prepare_lsn = XLogInsert(RM_XACT_ID, XLOG_XACT_PREPARE,
 									records.head);
-	XLogFlush(gxact->prepare_lsn);
+
+	/*
+	 * Wait for synchronous replication, if required.
+	 *
+	 * Note that at this stage we have marked the prepare, but still show as
+	 * running in the procarray (twice!) and continue to hold locks.
+	 */
+	XLogFlush(gxact->prepare_lsn, false, true);
 
 	/* If we crash now, we have prepared: WAL replay will fix things */
 
@@ -1090,14 +1097,6 @@ EndPrepare(GlobalTransaction gxact)
 
 	END_CRIT_SECTION();
 
-	/*
-	 * Wait for synchronous replication, if required.
-	 *
-	 * Note that at this stage we have marked the prepare, but still show as
-	 * running in the procarray (twice!) and continue to hold locks.
-	 */
-	SyncRepWaitForLSN(gxact->prepare_lsn);
-
 	records.tail = records.head = NULL;
 }
 
@@ -2046,8 +2045,14 @@ RecordTransactionCommitPrepared(TransactionId xid,
 	 * a contradiction)
 	 */
 
-	/* Flush XLOG to disk */
-	XLogFlush(recptr);
+	/*
+	 * Flush XLOG to disk,
+	 * Wait for synchronous replication, if required.
+	 *
+	 * Note that at this stage we have marked clog, but still show as running
+	 * in the procarray and continue to hold locks.
+	 */
+	XLogFlush(recptr, false, true);
 
 	/* Mark the transaction committed in pg_clog */
 	TransactionIdCommitTree(xid, nchildren, children);
@@ -2056,14 +2061,6 @@ RecordTransactionCommitPrepared(TransactionId xid,
 	MyPgXact->delayChkpt = false;
 
 	END_CRIT_SECTION();
-
-	/*
-	 * Wait for synchronous replication, if required.
-	 *
-	 * Note that at this stage we have marked clog, but still show as running
-	 * in the procarray and continue to hold locks.
-	 */
-	SyncRepWaitForLSN(recptr);
 }
 
 /*
@@ -2126,8 +2123,14 @@ RecordTransactionAbortPrepared(TransactionId xid,
 
 	recptr = XLogInsert(RM_XACT_ID, XLOG_XACT_ABORT_PREPARED, rdata);
 
-	/* Always flush, since we're about to remove the 2PC state file */
-	XLogFlush(recptr);
+	/*
+	 * Always flush, since we're about to remove the 2PC state file.
+	 * Wait for synchronous replication, if required.
+	 *
+	 * Note that at this stage we have marked clog, but still show as running
+	 * in the procarray and continue to hold locks.
+	 */
+	XLogFlush(recptr, false, true);
 
 	/*
 	 * Mark the transaction aborted in clog.  This is not absolutely necessary
@@ -2136,12 +2139,4 @@ RecordTransactionAbortPrepared(TransactionId xid,
 	TransactionIdAbortTree(xid, nchildren, children);
 
 	END_CRIT_SECTION();
-
-	/*
-	 * Wait for synchronous replication, if required.
-	 *
-	 * Note that at this stage we have marked clog, but still show as running
-	 * in the procarray and continue to hold locks.
-	 */
-	SyncRepWaitForLSN(recptr);
 }
diff --git a/src/backend/access/transam/xact.c b/src/backend/access/transam/xact.c
index 31e868d..9331742 100644
--- a/src/backend/access/transam/xact.c
+++ b/src/backend/access/transam/xact.c
@@ -965,6 +965,7 @@ RecordTransactionCommit(void)
 	SharedInvalidationMessage *invalMessages = NULL;
 	bool		RelcacheInitFileInval = false;
 	bool		wrote_xlog;
+	bool		ret = false;
 
 	/* Get data needed for commit record */
 	nrels = smgrGetPendingDeletes(true, &rels);
@@ -1143,8 +1144,8 @@ RecordTransactionCommit(void)
 	if ((wrote_xlog && synchronous_commit > SYNCHRONOUS_COMMIT_OFF) ||
 		forceSyncCommit || nrels > 0)
 	{
-		XLogFlush(XactLastRecEnd);
-
+		XLogFlush(XactLastRecEnd, false, true);
+		ret = true;
 		/*
 		 * Now we may update the CLOG, if we wrote a COMMIT record above
 		 */
@@ -1195,7 +1196,7 @@ RecordTransactionCommit(void)
 	 * in the procarray and continue to hold locks.
 	 */
 	if (wrote_xlog)
-		SyncRepWaitForLSN(XactLastRecEnd);
+		SyncRepWaitForLSN(XactLastRecEnd, false, !ret);
 
 	/* Reset XactLastRecEnd until the next transaction writes something */
 	XactLastRecEnd = 0;
@@ -4663,7 +4664,7 @@ xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
 		 * after deletion, but that would leave a small window where the
 		 * WAL-first rule would be violated.
 		 */
-		XLogFlush(lsn);
+		XLogFlush(lsn, true, false);
 
 		for (i = 0; i < nrels; i++)
 		{
@@ -4690,7 +4691,7 @@ xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
 	 * for any user that requested ForceSyncCommit().
 	 */
 	if (XactCompletionForceSyncCommit(xinfo))
-		XLogFlush(lsn);
+		XLogFlush(lsn, true, false);
 
 }
 
diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index c9e3a7a..5f6b9ba 100644
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -1224,7 +1224,7 @@ begin:;
 	if (isLogSwitch)
 	{
 		TRACE_POSTGRESQL_XLOG_SWITCH();
-		XLogFlush(EndPos);
+		XLogFlush(EndPos, true, true);
 		/*
 		 * Even though we reserved the rest of the segment for us, which is
 		 * reflected in EndPos, we return a pointer to just the end of the
@@ -2996,7 +2996,7 @@ UpdateMinRecoveryPoint(XLogRecPtr lsn, bool force)
  * already held, and we try to avoid acquiring it if possible.
  */
 void
-XLogFlush(XLogRecPtr record)
+XLogFlush(XLogRecPtr record, bool ForDataFlush, bool Wait)
 {
 	XLogRecPtr	WriteRqstPtr;
 	XLogwrtRqst WriteRqst;
@@ -3134,6 +3134,8 @@ XLogFlush(XLogRecPtr record)
 	/* wake up walsenders now that we've released heavily contended locks */
 	WalSndWakeupProcessRequests();
 
+	SyncRepWaitForLSN(WriteRqstPtr, ForDataFlush, Wait);
+
 	/*
 	 * If we still haven't flushed to the request point then we have a
 	 * problem; most likely, the requested flush point is past end of XLOG.
@@ -8230,7 +8232,12 @@ CreateCheckPoint(int flags)
 						XLOG_CHECKPOINT_ONLINE,
 						&rdata);
 
-	XLogFlush(recptr);
+	/*
+	 * At this point, ensure that the synchronous standby has received the
+	 * checkpoint WAL. Otherwise failure after the control file update will
+	 * cause the master to start from a location not known to the standby
+	 */
+	XLogFlush(recptr, true, !shutdown);
 
 	/*
 	 * We mustn't write any new WAL after a shutdown checkpoint, or it will be
@@ -8387,7 +8394,7 @@ CreateEndOfRecoveryRecord(void)
 
 	recptr = XLogInsert(RM_XLOG_ID, XLOG_END_OF_RECOVERY, &rdata);
 
-	XLogFlush(recptr);
+	XLogFlush(recptr, true, true);
 
 	/*
 	 * Update the control file so that crash recovery can follow the timeline
diff --git a/src/backend/catalog/storage.c b/src/backend/catalog/storage.c
index 971a149..a77471b 100644
--- a/src/backend/catalog/storage.c
+++ b/src/backend/catalog/storage.c
@@ -285,9 +285,13 @@ RelationTruncate(Relation rel, BlockNumber nblocks)
 		 * or visibility map. If we crashed during that window, we'd be left
 		 * with a truncated heap, but the FSM or visibility map would still
 		 * contain entries for the non-existent heap pages.
+		 *
+		 * Also ensure that the WAL is received by the synchronous standby.
+		 * Otherwise, we may have a situation where the heap is truncated, but
+		 * the action never replayed on the standby
 		 */
 		if (fsm || vm)
-			XLogFlush(lsn);
+			XLogFlush(lsn, true, true);
 	}
 
 	/* Do the real work */
@@ -519,7 +523,7 @@ smgr_redo(XLogRecPtr lsn, XLogRecord *record)
 		 * after truncation, but that would leave a small window where the
 		 * WAL-first rule could be violated.
 		 */
-		XLogFlush(lsn);
+		XLogFlush(lsn, true, false);
 
 		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
 
diff --git a/src/backend/replication/syncrep.c b/src/backend/replication/syncrep.c
index 5424281..6a58350 100644
--- a/src/backend/replication/syncrep.c
+++ b/src/backend/replication/syncrep.c
@@ -65,6 +65,8 @@ char	   *SyncRepStandbyNames;
 static bool announce_next_takeover = true;
 
 static int	SyncRepWaitMode = SYNC_REP_NO_WAIT;
+static int	SyncTransferMode = SYNC_REP_NO_WAIT;
+int		synchronous_transfer = SYNCHRONOUS_TRANSFER_COMMIT;
 
 static void SyncRepQueueInsert(int mode);
 static void SyncRepCancelWait(void);
@@ -85,25 +87,55 @@ static bool SyncRepQueueIsOrderedByLSN(int mode);
  * Wait for synchronous replication, if requested by user.
  *
  * Initially backends start in state SYNC_REP_NOT_WAITING and then
- * change that state to SYNC_REP_WAITING before adding ourselves
- * to the wait queue. During SyncRepWakeQueue() a WALSender changes
- * the state to SYNC_REP_WAIT_COMPLETE once replication is confirmed.
- * This backend then resets its state to SYNC_REP_NOT_WAITING.
+ * change that state to SYNC_REP_WAITING/SYNC_REP_WAITING_FOR_DATA_FLUSH
+ * before adding ourselves to the wait queue. During SyncRepWakeQueue() a
+ * WALSender changes the state to SYNC_REP_WAIT_COMPLETE once replication is
+ * confirmed. This backend then resets its state to SYNC_REP_NOT_WAITING.
+ *
+ * ForDataFlush - if TRUE, we wait for the flushing data page.
+ * Otherwise wait for the sync standby
+ *
+ * Wait - if FALSE, we don't actually wait, but tell the caller whether or not
+ * the standby has already made progressed upto the given XactCommitLSN
+ *
+ * Return TRUE if either the sync standby is not
+ * configured/turned off OR the standby has made enough progress
  */
-void
-SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
+bool
+SyncRepWaitForLSN(XLogRecPtr XactCommitLSN, bool ForDataFlush, bool Wait)
 {
 	char	   *new_status = NULL;
 	const char *old_status;
-	int			mode = SyncRepWaitMode;
+	int			mode = !ForDataFlush ? SyncRepWaitMode : SyncTransferMode;
+	bool		ret;
 
 	/*
 	 * Fast exit if user has not requested sync replication, or there are no
 	 * sync replication standby names defined. Note that those standbys don't
 	 * need to be connected.
 	 */
-	if (!SyncRepRequested() || !SyncStandbysDefined())
-		return;
+	if ((!SyncRepRequested() || !SyncStandbysDefined()) &&
+	    !SyncTransRequested() && !ForDataFlush)
+		return true;
+
+	/*
+	 * If the caller has specified ForDataFlush, but synchronous transfer
+	 * is not specified or its turned off, exit.
+	 *
+	 * We would like to allow the failback safe mechanism even for cascaded
+	 * standbys as well. But we can't really wait for the standby to catch
+	 * up until we reach a consistent state since the standbys won't be
+	 * even able to connect without us reaching in that state (XXX Confirm)
+	 */
+	if ((!SyncTransRequested()) && ForDataFlush)
+		return true;
+
+	/*
+	 * If the caller has not specified ForDataFlush, but synchronous commit
+	 * is skipped by values of synchronous_transfer, exit.
+	 */
+	if (IsSyncRepSkipped() && !ForDataFlush)
+		return true;
 
 	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
 	Assert(WalSndCtl != NULL);
@@ -118,12 +150,14 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 	 * Also check that the standby hasn't already replied. Unlikely race
 	 * condition but we'll be fetching that cache line anyway so its likely to
 	 * be a low cost check.
+	 * And if we are told not to block on the standby, exit
 	 */
-	if (!WalSndCtl->sync_standbys_defined ||
-		XactCommitLSN <= WalSndCtl->lsn[mode])
+	if ((!ForDataFlush && !WalSndCtl->sync_standbys_defined) ||
+		XactCommitLSN <= WalSndCtl->lsn[mode] ||
+		!Wait)
 	{
 		LWLockRelease(SyncRepLock);
-		return;
+		return true;
 	}
 
 	/*
@@ -150,6 +184,8 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		new_status[len] = '\0'; /* truncate off " waiting ..." */
 	}
 
+	ret = false;
+
 	/*
 	 * Wait for specified LSN to be confirmed.
 	 *
@@ -186,7 +222,10 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 			LWLockRelease(SyncRepLock);
 		}
 		if (syncRepState == SYNC_REP_WAIT_COMPLETE)
+		{
+			ret = true;
 			break;
+		}
 
 		/*
 		 * If a wait for synchronous replication is pending, we can neither
@@ -263,6 +302,8 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		set_ps_display(new_status, false);
 		pfree(new_status);
 	}
+
+	return ret;
 }
 
 /*
@@ -370,6 +411,7 @@ SyncRepReleaseWaiters(void)
 	volatile WalSnd *syncWalSnd = NULL;
 	int			numwrite = 0;
 	int			numflush = 0;
+	int			numdataflush = 0;
 	int			priority = 0;
 	int			i;
 
@@ -379,11 +421,10 @@ SyncRepReleaseWaiters(void)
 	 * up, still running base backup or the current flush position is still
 	 * invalid, then leave quickly also.
 	 */
-	if (MyWalSnd->sync_standby_priority == 0 ||
-		MyWalSnd->state < WALSNDSTATE_STREAMING ||
+
+	if (MyWalSnd->state < WALSNDSTATE_STREAMING ||
 		XLogRecPtrIsInvalid(MyWalSnd->flush))
 		return;
-
 	/*
 	 * We're a potential sync standby. Release waiters if we are the highest
 	 * priority standby. If there are multiple standbys with same priorities
@@ -399,7 +440,6 @@ SyncRepReleaseWaiters(void)
 
 		if (walsnd->pid != 0 &&
 			walsnd->state == WALSNDSTATE_STREAMING &&
-			walsnd->sync_standby_priority > 0 &&
 			(priority == 0 ||
 			 priority > walsnd->sync_standby_priority) &&
 			!XLogRecPtrIsInvalid(walsnd->flush))
@@ -438,12 +478,17 @@ SyncRepReleaseWaiters(void)
 		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
 		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
 	}
+	if (walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] < MyWalSnd->flush)
+	{
+		walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] = MyWalSnd->flush;
+		numdataflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_DATA_FLUSH);
+	}
 
 	LWLockRelease(SyncRepLock);
 
 	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X",
 		 numwrite, (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
-	   numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
+		 numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
 
 	/*
 	 * If we are managing the highest priority standby, though we weren't
@@ -709,3 +754,18 @@ assign_synchronous_commit(int newval, void *extra)
 			break;
 	}
 }
+
+void
+assign_synchronous_transfer(int newval, void *extra)
+{
+	switch (newval)
+	{
+		case SYNCHRONOUS_TRANSFER_ALL:
+		case SYNCHRONOUS_TRANSFER_DATA_FLUSH:
+			SyncTransferMode = SYNC_REP_WAIT_DATA_FLUSH;
+			break;
+		default:
+			SyncTransferMode = SYNC_REP_NO_WAIT;
+			break;
+	}
+}
diff --git a/src/backend/storage/buffer/bufmgr.c b/src/backend/storage/buffer/bufmgr.c
index 8079226..fc603d7 100644
--- a/src/backend/storage/buffer/bufmgr.c
+++ b/src/backend/storage/buffer/bufmgr.c
@@ -41,6 +41,7 @@
 #include "pg_trace.h"
 #include "pgstat.h"
 #include "postmaster/bgwriter.h"
+#include "replication/syncrep.h"
 #include "storage/buf_internals.h"
 #include "storage/bufmgr.h"
 #include "storage/ipc.h"
@@ -1975,7 +1976,7 @@ FlushBuffer(volatile BufferDesc *buf, SMgrRelation reln)
 	 * skip the flush if the buffer isn't permanent.
 	 */
 	if (buf->flags & BM_PERMANENT)
-		XLogFlush(recptr);
+		XLogFlush(recptr, true, false);
 
 	/*
 	 * Now it's safe to write buffer to disk. Note that no one else should
diff --git a/src/backend/utils/cache/relmapper.c b/src/backend/utils/cache/relmapper.c
index 2c7d9f3..13eb2df 100644
--- a/src/backend/utils/cache/relmapper.c
+++ b/src/backend/utils/cache/relmapper.c
@@ -721,7 +721,12 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 		lsn = XLogInsert(RM_RELMAP_ID, XLOG_RELMAP_UPDATE, rdata);
 
 		/* As always, WAL must hit the disk before the data update does */
-		XLogFlush(lsn);
+		XLogFlush(lsn, true, true);
+
+		/*
+		 * XXX Should we also wait for the failback safe standby to receive the
+		 * WAL ?
+		 */
 	}
 
 	errno = 0;
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 5aefd1b..69568be 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -381,6 +381,18 @@ static const struct config_enum_entry synchronous_commit_options[] = {
 };
 
 /*
+ * Although only "all", "data_flush", and "commit" are documented, we
+ * accept all the likely variants of "off".
+ */
+static const struct config_enum_entry synchronous_transfer_options[] = {
+	{"all", SYNCHRONOUS_TRANSFER_ALL, false},
+	{"data_flush", SYNCHRONOUS_TRANSFER_DATA_FLUSH, false},
+	{"commit", SYNCHRONOUS_TRANSFER_COMMIT, true},
+	{"0", SYNCHRONOUS_TRANSFER_COMMIT, true},
+	{NULL, 0, false}
+};
+
+/*
  * Options for enum values stored in other modules
  */
 extern const struct config_enum_entry wal_level_options[];
@@ -3277,6 +3289,16 @@ static struct config_enum ConfigureNamesEnum[] =
 	},
 
 	{
+		{"synchronous_transfer", PGC_SIGHUP, WAL_SETTINGS,
+			gettext_noop("Sets the data flush synchronization level"),
+			NULL
+		},
+		&synchronous_transfer,
+		SYNCHRONOUS_TRANSFER_COMMIT, synchronous_transfer_options,
+		NULL, assign_synchronous_transfer, NULL
+	},
+
+	{
 		{"trace_recovery_messages", PGC_SIGHUP, DEVELOPER_OPTIONS,
 			gettext_noop("Enables logging of recovery-related debugging information."),
 			gettext_noop("Each level includes all the levels that follow it. The later"
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample
index d69a02b..d6603c2 100644
--- a/src/backend/utils/misc/postgresql.conf.sample
+++ b/src/backend/utils/misc/postgresql.conf.sample
@@ -220,6 +220,8 @@
 #synchronous_standby_names = ''	# standby servers that provide sync rep
 				# comma-separated list of application_name
 				# from standby(s); '*' = all
+#synchronous_transfer = commit	# data page synchronization level
+				# commit, data_flush or all
 #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
 
 # - Standby Servers -
diff --git a/src/backend/utils/time/tqual.c b/src/backend/utils/time/tqual.c
index 55563ea..c081ee0 100644
--- a/src/backend/utils/time/tqual.c
+++ b/src/backend/utils/time/tqual.c
@@ -62,6 +62,7 @@
 #include "access/subtrans.h"
 #include "access/transam.h"
 #include "access/xact.h"
+#include "replication/syncrep.h"
 #include "storage/bufmgr.h"
 #include "storage/procarray.h"
 #include "utils/tqual.h"
@@ -118,6 +119,15 @@ SetHintBits(HeapTupleHeader tuple, Buffer buffer,
 
 		if (XLogNeedsFlush(commitLSN) && BufferIsPermanent(buffer))
 			return;				/* not flushed yet, so don't set hint */
+
+		/*
+		 * If synchronous_transfer is configured to data_flush or all, we should
+		 * also check if the commit WAL record has made to the standby before
+		 * allowing hint bit updates. We should not wait for the standby to receive
+		 * the WAL since its OK to delay hint bit updates
+		 */
+		if (!SyncRepWaitForLSN(commitLSN, true, false))
+			return;
 	}
 
 	tuple->t_infomask |= infomask;
diff --git a/src/include/access/xlog.h b/src/include/access/xlog.h
index 002862c..68072d2 100644
--- a/src/include/access/xlog.h
+++ b/src/include/access/xlog.h
@@ -262,7 +262,7 @@ typedef struct CheckpointStatsData
 extern CheckpointStatsData CheckpointStats;
 
 extern XLogRecPtr XLogInsert(RmgrId rmid, uint8 info, XLogRecData *rdata);
-extern void XLogFlush(XLogRecPtr RecPtr);
+extern void XLogFlush(XLogRecPtr RecPtr, bool ForDataFush, bool Wait);
 extern bool XLogBackgroundFlush(void);
 extern bool XLogNeedsFlush(XLogRecPtr RecPtr);
 extern int	XLogFileInit(XLogSegNo segno, bool *use_existent, bool use_lock);
diff --git a/src/include/replication/syncrep.h b/src/include/replication/syncrep.h
index ac23ea6..4540625 100644
--- a/src/include/replication/syncrep.h
+++ b/src/include/replication/syncrep.h
@@ -19,23 +19,42 @@
 #define SyncRepRequested() \
 	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
 
+#define SyncTransRequested() \
+	(max_wal_senders > 0 && synchronous_transfer > SYNCHRONOUS_TRANSFER_COMMIT)
+
+#define IsSyncRepSkipped() \
+	(max_wal_senders > 0 && synchronous_transfer ==  SYNCHRONOUS_TRANSFER_DATA_FLUSH)
+
 /* SyncRepWaitMode */
-#define SYNC_REP_NO_WAIT		-1
-#define SYNC_REP_WAIT_WRITE		0
-#define SYNC_REP_WAIT_FLUSH		1
+#define SYNC_REP_NO_WAIT					-1
+#define SYNC_REP_WAIT_WRITE					0
+#define SYNC_REP_WAIT_FLUSH					1
+#define SYNC_REP_WAIT_DATA_FLUSH	2
 
-#define NUM_SYNC_REP_WAIT_MODE	2
+#define NUM_SYNC_REP_WAIT_MODE				3
 
 /* syncRepState */
-#define SYNC_REP_NOT_WAITING		0
-#define SYNC_REP_WAITING			1
-#define SYNC_REP_WAIT_COMPLETE		2
+#define SYNC_REP_NOT_WAITING					0
+#define SYNC_REP_WAITING						1
+#define SYNC_REP_WAIT_COMPLETE					2
+
+typedef enum
+{
+	SYNCHRONOUS_TRANSFER_COMMIT,		/* no wait for flush data page */
+	SYNCHRONOUS_TRANSFER_DATA_FLUSH,	/* wait for data page flush only
+										 * no wait for WAL */
+	SYNCHRONOUS_TRANSFER_ALL	        /* wait for data page flush */
+}	SynchronousTransferLevel;
 
 /* user-settable parameters for synchronous replication */
 extern char *SyncRepStandbyNames;
 
+/* user-settable parameters for failback safe replication */
+extern int	synchronous_transfer;
+
 /* called by user backend */
-extern void SyncRepWaitForLSN(XLogRecPtr XactCommitLSN);
+extern bool SyncRepWaitForLSN(XLogRecPtr XactCommitLSN,
+		bool ForDataFlush, bool Wait);
 
 /* called at backend exit */
 extern void SyncRepCleanupAtProcExit(void);
@@ -52,5 +71,6 @@ extern int	SyncRepWakeQueue(bool all, int mode);
 
 extern bool check_synchronous_standby_names(char **newval, void **extra, GucSource source);
 extern void assign_synchronous_commit(int newval, void *extra);
+extern void assign_synchronous_transfer(int newval, void *extra);
 
 #endif   /* _SYNCREP_H */

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 23ebc11..0b8d614 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1749,6 +1749,50 @@ include 'filename'
       </listitem>
      </varlistentry>
 
+     <varlistentry id="guc-synchronous-transfer" xreflabel="synchronous_transfer">
+      <term><varname>synchronous_transfer</varname> (<type>enum</type>)</term>
+      <indexterm>
+       <primary><varname>synchronous_transfer</> configuration parameter</primary>
+      </indexterm>
+      <listitem>
+       <para>
+        This parameter controls the synchronous nature of WAL transfer and
+        maintains file system level consistency between master server and
+        standby server. Specifies whether master server will wait for file
+        system level change (for example : modifying data page) before
+        corresponding WAL records are replicated to the standby server.
+       </para>
+       <para>
+        Valid values are <literal>commit</>, <literal>data_flush</> and
+        <literal>all</>. The default value is <literal>commit</>, meaning
+        that master only wait for transaction commits, this is equivalent
+        to turning off <literal>synchronous_transfer</> parameter and standby
+        server will behave as a <quote>synchronous standby </> in
+        Streaming Replication. When <literal>data_flush</>, master will
+        wait only for data page modifications but not for transaction
+        commits, hence the standby server will act as <quote>asynchronous
+        failback safe standby</>. When <literal> all</>, master will wait
+        for data page modifications as well as for transaction commits and
+        resultant standby server will act as <quote>synchronous failback safe
+        standby</>, to configure synchronous failback safe standby
+        <xref linkend="guc-synchronous-standby-names"> should be set.
+       </para>
+       <para>
+        Setting this parameter to <literal> commit</> will configure pure
+        Streaming Replication, on the other hand setting to <literal>
+        data_flush </> will make WAL transfer synchronous except transaction
+        commits. All WAL transfer can be made synchronous by setting this
+        parameter to <literal>all</> value.
+       </para>
+       <para>
+        Setting <literal>synchronous_transfer</> to <literal>data_flush</> or
+        <literal>all</> makes WAL transfer synchronous, but this wait is mostly
+        on background activities such as bgwriter. Hence this will not create
+        much performance overhead.
+       </para>
+      </listitem>
+     </varlistentry>
+
      <varlistentry id="guc-wal-sync-method" xreflabel="wal_sync_method">
       <term><varname>wal_sync_method</varname> (<type>enum</type>)</term>
       <indexterm>
@@ -2258,14 +2302,25 @@ include 'filename'
       </indexterm>
       <listitem>
        <para>
-        Specifies a comma-separated list of standby names that can support
-        <firstterm>synchronous replication</>, as described in
-        <xref linkend="synchronous-replication">.
-        At any one time there will be at most one active synchronous standby;
-        transactions waiting for commit will be allowed to proceed after
-        this standby server confirms receipt of their data.
-        The synchronous standby will be the first standby named in this list
-        that is both currently connected and streaming data in real-time
+        Specifies a comma-separated list of standby names. If this parameter
+        is set then standby will behave as synchronous standby in replication,
+        as described in <xref linkend="synchronous-replication"> or synchronous
+        failback safe standby, as described in <xref linkend="failback-safe">.
+        At any time there will be at most one active standby; when standby is
+        synchronous standby in replication, transactions waiting for commit
+        will be allowed to proceed after this standby server confirms receipt
+        of their data. But when standby is synchronous failback safe standby
+        data page modifications as well as transaction commits will be allowed
+        to proceed only after this standby server confirms receipt of their data.
+        If this parameter is set to empty value and
+        <xref linkend="guc-synchronous-transfer"> is set to <literal>data_flush</>
+        then standby is called as asynchronous failback safe standby and only
+        data page modifications will wait before corresponding WAL record is
+        replicated to standby.
+       </para>
+       <para>
+        Synchronous standby in replication will be the first standby named in
+        this list that is both currently connected and streaming data in real-time
         (as shown by a state of <literal>streaming</literal> in the
         <link linkend="monitoring-stats-views-table">
         <literal>pg_stat_replication</></link> view).
diff --git a/doc/src/sgml/high-availability.sgml b/doc/src/sgml/high-availability.sgml
index c8f6fa8..b2b42be 100644
--- a/doc/src/sgml/high-availability.sgml
+++ b/doc/src/sgml/high-availability.sgml
@@ -1140,6 +1140,70 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
 
    </sect3>
   </sect2>
+
+  <sect2 id="failback-safe">
+     <title>Setting up failback safe standby</title>
+
+   <indexterm zone="high-availability">
+       <primary>Setting up failback safe standby</primary>
+   </indexterm>
+
+   <para>
+    PostgreSQL Streaming Replication offers durability, but if master
+    crashes and particular WAL record is unable to reach to standby
+    server, then that WAL record is present on master server but not
+    on standby server. In such a case master is ahead of standby server
+    in term of WAL records and Data in database. This will lead to
+    file-system level inconsistency between master and standby server.
+   </para>
+
+   <para>
+    Due to this inconsistency fresh backup of new master onto new standby
+    is needed to re-prepare HA cluster. Taking fresh backup can be very
+    time consuming process when database is of large size. In such a case
+    disaster recovery can take very long time if Streaming Replication is
+    used to setup the high availability cluster. The reason for this is,
+    Synchronous Replication makes WAL transfer synchronous at the time of
+    transaction commit. This will ensure the durability until the HA cluster
+    is up, but there are certain cases such as heap page update which will
+    cause inconsistency at the time of disaster if the standby is failed to
+    receive WAL record corresponding to this heap page update.
+   </para>
+
+   <para>
+    If HA cluster is configured with failback safe standby then master will
+    wait for data page modifications before corresponding WAL record is replicated
+    to standby. Failback safe standby has a control over all WAL transfer
+    and will not make any file system level change until gets a confirmation
+    from standby server. Hence avoids the need of fresh backup by maintaining
+    consistency.
+   </para>
+
+   <sect3 id="Failback-safe-config">
+    <title>Basic Configuration</title>
+   <para>
+    Failback safe standby can be asynchronous or synchronous in nature.
+    This will depend upon whether master will wait for transaction commit
+    or not. By default failback safe mechanism is turned off.
+   </para>
+
+   <para>
+    The first step to configure HA with failback safe standby is to setup
+    streaming replication. Configuring synchronous failback safe standby
+    requires setting up  <xref linkend="guc-synchronous-transfer"> to
+    <literal>all</> and <xref linkend="guc-synchronous-standby-names">
+    must be set to a non-empty value. This configuration will cause each
+    commit and data page modification to wait for confirmation that standby
+    has written corresponding WAL record to durable storage. Configuring
+    asynchronous failback safe standby requires only setting up
+     <xref linkend="guc-synchronous-transfer"> to <literal> data_flush</>.
+    This configuration will cause only data page modifications to wait
+    for confirmation that standby has written corresponding WAL record
+    to durable storage.
+   </para>
+
+  </sect3>
+  </sect2>
   </sect1>
 
   <sect1 id="warm-standby-failover">
@@ -1201,12 +1265,28 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
    </para>
 
