252 files changed, 6676 insertions, 9929 deletions

diff --git a/fs/9p/Kconfig b/fs/9p/Kconfig
index 6489e1fc1afd..11045d8e356a 100644
--- a/fs/9p/Kconfig
+++ b/fs/9p/Kconfig
@@ -25,9 +25,6 @@ config 9P_FS_POSIX_ACL
           POSIX Access Control Lists (ACLs) support permissions for users and
           groups beyond the owner/group/world scheme.
 
-          To learn more about Access Control Lists, visit the POSIX ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
           If you don't know what Access Control Lists are, say N
 
 endif
diff --git a/fs/Kconfig b/fs/Kconfig
index 7aee6d699fd6..9774588da60e 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -167,17 +167,13 @@ config TMPFS_POSIX_ACL
           files for sound to work properly.  In short, if you're not sure,
           say Y.
 
-          To learn more about Access Control Lists, visit the POSIX ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
 config TMPFS_XATTR
         bool "Tmpfs extended attributes"
         depends on TMPFS
         default n
         help
           Extended attributes are name:value pairs associated with inodes by
-          the kernel or by users (see the attr(5) manual page, or visit
-          <http://acl.bestbits.at/> for details).
+          the kernel or by users (see the attr(5) manual page for details).
 
           Currently this enables support for the trusted.* and
           security.* namespaces.
@@ -298,7 +294,6 @@ config NFS_COMMON
 source "net/sunrpc/Kconfig"
 source "fs/ceph/Kconfig"
 source "fs/cifs/Kconfig"
-source "fs/ncpfs/Kconfig"
 source "fs/coda/Kconfig"
 source "fs/afs/Kconfig"
 source "fs/9p/Kconfig"
diff --git a/fs/Makefile b/fs/Makefile
index ef772f1eaff8..add789ea270a 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -92,7 +92,6 @@ obj-$(CONFIG_LOCKD)		+= lockd/
 obj-$(CONFIG_NLS)               += nls/
 obj-$(CONFIG_SYSV_FS)           += sysv/
 obj-$(CONFIG_CIFS)              += cifs/
-obj-$(CONFIG_NCP_FS)            += ncpfs/
 obj-$(CONFIG_HPFS_FS)           += hpfs/
 obj-$(CONFIG_NTFS_FS)           += ntfs/
 obj-$(CONFIG_UFS_FS)            += ufs/
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index ee236231cafa..af2832aaeec5 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -444,11 +444,15 @@ unacquire_none:
 static int __init
 befs_init_inodecache(void)
 {
-        befs_inode_cachep = kmem_cache_create("befs_inode_cache",
-                                              sizeof (struct befs_inode_info),
-                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
-                                              init_once);
+        befs_inode_cachep = kmem_cache_create_usercopy("befs_inode_cache",
+                                sizeof(struct befs_inode_info), 0,
+                                (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
+                                        SLAB_ACCOUNT),
+                                offsetof(struct befs_inode_info,
+                                        i_data.symlink),
+                                sizeof_field(struct befs_inode_info,
+                                        i_data.symlink),
+                                init_once);
         if (befs_inode_cachep == NULL)
                 return -ENOMEM;
 
diff --git a/fs/btrfs/Kconfig b/fs/btrfs/Kconfig
index 2e558227931a..273351ee4c46 100644
--- a/fs/btrfs/Kconfig
+++ b/fs/btrfs/Kconfig
@@ -38,9 +38,6 @@ config BTRFS_FS_POSIX_ACL
           POSIX Access Control Lists (ACLs) support permissions for users and
           groups beyond the owner/group/world scheme.
 
-          To learn more about Access Control Lists, visit the POSIX ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
           If you don't know what Access Control Lists are, say N
 
 config BTRFS_FS_CHECK_INTEGRITY
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index ed095202942f..21f34ad0d411 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -30,6 +30,7 @@
 #include <linux/ratelimit.h>
 #include <linux/uuid.h>
 #include <linux/semaphore.h>
+#include <linux/error-injection.h>
 #include <asm/unaligned.h>
 #include "ctree.h"
 #include "disk-io.h"
@@ -3115,6 +3116,7 @@ recovery_tree_root:
                 goto fail_block_groups;
         goto retry_root_backup;
 }
+ALLOW_ERROR_INJECTION(open_ctree, ERRNO);
 
 static void btrfs_end_buffer_write_sync(struct buffer_head *bh, int uptodate)
 {
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 014f3c090231..a9f22ac50d6a 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -22,6 +22,7 @@
 #include <linux/slab.h>
 #include <linux/math64.h>
 #include <linux/ratelimit.h>
+#include <linux/error-injection.h>
 #include "ctree.h"
 #include "free-space-cache.h"
 #include "transaction.h"
@@ -332,6 +333,7 @@ static int io_ctl_init(struct btrfs_io_ctl *io_ctl, struct inode *inode,
 
         return 0;
 }
+ALLOW_ERROR_INJECTION(io_ctl_init, ERRNO);
 
 static void io_ctl_free(struct btrfs_io_ctl *io_ctl)
 {
diff --git a/fs/buffer.c b/fs/buffer.c
index 8b26295a56fe..9a73924db22f 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -53,13 +53,6 @@ static int submit_bh_wbc(int op, int op_flags, struct buffer_head *bh,
 
 #define BH_ENTRY(list) list_entry((list), struct buffer_head, b_assoc_buffers)
 
-void init_buffer(struct buffer_head *bh, bh_end_io_t *handler, void *private)
-{
-        bh->b_end_io = handler;
-        bh->b_private = private;
-}
-EXPORT_SYMBOL(init_buffer);
-
 inline void touch_buffer(struct buffer_head *bh)
 {
         trace_block_touch_buffer(bh);
@@ -922,7 +915,8 @@ init_page_buffers(struct page *page, struct block_device *bdev,
 
         do {
                 if (!buffer_mapped(bh)) {
-                        init_buffer(bh, NULL, NULL);
+                        bh->b_end_io = NULL;
+                        bh->b_private = NULL;
                         bh->b_bdev = bdev;
                         bh->b_blocknr = block;
                         if (uptodate)
diff --git a/fs/ceph/Kconfig b/fs/ceph/Kconfig
index 264e9bf83ff3..52095f473464 100644
--- a/fs/ceph/Kconfig
+++ b/fs/ceph/Kconfig
@@ -34,7 +34,4 @@ config CEPH_FS_POSIX_ACL
           POSIX Access Control Lists (ACLs) support permissions for users and
           groups beyond the owner/group/world scheme.
 
-          To learn more about Access Control Lists, visit the POSIX ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
           If you don't know what Access Control Lists are, say N
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index c71971c01c63..687da62daf4e 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -108,14 +108,13 @@ config CIFS_XATTR
         depends on CIFS
         help
           Extended attributes are name:value pairs associated with inodes by
-          the kernel or by users (see the attr(5) manual page, or visit
-          <http://acl.bestbits.at/> for details).  CIFS maps the name of
-          extended attributes beginning with the user namespace prefix
-          to SMB/CIFS EAs. EAs are stored on Windows servers without the
-          user namespace prefix, but their names are seen by Linux cifs clients
-          prefaced by the user namespace prefix. The system namespace
-          (used by some filesystems to store ACLs) is not supported at
-          this time.
+          the kernel or by users (see the attr(5) manual page for details).
+          CIFS maps the name of extended attributes beginning with the user
+          namespace prefix to SMB/CIFS EAs.  EAs are stored on Windows
+          servers without the user namespace prefix, but their names are
+          seen by Linux cifs clients prefaced by the user namespace prefix.
+          The system namespace (used by some filesystems to store ACLs) is
+          not supported at this time.
 
           If unsure, say Y.
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index a7be591d8e18..32cdea67bbfd 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1239,9 +1239,11 @@ cifs_init_request_bufs(void)
         cifs_dbg(VFS, "CIFSMaxBufSize %d 0x%x\n",
                  CIFSMaxBufSize, CIFSMaxBufSize);
 */
-        cifs_req_cachep = kmem_cache_create("cifs_request",
+        cifs_req_cachep = kmem_cache_create_usercopy("cifs_request",
                                             CIFSMaxBufSize + max_hdr_size, 0,
-                                            SLAB_HWCACHE_ALIGN, NULL);
+                                            SLAB_HWCACHE_ALIGN, 0,
+                                            CIFSMaxBufSize + max_hdr_size,
+                                            NULL);
         if (cifs_req_cachep == NULL)
                 return -ENOMEM;
 
@@ -1267,9 +1269,9 @@ cifs_init_request_bufs(void)
         more SMBs to use small buffer alloc and is still much more
         efficient to alloc 1 per page off the slab compared to 17K (5page)
         alloc of large cifs buffers even when page debugging is on */
-        cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
+        cifs_sm_req_cachep = kmem_cache_create_usercopy("cifs_small_rq",
                         MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
-                        NULL);
+                        0, MAX_CIFS_SMALL_BUFFER_SIZE, NULL);
         if (cifs_sm_req_cachep == NULL) {
                 mempool_destroy(cifs_req_poolp);
                 kmem_cache_destroy(cifs_req_cachep);
diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
index 732a786cce9d..ce654526c0fb 100644
--- a/fs/crypto/crypto.c
+++ b/fs/crypto/crypto.c
@@ -27,6 +27,7 @@
 #include <linux/dcache.h>
 #include <linux/namei.h>
 #include <crypto/aes.h>
+#include <crypto/skcipher.h>
 #include "fscrypt_private.h"
 
 static unsigned int num_prealloc_crypto_pages = 32;
diff --git a/fs/crypto/fname.c b/fs/crypto/fname.c
index 305541bcd108..e33f3d3c5ade 100644
--- a/fs/crypto/fname.c
+++ b/fs/crypto/fname.c
@@ -13,42 +13,46 @@
 
 #include <linux/scatterlist.h>
 #include <linux/ratelimit.h>
+#include <crypto/skcipher.h>
 #include "fscrypt_private.h"
 
+static inline bool fscrypt_is_dot_dotdot(const struct qstr *str)
+{
+        if (str->len == 1 && str->name[0] == '.')
+                return true;
+
+        if (str->len == 2 && str->name[0] == '.' && str->name[1] == '.')
+                return true;
+
+        return false;
+}
+
 /**
  * fname_encrypt() - encrypt a filename
  *
- * The caller must have allocated sufficient memory for the @oname string.
+ * The output buffer must be at least as large as the input buffer.
+ * Any extra space is filled with NUL padding before encryption.
  *
  * Return: 0 on success, -errno on failure
  */
-static int fname_encrypt(struct inode *inode,
-                        const struct qstr *iname, struct fscrypt_str *oname)
+int fname_encrypt(struct inode *inode, const struct qstr *iname,
+                  u8 *out, unsigned int olen)
 {
         struct skcipher_request *req = NULL;
         DECLARE_CRYPTO_WAIT(wait);
-        struct fscrypt_info *ci = inode->i_crypt_info;
-        struct crypto_skcipher *tfm = ci->ci_ctfm;
+        struct crypto_skcipher *tfm = inode->i_crypt_info->ci_ctfm;
         int res = 0;
         char iv[FS_CRYPTO_BLOCK_SIZE];
         struct scatterlist sg;
-        int padding = 4 << (ci->ci_flags & FS_POLICY_FLAGS_PAD_MASK);
-        unsigned int lim;
-        unsigned int cryptlen;
-
-        lim = inode->i_sb->s_cop->max_namelen(inode);
-        if (iname->len <= 0 || iname->len > lim)
-                return -EIO;
 
         /*
          * Copy the filename to the output buffer for encrypting in-place and
          * pad it with the needed number of NUL bytes.
          */
-        cryptlen = max_t(unsigned int, iname->len, FS_CRYPTO_BLOCK_SIZE);
-        cryptlen = round_up(cryptlen, padding);
-        cryptlen = min(cryptlen, lim);
-        memcpy(oname->name, iname->name, iname->len);
-        memset(oname->name + iname->len, 0, cryptlen - iname->len);
+        if (WARN_ON(olen < iname->len))
+                return -ENOBUFS;
+        memcpy(out, iname->name, iname->len);
+        memset(out + iname->len, 0, olen - iname->len);
 
         /* Initialize the IV */
         memset(iv, 0, FS_CRYPTO_BLOCK_SIZE);
@@ -63,8 +67,8 @@ static int fname_encrypt(struct inode *inode,
         skcipher_request_set_callback(req,
                         CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
                         crypto_req_done, &wait);
-        sg_init_one(&sg, oname->name, cryptlen);
-        skcipher_request_set_crypt(req, &sg, &sg, cryptlen, iv);
+        sg_init_one(&sg, out, olen);
+        skcipher_request_set_crypt(req, &sg, &sg, olen, iv);
 
         /* Do the encryption */
         res = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);
@@ -75,7 +79,6 @@ static int fname_encrypt(struct inode *inode,
                 return res;
         }
 
-        oname->len = cryptlen;
         return 0;
 }
 
@@ -188,50 +191,52 @@ static int digest_decode(const char *src, int len, char *dst)
         return cp - dst;
 }
 
-u32 fscrypt_fname_encrypted_size(const struct inode *inode, u32 ilen)
+bool fscrypt_fname_encrypted_size(const struct inode *inode, u32 orig_len,
+                                  u32 max_len, u32 *encrypted_len_ret)
 {
-        int padding = 32;
-        struct fscrypt_info *ci = inode->i_crypt_info;
-
-        if (ci)
-                padding = 4 << (ci->ci_flags & FS_POLICY_FLAGS_PAD_MASK);
-        ilen = max(ilen, (u32)FS_CRYPTO_BLOCK_SIZE);
-        return round_up(ilen, padding);
+        int padding = 4 << (inode->i_crypt_info->ci_flags &
+                            FS_POLICY_FLAGS_PAD_MASK);
+        u32 encrypted_len;
+
+        if (orig_len > max_len)
+                return false;
+        encrypted_len = max(orig_len, (u32)FS_CRYPTO_BLOCK_SIZE);
+        encrypted_len = round_up(encrypted_len, padding);
+        *encrypted_len_ret = min(encrypted_len, max_len);
+        return true;
 }
-EXPORT_SYMBOL(fscrypt_fname_encrypted_size);
 
 /**
- * fscrypt_fname_crypto_alloc_obuff() -
+ * fscrypt_fname_alloc_buffer - allocate a buffer for presented filenames
+ *
+ * Allocate a buffer that is large enough to hold any decrypted or encoded
+ * filename (null-terminated), for the given maximum encrypted filename length.
  *
- * Allocates an output buffer that is sufficient for the crypto operation
- * specified by the context and the direction.
+ * Return: 0 on success, -errno on failure
  */
 int fscrypt_fname_alloc_buffer(const struct inode *inode,
-                                u32 ilen, struct fscrypt_str *crypto_str)
+                               u32 max_encrypted_len,
+                               struct fscrypt_str *crypto_str)
 {
-        u32 olen = fscrypt_fname_encrypted_size(inode, ilen);
         const u32 max_encoded_len =
                 max_t(u32, BASE64_CHARS(FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE),
                       1 + BASE64_CHARS(sizeof(struct fscrypt_digested_name)));
+        u32 max_presented_len;
 
-        crypto_str->len = olen;
-        olen = max(olen, max_encoded_len);
+        max_presented_len = max(max_encoded_len, max_encrypted_len);
 
-        /*
-         * Allocated buffer can hold one more character to null-terminate the
-         * string
-         */
-        crypto_str->name = kmalloc(olen + 1, GFP_NOFS);
-        if (!(crypto_str->name))
+        crypto_str->name = kmalloc(max_presented_len + 1, GFP_NOFS);
+        if (!crypto_str->name)
                 return -ENOMEM;
+        crypto_str->len = max_presented_len;
         return 0;
 }
 EXPORT_SYMBOL(fscrypt_fname_alloc_buffer);
 
 /**
- * fscrypt_fname_crypto_free_buffer() -
+ * fscrypt_fname_free_buffer - free the buffer for presented filenames
  *
- * Frees the buffer allocated for crypto operation.
+ * Free the buffer allocated by fscrypt_fname_alloc_buffer().
  */
 void fscrypt_fname_free_buffer(struct fscrypt_str *crypto_str)
 {
@@ -298,35 +303,6 @@ int fscrypt_fname_disk_to_usr(struct inode *inode,
 EXPORT_SYMBOL(fscrypt_fname_disk_to_usr);
 
 /**
- * fscrypt_fname_usr_to_disk() - converts a filename from user space to disk
- * space
- *
- * The caller must have allocated sufficient memory for the @oname string.
- *
- * Return: 0 on success, -errno on failure
- */
-int fscrypt_fname_usr_to_disk(struct inode *inode,
-                        const struct qstr *iname,
-                        struct fscrypt_str *oname)
-{
-        if (fscrypt_is_dot_dotdot(iname)) {
-                oname->name[0] = '.';
-                oname->name[iname->len - 1] = '.';
-                oname->len = iname->len;
-                return 0;
-        }
-        if (inode->i_crypt_info)
-                return fname_encrypt(inode, iname, oname);
-        /*
-         * Without a proper key, a user is not allowed to modify the filenames
-         * in a directory. Consequently, a user space name cannot be mapped to
-         * a disk-space name
-         */
-        return -ENOKEY;
-}
-EXPORT_SYMBOL(fscrypt_fname_usr_to_disk);
-
-/**
  * fscrypt_setup_filename() - prepare to search a possibly encrypted directory
  * @dir: the directory that will be searched
  * @iname: the user-provided filename being searched for
@@ -369,11 +345,17 @@ int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname,
                 return ret;
 
         if (dir->i_crypt_info) {
-                ret = fscrypt_fname_alloc_buffer(dir, iname->len,
-                                                        &fname->crypto_buf);
-                if (ret)
-                        return ret;
-                ret = fname_encrypt(dir, iname, &fname->crypto_buf);
+                if (!fscrypt_fname_encrypted_size(dir, iname->len,
+                                                  dir->i_sb->s_cop->max_namelen(dir),
+                                                  &fname->crypto_buf.len))
+                        return -ENAMETOOLONG;
+                fname->crypto_buf.name = kmalloc(fname->crypto_buf.len,
+                                                 GFP_NOFS);
+                if (!fname->crypto_buf.name)
+                        return -ENOMEM;
+
+                ret = fname_encrypt(dir, iname, fname->crypto_buf.name,
+                                    fname->crypto_buf.len);
                 if (ret)
                         goto errout;
                 fname->disk_name.name = fname->crypto_buf.name;
@@ -425,7 +407,7 @@ int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname,
         return 0;
 
 errout:
-        fscrypt_fname_free_buffer(&fname->crypto_buf);
+        kfree(fname->crypto_buf.name);
         return ret;
 }
 EXPORT_SYMBOL(fscrypt_setup_filename);
diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h
index c0b4f5597e1a..ad6722bae8b7 100644
--- a/fs/crypto/fscrypt_private.h
+++ b/fs/crypto/fscrypt_private.h
@@ -50,6 +50,15 @@ struct fscrypt_context {
 