    <para>
-    So, switching from primary to standby server can be fast but requires
-    some time to re-prepare the failover cluster. Regular switching from
-    primary to standby is useful, since it allows regular downtime on
-    each system for maintenance. This also serves as a test of the
-    failover mechanism to ensure that it will really work when you need it.
-    Written administration procedures are advised.
+    At the time of failover there is a possibility of file-system level
+    inconsistency between old primary and old standby server hence
+    fresh backup from new master onto old master is needed for Configuring
+    former primary server as a new standby server. Without taking fresh
+    backup even if the new standby starts, streaming replication does not
+    start successfully. The activity of taking backup can be fast for small
+    database but for large database requires more time to re-prepare the
+    failover cluster and could break the service line agreement of crash
+    recovery. This situation can arise when HA cluster is configured through
+    Streaming Replication. The need of fresh backup and problem of long
+    recovery time can be solved by using if HA cluster is configured with
+    failback safe standby see <xref linkend="failback-safe">.
+    Failback safe standby makes WAL transfer synchronous at required places
+    and maintains the file-system level consistency between master and standby
+    server and the former primary can be easily configured as new standby server.
+   </para>
+
+   <para>
+    Regular switching from primary to standby is useful, since it allows
+    regular downtime on each system for maintenance. This also serves as
+    a test of the failover mechanism to ensure that it will really work
+    when you need it. Written administration procedures are advised.
    </para>
 
    <para>
diff --git a/doc/src/sgml/perform.sgml b/doc/src/sgml/perform.sgml
index 7868fe4..ec3bb53 100644
--- a/doc/src/sgml/perform.sgml
+++ b/doc/src/sgml/perform.sgml
@@ -1557,6 +1557,14 @@ SELECT * FROM x, y, a, b, c WHERE something AND somethingelse;
        corruption) in case of a crash of the <emphasis>database</> alone.
       </para>
      </listitem>
+
+     <listitem>
+      <para>
+       Set <xref linkend="guc-synchronous-transfer"> to commit; there is no
+       need to guard against database inconsistency between master and standby.
+       and it is feasible to take fresh backup at failback time.
+      </para>
+     </listitem>
     </itemizedlist>
    </para>
   </sect1>

diff --git a/src/backend/access/transam/clog.c b/src/backend/access/transam/clog.c
index cb95aa3..d216b2e 100644
--- a/src/backend/access/transam/clog.c
+++ b/src/backend/access/transam/clog.c
@@ -37,6 +37,8 @@
 #include "access/transam.h"
 #include "miscadmin.h"
 #include "pg_trace.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 
 /*
  * Defines for CLOG page sizes.  A page is the same BLCKSZ as is used
@@ -708,8 +710,10 @@ WriteZeroPageXlogRec(int pageno)
 /*
  * Write a TRUNCATE xlog record
  *
- * We must flush the xlog record to disk before returning --- see notes
- * in TruncateCLOG().
+ * Before returning we must flush the xlog record to disk
+ * and if synchronous transfer is requested wait for failback
+ * safe standby to receive WAL up to recptr.
+ * --- see notes in TruncateCLOG().
  */
 static void
 WriteTruncateXlogRec(int pageno)
@@ -723,6 +727,12 @@ WriteTruncateXlogRec(int pageno)
 	rdata.next = NULL;
 	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
 	XLogFlush(recptr);
+
+	/*
+	 * Wait for failback safe standby.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(recptr, true, true);
 }
 
 /*
diff --git a/src/backend/access/transam/slru.c b/src/backend/access/transam/slru.c
index 5e53593..edaee83 100644
--- a/src/backend/access/transam/slru.c
+++ b/src/backend/access/transam/slru.c
@@ -54,6 +54,8 @@
 #include "access/slru.h"
 #include "access/transam.h"
 #include "access/xlog.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/fd.h"
 #include "storage/shmem.h"
 #include "miscadmin.h"
@@ -744,6 +746,12 @@ SlruPhysicalWritePage(SlruCtl ctl, int pageno, int slotno, SlruFlush fdata)
 			START_CRIT_SECTION();
 			XLogFlush(max_lsn);
 			END_CRIT_SECTION();
+
+			/* If synchronous transfer is requested, wait for failback safe
+			 * standby to receive WAL up to max_lsn.
+			 */
+			if (SyncTransRequested())
+				SyncRepWaitForLSN(max_lsn, true, true);
 		}
 	}
 
diff --git a/src/backend/access/transam/twophase.c b/src/backend/access/transam/twophase.c
index e975f8d..38a9e9c 100644
--- a/src/backend/access/transam/twophase.c
+++ b/src/backend/access/transam/twophase.c
@@ -1091,12 +1091,12 @@ EndPrepare(GlobalTransaction gxact)
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked the prepare, but still show as
 	 * running in the procarray (twice!) and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(gxact->prepare_lsn);
+	SyncRepWaitForLSN(gxact->prepare_lsn, false, true);
 
 	records.tail = records.head = NULL;
 }
@@ -2058,12 +2058,12 @@ RecordTransactionCommitPrepared(TransactionId xid,
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(recptr);
+	SyncRepWaitForLSN(recptr, false, true);
 }
 
 /*
@@ -2138,10 +2138,10 @@ RecordTransactionAbortPrepared(TransactionId xid,
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(recptr);
+	SyncRepWaitForLSN(recptr, false, true);
 }
diff --git a/src/backend/access/transam/xact.c b/src/backend/access/transam/xact.c
index 0591f3f..25210df 100644
--- a/src/backend/access/transam/xact.c
+++ b/src/backend/access/transam/xact.c
@@ -1189,13 +1189,13 @@ RecordTransactionCommit(void)
 	latestXid = TransactionIdLatest(xid, nchildren, children);
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
 	if (wrote_xlog)
-		SyncRepWaitForLSN(XactLastRecEnd);
+		SyncRepWaitForLSN(XactLastRecEnd, false, true);
 
 	/* Reset XactLastRecEnd until the next transaction writes something */
 	XactLastRecEnd = 0;
@@ -4690,8 +4690,17 @@ xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
 	 * for any user that requested ForceSyncCommit().
 	 */
 	if (XactCompletionForceSyncCommit(xinfo))
+	{
 		XLogFlush(lsn);
 
+		/*
+		 * If synchronous transfer is requested, wait for failback safe
+		 * standby to receive WAL up to lsn,
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
+
+	}
 }
 
 /*
diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index dc47c47..e8e118c 100644
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -39,8 +39,10 @@
 #include "pgstat.h"
 #include "postmaster/bgwriter.h"
 #include "postmaster/startup.h"
+#include "replication/syncrep.h"
 #include "replication/walreceiver.h"
 #include "replication/walsender.h"
+#include "replication/syncrep.h"
 #include "storage/barrier.h"
 #include "storage/bufmgr.h"
 #include "storage/fd.h"
@@ -8278,6 +8280,18 @@ CreateCheckPoint(int flags)
 	END_CRIT_SECTION();
 
 	/*
+	 * If synchronous transfer is requested, wait for failback safe standby
+	 * to receive WAL up to checkpoint WAL record. Otherwise if failure occurs
+	 * before standby receives CHECKPOINT WAL record causes an inconsistency
+	 * between control files of master and standby. Because of this master will
+	 * start from a location which is not known to the standby at the time fail-over.
+	 *
+	 * There is no need to wait for shutdown CHECKPOINT.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(recptr, true, !shutdown);
+
+	/*
 	 * Let smgr do post-checkpoint cleanup (eg, deleting old files).
 	 */
 	smgrpostckpt();
diff --git a/src/backend/catalog/storage.c b/src/backend/catalog/storage.c
index 971a149..050a6ba 100644
--- a/src/backend/catalog/storage.c
+++ b/src/backend/catalog/storage.c
@@ -25,6 +25,8 @@
 #include "catalog/catalog.h"
 #include "catalog/storage.h"
 #include "catalog/storage_xlog.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/freespace.h"
 #include "storage/smgr.h"
 #include "utils/memutils.h"
@@ -288,6 +290,14 @@ RelationTruncate(Relation rel, BlockNumber nblocks)
 		 */
 		if (fsm || vm)
 			XLogFlush(lsn);
+
+		/*
+		 * If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to lsn. Otherwise, we may have a situation where
+		 * the heap is truncated, but the action never replayed on the standby.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
 	}
 
 	/* Do the real work */
@@ -521,6 +531,13 @@ smgr_redo(XLogRecPtr lsn, XLogRecord *record)
 		 */
 		XLogFlush(lsn);
 
+		/*
+		 * If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to lsn.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
+
 		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
 
 		/* Also tell xlogutils.c about it */
diff --git a/src/backend/replication/syncrep.c b/src/backend/replication/syncrep.c
index 8cf1346..f5cc21c 100644
--- a/src/backend/replication/syncrep.c
+++ b/src/backend/replication/syncrep.c
@@ -66,6 +66,8 @@ char	   *SyncRepStandbyNames;
 static bool announce_next_takeover = true;
 
 static int	SyncRepWaitMode = SYNC_REP_NO_WAIT;
+static int	SyncTransferMode = SYNC_REP_NO_WAIT;
+int		synchronous_transfer = SYNCHRONOUS_TRANSFER_COMMIT;
 
 static void SyncRepQueueInsert(int mode);
 static void SyncRepCancelWait(void);
@@ -83,20 +85,30 @@ static bool SyncRepQueueIsOrderedByLSN(int mode);
  */
 
 /*
- * Wait for synchronous replication, if requested by user.
+ * Wait for synchronous/failback safe standby, if requested by user.
  *
  * Initially backends start in state SYNC_REP_NOT_WAITING and then
- * change that state to SYNC_REP_WAITING before adding ourselves
- * to the wait queue. During SyncRepWakeQueue() a WALSender changes
- * the state to SYNC_REP_WAIT_COMPLETE once replication is confirmed.
- * This backend then resets its state to SYNC_REP_NOT_WAITING.
+ * change that state to SYNC_REP_WAITING/SYNC_REP_WAITING_FOR_DATA_FLUSH
+ * before adding ourselves to the wait queue. During SyncRepWakeQueue() a
+ * WALSender changes the state to SYNC_REP_WAIT_COMPLETE once replication is
+ * confirmed. This backend then resets its state to SYNC_REP_NOT_WAITING.
+ *
+ * ForDataFlush - if TRUE, we wait before flushing data page.
+ * Otherwise wait for the sync standby
+ *
+ * Wait - if FALSE, we don't actually wait, but tell the caller whether or not
+ * the standby has already made progressed upto the given XactCommitLSN
+ *
+ * Return TRUE if either the synchronous standby/failback safe standby is not
+ * configured/turned off OR the standby has made enough progress
  */
-void
-SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
+bool
+SyncRepWaitForLSN(XLogRecPtr XactCommitLSN, bool ForDataFlush, bool Wait)
 {
 	char	   *new_status = NULL;
 	const char *old_status;
-	int			mode = SyncRepWaitMode;
+	int			mode = !ForDataFlush ? SyncRepWaitMode : SyncTransferMode;
+	bool		ret;
 
 	/*
 	 * Fast exit if user has not requested sync replication, or there are no
@@ -104,7 +116,26 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 	 * need to be connected.
 	 */
 	if (!SyncRepRequested() || !SyncStandbysDefined())
-		return;
+		return true;
+
+	/*
+	 * If the caller has specified ForDataFlush, but synchronous transfer
+	 * is not specified or its turned off, exit.
+	 *
+	 * We would like to allow the failback safe mechanism even for cascaded
+	 * standbys as well. But we can't really wait for the standby to catch
+	 * up until we reach a consistent state since the standbys won't be
+	 * even able to connect without us reaching in that state (XXX Confirm)
+	 */
+	if ((!SyncTransRequested()) && ForDataFlush)
+		return true;
+
+	/*
+	 * If the caller has not specified ForDataFlush, but synchronous commit
+	 * is skipped by values of synchronous_transfer, exit.
+	 */
+	if (IsSyncRepSkipped() && !ForDataFlush)
+		return true;
 
 	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
 	Assert(WalSndCtl != NULL);
@@ -120,11 +151,20 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 	 * condition but we'll be fetching that cache line anyway so it's likely to
 	 * be a low cost check.
 	 */
-	if (!WalSndCtl->sync_standbys_defined ||
+	if ((!ForDataFlush && !WalSndCtl->sync_standbys_defined) ||
 		XactCommitLSN <= WalSndCtl->lsn[mode])
 	{
 		LWLockRelease(SyncRepLock);
-		return;
+		return true;
+	}
+
+	/*
+	 * Exit if we are told not to block on the standby.
+	 */
+	if (!Wait)
+	{
+		LWLockRelease(SyncRepLock);
+		return false;
 	}
 
 	/*
@@ -151,6 +191,8 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		new_status[len] = '\0'; /* truncate off " waiting ..." */
 	}
 
+	ret = false;
+
 	/*
 	 * Wait for specified LSN to be confirmed.
 	 *
@@ -187,7 +229,10 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 			LWLockRelease(SyncRepLock);
 		}
 		if (syncRepState == SYNC_REP_WAIT_COMPLETE)
+		{
+			ret = true;
 			break;
+		}
 
 		/*
 		 * If a wait for synchronous replication is pending, we can neither
@@ -264,6 +309,8 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		set_ps_display(new_status, false);
 		pfree(new_status);
 	}
+
+	return ret;
 }
 
 /*
@@ -371,6 +418,7 @@ SyncRepReleaseWaiters(void)
 	volatile WalSnd *syncWalSnd = NULL;
 	int			numwrite = 0;
 	int			numflush = 0;
+	int			numdataflush = 0;
 	int			priority = 0;
 	int			i;
 
@@ -438,13 +486,20 @@ SyncRepReleaseWaiters(void)
 	{
 		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
 		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
+
+	}
+	if (walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] < MyWalSnd->flush)
+	{
+		walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] = MyWalSnd->flush;
+		numdataflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_DATA_FLUSH);
+
 	}
 
 	LWLockRelease(SyncRepLock);
 
 	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X",
 		 numwrite, (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
-	   numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
+		 numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
 
 	/*
 	 * If we are managing the highest priority standby, though we weren't
@@ -710,3 +765,18 @@ assign_synchronous_commit(int newval, void *extra)
 			break;
 	}
 }
+
+void
+assign_synchronous_transfer(int newval, void *extra)
+{
+	switch (newval)
+	{
+		case SYNCHRONOUS_TRANSFER_ALL:
+		case SYNCHRONOUS_TRANSFER_DATA_FLUSH:
+			SyncTransferMode = SYNC_REP_WAIT_DATA_FLUSH;
+			break;
+		default:
+			SyncTransferMode = SYNC_REP_NO_WAIT;
+			break;
+	}
+}
diff --git a/src/backend/replication/walsender.c b/src/backend/replication/walsender.c
index afd559d..492e039 100644
--- a/src/backend/replication/walsender.c
+++ b/src/backend/replication/walsender.c
@@ -1539,6 +1539,10 @@ XLogSend(bool *caughtup)
 
 		*caughtup = true;
 
+		elog(WARNING, "XLogSend sendTimeLineValidUpto(%X/%X) <= sentPtr(%X/%X) AND sendTImeLine",
+			 (uint32) (sendTimeLineValidUpto >> 32), (uint32) sendTimeLineValidUpto,
+			 (uint32) (sentPtr >> 32), (uint32) sentPtr);
+
 		elog(DEBUG1, "walsender reached end of timeline at %X/%X (sent up to %X/%X)",
 			 (uint32) (sendTimeLineValidUpto >> 32), (uint32) sendTimeLineValidUpto,
 			 (uint32) (sentPtr >> 32), (uint32) sentPtr);
diff --git a/src/backend/storage/buffer/bufmgr.c b/src/backend/storage/buffer/bufmgr.c
index f848391..7a2e285 100644
--- a/src/backend/storage/buffer/bufmgr.c
+++ b/src/backend/storage/buffer/bufmgr.c
@@ -41,6 +41,8 @@
 #include "pg_trace.h"
 #include "pgstat.h"
 #include "postmaster/bgwriter.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/buf_internals.h"
 #include "storage/bufmgr.h"
 #include "storage/ipc.h"
@@ -1975,8 +1977,14 @@ FlushBuffer(volatile BufferDesc *buf, SMgrRelation reln)
 	 * skip the flush if the buffer isn't permanent.
 	 */
 	if (buf->flags & BM_PERMANENT)
+	{
 		XLogFlush(recptr);
-
+		/* If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to recptr.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(recptr, true, true);
+	}
 	/*
 	 * Now it's safe to write buffer to disk. Note that no one else should
 	 * have been able to write it while we were busy with log flushing because
diff --git a/src/backend/utils/cache/relmapper.c b/src/backend/utils/cache/relmapper.c
index 18f0342..e92b607 100644
--- a/src/backend/utils/cache/relmapper.c
+++ b/src/backend/utils/cache/relmapper.c
@@ -48,6 +48,8 @@
 #include "catalog/pg_tablespace.h"
 #include "catalog/storage.h"
 #include "miscadmin.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/fd.h"
 #include "storage/lwlock.h"
 #include "utils/inval.h"
@@ -711,6 +713,7 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	int			fd;
 	RelMapFile *realmap;
 	char		mapfilename[MAXPGPATH];
+	XLogRecPtr	lsn=InvalidXLogRecPtr;
 
 	/*
 	 * Fill in the overhead fields and update CRC.
@@ -753,7 +756,6 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	{
 		xl_relmap_update xlrec;
 		XLogRecData rdata[2];
-		XLogRecPtr	lsn;
 
 		/* now errors are fatal ... */
 		START_CRIT_SECTION();
@@ -775,6 +777,7 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 
 		/* As always, WAL must hit the disk before the data update does */
 		XLogFlush(lsn);
+
 	}
 
 	errno = 0;
@@ -849,6 +852,13 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	/* Critical section done */
 	if (write_wal)
 		END_CRIT_SECTION();
+
+	/*
+	 * If synchronous transfer is requested, wait for failback safe
+	 * standby to receive WAL up to recptr.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(lsn, true, true);
 }
 
 /*
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 7d297bc..7e226a5 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -381,6 +381,18 @@ static const struct config_enum_entry synchronous_commit_options[] = {
 };
 
 /*
+ * Although only "all", "data_flush", and "commit" are documented, we
+ * accept all the likely variants of "off".
+ */
+static const struct config_enum_entry synchronous_transfer_options[] = {
+	{"all", SYNCHRONOUS_TRANSFER_ALL, false},
+	{"data_flush", SYNCHRONOUS_TRANSFER_DATA_FLUSH, false},
+	{"commit", SYNCHRONOUS_TRANSFER_COMMIT, true},
+	{"0", SYNCHRONOUS_TRANSFER_COMMIT, true},
+	{NULL, 0, false}
+};
+
+/*
  * Options for enum values stored in other modules
  */
 extern const struct config_enum_entry wal_level_options[];
@@ -3288,6 +3300,16 @@ static struct config_enum ConfigureNamesEnum[] =
 	},
 
 	{
+		{"synchronous_transfer", PGC_SIGHUP, WAL_SETTINGS,
+			gettext_noop("Sets the data flush synchronization level"),
+			NULL
+		},
+		&synchronous_transfer,
+		SYNCHRONOUS_TRANSFER_COMMIT, synchronous_transfer_options,
+		NULL, assign_synchronous_transfer, NULL
+	},
+
+	{
 		{"trace_recovery_messages", PGC_SIGHUP, DEVELOPER_OPTIONS,
 			gettext_noop("Enables logging of recovery-related debugging information."),
 			gettext_noop("Each level includes all the levels that follow it. The later"
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample
index d69a02b..d6603c2 100644
--- a/src/backend/utils/misc/postgresql.conf.sample
+++ b/src/backend/utils/misc/postgresql.conf.sample
@@ -220,6 +220,8 @@
 #synchronous_standby_names = ''	# standby servers that provide sync rep
 				# comma-separated list of application_name
 				# from standby(s); '*' = all
+#synchronous_transfer = commit	# data page synchronization level
+				# commit, data_flush or all
 #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
 
 # - Standby Servers -
diff --git a/src/backend/utils/time/tqual.c b/src/backend/utils/time/tqual.c
index ed66c49..6cf3f26 100644
--- a/src/backend/utils/time/tqual.c
+++ b/src/backend/utils/time/tqual.c
@@ -60,6 +60,8 @@
 #include "access/subtrans.h"
 #include "access/transam.h"
 #include "access/xact.h"
+#include "replication/walsender.h"
+#include "replication/syncrep.h"
 #include "storage/bufmgr.h"
 #include "storage/procarray.h"
 #include "utils/tqual.h"
@@ -115,6 +117,18 @@ SetHintBits(HeapTupleHeader tuple, Buffer buffer,
 
 		if (XLogNeedsFlush(commitLSN) && BufferIsPermanent(buffer))
 			return;				/* not flushed yet, so don't set hint */
+
+		/*
+		 * If synchronous transfer is requested, we check if the commit WAL record
+		 * has made to the standby before allowing hint bit updates. We should not
+		 * wait for the standby to receive the WAL since its OK to delay hint bit
+		 * updates.
+		 */
+		if (SyncTransRequested())
+		{
+			if(!SyncRepWaitForLSN(commitLSN, true, false))
+				return;
+		}
 	}
 
 	tuple->t_infomask |= infomask;
diff --git a/src/include/replication/syncrep.h b/src/include/replication/syncrep.h
index ac23ea6..4540625 100644
--- a/src/include/replication/syncrep.h
+++ b/src/include/replication/syncrep.h
@@ -19,23 +19,42 @@
 #define SyncRepRequested() \
 	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
 
+#define SyncTransRequested() \
+	(max_wal_senders > 0 && synchronous_transfer > SYNCHRONOUS_TRANSFER_COMMIT)
+
+#define IsSyncRepSkipped() \
+	(max_wal_senders > 0 && synchronous_transfer ==  SYNCHRONOUS_TRANSFER_DATA_FLUSH)
+
 /* SyncRepWaitMode */
-#define SYNC_REP_NO_WAIT		-1
-#define SYNC_REP_WAIT_WRITE		0
-#define SYNC_REP_WAIT_FLUSH		1
+#define SYNC_REP_NO_WAIT					-1
+#define SYNC_REP_WAIT_WRITE					0
+#define SYNC_REP_WAIT_FLUSH					1
+#define SYNC_REP_WAIT_DATA_FLUSH	2
 
-#define NUM_SYNC_REP_WAIT_MODE	2
+#define NUM_SYNC_REP_WAIT_MODE				3
 
 /* syncRepState */
-#define SYNC_REP_NOT_WAITING		0
-#define SYNC_REP_WAITING			1
-#define SYNC_REP_WAIT_COMPLETE		2
+#define SYNC_REP_NOT_WAITING					0
+#define SYNC_REP_WAITING						1
+#define SYNC_REP_WAIT_COMPLETE					2
+
+typedef enum
+{
+	SYNCHRONOUS_TRANSFER_COMMIT,		/* no wait for flush data page */
+	SYNCHRONOUS_TRANSFER_DATA_FLUSH,	/* wait for data page flush only
+										 * no wait for WAL */
+	SYNCHRONOUS_TRANSFER_ALL	        /* wait for data page flush */
+}	SynchronousTransferLevel;
 
 /* user-settable parameters for synchronous replication */
 extern char *SyncRepStandbyNames;
 
+/* user-settable parameters for failback safe replication */
+extern int	synchronous_transfer;
+
 /* called by user backend */
-extern void SyncRepWaitForLSN(XLogRecPtr XactCommitLSN);
+extern bool SyncRepWaitForLSN(XLogRecPtr XactCommitLSN,
+		bool ForDataFlush, bool Wait);
 
 /* called at backend exit */
 extern void SyncRepCleanupAtProcExit(void);
@@ -52,5 +71,6 @@ extern int	SyncRepWakeQueue(bool all, int mode);
 
 extern bool check_synchronous_standby_names(char **newval, void **extra, GucSource source);
 extern void assign_synchronous_commit(int newval, void *extra);
+extern void assign_synchronous_transfer(int newval, void *extra);
 
 #endif   /* _SYNCREP_H */

*** a/src/backend/access/transam/clog.c
--- b/src/backend/access/transam/clog.c
***************
*** 37,42 ****
--- 37,44 ----
  #include "access/transam.h"
  #include "miscadmin.h"
  #include "pg_trace.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  
  /*
   * Defines for CLOG page sizes.  A page is the same BLCKSZ as is used
***************
*** 708,715 **** WriteZeroPageXlogRec(int pageno)
  /*
   * Write a TRUNCATE xlog record
   *
!  * We must flush the xlog record to disk before returning --- see notes
!  * in TruncateCLOG().
   */
  static void
  WriteTruncateXlogRec(int pageno)
--- 710,719 ----
  /*
   * Write a TRUNCATE xlog record
   *
!  * Before returning we must flush the xlog record to disk
!  * and if synchronous transfer is requested wait for failback
!  * safe standby to receive WAL up to recptr.
!  * --- see notes in TruncateCLOG().
   */
  static void
  WriteTruncateXlogRec(int pageno)
***************
*** 723,728 **** WriteTruncateXlogRec(int pageno)
--- 727,738 ----
  	rdata.next = NULL;
  	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
  	XLogFlush(recptr);
+ 
+ 	/*
+ 	 * Wait for failback safe standby.
+ 	 */
+ 	if (SyncTransRequested())
+ 		SyncRepWaitForLSN(recptr, true, true);
  }
  
  /*
*** a/src/backend/access/transam/slru.c
--- b/src/backend/access/transam/slru.c
***************
*** 54,59 ****
--- 54,61 ----
  #include "access/slru.h"
  #include "access/transam.h"
  #include "access/xlog.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "storage/shmem.h"
  #include "miscadmin.h"
***************
*** 744,749 **** SlruPhysicalWritePage(SlruCtl ctl, int pageno, int slotno, SlruFlush fdata)
--- 746,757 ----
  			START_CRIT_SECTION();
  			XLogFlush(max_lsn);
  			END_CRIT_SECTION();
+ 
+ 			/* If synchronous transfer is requested, wait for failback safe
+ 			 * standby to receive WAL up to max_lsn.
+ 			 */
+ 			if (SyncTransRequested())
+ 				SyncRepWaitForLSN(max_lsn, true, true);
  		}
  	}
  
*** a/src/backend/access/transam/twophase.c
--- b/src/backend/access/transam/twophase.c
***************
*** 1091,1102 **** EndPrepare(GlobalTransaction gxact)
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked the prepare, but still show as
  	 * running in the procarray (twice!) and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(gxact->prepare_lsn);
  
  	records.tail = records.head = NULL;
  }
--- 1091,1102 ----
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked the prepare, but still show as
  	 * running in the procarray (twice!) and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(gxact->prepare_lsn, false, true);
  
  	records.tail = records.head = NULL;
  }
***************
*** 2058,2069 **** RecordTransactionCommitPrepared(TransactionId xid,
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr);
  }
  
  /*
--- 2058,2069 ----
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr, false, true);
  }
  
  /*
***************
*** 2138,2147 **** RecordTransactionAbortPrepared(TransactionId xid,
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr);
  }
--- 2138,2147 ----
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr, false, true);
  }
*** a/src/backend/access/transam/xact.c
--- b/src/backend/access/transam/xact.c
***************
*** 1189,1201 **** RecordTransactionCommit(void)
  	latestXid = TransactionIdLatest(xid, nchildren, children);
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
  	if (wrote_xlog)
! 		SyncRepWaitForLSN(XactLastRecEnd);
  
  	/* Reset XactLastRecEnd until the next transaction writes something */
  	XactLastRecEnd = 0;
--- 1189,1201 ----
  	latestXid = TransactionIdLatest(xid, nchildren, children);
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
  	if (wrote_xlog)
! 		SyncRepWaitForLSN(XactLastRecEnd, false, true);
  
  	/* Reset XactLastRecEnd until the next transaction writes something */
  	XactLastRecEnd = 0;
***************
*** 4690,4697 **** xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
--- 4690,4706 ----
  	 * for any user that requested ForceSyncCommit().
  	 */
  	if (XactCompletionForceSyncCommit(xinfo))
+ 	{
  		XLogFlush(lsn);
  
+ 		/*
+ 		 * If synchronous transfer is requested, wait for failback safe
+ 		 * standby to receive WAL up to lsn,
+ 		 */
+ 		if (SyncTransRequested())
+ 			SyncRepWaitForLSN(lsn, true, true);
+ 
+ 	}
  }
  
  /*
*** a/src/backend/access/transam/xlog.c
--- b/src/backend/access/transam/xlog.c
***************
*** 39,46 ****
--- 39,48 ----
  #include "pgstat.h"
  #include "postmaster/bgwriter.h"
  #include "postmaster/startup.h"
+ #include "replication/syncrep.h"
  #include "replication/walreceiver.h"
  #include "replication/walsender.h"
+ #include "replication/syncrep.h"
  #include "storage/barrier.h"
  #include "storage/bufmgr.h"
  #include "storage/fd.h"
***************
*** 8286,8291 **** CreateCheckPoint(int flags)
--- 8288,8305 ----
  	END_CRIT_SECTION();
  
  	/*
+ 	 * If synchronous transfer is requested, wait for failback safe standby
+ 	 * to receive WAL up to checkpoint WAL record. Otherwise if failure occurs
+ 	 * before standby receives CHECKPOINT WAL record causes an inconsistency
+ 	 * between control files of master and standby. Because of this master will
+ 	 * start from a location which is not known to the standby at the time fail-over.
+ 	 *
+ 	 * There is no need to wait for shutdown CHECKPOINT.
+ 	 */
+ 	if (SyncTransRequested())
+ 		SyncRepWaitForLSN(recptr, true, !shutdown);
+ 
+ 	/*
  	 * Let smgr do post-checkpoint cleanup (eg, deleting old files).
  	 */
  	smgrpostckpt();
*** a/src/backend/catalog/storage.c
--- b/src/backend/catalog/storage.c
***************
*** 25,30 ****
--- 25,32 ----
  #include "catalog/catalog.h"
  #include "catalog/storage.h"
  #include "catalog/storage_xlog.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/freespace.h"
  #include "storage/smgr.h"
  #include "utils/memutils.h"
***************
*** 288,293 **** RelationTruncate(Relation rel, BlockNumber nblocks)
--- 290,303 ----
  		 */
  		if (fsm || vm)
  			XLogFlush(lsn);
+ 
+ 		/*
+ 		 * If synchronous transfer is requested, wait for failback safe standby
+ 		 * to receive WAL up to lsn. Otherwise, we may have a situation where
+ 		 * the heap is truncated, but the action never replayed on the standby.
+ 		 */
+ 		if (SyncTransRequested())
+ 			SyncRepWaitForLSN(lsn, true, true);
  	}
  
  	/* Do the real work */
***************
*** 521,526 **** smgr_redo(XLogRecPtr lsn, XLogRecord *record)
--- 531,543 ----
  		 */
  		XLogFlush(lsn);
  
+ 		/*
+ 		 * If synchronous transfer is requested, wait for failback safe standby
+ 		 * to receive WAL up to lsn.
+ 		 */
+ 		if (SyncTransRequested())
+ 			SyncRepWaitForLSN(lsn, true, true);
+ 
  		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
  
  		/* Also tell xlogutils.c about it */
*** a/src/backend/replication/syncrep.c
--- b/src/backend/replication/syncrep.c
***************
*** 65,70 **** char	   *SyncRepStandbyNames;
--- 65,72 ----
  static bool announce_next_takeover = true;
  
  static int	SyncRepWaitMode = SYNC_REP_NO_WAIT;
+ static int	SyncTransferMode = SYNC_REP_NO_WAIT;
+ int		synchronous_transfer = SYNCHRONOUS_TRANSFER_COMMIT;
  
  static void SyncRepQueueInsert(int mode);
  static void SyncRepCancelWait(void);
***************
*** 82,101 **** static bool SyncRepQueueIsOrderedByLSN(int mode);
   */
  
  /*
!  * Wait for synchronous replication, if requested by user.
   *
   * Initially backends start in state SYNC_REP_NOT_WAITING and then
!  * change that state to SYNC_REP_WAITING before adding ourselves
!  * to the wait queue. During SyncRepWakeQueue() a WALSender changes
!  * the state to SYNC_REP_WAIT_COMPLETE once replication is confirmed.
!  * This backend then resets its state to SYNC_REP_NOT_WAITING.
   */
! void
! SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  {
  	char	   *new_status = NULL;
  	const char *old_status;
! 	int			mode = SyncRepWaitMode;
  
  	/*
  	 * Fast exit if user has not requested sync replication, or there are no
--- 84,113 ----
   */
  
  /*
!  * Wait for synchronous/failback safe standby, if requested by user.
   *
   * Initially backends start in state SYNC_REP_NOT_WAITING and then
!  * change that state to SYNC_REP_WAITING/SYNC_REP_WAITING_FOR_DATA_FLUSH
!  * before adding ourselves to the wait queue. During SyncRepWakeQueue() a
!  * WALSender changes the state to SYNC_REP_WAIT_COMPLETE once replication is
!  * confirmed. This backend then resets its state to SYNC_REP_NOT_WAITING.
!  *
!  * ForDataFlush - if TRUE, we wait before flushing data page.
!  * Otherwise wait for the sync standby
!  *
!  * Wait - if FALSE, we don't actually wait, but tell the caller whether or not
!  * the standby has already made progressed upto the given XactCommitLSN
!  *
!  * Return TRUE if either the synchronous standby/failback safe standby is not
!  * configured/turned off OR the standby has made enough progress
   */
! bool
! SyncRepWaitForLSN(XLogRecPtr XactCommitLSN, bool ForDataFlush, bool Wait)
  {
  	char	   *new_status = NULL;
  	const char *old_status;
! 	int			mode = !ForDataFlush ? SyncRepWaitMode : SyncTransferMode;
! 	bool		ret;
  
  	/*
  	 * Fast exit if user has not requested sync replication, or there are no
***************
*** 103,109 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  	 * need to be connected.
  	 */
  	if (!SyncRepRequested() || !SyncStandbysDefined())
! 		return;
  
  	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
  	Assert(WalSndCtl != NULL);
--- 115,140 ----
  	 * need to be connected.
  	 */
  	if (!SyncRepRequested() || !SyncStandbysDefined())
! 		return true;
! 
! 	/*
! 	 * If the caller has specified ForDataFlush, but synchronous transfer
! 	 * is not specified or its turned off, exit.
! 	 *
! 	 * We would like to allow the failback safe mechanism even for cascaded
! 	 * standbys as well. But we can't really wait for the standby to catch
! 	 * up until we reach a consistent state since the standbys won't be
! 	 * even able to connect without us reaching in that state (XXX Confirm)
! 	 */
! 	if ((!SyncTransRequested()) && ForDataFlush)
! 		return true;
! 
! 	/*
! 	 * If the caller has not specified ForDataFlush, but synchronous commit
! 	 * is skipped by values of synchronous_transfer, exit.
! 	 */
! 	if (IsSyncRepSkipped() && !ForDataFlush)
! 		return true;
  
  	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
  	Assert(WalSndCtl != NULL);
***************
*** 119,129 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  	 * condition but we'll be fetching that cache line anyway so its likely to
  	 * be a low cost check.
  	 */
! 	if (!WalSndCtl->sync_standbys_defined ||
  		XactCommitLSN <= WalSndCtl->lsn[mode])
  	{
  		LWLockRelease(SyncRepLock);
! 		return;
  	}
  
  	/*
--- 150,169 ----
  	 * condition but we'll be fetching that cache line anyway so its likely to
  	 * be a low cost check.
  	 */
! 	if ((!ForDataFlush && !WalSndCtl->sync_standbys_defined) ||
  		XactCommitLSN <= WalSndCtl->lsn[mode])
  	{
  		LWLockRelease(SyncRepLock);
! 		return true;
! 	}
! 
! 	/*
! 	 * Exit if we are told not to block on the standby.
! 	 */
! 	if (!Wait)
! 	{
! 		LWLockRelease(SyncRepLock);
! 		return false;
  	}
  
  	/*
***************
*** 150,155 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 190,197 ----
  		new_status[len] = '\0'; /* truncate off " waiting ..." */
  	}
  
+ 	ret = false;
+ 
  	/*
  	 * Wait for specified LSN to be confirmed.
  	 *
***************
*** 186,192 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 228,237 ----
  			LWLockRelease(SyncRepLock);
  		}
  		if (syncRepState == SYNC_REP_WAIT_COMPLETE)
+ 		{
+ 			ret = true;
  			break;
+ 		}
  
  		/*
  		 * If a wait for synchronous replication is pending, we can neither
***************
*** 263,268 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 308,315 ----
  		set_ps_display(new_status, false);
  		pfree(new_status);
  	}
+ 
+ 	return ret;
  }
  
  /*
***************
*** 370,375 **** SyncRepReleaseWaiters(void)
--- 417,423 ----
  	volatile WalSnd *syncWalSnd = NULL;
  	int			numwrite = 0;
  	int			numflush = 0;
+ 	int			numdataflush = 0;
  	int			priority = 0;
  	int			i;
  
***************
*** 437,449 **** SyncRepReleaseWaiters(void)
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
  		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
  	}
  
  	LWLockRelease(SyncRepLock);
  
! 	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X",
! 		 numwrite, (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
! 	   numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
  
  	/*
  	 * If we are managing the highest priority standby, though we weren't
--- 485,505 ----
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
  		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
+ 
+ 	}
+ 	if (walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] < MyWalSnd->flush)
+ 	{
+ 		walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] = MyWalSnd->flush;
+ 		numdataflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_DATA_FLUSH);
+ 
  	}
  
  	LWLockRelease(SyncRepLock);
  
! 	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X, %d procs up to data flush %X/%X",
! 		 numwrite    , (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
! 		 numflush    , (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush,
! 		 numdataflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
  
  	/*
  	 * If we are managing the highest priority standby, though we weren't
***************
*** 709,711 **** assign_synchronous_commit(int newval, void *extra)
--- 765,782 ----
  			break;
  	}
  }
+ 
+ void
+ assign_synchronous_transfer(int newval, void *extra)
+ {
+ 	switch (newval)
+ 	{
+ 		case SYNCHRONOUS_TRANSFER_ALL:
+ 		case SYNCHRONOUS_TRANSFER_DATA_FLUSH:
+ 			SyncTransferMode = SYNC_REP_WAIT_DATA_FLUSH;
+ 			break;
+ 		default:
+ 			SyncTransferMode = SYNC_REP_NO_WAIT;
+ 			break;
+ 	}
+ }
*** a/src/backend/replication/walsender.c
--- b/src/backend/replication/walsender.c
***************
*** 1539,1544 **** XLogSend(bool *caughtup)
--- 1539,1548 ----
  
  		*caughtup = true;
  
+ 		elog(WARNING, "XLogSend sendTimeLineValidUpto(%X/%X) <= sentPtr(%X/%X) AND sendTImeLine",
+ 			 (uint32) (sendTimeLineValidUpto >> 32), (uint32) sendTimeLineValidUpto,
+ 			 (uint32) (sentPtr >> 32), (uint32) sentPtr);
+ 
  		elog(DEBUG1, "walsender reached end of timeline at %X/%X (sent up to %X/%X)",
  			 (uint32) (sendTimeLineValidUpto >> 32), (uint32) sendTimeLineValidUpto,
  			 (uint32) (sentPtr >> 32), (uint32) sentPtr);
*** a/src/backend/storage/buffer/bufmgr.c
--- b/src/backend/storage/buffer/bufmgr.c
***************
*** 41,46 ****
--- 41,48 ----
  #include "pg_trace.h"
  #include "pgstat.h"
  #include "postmaster/bgwriter.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/buf_internals.h"
  #include "storage/bufmgr.h"
  #include "storage/ipc.h"
***************
*** 1975,1982 **** FlushBuffer(volatile BufferDesc *buf, SMgrRelation reln)
  	 * skip the flush if the buffer isn't permanent.
  	 */
  	if (buf->flags & BM_PERMANENT)
  		XLogFlush(recptr);
! 
  	/*
  	 * Now it's safe to write buffer to disk. Note that no one else should
  	 * have been able to write it while we were busy with log flushing because
--- 1977,1990 ----
  	 * skip the flush if the buffer isn't permanent.
  	 */
  	if (buf->flags & BM_PERMANENT)
+ 	{
  		XLogFlush(recptr);
! 		/* If synchronous transfer is requested, wait for failback safe standby
! 		 * to receive WAL up to recptr.
! 		 */
! 		if (SyncTransRequested())
! 			SyncRepWaitForLSN(recptr, true, true);
! 	}
  	/*
  	 * Now it's safe to write buffer to disk. Note that no one else should
  	 * have been able to write it while we were busy with log flushing because
*** a/src/backend/utils/cache/relmapper.c
--- b/src/backend/utils/cache/relmapper.c
***************
*** 48,53 ****
--- 48,55 ----
  #include "catalog/pg_tablespace.h"
  #include "catalog/storage.h"
  #include "miscadmin.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "storage/lwlock.h"
  #include "utils/inval.h"
***************
*** 711,716 **** write_relmap_file(bool shared, RelMapFile *newmap,
--- 713,719 ----
  	int			fd;
  	RelMapFile *realmap;
  	char		mapfilename[MAXPGPATH];
+ 	XLogRecPtr	lsn=InvalidXLogRecPtr;
  
  	/*
  	 * Fill in the overhead fields and update CRC.
***************
*** 753,759 **** write_relmap_file(bool shared, RelMapFile *newmap,
  	{
  		xl_relmap_update xlrec;
  		XLogRecData rdata[2];
- 		XLogRecPtr	lsn;
  
  		/* now errors are fatal ... */
  		START_CRIT_SECTION();
--- 756,761 ----
***************
*** 775,780 **** write_relmap_file(bool shared, RelMapFile *newmap,
--- 777,783 ----
  
  		/* As always, WAL must hit the disk before the data update does */
  		XLogFlush(lsn);
+ 
  	}
  
  	errno = 0;
***************
*** 849,854 **** write_relmap_file(bool shared, RelMapFile *newmap,
--- 852,864 ----
  	/* Critical section done */
  	if (write_wal)
  		END_CRIT_SECTION();
+ 
+ 	/*
+ 	 * If synchronous transfer is requested, wait for failback safe
+ 	 * standby to receive WAL up to recptr.
+ 	 */
+ 	if (SyncTransRequested())
+ 		SyncRepWaitForLSN(lsn, true, true);
  }
  
  /*
*** a/src/backend/utils/misc/guc.c
--- b/src/backend/utils/misc/guc.c
***************
*** 381,386 **** static const struct config_enum_entry synchronous_commit_options[] = {
--- 381,398 ----
  };
  
  /*
+  * Although only "all", "data_flush", and "commit" are documented, we
+  * accept all the likely variants of "off".
+  */
+ static const struct config_enum_entry synchronous_transfer_options[] = {
+ 	{"all", SYNCHRONOUS_TRANSFER_ALL, false},
+ 	{"data_flush", SYNCHRONOUS_TRANSFER_DATA_FLUSH, false},
+ 	{"commit", SYNCHRONOUS_TRANSFER_COMMIT, true},
+ 	{"0", SYNCHRONOUS_TRANSFER_COMMIT, true},
+ 	{NULL, 0, false}
+ };
+ 
+ /*
   * Options for enum values stored in other modules
   */
  extern const struct config_enum_entry wal_level_options[];
***************
*** 3288,3293 **** static struct config_enum ConfigureNamesEnum[] =
--- 3300,3315 ----
  	},
  
  	{
+ 		{"synchronous_transfer", PGC_SIGHUP, WAL_SETTINGS,
+ 			gettext_noop("Sets the data flush synchronization level"),
+ 			NULL
+ 		},
+ 		&synchronous_transfer,
+ 		SYNCHRONOUS_TRANSFER_COMMIT, synchronous_transfer_options,
+ 		NULL, assign_synchronous_transfer, NULL
+ 	},
+ 
+ 	{
  		{"trace_recovery_messages", PGC_SIGHUP, DEVELOPER_OPTIONS,
  			gettext_noop("Enables logging of recovery-related debugging information."),
  			gettext_noop("Each level includes all the levels that follow it. The later"
*** a/src/backend/utils/misc/postgresql.conf.sample
--- b/src/backend/utils/misc/postgresql.conf.sample
***************
*** 220,225 ****
--- 220,227 ----
  #synchronous_standby_names = ''	# standby servers that provide sync rep
  				# comma-separated list of application_name
  				# from standby(s); '*' = all
+ #synchronous_transfer = commit	# data page synchronization level
+ 				# commit, data_flush or all
  #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
  
  # - Standby Servers -
*** a/src/backend/utils/time/tqual.c
--- b/src/backend/utils/time/tqual.c
***************
*** 60,65 ****
--- 60,67 ----
  #include "access/subtrans.h"
  #include "access/transam.h"
  #include "access/xact.h"
+ #include "replication/walsender.h"
+ #include "replication/syncrep.h"
  #include "storage/bufmgr.h"
  #include "storage/procarray.h"
  #include "utils/tqual.h"
***************
*** 115,120 **** SetHintBits(HeapTupleHeader tuple, Buffer buffer,
--- 117,134 ----
  
  		if (XLogNeedsFlush(commitLSN) && BufferIsPermanent(buffer))
  			return;				/* not flushed yet, so don't set hint */
+ 
+ 		/*
+ 		 * If synchronous transfer is requested, we check if the commit WAL record
+ 		 * has made to the standby before allowing hint bit updates. We should not
+ 		 * wait for the standby to receive the WAL since its OK to delay hint bit
+ 		 * updates.
+ 		 */
+ 		if (SyncTransRequested())
+ 		{
+ 			if(!SyncRepWaitForLSN(commitLSN, true, false))
+ 				return;
+ 		}
  	}
  
  	tuple->t_infomask |= infomask;
*** a/src/include/replication/syncrep.h
--- b/src/include/replication/syncrep.h
***************
*** 19,41 ****
  #define SyncRepRequested() \
  	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
  
  /* SyncRepWaitMode */
! #define SYNC_REP_NO_WAIT		-1
! #define SYNC_REP_WAIT_WRITE		0
! #define SYNC_REP_WAIT_FLUSH		1
  
! #define NUM_SYNC_REP_WAIT_MODE	2
  
  /* syncRepState */
! #define SYNC_REP_NOT_WAITING		0
! #define SYNC_REP_WAITING			1
! #define SYNC_REP_WAIT_COMPLETE		2
  
  /* user-settable parameters for synchronous replication */
  extern char *SyncRepStandbyNames;
  
  /* called by user backend */
! extern void SyncRepWaitForLSN(XLogRecPtr XactCommitLSN);
  
  /* called at backend exit */
  extern void SyncRepCleanupAtProcExit(void);
--- 19,60 ----
  #define SyncRepRequested() \
  	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
  
+ #define SyncTransRequested() \
+ 	(max_wal_senders > 0 && synchronous_transfer > SYNCHRONOUS_TRANSFER_COMMIT)
+ 
+ #define IsSyncRepSkipped() \
+ 	(max_wal_senders > 0 && synchronous_transfer ==  SYNCHRONOUS_TRANSFER_DATA_FLUSH)
+ 
  /* SyncRepWaitMode */
! #define SYNC_REP_NO_WAIT					-1
! #define SYNC_REP_WAIT_WRITE					0
! #define SYNC_REP_WAIT_FLUSH					1
! #define SYNC_REP_WAIT_DATA_FLUSH	2
  
! #define NUM_SYNC_REP_WAIT_MODE				3
  
  /* syncRepState */
! #define SYNC_REP_NOT_WAITING					0
! #define SYNC_REP_WAITING						1
! #define SYNC_REP_WAIT_COMPLETE					2
! 
! typedef enum
! {
! 	SYNCHRONOUS_TRANSFER_COMMIT,		/* no wait for flush data page */
! 	SYNCHRONOUS_TRANSFER_DATA_FLUSH,	/* wait for data page flush only
! 										 * no wait for WAL */
! 	SYNCHRONOUS_TRANSFER_ALL	        /* wait for data page flush */
! }	SynchronousTransferLevel;
  
  /* user-settable parameters for synchronous replication */
  extern char *SyncRepStandbyNames;
  
+ /* user-settable parameters for failback safe replication */
+ extern int	synchronous_transfer;
+ 
  /* called by user backend */
! extern bool SyncRepWaitForLSN(XLogRecPtr XactCommitLSN,
! 		bool ForDataFlush, bool Wait);
  
  /* called at backend exit */
  extern void SyncRepCleanupAtProcExit(void);
***************
*** 52,56 **** extern int	SyncRepWakeQueue(bool all, int mode);
--- 71,76 ----
  
  extern bool check_synchronous_standby_names(char **newval, void **extra, GucSource source);
  extern void assign_synchronous_commit(int newval, void *extra);
+ extern void assign_synchronous_transfer(int newval, void *extra);
  
  #endif   /* _SYNCREP_H */

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 370aa09..bc8891c 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1749,6 +1749,50 @@ include 'filename'
       </listitem>
      </varlistentry>
 
+     <varlistentry id="guc-synchronous-transfer" xreflabel="synchronous_transfer">
+      <term><varname>synchronous_transfer</varname> (<type>enum</type>)</term>
+      <indexterm>
+       <primary><varname>synchronous_transfer</> configuration parameter</primary>
+      </indexterm>
+      <listitem>
+       <para>
+        This parameter controls the synchronous nature of WAL transfer and
+        maintains file system level consistency between master server and
+        standby server. Specifies whether master server will wait for file
+        system level change (for example : modifying data page) before
+        corresponding WAL records are replicated to the standby server.
+       </para>
+       <para>
+        Valid values are <literal>commit</>, <literal>data_flush</> and
+        <literal>all</>. The default value is <literal>commit</>, meaning
+        that master only wait for transaction commits, this is equivalent
+        to turning off <literal>synchronous_transfer</> parameter and standby
+        server will behave as a <quote>synchronous standby </> in
+        Streaming Replication. When <literal>data_flush</>, master will
+        wait only for data page modifications but not for transaction
+        commits, hence the standby server will act as <quote>asynchronous
+        failback safe standby</>. When <literal> all</>, master will wait
+        for data page modifications as well as for transaction commits and
+        resultant standby server will act as <quote>synchronous failback safe
+        standby</>, to configure synchronous failback safe standby
+        <xref linkend="guc-synchronous-standby-names"> should be set.
+       </para>
+       <para>
+        Setting this parameter to <literal> commit</> will configure pure
+        Streaming Replication, on the other hand setting to <literal>
+        data_flush </> will make WAL transfer synchronous except transaction
+        commits. All WAL transfer can be made synchronous by setting this
+        parameter to <literal>all</> value.
+       </para>
+       <para>
+        Setting <literal>synchronous_transfer</> to <literal>data_flush</> or
+        <literal>all</> makes WAL transfer synchronous, but this wait is mostly
+        on background activities such as bgwriter. Hence this will not create
+        much performance overhead.
+       </para>
+      </listitem>
+     </varlistentry>
+
      <varlistentry id="guc-wal-sync-method" xreflabel="wal_sync_method">
       <term><varname>wal_sync_method</varname> (<type>enum</type>)</term>
       <indexterm>
@@ -2258,14 +2302,25 @@ include 'filename'
       </indexterm>
       <listitem>
        <para>
-        Specifies a comma-separated list of standby names that can support
-        <firstterm>synchronous replication</>, as described in
-        <xref linkend="synchronous-replication">.
-        At any one time there will be at most one active synchronous standby;
-        transactions waiting for commit will be allowed to proceed after
-        this standby server confirms receipt of their data.
-        The synchronous standby will be the first standby named in this list
-        that is both currently connected and streaming data in real-time
+        Specifies a comma-separated list of standby names. If this parameter
+        is set then standby will behave as synchronous standby in replication,
+        as described in <xref linkend="synchronous-replication"> or synchronous
+        failback safe standby, as described in <xref linkend="failback-safe">.
+        At any time there will be at most one active standby; when standby is
+        synchronous standby in replication, transactions waiting for commit
+        will be allowed to proceed after this standby server confirms receipt
+        of their data. But when standby is synchronous failback safe standby
+        data page modifications as well as transaction commits will be allowed
+        to proceed only after this standby server confirms receipt of their data.
+        If this parameter is set to empty value and
+        <xref linkend="guc-synchronous-transfer"> is set to <literal>data_flush</>
+        then standby is called as asynchronous failback safe standby and only
+        data page modifications will wait before corresponding WAL record is
+        replicated to standby.
+       </para>
+       <para>
+        Synchronous standby in replication will be the first standby named in
+        this list that is both currently connected and streaming data in real-time
         (as shown by a state of <literal>streaming</literal> in the
         <link linkend="monitoring-stats-views-table">
         <literal>pg_stat_replication</></link> view).
diff --git a/doc/src/sgml/high-availability.sgml b/doc/src/sgml/high-availability.sgml
index c8f6fa8..b2b42be 100644
--- a/doc/src/sgml/high-availability.sgml
+++ b/doc/src/sgml/high-availability.sgml
@@ -1140,6 +1140,70 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
 
    </sect3>
   </sect2>
+
+  <sect2 id="failback-safe">
+     <title>Setting up failback safe standby</title>
+
+   <indexterm zone="high-availability">
+       <primary>Setting up failback safe standby</primary>
+   </indexterm>
+
+   <para>
+    PostgreSQL Streaming Replication offers durability, but if master
+    crashes and particular WAL record is unable to reach to standby
+    server, then that WAL record is present on master server but not
+    on standby server. In such a case master is ahead of standby server
+    in term of WAL records and Data in database. This will lead to
+    file-system level inconsistency between master and standby server.
+   </para>
+
+   <para>
+    Due to this inconsistency fresh backup of new master onto new standby
+    is needed to re-prepare HA cluster. Taking fresh backup can be very
+    time consuming process when database is of large size. In such a case
+    disaster recovery can take very long time if Streaming Replication is
+    used to setup the high availability cluster. The reason for this is,
+    Synchronous Replication makes WAL transfer synchronous at the time of
+    transaction commit. This will ensure the durability until the HA cluster
+    is up, but there are certain cases such as heap page update which will
+    cause inconsistency at the time of disaster if the standby is failed to
+    receive WAL record corresponding to this heap page update.
+   </para>
+
+   <para>
+    If HA cluster is configured with failback safe standby then master will
+    wait for data page modifications before corresponding WAL record is replicated
+    to standby. Failback safe standby has a control over all WAL transfer
+    and will not make any file system level change until gets a confirmation
+    from standby server. Hence avoids the need of fresh backup by maintaining
+    consistency.
+   </para>
+
+   <sect3 id="Failback-safe-config">
+    <title>Basic Configuration</title>
+   <para>
+    Failback safe standby can be asynchronous or synchronous in nature.
+    This will depend upon whether master will wait for transaction commit
+    or not. By default failback safe mechanism is turned off.
+   </para>
+
+   <para>
+    The first step to configure HA with failback safe standby is to setup
+    streaming replication. Configuring synchronous failback safe standby
+    requires setting up  <xref linkend="guc-synchronous-transfer"> to
+    <literal>all</> and <xref linkend="guc-synchronous-standby-names">
+    must be set to a non-empty value. This configuration will cause each
+    commit and data page modification to wait for confirmation that standby
+    has written corresponding WAL record to durable storage. Configuring
+    asynchronous failback safe standby requires only setting up
+     <xref linkend="guc-synchronous-transfer"> to <literal> data_flush</>.
+    This configuration will cause only data page modifications to wait
+    for confirmation that standby has written corresponding WAL record
+    to durable storage.
+   </para>
+
+  </sect3>
+  </sect2>
   </sect1>
 
   <sect1 id="warm-standby-failover">
@@ -1201,12 +1265,28 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
    </para>
 
    <para>
-    So, switching from primary to standby server can be fast but requires
-    some time to re-prepare the failover cluster. Regular switching from
-    primary to standby is useful, since it allows regular downtime on
-    each system for maintenance. This also serves as a test of the
-    failover mechanism to ensure that it will really work when you need it.
-    Written administration procedures are advised.
+    At the time of failover there is a possibility of file-system level
+    inconsistency between old primary and old standby server hence
+    fresh backup from new master onto old master is needed for Configuring
+    former primary server as a new standby server. Without taking fresh
+    backup even if the new standby starts, streaming replication does not
+    start successfully. The activity of taking backup can be fast for small
+    database but for large database requires more time to re-prepare the
+    failover cluster and could break the service line agreement of crash
+    recovery. This situation can arise when HA cluster is configured through
+    Streaming Replication. The need of fresh backup and problem of long
+    recovery time can be solved by using if HA cluster is configured with
+    failback safe standby see <xref linkend="failback-safe">.
+    Failback safe standby makes WAL transfer synchronous at required places
+    and maintains the file-system level consistency between master and standby
+    server and the former primary can be easily configured as new standby server.
+   </para>
+
+   <para>
+    Regular switching from primary to standby is useful, since it allows
+    regular downtime on each system for maintenance. This also serves as
+    a test of the failover mechanism to ensure that it will really work
+    when you need it. Written administration procedures are advised.
    </para>
 
    <para>
diff --git a/doc/src/sgml/perform.sgml b/doc/src/sgml/perform.sgml
index 2af1738..da3820f 100644
--- a/doc/src/sgml/perform.sgml
+++ b/doc/src/sgml/perform.sgml
@@ -1569,6 +1569,14 @@ SELECT * FROM x, y, a, b, c WHERE something AND somethingelse;
        corruption) in case of a crash of the <emphasis>database</> alone.
       </para>
      </listitem>
+
+     <listitem>
+      <para>
+       Set <xref linkend="guc-synchronous-transfer"> to commit; there is no
+       need to guard against database inconsistency between master and standby.
+       and it is feasible to take fresh backup at failback time.
+      </para>
+     </listitem>
     </itemizedlist>
    </para>
   </sect1>
diff --git a/src/backend/access/transam/clog.c b/src/backend/access/transam/clog.c
index cb95aa3..d216b2e 100644
--- a/src/backend/access/transam/clog.c
+++ b/src/backend/access/transam/clog.c
@@ -37,6 +37,8 @@
 #include "access/transam.h"
 #include "miscadmin.h"
 #include "pg_trace.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 
 /*
  * Defines for CLOG page sizes.  A page is the same BLCKSZ as is used
@@ -708,8 +710,10 @@ WriteZeroPageXlogRec(int pageno)
 /*
  * Write a TRUNCATE xlog record
  *
- * We must flush the xlog record to disk before returning --- see notes
- * in TruncateCLOG().
+ * Before returning we must flush the xlog record to disk
+ * and if synchronous transfer is requested wait for failback
+ * safe standby to receive WAL up to recptr.
+ * --- see notes in TruncateCLOG().
  */
 static void
 WriteTruncateXlogRec(int pageno)
@@ -723,6 +727,12 @@ WriteTruncateXlogRec(int pageno)
 	rdata.next = NULL;
 	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
 	XLogFlush(recptr);
+
+	/*
+	 * Wait for failback safe standby.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(recptr, true, true);
 }
 
 /*
diff --git a/src/backend/access/transam/slru.c b/src/backend/access/transam/slru.c
index 5e53593..edaee83 100644
--- a/src/backend/access/transam/slru.c
+++ b/src/backend/access/transam/slru.c
@@ -54,6 +54,8 @@
 #include "access/slru.h"
 #include "access/transam.h"
 #include "access/xlog.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/fd.h"
 #include "storage/shmem.h"
 #include "miscadmin.h"
@@ -744,6 +746,12 @@ SlruPhysicalWritePage(SlruCtl ctl, int pageno, int slotno, SlruFlush fdata)
 			START_CRIT_SECTION();
 			XLogFlush(max_lsn);
 			END_CRIT_SECTION();
+
+			/* If synchronous transfer is requested, wait for failback safe
+			 * standby to receive WAL up to max_lsn.
+			 */
+			if (SyncTransRequested())
+				SyncRepWaitForLSN(max_lsn, true, true);
 		}
 	}
 
diff --git a/src/backend/access/transam/twophase.c b/src/backend/access/transam/twophase.c
index e975f8d..38a9e9c 100644
--- a/src/backend/access/transam/twophase.c
+++ b/src/backend/access/transam/twophase.c
@@ -1091,12 +1091,12 @@ EndPrepare(GlobalTransaction gxact)
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked the prepare, but still show as
 	 * running in the procarray (twice!) and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(gxact->prepare_lsn);
+	SyncRepWaitForLSN(gxact->prepare_lsn, false, true);
 
 	records.tail = records.head = NULL;
 }
@@ -2058,12 +2058,12 @@ RecordTransactionCommitPrepared(TransactionId xid,
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(recptr);
+	SyncRepWaitForLSN(recptr, false, true);
 }
 
 /*
@@ -2138,10 +2138,10 @@ RecordTransactionAbortPrepared(TransactionId xid,
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(recptr);
+	SyncRepWaitForLSN(recptr, false, true);
 }
diff --git a/src/backend/access/transam/xact.c b/src/backend/access/transam/xact.c
index 0591f3f..25210df 100644
--- a/src/backend/access/transam/xact.c
+++ b/src/backend/access/transam/xact.c
@@ -1189,13 +1189,13 @@ RecordTransactionCommit(void)
 	latestXid = TransactionIdLatest(xid, nchildren, children);
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
 	if (wrote_xlog)
-		SyncRepWaitForLSN(XactLastRecEnd);
+		SyncRepWaitForLSN(XactLastRecEnd, false, true);
 
 	/* Reset XactLastRecEnd until the next transaction writes something */
 	XactLastRecEnd = 0;
@@ -4690,8 +4690,17 @@ xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
 	 * for any user that requested ForceSyncCommit().
 	 */
 	if (XactCompletionForceSyncCommit(xinfo))
+	{
 		XLogFlush(lsn);
 
+		/*
+		 * If synchronous transfer is requested, wait for failback safe
+		 * standby to receive WAL up to lsn,
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
+
+	}
 }
 
 /*
diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index fc495d6..ef46419 100644
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -39,8 +39,10 @@
 #include "pgstat.h"
 #include "postmaster/bgwriter.h"
 #include "postmaster/startup.h"
+#include "replication/syncrep.h"
 #include "replication/walreceiver.h"
 #include "replication/walsender.h"
+#include "replication/syncrep.h"
 #include "storage/barrier.h"
 #include "storage/bufmgr.h"
 #include "storage/fd.h"
@@ -8282,6 +8284,18 @@ CreateCheckPoint(int flags)
 	END_CRIT_SECTION();
 
 	/*
+	 * If synchronous transfer is requested, wait for failback safe standby
+	 * to receive WAL up to checkpoint WAL record. Otherwise if failure occurs
+	 * before standby receives CHECKPOINT WAL record causes an inconsistency
+	 * between control files of master and standby. Because of this master will
+	 * start from a location which is not known to the standby at the time fail-over.
+	 *
+	 * There is no need to wait for shutdown CHECKPOINT.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(recptr, true, !shutdown);
+
+	/*
 	 * Let smgr do post-checkpoint cleanup (eg, deleting old files).
 	 */
 	smgrpostckpt();
diff --git a/src/backend/catalog/storage.c b/src/backend/catalog/storage.c
index 971a149..050a6ba 100644
--- a/src/backend/catalog/storage.c
+++ b/src/backend/catalog/storage.c
@@ -25,6 +25,8 @@
 #include "catalog/catalog.h"
 #include "catalog/storage.h"
 #include "catalog/storage_xlog.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/freespace.h"
 #include "storage/smgr.h"
 #include "utils/memutils.h"
@@ -288,6 +290,14 @@ RelationTruncate(Relation rel, BlockNumber nblocks)
 		 */
 		if (fsm || vm)
 			XLogFlush(lsn);
+
+		/*
+		 * If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to lsn. Otherwise, we may have a situation where
+		 * the heap is truncated, but the action never replayed on the standby.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
 	}
 