 #define FS_ENCRYPTION_CONTEXT_FORMAT_V1         1
 
+/**
+ * For encrypted symlinks, the ciphertext length is stored at the beginning
+ * of the string in little-endian format.
+ */
+struct fscrypt_symlink_data {
+        __le16 len;
+        char encrypted_path[1];
+} __packed;
+
 /*
  * A pointer to this structure is stored in the file system's in-core
  * representation of an inode.
@@ -71,7 +80,22 @@ typedef enum {
 #define FS_CTX_REQUIRES_FREE_ENCRYPT_FL         0x00000001
 #define FS_CTX_HAS_BOUNCE_BUFFER_FL             0x00000002
 
+static inline bool fscrypt_valid_enc_modes(u32 contents_mode,
+                                           u32 filenames_mode)
+{
+        if (contents_mode == FS_ENCRYPTION_MODE_AES_128_CBC &&
+            filenames_mode == FS_ENCRYPTION_MODE_AES_128_CTS)
+                return true;
+
+        if (contents_mode == FS_ENCRYPTION_MODE_AES_256_XTS &&
+            filenames_mode == FS_ENCRYPTION_MODE_AES_256_CTS)
+                return true;
+
+        return false;
+}
+
 /* crypto.c */
+extern struct kmem_cache *fscrypt_info_cachep;
 extern int fscrypt_initialize(unsigned int cop_flags);
 extern struct workqueue_struct *fscrypt_read_workqueue;
 extern int fscrypt_do_page_crypto(const struct inode *inode,
@@ -83,6 +107,13 @@ extern int fscrypt_do_page_crypto(const struct inode *inode,
 extern struct page *fscrypt_alloc_bounce_page(struct fscrypt_ctx *ctx,
                                               gfp_t gfp_flags);
 
+/* fname.c */
+extern int fname_encrypt(struct inode *inode, const struct qstr *iname,
+                         u8 *out, unsigned int olen);
+extern bool fscrypt_fname_encrypted_size(const struct inode *inode,
+                                         u32 orig_len, u32 max_len,
+                                         u32 *encrypted_len_ret);
+
 /* keyinfo.c */
 extern void __exit fscrypt_essiv_cleanup(void);
 
diff --git a/fs/crypto/hooks.c b/fs/crypto/hooks.c
index 9f5fb2eb9cf7..bec06490fb13 100644
--- a/fs/crypto/hooks.c
+++ b/fs/crypto/hooks.c
@@ -110,3 +110,161 @@ int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry)
         return 0;
 }
 EXPORT_SYMBOL_GPL(__fscrypt_prepare_lookup);
+
+int __fscrypt_prepare_symlink(struct inode *dir, unsigned int len,
+                              unsigned int max_len,
+                              struct fscrypt_str *disk_link)
+{
+        int err;
+
+        /*
+         * To calculate the size of the encrypted symlink target we need to know
+         * the amount of NUL padding, which is determined by the flags set in
+         * the encryption policy which will be inherited from the directory.
+         * The easiest way to get access to this is to just load the directory's
+         * fscrypt_info, since we'll need it to create the dir_entry anyway.
+         *
+         * Note: in test_dummy_encryption mode, @dir may be unencrypted.
+         */
+        err = fscrypt_get_encryption_info(dir);
+        if (err)
+                return err;
+        if (!fscrypt_has_encryption_key(dir))
+                return -ENOKEY;
+
+        /*
+         * Calculate the size of the encrypted symlink and verify it won't
+         * exceed max_len.  Note that for historical reasons, encrypted symlink
+         * targets are prefixed with the ciphertext length, despite this
+         * actually being redundant with i_size.  This decreases by 2 bytes the
+         * longest symlink target we can accept.
+         *
+         * We could recover 1 byte by not counting a null terminator, but
+         * counting it (even though it is meaningless for ciphertext) is simpler
+         * for now since filesystems will assume it is there and subtract it.
+         */
+        if (!fscrypt_fname_encrypted_size(dir, len,
+                                          max_len - sizeof(struct fscrypt_symlink_data),
+                                          &disk_link->len))
+                return -ENAMETOOLONG;
+        disk_link->len += sizeof(struct fscrypt_symlink_data);
+
+        disk_link->name = NULL;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(__fscrypt_prepare_symlink);
+
+int __fscrypt_encrypt_symlink(struct inode *inode, const char *target,
+                              unsigned int len, struct fscrypt_str *disk_link)
+{
+        int err;
+        struct qstr iname = QSTR_INIT(target, len);
+        struct fscrypt_symlink_data *sd;
+        unsigned int ciphertext_len;
+
+        err = fscrypt_require_key(inode);
+        if (err)
+                return err;
+
+        if (disk_link->name) {
+                /* filesystem-provided buffer */
+                sd = (struct fscrypt_symlink_data *)disk_link->name;
+        } else {
+                sd = kmalloc(disk_link->len, GFP_NOFS);
+                if (!sd)
+                        return -ENOMEM;
+        }
+        ciphertext_len = disk_link->len - sizeof(*sd);
+        sd->len = cpu_to_le16(ciphertext_len);
+
+        err = fname_encrypt(inode, &iname, sd->encrypted_path, ciphertext_len);
+        if (err) {
+                if (!disk_link->name)
+                        kfree(sd);
+                return err;
+        }
+        /*
+         * Null-terminating the ciphertext doesn't make sense, but we still
+         * count the null terminator in the length, so we might as well
+         * initialize it just in case the filesystem writes it out.
+         */
+        sd->encrypted_path[ciphertext_len] = '\0';
+
+        if (!disk_link->name)
+                disk_link->name = (unsigned char *)sd;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(__fscrypt_encrypt_symlink);
+
+/**
+ * fscrypt_get_symlink - get the target of an encrypted symlink
+ * @inode: the symlink inode
+ * @caddr: the on-disk contents of the symlink
+ * @max_size: size of @caddr buffer
+ * @done: if successful, will be set up to free the returned target
+ *
+ * If the symlink's encryption key is available, we decrypt its target.
+ * Otherwise, we encode its target for presentation.
+ *
+ * This may sleep, so the filesystem must have dropped out of RCU mode already.
+ *
+ * Return: the presentable symlink target or an ERR_PTR()
+ */
+const char *fscrypt_get_symlink(struct inode *inode, const void *caddr,
+                                unsigned int max_size,
+                                struct delayed_call *done)
+{
+        const struct fscrypt_symlink_data *sd;
+        struct fscrypt_str cstr, pstr;
+        int err;
+
+        /* This is for encrypted symlinks only */
+        if (WARN_ON(!IS_ENCRYPTED(inode)))
+                return ERR_PTR(-EINVAL);
+
+        /*
+         * Try to set up the symlink's encryption key, but we can continue
+         * regardless of whether the key is available or not.
+         */
+        err = fscrypt_get_encryption_info(inode);
+        if (err)
+                return ERR_PTR(err);
+
+        /*
+         * For historical reasons, encrypted symlink targets are prefixed with
+         * the ciphertext length, even though this is redundant with i_size.
+         */
+
+        if (max_size < sizeof(*sd))
+                return ERR_PTR(-EUCLEAN);
+        sd = caddr;
+        cstr.name = (unsigned char *)sd->encrypted_path;
+        cstr.len = le16_to_cpu(sd->len);
+
+        if (cstr.len == 0)
+                return ERR_PTR(-EUCLEAN);
+
+        if (cstr.len + sizeof(*sd) - 1 > max_size)
+                return ERR_PTR(-EUCLEAN);
+
+        err = fscrypt_fname_alloc_buffer(inode, cstr.len, &pstr);
+        if (err)
+                return ERR_PTR(err);
+
+        err = fscrypt_fname_disk_to_usr(inode, 0, 0, &cstr, &pstr);
+        if (err)
+                goto err_kfree;
+
+        err = -EUCLEAN;
+        if (pstr.name[0] == '\0')
+                goto err_kfree;
+
+        pstr.name[pstr.len] = '\0';
+        set_delayed_call(done, kfree_link, pstr.name);
+        return pstr.name;
+
+err_kfree:
+        kfree(pstr.name);
+        return ERR_PTR(err);
+}
+EXPORT_SYMBOL_GPL(fscrypt_get_symlink);
diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
index 5e6e846f5a24..05f5ee1f0705 100644
--- a/fs/crypto/keyinfo.c
+++ b/fs/crypto/keyinfo.c
@@ -14,6 +14,7 @@
 #include <linux/ratelimit.h>
 #include <crypto/aes.h>
 #include <crypto/sha.h>
+#include <crypto/skcipher.h>
 #include "fscrypt_private.h"
 
 static struct crypto_shash *essiv_hash_tfm;
@@ -354,19 +355,9 @@ out:
 }
 EXPORT_SYMBOL(fscrypt_get_encryption_info);
 
-void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci)
+void fscrypt_put_encryption_info(struct inode *inode)
 {
-        struct fscrypt_info *prev;
-
-        if (ci == NULL)
-                ci = READ_ONCE(inode->i_crypt_info);
-        if (ci == NULL)
-                return;
-
-        prev = cmpxchg(&inode->i_crypt_info, ci, NULL);
-        if (prev != ci)
-                return;
-
-        put_crypt_info(ci);
+        put_crypt_info(inode->i_crypt_info);
+        inode->i_crypt_info = NULL;
 }
 EXPORT_SYMBOL(fscrypt_put_encryption_info);
diff --git a/fs/dax.c b/fs/dax.c
index 95981591977a..0276df90e86c 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -44,6 +44,7 @@
 
 /* The 'colour' (ie low bits) within a PMD of a page offset.  */
 #define PG_PMD_COLOUR   ((PMD_SIZE >> PAGE_SHIFT) - 1)
+#define PG_PMD_NR       (PMD_SIZE >> PAGE_SHIFT)
 
 static wait_queue_head_t wait_table[DAX_WAIT_TABLE_ENTRIES];
 
@@ -375,8 +376,8 @@ restart:
                  * unmapped.
                  */
                 if (pmd_downgrade && dax_is_zero_entry(entry))
-                        unmap_mapping_range(mapping,
-                                (index << PAGE_SHIFT) & PMD_MASK, PMD_SIZE, 0);
+                        unmap_mapping_pages(mapping, index & ~PG_PMD_COLOUR,
+                                                        PG_PMD_NR, false);
 
                 err = radix_tree_preload(
                                 mapping_gfp_mask(mapping) & ~__GFP_HIGHMEM);
@@ -538,12 +539,10 @@ static void *dax_insert_mapping_entry(struct address_space *mapping,
         if (dax_is_zero_entry(entry) && !(flags & RADIX_DAX_ZERO_PAGE)) {
                 /* we are replacing a zero page with block mapping */
                 if (dax_is_pmd_entry(entry))
-                        unmap_mapping_range(mapping,
-                                        (vmf->pgoff << PAGE_SHIFT) & PMD_MASK,
-                                        PMD_SIZE, 0);
+                        unmap_mapping_pages(mapping, index & ~PG_PMD_COLOUR,
+                                                        PG_PMD_NR, false);
                 else /* pte entry */
-                        unmap_mapping_range(mapping, vmf->pgoff << PAGE_SHIFT,
-                                        PAGE_SIZE, 0);
+                        unmap_mapping_pages(mapping, vmf->pgoff, 1, false);
         }
 
         spin_lock_irq(&mapping->tree_lock);
@@ -636,8 +635,8 @@ static void dax_mapping_entry_mkclean(struct address_space *mapping,
                         pmd = pmd_mkclean(pmd);
                         set_pmd_at(vma->vm_mm, address, pmdp, pmd);
 unlock_pmd:
-                        spin_unlock(ptl);
 #endif
+                        spin_unlock(ptl);
                 } else {
                         if (pfn != pte_pfn(*ptep))
                                 goto unlock_pte;
@@ -1096,7 +1095,7 @@ static bool dax_fault_is_synchronous(unsigned long flags,
 }
 
 static int dax_iomap_pte_fault(struct vm_fault *vmf, pfn_t *pfnp,
-                               const struct iomap_ops *ops)
+                               int *iomap_errp, const struct iomap_ops *ops)
 {
         struct vm_area_struct *vma = vmf->vma;
         struct address_space *mapping = vma->vm_file->f_mapping;
@@ -1149,6 +1148,8 @@ static int dax_iomap_pte_fault(struct vm_fault *vmf, pfn_t *pfnp,
          * that we never have to deal with more than a single extent here.
          */
         error = ops->iomap_begin(inode, pos, PAGE_SIZE, flags, &iomap);
+        if (iomap_errp)
+                *iomap_errp = error;
         if (error) {
                 vmf_ret = dax_fault_return(error);
                 goto unlock_entry;
@@ -1269,12 +1270,6 @@ static int dax_iomap_pte_fault(struct vm_fault *vmf, pfn_t *pfnp,
 }
 
 #ifdef CONFIG_FS_DAX_PMD
-/*
- * The 'colour' (ie low bits) within a PMD of a page offset.  This comes up
- * more often than one might expect in the below functions.
- */
-#define PG_PMD_COLOUR   ((PMD_SIZE >> PAGE_SHIFT) - 1)
-
 static int dax_pmd_load_hole(struct vm_fault *vmf, struct iomap *iomap,
                 void *entry)
 {
@@ -1488,6 +1483,7 @@ static int dax_iomap_pmd_fault(struct vm_fault *vmf, pfn_t *pfnp,
  * @vmf: The description of the fault
  * @pe_size: Size of the page to fault in
  * @pfnp: PFN to insert for synchronous faults if fsync is required
+ * @iomap_errp: Storage for detailed error code in case of error
  * @ops: Iomap ops passed from the file system
  *
  * When a page fault occurs, filesystems may call this helper in
@@ -1496,11 +1492,11 @@ static int dax_iomap_pmd_fault(struct vm_fault *vmf, pfn_t *pfnp,
  * successfully.
  */
 int dax_iomap_fault(struct vm_fault *vmf, enum page_entry_size pe_size,
-                    pfn_t *pfnp, const struct iomap_ops *ops)
+                    pfn_t *pfnp, int *iomap_errp, const struct iomap_ops *ops)
 {
         switch (pe_size) {
         case PE_SIZE_PTE:
-                return dax_iomap_pte_fault(vmf, pfnp, ops);
+                return dax_iomap_pte_fault(vmf, pfnp, iomap_errp, ops);
         case PE_SIZE_PMD:
                 return dax_iomap_pmd_fault(vmf, pfnp, ops);
         default:
diff --git a/fs/dcache.c b/fs/dcache.c
index 379dce86f001..cca2b377ff0a 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -32,14 +32,11 @@
 #include <linux/swap.h>
 #include <linux/bootmem.h>
 #include <linux/fs_struct.h>
-#include <linux/hardirq.h>
 #include <linux/bit_spinlock.h>
 #include <linux/rculist_bl.h>
 #include <linux/prefetch.h>
 #include <linux/ratelimit.h>
 #include <linux/list_lru.h>
-#include <linux/kasan.h>
-
 #include "internal.h"
 #include "mount.h"
 
@@ -49,8 +46,8 @@
  *   - i_dentry, d_u.d_alias, d_inode of aliases
  * dcache_hash_bucket lock protects:
  *   - the dcache hash table
- * s_anon bl list spinlock protects:
- *   - the s_anon list (see __d_drop)
+ * s_roots bl list spinlock protects:
+ *   - the s_roots list (see __d_drop)
  * dentry->d_sb->s_dentry_lru_lock protects:
  *   - the dcache lru lists and counters
  * d_lock protects:
@@ -68,7 +65,7 @@
  *   dentry->d_lock
  *     dentry->d_sb->s_dentry_lru_lock
  *     dcache_hash_bucket lock
- *     s_anon lock
+ *     s_roots lock
  *
  * If there is an ancestor relationship:
  * dentry->d_parent->...->d_parent->d_lock
@@ -104,14 +101,13 @@ EXPORT_SYMBOL(slash_name);
  * information, yet avoid using a prime hash-size or similar.
  */
 
-static unsigned int d_hash_mask __read_mostly;
 static unsigned int d_hash_shift __read_mostly;
 
 static struct hlist_bl_head *dentry_hashtable __read_mostly;
 
 static inline struct hlist_bl_head *d_hash(unsigned int hash)
 {
-        return dentry_hashtable + (hash >> (32 - d_hash_shift));
+        return dentry_hashtable + (hash >> d_hash_shift);
 }
 
 #define IN_LOOKUP_SHIFT 10
@@ -195,7 +191,7 @@ static inline int dentry_string_cmp(const unsigned char *cs, const unsigned char
         unsigned long a,b,mask;
 
         for (;;) {
-                a = *(unsigned long *)cs;
+                a = read_word_at_a_time(cs);
                 b = load_unaligned_zeropad(ct);
                 if (tcount < sizeof(unsigned long))
                         break;
@@ -468,30 +464,37 @@ static void dentry_lru_add(struct dentry *dentry)
  * d_drop() is used mainly for stuff that wants to invalidate a dentry for some
  * reason (NFS timeouts or autofs deletes).
  *
- * __d_drop requires dentry->d_lock.
+ * __d_drop requires dentry->d_lock
+ * ___d_drop doesn't mark dentry as "unhashed"
+ *   (dentry->d_hash.pprev will be LIST_POISON2, not NULL).
  */
-void __d_drop(struct dentry *dentry)
+static void ___d_drop(struct dentry *dentry)
 {
         if (!d_unhashed(dentry)) {
                 struct hlist_bl_head *b;
                 /*
                  * Hashed dentries are normally on the dentry hashtable,
                  * with the exception of those newly allocated by
-                 * d_obtain_alias, which are always IS_ROOT:
+                 * d_obtain_root, which are always IS_ROOT:
                  */
                 if (unlikely(IS_ROOT(dentry)))
-                        b = &dentry->d_sb->s_anon;
+                        b = &dentry->d_sb->s_roots;
                 else
                         b = d_hash(dentry->d_name.hash);
 
                 hlist_bl_lock(b);
                 __hlist_bl_del(&dentry->d_hash);
-                dentry->d_hash.pprev = NULL;
                 hlist_bl_unlock(b);
                 /* After this call, in-progress rcu-walk path lookup will fail. */
                 write_seqcount_invalidate(&dentry->d_seq);
         }
 }
+
+void __d_drop(struct dentry *dentry)
+{
+        ___d_drop(dentry);
+        dentry->d_hash.pprev = NULL;
+}
 EXPORT_SYMBOL(__d_drop);
 
 void d_drop(struct dentry *dentry)
@@ -1500,8 +1503,8 @@ void shrink_dcache_for_umount(struct super_block *sb)
         sb->s_root = NULL;
         do_one_tree(dentry);
 