 	/* Do the real work */
@@ -521,6 +531,13 @@ smgr_redo(XLogRecPtr lsn, XLogRecord *record)
 		 */
 		XLogFlush(lsn);
 
+		/*
+		 * If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to lsn.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
+
 		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
 
 		/* Also tell xlogutils.c about it */
diff --git a/src/backend/replication/syncrep.c b/src/backend/replication/syncrep.c
index 8cf1346..f410b9c 100644
--- a/src/backend/replication/syncrep.c
+++ b/src/backend/replication/syncrep.c
@@ -66,6 +66,8 @@ char	   *SyncRepStandbyNames;
 static bool announce_next_takeover = true;
 
 static int	SyncRepWaitMode = SYNC_REP_NO_WAIT;
+static int	SyncTransferMode = SYNC_REP_NO_WAIT;
+int		synchronous_transfer = SYNCHRONOUS_TRANSFER_COMMIT;
 
 static void SyncRepQueueInsert(int mode);
 static void SyncRepCancelWait(void);
@@ -83,20 +85,30 @@ static bool SyncRepQueueIsOrderedByLSN(int mode);
  */
 
 /*
- * Wait for synchronous replication, if requested by user.
+ * Wait for synchronous/failback safe standby, if requested by user.
  *
  * Initially backends start in state SYNC_REP_NOT_WAITING and then
- * change that state to SYNC_REP_WAITING before adding ourselves
- * to the wait queue. During SyncRepWakeQueue() a WALSender changes
- * the state to SYNC_REP_WAIT_COMPLETE once replication is confirmed.
- * This backend then resets its state to SYNC_REP_NOT_WAITING.
+ * change that state to SYNC_REP_WAITING/SYNC_REP_WAITING_FOR_DATA_FLUSH
+ * before adding ourselves to the wait queue. During SyncRepWakeQueue() a
+ * WALSender changes the state to SYNC_REP_WAIT_COMPLETE once replication is
+ * confirmed. This backend then resets its state to SYNC_REP_NOT_WAITING.
+ *
+ * ForDataFlush - if TRUE, we wait before flushing data page.
+ * Otherwise wait for the sync standby
+ *
+ * Wait - if FALSE, we don't actually wait, but tell the caller whether or not
+ * the standby has already made progressed upto the given XactCommitLSN
+ *
+ * Return TRUE if either the synchronous standby/failback safe standby is not
+ * configured/turned off OR the standby has made enough progress
  */
-void
-SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
+bool
+SyncRepWaitForLSN(XLogRecPtr XactCommitLSN, bool ForDataFlush, bool Wait)
 {
 	char	   *new_status = NULL;
 	const char *old_status;
-	int			mode = SyncRepWaitMode;
+	int			mode = !ForDataFlush ? SyncRepWaitMode : SyncTransferMode;
+	bool		ret;
 
 	/*
 	 * Fast exit if user has not requested sync replication, or there are no
@@ -104,7 +116,26 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 	 * need to be connected.
 	 */
 	if (!SyncRepRequested() || !SyncStandbysDefined())
-		return;
+		return true;
+
+	/*
+	 * If the caller has specified ForDataFlush, but synchronous transfer
+	 * is not specified or its turned off, exit.
+	 *
+	 * We would like to allow the failback safe mechanism even for cascaded
+	 * standbys as well. But we can't really wait for the standby to catch
+	 * up until we reach a consistent state since the standbys won't be
+	 * even able to connect without us reaching in that state (XXX Confirm)
+	 */
+	if ((!SyncTransRequested()) && ForDataFlush)
+		return true;
+
+	/*
+	 * If the caller has not specified ForDataFlush, but synchronous commit
+	 * is skipped by values of synchronous_transfer, exit.
+	 */
+	if (IsSyncRepSkipped() && !ForDataFlush)
+		return true;
 
 	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
 	Assert(WalSndCtl != NULL);
@@ -120,11 +151,20 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 	 * condition but we'll be fetching that cache line anyway so it's likely to
 	 * be a low cost check.
 	 */
-	if (!WalSndCtl->sync_standbys_defined ||
+	if ((!ForDataFlush && !WalSndCtl->sync_standbys_defined) ||
 		XactCommitLSN <= WalSndCtl->lsn[mode])
 	{
 		LWLockRelease(SyncRepLock);
-		return;
+		return true;
+	}
+
+	/*
+	 * Exit if we are told not to block on the standby.
+	 */
+	if (!Wait)
+	{
+		LWLockRelease(SyncRepLock);
+		return false;
 	}
 
 	/*
@@ -151,6 +191,8 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		new_status[len] = '\0'; /* truncate off " waiting ..." */
 	}
 
+	ret = false;
+
 	/*
 	 * Wait for specified LSN to be confirmed.
 	 *
@@ -187,7 +229,10 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 			LWLockRelease(SyncRepLock);
 		}
 		if (syncRepState == SYNC_REP_WAIT_COMPLETE)
+		{
+			ret = true;
 			break;
+		}
 
 		/*
 		 * If a wait for synchronous replication is pending, we can neither
@@ -264,6 +309,8 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		set_ps_display(new_status, false);
 		pfree(new_status);
 	}
+
+	return ret;
 }
 
 /*
@@ -371,6 +418,7 @@ SyncRepReleaseWaiters(void)
 	volatile WalSnd *syncWalSnd = NULL;
 	int			numwrite = 0;
 	int			numflush = 0;
+	int			numdataflush = 0;
 	int			priority = 0;
 	int			i;
 
@@ -438,13 +486,21 @@ SyncRepReleaseWaiters(void)
 	{
 		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
 		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
+
+	}
+	if (walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] < MyWalSnd->flush)
+	{
+		walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] = MyWalSnd->flush;
+		numdataflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_DATA_FLUSH);
+
 	}
 
 	LWLockRelease(SyncRepLock);
 
-	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X",
-		 numwrite, (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
-	   numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
+	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X, %d procs up to data flush %X/%X",
+		 numwrite    , (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
+		 numflush    , (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush,
+		 numdataflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
 
 	/*
 	 * If we are managing the highest priority standby, though we weren't
@@ -710,3 +766,18 @@ assign_synchronous_commit(int newval, void *extra)
 			break;
 	}
 }
+
+void
+assign_synchronous_transfer(int newval, void *extra)
+{
+	switch (newval)
+	{
+		case SYNCHRONOUS_TRANSFER_ALL:
+		case SYNCHRONOUS_TRANSFER_DATA_FLUSH:
+			SyncTransferMode = SYNC_REP_WAIT_DATA_FLUSH;
+			break;
+		default:
+			SyncTransferMode = SYNC_REP_NO_WAIT;
+			break;
+	}
+}
diff --git a/src/backend/replication/walsender.c b/src/backend/replication/walsender.c
index afd559d..492e039 100644
--- a/src/backend/replication/walsender.c
+++ b/src/backend/replication/walsender.c
@@ -1539,6 +1539,10 @@ XLogSend(bool *caughtup)
 
 		*caughtup = true;
 
+		elog(WARNING, "XLogSend sendTimeLineValidUpto(%X/%X) <= sentPtr(%X/%X) AND sendTImeLine",
+			 (uint32) (sendTimeLineValidUpto >> 32), (uint32) sendTimeLineValidUpto,
+			 (uint32) (sentPtr >> 32), (uint32) sentPtr);
+
 		elog(DEBUG1, "walsender reached end of timeline at %X/%X (sent up to %X/%X)",
 			 (uint32) (sendTimeLineValidUpto >> 32), (uint32) sendTimeLineValidUpto,
 			 (uint32) (sentPtr >> 32), (uint32) sentPtr);
diff --git a/src/backend/storage/buffer/bufmgr.c b/src/backend/storage/buffer/bufmgr.c
index f848391..7a2e285 100644
--- a/src/backend/storage/buffer/bufmgr.c
+++ b/src/backend/storage/buffer/bufmgr.c
@@ -41,6 +41,8 @@
 #include "pg_trace.h"
 #include "pgstat.h"
 #include "postmaster/bgwriter.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/buf_internals.h"
 #include "storage/bufmgr.h"
 #include "storage/ipc.h"
@@ -1975,8 +1977,14 @@ FlushBuffer(volatile BufferDesc *buf, SMgrRelation reln)
 	 * skip the flush if the buffer isn't permanent.
 	 */
 	if (buf->flags & BM_PERMANENT)
+	{
 		XLogFlush(recptr);
-
+		/* If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to recptr.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(recptr, true, true);
+	}
 	/*
 	 * Now it's safe to write buffer to disk. Note that no one else should
 	 * have been able to write it while we were busy with log flushing because
diff --git a/src/backend/utils/cache/relmapper.c b/src/backend/utils/cache/relmapper.c
index 18f0342..e92b607 100644
--- a/src/backend/utils/cache/relmapper.c
+++ b/src/backend/utils/cache/relmapper.c
@@ -48,6 +48,8 @@
 #include "catalog/pg_tablespace.h"
 #include "catalog/storage.h"
 #include "miscadmin.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/fd.h"
 #include "storage/lwlock.h"
 #include "utils/inval.h"
@@ -711,6 +713,7 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	int			fd;
 	RelMapFile *realmap;
 	char		mapfilename[MAXPGPATH];
+	XLogRecPtr	lsn=InvalidXLogRecPtr;
 
 	/*
 	 * Fill in the overhead fields and update CRC.
@@ -753,7 +756,6 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	{
 		xl_relmap_update xlrec;
 		XLogRecData rdata[2];
-		XLogRecPtr	lsn;
 
 		/* now errors are fatal ... */
 		START_CRIT_SECTION();
@@ -775,6 +777,7 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 
 		/* As always, WAL must hit the disk before the data update does */
 		XLogFlush(lsn);
+
 	}
 
 	errno = 0;
@@ -849,6 +852,13 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	/* Critical section done */
 	if (write_wal)
 		END_CRIT_SECTION();
+
+	/*
+	 * If synchronous transfer is requested, wait for failback safe
+	 * standby to receive WAL up to recptr.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(lsn, true, true);
 }
 
 /*
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 3107f9c..ccac724 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -381,6 +381,18 @@ static const struct config_enum_entry synchronous_commit_options[] = {
 };
 
 /*
+ * Although only "all", "data_flush", and "commit" are documented, we
+ * accept all the likely variants of "off".
+ */
+static const struct config_enum_entry synchronous_transfer_options[] = {
+	{"all", SYNCHRONOUS_TRANSFER_ALL, false},
+	{"data_flush", SYNCHRONOUS_TRANSFER_DATA_FLUSH, false},
+	{"commit", SYNCHRONOUS_TRANSFER_COMMIT, true},
+	{"0", SYNCHRONOUS_TRANSFER_COMMIT, true},
+	{NULL, 0, false}
+};
+
+/*
  * Options for enum values stored in other modules
  */
 extern const struct config_enum_entry wal_level_options[];
@@ -3300,6 +3312,16 @@ static struct config_enum ConfigureNamesEnum[] =
 	},
 
 	{
+		{"synchronous_transfer", PGC_SIGHUP, WAL_SETTINGS,
+			gettext_noop("Sets the data flush synchronization level"),
+			NULL
+		},
+		&synchronous_transfer,
+		SYNCHRONOUS_TRANSFER_COMMIT, synchronous_transfer_options,
+		NULL, assign_synchronous_transfer, NULL
+	},
+
+	{
 		{"trace_recovery_messages", PGC_SIGHUP, DEVELOPER_OPTIONS,
 			gettext_noop("Enables logging of recovery-related debugging information."),
 			gettext_noop("Each level includes all the levels that follow it. The later"
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample
index d69a02b..d6603c2 100644
--- a/src/backend/utils/misc/postgresql.conf.sample
+++ b/src/backend/utils/misc/postgresql.conf.sample
@@ -220,6 +220,8 @@
 #synchronous_standby_names = ''	# standby servers that provide sync rep
 				# comma-separated list of application_name
 				# from standby(s); '*' = all
+#synchronous_transfer = commit	# data page synchronization level
+				# commit, data_flush or all
 #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
 
 # - Standby Servers -
diff --git a/src/backend/utils/time/tqual.c b/src/backend/utils/time/tqual.c
index ed66c49..6cf3f26 100644
--- a/src/backend/utils/time/tqual.c
+++ b/src/backend/utils/time/tqual.c
@@ -60,6 +60,8 @@
 #include "access/subtrans.h"
 #include "access/transam.h"
 #include "access/xact.h"
+#include "replication/walsender.h"
+#include "replication/syncrep.h"
 #include "storage/bufmgr.h"
 #include "storage/procarray.h"
 #include "utils/tqual.h"
@@ -115,6 +117,18 @@ SetHintBits(HeapTupleHeader tuple, Buffer buffer,
 
 		if (XLogNeedsFlush(commitLSN) && BufferIsPermanent(buffer))
 			return;				/* not flushed yet, so don't set hint */
+
+		/*
+		 * If synchronous transfer is requested, we check if the commit WAL record
+		 * has made to the standby before allowing hint bit updates. We should not
+		 * wait for the standby to receive the WAL since its OK to delay hint bit
+		 * updates.
+		 */
+		if (SyncTransRequested())
+		{
+			if(!SyncRepWaitForLSN(commitLSN, true, false))
+				return;
+		}
 	}
 
 	tuple->t_infomask |= infomask;
diff --git a/src/include/replication/syncrep.h b/src/include/replication/syncrep.h
index ac23ea6..4540625 100644
--- a/src/include/replication/syncrep.h
+++ b/src/include/replication/syncrep.h
@@ -19,23 +19,42 @@
 #define SyncRepRequested() \
 	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
 
+#define SyncTransRequested() \
+	(max_wal_senders > 0 && synchronous_transfer > SYNCHRONOUS_TRANSFER_COMMIT)
+
+#define IsSyncRepSkipped() \
+	(max_wal_senders > 0 && synchronous_transfer ==  SYNCHRONOUS_TRANSFER_DATA_FLUSH)
+
 /* SyncRepWaitMode */
-#define SYNC_REP_NO_WAIT		-1
-#define SYNC_REP_WAIT_WRITE		0
-#define SYNC_REP_WAIT_FLUSH		1
+#define SYNC_REP_NO_WAIT					-1
+#define SYNC_REP_WAIT_WRITE					0
+#define SYNC_REP_WAIT_FLUSH					1
+#define SYNC_REP_WAIT_DATA_FLUSH	2
 
-#define NUM_SYNC_REP_WAIT_MODE	2
+#define NUM_SYNC_REP_WAIT_MODE				3
 
 /* syncRepState */
-#define SYNC_REP_NOT_WAITING		0
-#define SYNC_REP_WAITING			1
-#define SYNC_REP_WAIT_COMPLETE		2
+#define SYNC_REP_NOT_WAITING					0
+#define SYNC_REP_WAITING						1
+#define SYNC_REP_WAIT_COMPLETE					2
+
+typedef enum
+{
+	SYNCHRONOUS_TRANSFER_COMMIT,		/* no wait for flush data page */
+	SYNCHRONOUS_TRANSFER_DATA_FLUSH,	/* wait for data page flush only
+										 * no wait for WAL */
+	SYNCHRONOUS_TRANSFER_ALL	        /* wait for data page flush */
+}	SynchronousTransferLevel;
 
 /* user-settable parameters for synchronous replication */
 extern char *SyncRepStandbyNames;
 
+/* user-settable parameters for failback safe replication */
+extern int	synchronous_transfer;
+
 /* called by user backend */
-extern void SyncRepWaitForLSN(XLogRecPtr XactCommitLSN);
+extern bool SyncRepWaitForLSN(XLogRecPtr XactCommitLSN,
+		bool ForDataFlush, bool Wait);
 
 /* called at backend exit */
 extern void SyncRepCleanupAtProcExit(void);
@@ -52,5 +71,6 @@ extern int	SyncRepWakeQueue(bool all, int mode);
 
 extern bool check_synchronous_standby_names(char **newval, void **extra, GucSource source);
 extern void assign_synchronous_commit(int newval, void *extra);
+extern void assign_synchronous_transfer(int newval, void *extra);
 
 #endif   /* _SYNCREP_H */

*** a/src/backend/access/transam/clog.c
--- b/src/backend/access/transam/clog.c
***************
*** 37,42 ****
--- 37,44 ----
  #include "access/transam.h"
  #include "miscadmin.h"
  #include "pg_trace.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  
  /*
   * Defines for CLOG page sizes.  A page is the same BLCKSZ as is used
***************
*** 708,715 **** WriteZeroPageXlogRec(int pageno)
  /*
   * Write a TRUNCATE xlog record
   *
!  * We must flush the xlog record to disk before returning --- see notes
!  * in TruncateCLOG().
   */
  static void
  WriteTruncateXlogRec(int pageno)
--- 710,719 ----
  /*
   * Write a TRUNCATE xlog record
   *
!  * Before returning we must flush the xlog record to disk
!  * and if synchronous transfer is requested wait for failback
!  * safe standby to receive WAL up to recptr.
!  * --- see notes in TruncateCLOG().
   */
  static void
  WriteTruncateXlogRec(int pageno)
***************
*** 723,728 **** WriteTruncateXlogRec(int pageno)
--- 727,738 ----
  	rdata.next = NULL;
  	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
  	XLogFlush(recptr);
+ 
+ 	/*
+ 	 * Wait for failback safe standby.
+ 	 */
+ 	if (SyncTransRequested())
+ 		SyncRepWaitForLSN(recptr, true, true);
  }
  
  /*
*** a/src/backend/access/transam/slru.c
--- b/src/backend/access/transam/slru.c
***************
*** 54,59 ****
--- 54,61 ----
  #include "access/slru.h"
  #include "access/transam.h"
  #include "access/xlog.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "storage/shmem.h"
  #include "miscadmin.h"
***************
*** 700,705 **** SlruPhysicalWritePage(SlruCtl ctl, int pageno, int slotno, SlruFlush fdata)
--- 702,714 ----
  			START_CRIT_SECTION();
  			XLogFlush(max_lsn);
  			END_CRIT_SECTION();
+ 
+ 			/*
+ 			 * If synchronous transfer is requested, wait for failback safe
+ 			 * standby to receive WAL up to max_lsn.
+ 			 */
+ 			if (SyncTransRequested())
+ 				SyncRepWaitForLSN(max_lsn, true, true);
  		}
  	}
  
*** a/src/backend/access/transam/twophase.c
--- b/src/backend/access/transam/twophase.c
***************
*** 1091,1102 **** EndPrepare(GlobalTransaction gxact)
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked the prepare, but still show as
  	 * running in the procarray (twice!) and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(gxact->prepare_lsn);
  
  	records.tail = records.head = NULL;
  }
--- 1091,1102 ----
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked the prepare, but still show as
  	 * running in the procarray (twice!) and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(gxact->prepare_lsn, false, true);
  
  	records.tail = records.head = NULL;
  }
***************
*** 2058,2069 **** RecordTransactionCommitPrepared(TransactionId xid,
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr);
  }
  
  /*
--- 2058,2069 ----
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr, false, true);
  }
  
  /*
***************
*** 2138,2147 **** RecordTransactionAbortPrepared(TransactionId xid,
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr);
  }
--- 2138,2147 ----
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr, false, true);
  }
*** a/src/backend/access/transam/xact.c
--- b/src/backend/access/transam/xact.c
***************
*** 1189,1201 **** RecordTransactionCommit(void)
  	latestXid = TransactionIdLatest(xid, nchildren, children);
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
  	if (wrote_xlog)
! 		SyncRepWaitForLSN(XactLastRecEnd);
  
  	/* Reset XactLastRecEnd until the next transaction writes something */
  	XactLastRecEnd = 0;
--- 1189,1201 ----
  	latestXid = TransactionIdLatest(xid, nchildren, children);
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
  	if (wrote_xlog)
! 		SyncRepWaitForLSN(XactLastRecEnd, false, true);
  
  	/* Reset XactLastRecEnd until the next transaction writes something */
  	XactLastRecEnd = 0;
***************
*** 4690,4697 **** xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
--- 4690,4706 ----
  	 * for any user that requested ForceSyncCommit().
  	 */
  	if (XactCompletionForceSyncCommit(xinfo))
+ 	{
  		XLogFlush(lsn);
  
+ 		/*
+ 		 * If synchronous transfer is requested, wait for failback safe
+ 		 * standby to receive WAL up to lsn,
+ 		 */
+ 		if (SyncTransRequested())
+ 			SyncRepWaitForLSN(lsn, true, true);
+ 
+ 	}
  }
  
  /*
*** a/src/backend/access/transam/xlog.c
--- b/src/backend/access/transam/xlog.c
***************
*** 39,46 ****
--- 39,48 ----
  #include "pgstat.h"
  #include "postmaster/bgwriter.h"
  #include "postmaster/startup.h"
+ #include "replication/syncrep.h"
  #include "replication/walreceiver.h"
  #include "replication/walsender.h"
+ #include "replication/syncrep.h"
  #include "storage/barrier.h"
  #include "storage/bufmgr.h"
  #include "storage/fd.h"
***************
*** 8286,8291 **** CreateCheckPoint(int flags)
--- 8288,8305 ----
  	END_CRIT_SECTION();
  
  	/*
+ 	 * If synchronous transfer is requested, wait for failback safe standby
+ 	 * to receive WAL up to checkpoint WAL record. Otherwise if failure occurs
+ 	 * before standby receives CHECKPOINT WAL record causes an inconsistency
+ 	 * between control files of master and standby. Because of this master will
+ 	 * start from a location which is not known to the standby at the time fail-over.
+ 	 *
+ 	 * There is no need to wait for shutdown CHECKPOINT.
+ 	 */
+ 	if (SyncTransRequested())
+ 		SyncRepWaitForLSN(recptr, true, !shutdown);
+ 
+ 	/*
  	 * Let smgr do post-checkpoint cleanup (eg, deleting old files).
  	 */
  	smgrpostckpt();
*** a/src/backend/catalog/storage.c
--- b/src/backend/catalog/storage.c
***************
*** 25,30 ****
--- 25,32 ----
  #include "catalog/catalog.h"
  #include "catalog/storage.h"
  #include "catalog/storage_xlog.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/freespace.h"
  #include "storage/smgr.h"
  #include "utils/memutils.h"
***************
*** 288,293 **** RelationTruncate(Relation rel, BlockNumber nblocks)
--- 290,303 ----
  		 */
  		if (fsm || vm)
  			XLogFlush(lsn);
+ 
+ 		/*
+ 		 * If synchronous transfer is requested, wait for failback safe standby
+ 		 * to receive WAL up to lsn. Otherwise, we may have a situation where
+ 		 * the heap is truncated, but the action never replayed on the standby.
+ 		 */
+ 		if (SyncTransRequested())
+ 			SyncRepWaitForLSN(lsn, true, true);
  	}
  
  	/* Do the real work */
***************
*** 521,526 **** smgr_redo(XLogRecPtr lsn, XLogRecord *record)
--- 531,543 ----
  		 */
  		XLogFlush(lsn);
  
+ 		/*
+ 		 * If synchronous transfer is requested, wait for failback safe standby
+ 		 * to receive WAL up to lsn.
+ 		 */
+ 		if (SyncTransRequested())
+ 			SyncRepWaitForLSN(lsn, true, true);
+ 
  		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
  
  		/* Also tell xlogutils.c about it */
*** a/src/backend/replication/syncrep.c
--- b/src/backend/replication/syncrep.c
***************
*** 65,70 **** char	   *SyncRepStandbyNames;
--- 65,72 ----
  static bool announce_next_takeover = true;
  
  static int	SyncRepWaitMode = SYNC_REP_NO_WAIT;
+ static int	SyncTransferMode = SYNC_REP_NO_WAIT;
+ int		synchronous_transfer = SYNCHRONOUS_TRANSFER_COMMIT;
  
  static void SyncRepQueueInsert(int mode);
  static void SyncRepCancelWait(void);
***************
*** 82,101 **** static bool SyncRepQueueIsOrderedByLSN(int mode);
   */
  
  /*
!  * Wait for synchronous replication, if requested by user.
   *
   * Initially backends start in state SYNC_REP_NOT_WAITING and then
!  * change that state to SYNC_REP_WAITING before adding ourselves
!  * to the wait queue. During SyncRepWakeQueue() a WALSender changes
!  * the state to SYNC_REP_WAIT_COMPLETE once replication is confirmed.
!  * This backend then resets its state to SYNC_REP_NOT_WAITING.
   */
! void
! SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  {
  	char	   *new_status = NULL;
  	const char *old_status;
! 	int			mode = SyncRepWaitMode;
  
  	/*
  	 * Fast exit if user has not requested sync replication, or there are no
--- 84,114 ----
   */
  
  /*
!  * Wait for synchronous/failback safe standby, if requested by user.
   *
   * Initially backends start in state SYNC_REP_NOT_WAITING and then
!  * change that state to SYNC_REP_WAITING/SYNC_REP_WAITING_FOR_DATA_FLUSH
!  * before adding ourselves to the wait queue. During SyncRepWakeQueue() a
!  * WALSender changes the state to SYNC_REP_WAIT_COMPLETE once replication is
!  * confirmed. This backend then resets its state to SYNC_REP_NOT_WAITING.
!  *
!  * ForDataFlush - if TRUE, we wait before flushing data page.
!  * Otherwise wait for the sync standby
!  *
!  * Wait - if FALSE, we don't actually wait, but tell the caller whether or not
!  * the standby has already made progressed upto the given XactCommitLSN
!  *
!  * Return TRUE if either the synchronous standby/failback safe standby is not
!  * configured/turned off OR the standby has made enough progress
   */
! bool
! SyncRepWaitForLSN(XLogRecPtr XactCommitLSN, bool ForDataFlush, bool Wait)
  {
  	char	   *new_status = NULL;
  	const char *old_status;
! 	int			mode = !ForDataFlush ? SyncRepWaitMode : SyncTransferMode;
! 	bool		ret;
! 	int			i;
  
  	/*
  	 * Fast exit if user has not requested sync replication, or there are no
***************
*** 103,109 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  	 * need to be connected.
  	 */
  	if (!SyncRepRequested() || !SyncStandbysDefined())
! 		return;
  
  	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
  	Assert(WalSndCtl != NULL);
--- 116,148 ----
  	 * need to be connected.
  	 */
  	if (!SyncRepRequested() || !SyncStandbysDefined())
! 		return true;
! 
! 	/*
! 	 * If the caller has specified ForDataFlush, but synchronous transfer
! 	 * is not specified or its turned off, exit.
! 	 *
! 	 * We would like to allow the failback safe mechanism even for cascaded
! 	 * standbys as well. But we can't really wait for the standby to catch
! 	 * up until we reach a consistent state since the standbys won't be
! 	 * even able to connect without us reaching in that state (XXX Confirm)
! 	 */
! 	if ((!SyncTransRequested()) && ForDataFlush)
! 		return true;
! 
! 	/*
! 	 * If the caller has not specified ForDataFlush, but synchronous commit
! 	 * is skipped by values of synchronous_transfer, exit.
! 	 */
! 	if (IsSyncRepSkipped() && !ForDataFlush)
! 		return true;
! 
! 	/*
! 	 * If both synchronous replication and synchronous transfer
! 	 * are requested but the system still in recovery, exit.
! 	 */
! 	if (RecoveryInProgress())
! 		return true;
  
  	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
  	Assert(WalSndCtl != NULL);
***************
*** 119,129 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  	 * condition but we'll be fetching that cache line anyway so its likely to
  	 * be a low cost check.
  	 */
! 	if (!WalSndCtl->sync_standbys_defined ||
  		XactCommitLSN <= WalSndCtl->lsn[mode])
  	{
  		LWLockRelease(SyncRepLock);
! 		return;
  	}
  
  	/*
--- 158,177 ----
  	 * condition but we'll be fetching that cache line anyway so its likely to
  	 * be a low cost check.
  	 */
! 	if ((!ForDataFlush && !WalSndCtl->sync_standbys_defined) ||
  		XactCommitLSN <= WalSndCtl->lsn[mode])
  	{
  		LWLockRelease(SyncRepLock);
! 		return true;
! 	}
! 
! 	/*
! 	 * Exit if we are told not to block on the standby.
! 	 */
! 	if (!Wait)
! 	{
! 		LWLockRelease(SyncRepLock);
! 		return false;
  	}
  
  	/*
***************
*** 150,155 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 198,205 ----
  		new_status[len] = '\0'; /* truncate off " waiting ..." */
  	}
  
+ 	ret = false;
+ 
  	/*
  	 * Wait for specified LSN to be confirmed.
  	 *
***************
*** 186,192 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 236,245 ----
  			LWLockRelease(SyncRepLock);
  		}
  		if (syncRepState == SYNC_REP_WAIT_COMPLETE)
+ 		{
+ 			ret = true;
  			break;
+ 		}
  
  		/*
  		 * If a wait for synchronous replication is pending, we can neither
***************
*** 263,268 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 316,323 ----
  		set_ps_display(new_status, false);
  		pfree(new_status);
  	}
+ 
+ 	return ret;
  }
  
  /*
***************
*** 370,375 **** SyncRepReleaseWaiters(void)
--- 425,431 ----
  	volatile WalSnd *syncWalSnd = NULL;
  	int			numwrite = 0;
  	int			numflush = 0;
+ 	int			numdataflush = 0;
  	int			priority = 0;
  	int			i;
  
***************
*** 437,449 **** SyncRepReleaseWaiters(void)
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
  		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
  	}
  
  	LWLockRelease(SyncRepLock);
  
! 	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X",
! 		 numwrite, (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
! 	   numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
  
  	/*
  	 * If we are managing the highest priority standby, though we weren't
--- 493,513 ----
  	{
  		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
  		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
+ 
+ 	}
+ 	if (walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] < MyWalSnd->flush)
+ 	{
+ 		walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] = MyWalSnd->flush;
+ 		numdataflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_DATA_FLUSH);
+ 
  	}
  
  	LWLockRelease(SyncRepLock);
  
! 	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X, %d procs up to data flush %X/%X",
! 		 numwrite    , (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
! 		 numflush    , (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush,
! 		 numdataflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
  
  	/*
  	 * If we are managing the highest priority standby, though we weren't
***************
*** 709,711 **** assign_synchronous_commit(int newval, void *extra)
--- 773,790 ----
  			break;
  	}
  }
+ 
+ void
+ assign_synchronous_transfer(int newval, void *extra)
+ {
+ 	switch (newval)
+ 	{
+ 		case SYNCHRONOUS_TRANSFER_ALL:
+ 		case SYNCHRONOUS_TRANSFER_DATA_FLUSH:
+ 			SyncTransferMode = SYNC_REP_WAIT_DATA_FLUSH;
+ 			break;
+ 		default:
+ 			SyncTransferMode = SYNC_REP_NO_WAIT;
+ 			break;
+ 	}
+ }
*** a/src/backend/replication/walsender.c
--- b/src/backend/replication/walsender.c
***************
*** 1539,1544 **** XLogSend(bool *caughtup)
--- 1539,1548 ----
  
  		*caughtup = true;
  
+ 		elog(WARNING, "XLogSend sendTimeLineValidUpto(%X/%X) <= sentPtr(%X/%X) AND sendTImeLine",
+ 			 (uint32) (sendTimeLineValidUpto >> 32), (uint32) sendTimeLineValidUpto,
+ 			 (uint32) (sentPtr >> 32), (uint32) sentPtr);
+ 
  		elog(DEBUG1, "walsender reached end of timeline at %X/%X (sent up to %X/%X)",
  			 (uint32) (sendTimeLineValidUpto >> 32), (uint32) sendTimeLineValidUpto,
  			 (uint32) (sentPtr >> 32), (uint32) sentPtr);
*** a/src/backend/storage/buffer/bufmgr.c
--- b/src/backend/storage/buffer/bufmgr.c
***************
*** 41,46 ****
--- 41,48 ----
  #include "pg_trace.h"
  #include "pgstat.h"
  #include "postmaster/bgwriter.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/buf_internals.h"
  #include "storage/bufmgr.h"
  #include "storage/ipc.h"
***************
*** 1975,1982 **** FlushBuffer(volatile BufferDesc *buf, SMgrRelation reln)
  	 * skip the flush if the buffer isn't permanent.
  	 */
  	if (buf->flags & BM_PERMANENT)
  		XLogFlush(recptr);
! 
  	/*
  	 * Now it's safe to write buffer to disk. Note that no one else should
  	 * have been able to write it while we were busy with log flushing because
--- 1977,1990 ----
  	 * skip the flush if the buffer isn't permanent.
  	 */
  	if (buf->flags & BM_PERMANENT)
+ 	{
  		XLogFlush(recptr);
! 		/* If synchronous transfer is requested, wait for failback safe standby
! 		 * to receive WAL up to recptr.
! 		 */
! 		if (SyncTransRequested())
! 			SyncRepWaitForLSN(recptr, true, true);
! 	}
  	/*
  	 * Now it's safe to write buffer to disk. Note that no one else should
  	 * have been able to write it while we were busy with log flushing because
*** a/src/backend/utils/cache/relmapper.c
--- b/src/backend/utils/cache/relmapper.c
***************
*** 48,53 ****
--- 48,55 ----
  #include "catalog/pg_tablespace.h"
  #include "catalog/storage.h"
  #include "miscadmin.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "storage/lwlock.h"
  #include "utils/inval.h"
***************
*** 711,716 **** write_relmap_file(bool shared, RelMapFile *newmap,
--- 713,719 ----
  	int			fd;
  	RelMapFile *realmap;
  	char		mapfilename[MAXPGPATH];
+ 	XLogRecPtr	lsn=InvalidXLogRecPtr;
  
  	/*
  	 * Fill in the overhead fields and update CRC.
***************
*** 753,759 **** write_relmap_file(bool shared, RelMapFile *newmap,
  	{
  		xl_relmap_update xlrec;
  		XLogRecData rdata[2];
- 		XLogRecPtr	lsn;
  
  		/* now errors are fatal ... */
  		START_CRIT_SECTION();
--- 756,761 ----
***************
*** 775,780 **** write_relmap_file(bool shared, RelMapFile *newmap,
--- 777,783 ----
  
  		/* As always, WAL must hit the disk before the data update does */
  		XLogFlush(lsn);
+ 
  	}
  
  	errno = 0;
***************
*** 849,854 **** write_relmap_file(bool shared, RelMapFile *newmap,
--- 852,864 ----
  	/* Critical section done */
  	if (write_wal)
  		END_CRIT_SECTION();
+ 
+ 	/*
+ 	 * If synchronous transfer is requested, wait for failback safe
+ 	 * standby to receive WAL up to recptr.
+ 	 */
+ 	if (SyncTransRequested())
+ 		SyncRepWaitForLSN(lsn, true, true);
  }
  
  /*
*** a/src/backend/utils/misc/guc.c
--- b/src/backend/utils/misc/guc.c
***************
*** 381,386 **** static const struct config_enum_entry synchronous_commit_options[] = {
--- 381,398 ----
  };
  
  /*
+  * Although only "all", "data_flush", and "commit" are documented, we
+  * accept all the likely variants of "off".
+  */
+ static const struct config_enum_entry synchronous_transfer_options[] = {
+ 	{"all", SYNCHRONOUS_TRANSFER_ALL, false},
+ 	{"data_flush", SYNCHRONOUS_TRANSFER_DATA_FLUSH, false},
+ 	{"commit", SYNCHRONOUS_TRANSFER_COMMIT, true},
+ 	{"0", SYNCHRONOUS_TRANSFER_COMMIT, true},
+ 	{NULL, 0, false}
+ };
+ 
+ /*
   * Options for enum values stored in other modules
   */
  extern const struct config_enum_entry wal_level_options[];
***************
*** 3290,3295 **** static struct config_enum ConfigureNamesEnum[] =
--- 3302,3317 ----
  	},
  
  	{
+ 		{"synchronous_transfer", PGC_SIGHUP, WAL_SETTINGS,
+ 			gettext_noop("Sets the data flush synchronization level"),
+ 			NULL
+ 		},
+ 		&synchronous_transfer,
+ 		SYNCHRONOUS_TRANSFER_COMMIT, synchronous_transfer_options,
+ 		NULL, assign_synchronous_transfer, NULL
+ 	},
+ 
+ 	{
  		{"trace_recovery_messages", PGC_SIGHUP, DEVELOPER_OPTIONS,
  			gettext_noop("Enables logging of recovery-related debugging information."),
  			gettext_noop("Each level includes all the levels that follow it. The later"
*** a/src/backend/utils/misc/postgresql.conf.sample
--- b/src/backend/utils/misc/postgresql.conf.sample
***************
*** 220,225 ****
--- 220,227 ----
  #synchronous_standby_names = ''	# standby servers that provide sync rep
  				# comma-separated list of application_name
  				# from standby(s); '*' = all
+ #synchronous_transfer = commit	# data page synchronization level
+ 				# commit, data_flush or all
  #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
  
  # - Standby Servers -
*** a/src/backend/utils/time/tqual.c
--- b/src/backend/utils/time/tqual.c
***************
*** 62,67 ****
--- 62,69 ----
  #include "access/subtrans.h"
  #include "access/transam.h"
  #include "access/xact.h"
+ #include "replication/walsender.h"
+ #include "replication/syncrep.h"
  #include "storage/bufmgr.h"
  #include "storage/procarray.h"
  #include "utils/tqual.h"
***************
*** 118,123 **** SetHintBits(HeapTupleHeader tuple, Buffer buffer,
--- 120,137 ----
  
  		if (XLogNeedsFlush(commitLSN) && BufferIsPermanent(buffer))
  			return;				/* not flushed yet, so don't set hint */
+ 
+ 		/*
+ 		 * If synchronous transfer is requested, we check if the commit WAL record
+ 		 * has made to the standby before allowing hint bit updates. We should not
+ 		 * wait for the standby to receive the WAL since its OK to delay hint bit
+ 		 * updates.
+ 		 */
+ 		if (SyncTransRequested())
+ 		{
+ 			if(!SyncRepWaitForLSN(commitLSN, true, false))
+ 				return;
+ 		}
  	}
  
  	tuple->t_infomask |= infomask;
*** a/src/include/replication/syncrep.h
--- b/src/include/replication/syncrep.h
***************
*** 19,41 ****
  #define SyncRepRequested() \
  	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
  
  /* SyncRepWaitMode */
! #define SYNC_REP_NO_WAIT		-1
! #define SYNC_REP_WAIT_WRITE		0
! #define SYNC_REP_WAIT_FLUSH		1
  
! #define NUM_SYNC_REP_WAIT_MODE	2
  
  /* syncRepState */
! #define SYNC_REP_NOT_WAITING		0
! #define SYNC_REP_WAITING			1
! #define SYNC_REP_WAIT_COMPLETE		2
  
  /* user-settable parameters for synchronous replication */
  extern char *SyncRepStandbyNames;
  
  /* called by user backend */
! extern void SyncRepWaitForLSN(XLogRecPtr XactCommitLSN);
  
  /* called at backend exit */
  extern void SyncRepCleanupAtProcExit(void);
--- 19,60 ----
  #define SyncRepRequested() \
  	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
  
+ #define SyncTransRequested() \
+ 	(max_wal_senders > 0 && synchronous_transfer > SYNCHRONOUS_TRANSFER_COMMIT)
+ 
+ #define IsSyncRepSkipped() \
+ 	(max_wal_senders > 0 && synchronous_transfer ==  SYNCHRONOUS_TRANSFER_DATA_FLUSH)
+ 
  /* SyncRepWaitMode */
! #define SYNC_REP_NO_WAIT					-1
! #define SYNC_REP_WAIT_WRITE					0
! #define SYNC_REP_WAIT_FLUSH					1
! #define SYNC_REP_WAIT_DATA_FLUSH	2
  
! #define NUM_SYNC_REP_WAIT_MODE				3
  
  /* syncRepState */
! #define SYNC_REP_NOT_WAITING					0
! #define SYNC_REP_WAITING						1
! #define SYNC_REP_WAIT_COMPLETE					2
! 
! typedef enum
! {
! 	SYNCHRONOUS_TRANSFER_COMMIT,		/* no wait for flush data page */
! 	SYNCHRONOUS_TRANSFER_DATA_FLUSH,	/* wait for data page flush only
! 										 * no wait for WAL */
! 	SYNCHRONOUS_TRANSFER_ALL	        /* wait for data page flush */
! }	SynchronousTransferLevel;
  
  /* user-settable parameters for synchronous replication */
  extern char *SyncRepStandbyNames;
  
+ /* user-settable parameters for failback safe replication */
+ extern int	synchronous_transfer;
+ 
  /* called by user backend */
! extern bool SyncRepWaitForLSN(XLogRecPtr XactCommitLSN,
! 		bool ForDataFlush, bool Wait);
  
  /* called at backend exit */
  extern void SyncRepCleanupAtProcExit(void);
***************
*** 52,56 **** extern int	SyncRepWakeQueue(bool all, int mode);
--- 71,76 ----
  
  extern bool check_synchronous_standby_names(char **newval, void **extra, GucSource source);
  extern void assign_synchronous_commit(int newval, void *extra);
+ extern void assign_synchronous_transfer(int newval, void *extra);
  
  #endif   /* _SYNCREP_H */

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 370aa09..86d2265 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1749,6 +1749,39 @@ include 'filename'
       </listitem>
      </varlistentry>
 
+     <varlistentry id="guc-synchronous-transfer" xreflabel="synchronous_transfer">
+      <term><varname>synchronous_transfer</varname> (<type>enum</type>)</term>
+      <indexterm>
+       <primary><varname>synchronous_transfer</> configuration parameter</primary>
+      </indexterm>
+      <listitem>
+       <para>
+        This parameter controls the synchronous nature of WAL transfer and
+        maintains file system level consistency between master server and
+        standby server. Specifies whether master server will wait for file
+        system level change (for example : modifying data page) before
+        corresponding WAL records are replicated to the standby server.
+       </para>
+       <para>
+        Valid values are <literal>commit</>, <literal>data_flush</> and
+        <literal>all</>. The default value is <literal>commit</>, meaning
+        that master only wait for transaction commits, this is equivalent
+        to turning off <literal>synchronous_transfer</> parameter and standby
+        server will behave as a <quote>synchronous standby </> in
+        Streaming Replication. For value <literal>data_flush</>, master will
+        wait only for data page modifications but not for transaction
+        commits, hence the standby server will act as <quote>asynchronous
+        failback safe standby</>. For value <literal> all</>, master will wait
+        for data page modifications as well as for transaction commits and
+        resultant standby server will act as <quote>synchronous failback safe
+        standby</>. The wait is on background activities and hence will not
+        create much performance overhead.
+        To configure synchronous failback safe standby
+        <xref linkend="guc-synchronous-standby-names"> should be set.
+       </para>
+      </listitem>
+     </varlistentry>
+
      <varlistentry id="guc-wal-sync-method" xreflabel="wal_sync_method">
       <term><varname>wal_sync_method</varname> (<type>enum</type>)</term>
       <indexterm>
@@ -2258,14 +2291,25 @@ include 'filename'
       </indexterm>
       <listitem>
        <para>
-        Specifies a comma-separated list of standby names that can support
-        <firstterm>synchronous replication</>, as described in
-        <xref linkend="synchronous-replication">.
-        At any one time there will be at most one active synchronous standby;
-        transactions waiting for commit will be allowed to proceed after
-        this standby server confirms receipt of their data.
-        The synchronous standby will be the first standby named in this list
-        that is both currently connected and streaming data in real-time
+        Specifies a comma-separated list of standby names. If this parameter
+        is set then standby will behave as synchronous standby in replication,
+        as described in <xref linkend="synchronous-replication"> or synchronous
+        failback safe standby, as described in <xref linkend="failback-safe">.
+        At any time there will be at most one active standby; when standby is
+        synchronous standby in replication, transactions waiting for commit
+        will be allowed to proceed after this standby server confirms receipt
+        of their data. But when standby is synchronous failback safe standby
+        data page modifications as well as transaction commits will be allowed
+        to proceed only after this standby server confirms receipt of their data.
+        If this parameter is set to empty value and
+        <xref linkend="guc-synchronous-transfer"> is set to <literal>data_flush</>
+        then standby is called as asynchronous failback safe standby and only
+        data page modifications will wait before corresponding WAL record is
+        replicated to standby.
+       </para>
+       <para>
+        Synchronous standby in replication will be the first standby named in
+        this list that is both currently connected and streaming data in real-time
         (as shown by a state of <literal>streaming</literal> in the
         <link linkend="monitoring-stats-views-table">
         <literal>pg_stat_replication</></link> view).
diff --git a/doc/src/sgml/high-availability.sgml b/doc/src/sgml/high-availability.sgml
index c8f6fa8..e551077 100644
--- a/doc/src/sgml/high-availability.sgml
+++ b/doc/src/sgml/high-availability.sgml
@@ -1140,6 +1140,64 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
 
    </sect3>
   </sect2>
+
+  <sect2 id="failback-safe">
+     <title>Setting up failback safe standby</title>
+
+   <indexterm zone="high-availability">
+       <primary>Setting up failback safe standby</primary>
+   </indexterm>
+
+   <para>
+    PostgreSQL Streaming Replication offers durability, but if the master
+    crashes and particular WAL record is unable to reach to standby
+    server, then that WAL record is present on master server but not
+    on standby server. In such a case master is ahead of standby server
+    in term of WAL records and Data in database. This will lead to
+    file-system level inconsistency between master and standby server.
+    For example a heap page update on the master might not have been reflected
+    on standby when master crashes.
+   </para>
+
+   <para>
+    Due to this inconsistency fresh backup of new master onto new standby
+    is needed to re-prepare HA cluster. Taking fresh backup can be very
+    time consuming process when database is of large size. In such a case
+    disaster recovery can take very long time if Streaming Replication is
+    used to setup the high availability cluster.
+   </para>
+
+   <para>
+    If HA cluster is configured with failback safe standby then this fresh
+    back up can be avoided. The <xref linkend="guc-synchronous-transfer">
+    parameter has control over all WAL transfers and will not make any file
+    system level change until master gets a confirmation from standby server.
+    This avoids the need of a fresh backup by maintaining consistency.
+   </para>
+
+   <sect3 id="Failback-safe-config">
+    <title>Basic Configuration</title>
+   <para>
+    Failback safe standby can be asynchronous or synchronous in nature.
+    This will depend upon whether master will wait for transaction commit
+    or not. By default failback safe mechanism is turned off.
+   </para>
+
+   <para>
+    The first step to configure HA with failback safe standby is to setup
+    synchronous streaming replication. Configuring synchronous failback
+    safe standby requires setting up  <xref linkend="guc-synchronous-transfer"> to
+    <literal>all</>. This configuration will cause each commit and data
+    page modification to wait for confirmation that standby has written
+    corresponding WAL record to durable storage. Configuring asynchronous
+    failback safe standby requires setting up <xref linkend="guc-synchronous-transfer">
+    to <literal> data_flush</>. This configuration will cause only data
+    page modifications to wait for confirmation that standby has written
+    corresponding WAL record to durable storage.
+   </para>
+
+  </sect3>
+  </sect2>
   </sect1>
 
   <sect1 id="warm-standby-failover">
@@ -1201,12 +1259,28 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
    </para>
 
    <para>
-    So, switching from primary to standby server can be fast but requires
-    some time to re-prepare the failover cluster. Regular switching from
-    primary to standby is useful, since it allows regular downtime on
-    each system for maintenance. This also serves as a test of the
-    failover mechanism to ensure that it will really work when you need it.
-    Written administration procedures are advised.
+    At the time of failover there is a possibility of file-system level
+    inconsistency between old primary and old standby server hence
+    fresh backup from new master onto old master is needed for Configuring
+    old standby server as a new standby server. Without taking fresh
+    backup even if the new standby starts, streaming replication does not
+    start successfully. The activity of taking backup can be fast for smaller
+    database but for large database requires more time to re-prepare the
+    failover cluster and could break the service level agreement of crash
+    recovery. The need of fresh backup and problem of long
+    recovery time can be solved if HA cluster is configured with
+    failback safe standby see <xref linkend="failback-safe">.
+    Failback safe standby makes WAL transfer synchronous at required
+    places and maintains the file-system level consistency between
+    master and standby server and the old master server can be easily
+    configured as new standby server.
+   </para>
+
+   <para>
+    Regular switching from primary to standby is useful, since it allows
+    regular downtime on each system for maintenance. This also serves as
+    a test of the failover mechanism to ensure that it will really work
+    when you need it. Written administration procedures are advised.
    </para>
 
    <para>
diff --git a/doc/src/sgml/perform.sgml b/doc/src/sgml/perform.sgml
index 2af1738..b074a91 100644
--- a/doc/src/sgml/perform.sgml
+++ b/doc/src/sgml/perform.sgml
@@ -1569,6 +1569,14 @@ SELECT * FROM x, y, a, b, c WHERE something AND somethingelse;
        corruption) in case of a crash of the <emphasis>database</> alone.
       </para>
      </listitem>
+
+     <listitem>
+      <para>
+       Set <xref linkend="guc-synchronous-transfer"> to commit; there is no
+       need to guard against database inconsistency between master and standby
+       server during failover.
+      </para>
+     </listitem>
     </itemizedlist>
    </para>
   </sect1>
diff --git a/src/backend/access/transam/clog.c b/src/backend/access/transam/clog.c
index cb95aa3..d216b2e 100644
--- a/src/backend/access/transam/clog.c
+++ b/src/backend/access/transam/clog.c
@@ -37,6 +37,8 @@
 #include "access/transam.h"
 #include "miscadmin.h"
 #include "pg_trace.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 
 /*
  * Defines for CLOG page sizes.  A page is the same BLCKSZ as is used
@@ -708,8 +710,10 @@ WriteZeroPageXlogRec(int pageno)
 /*
  * Write a TRUNCATE xlog record
  *
- * We must flush the xlog record to disk before returning --- see notes
- * in TruncateCLOG().
+ * Before returning we must flush the xlog record to disk
+ * and if synchronous transfer is requested wait for failback
+ * safe standby to receive WAL up to recptr.
+ * --- see notes in TruncateCLOG().
  */
 static void
 WriteTruncateXlogRec(int pageno)
@@ -723,6 +727,12 @@ WriteTruncateXlogRec(int pageno)
 	rdata.next = NULL;
 	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
 	XLogFlush(recptr);
+
+	/*
+	 * Wait for failback safe standby.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(recptr, true, true);
 }
 
 /*
diff --git a/src/backend/access/transam/slru.c b/src/backend/access/transam/slru.c
index 5e53593..069630b 100644
--- a/src/backend/access/transam/slru.c
+++ b/src/backend/access/transam/slru.c
@@ -54,6 +54,8 @@
 #include "access/slru.h"
 #include "access/transam.h"
 #include "access/xlog.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/fd.h"
 #include "storage/shmem.h"
 #include "miscadmin.h"
@@ -744,6 +746,13 @@ SlruPhysicalWritePage(SlruCtl ctl, int pageno, int slotno, SlruFlush fdata)
 			START_CRIT_SECTION();
 			XLogFlush(max_lsn);
 			END_CRIT_SECTION();
+
+			/*
+			 * If synchronous transfer is requested, wait for failback safe
+			 * standby to receive WAL up to max_lsn.
+			 */
+			if (SyncTransRequested())
+				SyncRepWaitForLSN(max_lsn, true, true);
 		}
 	}
 
diff --git a/src/backend/access/transam/twophase.c b/src/backend/access/transam/twophase.c
index e975f8d..38a9e9c 100644
--- a/src/backend/access/transam/twophase.c
+++ b/src/backend/access/transam/twophase.c
@@ -1091,12 +1091,12 @@ EndPrepare(GlobalTransaction gxact)
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked the prepare, but still show as
 	 * running in the procarray (twice!) and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(gxact->prepare_lsn);
+	SyncRepWaitForLSN(gxact->prepare_lsn, false, true);
 
 	records.tail = records.head = NULL;
 }
@@ -2058,12 +2058,12 @@ RecordTransactionCommitPrepared(TransactionId xid,
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(recptr);
+	SyncRepWaitForLSN(recptr, false, true);
 }
 
 /*
@@ -2138,10 +2138,10 @@ RecordTransactionAbortPrepared(TransactionId xid,
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(recptr);
+	SyncRepWaitForLSN(recptr, false, true);
 }
diff --git a/src/backend/access/transam/xact.c b/src/backend/access/transam/xact.c
index 0591f3f..25210df 100644
--- a/src/backend/access/transam/xact.c
+++ b/src/backend/access/transam/xact.c
@@ -1189,13 +1189,13 @@ RecordTransactionCommit(void)
 	latestXid = TransactionIdLatest(xid, nchildren, children);
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
 	if (wrote_xlog)
-		SyncRepWaitForLSN(XactLastRecEnd);
+		SyncRepWaitForLSN(XactLastRecEnd, false, true);
 
 	/* Reset XactLastRecEnd until the next transaction writes something */
 	XactLastRecEnd = 0;
@@ -4690,8 +4690,17 @@ xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
 	 * for any user that requested ForceSyncCommit().
 	 */
 	if (XactCompletionForceSyncCommit(xinfo))
+	{
 		XLogFlush(lsn);
 
+		/*
+		 * If synchronous transfer is requested, wait for failback safe
+		 * standby to receive WAL up to lsn,
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
+
+	}
 }
 
 /*
diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index fc495d6..ef46419 100644
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -39,8 +39,10 @@
 #include "pgstat.h"
 #include "postmaster/bgwriter.h"
 #include "postmaster/startup.h"
+#include "replication/syncrep.h"
 #include "replication/walreceiver.h"
 #include "replication/walsender.h"
+#include "replication/syncrep.h"
 #include "storage/barrier.h"
 #include "storage/bufmgr.h"
 #include "storage/fd.h"
@@ -8282,6 +8284,18 @@ CreateCheckPoint(int flags)
 	END_CRIT_SECTION();
 
 	/*
+	 * If synchronous transfer is requested, wait for failback safe standby
+	 * to receive WAL up to checkpoint WAL record. Otherwise if failure occurs
+	 * before standby receives CHECKPOINT WAL record causes an inconsistency
+	 * between control files of master and standby. Because of this master will
+	 * start from a location which is not known to the standby at the time fail-over.
+	 *
+	 * There is no need to wait for shutdown CHECKPOINT.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(recptr, true, !shutdown);
+
+	/*
 	 * Let smgr do post-checkpoint cleanup (eg, deleting old files).
 	 */
 	smgrpostckpt();
diff --git a/src/backend/catalog/storage.c b/src/backend/catalog/storage.c
index 971a149..050a6ba 100644
--- a/src/backend/catalog/storage.c
+++ b/src/backend/catalog/storage.c
@@ -25,6 +25,8 @@
 #include "catalog/catalog.h"
 #include "catalog/storage.h"
 #include "catalog/storage_xlog.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/freespace.h"
 #include "storage/smgr.h"
 #include "utils/memutils.h"
@@ -288,6 +290,14 @@ RelationTruncate(Relation rel, BlockNumber nblocks)
 		 */
 		if (fsm || vm)
 			XLogFlush(lsn);
+
+		/*
+		 * If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to lsn. Otherwise, we may have a situation where
+		 * the heap is truncated, but the action never replayed on the standby.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
 	}
 
 	/* Do the real work */
@@ -521,6 +531,13 @@ smgr_redo(XLogRecPtr lsn, XLogRecord *record)
 		 */
 		XLogFlush(lsn);
 
+		/*
+		 * If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to lsn.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
+
 		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
 
 		/* Also tell xlogutils.c about it */
diff --git a/src/backend/replication/syncrep.c b/src/backend/replication/syncrep.c
index 8cf1346..bbe88f9 100644
--- a/src/backend/replication/syncrep.c
+++ b/src/backend/replication/syncrep.c
@@ -66,6 +66,8 @@ char	   *SyncRepStandbyNames;
 static bool announce_next_takeover = true;
 
 static int	SyncRepWaitMode = SYNC_REP_NO_WAIT;
+static int	SyncTransferMode = SYNC_REP_NO_WAIT;
+int		synchronous_transfer = SYNCHRONOUS_TRANSFER_COMMIT;
 
 static void SyncRepQueueInsert(int mode);
 static void SyncRepCancelWait(void);
@@ -83,20 +85,31 @@ static bool SyncRepQueueIsOrderedByLSN(int mode);
  */
 
 /*
- * Wait for synchronous replication, if requested by user.
+ * Wait for synchronous/failback safe standby, if requested by user.
  *
  * Initially backends start in state SYNC_REP_NOT_WAITING and then
- * change that state to SYNC_REP_WAITING before adding ourselves
- * to the wait queue. During SyncRepWakeQueue() a WALSender changes
- * the state to SYNC_REP_WAIT_COMPLETE once replication is confirmed.
- * This backend then resets its state to SYNC_REP_NOT_WAITING.
+ * change that state to SYNC_REP_WAITING/SYNC_REP_WAITING_FOR_DATA_FLUSH
+ * before adding ourselves to the wait queue. During SyncRepWakeQueue() a
+ * WALSender changes the state to SYNC_REP_WAIT_COMPLETE once replication is
+ * confirmed. This backend then resets its state to SYNC_REP_NOT_WAITING.
+ *
+ * ForDataFlush - if TRUE, we wait before flushing data page.
+ * Otherwise wait for the sync standby
+ *
+ * Wait - if FALSE, we don't actually wait, but tell the caller whether or not
+ * the standby has already made progressed upto the given XactCommitLSN
+ *
+ * Return TRUE if either the synchronous standby/failback safe standby is not
+ * configured/turned off OR the standby has made enough progress
  */
-void
-SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
+bool
+SyncRepWaitForLSN(XLogRecPtr XactCommitLSN, bool ForDataFlush, bool Wait)
 {
 	char	   *new_status = NULL;
 	const char *old_status;
-	int			mode = SyncRepWaitMode;
+	int			mode = !ForDataFlush ? SyncRepWaitMode : SyncTransferMode;
+	bool		ret;
+	int			i;
 
 	/*
 	 * Fast exit if user has not requested sync replication, or there are no
@@ -104,7 +117,33 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 	 * need to be connected.
 	 */
 	if (!SyncRepRequested() || !SyncStandbysDefined())
-		return;
+		return true;
+
+	/*
+	 * If the caller has specified ForDataFlush, but synchronous transfer
+	 * is not specified or its turned off, exit.
+	 *
+	 * We would like to allow the failback safe mechanism even for cascaded
+	 * standbys as well. But we can't really wait for the standby to catch
+	 * up until we reach a consistent state since the standbys won't be
+	 * even able to connect without us reaching in that state (XXX Confirm)
+	 */
+	if ((!SyncTransRequested()) && ForDataFlush)
+		return true;
+
+	/*
+	 * If the caller has not specified ForDataFlush, but synchronous commit
+	 * is skipped by values of synchronous_transfer, exit.
+	 */
+	if (IsSyncRepSkipped() && !ForDataFlush)
+		return true;
+
+	/*
+	 * If both synchronous replication and synchronous transfer
+	 * are requested but the system still in recovery, exit.
+	 */
+	if (RecoveryInProgress())
+		return true;
 
 	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
 	Assert(WalSndCtl != NULL);
@@ -120,11 +159,20 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 	 * condition but we'll be fetching that cache line anyway so it's likely to
 	 * be a low cost check.
 	 */
-	if (!WalSndCtl->sync_standbys_defined ||
+	if ((!ForDataFlush && !WalSndCtl->sync_standbys_defined) ||
 		XactCommitLSN <= WalSndCtl->lsn[mode])
 	{
 		LWLockRelease(SyncRepLock);
-		return;
+		return true;
+	}
+
+	/*
+	 * Exit if we are told not to block on the standby.
+	 */
+	if (!Wait)
+	{
+		LWLockRelease(SyncRepLock);
+		return false;
 	}
 
 	/*
@@ -151,6 +199,8 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		new_status[len] = '\0'; /* truncate off " waiting ..." */
 	}
 
+	ret = false;
+
 	/*
 	 * Wait for specified LSN to be confirmed.
 	 *
@@ -187,7 +237,10 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 			LWLockRelease(SyncRepLock);
 		}
 		if (syncRepState == SYNC_REP_WAIT_COMPLETE)
+		{
+			ret = true;
 			break;
+		}
 
 		/*
 		 * If a wait for synchronous replication is pending, we can neither
@@ -264,6 +317,8 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		set_ps_display(new_status, false);
 		pfree(new_status);
 	}
+
+	return ret;
 }
 
 /*
@@ -371,6 +426,7 @@ SyncRepReleaseWaiters(void)
 	volatile WalSnd *syncWalSnd = NULL;
 	int			numwrite = 0;
 	int			numflush = 0;
+	int			numdataflush = 0;
 	int			priority = 0;
 	int			i;
 
@@ -438,13 +494,21 @@ SyncRepReleaseWaiters(void)
 	{
 		walsndctl->lsn[SYNC_REP_WAIT_FLUSH] = MyWalSnd->flush;
 		numflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_FLUSH);
+
+	}
+	if (walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] < MyWalSnd->flush)
+	{
+		walsndctl->lsn[SYNC_REP_WAIT_DATA_FLUSH] = MyWalSnd->flush;
+		numdataflush = SyncRepWakeQueue(false, SYNC_REP_WAIT_DATA_FLUSH);
+
 	}
 
 	LWLockRelease(SyncRepLock);
 
-	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X",
-		 numwrite, (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
-	   numflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
+	elog(DEBUG3, "released %d procs up to write %X/%X, %d procs up to flush %X/%X, %d procs up to data flush %X/%X",
+		 numwrite    , (uint32) (MyWalSnd->write >> 32), (uint32) MyWalSnd->write,
+		 numflush    , (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush,
+		 numdataflush, (uint32) (MyWalSnd->flush >> 32), (uint32) MyWalSnd->flush);
 
 	/*
 	 * If we are managing the highest priority standby, though we weren't
@@ -710,3 +774,18 @@ assign_synchronous_commit(int newval, void *extra)
 			break;
 	}
 }
+
+void
+assign_synchronous_transfer(int newval, void *extra)
+{
+	switch (newval)
+	{
+		case SYNCHRONOUS_TRANSFER_ALL:
+		case SYNCHRONOUS_TRANSFER_DATA_FLUSH:
+			SyncTransferMode = SYNC_REP_WAIT_DATA_FLUSH;
+			break;
+		default:
+			SyncTransferMode = SYNC_REP_NO_WAIT;
+			break;
+	}
+}
diff --git a/src/backend/replication/walsender.c b/src/backend/replication/walsender.c
index afd559d..492e039 100644
--- a/src/backend/replication/walsender.c
+++ b/src/backend/replication/walsender.c
@@ -1539,6 +1539,10 @@ XLogSend(bool *caughtup)
 
 		*caughtup = true;
 