-        while (!hlist_bl_empty(&sb->s_anon)) {
-                dentry = dget(hlist_bl_entry(hlist_bl_first(&sb->s_anon), struct dentry, d_hash));
+        while (!hlist_bl_empty(&sb->s_roots)) {
+                dentry = dget(hlist_bl_entry(hlist_bl_first(&sb->s_roots), struct dentry, d_hash));
                 do_one_tree(dentry);
         }
 }
@@ -1623,9 +1626,6 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
                 }
                 atomic_set(&p->u.count, 1);
                 dname = p->name;
-                if (IS_ENABLED(CONFIG_DCACHE_WORD_ACCESS))
-                        kasan_unpoison_shadow(dname,
-                                round_up(name->len + 1, sizeof(unsigned long)));
         } else  {
                 dname = dentry->d_iname;
         }       
@@ -1964,9 +1964,11 @@ static struct dentry *__d_obtain_alias(struct inode *inode, int disconnected)
         spin_lock(&tmp->d_lock);
         __d_set_inode_and_type(tmp, inode, add_flags);
         hlist_add_head(&tmp->d_u.d_alias, &inode->i_dentry);
-        hlist_bl_lock(&tmp->d_sb->s_anon);
-        hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_anon);
-        hlist_bl_unlock(&tmp->d_sb->s_anon);
+        if (!disconnected) {
+                hlist_bl_lock(&tmp->d_sb->s_roots);
+                hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_roots);
+                hlist_bl_unlock(&tmp->d_sb->s_roots);
+        }
         spin_unlock(&tmp->d_lock);
         spin_unlock(&inode->i_lock);
 
@@ -2380,7 +2382,7 @@ EXPORT_SYMBOL(d_delete);
 static void __d_rehash(struct dentry *entry)
 {
         struct hlist_bl_head *b = d_hash(entry->d_name.hash);
-        BUG_ON(!d_unhashed(entry));
+
         hlist_bl_lock(b);
         hlist_bl_add_head_rcu(&entry->d_hash, b);
         hlist_bl_unlock(b);
@@ -2815,9 +2817,9 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
         write_seqcount_begin_nested(&target->d_seq, DENTRY_D_LOCK_NESTED);
 
         /* unhash both */
-        /* __d_drop does write_seqcount_barrier, but they're OK to nest. */
-        __d_drop(dentry);
-        __d_drop(target);
+        /* ___d_drop does write_seqcount_barrier, but they're OK to nest. */
+        ___d_drop(dentry);
+        ___d_drop(target);
 
         /* Switch the names.. */
         if (exchange)
@@ -2829,6 +2831,8 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
         __d_rehash(dentry);
         if (exchange)
                 __d_rehash(target);
+        else
+                target->d_hash.pprev = NULL;
 
         /* ... and switch them in the tree */
         if (IS_ROOT(dentry)) {
@@ -3585,9 +3589,10 @@ static void __init dcache_init_early(void)
                                         13,
                                         HASH_EARLY | HASH_ZERO,
                                         &d_hash_shift,
-                                        &d_hash_mask,
+                                        NULL,
                                         0,
                                         0);
+        d_hash_shift = 32 - d_hash_shift;
 }
 
 static void __init dcache_init(void)
@@ -3597,8 +3602,9 @@ static void __init dcache_init(void)
          * but it is probably not worth it because of the cache nature
          * of the dcache.
          */
-        dentry_cache = KMEM_CACHE(dentry,
-                SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|SLAB_MEM_SPREAD|SLAB_ACCOUNT);
+        dentry_cache = KMEM_CACHE_USERCOPY(dentry,
+                SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|SLAB_MEM_SPREAD|SLAB_ACCOUNT,
+                d_iname);
 
         /* Hash may have been set up in dcache_init_early */
         if (!hashdist)
@@ -3611,9 +3617,10 @@ static void __init dcache_init(void)
                                         13,
                                         HASH_ZERO,
                                         &d_hash_shift,
-                                        &d_hash_mask,
+                                        NULL,
                                         0,
                                         0);
+        d_hash_shift = 32 - d_hash_shift;
 }
 
 /* SLAB cache for __getname() consumers */
@@ -3635,8 +3642,8 @@ void __init vfs_caches_init_early(void)
 
 void __init vfs_caches_init(void)
 {
-        names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
-                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+        names_cachep = kmem_cache_create_usercopy("names_cache", PATH_MAX, 0,
+                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, 0, PATH_MAX, NULL);
 
         dcache_init();
         inode_init();
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 7eae33ffa3fc..e31d6ed3ec32 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -168,11 +168,11 @@ struct vfsmount *devpts_mntget(struct file *filp, struct pts_fs_info *fsi)
         dput(path.dentry);
         if (err) {
                 mntput(path.mnt);
-                path.mnt = ERR_PTR(err);
+                return ERR_PTR(err);
         }
         if (DEVPTS_SB(path.mnt->mnt_sb) != fsi) {
                 mntput(path.mnt);
-                path.mnt = ERR_PTR(-ENODEV);
+                return ERR_PTR(-ENODEV);
         }
         return path.mnt;
 }
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 3aafb3343a65..a0ca9e48e993 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -219,6 +219,27 @@ static inline struct page *dio_get_page(struct dio *dio,
         return dio->pages[sdio->head];
 }
 
+/*
+ * Warn about a page cache invalidation failure during a direct io write.
+ */
+void dio_warn_stale_pagecache(struct file *filp)
+{
+        static DEFINE_RATELIMIT_STATE(_rs, 86400 * HZ, DEFAULT_RATELIMIT_BURST);
+        char pathname[128];
+        struct inode *inode = file_inode(filp);
+        char *path;
+
+        errseq_set(&inode->i_mapping->wb_err, -EIO);
+        if (__ratelimit(&_rs)) {
+                path = file_path(filp, pathname, sizeof(pathname));
+                if (IS_ERR(path))
+                        path = "(unknown)";
+                pr_crit("Page cache invalidation failure on direct I/O.  Possible data corruption due to collision with buffered I/O!\n");
+                pr_crit("File: %s PID: %d Comm: %.20s\n", path, current->pid,
+                        current->comm);
+        }
+}
+
 /**
  * dio_complete() - called when all DIO BIO I/O has been completed
  * @offset: the byte offset in the file of the completed operation
@@ -290,7 +311,8 @@ static ssize_t dio_complete(struct dio *dio, ssize_t ret, unsigned int flags)
                 err = invalidate_inode_pages2_range(dio->inode->i_mapping,
                                         offset >> PAGE_SHIFT,
                                         (offset + ret - 1) >> PAGE_SHIFT);
-                WARN_ON_ONCE(err);
+                if (err)
+                        dio_warn_stale_pagecache(dio->iocb->ki_filp);
         }
 
         if (!(dio->flags & DIO_SKIP_DIO_COUNT))
diff --git a/fs/eventfd.c b/fs/eventfd.c
index 6318a9b57e53..04fd824142a1 100644
--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -80,24 +80,11 @@ static void eventfd_free(struct kref *kref)
 }
 
 /**
- * eventfd_ctx_get - Acquires a reference to the internal eventfd context.
- * @ctx: [in] Pointer to the eventfd context.
- *
- * Returns: In case of success, returns a pointer to the eventfd context.
- */
-struct eventfd_ctx *eventfd_ctx_get(struct eventfd_ctx *ctx)
-{
-        kref_get(&ctx->kref);
-        return ctx;
-}
-EXPORT_SYMBOL_GPL(eventfd_ctx_get);
-
-/**
  * eventfd_ctx_put - Releases a reference to the internal eventfd context.
  * @ctx: [in] Pointer to eventfd context.
  *
  * The eventfd context reference must have been previously acquired either
- * with eventfd_ctx_get() or eventfd_ctx_fdget().
+ * with eventfd_ctx_fdget() or eventfd_ctx_fileget().
  */
 void eventfd_ctx_put(struct eventfd_ctx *ctx)
 {
@@ -207,36 +194,27 @@ int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_entry_t *w
 }
 EXPORT_SYMBOL_GPL(eventfd_ctx_remove_wait_queue);
 
-/**
- * eventfd_ctx_read - Reads the eventfd counter or wait if it is zero.
- * @ctx: [in] Pointer to eventfd context.
- * @no_wait: [in] Different from zero if the operation should not block.
- * @cnt: [out] Pointer to the 64-bit counter value.
- *
- * Returns %0 if successful, or the following error codes:
- *
- *  - -EAGAIN      : The operation would have blocked but @no_wait was non-zero.
- *  - -ERESTARTSYS : A signal interrupted the wait operation.
- *
- * If @no_wait is zero, the function might sleep until the eventfd internal
- * counter becomes greater than zero.
- */
-ssize_t eventfd_ctx_read(struct eventfd_ctx *ctx, int no_wait, __u64 *cnt)
+static ssize_t eventfd_read(struct file *file, char __user *buf, size_t count,
+                            loff_t *ppos)
 {
+        struct eventfd_ctx *ctx = file->private_data;
         ssize_t res;
+        __u64 ucnt = 0;
         DECLARE_WAITQUEUE(wait, current);
 
+        if (count < sizeof(ucnt))
+                return -EINVAL;
+
         spin_lock_irq(&ctx->wqh.lock);
-        *cnt = 0;
         res = -EAGAIN;
         if (ctx->count > 0)
-                res = 0;
-        else if (!no_wait) {
+                res = sizeof(ucnt);
+        else if (!(file->f_flags & O_NONBLOCK)) {
                 __add_wait_queue(&ctx->wqh, &wait);
                 for (;;) {
                         set_current_state(TASK_INTERRUPTIBLE);
                         if (ctx->count > 0) {
-                                res = 0;
+                                res = sizeof(ucnt);
                                 break;
                         }
                         if (signal_pending(current)) {
@@ -250,31 +228,17 @@ ssize_t eventfd_ctx_read(struct eventfd_ctx *ctx, int no_wait, __u64 *cnt)
                 __remove_wait_queue(&ctx->wqh, &wait);
                 __set_current_state(TASK_RUNNING);
         }
-        if (likely(res == 0)) {
-                eventfd_ctx_do_read(ctx, cnt);
+        if (likely(res > 0)) {
+                eventfd_ctx_do_read(ctx, &ucnt);
                 if (waitqueue_active(&ctx->wqh))
                         wake_up_locked_poll(&ctx->wqh, POLLOUT);
         }
         spin_unlock_irq(&ctx->wqh.lock);
 
-        return res;
-}
-EXPORT_SYMBOL_GPL(eventfd_ctx_read);
-
-static ssize_t eventfd_read(struct file *file, char __user *buf, size_t count,
-                            loff_t *ppos)
-{
-        struct eventfd_ctx *ctx = file->private_data;
-        ssize_t res;
-        __u64 cnt;
-
-        if (count < sizeof(cnt))
-                return -EINVAL;
-        res = eventfd_ctx_read(ctx, file->f_flags & O_NONBLOCK, &cnt);
-        if (res < 0)
-                return res;
+        if (res > 0 && put_user(ucnt, (__u64 __user *)buf))
+                return -EFAULT;
 
-        return put_user(cnt, (__u64 __user *) buf) ? -EFAULT : sizeof(cnt);
+        return res;
 }
 
 static ssize_t eventfd_write(struct file *file, const char __user *buf, size_t count,
@@ -405,79 +369,44 @@ EXPORT_SYMBOL_GPL(eventfd_ctx_fdget);
  */
 struct eventfd_ctx *eventfd_ctx_fileget(struct file *file)
 {
+        struct eventfd_ctx *ctx;
+
         if (file->f_op != &eventfd_fops)
                 return ERR_PTR(-EINVAL);
 
-        return eventfd_ctx_get(file->private_data);
+        ctx = file->private_data;
+        kref_get(&ctx->kref);
+        return ctx;
 }
 EXPORT_SYMBOL_GPL(eventfd_ctx_fileget);
 
-/**
- * eventfd_file_create - Creates an eventfd file pointer.
- * @count: Initial eventfd counter value.
- * @flags: Flags for the eventfd file.
- *
- * This function creates an eventfd file pointer, w/out installing it into
- * the fd table. This is useful when the eventfd file is used during the
- * initialization of data structures that require extra setup after the eventfd
- * creation. So the eventfd creation is split into the file pointer creation
- * phase, and the file descriptor installation phase.
- * In this way races with userspace closing the newly installed file descriptor
- * can be avoided.
- * Returns an eventfd file pointer, or a proper error pointer.
- */
-struct file *eventfd_file_create(unsigned int count, int flags)
+SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags)
 {
-        struct file *file;
         struct eventfd_ctx *ctx;
+        int fd;
 
         /* Check the EFD_* constants for consistency.  */
         BUILD_BUG_ON(EFD_CLOEXEC != O_CLOEXEC);
         BUILD_BUG_ON(EFD_NONBLOCK != O_NONBLOCK);
 
         if (flags & ~EFD_FLAGS_SET)
-                return ERR_PTR(-EINVAL);
+                return -EINVAL;
 
         ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
         if (!ctx)
-                return ERR_PTR(-ENOMEM);
+                return -ENOMEM;
 
         kref_init(&ctx->kref);
         init_waitqueue_head(&ctx->wqh);
         ctx->count = count;
         ctx->flags = flags;
 
-        file = anon_inode_getfile("[eventfd]", &eventfd_fops, ctx,
-                                  O_RDWR | (flags & EFD_SHARED_FCNTL_FLAGS));
-        if (IS_ERR(file))
+        fd = anon_inode_getfd("[eventfd]", &eventfd_fops, ctx,
+                              O_RDWR | (flags & EFD_SHARED_FCNTL_FLAGS));
+        if (fd < 0)
                 eventfd_free_ctx(ctx);
 
-        return file;
-}
-
-SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags)
-{
-        int fd, error;
-        struct file *file;
-
-        error = get_unused_fd_flags(flags & EFD_SHARED_FCNTL_FLAGS);
-        if (error < 0)
-                return error;
-        fd = error;
-
-        file = eventfd_file_create(count, flags);
-        if (IS_ERR(file)) {
-                error = PTR_ERR(file);
-                goto err_put_unused_fd;
-        }
-        fd_install(fd, file);
-
         return fd;
-
-err_put_unused_fd:
-        put_unused_fd(fd);
-
-        return error;
 }
 
 SYSCALL_DEFINE1(eventfd, unsigned int, count)
diff --git a/fs/exofs/super.c b/fs/exofs/super.c
index 7e244093c0e5..179cd5c2f52a 100644
--- a/fs/exofs/super.c
+++ b/fs/exofs/super.c
@@ -193,10 +193,13 @@ static void exofs_init_once(void *foo)
  */
 static int init_inodecache(void)
 {
-        exofs_inode_cachep = kmem_cache_create("exofs_inode_cache",
+        exofs_inode_cachep = kmem_cache_create_usercopy("exofs_inode_cache",
                                 sizeof(struct exofs_i_info), 0,
                                 SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD |
-                                SLAB_ACCOUNT, exofs_init_once);
+                                SLAB_ACCOUNT,
+                                offsetof(struct exofs_i_info, i_data),
+                                sizeof_field(struct exofs_i_info, i_data),
+                                exofs_init_once);
         if (exofs_inode_cachep == NULL)
                 return -ENOMEM;
         return 0;
diff --git a/fs/ext2/Kconfig b/fs/ext2/Kconfig
index c634874e12d9..894e4c53d1d2 100644
--- a/fs/ext2/Kconfig
+++ b/fs/ext2/Kconfig
@@ -13,8 +13,7 @@ config EXT2_FS_XATTR
         depends on EXT2_FS
         help
           Extended attributes are name:value pairs associated with inodes by
-          the kernel or by users (see the attr(5) manual page, or visit
-          <http://acl.bestbits.at/> for details).
+          the kernel or by users (see the attr(5) manual page for details).
 
           If unsure, say N.
 
@@ -26,9 +25,6 @@ config EXT2_FS_POSIX_ACL
           Posix Access Control Lists (ACLs) support permissions for users and
           groups beyond the owner/group/world scheme.
 
-          To learn more about Access Control Lists, visit the Posix ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
           If you don't know what Access Control Lists are, say N
 
 config EXT2_FS_SECURITY
diff --git a/fs/ext2/file.c b/fs/ext2/file.c
index 2da67699dc33..09640220fda8 100644
--- a/fs/ext2/file.c
+++ b/fs/ext2/file.c
@@ -100,7 +100,7 @@ static int ext2_dax_fault(struct vm_fault *vmf)
         }
         down_read(&ei->dax_sem);
 
-        ret = dax_iomap_fault(vmf, PE_SIZE_PTE, NULL, &ext2_iomap_ops);
+        ret = dax_iomap_fault(vmf, PE_SIZE_PTE, NULL, NULL, &ext2_iomap_ops);
 
         up_read(&ei->dax_sem);
         if (vmf->flags & FAULT_FLAG_WRITE)
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 554c98b8a93a..db5f9daa7780 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -221,11 +221,13 @@ static void init_once(void *foo)
 
 static int __init init_inodecache(void)
 {
-        ext2_inode_cachep = kmem_cache_create("ext2_inode_cache",
-                                             sizeof(struct ext2_inode_info),
-                                             0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
-                                             init_once);
+        ext2_inode_cachep = kmem_cache_create_usercopy("ext2_inode_cache",
+                                sizeof(struct ext2_inode_info), 0,
+                                (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
+                                        SLAB_ACCOUNT),
+                                offsetof(struct ext2_inode_info, i_data),
+                                sizeof_field(struct ext2_inode_info, i_data),
+                                init_once);
         if (ext2_inode_cachep == NULL)
                 return -ENOMEM;
         return 0;
diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig
index 73b850f5659c..a453cc87082b 100644
--- a/fs/ext4/Kconfig
+++ b/fs/ext4/Kconfig
@@ -82,9 +82,6 @@ config EXT4_FS_POSIX_ACL
           POSIX Access Control Lists (ACLs) support permissions for users and
           groups beyond the owner/group/world scheme.
 