+		elog(WARNING, "XLogSend sendTimeLineValidUpto(%X/%X) <= sentPtr(%X/%X) AND sendTImeLine",
+			 (uint32) (sendTimeLineValidUpto >> 32), (uint32) sendTimeLineValidUpto,
+			 (uint32) (sentPtr >> 32), (uint32) sentPtr);
+
 		elog(DEBUG1, "walsender reached end of timeline at %X/%X (sent up to %X/%X)",
 			 (uint32) (sendTimeLineValidUpto >> 32), (uint32) sendTimeLineValidUpto,
 			 (uint32) (sentPtr >> 32), (uint32) sentPtr);
diff --git a/src/backend/storage/buffer/bufmgr.c b/src/backend/storage/buffer/bufmgr.c
index f848391..7a2e285 100644
--- a/src/backend/storage/buffer/bufmgr.c
+++ b/src/backend/storage/buffer/bufmgr.c
@@ -41,6 +41,8 @@
 #include "pg_trace.h"
 #include "pgstat.h"
 #include "postmaster/bgwriter.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/buf_internals.h"
 #include "storage/bufmgr.h"
 #include "storage/ipc.h"
@@ -1975,8 +1977,14 @@ FlushBuffer(volatile BufferDesc *buf, SMgrRelation reln)
 	 * skip the flush if the buffer isn't permanent.
 	 */
 	if (buf->flags & BM_PERMANENT)
+	{
 		XLogFlush(recptr);
-
+		/* If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to recptr.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(recptr, true, true);
+	}
 	/*
 	 * Now it's safe to write buffer to disk. Note that no one else should
 	 * have been able to write it while we were busy with log flushing because
diff --git a/src/backend/utils/cache/relmapper.c b/src/backend/utils/cache/relmapper.c
index 18f0342..e92b607 100644
--- a/src/backend/utils/cache/relmapper.c
+++ b/src/backend/utils/cache/relmapper.c
@@ -48,6 +48,8 @@
 #include "catalog/pg_tablespace.h"
 #include "catalog/storage.h"
 #include "miscadmin.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/fd.h"
 #include "storage/lwlock.h"
 #include "utils/inval.h"
@@ -711,6 +713,7 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	int			fd;
 	RelMapFile *realmap;
 	char		mapfilename[MAXPGPATH];
+	XLogRecPtr	lsn=InvalidXLogRecPtr;
 
 	/*
 	 * Fill in the overhead fields and update CRC.
@@ -753,7 +756,6 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	{
 		xl_relmap_update xlrec;
 		XLogRecData rdata[2];
-		XLogRecPtr	lsn;
 
 		/* now errors are fatal ... */
 		START_CRIT_SECTION();
@@ -775,6 +777,7 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 
 		/* As always, WAL must hit the disk before the data update does */
 		XLogFlush(lsn);
+
 	}
 
 	errno = 0;
@@ -849,6 +852,13 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	/* Critical section done */
 	if (write_wal)
 		END_CRIT_SECTION();
+
+	/*
+	 * If synchronous transfer is requested, wait for failback safe
+	 * standby to receive WAL up to recptr.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(lsn, true, true);
 }
 
 /*
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 3107f9c..ccac724 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -381,6 +381,18 @@ static const struct config_enum_entry synchronous_commit_options[] = {
 };
 
 /*
+ * Although only "all", "data_flush", and "commit" are documented, we
+ * accept all the likely variants of "off".
+ */
+static const struct config_enum_entry synchronous_transfer_options[] = {
+	{"all", SYNCHRONOUS_TRANSFER_ALL, false},
+	{"data_flush", SYNCHRONOUS_TRANSFER_DATA_FLUSH, false},
+	{"commit", SYNCHRONOUS_TRANSFER_COMMIT, true},
+	{"0", SYNCHRONOUS_TRANSFER_COMMIT, true},
+	{NULL, 0, false}
+};
+
+/*
  * Options for enum values stored in other modules
  */
 extern const struct config_enum_entry wal_level_options[];
@@ -3300,6 +3312,16 @@ static struct config_enum ConfigureNamesEnum[] =
 	},
 
 	{
+		{"synchronous_transfer", PGC_SIGHUP, WAL_SETTINGS,
+			gettext_noop("Sets the data flush synchronization level"),
+			NULL
+		},
+		&synchronous_transfer,
+		SYNCHRONOUS_TRANSFER_COMMIT, synchronous_transfer_options,
+		NULL, assign_synchronous_transfer, NULL
+	},
+
+	{
 		{"trace_recovery_messages", PGC_SIGHUP, DEVELOPER_OPTIONS,
 			gettext_noop("Enables logging of recovery-related debugging information."),
 			gettext_noop("Each level includes all the levels that follow it. The later"
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample
index d69a02b..d6603c2 100644
--- a/src/backend/utils/misc/postgresql.conf.sample
+++ b/src/backend/utils/misc/postgresql.conf.sample
@@ -220,6 +220,8 @@
 #synchronous_standby_names = ''	# standby servers that provide sync rep
 				# comma-separated list of application_name
 				# from standby(s); '*' = all
+#synchronous_transfer = commit	# data page synchronization level
+				# commit, data_flush or all
 #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
 
 # - Standby Servers -
diff --git a/src/backend/utils/time/tqual.c b/src/backend/utils/time/tqual.c
index ed66c49..6cf3f26 100644
--- a/src/backend/utils/time/tqual.c
+++ b/src/backend/utils/time/tqual.c
@@ -60,6 +60,8 @@
 #include "access/subtrans.h"
 #include "access/transam.h"
 #include "access/xact.h"
+#include "replication/walsender.h"
+#include "replication/syncrep.h"
 #include "storage/bufmgr.h"
 #include "storage/procarray.h"
 #include "utils/tqual.h"
@@ -115,6 +117,18 @@ SetHintBits(HeapTupleHeader tuple, Buffer buffer,
 
 		if (XLogNeedsFlush(commitLSN) && BufferIsPermanent(buffer))
 			return;				/* not flushed yet, so don't set hint */
+
+		/*
+		 * If synchronous transfer is requested, we check if the commit WAL record
+		 * has made to the standby before allowing hint bit updates. We should not
+		 * wait for the standby to receive the WAL since its OK to delay hint bit
+		 * updates.
+		 */
+		if (SyncTransRequested())
+		{
+			if(!SyncRepWaitForLSN(commitLSN, true, false))
+				return;
+		}
 	}
 
 	tuple->t_infomask |= infomask;
diff --git a/src/include/replication/syncrep.h b/src/include/replication/syncrep.h
index ac23ea6..4540625 100644
--- a/src/include/replication/syncrep.h
+++ b/src/include/replication/syncrep.h
@@ -19,23 +19,42 @@
 #define SyncRepRequested() \
 	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
 
+#define SyncTransRequested() \
+	(max_wal_senders > 0 && synchronous_transfer > SYNCHRONOUS_TRANSFER_COMMIT)
+
+#define IsSyncRepSkipped() \
+	(max_wal_senders > 0 && synchronous_transfer ==  SYNCHRONOUS_TRANSFER_DATA_FLUSH)
+
 /* SyncRepWaitMode */
-#define SYNC_REP_NO_WAIT		-1
-#define SYNC_REP_WAIT_WRITE		0
-#define SYNC_REP_WAIT_FLUSH		1
+#define SYNC_REP_NO_WAIT					-1
+#define SYNC_REP_WAIT_WRITE					0
+#define SYNC_REP_WAIT_FLUSH					1
+#define SYNC_REP_WAIT_DATA_FLUSH	2
 
-#define NUM_SYNC_REP_WAIT_MODE	2
+#define NUM_SYNC_REP_WAIT_MODE				3
 
 /* syncRepState */
-#define SYNC_REP_NOT_WAITING		0
-#define SYNC_REP_WAITING			1
-#define SYNC_REP_WAIT_COMPLETE		2
+#define SYNC_REP_NOT_WAITING					0
+#define SYNC_REP_WAITING						1
+#define SYNC_REP_WAIT_COMPLETE					2
+
+typedef enum
+{
+	SYNCHRONOUS_TRANSFER_COMMIT,		/* no wait for flush data page */
+	SYNCHRONOUS_TRANSFER_DATA_FLUSH,	/* wait for data page flush only
+										 * no wait for WAL */
+	SYNCHRONOUS_TRANSFER_ALL	        /* wait for data page flush */
+}	SynchronousTransferLevel;
 
 /* user-settable parameters for synchronous replication */
 extern char *SyncRepStandbyNames;
 
+/* user-settable parameters for failback safe replication */
+extern int	synchronous_transfer;
+
 /* called by user backend */
-extern void SyncRepWaitForLSN(XLogRecPtr XactCommitLSN);
+extern bool SyncRepWaitForLSN(XLogRecPtr XactCommitLSN,
+		bool ForDataFlush, bool Wait);
 
 /* called at backend exit */
 extern void SyncRepCleanupAtProcExit(void);
@@ -52,5 +71,6 @@ extern int	SyncRepWakeQueue(bool all, int mode);
 
 extern bool check_synchronous_standby_names(char **newval, void **extra, GucSource source);
 extern void assign_synchronous_commit(int newval, void *extra);
+extern void assign_synchronous_transfer(int newval, void *extra);
 
 #endif   /* _SYNCREP_H */

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 370aa09..86d2265 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1749,6 +1749,39 @@ include 'filename'
       </listitem>
      </varlistentry>
 
+     <varlistentry id="guc-synchronous-transfer" xreflabel="synchronous_transfer">
+      <term><varname>synchronous_transfer</varname> (<type>enum</type>)</term>
+      <indexterm>
+       <primary><varname>synchronous_transfer</> configuration parameter</primary>
+      </indexterm>
+      <listitem>
+       <para>
+        This parameter controls the synchronous nature of WAL transfer and
+        maintains file system level consistency between master server and
+        standby server. Specifies whether master server will wait for file
+        system level change (for example : modifying data page) before
+        corresponding WAL records are replicated to the standby server.
+       </para>
+       <para>
+        Valid values are <literal>commit</>, <literal>data_flush</> and
+        <literal>all</>. The default value is <literal>commit</>, meaning
+        that master only wait for transaction commits, this is equivalent
+        to turning off <literal>synchronous_transfer</> parameter and standby
+        server will behave as a <quote>synchronous standby </> in
+        Streaming Replication. For value <literal>data_flush</>, master will
+        wait only for data page modifications but not for transaction
+        commits, hence the standby server will act as <quote>asynchronous
+        failback safe standby</>. For value <literal> all</>, master will wait
+        for data page modifications as well as for transaction commits and
+        resultant standby server will act as <quote>synchronous failback safe
+        standby</>. The wait is on background activities and hence will not
+        create much performance overhead.
+        To configure synchronous failback safe standby
+        <xref linkend="guc-synchronous-standby-names"> should be set.
+       </para>
+      </listitem>
+     </varlistentry>
+
      <varlistentry id="guc-wal-sync-method" xreflabel="wal_sync_method">
       <term><varname>wal_sync_method</varname> (<type>enum</type>)</term>
       <indexterm>
@@ -2258,14 +2291,25 @@ include 'filename'
       </indexterm>
       <listitem>
        <para>
-        Specifies a comma-separated list of standby names that can support
-        <firstterm>synchronous replication</>, as described in
-        <xref linkend="synchronous-replication">.
-        At any one time there will be at most one active synchronous standby;
-        transactions waiting for commit will be allowed to proceed after
-        this standby server confirms receipt of their data.
-        The synchronous standby will be the first standby named in this list
-        that is both currently connected and streaming data in real-time
+        Specifies a comma-separated list of standby names. If this parameter
+        is set then standby will behave as synchronous standby in replication,
+        as described in <xref linkend="synchronous-replication"> or synchronous
+        failback safe standby, as described in <xref linkend="failback-safe">.
+        At any time there will be at most one active standby; when standby is
+        synchronous standby in replication, transactions waiting for commit
+        will be allowed to proceed after this standby server confirms receipt
+        of their data. But when standby is synchronous failback safe standby
+        data page modifications as well as transaction commits will be allowed
+        to proceed only after this standby server confirms receipt of their data.
+        If this parameter is set to empty value and
+        <xref linkend="guc-synchronous-transfer"> is set to <literal>data_flush</>
+        then standby is called as asynchronous failback safe standby and only
+        data page modifications will wait before corresponding WAL record is
+        replicated to standby.
+       </para>
+       <para>
+        Synchronous standby in replication will be the first standby named in
+        this list that is both currently connected and streaming data in real-time
         (as shown by a state of <literal>streaming</literal> in the
         <link linkend="monitoring-stats-views-table">
         <literal>pg_stat_replication</></link> view).
diff --git a/doc/src/sgml/high-availability.sgml b/doc/src/sgml/high-availability.sgml
index c8f6fa8..e551077 100644
--- a/doc/src/sgml/high-availability.sgml
+++ b/doc/src/sgml/high-availability.sgml
@@ -1140,6 +1140,64 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
 
    </sect3>
   </sect2>
+
+  <sect2 id="failback-safe">
+     <title>Setting up failback safe standby</title>
+
+   <indexterm zone="high-availability">
+       <primary>Setting up failback safe standby</primary>
+   </indexterm>
+
+   <para>
+    PostgreSQL Streaming Replication offers durability, but if the master
+    crashes and particular WAL record is unable to reach to standby
+    server, then that WAL record is present on master server but not
+    on standby server. In such a case master is ahead of standby server
+    in term of WAL records and Data in database. This will lead to
+    file-system level inconsistency between master and standby server.
+    For example a heap page update on the master might not have been reflected
+    on standby when master crashes.
+   </para>
+
+   <para>
+    Due to this inconsistency fresh backup of new master onto new standby
+    is needed to re-prepare HA cluster. Taking fresh backup can be very
+    time consuming process when database is of large size. In such a case
+    disaster recovery can take very long time if Streaming Replication is
+    used to setup the high availability cluster.
+   </para>
+
+   <para>
+    If HA cluster is configured with failback safe standby then this fresh
+    back up can be avoided. The <xref linkend="guc-synchronous-transfer">
+    parameter has control over all WAL transfers and will not make any file
+    system level change until master gets a confirmation from standby server.
+    This avoids the need of a fresh backup by maintaining consistency.
+   </para>
+
+   <sect3 id="Failback-safe-config">
+    <title>Basic Configuration</title>
+   <para>
+    Failback safe standby can be asynchronous or synchronous in nature.
+    This will depend upon whether master will wait for transaction commit
+    or not. By default failback safe mechanism is turned off.
+   </para>
+
+   <para>
+    The first step to configure HA with failback safe standby is to setup
+    synchronous streaming replication. Configuring synchronous failback
+    safe standby requires setting up  <xref linkend="guc-synchronous-transfer"> to
+    <literal>all</>. This configuration will cause each commit and data
+    page modification to wait for confirmation that standby has written
+    corresponding WAL record to durable storage. Configuring asynchronous
+    failback safe standby requires setting up <xref linkend="guc-synchronous-transfer">
+    to <literal> data_flush</>. This configuration will cause only data
+    page modifications to wait for confirmation that standby has written
+    corresponding WAL record to durable storage.
+   </para>
+
+  </sect3>
+  </sect2>
   </sect1>
 
   <sect1 id="warm-standby-failover">
@@ -1201,12 +1259,28 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
    </para>
 
    <para>
-    So, switching from primary to standby server can be fast but requires
-    some time to re-prepare the failover cluster. Regular switching from
-    primary to standby is useful, since it allows regular downtime on
-    each system for maintenance. This also serves as a test of the
-    failover mechanism to ensure that it will really work when you need it.
-    Written administration procedures are advised.
+    At the time of failover there is a possibility of file-system level
+    inconsistency between old primary and old standby server hence
+    fresh backup from new master onto old master is needed for Configuring
+    old standby server as a new standby server. Without taking fresh
+    backup even if the new standby starts, streaming replication does not
+    start successfully. The activity of taking backup can be fast for smaller
+    database but for large database requires more time to re-prepare the
+    failover cluster and could break the service level agreement of crash
+    recovery. The need of fresh backup and problem of long
+    recovery time can be solved if HA cluster is configured with
+    failback safe standby see <xref linkend="failback-safe">.
+    Failback safe standby makes WAL transfer synchronous at required
+    places and maintains the file-system level consistency between
+    master and standby server and the old master server can be easily
+    configured as new standby server.
+   </para>
+
+   <para>
+    Regular switching from primary to standby is useful, since it allows
+    regular downtime on each system for maintenance. This also serves as
+    a test of the failover mechanism to ensure that it will really work
+    when you need it. Written administration procedures are advised.
    </para>
 
    <para>
diff --git a/doc/src/sgml/perform.sgml b/doc/src/sgml/perform.sgml
index 2af1738..b074a91 100644
--- a/doc/src/sgml/perform.sgml
+++ b/doc/src/sgml/perform.sgml
@@ -1569,6 +1569,14 @@ SELECT * FROM x, y, a, b, c WHERE something AND somethingelse;
        corruption) in case of a crash of the <emphasis>database</> alone.
       </para>
      </listitem>
+
+     <listitem>
+      <para>
+       Set <xref linkend="guc-synchronous-transfer"> to commit; there is no
+       need to guard against database inconsistency between master and standby
+       server during failover.
+      </para>
+     </listitem>
     </itemizedlist>
    </para>
   </sect1>
diff --git a/src/backend/access/transam/clog.c b/src/backend/access/transam/clog.c
index cb95aa3..d216b2e 100644
--- a/src/backend/access/transam/clog.c
+++ b/src/backend/access/transam/clog.c
@@ -37,6 +37,8 @@
 #include "access/transam.h"
 #include "miscadmin.h"
 #include "pg_trace.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 
 /*
  * Defines for CLOG page sizes.  A page is the same BLCKSZ as is used
@@ -708,8 +710,10 @@ WriteZeroPageXlogRec(int pageno)
 /*
  * Write a TRUNCATE xlog record
  *
- * We must flush the xlog record to disk before returning --- see notes
- * in TruncateCLOG().
+ * Before returning we must flush the xlog record to disk
+ * and if synchronous transfer is requested wait for failback
+ * safe standby to receive WAL up to recptr.
+ * --- see notes in TruncateCLOG().
  */
 static void
 WriteTruncateXlogRec(int pageno)
@@ -723,6 +727,12 @@ WriteTruncateXlogRec(int pageno)
 	rdata.next = NULL;
 	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
 	XLogFlush(recptr);
+
+	/*
+	 * Wait for failback safe standby.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(recptr, true, true);
 }
 
 /*
diff --git a/src/backend/access/transam/slru.c b/src/backend/access/transam/slru.c
index 5e53593..069630b 100644
--- a/src/backend/access/transam/slru.c
+++ b/src/backend/access/transam/slru.c
@@ -54,6 +54,8 @@
 #include "access/slru.h"
 #include "access/transam.h"
 #include "access/xlog.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/fd.h"
 #include "storage/shmem.h"
 #include "miscadmin.h"
@@ -744,6 +746,13 @@ SlruPhysicalWritePage(SlruCtl ctl, int pageno, int slotno, SlruFlush fdata)
 			START_CRIT_SECTION();
 			XLogFlush(max_lsn);
 			END_CRIT_SECTION();
+
+			/*
+			 * If synchronous transfer is requested, wait for failback safe
+			 * standby to receive WAL up to max_lsn.
+			 */
+			if (SyncTransRequested())
+				SyncRepWaitForLSN(max_lsn, true, true);
 		}
 	}
 
diff --git a/src/backend/access/transam/twophase.c b/src/backend/access/transam/twophase.c
index e975f8d..38a9e9c 100644
--- a/src/backend/access/transam/twophase.c
+++ b/src/backend/access/transam/twophase.c
@@ -1091,12 +1091,12 @@ EndPrepare(GlobalTransaction gxact)
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked the prepare, but still show as
 	 * running in the procarray (twice!) and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(gxact->prepare_lsn);
+	SyncRepWaitForLSN(gxact->prepare_lsn, false, true);
 
 	records.tail = records.head = NULL;
 }
@@ -2058,12 +2058,12 @@ RecordTransactionCommitPrepared(TransactionId xid,
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(recptr);
+	SyncRepWaitForLSN(recptr, false, true);
 }
 
 /*
@@ -2138,10 +2138,10 @@ RecordTransactionAbortPrepared(TransactionId xid,
 	END_CRIT_SECTION();
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
-	SyncRepWaitForLSN(recptr);
+	SyncRepWaitForLSN(recptr, false, true);
 }
diff --git a/src/backend/access/transam/xact.c b/src/backend/access/transam/xact.c
index 0591f3f..25210df 100644
--- a/src/backend/access/transam/xact.c
+++ b/src/backend/access/transam/xact.c
@@ -1189,13 +1189,13 @@ RecordTransactionCommit(void)
 	latestXid = TransactionIdLatest(xid, nchildren, children);
 
 	/*
-	 * Wait for synchronous replication, if required.
+	 * Wait for synchronous/synchronous failback safe standby, if required.
 	 *
 	 * Note that at this stage we have marked clog, but still show as running
 	 * in the procarray and continue to hold locks.
 	 */
 	if (wrote_xlog)
-		SyncRepWaitForLSN(XactLastRecEnd);
+		SyncRepWaitForLSN(XactLastRecEnd, false, true);
 
 	/* Reset XactLastRecEnd until the next transaction writes something */
 	XactLastRecEnd = 0;
@@ -4690,8 +4690,17 @@ xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
 	 * for any user that requested ForceSyncCommit().
 	 */
 	if (XactCompletionForceSyncCommit(xinfo))
+	{
 		XLogFlush(lsn);
 
+		/*
+		 * If synchronous transfer is requested, wait for failback safe
+		 * standby to receive WAL up to lsn,
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
+
+	}
 }
 
 /*
diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index fc495d6..ef46419 100644
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -39,8 +39,10 @@
 #include "pgstat.h"
 #include "postmaster/bgwriter.h"
 #include "postmaster/startup.h"
+#include "replication/syncrep.h"
 #include "replication/walreceiver.h"
 #include "replication/walsender.h"
+#include "replication/syncrep.h"
 #include "storage/barrier.h"
 #include "storage/bufmgr.h"
 #include "storage/fd.h"
@@ -8282,6 +8284,18 @@ CreateCheckPoint(int flags)
 	END_CRIT_SECTION();
 
 	/*
+	 * If synchronous transfer is requested, wait for failback safe standby
+	 * to receive WAL up to checkpoint WAL record. Otherwise if failure occurs
+	 * before standby receives CHECKPOINT WAL record causes an inconsistency
+	 * between control files of master and standby. Because of this master will
+	 * start from a location which is not known to the standby at the time fail-over.
+	 *
+	 * There is no need to wait for shutdown CHECKPOINT.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(recptr, true, !shutdown);
+
+	/*
 	 * Let smgr do post-checkpoint cleanup (eg, deleting old files).
 	 */
 	smgrpostckpt();
diff --git a/src/backend/catalog/storage.c b/src/backend/catalog/storage.c
index 971a149..050a6ba 100644
--- a/src/backend/catalog/storage.c
+++ b/src/backend/catalog/storage.c
@@ -25,6 +25,8 @@
 #include "catalog/catalog.h"
 #include "catalog/storage.h"
 #include "catalog/storage_xlog.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/freespace.h"
 #include "storage/smgr.h"
 #include "utils/memutils.h"
@@ -288,6 +290,14 @@ RelationTruncate(Relation rel, BlockNumber nblocks)
 		 */
 		if (fsm || vm)
 			XLogFlush(lsn);
+
+		/*
+		 * If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to lsn. Otherwise, we may have a situation where
+		 * the heap is truncated, but the action never replayed on the standby.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
 	}
 
 	/* Do the real work */
@@ -521,6 +531,13 @@ smgr_redo(XLogRecPtr lsn, XLogRecord *record)
 		 */
 		XLogFlush(lsn);
 
+		/*
+		 * If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to lsn.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(lsn, true, true);
+
 		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
 
 		/* Also tell xlogutils.c about it */
diff --git a/src/backend/replication/syncrep.c b/src/backend/replication/syncrep.c
index 8cf1346..6814886 100644
--- a/src/backend/replication/syncrep.c
+++ b/src/backend/replication/syncrep.c
@@ -67,6 +67,8 @@ static bool announce_next_takeover = true;
 
 static int	SyncRepWaitMode = SYNC_REP_NO_WAIT;
 
+int		synchronous_transfer = SYNCHRONOUS_TRANSFER_COMMIT;
+
 static void SyncRepQueueInsert(int mode);
 static void SyncRepCancelWait(void);
 
@@ -83,20 +85,30 @@ static bool SyncRepQueueIsOrderedByLSN(int mode);
  */
 
 /*
- * Wait for synchronous replication, if requested by user.
+ * Wait for synchronous/failback safe standby, if requested by user.
  *
  * Initially backends start in state SYNC_REP_NOT_WAITING and then
- * change that state to SYNC_REP_WAITING before adding ourselves
- * to the wait queue. During SyncRepWakeQueue() a WALSender changes
- * the state to SYNC_REP_WAIT_COMPLETE once replication is confirmed.
- * This backend then resets its state to SYNC_REP_NOT_WAITING.
+ * change that state to SYNC_REP_WAITING/SYNC_REP_WAITING_FOR_DATA_FLUSH
+ * before adding ourselves to the wait queue. During SyncRepWakeQueue() a
+ * WALSender changes the state to SYNC_REP_WAIT_COMPLETE once replication is
+ * confirmed. This backend then resets its state to SYNC_REP_NOT_WAITING.
+ *
+ * ForDataFlush - if TRUE, we wait before flushing data page.
+ * Otherwise wait for the sync standby
+ *
+ * Wait - if FALSE, we don't actually wait, but tell the caller whether or not
+ * the standby has already made progressed upto the given XactCommitLSN
+ *
+ * Return TRUE if either the synchronous standby/failback safe standby is not
+ * configured/turned off OR the standby has made enough progress
  */
-void
-SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
+bool
+SyncRepWaitForLSN(XLogRecPtr XactCommitLSN, bool ForDataFlush, bool Wait)
 {
 	char	   *new_status = NULL;
 	const char *old_status;
 	int			mode = SyncRepWaitMode;
+	bool		ret;
 
 	/*
 	 * Fast exit if user has not requested sync replication, or there are no
@@ -104,7 +116,33 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 	 * need to be connected.
 	 */
 	if (!SyncRepRequested() || !SyncStandbysDefined())
-		return;
+		return true;
+
+	/*
+	 * If the caller has specified ForDataFlush, but synchronous transfer
+	 * is not specified or its turned off, exit.
+	 *
+	 * We would like to allow the failback safe mechanism even for cascaded
+	 * standbys as well. But we can't really wait for the standby to catch
+	 * up until we reach a consistent state since the standbys won't be
+	 * even able to connect without us reaching in that state (XXX Confirm)
+	 */
+	if (!SyncTransRequested() && ForDataFlush)
+		return true;
+
+	/*
+	 * If the caller has not specified ForDataFlush, but synchronous commit
+	 * is skipped by values of synchronous_transfer, exit.
+	 */
+	if (IsSyncRepSkipped() && !ForDataFlush)
+		return true;
+
+	/*
+	 * If both synchronous replication and synchronous transfer
+	 * are requested but the system still in recovery, exit.
+	 */
+	if (RecoveryInProgress())
+		return true;
 
 	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
 	Assert(WalSndCtl != NULL);
@@ -120,11 +158,20 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 	 * condition but we'll be fetching that cache line anyway so it's likely to
 	 * be a low cost check.
 	 */
-	if (!WalSndCtl->sync_standbys_defined ||
+	if ((!ForDataFlush && !WalSndCtl->sync_standbys_defined) ||
 		XactCommitLSN <= WalSndCtl->lsn[mode])
 	{
 		LWLockRelease(SyncRepLock);
-		return;
+		return true;
+	}
+
+	/*
+	 * Exit if we are told not to block on the standby.
+	 */
+	if (!Wait)
+	{
+		LWLockRelease(SyncRepLock);
+		return false;
 	}
 
 	/*
@@ -151,6 +198,8 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		new_status[len] = '\0'; /* truncate off " waiting ..." */
 	}
 
+	ret = false;
+
 	/*
 	 * Wait for specified LSN to be confirmed.
 	 *
@@ -187,7 +236,10 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 			LWLockRelease(SyncRepLock);
 		}
 		if (syncRepState == SYNC_REP_WAIT_COMPLETE)
+		{
+			ret = true;
 			break;
+		}
 
 		/*
 		 * If a wait for synchronous replication is pending, we can neither
@@ -264,6 +316,8 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		set_ps_display(new_status, false);
 		pfree(new_status);
 	}
+
+	return ret;
 }
 
 /*
diff --git a/src/backend/storage/buffer/bufmgr.c b/src/backend/storage/buffer/bufmgr.c
index f848391..7a2e285 100644
--- a/src/backend/storage/buffer/bufmgr.c
+++ b/src/backend/storage/buffer/bufmgr.c
@@ -41,6 +41,8 @@
 #include "pg_trace.h"
 #include "pgstat.h"
 #include "postmaster/bgwriter.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/buf_internals.h"
 #include "storage/bufmgr.h"
 #include "storage/ipc.h"
@@ -1975,8 +1977,14 @@ FlushBuffer(volatile BufferDesc *buf, SMgrRelation reln)
 	 * skip the flush if the buffer isn't permanent.
 	 */
 	if (buf->flags & BM_PERMANENT)
+	{
 		XLogFlush(recptr);
-
+		/* If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to recptr.
+		 */
+		if (SyncTransRequested())
+			SyncRepWaitForLSN(recptr, true, true);
+	}
 	/*
 	 * Now it's safe to write buffer to disk. Note that no one else should
 	 * have been able to write it while we were busy with log flushing because
diff --git a/src/backend/utils/cache/relmapper.c b/src/backend/utils/cache/relmapper.c
index 18f0342..6d0aa69 100644
--- a/src/backend/utils/cache/relmapper.c
+++ b/src/backend/utils/cache/relmapper.c
@@ -48,6 +48,8 @@
 #include "catalog/pg_tablespace.h"
 #include "catalog/storage.h"
 #include "miscadmin.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/fd.h"
 #include "storage/lwlock.h"
 #include "utils/inval.h"
@@ -711,6 +713,7 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	int			fd;
 	RelMapFile *realmap;
 	char		mapfilename[MAXPGPATH];
+	XLogRecPtr	lsn=InvalidXLogRecPtr;
 
 	/*
 	 * Fill in the overhead fields and update CRC.
@@ -753,7 +756,6 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	{
 		xl_relmap_update xlrec;
 		XLogRecData rdata[2];
-		XLogRecPtr	lsn;
 
 		/* now errors are fatal ... */
 		START_CRIT_SECTION();
@@ -849,6 +851,13 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	/* Critical section done */
 	if (write_wal)
 		END_CRIT_SECTION();
+
+	/*
+	 * If synchronous transfer is requested, wait for failback safe
+	 * standby to receive WAL up to recptr.
+	 */
+	if (SyncTransRequested())
+		SyncRepWaitForLSN(lsn, true, true);
 }
 
 /*
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 3107f9c..2e08f74 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -381,6 +381,16 @@ static const struct config_enum_entry synchronous_commit_options[] = {
 };
 
 /*
+ * Although only "all", "data_flush", and "commit" are documented
+ */
+static const struct config_enum_entry synchronous_transfer_options[] = {
+	{"all", SYNCHRONOUS_TRANSFER_ALL, false},
+	{"data_flush", SYNCHRONOUS_TRANSFER_DATA_FLUSH, false},
+	{"commit", SYNCHRONOUS_TRANSFER_COMMIT, false},
+	{NULL, 0, false}
+};
+
+/*
  * Options for enum values stored in other modules
  */
 extern const struct config_enum_entry wal_level_options[];
@@ -3300,6 +3310,16 @@ static struct config_enum ConfigureNamesEnum[] =
 	},
 
 	{
+		{"synchronous_transfer", PGC_SIGHUP, WAL_SETTINGS,
+			gettext_noop("Sets the data flush synchronization level"),
+			NULL
+		},
+		&synchronous_transfer,
+		SYNCHRONOUS_TRANSFER_COMMIT, synchronous_transfer_options,
+		NULL, NULL, NULL
+	},
+
+	{
 		{"trace_recovery_messages", PGC_SIGHUP, DEVELOPER_OPTIONS,
 			gettext_noop("Enables logging of recovery-related debugging information."),
 			gettext_noop("Each level includes all the levels that follow it. The later"
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample
index d69a02b..d6603c2 100644
--- a/src/backend/utils/misc/postgresql.conf.sample
+++ b/src/backend/utils/misc/postgresql.conf.sample
@@ -220,6 +220,8 @@
 #synchronous_standby_names = ''	# standby servers that provide sync rep
 				# comma-separated list of application_name
 				# from standby(s); '*' = all
+#synchronous_transfer = commit	# data page synchronization level
+				# commit, data_flush or all
 #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
 
 # - Standby Servers -
diff --git a/src/backend/utils/time/tqual.c b/src/backend/utils/time/tqual.c
index ed66c49..6cf3f26 100644
--- a/src/backend/utils/time/tqual.c
+++ b/src/backend/utils/time/tqual.c
@@ -60,6 +60,8 @@
 #include "access/subtrans.h"
 #include "access/transam.h"
 #include "access/xact.h"
+#include "replication/walsender.h"
+#include "replication/syncrep.h"
 #include "storage/bufmgr.h"
 #include "storage/procarray.h"
 #include "utils/tqual.h"
@@ -115,6 +117,18 @@ SetHintBits(HeapTupleHeader tuple, Buffer buffer,
 
 		if (XLogNeedsFlush(commitLSN) && BufferIsPermanent(buffer))
 			return;				/* not flushed yet, so don't set hint */
+
+		/*
+		 * If synchronous transfer is requested, we check if the commit WAL record
+		 * has made to the standby before allowing hint bit updates. We should not
+		 * wait for the standby to receive the WAL since its OK to delay hint bit
+		 * updates.
+		 */
+		if (SyncTransRequested())
+		{
+			if(!SyncRepWaitForLSN(commitLSN, true, false))
+				return;
+		}
 	}
 
 	tuple->t_infomask |= infomask;
diff --git a/src/include/replication/syncrep.h b/src/include/replication/syncrep.h
index ac23ea6..4e42eba 100644
--- a/src/include/replication/syncrep.h
+++ b/src/include/replication/syncrep.h
@@ -19,6 +19,12 @@
 #define SyncRepRequested() \
 	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
 
+#define SyncTransRequested() \
+	(max_wal_senders > 0 && synchronous_transfer > SYNCHRONOUS_TRANSFER_COMMIT)
+
+#define IsSyncRepSkipped() \
+	(max_wal_senders > 0 && synchronous_transfer ==  SYNCHRONOUS_TRANSFER_DATA_FLUSH)
+
 /* SyncRepWaitMode */
 #define SYNC_REP_NO_WAIT		-1
 #define SYNC_REP_WAIT_WRITE		0
@@ -31,11 +37,23 @@
 #define SYNC_REP_WAITING			1
 #define SYNC_REP_WAIT_COMPLETE		2
 
+typedef enum
+{
+	SYNCHRONOUS_TRANSFER_COMMIT,		/* no wait for flush data page */
+	SYNCHRONOUS_TRANSFER_DATA_FLUSH,	/* wait for data page flush only
+										 * no wait for WAL */
+	SYNCHRONOUS_TRANSFER_ALL	        /* wait for data page flush and WAL*/
+}	SynchronousTransferLevel;
+
 /* user-settable parameters for synchronous replication */
 extern char *SyncRepStandbyNames;
 
+/* user-settable parameters for failback safe replication */
+extern int	synchronous_transfer;
+
 /* called by user backend */
-extern void SyncRepWaitForLSN(XLogRecPtr XactCommitLSN);
+extern bool SyncRepWaitForLSN(XLogRecPtr XactCommitLSN,
+		bool ForDataFlush, bool Wait);
 
 /* called at backend exit */
 extern void SyncRepCleanupAtProcExit(void);

*** a/doc/src/sgml/config.sgml
--- b/doc/src/sgml/config.sgml
***************
*** 1749,1754 **** include 'filename'
--- 1749,1787 ----
        </listitem>
       </varlistentry>
  
+      <varlistentry id="guc-synchronous-transfer" xreflabel="synchronous_transfer">
+       <term><varname>synchronous_transfer</varname> (<type>enum</type>)</term>
+       <indexterm>
+        <primary><varname>synchronous_transfer</> configuration parameter</primary>
+       </indexterm>
+       <listitem>
+        <para>
+         This parameter controls the synchronous nature of WAL transfer and
+         maintains file system level consistency between master server and
+         standby server. Specifies whether master server will wait for file
+         system level change (for example : modifying data page) before
+         corresponding WAL records are replicated to the standby server.
+        </para>
+        <para>
+         Valid values are <literal>commit</>, <literal>data_flush</> and
+         <literal>all</>. The default value is <literal>commit</>, meaning
+         that master only wait for transaction commits, this is equivalent
+         to turning off <literal>synchronous_transfer</> parameter and standby
+         server will behave as a <quote>synchronous standby </> in
+         Streaming Replication. For value <literal>data_flush</>, master will
+         wait only for data page modifications but not for transaction
+         commits, hence the standby server will act as <quote>asynchronous
+         failback safe standby</>. For value <literal> all</>, master will wait
+         for data page modifications as well as for transaction commits and
+         resultant standby server will act as <quote>synchronous failback safe
+         standby</>. The wait is on background activities and hence will not
+         create much performance overhead.
+         To configure synchronous failback safe standby
+         <xref linkend="guc-synchronous-standby-names"> should be set.
+        </para>
+       </listitem>
+      </varlistentry>
+ 
       <varlistentry id="guc-wal-sync-method" xreflabel="wal_sync_method">
        <term><varname>wal_sync_method</varname> (<type>enum</type>)</term>
        <indexterm>
***************
*** 2258,2271 **** include 'filename'
        </indexterm>
        <listitem>
         <para>
!         Specifies a comma-separated list of standby names that can support
!         <firstterm>synchronous replication</>, as described in
!         <xref linkend="synchronous-replication">.
!         At any one time there will be at most one active synchronous standby;
!         transactions waiting for commit will be allowed to proceed after
!         this standby server confirms receipt of their data.
!         The synchronous standby will be the first standby named in this list
!         that is both currently connected and streaming data in real-time
          (as shown by a state of <literal>streaming</literal> in the
          <link linkend="monitoring-stats-views-table">
          <literal>pg_stat_replication</></link> view).
--- 2291,2315 ----
        </indexterm>
        <listitem>
         <para>
!         Specifies a comma-separated list of standby names. If this parameter
!         is set then standby will behave as synchronous standby in replication,
!         as described in <xref linkend="synchronous-replication"> or synchronous
!         failback safe standby, as described in <xref linkend="failback-safe">.
!         At any time there will be at most one active standby; when standby is
!         synchronous standby in replication, transactions waiting for commit
!         will be allowed to proceed after this standby server confirms receipt
!         of their data. But when standby is synchronous failback safe standby
!         data page modifications as well as transaction commits will be allowed
!         to proceed only after this standby server confirms receipt of their data.
!         If this parameter is set to empty value and
!         <xref linkend="guc-synchronous-transfer"> is set to <literal>data_flush</>
!         then standby is called as asynchronous failback safe standby and only
!         data page modifications will wait before corresponding WAL record is
!         replicated to standby.
!        </para>
!        <para>
!         Synchronous standby in replication will be the first standby named in
!         this list that is both currently connected and streaming data in real-time
          (as shown by a state of <literal>streaming</literal> in the
          <link linkend="monitoring-stats-views-table">
          <literal>pg_stat_replication</></link> view).
*** a/doc/src/sgml/high-availability.sgml
--- b/doc/src/sgml/high-availability.sgml
***************
*** 1140,1145 **** primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
--- 1140,1203 ----
  
     </sect3>
    </sect2>
+ 
+   <sect2 id="failback-safe">
+      <title>Setting up failback safe standby</title>
+ 
+    <indexterm zone="high-availability">
+        <primary>Setting up failback safe standby</primary>
+    </indexterm>
+ 
+    <para>
+     PostgreSQL Streaming Replication offers durability, but if the master
+     crashes and particular WAL record is unable to reach to standby
+     server, then that WAL record is present on master server but not
+     on standby server. In such a case master is ahead of standby server
+     in term of WAL records and Data in database. This will lead to
+     file-system level inconsistency between master and standby server.
+     For example a heap page update on the master might not have been reflected
+     on standby when master crashes.
+    </para>
+ 
+    <para>
+     Due to this inconsistency fresh backup of new master onto new standby
+     is needed to re-prepare HA cluster. Taking fresh backup can be very
+     time consuming process when database is of large size. In such a case
+     disaster recovery can take very long time if Streaming Replication is
+     used to setup the high availability cluster.
+    </para>
+ 
+    <para>
+     If HA cluster is configured with failback safe standby then this fresh
+     back up can be avoided. The <xref linkend="guc-synchronous-transfer">
+     parameter has control over all WAL transfers and will not make any file
+     system level change until master gets a confirmation from standby server.
+     This avoids the need of a fresh backup by maintaining consistency.
+    </para>
+ 
+    <sect3 id="Failback-safe-config">
+     <title>Basic Configuration</title>
+    <para>
+     Failback safe standby can be asynchronous or synchronous in nature.
+     This will depend upon whether master will wait for transaction commit
+     or not. By default failback safe mechanism is turned off.
+    </para>
+ 
+    <para>
+     The first step to configure HA with failback safe standby is to setup
+     synchronous streaming replication. Configuring synchronous failback
+     safe standby requires setting up  <xref linkend="guc-synchronous-transfer"> to
+     <literal>all</>. This configuration will cause each commit and data
+     page modification to wait for confirmation that standby has written
+     corresponding WAL record to durable storage. Configuring asynchronous
+     failback safe standby requires setting up <xref linkend="guc-synchronous-transfer">
+     to <literal> data_flush</>. This configuration will cause only data
+     page modifications to wait for confirmation that standby has written
+     corresponding WAL record to durable storage.
+    </para>
+ 
+   </sect3>
+   </sect2>
    </sect1>
  
    <sect1 id="warm-standby-failover">
***************
*** 1201,1212 **** primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
     </para>
  
     <para>
!     So, switching from primary to standby server can be fast but requires
!     some time to re-prepare the failover cluster. Regular switching from
!     primary to standby is useful, since it allows regular downtime on
!     each system for maintenance. This also serves as a test of the
!     failover mechanism to ensure that it will really work when you need it.
!     Written administration procedures are advised.
     </para>
  
     <para>
--- 1259,1286 ----
     </para>
  
     <para>
!     At the time of failover there is a possibility of file-system level
!     inconsistency between old primary and old standby server hence
!     fresh backup from new master onto old master is needed for Configuring
!     old standby server as a new standby server. Without taking fresh
!     backup even if the new standby starts, streaming replication does not
!     start successfully. The activity of taking backup can be fast for smaller
!     database but for large database requires more time to re-prepare the
!     failover cluster and could break the service level agreement of crash
!     recovery. The need of fresh backup and problem of long
!     recovery time can be solved if HA cluster is configured with
!     failback safe standby see <xref linkend="failback-safe">.
!     Failback safe standby makes WAL transfer synchronous at required
!     places and maintains the file-system level consistency between
!     master and standby server and the old master server can be easily
!     configured as new standby server.
!    </para>
! 
!    <para>
!     Regular switching from primary to standby is useful, since it allows
!     regular downtime on each system for maintenance. This also serves as
!     a test of the failover mechanism to ensure that it will really work
!     when you need it. Written administration procedures are advised.
     </para>
  
     <para>
*** a/doc/src/sgml/perform.sgml
--- b/doc/src/sgml/perform.sgml
***************
*** 1569,1574 **** SELECT * FROM x, y, a, b, c WHERE something AND somethingelse;
--- 1569,1582 ----
         corruption) in case of a crash of the <emphasis>database</> alone.
        </para>
       </listitem>
+ 
+      <listitem>
+       <para>
+        Set <xref linkend="guc-synchronous-transfer"> to commit; there is no
+        need to guard against database inconsistency between master and standby
+        server during failover.
+       </para>
+      </listitem>
      </itemizedlist>
     </para>
    </sect1>
*** a/src/backend/access/transam/clog.c
--- b/src/backend/access/transam/clog.c
***************
*** 37,42 ****
--- 37,44 ----
  #include "access/transam.h"
  #include "miscadmin.h"
  #include "pg_trace.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  
  /*
   * Defines for CLOG page sizes.  A page is the same BLCKSZ as is used
***************
*** 708,715 **** WriteZeroPageXlogRec(int pageno)
  /*
   * Write a TRUNCATE xlog record
   *
!  * We must flush the xlog record to disk before returning --- see notes
!  * in TruncateCLOG().
   */
  static void
  WriteTruncateXlogRec(int pageno)
--- 710,719 ----
  /*
   * Write a TRUNCATE xlog record
   *
!  * Before returning we must flush the xlog record to disk
!  * and if synchronous transfer is requested wait for failback
!  * safe standby to receive WAL up to recptr.
!  * --- see notes in TruncateCLOG().
   */
  static void
  WriteTruncateXlogRec(int pageno)
***************
*** 723,728 **** WriteTruncateXlogRec(int pageno)
--- 727,738 ----
  	rdata.next = NULL;
  	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
  	XLogFlush(recptr);
+ 
+ 	/*
+ 	 * Wait for failback safe standby.
+ 	 */
+ 	if (SyncTransRequested())
+ 		SyncRepWaitForLSN(recptr, true, true);
  }
  
  /*
*** a/src/backend/access/transam/slru.c
--- b/src/backend/access/transam/slru.c
***************
*** 54,59 ****
--- 54,61 ----
  #include "access/slru.h"
  #include "access/transam.h"
  #include "access/xlog.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "storage/shmem.h"
  #include "miscadmin.h"
***************
*** 744,749 **** SlruPhysicalWritePage(SlruCtl ctl, int pageno, int slotno, SlruFlush fdata)
--- 746,758 ----
  			START_CRIT_SECTION();
  			XLogFlush(max_lsn);
  			END_CRIT_SECTION();
+ 
+ 			/*
+ 			 * If synchronous transfer is requested, wait for failback safe
+ 			 * standby to receive WAL up to max_lsn.
+ 			 */
+ 			if (SyncTransRequested())
+ 				SyncRepWaitForLSN(max_lsn, true, true);
  		}
  	}
  
*** a/src/backend/access/transam/twophase.c
--- b/src/backend/access/transam/twophase.c
***************
*** 1091,1102 **** EndPrepare(GlobalTransaction gxact)
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked the prepare, but still show as
  	 * running in the procarray (twice!) and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(gxact->prepare_lsn);
  
  	records.tail = records.head = NULL;
  }
--- 1091,1102 ----
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked the prepare, but still show as
  	 * running in the procarray (twice!) and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(gxact->prepare_lsn, false, true);
  
  	records.tail = records.head = NULL;
  }
***************
*** 2058,2069 **** RecordTransactionCommitPrepared(TransactionId xid,
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr);
  }
  
  /*
--- 2058,2069 ----
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr, false, true);
  }
  
  /*
***************
*** 2138,2147 **** RecordTransactionAbortPrepared(TransactionId xid,
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr);
  }
--- 2138,2147 ----
  	END_CRIT_SECTION();
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
! 	SyncRepWaitForLSN(recptr, false, true);
  }
*** a/src/backend/access/transam/xact.c
--- b/src/backend/access/transam/xact.c
***************
*** 1189,1201 **** RecordTransactionCommit(void)
  	latestXid = TransactionIdLatest(xid, nchildren, children);
  
  	/*
! 	 * Wait for synchronous replication, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
  	if (wrote_xlog)
! 		SyncRepWaitForLSN(XactLastRecEnd);
  
  	/* Reset XactLastRecEnd until the next transaction writes something */
  	XactLastRecEnd = 0;
--- 1189,1201 ----
  	latestXid = TransactionIdLatest(xid, nchildren, children);
  
  	/*
! 	 * Wait for synchronous/synchronous failback safe standby, if required.
  	 *
  	 * Note that at this stage we have marked clog, but still show as running
  	 * in the procarray and continue to hold locks.
  	 */
  	if (wrote_xlog)
! 		SyncRepWaitForLSN(XactLastRecEnd, false, true);
  
  	/* Reset XactLastRecEnd until the next transaction writes something */
  	XactLastRecEnd = 0;
***************
*** 4690,4697 **** xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
--- 4690,4706 ----
  	 * for any user that requested ForceSyncCommit().
  	 */
  	if (XactCompletionForceSyncCommit(xinfo))
+ 	{
  		XLogFlush(lsn);
  
+ 		/*
+ 		 * If synchronous transfer is requested, wait for failback safe
+ 		 * standby to receive WAL up to lsn,
+ 		 */
+ 		if (SyncTransRequested())
+ 			SyncRepWaitForLSN(lsn, true, true);
+ 
+ 	}
  }
  
  /*
*** a/src/backend/access/transam/xlog.c
--- b/src/backend/access/transam/xlog.c
***************
*** 39,44 ****
--- 39,45 ----
  #include "pgstat.h"
  #include "postmaster/bgwriter.h"
  #include "postmaster/startup.h"
+ #include "replication/syncrep.h"
  #include "replication/walreceiver.h"
  #include "replication/walsender.h"
  #include "storage/barrier.h"
***************
*** 8282,8287 **** CreateCheckPoint(int flags)
--- 8283,8300 ----
  	END_CRIT_SECTION();
  
  	/*
+ 	 * If synchronous transfer is requested, wait for failback safe standby
+ 	 * to receive WAL up to checkpoint WAL record. Otherwise if failure occurs
+ 	 * before standby receives CHECKPOINT WAL record causes an inconsistency
+ 	 * between control files of master and standby. Because of this master will
+ 	 * start from a location which is not known to the standby at the time fail-over.
+ 	 *
+ 	 * There is no need to wait for shutdown CHECKPOINT.
+ 	 */
+ 	if (SyncTransRequested())
+ 		SyncRepWaitForLSN(recptr, true, !shutdown);
+ 
+ 	/*
  	 * Let smgr do post-checkpoint cleanup (eg, deleting old files).
  	 */
  	smgrpostckpt();
*** a/src/backend/catalog/storage.c
--- b/src/backend/catalog/storage.c
***************
*** 25,30 ****
--- 25,32 ----
  #include "catalog/catalog.h"
  #include "catalog/storage.h"
  #include "catalog/storage_xlog.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/freespace.h"
  #include "storage/smgr.h"
  #include "utils/memutils.h"
***************
*** 288,293 **** RelationTruncate(Relation rel, BlockNumber nblocks)
--- 290,303 ----
  		 */
  		if (fsm || vm)
  			XLogFlush(lsn);
+ 
+ 		/*
+ 		 * If synchronous transfer is requested, wait for failback safe standby
+ 		 * to receive WAL up to lsn. Otherwise, we may have a situation where
+ 		 * the heap is truncated, but the action never replayed on the standby.
+ 		 */
+ 		if (SyncTransRequested())
+ 			SyncRepWaitForLSN(lsn, true, true);
  	}
  
  	/* Do the real work */
***************
*** 521,526 **** smgr_redo(XLogRecPtr lsn, XLogRecord *record)
--- 531,543 ----
  		 */
  		XLogFlush(lsn);
  
+ 		/*
+ 		 * If synchronous transfer is requested, wait for failback safe standby
+ 		 * to receive WAL up to lsn.
+ 		 */
+ 		if (SyncTransRequested())
+ 			SyncRepWaitForLSN(lsn, true, true);
+ 
  		smgrtruncate(reln, MAIN_FORKNUM, xlrec->blkno);
  
  		/* Also tell xlogutils.c about it */
*** a/src/backend/postmaster/autovacuum.c
--- b/src/backend/postmaster/autovacuum.c
***************
*** 85,90 ****
--- 85,92 ----
  #include "postmaster/autovacuum.h"
  #include "postmaster/fork_process.h"
  #include "postmaster/postmaster.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/bufmgr.h"
  #include "storage/ipc.h"
  #include "storage/latch.h"
***************
*** 1591,1598 **** AutoVacWorkerMain(int argc, char *argv[])
  	 * Force synchronous replication off to allow regular maintenance even if
  	 * we are waiting for standbys to connect. This is important to ensure we
  	 * aren't blocked from performing anti-wraparound tasks.
  	 */
! 	if (synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
  		SetConfigOption("synchronous_commit", "local",
  						PGC_SUSET, PGC_S_OVERRIDE);
  
--- 1593,1602 ----
  	 * Force synchronous replication off to allow regular maintenance even if
  	 * we are waiting for standbys to connect. This is important to ensure we
  	 * aren't blocked from performing anti-wraparound tasks.
+ 	 * Note that if sync transfer is requested, we can't regular maintenance until
+ 	 * standbys to connect.
  	 */
! 	if (synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH && !SyncTransRequested())
  		SetConfigOption("synchronous_commit", "local",
  						PGC_SUSET, PGC_S_OVERRIDE);
  
*** a/src/backend/replication/syncrep.c
--- b/src/backend/replication/syncrep.c
***************
*** 67,72 **** static bool announce_next_takeover = true;
--- 67,74 ----
  
  static int	SyncRepWaitMode = SYNC_REP_NO_WAIT;
  
+ int		synchronous_transfer = SYNCHRONOUS_TRANSFER_COMMIT;
+ 
  static void SyncRepQueueInsert(int mode);
  static void SyncRepCancelWait(void);
  
***************
*** 83,110 **** static bool SyncRepQueueIsOrderedByLSN(int mode);
   */
  
  /*
!  * Wait for synchronous replication, if requested by user.
   *
   * Initially backends start in state SYNC_REP_NOT_WAITING and then
!  * change that state to SYNC_REP_WAITING before adding ourselves
!  * to the wait queue. During SyncRepWakeQueue() a WALSender changes
!  * the state to SYNC_REP_WAIT_COMPLETE once replication is confirmed.
!  * This backend then resets its state to SYNC_REP_NOT_WAITING.
   */
! void
! SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  {
  	char	   *new_status = NULL;
  	const char *old_status;
  	int			mode = SyncRepWaitMode;
  
  	/*
! 	 * Fast exit if user has not requested sync replication, or there are no
! 	 * sync replication standby names defined. Note that those standbys don't
! 	 * need to be connected.
  	 */
! 	if (!SyncRepRequested() || !SyncStandbysDefined())
! 		return;
  
  	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
  	Assert(WalSndCtl != NULL);
--- 85,151 ----
   */
  
  /*
!  * Wait for synchronous/failback safe standby, if requested by user.
   *
   * Initially backends start in state SYNC_REP_NOT_WAITING and then
!  * change that state to SYNC_REP_WAITING/SYNC_REP_WAITING_FOR_DATA_FLUSH
!  * before adding ourselves to the wait queue. During SyncRepWakeQueue() a
!  * WALSender changes the state to SYNC_REP_WAIT_COMPLETE once replication is
!  * confirmed. This backend then resets its state to SYNC_REP_NOT_WAITING.
!  *
!  * ForDataFlush - if TRUE, we wait before flushing data page.
!  * Otherwise wait for the sync standby
!  *
!  * Wait - if FALSE, we don't actually wait, but tell the caller whether or not
!  * the standby has already made progressed upto the given XactCommitLSN
!  *
!  * Return TRUE if either the synchronous standby/failback safe standby is not
!  * configured/turned off OR the standby has made enough progress
   */
! bool
! SyncRepWaitForLSN(XLogRecPtr XactCommitLSN, bool ForDataFlush, bool Wait)
  {
  	char	   *new_status = NULL;
  	const char *old_status;
  	int			mode = SyncRepWaitMode;
+ 	bool		ret;
  
  	/*
! 	 * Fast exit If there are no sync replication standby names defined.
! 	 * Note that those standbys don't need to be connected.
  	 */
! 	if (!SyncStandbysDefined())
! 		return true;
! 
! 	/* if user has not requested sync replication, exit */
! 	if (!SyncRepRequested()  && !ForDataFlush)
! 		return true;
! 
! 	/*
! 	 * If the caller has specified ForDataFlush, but synchronous transfer
! 	 * is not specified or its turned off, exit.
! 	 *
! 	 * We would like to allow the failback safe mechanism even for cascaded
! 	 * standbys as well. But we can't really wait for the standby to catch
! 	 * up until we reach a consistent state since the standbys won't be
! 	 * even able to connect without us reaching in that state (XXX Confirm)
! 	 */
! 	if (!SyncTransRequested() && ForDataFlush)
! 		return true;
! 
! 	/*
! 	 * If the caller has not specified ForDataFlush, but synchronous commit
! 	 * is skipped by values of synchronous_transfer, exit.
! 	 */
! 	if (IsSyncRepSkipped() && !ForDataFlush)
! 		return true;
! 
! 	/*
! 	 * If both synchronous replication and synchronous transfer
! 	 * are requested but the system still in recovery, exit.
! 	 */
! 	if (RecoveryInProgress())
! 		return true;
  
  	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
  	Assert(WalSndCtl != NULL);
***************
*** 120,130 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
  	 * condition but we'll be fetching that cache line anyway so it's likely to
  	 * be a low cost check.
  	 */
! 	if (!WalSndCtl->sync_standbys_defined ||
  		XactCommitLSN <= WalSndCtl->lsn[mode])
  	{
  		LWLockRelease(SyncRepLock);
! 		return;
  	}
  
  	/*
--- 161,180 ----
  	 * condition but we'll be fetching that cache line anyway so it's likely to
  	 * be a low cost check.
  	 */
! 	if ((!ForDataFlush && !WalSndCtl->sync_standbys_defined) ||
  		XactCommitLSN <= WalSndCtl->lsn[mode])
  	{
  		LWLockRelease(SyncRepLock);
! 		return true;
! 	}
! 
! 	/*
! 	 * Exit if we are told not to block on the standby.
! 	 */
! 	if (!Wait)
! 	{
! 		LWLockRelease(SyncRepLock);
! 		return false;
  	}
  
  	/*
***************
*** 151,156 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 201,208 ----
  		new_status[len] = '\0'; /* truncate off " waiting ..." */
  	}
  
+ 	ret = false;
+ 
  	/*
  	 * Wait for specified LSN to be confirmed.
  	 *
***************
*** 187,193 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 239,248 ----
  			LWLockRelease(SyncRepLock);
  		}
  		if (syncRepState == SYNC_REP_WAIT_COMPLETE)
+ 		{
+ 			ret = true;
  			break;
+ 		}
  
  		/*
  		 * If a wait for synchronous replication is pending, we can neither
***************
*** 264,269 **** SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
--- 319,326 ----
  		set_ps_display(new_status, false);
  		pfree(new_status);
  	}
+ 
+ 	return ret;
  }
  
  /*
*** a/src/backend/storage/buffer/bufmgr.c
--- b/src/backend/storage/buffer/bufmgr.c
***************
*** 41,46 ****
--- 41,48 ----
  #include "pg_trace.h"
  #include "pgstat.h"
  #include "postmaster/bgwriter.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/buf_internals.h"
  #include "storage/bufmgr.h"
  #include "storage/ipc.h"
***************
*** 1975,1982 **** FlushBuffer(volatile BufferDesc *buf, SMgrRelation reln)
  	 * skip the flush if the buffer isn't permanent.
  	 */
  	if (buf->flags & BM_PERMANENT)
  		XLogFlush(recptr);
! 
  	/*
  	 * Now it's safe to write buffer to disk. Note that no one else should
  	 * have been able to write it while we were busy with log flushing because
--- 1977,1990 ----
  	 * skip the flush if the buffer isn't permanent.
  	 */
  	if (buf->flags & BM_PERMANENT)
+ 	{
  		XLogFlush(recptr);
! 		/* If synchronous transfer is requested, wait for failback safe standby
! 		 * to receive WAL up to recptr.
! 		 */
! 		if (SyncTransRequested())
! 			SyncRepWaitForLSN(recptr, true, true);
! 	}
  	/*
  	 * Now it's safe to write buffer to disk. Note that no one else should
  	 * have been able to write it while we were busy with log flushing because
*** a/src/backend/utils/cache/relmapper.c
--- b/src/backend/utils/cache/relmapper.c
***************
*** 48,53 ****
--- 48,55 ----
  #include "catalog/pg_tablespace.h"
  #include "catalog/storage.h"
  #include "miscadmin.h"
+ #include "replication/syncrep.h"
+ #include "replication/walsender.h"
  #include "storage/fd.h"
  #include "storage/lwlock.h"
  #include "utils/inval.h"
***************
*** 711,716 **** write_relmap_file(bool shared, RelMapFile *newmap,
--- 713,719 ----
  	int			fd;
  	RelMapFile *realmap;
  	char		mapfilename[MAXPGPATH];
+ 	XLogRecPtr	lsn=InvalidXLogRecPtr;
  
  	/*
  	 * Fill in the overhead fields and update CRC.
***************
*** 753,759 **** write_relmap_file(bool shared, RelMapFile *newmap,
  	{
  		xl_relmap_update xlrec;
  		XLogRecData rdata[2];
- 		XLogRecPtr	lsn;
  
  		/* now errors are fatal ... */
  		START_CRIT_SECTION();
--- 756,761 ----
***************
*** 849,854 **** write_relmap_file(bool shared, RelMapFile *newmap,
--- 851,863 ----
  	/* Critical section done */
  	if (write_wal)
  		END_CRIT_SECTION();
+ 
+ 	/*
+ 	 * If synchronous transfer is requested, wait for failback safe
+ 	 * standby to receive WAL up to recptr.
+ 	 */
+ 	if (SyncTransRequested())
+ 		SyncRepWaitForLSN(lsn, true, true);
  }
  
  /*
*** a/src/backend/utils/misc/guc.c
--- b/src/backend/utils/misc/guc.c
***************
*** 381,386 **** static const struct config_enum_entry synchronous_commit_options[] = {
--- 381,396 ----
  };
  
  /*
+  * Although only "all", "data_flush", and "commit" are documented
+  */
+ static const struct config_enum_entry synchronous_transfer_options[] = {
+ 	{"all", SYNCHRONOUS_TRANSFER_ALL, false},
+ 	{"data_flush", SYNCHRONOUS_TRANSFER_DATA_FLUSH, false},
+ 	{"commit", SYNCHRONOUS_TRANSFER_COMMIT, false},
+ 	{NULL, 0, false}
+ };
+ 
+ /*
   * Options for enum values stored in other modules
   */
  extern const struct config_enum_entry wal_level_options[];
***************
*** 3300,3305 **** static struct config_enum ConfigureNamesEnum[] =
--- 3310,3325 ----
  	},
  
  	{
+ 		{"synchronous_transfer", PGC_SIGHUP, WAL_SETTINGS,
+ 			gettext_noop("Sets the data flush synchronization level"),
+ 			NULL
+ 		},
+ 		&synchronous_transfer,
+ 		SYNCHRONOUS_TRANSFER_COMMIT, synchronous_transfer_options,
+ 		NULL, NULL, NULL
+ 	},
+ 
+ 	{
  		{"trace_recovery_messages", PGC_SIGHUP, DEVELOPER_OPTIONS,
  			gettext_noop("Enables logging of recovery-related debugging information."),
  			gettext_noop("Each level includes all the levels that follow it. The later"
*** a/src/backend/utils/misc/postgresql.conf.sample
--- b/src/backend/utils/misc/postgresql.conf.sample
***************
*** 220,225 ****
--- 220,227 ----
  #synchronous_standby_names = ''	# standby servers that provide sync rep
  				# comma-separated list of application_name
  				# from standby(s); '*' = all
+ #synchronous_transfer = commit	# data page synchronization level
+ 				# commit, data_flush or all
  #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
  