-          To learn more about Access Control Lists, visit the POSIX ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
           If you don't know what Access Control Lists are, say N
 
 config EXT4_FS_SECURITY
diff --git a/fs/ext4/acl.h b/fs/ext4/acl.h
index a48fc5ae2701..9b63f5416a2f 100644
--- a/fs/ext4/acl.h
+++ b/fs/ext4/acl.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+// SPDX-License-Identifier: GPL-2.0
 /*
   File: fs/ext4/acl.h
 
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index a943e568292e..f9b3e0a83526 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -355,10 +355,10 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
         blk = ext4_inode_table(sb, desc);
         offset = blk - group_first_block;
         next_zero_bit = ext4_find_next_zero_bit(bh->b_data,
-                        EXT4_B2C(sbi, offset + EXT4_SB(sb)->s_itb_per_group),
+                        EXT4_B2C(sbi, offset + sbi->s_itb_per_group),
                         EXT4_B2C(sbi, offset));
         if (next_zero_bit <
-            EXT4_B2C(sbi, offset + EXT4_SB(sb)->s_itb_per_group))
+            EXT4_B2C(sbi, offset + sbi->s_itb_per_group))
                 /* bad bitmap for inode tables */
                 return blk;
         return 0;
diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
index bee888e0e2db..913061c0de1b 100644
--- a/fs/ext4/block_validity.c
+++ b/fs/ext4/block_validity.c
@@ -147,11 +147,11 @@ int ext4_setup_system_zone(struct super_block *sb)
         int ret;
 
         if (!test_opt(sb, BLOCK_VALIDITY)) {
-                if (EXT4_SB(sb)->system_blks.rb_node)
+                if (sbi->system_blks.rb_node)
                         ext4_release_system_zone(sb);
                 return 0;
         }
-        if (EXT4_SB(sb)->system_blks.rb_node)
+        if (sbi->system_blks.rb_node)
                 return 0;
 
         for (i=0; i < ngroups; i++) {
@@ -173,7 +173,7 @@ int ext4_setup_system_zone(struct super_block *sb)
         }
 
         if (test_opt(sb, DEBUG))
-                debug_print_tree(EXT4_SB(sb));
+                debug_print_tree(sbi);
         return 0;
 }
 
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 4e091eae38b1..3241475a1733 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+// SPDX-License-Identifier: GPL-2.0
 /*
  *  ext4.h
  *
@@ -611,10 +611,10 @@ enum {
 /*
  * Flags used by ext4_free_blocks
  */
-#define EXT4_FREE_BLOCKS_METADATA       0x0001
-#define EXT4_FREE_BLOCKS_FORGET         0x0002
-#define EXT4_FREE_BLOCKS_VALIDATED      0x0004
-#define EXT4_FREE_BLOCKS_NO_QUOT_UPDATE 0x0008
+#define EXT4_FREE_BLOCKS_METADATA               0x0001
+#define EXT4_FREE_BLOCKS_FORGET                 0x0002
+#define EXT4_FREE_BLOCKS_VALIDATED              0x0004
+#define EXT4_FREE_BLOCKS_NO_QUOT_UPDATE         0x0008
 #define EXT4_FREE_BLOCKS_NOFREE_FIRST_CLUSTER   0x0010
 #define EXT4_FREE_BLOCKS_NOFREE_LAST_CLUSTER    0x0020
 
@@ -1986,10 +1986,10 @@ static inline __le16 ext4_rec_len_to_disk(unsigned len, unsigned blocksize)
 
 /* Legal values for the dx_root hash_version field: */
 
-#define DX_HASH_LEGACY          0
-#define DX_HASH_HALF_MD4        1
-#define DX_HASH_TEA             2
-#define DX_HASH_LEGACY_UNSIGNED 3
+#define DX_HASH_LEGACY                  0
+#define DX_HASH_HALF_MD4                1
+#define DX_HASH_TEA                     2
+#define DX_HASH_LEGACY_UNSIGNED         3
 #define DX_HASH_HALF_MD4_UNSIGNED       4
 #define DX_HASH_TEA_UNSIGNED            5
 
@@ -2000,7 +2000,6 @@ static inline u32 ext4_chksum(struct ext4_sb_info *sbi, u32 crc,
                 struct shash_desc shash;
                 char ctx[4];
         } desc;
-        int err;
 
         BUG_ON(crypto_shash_descsize(sbi->s_chksum_driver)!=sizeof(desc.ctx));
 
@@ -2008,8 +2007,7 @@ static inline u32 ext4_chksum(struct ext4_sb_info *sbi, u32 crc,
         desc.shash.flags = 0;
         *(u32 *)desc.ctx = crc;
 
-        err = crypto_shash_update(&desc.shash, address, length);
-        BUG_ON(err);
+        BUG_ON(crypto_shash_update(&desc.shash, address, length));
 
         return *(u32 *)desc.ctx;
 }
diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
index 8ecf84b8f5a1..98fb0c119c68 100644
--- a/fs/ext4/ext4_extents.h
+++ b/fs/ext4/ext4_extents.h
@@ -1,19 +1,7 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2003-2006, Cluster File Systems, Inc, info@clusterfs.com
  * Written by Alex Tomas <alex@clusterfs.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-
  */
 
 #ifndef _EXT4_EXTENTS
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index 48143e32411c..15b6dd733780 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * ext4_jbd2.h
  *
@@ -5,10 +6,6 @@
  *
  * Copyright 1998--1999 Red Hat corp --- All Rights Reserved
  *
- * This file is part of the Linux kernel and is made available under
- * the terms of the GNU General Public License, version 2, or at your
- * option, any later version, incorporated herein by reference.
- *
  * Ext4-specific journaling extensions.
  */
 
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index c941251ac0c0..054416e9d827 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2003-2006, Cluster File Systems, Inc, info@clusterfs.com
  * Written by Alex Tomas <alex@clusterfs.com>
@@ -5,19 +6,6 @@
  * Architecture independence:
  *   Copyright (c) 2005, Bull S.A.
  *   Written by Pierre Peiffer <pierre.peiffer@bull.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-
  */
 
 /*
diff --git a/fs/ext4/extents_status.h b/fs/ext4/extents_status.h
index ca90fc96f47e..8efdeb903d6b 100644
--- a/fs/ext4/extents_status.h
+++ b/fs/ext4/extents_status.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+// SPDX-License-Identifier: GPL-2.0
 /*
  *  fs/ext4/extents_status.h
  *
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index a0ae27b1bc66..fb6f023622fe 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -280,7 +280,8 @@ out:
 static int ext4_dax_huge_fault(struct vm_fault *vmf,
                 enum page_entry_size pe_size)
 {
-        int result;
+        int result, error = 0;
+        int retries = 0;
         handle_t *handle = NULL;
         struct inode *inode = file_inode(vmf->vma->vm_file);
         struct super_block *sb = inode->i_sb;
@@ -304,6 +305,7 @@ static int ext4_dax_huge_fault(struct vm_fault *vmf,
                 sb_start_pagefault(sb);
                 file_update_time(vmf->vma->vm_file);
                 down_read(&EXT4_I(inode)->i_mmap_sem);
+retry:
                 handle = ext4_journal_start_sb(sb, EXT4_HT_WRITE_PAGE,
                                                EXT4_DATA_TRANS_BLOCKS(sb));
                 if (IS_ERR(handle)) {
@@ -314,9 +316,13 @@ static int ext4_dax_huge_fault(struct vm_fault *vmf,
         } else {
                 down_read(&EXT4_I(inode)->i_mmap_sem);
         }
-        result = dax_iomap_fault(vmf, pe_size, &pfn, &ext4_iomap_ops);
+        result = dax_iomap_fault(vmf, pe_size, &pfn, &error, &ext4_iomap_ops);
         if (write) {
                 ext4_journal_stop(handle);
+
+                if ((result & VM_FAULT_ERROR) && error == -ENOSPC &&
+                    ext4_should_retry_alloc(sb, &retries))
+                        goto retry;
                 /* Handling synchronous page fault? */
                 if (result & VM_FAULT_NEEDDSYNC)
                         result = dax_finish_sync_fault(vmf, pe_size, pfn);
diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c
index 7ec340898598..e871c4bf18e9 100644
--- a/fs/ext4/fsmap.c
+++ b/fs/ext4/fsmap.c
@@ -1,21 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * Copyright (C) 2017 Oracle.  All Rights Reserved.
  *
  * Author: Darrick J. Wong <darrick.wong@oracle.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it would be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write the Free Software Foundation,
- * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301, USA.
  */
 #include "ext4.h"
 #include <linux/fsmap.h>
diff --git a/fs/ext4/fsmap.h b/fs/ext4/fsmap.h
index 9a2cd367cc66..68c8001fee85 100644
--- a/fs/ext4/fsmap.h
+++ b/fs/ext4/fsmap.h
@@ -1,21 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * Copyright (C) 2017 Oracle.  All Rights Reserved.
  *
  * Author: Darrick J. Wong <darrick.wong@oracle.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it would be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write the Free Software Foundation,
- * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301, USA.
  */
 #ifndef __EXT4_FSMAP_H__
 #define __EXT4_FSMAP_H__
diff --git a/fs/ext4/hash.c b/fs/ext4/hash.c
index 00c6dd29e621..e22dcfab308b 100644
--- a/fs/ext4/hash.c
+++ b/fs/ext4/hash.c
@@ -1,12 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  *  linux/fs/ext4/hash.c
  *
  * Copyright (C) 2002 by Theodore Ts'o
- *
- * This file is released under the GPL v2.
- *
- * This file may be redistributed under the terms of the GNU Public
- * License.
  */
 
 #include <linux/fs.h>
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index b32cf263750d..7830d28df331 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -303,7 +303,7 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
         /* Do this BEFORE marking the inode not in use or returning an error */
         ext4_clear_inode(inode);
 
-        es = EXT4_SB(sb)->s_es;
+        es = sbi->s_es;
         if (ino < EXT4_FIRST_INO(sb) || ino > le32_to_cpu(es->s_inodes_count)) {
                 ext4_error(sb, "reserved or nonexistent inode %lu", ino);
                 goto error_return;
@@ -1157,7 +1157,7 @@ got:
         ext4_clear_state_flags(ei); /* Only relevant on 32-bit archs */
         ext4_set_inode_state(inode, EXT4_STATE_NEW);
 
-        ei->i_extra_isize = EXT4_SB(sb)->s_want_extra_isize;
+        ei->i_extra_isize = sbi->s_want_extra_isize;
         ei->i_inline_off = 0;
         if (ext4_has_feature_inline_data(sb))
                 ext4_set_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index a8b987b71173..7c4165b88505 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1,15 +1,7 @@
+// SPDX-License-Identifier: LGPL-2.1
 /*
  * Copyright (c) 2012 Taobao.
  * Written by Tao Ma <boyu.mt@taobao.com>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2.1 of the GNU Lesser General Public License
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <linux/iomap.h>
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 0eff5b761c6e..c94780075b04 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3768,10 +3768,18 @@ static ssize_t ext4_direct_IO_write(struct kiocb *iocb, struct iov_iter *iter)
                 /* Credits for sb + inode write */
                 handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
                 if (IS_ERR(handle)) {
-                        /* This is really bad luck. We've written the data
-                         * but cannot extend i_size. Bail out and pretend
-                         * the write failed... */
-                        ret = PTR_ERR(handle);
+                        /*
+                         * We wrote the data but cannot extend
+                         * i_size. Bail out. In async io case, we do
+                         * not return error here because we have
+                         * already submmitted the corresponding
+                         * bio. Returning error here makes the caller
+                         * think that this IO is done and failed
+                         * resulting in race with bio's completion
+                         * handler.
+                         */
+                        if (!ret)
+                                ret = PTR_ERR(handle);
                         if (inode->i_nlink)
                                 ext4_orphan_del(NULL, inode);
 
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index d9f8b90a93ed..769a62708b1c 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1,19 +1,7 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (c) 2003-2006, Cluster File Systems, Inc, info@clusterfs.com
  * Written by Alex Tomas <alex@clusterfs.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-
  */
 
 
@@ -769,10 +757,10 @@ void ext4_mb_generate_buddy(struct super_block *sb,
         clear_bit(EXT4_GROUP_INFO_NEED_INIT_BIT, &(grp->bb_state));
 
         period = get_cycles() - period;
-        spin_lock(&EXT4_SB(sb)->s_bal_lock);
-        EXT4_SB(sb)->s_mb_buddies_generated++;
-        EXT4_SB(sb)->s_mb_generation_time += period;
-        spin_unlock(&EXT4_SB(sb)->s_bal_lock);
+        spin_lock(&sbi->s_bal_lock);
+        sbi->s_mb_buddies_generated++;
+        sbi->s_mb_generation_time += period;
+        spin_unlock(&sbi->s_bal_lock);
 }
 
 static void mb_regenerate_buddy(struct ext4_buddy *e4b)
@@ -1459,7 +1447,7 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
                 ext4_fsblk_t blocknr;
 
                 blocknr = ext4_group_first_block_no(sb, e4b->bd_group);
-                blocknr += EXT4_C2B(EXT4_SB(sb), block);
+                blocknr += EXT4_C2B(sbi, block);
                 ext4_grp_locked_error(sb, e4b->bd_group,
                                       inode ? inode->i_ino : 0,
                                       blocknr,
@@ -4850,9 +4838,9 @@ do_more:
         if (in_range(ext4_block_bitmap(sb, gdp), block, count) ||
             in_range(ext4_inode_bitmap(sb, gdp), block, count) ||
             in_range(block, ext4_inode_table(sb, gdp),
-                     EXT4_SB(sb)->s_itb_per_group) ||
+                     sbi->s_itb_per_group) ||
             in_range(block + count - 1, ext4_inode_table(sb, gdp),
-                     EXT4_SB(sb)->s_itb_per_group)) {
+                     sbi->s_itb_per_group)) {
 
                 ext4_error(sb, "Freeing blocks in system zone - "
                            "Block = %llu, count = %lu", block, count);
diff --git a/fs/ext4/mballoc.h b/fs/ext4/mballoc.h
index dcf52540f379..88c98f17e3d9 100644
--- a/fs/ext4/mballoc.h
+++ b/fs/ext4/mballoc.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+// SPDX-License-Identifier: GPL-2.0
 /*
  *  fs/ext4/mballoc.h
  *
diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
index cf5181b62df1..61a9d1927817 100644
--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -1,15 +1,8 @@
+// SPDX-License-Identifier: LGPL-2.1
 /*
  * Copyright IBM Corporation, 2007
  * Author Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
  *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2.1 of the GNU Lesser General Public License
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it would be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
- *
  */
 
 #include <linux/slab.h>
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 9bb36909ec92..b96e4bd3b3ec 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -1,16 +1,8 @@
+// SPDX-License-Identifier: LGPL-2.1
 /*
  * Copyright (c) 2008,2009 NEC Software Tohoku, Ltd.
  * Written by Takashi Sato <t-sato@yk.jp.nec.com>
  *            Akira Fujita <a-fujita@rs.jp.nec.com>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2.1 of the GNU Lesser General Public License
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <linux/fs.h>
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 6660686e505a..b1f21e3a0763 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3057,39 +3057,19 @@ static int ext4_symlink(struct inode *dir,
         struct inode *inode;
         int err, len = strlen(symname);
         int credits;
-        bool encryption_required;
         struct fscrypt_str disk_link;
-        struct fscrypt_symlink_data *sd = NULL;
 
         if (unlikely(ext4_forced_shutdown(EXT4_SB(dir->i_sb))))
                 return -EIO;
 
-        disk_link.len = len + 1;
-        disk_link.name = (char *) symname;
-
-        encryption_required = (ext4_encrypted_inode(dir) ||
-                               DUMMY_ENCRYPTION_ENABLED(EXT4_SB(dir->i_sb)));
-        if (encryption_required) {
-                err = fscrypt_get_encryption_info(dir);
-                if (err)
-                        return err;
-                if (!fscrypt_has_encryption_key(dir))
-                        return -ENOKEY;
-                disk_link.len = (fscrypt_fname_encrypted_size(dir, len) +
-                                 sizeof(struct fscrypt_symlink_data));
-                sd = kzalloc(disk_link.len, GFP_KERNEL);
-                if (!sd)
-                        return -ENOMEM;
-        }
-
-        if (disk_link.len > dir->i_sb->s_blocksize) {
-                err = -ENAMETOOLONG;
-                goto err_free_sd;
-        }
+        err = fscrypt_prepare_symlink(dir, symname, len, dir->i_sb->s_blocksize,
+                                      &disk_link);
+        if (err)
+                return err;
 
         err = dquot_initialize(dir);
         if (err)
-                goto err_free_sd;
+                return err;
 
         if ((disk_link.len > EXT4_N_BLOCKS * 4)) {
                 /*
@@ -3118,27 +3098,18 @@ static int ext4_symlink(struct inode *dir,
         if (IS_ERR(inode)) {
                 if (handle)
                         ext4_journal_stop(handle);
-                err = PTR_ERR(inode);
-                goto err_free_sd;
+                return PTR_ERR(inode);
         }
 
-        if (encryption_required) {
-                struct qstr istr;
-                struct fscrypt_str ostr =
-                        FSTR_INIT(sd->encrypted_path, disk_link.len);
-
-                istr.name = (const unsigned char *) symname;
-                istr.len = len;
-                err = fscrypt_fname_usr_to_disk(inode, &istr, &ostr);
+        if (IS_ENCRYPTED(inode)) {
+                err = fscrypt_encrypt_symlink(inode, symname, len, &disk_link);
                 if (err)
                         goto err_drop_inode;
-                sd->len = cpu_to_le16(ostr.len);
-                disk_link.name = (char *) sd;
                 inode->i_op = &ext4_encrypted_symlink_inode_operations;
         }
 
         if ((disk_link.len > EXT4_N_BLOCKS * 4)) {
-                if (!encryption_required)
+                if (!IS_ENCRYPTED(inode))
                         inode->i_op = &ext4_symlink_inode_operations;
                 inode_nohighmem(inode);
                 ext4_set_aops(inode);
@@ -3180,7 +3151,7 @@ static int ext4_symlink(struct inode *dir,
         } else {
                 /* clear the extent format for fast symlink */
                 ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
-                if (!encryption_required) {
+                if (!IS_ENCRYPTED(inode)) {
                         inode->i_op = &ext4_fast_symlink_inode_operations;
                         inode->i_link = (char *)&EXT4_I(inode)->i_data;
                 }
@@ -3195,16 +3166,17 @@ static int ext4_symlink(struct inode *dir,
 
         if (handle)
                 ext4_journal_stop(handle);
-        kfree(sd);
-        return err;
+        goto out_free_encrypted_link;
+
 err_drop_inode:
         if (handle)
                 ext4_journal_stop(handle);
         clear_nlink(inode);
         unlock_new_inode(inode);
         iput(inode);
-err_free_sd:
-        kfree(sd);
+out_free_encrypted_link:
+        if (disk_link.name != (unsigned char *)symname)
+                kfree(disk_link.name);
         return err;
 }
 
@@ -3222,9 +3194,9 @@ static int ext4_link(struct dentry *old_dentry,
         if (err)
                 return err;
 