  # - Standby Servers -
*** a/src/backend/utils/time/tqual.c
--- b/src/backend/utils/time/tqual.c
***************
*** 60,65 ****
--- 60,67 ----
  #include "access/subtrans.h"
  #include "access/transam.h"
  #include "access/xact.h"
+ #include "replication/walsender.h"
+ #include "replication/syncrep.h"
  #include "storage/bufmgr.h"
  #include "storage/procarray.h"
  #include "utils/tqual.h"
***************
*** 115,120 **** SetHintBits(HeapTupleHeader tuple, Buffer buffer,
--- 117,134 ----
  
  		if (XLogNeedsFlush(commitLSN) && BufferIsPermanent(buffer))
  			return;				/* not flushed yet, so don't set hint */
+ 
+ 		/*
+ 		 * If synchronous transfer is requested, we check if the commit WAL record
+ 		 * has made to the standby before allowing hint bit updates. We should not
+ 		 * wait for the standby to receive the WAL since its OK to delay hint bit
+ 		 * updates.
+ 		 */
+ 		if (SyncTransRequested())
+ 		{
+ 			if(!SyncRepWaitForLSN(commitLSN, true, false))
+ 				return;
+ 		}
  	}
  
  	tuple->t_infomask |= infomask;
*** a/src/include/replication/syncrep.h
--- b/src/include/replication/syncrep.h
***************
*** 19,24 ****
--- 19,30 ----
  #define SyncRepRequested() \
  	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
  
+ #define SyncTransRequested() \
+ 	(max_wal_senders > 0 && synchronous_transfer > SYNCHRONOUS_TRANSFER_COMMIT)
+ 
+ #define IsSyncRepSkipped() \
+ 	(max_wal_senders > 0 && synchronous_transfer ==  SYNCHRONOUS_TRANSFER_DATA_FLUSH)
+ 
  /* SyncRepWaitMode */
  #define SYNC_REP_NO_WAIT		-1
  #define SYNC_REP_WAIT_WRITE		0
***************
*** 31,41 ****
  #define SYNC_REP_WAITING			1
  #define SYNC_REP_WAIT_COMPLETE		2
  
  /* user-settable parameters for synchronous replication */
  extern char *SyncRepStandbyNames;
  
  /* called by user backend */
! extern void SyncRepWaitForLSN(XLogRecPtr XactCommitLSN);
  
  /* called at backend exit */
  extern void SyncRepCleanupAtProcExit(void);
--- 37,59 ----
  #define SYNC_REP_WAITING			1
  #define SYNC_REP_WAIT_COMPLETE		2
  
+ typedef enum
+ {
+ 	SYNCHRONOUS_TRANSFER_COMMIT,		/* no wait for flush data page */
+ 	SYNCHRONOUS_TRANSFER_DATA_FLUSH,	/* wait for data page flush only
+ 										 * no wait for WAL */
+ 	SYNCHRONOUS_TRANSFER_ALL	        /* wait for data page flush and WAL*/
+ }	SynchronousTransferLevel;
+ 
  /* user-settable parameters for synchronous replication */
  extern char *SyncRepStandbyNames;
  
+ /* user-settable parameters for failback safe replication */
+ extern int	synchronous_transfer;
+ 
  /* called by user backend */
! extern bool SyncRepWaitForLSN(XLogRecPtr XactCommitLSN,
! 		bool ForDataFlush, bool Wait);
  
  /* called at backend exit */
  extern void SyncRepCleanupAtProcExit(void);

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 370aa09..86d2265 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1749,6 +1749,39 @@ include 'filename'
       </listitem>
      </varlistentry>
 
+     <varlistentry id="guc-synchronous-transfer" xreflabel="synchronous_transfer">
+      <term><varname>synchronous_transfer</varname> (<type>enum</type>)</term>
+      <indexterm>
+       <primary><varname>synchronous_transfer</> configuration parameter</primary>
+      </indexterm>
+      <listitem>
+       <para>
+        This parameter controls the synchronous nature of WAL transfer and
+        maintains file system level consistency between master server and
+        standby server. Specifies whether master server will wait for file
+        system level change (for example : modifying data page) before
+        corresponding WAL records are replicated to the standby server.
+       </para>
+       <para>
+        Valid values are <literal>commit</>, <literal>data_flush</> and
+        <literal>all</>. The default value is <literal>commit</>, meaning
+        that master only wait for transaction commits, this is equivalent
+        to turning off <literal>synchronous_transfer</> parameter and standby
+        server will behave as a <quote>synchronous standby </> in
+        Streaming Replication. For value <literal>data_flush</>, master will
+        wait only for data page modifications but not for transaction
+        commits, hence the standby server will act as <quote>asynchronous
+        failback safe standby</>. For value <literal> all</>, master will wait
+        for data page modifications as well as for transaction commits and
+        resultant standby server will act as <quote>synchronous failback safe
+        standby</>. The wait is on background activities and hence will not
+        create much performance overhead.
+        To configure synchronous failback safe standby
+        <xref linkend="guc-synchronous-standby-names"> should be set.
+       </para>
+      </listitem>
+     </varlistentry>
+
      <varlistentry id="guc-wal-sync-method" xreflabel="wal_sync_method">
       <term><varname>wal_sync_method</varname> (<type>enum</type>)</term>
       <indexterm>
@@ -2258,14 +2291,25 @@ include 'filename'
       </indexterm>
       <listitem>
        <para>
-        Specifies a comma-separated list of standby names that can support
-        <firstterm>synchronous replication</>, as described in
-        <xref linkend="synchronous-replication">.
-        At any one time there will be at most one active synchronous standby;
-        transactions waiting for commit will be allowed to proceed after
-        this standby server confirms receipt of their data.
-        The synchronous standby will be the first standby named in this list
-        that is both currently connected and streaming data in real-time
+        Specifies a comma-separated list of standby names. If this parameter
+        is set then standby will behave as synchronous standby in replication,
+        as described in <xref linkend="synchronous-replication"> or synchronous
+        failback safe standby, as described in <xref linkend="failback-safe">.
+        At any time there will be at most one active standby; when standby is
+        synchronous standby in replication, transactions waiting for commit
+        will be allowed to proceed after this standby server confirms receipt
+        of their data. But when standby is synchronous failback safe standby
+        data page modifications as well as transaction commits will be allowed
+        to proceed only after this standby server confirms receipt of their data.
+        If this parameter is set to empty value and
+        <xref linkend="guc-synchronous-transfer"> is set to <literal>data_flush</>
+        then standby is called as asynchronous failback safe standby and only
+        data page modifications will wait before corresponding WAL record is
+        replicated to standby.
+       </para>
+       <para>
+        Synchronous standby in replication will be the first standby named in
+        this list that is both currently connected and streaming data in real-time
         (as shown by a state of <literal>streaming</literal> in the
         <link linkend="monitoring-stats-views-table">
         <literal>pg_stat_replication</></link> view).
diff --git a/doc/src/sgml/high-availability.sgml b/doc/src/sgml/high-availability.sgml
index c8f6fa8..e551077 100644
--- a/doc/src/sgml/high-availability.sgml
+++ b/doc/src/sgml/high-availability.sgml
@@ -1140,6 +1140,64 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
 
    </sect3>
   </sect2>
+
+  <sect2 id="failback-safe">
+     <title>Setting up failback safe standby</title>
+
+   <indexterm zone="high-availability">
+       <primary>Setting up failback safe standby</primary>
+   </indexterm>
+
+   <para>
+    PostgreSQL Streaming Replication offers durability, but if the master
+    crashes and particular WAL record is unable to reach to standby
+    server, then that WAL record is present on master server but not
+    on standby server. In such a case master is ahead of standby server
+    in term of WAL records and Data in database. This will lead to
+    file-system level inconsistency between master and standby server.
+    For example a heap page update on the master might not have been reflected
+    on standby when master crashes.
+   </para>
+
+   <para>
+    Due to this inconsistency fresh backup of new master onto new standby
+    is needed to re-prepare HA cluster. Taking fresh backup can be very
+    time consuming process when database is of large size. In such a case
+    disaster recovery can take very long time if Streaming Replication is
+    used to setup the high availability cluster.
+   </para>
+
+   <para>
+    If HA cluster is configured with failback safe standby then this fresh
+    back up can be avoided. The <xref linkend="guc-synchronous-transfer">
+    parameter has control over all WAL transfers and will not make any file
+    system level change until master gets a confirmation from standby server.
+    This avoids the need of a fresh backup by maintaining consistency.
+   </para>
+
+   <sect3 id="Failback-safe-config">
+    <title>Basic Configuration</title>
+   <para>
+    Failback safe standby can be asynchronous or synchronous in nature.
+    This will depend upon whether master will wait for transaction commit
+    or not. By default failback safe mechanism is turned off.
+   </para>
+
+   <para>
+    The first step to configure HA with failback safe standby is to setup
+    synchronous streaming replication. Configuring synchronous failback
+    safe standby requires setting up  <xref linkend="guc-synchronous-transfer"> to
+    <literal>all</>. This configuration will cause each commit and data
+    page modification to wait for confirmation that standby has written
+    corresponding WAL record to durable storage. Configuring asynchronous
+    failback safe standby requires setting up <xref linkend="guc-synchronous-transfer">
+    to <literal> data_flush</>. This configuration will cause only data
+    page modifications to wait for confirmation that standby has written
+    corresponding WAL record to durable storage.
+   </para>
+
+  </sect3>
+  </sect2>
   </sect1>
 
   <sect1 id="warm-standby-failover">
@@ -1201,12 +1259,28 @@ primary_conninfo = 'host=192.168.1.50 port=5432 user=foo password=foopass'
    </para>
 
    <para>
-    So, switching from primary to standby server can be fast but requires
-    some time to re-prepare the failover cluster. Regular switching from
-    primary to standby is useful, since it allows regular downtime on
-    each system for maintenance. This also serves as a test of the
-    failover mechanism to ensure that it will really work when you need it.
-    Written administration procedures are advised.
+    At the time of failover there is a possibility of file-system level
+    inconsistency between old primary and old standby server hence
+    fresh backup from new master onto old master is needed for Configuring
+    old standby server as a new standby server. Without taking fresh
+    backup even if the new standby starts, streaming replication does not
+    start successfully. The activity of taking backup can be fast for smaller
+    database but for large database requires more time to re-prepare the
+    failover cluster and could break the service level agreement of crash
+    recovery. The need of fresh backup and problem of long
+    recovery time can be solved if HA cluster is configured with
+    failback safe standby see <xref linkend="failback-safe">.
+    Failback safe standby makes WAL transfer synchronous at required
+    places and maintains the file-system level consistency between
+    master and standby server and the old master server can be easily
+    configured as new standby server.
+   </para>
+
+   <para>
+    Regular switching from primary to standby is useful, since it allows
+    regular downtime on each system for maintenance. This also serves as
+    a test of the failover mechanism to ensure that it will really work
+    when you need it. Written administration procedures are advised.
    </para>
 
    <para>
diff --git a/doc/src/sgml/perform.sgml b/doc/src/sgml/perform.sgml
index 2af1738..b074a91 100644
--- a/doc/src/sgml/perform.sgml
+++ b/doc/src/sgml/perform.sgml
@@ -1569,6 +1569,14 @@ SELECT * FROM x, y, a, b, c WHERE something AND somethingelse;
        corruption) in case of a crash of the <emphasis>database</> alone.
       </para>
      </listitem>
+
+     <listitem>
+      <para>
+       Set <xref linkend="guc-synchronous-transfer"> to commit; there is no
+       need to guard against database inconsistency between master and standby
+       server during failover.
+      </para>
+     </listitem>
     </itemizedlist>
    </para>
   </sect1>
diff --git a/src/backend/access/transam/clog.c b/src/backend/access/transam/clog.c
index cb95aa3..5759791 100644
--- a/src/backend/access/transam/clog.c
+++ b/src/backend/access/transam/clog.c
@@ -37,6 +37,8 @@
 #include "access/transam.h"
 #include "miscadmin.h"
 #include "pg_trace.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 
 /*
  * Defines for CLOG page sizes.  A page is the same BLCKSZ as is used
@@ -708,8 +710,10 @@ WriteZeroPageXlogRec(int pageno)
 /*
  * Write a TRUNCATE xlog record
  *
- * We must flush the xlog record to disk before returning --- see notes
- * in TruncateCLOG().
+ * Before returning we must flush the xlog record to disk
+ * and if synchronous transfer is requested wait for failback
+ * safe standby to receive WAL up to recptr.
+ * --- see notes in TruncateCLOG().
  */
 static void
 WriteTruncateXlogRec(int pageno)
@@ -723,6 +727,12 @@ WriteTruncateXlogRec(int pageno)
 	rdata.next = NULL;
 	recptr = XLogInsert(RM_CLOG_ID, CLOG_TRUNCATE, &rdata);
 	XLogFlush(recptr);
+
+	/*
+	 * Wait for failback safe standby.
+	 */
+	if (SyncTransRequested())
+		SyncRepTransferWaitForLSN(recptr, true);
 }
 
 /*
diff --git a/src/backend/access/transam/slru.c b/src/backend/access/transam/slru.c
index 5e53593..b01b3b6 100644
--- a/src/backend/access/transam/slru.c
+++ b/src/backend/access/transam/slru.c
@@ -54,6 +54,8 @@
 #include "access/slru.h"
 #include "access/transam.h"
 #include "access/xlog.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/fd.h"
 #include "storage/shmem.h"
 #include "miscadmin.h"
@@ -744,6 +746,13 @@ SlruPhysicalWritePage(SlruCtl ctl, int pageno, int slotno, SlruFlush fdata)
 			START_CRIT_SECTION();
 			XLogFlush(max_lsn);
 			END_CRIT_SECTION();
+
+			/*
+			 * If synchronous transfer is requested, wait for failback safe
+			 * standby to receive WAL up to max_lsn.
+			 */
+			if (SyncTransRequested())
+				SyncRepTransferWaitForLSN(max_lsn, true);
 		}
 	}
 
diff --git a/src/backend/access/transam/xact.c b/src/backend/access/transam/xact.c
index 0591f3f..0a0a49c 100644
--- a/src/backend/access/transam/xact.c
+++ b/src/backend/access/transam/xact.c
@@ -4690,8 +4690,17 @@ xact_redo_commit_internal(TransactionId xid, XLogRecPtr lsn,
 	 * for any user that requested ForceSyncCommit().
 	 */
 	if (XactCompletionForceSyncCommit(xinfo))
+	{
 		XLogFlush(lsn);
 
+		/*
+		 * If synchronous transfer is requested, wait for failback safe
+		 * standby to receive WAL up to lsn,
+		 */
+		if (SyncTransRequested())
+			SyncRepTransferWaitForLSN(lsn, true);
+
+	}
 }
 
 /*
diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index fc495d6..4c1d2ac 100644
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -39,6 +39,7 @@
 #include "pgstat.h"
 #include "postmaster/bgwriter.h"
 #include "postmaster/startup.h"
+#include "replication/syncrep.h"
 #include "replication/walreceiver.h"
 #include "replication/walsender.h"
 #include "storage/barrier.h"
@@ -8282,6 +8283,18 @@ CreateCheckPoint(int flags)
 	END_CRIT_SECTION();
 
 	/*
+	 * If synchronous transfer is requested, wait for failback safe standby
+	 * to receive WAL up to checkpoint WAL record. Otherwise if failure occurs
+	 * before standby receives CHECKPOINT WAL record causes an inconsistency
+	 * between control files of master and standby. Because of this master will
+	 * start from a location which is not known to the standby at the time fail-over.
+	 *
+	 * There is no need to wait for shutdown CHECKPOINT.
+	 */
+	if (SyncTransRequested())
+		SyncRepTransferWaitForLSN(recptr, !shutdown);
+
+	/*
 	 * Let smgr do post-checkpoint cleanup (eg, deleting old files).
 	 */
 	smgrpostckpt();
diff --git a/src/backend/catalog/storage.c b/src/backend/catalog/storage.c
index 971a149..70595ca 100644
--- a/src/backend/catalog/storage.c
+++ b/src/backend/catalog/storage.c
@@ -25,6 +25,8 @@
 #include "catalog/catalog.h"
 #include "catalog/storage.h"
 #include "catalog/storage_xlog.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/freespace.h"
 #include "storage/smgr.h"
 #include "utils/memutils.h"
@@ -288,6 +290,14 @@ RelationTruncate(Relation rel, BlockNumber nblocks)
 		 */
 		if (fsm || vm)
 			XLogFlush(lsn);
+
+		/*
+		 * If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to lsn. Otherwise, we may have a situation where
+		 * the heap is truncated, but the action never replayed on the standby.
+		 */
+		if (SyncTransRequested())
+			SyncRepTransferWaitForLSN(lsn, true);
 	}
 
 	/* Do the real work */
diff --git a/src/backend/replication/syncrep.c b/src/backend/replication/syncrep.c
index 8cf1346..fc18883 100644
--- a/src/backend/replication/syncrep.c
+++ b/src/backend/replication/syncrep.c
@@ -66,6 +66,8 @@ char	   *SyncRepStandbyNames;
 static bool announce_next_takeover = true;
 
 static int	SyncRepWaitMode = SYNC_REP_NO_WAIT;
+static int	SyncTransferMode = SYNC_REP_NO_WAIT;
+int		synchronous_transfer = SYNCHRONOUS_TRANSFER_COMMIT;
 
 static void SyncRepQueueInsert(int mode);
 static void SyncRepCancelWait(void);
@@ -83,28 +85,24 @@ static bool SyncRepQueueIsOrderedByLSN(int mode);
  */
 
 /*
- * Wait for synchronous replication, if requested by user.
+ * Wait for synchronous standby, if requested by user.
  *
  * Initially backends start in state SYNC_REP_NOT_WAITING and then
- * change that state to SYNC_REP_WAITING before adding ourselves
- * to the wait queue. During SyncRepWakeQueue() a WALSender changes
- * the state to SYNC_REP_WAIT_COMPLETE once replication is confirmed.
- * This backend then resets its state to SYNC_REP_NOT_WAITING.
+ * change that state to SYNC_REP_WAITING/SYNC_REP_WAITING_FOR_DATA_FLUSH
+ * before adding ourselves to the wait queue. During SyncRepWakeQueue() a
+ * WALSender changes the state to SYNC_REP_WAIT_COMPLETE once replication is
+ * confirmed. This backend then resets its state to SYNC_REP_NOT_WAITING.
+ *
+ * ForDataFlush - if TRUE, we wait before flushing data page.
+ * Otherwise wait for the sync standby
  */
-void
-SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
+static bool
+SyncRepWait(XLogRecPtr XactCommitLSN, bool ForDataFlush, bool Wait)
 {
-	char	   *new_status = NULL;
-	const char *old_status;
-	int			mode = SyncRepWaitMode;
-
-	/*
-	 * Fast exit if user has not requested sync replication, or there are no
-	 * sync replication standby names defined. Note that those standbys don't
-	 * need to be connected.
-	 */
-	if (!SyncRepRequested() || !SyncStandbysDefined())
-		return;
+	char		*new_status = NULL;
+	const char  *old_status;
+	int			mode = !ForDataFlush ? SyncRepWaitMode : SyncTransferMode;
+	bool		ret;
 
 	Assert(SHMQueueIsDetached(&(MyProc->syncRepLinks)));
 	Assert(WalSndCtl != NULL);
@@ -120,11 +118,20 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 	 * condition but we'll be fetching that cache line anyway so it's likely to
 	 * be a low cost check.
 	 */
-	if (!WalSndCtl->sync_standbys_defined ||
+	if ((!ForDataFlush && !WalSndCtl->sync_standbys_defined) ||
 		XactCommitLSN <= WalSndCtl->lsn[mode])
 	{
 		LWLockRelease(SyncRepLock);
-		return;
+		return true;
+	}
+
+	/*
+	 * Exit if we are told not to block on the standby.
+	 */
+	if (!Wait)
+	{
+		LWLockRelease(SyncRepLock);
+		return false;
 	}
 
 	/*
@@ -151,6 +158,8 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		new_status[len] = '\0'; /* truncate off " waiting ..." */
 	}
 
+	ret = false;
+
 	/*
 	 * Wait for specified LSN to be confirmed.
 	 *
@@ -187,7 +196,10 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 			LWLockRelease(SyncRepLock);
 		}
 		if (syncRepState == SYNC_REP_WAIT_COMPLETE)
+		{
+			ret = true;
 			break;
+		}
 
 		/*
 		 * If a wait for synchronous replication is pending, we can neither
@@ -264,6 +276,65 @@ SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
 		set_ps_display(new_status, false);
 		pfree(new_status);
 	}
+
+	return ret;
+}
+
+/*
+ * Wait for synchronous standby on transaction commit, if requested by user.
+ */
+void
+SyncRepWaitForLSN(XLogRecPtr XactCommitLSN)
+{
+	/*
+	 * Fast exit If there are no sync replication standby names defined,
+	 * or sync replication is not requested. Note that those standbys don't
+	 * need to be connected.
+	 */
+	if (!SyncStandbysDefined() || !SyncRepRequested())
+		return;
+
+	/*
+	 * If synchronos_transfer is set 'data_flush', exit.
+	 * Note that it is regardless value of synchornous_commit.
+	 */
+	if (IsSyncRepSkipped())
+		return;
+
+	/* Wait for replication on transaction commit, ForDataFlush is false */
+	SyncRepWait(XactCommitLSN, false, true);
+}
+
+/*
+ * Wait for synchronous standby on data page flush, if requested by user.
+ *
+ * Wait - if FALSE, we don't actually wait, but tell the caller whether or not
+ * the standby has already made progressed upto the given XactCommitLSN.
+ *
+ * Return True if either the sycnhronous standby/failback safe standby is not
+ * configured/turned off OR the standby has made enough progress.
+ */
+bool
+SyncRepTransferWaitForLSN(XLogRecPtr XactCommitLSN, bool Wait)
+{
+	bool ret;
+
+	/*
+	 * Fast exit if there are no sync replication standby names defined,
+	 * or sync transfer is not requested. Note that those standby's don't
+	 * need to be connected.
+	 */
+	if (!SyncStandbysDefined() || !SyncTransRequested())
+		return true;
+
+	/* System still in recovery, exit */
+	if (RecoveryInProgress())
+		return true;
+
+	/* Wait for replication on data pafe flush, ForDataFlush is true */
+	ret = SyncRepWait(XactCommitLSN, true, Wait);
+
+	return ret;
 }
 
 /*
@@ -710,3 +781,18 @@ assign_synchronous_commit(int newval, void *extra)
 			break;
 	}
 }
+
+void
+assign_synchronous_transfer(int newval, void *extra)
+{
+	switch (newval)
+	{
+		case SYNCHRONOUS_TRANSFER_ALL:
+		case SYNCHRONOUS_TRANSFER_DATA_FLUSH:
+			SyncTransferMode = SYNC_REP_WAIT_FLUSH;
+			break;
+		default:
+			SyncTransferMode = SYNC_REP_NO_WAIT;
+			break;
+	}
+}
diff --git a/src/backend/storage/buffer/bufmgr.c b/src/backend/storage/buffer/bufmgr.c
index f848391..262509b 100644
--- a/src/backend/storage/buffer/bufmgr.c
+++ b/src/backend/storage/buffer/bufmgr.c
@@ -41,6 +41,8 @@
 #include "pg_trace.h"
 #include "pgstat.h"
 #include "postmaster/bgwriter.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/buf_internals.h"
 #include "storage/bufmgr.h"
 #include "storage/ipc.h"
@@ -1975,8 +1977,14 @@ FlushBuffer(volatile BufferDesc *buf, SMgrRelation reln)
 	 * skip the flush if the buffer isn't permanent.
 	 */
 	if (buf->flags & BM_PERMANENT)
+	{
 		XLogFlush(recptr);
-
+		/* If synchronous transfer is requested, wait for failback safe standby
+		 * to receive WAL up to recptr.
+		 */
+		if (SyncTransRequested())
+			SyncRepTransferWaitForLSN(recptr, true);
+	}
 	/*
 	 * Now it's safe to write buffer to disk. Note that no one else should
 	 * have been able to write it while we were busy with log flushing because
diff --git a/src/backend/utils/cache/relmapper.c b/src/backend/utils/cache/relmapper.c
index 18f0342..9e81edb 100644
--- a/src/backend/utils/cache/relmapper.c
+++ b/src/backend/utils/cache/relmapper.c
@@ -48,6 +48,8 @@
 #include "catalog/pg_tablespace.h"
 #include "catalog/storage.h"
 #include "miscadmin.h"
+#include "replication/syncrep.h"
+#include "replication/walsender.h"
 #include "storage/fd.h"
 #include "storage/lwlock.h"
 #include "utils/inval.h"
@@ -711,6 +713,7 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	int			fd;
 	RelMapFile *realmap;
 	char		mapfilename[MAXPGPATH];
+	XLogRecPtr	lsn=InvalidXLogRecPtr;
 
 	/*
 	 * Fill in the overhead fields and update CRC.
@@ -753,7 +756,6 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	{
 		xl_relmap_update xlrec;
 		XLogRecData rdata[2];
-		XLogRecPtr	lsn;
 
 		/* now errors are fatal ... */
 		START_CRIT_SECTION();
@@ -849,6 +851,13 @@ write_relmap_file(bool shared, RelMapFile *newmap,
 	/* Critical section done */
 	if (write_wal)
 		END_CRIT_SECTION();
+
+	/*
+	 * If synchronous transfer is requested, wait for failback safe
+	 * standby to receive WAL up to recptr.
+	 */
+	if (SyncTransRequested() && write_wal)
+		SyncRepTransferWaitForLSN(lsn, true);
 }
 
 /*
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 3107f9c..a92dba4 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -381,6 +381,16 @@ static const struct config_enum_entry synchronous_commit_options[] = {
 };
 
 /*
+ * Although only "all", "data_flush", and "commit" are documented
+ */
+static const struct config_enum_entry synchronous_transfer_options[] = {
+	{"all", SYNCHRONOUS_TRANSFER_ALL, false},
+	{"data_flush", SYNCHRONOUS_TRANSFER_DATA_FLUSH, false},
+	{"commit", SYNCHRONOUS_TRANSFER_COMMIT, false},
+	{NULL, 0, false}
+};
+
+/*
  * Options for enum values stored in other modules
  */
 extern const struct config_enum_entry wal_level_options[];
@@ -3300,6 +3310,16 @@ static struct config_enum ConfigureNamesEnum[] =
 	},
 
 	{
+		{"synchronous_transfer", PGC_SIGHUP, WAL_SETTINGS,
+			gettext_noop("Sets the data flush synchronization level"),
+			NULL
+		},
+		&synchronous_transfer,
+		SYNCHRONOUS_TRANSFER_COMMIT, synchronous_transfer_options,
+		NULL, assign_synchronous_transfer, NULL
+	},
+
+	{
 		{"trace_recovery_messages", PGC_SIGHUP, DEVELOPER_OPTIONS,
 			gettext_noop("Enables logging of recovery-related debugging information."),
 			gettext_noop("Each level includes all the levels that follow it. The later"
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample
index d69a02b..ababb81 100644
--- a/src/backend/utils/misc/postgresql.conf.sample
+++ b/src/backend/utils/misc/postgresql.conf.sample
@@ -220,6 +220,8 @@
 #synchronous_standby_names = ''	# standby servers that provide sync rep
 				# comma-separated list of application_name
 				# from standby(s); '*' = all
+#synchronous_transfer = commit	# specifies when to wait for replication
+				# commit, data_flush or all
 #vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
 
 # - Standby Servers -
diff --git a/src/backend/utils/time/tqual.c b/src/backend/utils/time/tqual.c
index ed66c49..050b6c9 100644
--- a/src/backend/utils/time/tqual.c
+++ b/src/backend/utils/time/tqual.c
@@ -60,6 +60,8 @@
 #include "access/subtrans.h"
 #include "access/transam.h"
 #include "access/xact.h"
+#include "replication/walsender.h"
+#include "replication/syncrep.h"
 #include "storage/bufmgr.h"
 #include "storage/procarray.h"
 #include "utils/tqual.h"
@@ -115,6 +117,18 @@ SetHintBits(HeapTupleHeader tuple, Buffer buffer,
 
 		if (XLogNeedsFlush(commitLSN) && BufferIsPermanent(buffer))
 			return;				/* not flushed yet, so don't set hint */
+
+		/*
+		 * If synchronous transfer is requested, we check if the commit WAL record
+		 * has made to the standby before allowing hint bit updates. We should not
+		 * wait for the standby to receive the WAL since its OK to delay hint bit
+		 * updates.
+		 */
+		if (SyncTransRequested())
+		{
+			if(!SyncRepTransferWaitForLSN(commitLSN, false))
+				return;
+		}
 	}
 
 	tuple->t_infomask |= infomask;
diff --git a/src/include/replication/syncrep.h b/src/include/replication/syncrep.h
index ac23ea6..b7b9e6d 100644
--- a/src/include/replication/syncrep.h
+++ b/src/include/replication/syncrep.h
@@ -19,6 +19,12 @@
 #define SyncRepRequested() \
 	(max_wal_senders > 0 && synchronous_commit > SYNCHRONOUS_COMMIT_LOCAL_FLUSH)
 
+#define SyncTransRequested() \
+	(max_wal_senders > 0 && synchronous_transfer > SYNCHRONOUS_TRANSFER_COMMIT)
+
+#define IsSyncRepSkipped() \
+	(max_wal_senders > 0 && synchronous_transfer ==  SYNCHRONOUS_TRANSFER_DATA_FLUSH)
+
 /* SyncRepWaitMode */
 #define SYNC_REP_NO_WAIT		-1
 #define SYNC_REP_WAIT_WRITE		0
@@ -31,11 +37,23 @@
 #define SYNC_REP_WAITING			1
 #define SYNC_REP_WAIT_COMPLETE		2
 
+typedef enum
+{
+	SYNCHRONOUS_TRANSFER_COMMIT,		/* Wait for replication on transaciton commit */
+	SYNCHRONOUS_TRANSFER_DATA_FLUSH,	/* Wait for replication on data page flush */
+	SYNCHRONOUS_TRANSFER_ALL	        /* Wait for replication on transaction commit  and
+										 * data page flush*/
+}	SynchronousTransferLevel;
+
 /* user-settable parameters for synchronous replication */
 extern char *SyncRepStandbyNames;
 
+/* user-settable parameters for failback safe replication */
+extern int	synchronous_transfer;
+
 /* called by user backend */
 extern void SyncRepWaitForLSN(XLogRecPtr XactCommitLSN);
+extern bool SyncTransWaitForLSN(XLogRecPtr XactCommitLSN, bool Wait);
 
 /* called at backend exit */
 extern void SyncRepCleanupAtProcExit(void);
@@ -52,5 +70,6 @@ extern int	SyncRepWakeQueue(bool all, int mode);
 
 extern bool check_synchronous_standby_names(char **newval, void **extra, GucSource source);
 extern void assign_synchronous_commit(int newval, void *extra);
+extern void assign_synchronous_transfer(int newval, void *extra);
 
 #endif   /* _SYNCREP_H */