-       if ((ext4_test_inode_flag(dir, EXT4_INODE_PROJINHERIT)) &&
-           (!projid_eq(EXT4_I(dir)->i_projid,
-                       EXT4_I(old_dentry->d_inode)->i_projid)))
+        if ((ext4_test_inode_flag(dir, EXT4_INODE_PROJINHERIT)) &&
+            (!projid_eq(EXT4_I(dir)->i_projid,
+                        EXT4_I(old_dentry->d_inode)->i_projid)))
                 return -EXDEV;
 
         err = dquot_initialize(dir);
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 50443bda8e98..b6bec270a8e4 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1477,7 +1477,7 @@ static int ext4_flex_group_add(struct super_block *sb,
                 goto exit_journal;
 
         group = flex_gd->groups[0].group;
-        BUG_ON(group != EXT4_SB(sb)->s_groups_count);
+        BUG_ON(group != sbi->s_groups_count);
         err = ext4_add_new_descs(handle, sb, group,
                                 resize_inode, flex_gd->count);
         if (err)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 5de959fb0244..421222ec3509 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  *  linux/fs/ext4/super.c
  *
@@ -743,6 +744,7 @@ __acquires(bitlock)
         }
 
         ext4_unlock_group(sb, grp);
+        ext4_commit_super(sb, 1);
         ext4_handle_error(sb);
         /*
          * We only get here in the ERRORS_RO case; relocking the group
@@ -871,7 +873,6 @@ static void ext4_put_super(struct super_block *sb)
         ext4_unregister_li_request(sb);
         ext4_quota_off_umount(sb);
 
-        flush_workqueue(sbi->rsv_conversion_wq);
         destroy_workqueue(sbi->rsv_conversion_wq);
 
         if (sbi->s_journal) {
@@ -1037,11 +1038,13 @@ static void init_once(void *foo)
 
 static int __init init_inodecache(void)
 {
-        ext4_inode_cachep = kmem_cache_create("ext4_inode_cache",
-                                             sizeof(struct ext4_inode_info),
-                                             0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
-                                             init_once);
+        ext4_inode_cachep = kmem_cache_create_usercopy("ext4_inode_cache",
+                                sizeof(struct ext4_inode_info), 0,
+                                (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
+                                        SLAB_ACCOUNT),
+                                offsetof(struct ext4_inode_info, i_data),
+                                sizeof_field(struct ext4_inode_info, i_data),
+                                init_once);
         if (ext4_inode_cachep == NULL)
                 return -ENOMEM;
         return 0;
@@ -1070,9 +1073,7 @@ void ext4_clear_inode(struct inode *inode)
                 jbd2_free_inode(EXT4_I(inode)->jinode);
                 EXT4_I(inode)->jinode = NULL;
         }
-#ifdef CONFIG_EXT4_FS_ENCRYPTION
-        fscrypt_put_encryption_info(inode, NULL);
-#endif
+        fscrypt_put_encryption_info(inode);
 }
 
 static struct inode *ext4_nfs_get_inode(struct super_block *sb,
@@ -2677,7 +2678,7 @@ static ext4_fsblk_t descriptor_loc(struct super_block *sb,
          * compensate.
          */
         if (sb->s_blocksize == 1024 && nr == 0 &&
-            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block) == 0)
+            le32_to_cpu(sbi->s_es->s_first_data_block) == 0)
                 has_super++;
 
         return (has_super + ext4_group_first_block_no(sb, bg));
@@ -3122,7 +3123,7 @@ int ext4_register_li_request(struct super_block *sb,
 {
         struct ext4_sb_info *sbi = EXT4_SB(sb);
         struct ext4_li_request *elr = NULL;
-        ext4_group_t ngroups = EXT4_SB(sb)->s_groups_count;
+        ext4_group_t ngroups = sbi->s_groups_count;
         int ret = 0;
 
         mutex_lock(&ext4_li_mtx);
@@ -4837,7 +4838,7 @@ static int ext4_sync_fs(struct super_block *sb, int wait)
         bool needs_barrier = false;
         struct ext4_sb_info *sbi = EXT4_SB(sb);
 
-        if (unlikely(ext4_forced_shutdown(EXT4_SB(sb))))
+        if (unlikely(ext4_forced_shutdown(sbi)))
                 return 0;
 
         trace_ext4_sync_fs(sb, wait);
diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c
index a2006c9af1d9..dd05af983092 100644
--- a/fs/ext4/symlink.c
+++ b/fs/ext4/symlink.c
@@ -28,59 +28,28 @@ static const char *ext4_encrypted_get_link(struct dentry *dentry,
                                            struct delayed_call *done)
 {
         struct page *cpage = NULL;
-        char *caddr, *paddr = NULL;
-        struct fscrypt_str cstr, pstr;
-        struct fscrypt_symlink_data *sd;
-        int res;
-        u32 max_size = inode->i_sb->s_blocksize;
+        const void *caddr;
+        unsigned int max_size;
+        const char *paddr;
 
         if (!dentry)
                 return ERR_PTR(-ECHILD);
 
-        res = fscrypt_get_encryption_info(inode);
-        if (res)
-                return ERR_PTR(res);
-
         if (ext4_inode_is_fast_symlink(inode)) {
-                caddr = (char *) EXT4_I(inode)->i_data;
+                caddr = EXT4_I(inode)->i_data;
                 max_size = sizeof(EXT4_I(inode)->i_data);
         } else {
                 cpage = read_mapping_page(inode->i_mapping, 0, NULL);
                 if (IS_ERR(cpage))
                         return ERR_CAST(cpage);
                 caddr = page_address(cpage);
+                max_size = inode->i_sb->s_blocksize;
         }
 
-        /* Symlink is encrypted */
-        sd = (struct fscrypt_symlink_data *)caddr;
-        cstr.name = sd->encrypted_path;
-        cstr.len  = le16_to_cpu(sd->len);
-        if ((cstr.len + sizeof(struct fscrypt_symlink_data) - 1) > max_size) {
-                /* Symlink data on the disk is corrupted */
-                res = -EFSCORRUPTED;
-                goto errout;
-        }
-
-        res = fscrypt_fname_alloc_buffer(inode, cstr.len, &pstr);
-        if (res)
-                goto errout;
-        paddr = pstr.name;
-
-        res = fscrypt_fname_disk_to_usr(inode, 0, 0, &cstr, &pstr);
-        if (res)
-                goto errout;
-
-        /* Null-terminate the name */
-        paddr[pstr.len] = '\0';
+        paddr = fscrypt_get_symlink(inode, caddr, max_size, done);
         if (cpage)
                 put_page(cpage);
-        set_delayed_call(done, kfree_link, paddr);
         return paddr;
-errout:
-        if (cpage)
-                put_page(cpage);
-        kfree(paddr);
-        return ERR_PTR(res);
 }
 
 const struct inode_operations ext4_encrypted_symlink_inode_operations = {
diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c
index e21afd52e7d7..1205261f130c 100644
--- a/fs/ext4/sysfs.c
+++ b/fs/ext4/sysfs.c
@@ -11,6 +11,7 @@
 #include <linux/time.h>
 #include <linux/fs.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include <linux/proc_fs.h>
 
 #include "ext4.h"
@@ -329,6 +330,13 @@ static void ext4_sb_release(struct kobject *kobj)
         complete(&sbi->s_kobj_unregister);
 }
 
+static void ext4_kset_release(struct kobject *kobj)
+{
+        struct kset *kset = container_of(kobj, struct kset, kobj);
+
+        kfree(kset);
+}
+
 static const struct sysfs_ops ext4_attr_ops = {
         .show   = ext4_attr_show,
         .store  = ext4_attr_store,
@@ -342,20 +350,18 @@ static struct kobj_type ext4_sb_ktype = {
 
 static struct kobj_type ext4_ktype = {
         .sysfs_ops      = &ext4_attr_ops,
+        .release        = ext4_kset_release,
 };
 
-static struct kset ext4_kset = {
-        .kobj   = {.ktype = &ext4_ktype},
-};
+static struct kset *ext4_kset;
 
 static struct kobj_type ext4_feat_ktype = {
         .default_attrs  = ext4_feat_attrs,
         .sysfs_ops      = &ext4_attr_ops,
+        .release        = (void (*)(struct kobject *))kfree,
 };
 
-static struct kobject ext4_feat = {
-        .kset   = &ext4_kset,
-};
+static struct kobject *ext4_feat;
 
 #define PROC_FILE_SHOW_DEFN(name) \
 static int name##_open(struct inode *inode, struct file *file) \
@@ -392,12 +398,15 @@ int ext4_register_sysfs(struct super_block *sb)
         const struct ext4_proc_files *p;
         int err;
 
-        sbi->s_kobj.kset = &ext4_kset;
+        sbi->s_kobj.kset = ext4_kset;
         init_completion(&sbi->s_kobj_unregister);
         err = kobject_init_and_add(&sbi->s_kobj, &ext4_sb_ktype, NULL,
                                    "%s", sb->s_id);
-        if (err)
+        if (err) {
+                kobject_put(&sbi->s_kobj);
+                wait_for_completion(&sbi->s_kobj_unregister);
                 return err;
+        }
 
         if (ext4_proc_root)
                 sbi->s_proc = proc_mkdir(sb->s_id, ext4_proc_root);
@@ -427,25 +436,45 @@ int __init ext4_init_sysfs(void)
 {
         int ret;
 
-        kobject_set_name(&ext4_kset.kobj, "ext4");
-        ext4_kset.kobj.parent = fs_kobj;
-        ret = kset_register(&ext4_kset);
+        ext4_kset = kzalloc(sizeof(*ext4_kset), GFP_KERNEL);
+        if (!ext4_kset)
+                return -ENOMEM;
+
+        kobject_set_name(&ext4_kset->kobj, "ext4");
+        ext4_kset->kobj.parent = fs_kobj;
+        ext4_kset->kobj.ktype = &ext4_ktype;
+        ret = kset_register(ext4_kset);
         if (ret)
-                return ret;
+                goto kset_err;
+
+        ext4_feat = kzalloc(sizeof(*ext4_feat), GFP_KERNEL);
+        if (!ext4_feat) {
+                ret = -ENOMEM;
+                goto kset_err;
+        }
 
-        ret = kobject_init_and_add(&ext4_feat, &ext4_feat_ktype,
+        ext4_feat->kset = ext4_kset;
+        ret = kobject_init_and_add(ext4_feat, &ext4_feat_ktype,
                                    NULL, "features");
         if (ret)
-                kset_unregister(&ext4_kset);
-        else
-                ext4_proc_root = proc_mkdir(proc_dirname, NULL);
+                goto feat_err;
+
+        ext4_proc_root = proc_mkdir(proc_dirname, NULL);
+        return ret;
+
+feat_err:
+        kobject_put(ext4_feat);
+kset_err:
+        kset_unregister(ext4_kset);
+        ext4_kset = NULL;
         return ret;
 }
 
 void ext4_exit_sysfs(void)
 {
-        kobject_put(&ext4_feat);
-        kset_unregister(&ext4_kset);
+        kobject_put(ext4_feat);
+        kset_unregister(ext4_kset);
+        ext4_kset = NULL;
         remove_proc_entry(proc_dirname, NULL);
         ext4_proc_root = NULL;
 }
diff --git a/fs/ext4/truncate.h b/fs/ext4/truncate.h
index b64a9fa0ff41..0cb13badf473 100644
--- a/fs/ext4/truncate.h
+++ b/fs/ext4/truncate.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+// SPDX-License-Identifier: GPL-2.0
 /*
  * linux/fs/ext4/truncate.h
  *
diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
index f8cc07588ac9..dd54c4f995c8 100644
--- a/fs/ext4/xattr.h
+++ b/fs/ext4/xattr.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+// SPDX-License-Identifier: GPL-2.0
 /*
   File: fs/ext4/xattr.h
 
diff --git a/fs/f2fs/Kconfig b/fs/f2fs/Kconfig
index 378c221d68a9..9a20ef42fadd 100644
--- a/fs/f2fs/Kconfig
+++ b/fs/f2fs/Kconfig
@@ -35,8 +35,7 @@ config F2FS_FS_XATTR
         default y
         help
           Extended attributes are name:value pairs associated with inodes by
-          the kernel or by users (see the attr(5) manual page, or visit
-          <http://acl.bestbits.at/> for details).
+          the kernel or by users (see the attr(5) manual page for details).
 
           If unsure, say N.
 
@@ -49,9 +48,6 @@ config F2FS_FS_POSIX_ACL
           Posix Access Control Lists (ACLs) support permissions for users and
           groups beyond the owner/group/world scheme.
 
-          To learn more about Access Control Lists, visit the POSIX ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
           If you don't know what Access Control Lists are, say N
 
 config F2FS_FS_SECURITY
diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index 89c838bfb067..205add3d0f3a 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -585,7 +585,7 @@ no_delete:
                         !exist_written_data(sbi, inode->i_ino, ORPHAN_INO));
         }
 out_clear:
-        fscrypt_put_encryption_info(inode, NULL);
+        fscrypt_put_encryption_info(inode);
         clear_inode(inode);
 }
 
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index c4c94c7e9f4f..b68e7b03959f 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -486,27 +486,16 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry,
         struct f2fs_sb_info *sbi = F2FS_I_SB(dir);
         struct inode *inode;
         size_t len = strlen(symname);
-        struct fscrypt_str disk_link = FSTR_INIT((char *)symname, len + 1);
-        struct fscrypt_symlink_data *sd = NULL;
+        struct fscrypt_str disk_link;
         int err;
 
         if (unlikely(f2fs_cp_error(sbi)))
                 return -EIO;
 
-        if (f2fs_encrypted_inode(dir)) {
-                err = fscrypt_get_encryption_info(dir);
-                if (err)
-                        return err;
-
-                if (!fscrypt_has_encryption_key(dir))
-                        return -ENOKEY;
-
-                disk_link.len = (fscrypt_fname_encrypted_size(dir, len) +
-                                sizeof(struct fscrypt_symlink_data));
-        }
-
-        if (disk_link.len > dir->i_sb->s_blocksize)
-                return -ENAMETOOLONG;
+        err = fscrypt_prepare_symlink(dir, symname, len, dir->i_sb->s_blocksize,
+                                      &disk_link);
+        if (err)
+                return err;
 
         err = dquot_initialize(dir);
         if (err)
@@ -516,7 +505,7 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry,
         if (IS_ERR(inode))
                 return PTR_ERR(inode);
 
-        if (f2fs_encrypted_inode(inode))
+        if (IS_ENCRYPTED(inode))
                 inode->i_op = &f2fs_encrypted_symlink_inode_operations;
         else
                 inode->i_op = &f2fs_symlink_inode_operations;
@@ -526,38 +515,13 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry,
         f2fs_lock_op(sbi);
         err = f2fs_add_link(dentry, inode);
         if (err)
-                goto out;
+                goto out_handle_failed_inode;
         f2fs_unlock_op(sbi);
         alloc_nid_done(sbi, inode->i_ino);
 
-        if (f2fs_encrypted_inode(inode)) {
-                struct qstr istr = QSTR_INIT(symname, len);
-                struct fscrypt_str ostr;
-
-                sd = f2fs_kzalloc(sbi, disk_link.len, GFP_NOFS);
-                if (!sd) {
-                        err = -ENOMEM;
-                        goto err_out;
-                }
-
-                err = fscrypt_get_encryption_info(inode);
-                if (err)
-                        goto err_out;
-
-                if (!fscrypt_has_encryption_key(inode)) {
-                        err = -ENOKEY;
-                        goto err_out;
-                }
-
-                ostr.name = sd->encrypted_path;
-                ostr.len = disk_link.len;
-                err = fscrypt_fname_usr_to_disk(inode, &istr, &ostr);
-                if (err)
-                        goto err_out;
-
-                sd->len = cpu_to_le16(ostr.len);
-                disk_link.name = (char *)sd;
-        }
+        err = fscrypt_encrypt_symlink(inode, symname, len, &disk_link);
+        if (err)
+                goto err_out;
 
         err = page_symlink(inode, disk_link.name, disk_link.len);
 
@@ -584,12 +548,14 @@ err_out:
                 f2fs_unlink(dir, dentry);
         }
 
-        kfree(sd);
-
         f2fs_balance_fs(sbi, true);
-        return err;
-out:
+        goto out_free_encrypted_link;
+
+out_handle_failed_inode:
         handle_failed_inode(inode);
+out_free_encrypted_link:
+        if (disk_link.name != (unsigned char *)symname)
+                kfree(disk_link.name);
         return err;
 }
 
@@ -1148,68 +1114,20 @@ static const char *f2fs_encrypted_get_link(struct dentry *dentry,
                                            struct inode *inode,
                                            struct delayed_call *done)
 {
-        struct page *cpage = NULL;
-        char *caddr, *paddr = NULL;
-        struct fscrypt_str cstr = FSTR_INIT(NULL, 0);
-        struct fscrypt_str pstr = FSTR_INIT(NULL, 0);
-        struct fscrypt_symlink_data *sd;
-        u32 max_size = inode->i_sb->s_blocksize;
-        int res;
+        struct page *page;
+        const char *target;
 
         if (!dentry)
                 return ERR_PTR(-ECHILD);
 
-        res = fscrypt_get_encryption_info(inode);
-        if (res)
-                return ERR_PTR(res);
-
-        cpage = read_mapping_page(inode->i_mapping, 0, NULL);
-        if (IS_ERR(cpage))
-                return ERR_CAST(cpage);
-        caddr = page_address(cpage);
-
-        /* Symlink is encrypted */
-        sd = (struct fscrypt_symlink_data *)caddr;
-        cstr.name = sd->encrypted_path;
-        cstr.len = le16_to_cpu(sd->len);
-
-        /* this is broken symlink case */
-        if (unlikely(cstr.len == 0)) {
-                res = -ENOENT;
-                goto errout;
-        }
-
-        if ((cstr.len + sizeof(struct fscrypt_symlink_data) - 1) > max_size) {
-                /* Symlink data on the disk is corrupted */
-                res = -EIO;
-                goto errout;
-        }
-        res = fscrypt_fname_alloc_buffer(inode, cstr.len, &pstr);
-        if (res)
-                goto errout;
-
-        res = fscrypt_fname_disk_to_usr(inode, 0, 0, &cstr, &pstr);
-        if (res)
-                goto errout;
-
-        /* this is broken symlink case */
-        if (unlikely(pstr.name[0] == 0)) {
-                res = -ENOENT;
-                goto errout;
-        }
-
-        paddr = pstr.name;
-
-        /* Null-terminate the name */
-        paddr[pstr.len] = '\0';
+        page = read_mapping_page(inode->i_mapping, 0, NULL);
+        if (IS_ERR(page))
+                return ERR_CAST(page);
 
-        put_page(cpage);
-        set_delayed_call(done, kfree_link, paddr);
-        return paddr;
-errout:
-        fscrypt_fname_free_buffer(&pstr);
-        put_page(cpage);
-        return ERR_PTR(res);
+        target = fscrypt_get_symlink(inode, page_address(page),
+                                     inode->i_sb->s_blocksize, done);
+        put_page(page);
+        return target;
 }
 
 const struct inode_operations f2fs_encrypted_symlink_inode_operations = {
diff --git a/fs/fcntl.c b/fs/fcntl.c
index c7b9e0948107..e95fa0a352ea 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -418,7 +418,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
                 break;
         case F_ADD_SEALS:
         case F_GET_SEALS:
-                err = shmem_fcntl(filp, cmd, arg);
+                err = memfd_fcntl(filp, cmd, arg);
                 break;
         case F_GET_RW_HINT:
         case F_SET_RW_HINT:
diff --git a/fs/fhandle.c b/fs/fhandle.c
index 0ace128f5d23..0ee727485615 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -69,8 +69,7 @@ static long do_sys_name_to_handle(struct path *path,
         } else
                 retval = 0;
         /* copy the mount id */
-        if (copy_to_user(mnt_id, &real_mount(path->mnt)->mnt_id,
-                         sizeof(*mnt_id)) ||
+        if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) ||
             copy_to_user(ufh, handle,
                          sizeof(struct file_handle) + handle_bytes))
                 retval = -EFAULT;
diff --git a/fs/file.c b/fs/file.c
index fc0eeb812e2c..42f0db4bd0fb 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -11,18 +11,13 @@
 #include <linux/export.h>
 #include <linux/fs.h>
 #include <linux/mm.h>
-#include <linux/mmzone.h>
-#include <linux/time.h>
 #include <linux/sched/signal.h>
 #include <linux/slab.h>
-#include <linux/vmalloc.h>
 #include <linux/file.h>
 #include <linux/fdtable.h>
 #include <linux/bitops.h>
-#include <linux/interrupt.h>
 #include <linux/spinlock.h>
 #include <linux/rcupdate.h>
-#include <linux/workqueue.h>
 
 unsigned int sysctl_nr_open __read_mostly = 1024*1024;
 unsigned int sysctl_nr_open_min = BITS_PER_LONG;
diff --git a/fs/file_table.c b/fs/file_table.c
index 2dc9f38bd195..7ec0b3e5f05d 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -23,7 +23,6 @@
 #include <linux/sysctl.h>
 #include <linux/percpu_counter.h>
 #include <linux/percpu.h>
-#include <linux/hardirq.h>
 #include <linux/task_work.h>
 #include <linux/ima.h>
 #include <linux/swap.h>
diff --git a/fs/freevxfs/vxfs_super.c b/fs/freevxfs/vxfs_super.c
index f989efa051a0..48b24bb50d02 100644
--- a/fs/freevxfs/vxfs_super.c
+++ b/fs/freevxfs/vxfs_super.c
@@ -332,9 +332,13 @@ vxfs_init(void)
 {
         int rv;
 
-        vxfs_inode_cachep = kmem_cache_create("vxfs_inode",
+        vxfs_inode_cachep = kmem_cache_create_usercopy("vxfs_inode",
                         sizeof(struct vxfs_inode_info), 0,
-                        SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD, NULL);
+                        SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
+                        offsetof(struct vxfs_inode_info, vii_immed.vi_immed),
+                        sizeof_field(struct vxfs_inode_info,
+                                vii_immed.vi_immed),
+                        NULL);
         if (!vxfs_inode_cachep)
                 return -ENOMEM;
         rv = register_filesystem(&vxfs_fs_type);
diff --git a/fs/gfs2/Kconfig b/fs/gfs2/Kconfig
index 43c827a7cce5..3ed2b088dcfd 100644
--- a/fs/gfs2/Kconfig
+++ b/fs/gfs2/Kconfig
@@ -3,6 +3,7 @@ config GFS2_FS
         depends on (64BIT || LBDAF)
         select FS_POSIX_ACL
         select CRC32
+        select LIBCRC32C
         select QUOTACTL
         select FS_IOMAP
         help
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index 1daf15a1f00c..2f725b4a386b 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -39,18 +39,21 @@
 
 
 static void gfs2_page_add_databufs(struct gfs2_inode *ip, struct page *page,
-                                   unsigned int from, unsigned int to)
+                                   unsigned int from, unsigned int len)
 {
         struct buffer_head *head = page_buffers(page);
         unsigned int bsize = head->b_size;
         struct buffer_head *bh;
+        unsigned int to = from + len;
         unsigned int start, end;
 
         for (bh = head, start = 0; bh != head || !start;
              bh = bh->b_this_page, start = end) {
                 end = start + bsize;
-                if (end <= from || start >= to)
+                if (end <= from)
                         continue;
+                if (start >= to)
+                        break;
                 if (gfs2_is_jdata(ip))
                         set_buffer_uptodate(bh);
                 gfs2_trans_add_data(ip->i_gl, bh);
@@ -189,7 +192,7 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w
                         create_empty_buffers(page, inode->i_sb->s_blocksize,
                                              BIT(BH_Dirty)|BIT(BH_Uptodate));
                 }
-                gfs2_page_add_databufs(ip, page, 0, sdp->sd_vfs->s_blocksize-1);
+                gfs2_page_add_databufs(ip, page, 0, sdp->sd_vfs->s_blocksize);
         }
         return gfs2_write_full_page(page, gfs2_get_block_noalloc, wbc);
 }
@@ -255,7 +258,6 @@ static int gfs2_writepages(struct address_space *mapping,
  * @wbc: The writeback control
  * @pvec: The vector of pages
  * @nr_pages: The number of pages to write
- * @end: End position
  * @done_index: Page index
  *
  * Returns: non-zero if loop should terminate, zero otherwise
@@ -264,7 +266,7 @@ static int gfs2_writepages(struct address_space *mapping,
 static int gfs2_write_jdata_pagevec(struct address_space *mapping,
                                     struct writeback_control *wbc,
                                     struct pagevec *pvec,
-                                    int nr_pages, pgoff_t end,
+                                    int nr_pages,
                                     pgoff_t *done_index)
 {
         struct inode *inode = mapping->host;
@@ -402,7 +404,7 @@ retry:
                 if (nr_pages == 0)
                         break;
 
-                ret = gfs2_write_jdata_pagevec(mapping, wbc, &pvec, nr_pages, end, &done_index);
+                ret = gfs2_write_jdata_pagevec(mapping, wbc, &pvec, nr_pages, &done_index);
                 if (ret)
                         done = 1;
                 if (ret > 0)
@@ -446,7 +448,8 @@ static int gfs2_jdata_writepages(struct address_space *mapping,
 
         ret = gfs2_write_cache_jdata(mapping, wbc);
         if (ret == 0 && wbc->sync_mode == WB_SYNC_ALL) {
-                gfs2_log_flush(sdp, ip->i_gl, NORMAL_FLUSH);
+                gfs2_log_flush(sdp, ip->i_gl, GFS2_LOG_HEAD_FLUSH_NORMAL |
+                               GFS2_LFC_JDATA_WPAGES);
                 ret = gfs2_write_cache_jdata(mapping, wbc);
         }
         return ret;
@@ -483,8 +486,8 @@ static int stuffed_readpage(struct gfs2_inode *ip, struct page *page)
                 return error;
 
         kaddr = kmap_atomic(page);
-        if (dsize > (dibh->b_size - sizeof(struct gfs2_dinode)))
-                dsize = (dibh->b_size - sizeof(struct gfs2_dinode));
+        if (dsize > gfs2_max_stuffed_size(ip))
+                dsize = gfs2_max_stuffed_size(ip);
         memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);
         memset(kaddr + dsize, 0, PAGE_SIZE - dsize);
         kunmap_atomic(kaddr);
@@ -501,10 +504,9 @@ static int stuffed_readpage(struct gfs2_inode *ip, struct page *page)
  * @file: The file to read a page for
  * @page: The page to read
  *
- * This is the core of gfs2's readpage. Its used by the internal file
- * reading code as in that case we already hold the glock. Also its
+ * This is the core of gfs2's readpage. It's used by the internal file
+ * reading code as in that case we already hold the glock. Also it's
  * called by gfs2_readpage() once the required lock has been granted.
- *
  */
 
 static int __gfs2_readpage(void *file, struct page *page)
@@ -725,7 +727,7 @@ static int gfs2_write_begin(struct file *file, struct address_space *mapping,
 
         if (gfs2_is_stuffed(ip)) {
                 error = 0;
-                if (pos + len > sdp->sd_sb.sb_bsize - sizeof(struct gfs2_dinode)) {
+                if (pos + len > gfs2_max_stuffed_size(ip)) {
                         error = gfs2_unstuff_dinode(ip, page);
                         if (error == 0)
                                 goto prepare_write;
@@ -832,7 +834,8 @@ static int gfs2_stuffed_write_end(struct inode *inode, struct buffer_head *dibh,
         void *kaddr;
         unsigned char *buf = dibh->b_data + sizeof(struct gfs2_dinode);
 
-        BUG_ON((pos + len) > (dibh->b_size - sizeof(struct gfs2_dinode)));
+        BUG_ON(pos + len > gfs2_max_stuffed_size(ip));
+
         kaddr = kmap_atomic(page);
         memcpy(buf + pos, kaddr + pos, copied);
         flush_dcache_page(page);
@@ -890,8 +893,6 @@ static int gfs2_write_end(struct file *file, struct address_space *mapping,
         struct gfs2_sbd *sdp = GFS2_SB(inode);
         struct gfs2_inode *m_ip = GFS2_I(sdp->sd_statfs_inode);
         struct buffer_head *dibh;
-        unsigned int from = pos & (PAGE_SIZE - 1);
-        unsigned int to = from + len;
         int ret;
         struct gfs2_trans *tr = current->journal_info;
         BUG_ON(!tr);
@@ -909,7 +910,7 @@ static int gfs2_write_end(struct file *file, struct address_space *mapping,
                 return gfs2_stuffed_write_end(inode, dibh, pos, len, copied, page);
 
         if (!gfs2_is_writeback(ip))
-                gfs2_page_add_databufs(ip, page, from, to);
+                gfs2_page_add_databufs(ip, page, pos & ~PAGE_MASK, len);
 
         ret = generic_write_end(file, mapping, pos, len, copied, page, fsdata);
         if (tr->tr_num_buf_new)
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index d5f0d96169c5..86863792f36a 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -69,8 +69,8 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, struct buffer_head *dibh,
                 void *kaddr = kmap(page);
                 u64 dsize = i_size_read(inode);
  
-                if (dsize > (dibh->b_size - sizeof(struct gfs2_dinode)))
-                        dsize = dibh->b_size - sizeof(struct gfs2_dinode);
+                if (dsize > gfs2_max_stuffed_size(ip))
+                        dsize = gfs2_max_stuffed_size(ip);
 
                 memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);
                 memset(kaddr + dsize, 0, PAGE_SIZE - dsize);
@@ -279,14 +279,13 @@ static inline __be64 *metapointer(unsigned int height, const struct metapath *mp
         return p + mp->mp_list[height];
 }
 
-static void gfs2_metapath_ra(struct gfs2_glock *gl,
-                             const struct buffer_head *bh, const __be64 *pos)
+static void gfs2_metapath_ra(struct gfs2_glock *gl, __be64 *start, __be64 *end)
 {
-        struct buffer_head *rabh;
-        const __be64 *endp = (const __be64 *)(bh->b_data + bh->b_size);
         const __be64 *t;
 
-        for (t = pos; t < endp; t++) {
+        for (t = start; t < end; t++) {
+                struct buffer_head *rabh;
+
                 if (!*t)
                         continue;
 
@@ -305,21 +304,22 @@ static void gfs2_metapath_ra(struct gfs2_glock *gl,
         }
 }
 
-/**
- * lookup_mp_height - helper function for lookup_metapath
- * @ip: the inode
- * @mp: the metapath
- * @h: the height which needs looking up
- */
-static int lookup_mp_height(struct gfs2_inode *ip, struct metapath *mp, int h)
+static int __fillup_metapath(struct gfs2_inode *ip, struct metapath *mp,
+                             unsigned int x, unsigned int h)
 {
-        __be64 *ptr = metapointer(h, mp);
-        u64 dblock = be64_to_cpu(*ptr);
-
-        if (!dblock)
-                return h + 1;
+        for (; x < h; x++) {
+                __be64 *ptr = metapointer(x, mp);
+                u64 dblock = be64_to_cpu(*ptr);
+                int ret;
 
-        return gfs2_meta_indirect_buffer(ip, h + 1, dblock, &mp->mp_bh[h + 1]);
+                if (!dblock)
+                        break;
+                ret = gfs2_meta_indirect_buffer(ip, x + 1, dblock, &mp->mp_bh[x + 1]);
+                if (ret)
+                        return ret;
+        }
+        mp->mp_aheight = x + 1;
+        return 0;
 }
 
 /**
@@ -336,25 +336,12 @@ static int lookup_mp_height(struct gfs2_inode *ip, struct metapath *mp, int h)
  * at which it found the unallocated block. Blocks which are found are
  * added to the mp->mp_bh[] list.
  *
- * Returns: error or height of metadata tree
+ * Returns: error
  */
 
 static int lookup_metapath(struct gfs2_inode *ip, struct metapath *mp)
 {
-        unsigned int end_of_metadata = ip->i_height - 1;
-        unsigned int x;
-        int ret;
-
-        for (x = 0; x < end_of_metadata; x++) {
-                ret = lookup_mp_height(ip, mp, x);
-                if (ret)
-                        goto out;
-        }
-
-        ret = ip->i_height;
-out:
-        mp->mp_aheight = ret;
-        return ret;
+        return __fillup_metapath(ip, mp, 0, ip->i_height - 1);
 }
 
 /**
@@ -365,25 +352,25 @@ out:
  *
  * Similar to lookup_metapath, but does lookups for a range of heights
  *
- * Returns: error or height of metadata tree
+ * Returns: error or the number of buffers filled
  */
 
 static int fillup_metapath(struct gfs2_inode *ip, struct metapath *mp, int h)
 {
-        unsigned int start_h = h - 1;
+        unsigned int x = 0;
         int ret;
 
         if (h) {
                 /* find the first buffer we need to look up. */
-                while (start_h > 0 && mp->mp_bh[start_h] == NULL)
-                        start_h--;
-                for (; start_h < h; start_h++) {
-                        ret = lookup_mp_height(ip, mp, start_h);
-                        if (ret)
-                                return ret;
+                for (x = h - 1; x > 0; x--) {
+                        if (mp->mp_bh[x])
+                                break;
                 }
         }
-        return ip->i_height;
+        ret = __fillup_metapath(ip, mp, x, h);
+        if (ret)
+                return ret;
+        return mp->mp_aheight - x - 1;
 }
 
 static inline void release_metapath(struct metapath *mp)
@@ -474,13 +461,6 @@ enum alloc_state {
         /* ALLOC_UNSTUFF = 3,   TBD and rather complicated */
 };
 
-static inline unsigned int hptrs(struct gfs2_sbd *sdp, const unsigned int hgt)
-{
-        if (hgt)
-                return sdp->sd_inptrs;
-        return sdp->sd_diptrs;
-}
-
 /**
  * gfs2_bmap_alloc - Build a metadata tree of the requested height
  * @inode: The GFS2 inode
@@ -788,7 +768,7 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
                 goto do_alloc;
 
         ret = lookup_metapath(ip, &mp);
-        if (ret < 0)
+        if (ret)
                 goto out_release;
 
         if (mp.mp_aheight != ip->i_height)
@@ -913,17 +893,18 @@ int gfs2_extent_map(struct inode *inode, u64 lblock, int *new, u64 *dblock, unsi
 }
 
 /**
- * gfs2_block_truncate_page - Deal with zeroing out data for truncate
+ * gfs2_block_zero_range - Deal with zeroing out data
  *
  * This is partly borrowed from ext3.
  */
-static int gfs2_block_truncate_page(struct address_space *mapping, loff_t from)
+static int gfs2_block_zero_range(struct inode *inode, loff_t from,
+                                 unsigned int length)
 {
-        struct inode *inode = mapping->host;
+        struct address_space *mapping = inode->i_mapping;
         struct gfs2_inode *ip = GFS2_I(inode);
         unsigned long index = from >> PAGE_SHIFT;
         unsigned offset = from & (PAGE_SIZE-1);
-        unsigned blocksize, iblock, length, pos;
+        unsigned blocksize, iblock, pos;
         struct buffer_head *bh;
         struct page *page;
         int err;
@@ -933,7 +914,6 @@ static int gfs2_block_truncate_page(struct address_space *mapping, loff_t from)
                 return 0;
 
         blocksize = inode->i_sb->s_blocksize;
-        length = blocksize - (offset & (blocksize - 1));
         iblock = index << (PAGE_SHIFT - inode->i_sb->s_blocksize_bits);
 
         if (!page_has_buffers(page))
@@ -1003,11 +983,24 @@ static int gfs2_journaled_truncate(struct inode *inode, u64 oldsize, u64 newsize
         int error;
 
         while (oldsize != newsize) {
+                struct gfs2_trans *tr;
+                unsigned int offs;
+
                 chunk = oldsize - newsize;
                 if (chunk > max_chunk)
                         chunk = max_chunk;
+
+                offs = oldsize & ~PAGE_MASK;
+                if (offs && chunk > PAGE_SIZE)
+                        chunk = offs + ((chunk - offs) & PAGE_MASK);
+
                 truncate_pagecache(inode, oldsize - chunk);
                 oldsize -= chunk;
+
+                tr = current->journal_info;
+                if (!test_bit(TR_TOUCHED, &tr->tr_flags))
+                        continue;
+
                 gfs2_trans_end(sdp);
                 error = gfs2_trans_begin(sdp, RES_DINODE, GFS2_JTRUNC_REVOKES);
                 if (error)
@@ -1017,13 +1010,13 @@ static int gfs2_journaled_truncate(struct inode *inode, u64 oldsize, u64 newsize
         return 0;
 }
 
-static int trunc_start(struct inode *inode, u64 oldsize, u64 newsize)
+static int trunc_start(struct inode *inode, u64 newsize)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_sbd *sdp = GFS2_SB(inode);
-        struct address_space *mapping = inode->i_mapping;
-        struct buffer_head *dibh;
+        struct buffer_head *dibh = NULL;
         int journaled = gfs2_is_jdata(ip);
+        u64 oldsize = inode->i_size;
         int error;
 
         if (journaled)
@@ -1042,10 +1035,13 @@ static int trunc_start(struct inode *inode, u64 oldsize, u64 newsize)
         if (gfs2_is_stuffed(ip)) {
                 gfs2_buffer_clear_tail(dibh, sizeof(struct gfs2_dinode) + newsize);
         } else {
-                if (newsize & (u64)(sdp->sd_sb.sb_bsize - 1)) {
-                        error = gfs2_block_truncate_page(mapping, newsize);
+                unsigned int blocksize = i_blocksize(inode);
+                unsigned int offs = newsize & (blocksize - 1);
+                if (offs) {
+                        error = gfs2_block_zero_range(inode, newsize,
+                                                      blocksize - offs);
                         if (error)
-                                goto out_brelse;
+                                goto out;
                 }
                 ip->i_diskflags |= GFS2_DIF_TRUNC_IN_PROG;
         }
@@ -1059,15 +1055,10 @@ static int trunc_start(struct inode *inode, u64 oldsize, u64 newsize)
         else
                 truncate_pagecache(inode, newsize);
 
-        if (error) {
-                brelse(dibh);
-                return error;
-        }
-
-out_brelse:
-        brelse(dibh);
 out:
-        gfs2_trans_end(sdp);
+        brelse(dibh);
+        if (current->journal_info)
+                gfs2_trans_end(sdp);
         return error;
 }
 
@@ -1075,10 +1066,11 @@ out:
  * sweep_bh_for_rgrps - find an rgrp in a meta buffer and free blocks therein
  * @ip: inode
  * @rg_gh: holder of resource group glock
- * @mp: current metapath fully populated with buffers
+ * @bh: buffer head to sweep
+ * @start: starting point in bh
+ * @end: end point in bh
+ * @meta: true if bh points to metadata (rather than data)
  * @btotal: place to keep count of total blocks freed
- * @hgt: height we're processing
- * @first: true if this is the first call to this function for this height
  *
  * We sweep a metadata buffer (provided by the metapath) for blocks we need to
  * free, and free them all. However, we do it one rgrp at a time. If this
@@ -1093,47 +1085,46 @@ out:
  *          *btotal has the total number of blocks freed
  */
 static int sweep_bh_for_rgrps(struct gfs2_inode *ip, struct gfs2_holder *rd_gh,
-                              const struct metapath *mp, u32 *btotal, int hgt,
-                              bool preserve1)
+                              struct buffer_head *bh, __be64 *start, __be64 *end,
+                              bool meta, u32 *btotal)
 {
         struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
         struct gfs2_rgrpd *rgd;
         struct gfs2_trans *tr;
-        struct buffer_head *bh = mp->mp_bh[hgt];
-        __be64 *top, *bottom, *p;
+        __be64 *p;
         int blks_outside_rgrp;
         u64 bn, bstart, isize_blks;
         s64 blen; /* needs to be s64 or gfs2_add_inode_blocks breaks */
-        int meta = ((hgt != ip->i_height - 1) ? 1 : 0);
         int ret = 0;
         bool buf_in_tr = false; /* buffer was added to transaction */
 
-        if (gfs2_metatype_check(sdp, bh,
-                                (hgt ? GFS2_METATYPE_IN : GFS2_METATYPE_DI)))
-                return -EIO;
-
 more_rgrps:
+        rgd = NULL;
+        if (gfs2_holder_initialized(rd_gh)) {
+                rgd = gfs2_glock2rgrp(rd_gh->gh_gl);
+                gfs2_assert_withdraw(sdp,
+                             gfs2_glock_is_locked_by_me(rd_gh->gh_gl));
+        }
         blks_outside_rgrp = 0;
         bstart = 0;
         blen = 0;
-        top = metapointer(hgt, mp); /* first ptr from metapath */
-        /* If we're keeping some data at the truncation point, we've got to
-           preserve the metadata tree by adding 1 to the starting metapath. */
-        if (preserve1)
-                top++;
 
-        bottom = (__be64 *)(bh->b_data + bh->b_size);
-
-        for (p = top; p < bottom; p++) {
+        for (p = start; p < end; p++) {
                 if (!*p)
                         continue;
                 bn = be64_to_cpu(*p);
-                if (gfs2_holder_initialized(rd_gh)) {
-                        rgd = gfs2_glock2rgrp(rd_gh->gh_gl);
-                        gfs2_assert_withdraw(sdp,
-                                     gfs2_glock_is_locked_by_me(rd_gh->gh_gl));
+
+                if (rgd) {
+                        if (!rgrp_contains_block(rgd, bn)) {
+                                blks_outside_rgrp++;
+                                continue;
+                        }
                 } else {
-                        rgd = gfs2_blk2rgrpd(sdp, bn, false);
+                        rgd = gfs2_blk2rgrpd(sdp, bn, true);
+                        if (unlikely(!rgd)) {
+                                ret = -EIO;
+                                goto out;
+                        }
                         ret = gfs2_glock_nq_init(rgd->rd_gl, LM_ST_EXCLUSIVE,
                                                  0, rd_gh);
                         if (ret)
@@ -1145,11 +1136,6 @@ more_rgrps:
                                 gfs2_rs_deltree(&ip->i_res);
                 }
 
-                if (!rgrp_contains_block(rgd, bn)) {
-                        blks_outside_rgrp++;
-                        continue;
-                }
-
                 /* The size of our transactions will be unknown until we
                    actually process all the metadata blocks that relate to
                    the rgrp. So we estimate. We know it can't be more than
@@ -1168,7 +1154,7 @@ more_rgrps:
                                 jblocks_rqsted += isize_blks;
                         revokes = jblocks_rqsted;
                         if (meta)
-                                revokes += hptrs(sdp, hgt);
+                                revokes += end - start;
                         else if (ip->i_depth)
                                 revokes += sdp->sd_inptrs;
                         ret = gfs2_trans_begin(sdp, jblocks_rqsted, revokes);
@@ -1226,7 +1212,11 @@ out_unlock:
                                             outside the rgrp we just processed,
                                             do it all over again. */
                 if (current->journal_info) {
-                        struct buffer_head *dibh = mp->mp_bh[0];
+                        struct buffer_head *dibh;
+
+                        ret = gfs2_meta_inode_buffer(ip, &dibh);
+                        if (ret)
+                                goto out;
 
                         /* Every transaction boundary, we rewrite the dinode
                            to keep its di_blocks current in case of failure. */
@@ -1234,6 +1224,7 @@ out_unlock:
                                 current_time(&ip->i_inode);
                         gfs2_trans_add_meta(ip->i_gl, dibh);
                         gfs2_dinode_out(ip, dibh->b_data);
+                        brelse(dibh);
                         up_write(&ip->i_rw_mutex);
                         gfs2_trans_end(sdp);
                 }
@@ -1245,38 +1236,48 @@ out:
         return ret;
 }
 
+static bool mp_eq_to_hgt(struct metapath *mp, __u16 *list, unsigned int h)
+{
+        if (memcmp(mp->mp_list, list, h * sizeof(mp->mp_list[0])))
+                return false;
+        return true;
+}
+
 /**
  * find_nonnull_ptr - find a non-null pointer given a metapath and height
- * assumes the metapath is valid (with buffers) out to height h
  * @mp: starting metapath
  * @h: desired height to search
  *
+ * Assumes the metapath is valid (with buffers) out to height h.
  * Returns: true if a non-null pointer was found in the metapath buffer
  *          false if all remaining pointers are NULL in the buffer
  */
 static bool find_nonnull_ptr(struct gfs2_sbd *sdp, struct metapath *mp,
-                             unsigned int h)
+                             unsigned int h,
+                             __u16 *end_list, unsigned int end_aligned)
 {
-        __be64 *ptr;
-        unsigned int ptrs = hptrs(sdp, h) - 1;
+        struct buffer_head *bh = mp->mp_bh[h];
+        __be64 *first, *ptr, *end;
+
+        first = metaptr1(h, mp);
+        ptr = first + mp->mp_list[h];
+        end = (__be64 *)(bh->b_data + bh->b_size);
+        if (end_list && mp_eq_to_hgt(mp, end_list, h)) {
+                bool keep_end = h < end_aligned;
+                end = first + end_list[h] + keep_end;
+        }
 
-        while (true) {
-                ptr = metapointer(h, mp);
+        while (ptr < end) {
                 if (*ptr) { /* if we have a non-null pointer */
-                        /* Now zero the metapath after the current height. */
+                        mp->mp_list[h] = ptr - first;
                         h++;
                         if (h < GFS2_MAX_META_HEIGHT)
-                                memset(&mp->mp_list[h], 0,
-                                       (GFS2_MAX_META_HEIGHT - h) *
-                                       sizeof(mp->mp_list[0]));
+                                mp->mp_list[h] = 0;
                         return true;
                 }
-
-                if (mp->mp_list[h] < ptrs)
-                        mp->mp_list[h]++;
-                else
-                        return false; /* no more pointers in this buffer */
+                ptr++;
         }
+        return false;
 }
 
 enum dealloc_states {
@@ -1286,49 +1287,126 @@ enum dealloc_states {
         DEALLOC_DONE = 3,       /* process complete */
 };
 
-static bool mp_eq_to_hgt(struct metapath *mp, __u16 *nbof, unsigned int h)
+static inline void
+metapointer_range(struct metapath *mp, int height,
+                  __u16 *start_list, unsigned int start_aligned,
+                  __u16 *end_list, unsigned int end_aligned,
+                  __be64 **start, __be64 **end)
 {
-        if (memcmp(mp->mp_list, nbof, h * sizeof(mp->mp_list[0])))
-                return false;
-        return true;
+        struct buffer_head *bh = mp->mp_bh[height];
+        __be64 *first;
+
+        first = metaptr1(height, mp);
+        *start = first;
+        if (mp_eq_to_hgt(mp, start_list, height)) {
+                bool keep_start = height < start_aligned;
+                *start = first + start_list[height] + keep_start;
+        }
+        *end = (__be64 *)(bh->b_data + bh->b_size);
+        if (end_list && mp_eq_to_hgt(mp, end_list, height)) {
+                bool keep_end = height < end_aligned;
+                *end = first + end_list[height] + keep_end;
+        }
+}
+
+static inline bool walk_done(struct gfs2_sbd *sdp,
+                             struct metapath *mp, int height,
+                             __u16 *end_list, unsigned int end_aligned)
+{
+        __u16 end;
+
+        if (end_list) {
+                bool keep_end = height < end_aligned;
+                if (!mp_eq_to_hgt(mp, end_list, height))
+                        return false;
+                end = end_list[height] + keep_end;
+        } else
+                end = (height > 0) ? sdp->sd_inptrs : sdp->sd_diptrs;
+        return mp->mp_list[height] >= end;
 }
 
 /**
- * trunc_dealloc - truncate a file down to a desired size
+ * punch_hole - deallocate blocks in a file
  * @ip: inode to truncate
- * @newsize: The desired size of the file
+ * @offset: the start of the hole
+ * @length: the size of the hole (or 0 for truncate)
+ *
+ * Punch a hole into a file or truncate a file at a given position.  This
+ * function operates in whole blocks (@offset and @length are rounded
+ * accordingly); partially filled blocks must be cleared otherwise.
  *
- * This function truncates a file to newsize. It works from the
- * bottom up, and from the right to the left. In other words, it strips off
- * the highest layer (data) before stripping any of the metadata. Doing it
- * this way is best in case the operation is interrupted by power failure, etc.
- * The dinode is rewritten in every transaction to guarantee integrity.
+ * This function works from the bottom up, and from the right to the left. In
+ * other words, it strips off the highest layer (data) before stripping any of
+ * the metadata. Doing it this way is best in case the operation is interrupted
+ * by power failure, etc.  The dinode is rewritten in every transaction to
+ * guarantee integrity.
  */
-static int trunc_dealloc(struct gfs2_inode *ip, u64 newsize)
+static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)
 {
         struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
-        struct metapath mp;
+        struct metapath mp = {};
         struct buffer_head *dibh, *bh;
         struct gfs2_holder rd_gh;
-        u64 lblock;
-        __u16 nbof[GFS2_MAX_META_HEIGHT]; /* new beginning of truncation */
+        unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift;
+        u64 lblock = (offset + (1 << bsize_shift) - 1) >> bsize_shift;
+        __u16 start_list[GFS2_MAX_META_HEIGHT];
+        __u16 __end_list[GFS2_MAX_META_HEIGHT], *end_list = NULL;
+        unsigned int start_aligned, uninitialized_var(end_aligned);
         unsigned int strip_h = ip->i_height - 1;
         u32 btotal = 0;
         int ret, state;
         int mp_h; /* metapath buffers are read in to this height */
-        sector_t last_ra = 0;
         u64 prev_bnr = 0;
-        bool preserve1; /* need to preserve the first meta pointer? */
+        __be64 *start, *end;
 
-        if (!newsize)
-                lblock = 0;
-        else
-                lblock = (newsize - 1) >> sdp->sd_sb.sb_bsize_shift;
+        /*
+         * The start position of the hole is defined by lblock, start_list, and
+         * start_aligned.  The end position of the hole is defined by lend,
+         * end_list, and end_aligned.
+         *
+         * start_aligned and end_aligned define down to which height the start
+         * and end positions are aligned to the metadata tree (i.e., the
+         * position is a multiple of the metadata granularity at the height
+         * above).  This determines at which heights additional meta pointers
+         * needs to be preserved for the remaining data.
+         */
+
+        if (length) {
+                u64 maxsize = sdp->sd_heightsize[ip->i_height];
+                u64 end_offset = offset + length;
+                u64 lend;
+
+                /*
+                 * Clip the end at the maximum file size for the given height:
+                 * that's how far the metadata goes; files bigger than that
+                 * will have additional layers of indirection.
+                 */
+                if (end_offset > maxsize)
+                        end_offset = maxsize;
+                lend = end_offset >> bsize_shift;
+
+                if (lblock >= lend)
+                        return 0;
+
+                find_metapath(sdp, lend, &mp, ip->i_height);
+                end_list = __end_list;
+                memcpy(end_list, mp.mp_list, sizeof(mp.mp_list));
+
+                for (mp_h = ip->i_height - 1; mp_h > 0; mp_h--) {
+                        if (end_list[mp_h])
+                                break;
+                }
+                end_aligned = mp_h;
+        }
 
-        memset(&mp, 0, sizeof(mp));
         find_metapath(sdp, lblock, &mp, ip->i_height);
+        memcpy(start_list, mp.mp_list, sizeof(start_list));
 
-        memcpy(&nbof, &mp.mp_list, sizeof(nbof));
+        for (mp_h = ip->i_height - 1; mp_h > 0; mp_h--) {
+                if (start_list[mp_h])
+                        break;
+        }
+        start_aligned = mp_h;
 
         ret = gfs2_meta_inode_buffer(ip, &dibh);
         if (ret)
@@ -1336,7 +1414,17 @@ static int trunc_dealloc(struct gfs2_inode *ip, u64 newsize)
 
         mp.mp_bh[0] = dibh;
         ret = lookup_metapath(ip, &mp);
-        if (ret == ip->i_height)
+        if (ret)
+                goto out_metapath;
+
+        /* issue read-ahead on metadata */
+        for (mp_h = 0; mp_h < mp.mp_aheight - 1; mp_h++) {
+                metapointer_range(&mp, mp_h, start_list, start_aligned,
+                                  end_list, end_aligned, &start, &end);
+                gfs2_metapath_ra(ip->i_gl, start, end);
+        }
+
+        if (mp.mp_aheight == ip->i_height)
                 state = DEALLOC_MP_FULL; /* We have a complete metapath */
         else
                 state = DEALLOC_FILL_MP; /* deal with partial metapath */
@@ -1357,20 +1445,6 @@ static int trunc_dealloc(struct gfs2_inode *ip, u64 newsize)
                 /* Truncate a full metapath at the given strip height.
                  * Note that strip_h == mp_h in order to be in this state. */
                 case DEALLOC_MP_FULL:
-                        if (mp_h > 0) { /* issue read-ahead on metadata */
-                                __be64 *top;
-
-                                bh = mp.mp_bh[mp_h - 1];
-                                if (bh->b_blocknr != last_ra) {
-                                        last_ra = bh->b_blocknr;
-                                        top = metaptr1(mp_h - 1, &mp);
-                                        gfs2_metapath_ra(ip->i_gl, bh, top);
-                                }
-                        }
-                        /* If we're truncating to a non-zero size and the mp is
-                           at the beginning of file for the strip height, we
-                           need to preserve the first metadata pointer. */
-                        preserve1 = (newsize && mp_eq_to_hgt(&mp, nbof, mp_h));
                         bh = mp.mp_bh[mp_h];
                         gfs2_assert_withdraw(sdp, bh);
                         if (gfs2_assert_withdraw(sdp,
@@ -1382,8 +1456,28 @@ static int trunc_dealloc(struct gfs2_inode *ip, u64 newsize)
                                        prev_bnr, ip->i_height, strip_h, mp_h);
                         }
                         prev_bnr = bh->b_blocknr;
-                        ret = sweep_bh_for_rgrps(ip, &rd_gh, &mp, &btotal,
-                                                 mp_h, preserve1);
+
+                        if (gfs2_metatype_check(sdp, bh,
+                                                (mp_h ? GFS2_METATYPE_IN :
+                                                        GFS2_METATYPE_DI))) {
+                                ret = -EIO;
+                                goto out;
+                        }
+
+                        /*
+                         * Below, passing end_aligned as 0 gives us the
+                         * metapointer range excluding the end point: the end
+                         * point is the first metapath we must not deallocate!
+                         */
+
+                        metapointer_range(&mp, mp_h, start_list, start_aligned,
+                                          end_list, 0 /* end_aligned */,
+                                          &start, &end);
+                        ret = sweep_bh_for_rgrps(ip, &rd_gh, mp.mp_bh[mp_h],
+                                                 start, end,
+                                                 mp_h != ip->i_height - 1,
+                                                 &btotal);
+
                         /* If we hit an error or just swept dinode buffer,
                            just exit. */
                         if (ret || !mp_h) {
@@ -1407,20 +1501,20 @@ static int trunc_dealloc(struct gfs2_inode *ip, u64 newsize)
                            stripping the previous level of metadata. */
                         if (mp_h == 0) {
                                 strip_h--;
-                                memcpy(&mp.mp_list, &nbof, sizeof(nbof));
+                                memcpy(mp.mp_list, start_list, sizeof(start_list));
                                 mp_h = strip_h;
                                 state = DEALLOC_FILL_MP;
                                 break;
                         }
                         mp.mp_list[mp_h] = 0;
                         mp_h--; /* search one metadata height down */
-                        if (mp.mp_list[mp_h] >= hptrs(sdp, mp_h) - 1)
-                                break; /* loop around in the same state */
                         mp.mp_list[mp_h]++;
+                        if (walk_done(sdp, &mp, mp_h, end_list, end_aligned))
+                                break;
                         /* Here we've found a part of the metapath that is not
                          * allocated. We need to search at that height for the
                          * next non-null pointer. */
-                        if (find_nonnull_ptr(sdp, &mp, mp_h)) {
+                        if (find_nonnull_ptr(sdp, &mp, mp_h, end_list, end_aligned)) {
                                 state = DEALLOC_FILL_MP;
                                 mp_h++;
                         }
@@ -1435,18 +1529,29 @@ static int trunc_dealloc(struct gfs2_inode *ip, u64 newsize)
                         if (ret < 0)
                                 goto out;
 
+                        /* issue read-ahead on metadata */
+                        if (mp.mp_aheight > 1) {
+                                for (; ret > 1; ret--) {
+                                        metapointer_range(&mp, mp.mp_aheight - ret,
+                                                          start_list, start_aligned,
+                                                          end_list, end_aligned,
+                                                          &start, &end);
+                                        gfs2_metapath_ra(ip->i_gl, start, end);
+                                }
+                        }
+
                         /* If buffers found for the entire strip height */
-                        if ((ret == ip->i_height) && (mp_h == strip_h)) {
+                        if (mp.mp_aheight - 1 == strip_h) {
                                 state = DEALLOC_MP_FULL;
                                 break;
                         }
-                        if (ret < ip->i_height) /* We have a partial height */
-                                mp_h = ret - 1;
+                        if (mp.mp_aheight < ip->i_height) /* We have a partial height */
+                                mp_h = mp.mp_aheight - 1;
 
                         /* If we find a non-null block pointer, crawl a bit
                            higher up in the metapath and try again, otherwise
                            we need to look lower for a new starting point. */
-                        if (find_nonnull_ptr(sdp, &mp, mp_h))
+                        if (find_nonnull_ptr(sdp, &mp, mp_h, end_list, end_aligned))
                                 mp_h++;
                         else
                                 state = DEALLOC_MP_LOWER;
@@ -1524,7 +1629,6 @@ out:
 /**
  * do_shrink - make a file smaller
  * @inode: the inode
- * @oldsize: the current inode size
  * @newsize: the size to make the file
  *
  * Called with an exclusive lock on @inode. The @size must
@@ -1533,18 +1637,18 @@ out:
  * Returns: errno
  */
 
-static int do_shrink(struct inode *inode, u64 oldsize, u64 newsize)
+static int do_shrink(struct inode *inode, u64 newsize)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
         int error;
 
-        error = trunc_start(inode, oldsize, newsize);
+        error = trunc_start(inode, newsize);
         if (error < 0)
                 return error;
         if (gfs2_is_stuffed(ip))
                 return 0;
 
-        error = trunc_dealloc(ip, newsize);
+        error = punch_hole(ip, newsize, 0);
         if (error == 0)
                 error = trunc_end(ip);
 
@@ -1553,10 +1657,9 @@ static int do_shrink(struct inode *inode, u64 oldsize, u64 newsize)
 
 void gfs2_trim_blocks(struct inode *inode)
 {
-        u64 size = inode->i_size;
         int ret;
 
-        ret = do_shrink(inode, size, size);
+        ret = do_shrink(inode, inode->i_size);
         WARN_ON(ret != 0);
 }
 
@@ -1589,8 +1692,7 @@ static int do_grow(struct inode *inode, u64 size)
         int error;
         int unstuff = 0;
 
-        if (gfs2_is_stuffed(ip) &&
-            (size > (sdp->sd_sb.sb_bsize - sizeof(struct gfs2_dinode)))) {
+        if (gfs2_is_stuffed(ip) && size > gfs2_max_stuffed_size(ip)) {
                 error = gfs2_quota_lock_check(ip, &ap);
                 if (error)
                         return error;
@@ -1650,7 +1752,6 @@ int gfs2_setattr_size(struct inode *inode, u64 newsize)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
         int ret;
-        u64 oldsize;
 
         BUG_ON(!S_ISREG(inode->i_mode));
 
@@ -1664,13 +1765,12 @@ int gfs2_setattr_size(struct inode *inode, u64 newsize)
         if (ret)
                 goto out;
 
-        oldsize = inode->i_size;
-        if (newsize >= oldsize) {
+        if (newsize >= inode->i_size) {
                 ret = do_grow(inode, newsize);
                 goto out;
         }
 
-        ret = do_shrink(inode, oldsize, newsize);
+        ret = do_shrink(inode, newsize);
 out:
         gfs2_rsqa_delete(ip, NULL);
         return ret;
@@ -1679,7 +1779,7 @@ out:
 int gfs2_truncatei_resume(struct gfs2_inode *ip)
 {
         int error;
-        error = trunc_dealloc(ip, i_size_read(&ip->i_inode));
+        error = punch_hole(ip, i_size_read(&ip->i_inode), 0);
         if (!error)
                 error = trunc_end(ip);
         return error;
@@ -1687,7 +1787,7 @@ int gfs2_truncatei_resume(struct gfs2_inode *ip)
 
 int gfs2_file_dealloc(struct gfs2_inode *ip)
 {
-        return trunc_dealloc(ip, 0);
+        return punch_hole(ip, 0, 0);
 }
 
 /**
@@ -1827,8 +1927,7 @@ int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset,
                 return 0;
 
         if (gfs2_is_stuffed(ip)) {
-                if (offset + len >
-                    sdp->sd_sb.sb_bsize - sizeof(struct gfs2_dinode))
+                if (offset + len > gfs2_max_stuffed_size(ip))
                         return 1;
                 return 0;
         }
@@ -1855,3 +1954,123 @@ int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset,
         return 0;
 }
 
+static int stuffed_zero_range(struct inode *inode, loff_t offset, loff_t length)
+{
+        struct gfs2_inode *ip = GFS2_I(inode);
+        struct buffer_head *dibh;
+        int error;
+
+        if (offset >= inode->i_size)
+                return 0;
+        if (offset + length > inode->i_size)
+                length = inode->i_size - offset;
+
+        error = gfs2_meta_inode_buffer(ip, &dibh);
+        if (error)
+                return error;
+        gfs2_trans_add_meta(ip->i_gl, dibh);
+        memset(dibh->b_data + sizeof(struct gfs2_dinode) + offset, 0,
+               length);
+        brelse(dibh);
+        return 0;
+}
+
+static int gfs2_journaled_truncate_range(struct inode *inode, loff_t offset,
+                                         loff_t length)
+{
+        struct gfs2_sbd *sdp = GFS2_SB(inode);
+        loff_t max_chunk = GFS2_JTRUNC_REVOKES * sdp->sd_vfs->s_blocksize;
+        int error;
+
+        while (length) {
+                struct gfs2_trans *tr;
+                loff_t chunk;
+                unsigned int offs;
+
+                chunk = length;
+                if (chunk > max_chunk)
+                        chunk = max_chunk;
+
+                offs = offset & ~PAGE_MASK;
+                if (offs && chunk > PAGE_SIZE)
+                        chunk = offs + ((chunk - offs) & PAGE_MASK);
+
+                truncate_pagecache_range(inode, offset, chunk);
+                offset += chunk;
+                length -= chunk;
+
+                tr = current->journal_info;
+                if (!test_bit(TR_TOUCHED, &tr->tr_flags))
+                        continue;
+
+                gfs2_trans_end(sdp);
+                error = gfs2_trans_begin(sdp, RES_DINODE, GFS2_JTRUNC_REVOKES);
+                if (error)
+                        return error;
+        }
+        return 0;
+}
+
+int __gfs2_punch_hole(struct file *file, loff_t offset, loff_t length)
+{
+        struct inode *inode = file_inode(file);
+        struct gfs2_inode *ip = GFS2_I(inode);
+        struct gfs2_sbd *sdp = GFS2_SB(inode);
+        int error;
+
+        if (gfs2_is_jdata(ip))
+                error = gfs2_trans_begin(sdp, RES_DINODE + 2 * RES_JDATA,
+                                         GFS2_JTRUNC_REVOKES);
+        else
+                error = gfs2_trans_begin(sdp, RES_DINODE, 0);
+        if (error)
+                return error;
+
+        if (gfs2_is_stuffed(ip)) {
+                error = stuffed_zero_range(inode, offset, length);
+                if (error)
+                        goto out;
+        } else {
+                unsigned int start_off, end_off, blocksize;
+
+                blocksize = i_blocksize(inode);
+                start_off = offset & (blocksize - 1);
+                end_off = (offset + length) & (blocksize - 1);
+                if (start_off) {
+                        unsigned int len = length;
+                        if (length > blocksize - start_off)
+                                len = blocksize - start_off;
+                        error = gfs2_block_zero_range(inode, offset, len);
+                        if (error)
+                                goto out;
+                        if (start_off + length < blocksize)
+                                end_off = 0;
+                }
+                if (end_off) {
+                        error = gfs2_block_zero_range(inode,
+                                offset + length - end_off, end_off);
+                        if (error)
+                                goto out;
+                }
+        }
+
+        if (gfs2_is_jdata(ip)) {
+                BUG_ON(!current->journal_info);
+                gfs2_journaled_truncate_range(inode, offset, length);
+        } else
+                truncate_pagecache_range(inode, offset, offset + length - 1);
+
+        file_update_time(file);
+        mark_inode_dirty(inode);
+
+        if (current->journal_info)
+                gfs2_trans_end(sdp);
+
+        if (!gfs2_is_stuffed(ip))
+                error = punch_hole(ip, offset, length);
+
+out:
+        if (current->journal_info)
+                gfs2_trans_end(sdp);
+        return error;
+}
diff --git a/fs/gfs2/bmap.h b/fs/gfs2/bmap.h
index 443cc182cf18..c3402fe00653 100644
--- a/fs/gfs2/bmap.h
+++ b/fs/gfs2/bmap.h
@@ -61,5 +61,6 @@ extern int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset,
                                      unsigned int len);
 extern int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd);
 extern void gfs2_free_journal_extents(struct gfs2_jdesc *jd);
+extern int __gfs2_punch_hole(struct file *file, loff_t offset, loff_t length);
 
 #endif /* __BMAP_DOT_H__ */
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index 06a0d1947c77..7c21aea0266b 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -170,8 +170,7 @@ static int gfs2_dir_write_data(struct gfs2_inode *ip, const char *buf,
         if (!size)
                 return 0;
 
-        if (gfs2_is_stuffed(ip) &&
-            offset + size <= sdp->sd_sb.sb_bsize - sizeof(struct gfs2_dinode))
+        if (gfs2_is_stuffed(ip) && offset + size <= gfs2_max_stuffed_size(ip))
                 return gfs2_dir_write_stuffed(ip, buf, (unsigned int)offset,
                                               size);
 
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index 58705ef8643a..4f88e201b3f0 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -246,7 +246,9 @@ static int do_gfs2_set_flags(struct file *filp, u32 reqflags, u32 mask)
         }
         if ((flags ^ new_flags) & GFS2_DIF_JDATA) {
                 if (new_flags & GFS2_DIF_JDATA)
-                        gfs2_log_flush(sdp, ip->i_gl, NORMAL_FLUSH);
+                        gfs2_log_flush(sdp, ip->i_gl,
+                                       GFS2_LOG_HEAD_FLUSH_NORMAL |
+                                       GFS2_LFC_SET_FLAGS);
                 error = filemap_fdatawrite(inode->i_mapping);
                 if (error)
                         goto out;
@@ -924,7 +926,7 @@ static long gfs2_fallocate(struct file *file, int mode, loff_t offset, loff_t le
         struct gfs2_holder gh;
         int ret;
 
-        if (mode & ~FALLOC_FL_KEEP_SIZE)
+        if (mode & ~(FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE))
                 return -EOPNOTSUPP;
         /* fallocate is needed by gfs2_grow to reserve space in the rindex */
         if (gfs2_is_jdata(ip) && inode != sdp->sd_rindex)
@@ -948,13 +950,18 @@ static long gfs2_fallocate(struct file *file, int mode, loff_t offset, loff_t le
         if (ret)
                 goto out_unlock;
 
-        ret = gfs2_rsqa_alloc(ip);
-        if (ret)
-                goto out_putw;
+        if (mode & FALLOC_FL_PUNCH_HOLE) {
+                ret = __gfs2_punch_hole(file, offset, len);
+        } else {
+                ret = gfs2_rsqa_alloc(ip);
+                if (ret)
+                        goto out_putw;
 
-        ret = __gfs2_fallocate(file, mode, offset, len);
-        if (ret)
-                gfs2_rs_deltree(&ip->i_res);
+                ret = __gfs2_fallocate(file, mode, offset, len);
+
+                if (ret)
+                        gfs2_rs_deltree(&ip->i_res);
+        }
 
 out_putw:
         put_write_access(inode);
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 11066d8647d2..82fb5583445c 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1549,16 +1549,13 @@ static void glock_hash_walk(glock_examiner examiner, const struct gfs2_sbd *sdp)
         rhashtable_walk_enter(&gl_hash_table, &iter);
 
         do {
-                gl = ERR_PTR(rhashtable_walk_start(&iter));
-                if (IS_ERR(gl))
-                        goto walk_stop;
+                rhashtable_walk_start(&iter);
 
                 while ((gl = rhashtable_walk_next(&iter)) && !IS_ERR(gl))
                         if (gl->gl_name.ln_sbd == sdp &&
                             lockref_get_not_dead(&gl->gl_lockref))
                                 examiner(gl);
 
-walk_stop:
                 rhashtable_walk_stop(&iter);
         } while (cond_resched(), gl == ERR_PTR(-EAGAIN));
 
@@ -1924,19 +1921,29 @@ void gfs2_glock_exit(void)
         destroy_workqueue(gfs2_delete_workqueue);
 }
 
-static void gfs2_glock_iter_next(struct gfs2_glock_iter *gi)
+static void gfs2_glock_iter_next(struct gfs2_glock_iter *gi, loff_t n)
 {
-        while ((gi->gl = rhashtable_walk_next(&gi->hti))) {
-                if (IS_ERR(gi->gl)) {
-                        if (PTR_ERR(gi->gl) == -EAGAIN)
-                                continue;
-                        gi->gl = NULL;
-                        return;
+        if (n == 0)
+                gi->gl = rhashtable_walk_peek(&gi->hti);
+        else {
+                gi->gl = rhashtable_walk_next(&gi->hti);
+                n--;
+        }
+        for (;;) {
+                if (IS_ERR_OR_NULL(gi->gl)) {
+                        if (!gi->gl)
+                                return;
+                        if (PTR_ERR(gi->gl) != -EAGAIN) {
+                                gi->gl = NULL;
+                                return;
+                        }
+                        n = 0;
+                } else if (gi->sdp == gi->gl->gl_name.ln_sbd &&
+                           !__lockref_is_dead(&gi->gl->gl_lockref)) {
+                        if (!n--)
+                                break;
                 }
-                /* Skip entries for other sb and dead entries */
-                if (gi->sdp == gi->gl->gl_name.ln_sbd &&
-                    !__lockref_is_dead(&gi->gl->gl_lockref))
-                        return;
+                gi->gl = rhashtable_walk_next(&gi->hti);
         }
 }
 
@@ -1944,18 +1951,24 @@ static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(RCU)
 {
         struct gfs2_glock_iter *gi = seq->private;
-        loff_t n = *pos;
+        loff_t n;
 
-        rhashtable_walk_enter(&gl_hash_table, &gi->hti);
-        if (rhashtable_walk_start(&gi->hti) != 0)
-                return NULL;
+        /*
+         * We can either stay where we are, skip to the next hash table
+         * entry, or start from the beginning.
+         */
+        if (*pos < gi->last_pos) {
+                rhashtable_walk_exit(&gi->hti);
+                rhashtable_walk_enter(&gl_hash_table, &gi->hti);
+                n = *pos + 1;
+        } else {
+                n = *pos - gi->last_pos;
+        }
 
-        do {
-                gfs2_glock_iter_next(gi);
-        } while (gi->gl && n--);
+        rhashtable_walk_start(&gi->hti);
 
+        gfs2_glock_iter_next(gi, n);
         gi->last_pos = *pos;
-
         return gi->gl;
 }
 
@@ -1966,8 +1979,7 @@ static void *gfs2_glock_seq_next(struct seq_file *seq, void *iter_ptr,
 
         (*pos)++;
         gi->last_pos = *pos;
-        gfs2_glock_iter_next(gi);
-
+        gfs2_glock_iter_next(gi, 1);
         return gi->gl;
 }
 
@@ -1978,7 +1990,6 @@ static void gfs2_glock_seq_stop(struct seq_file *seq, void *iter_ptr)
 
         gi->gl = NULL;
         rhashtable_walk_stop(&gi->hti);
-        rhashtable_walk_exit(&gi->hti);
 }
 
 static int gfs2_glock_seq_show(struct seq_file *seq, void *iter_ptr)
@@ -2044,7 +2055,13 @@ static int __gfs2_glocks_open(struct inode *inode, struct file *file,
                 seq->buf = kmalloc(GFS2_SEQ_GOODSIZE, GFP_KERNEL | __GFP_NOWARN);
                 if (seq->buf)
                         seq->size = GFS2_SEQ_GOODSIZE;
+                /*
+                 * Initially, we are "before" the first hash table entry; the
+                 * first call to rhashtable_walk_next gets us the first entry.
+                 */
+                gi->last_pos = -1;
                 gi->gl = NULL;
+                rhashtable_walk_enter(&gl_hash_table, &gi->hti);
         }
         return ret;
 }
@@ -2060,6 +2077,7 @@ static int gfs2_glocks_release(struct inode *inode, struct file *file)
         struct gfs2_glock_iter *gi = seq->private;
 
         gi->gl = NULL;
+        rhashtable_walk_exit(&gi->hti);
         return seq_release_private(inode, file);
 }
 
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index cdd1c5f06f45..d8782a7a1e7d 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -107,7 +107,8 @@ static void gfs2_ail_empty_gl(struct gfs2_glock *gl)
         __gfs2_ail_flush(gl, 0, tr.tr_revokes);
 
         gfs2_trans_end(sdp);
-        gfs2_log_flush(sdp, NULL, NORMAL_FLUSH);
+        gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_NORMAL |
+                       GFS2_LFC_AIL_EMPTY_GL);
 }
 
 void gfs2_ail_flush(struct gfs2_glock *gl, bool fsync)
@@ -128,7 +129,8 @@ void gfs2_ail_flush(struct gfs2_glock *gl, bool fsync)
                 return;
         __gfs2_ail_flush(gl, fsync, max_revokes);
         gfs2_trans_end(sdp);
-        gfs2_log_flush(sdp, NULL, NORMAL_FLUSH);
+        gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_NORMAL |
+                       GFS2_LFC_AIL_FLUSH);
 }
 
 /**
@@ -157,7 +159,8 @@ static void rgrp_go_sync(struct gfs2_glock *gl)
                 return;
         GLOCK_BUG_ON(gl, gl->gl_state != LM_ST_EXCLUSIVE);
 
-        gfs2_log_flush(sdp, gl, NORMAL_FLUSH);
+        gfs2_log_flush(sdp, gl, GFS2_LOG_HEAD_FLUSH_NORMAL |
+                       GFS2_LFC_RGRP_GO_SYNC);
         filemap_fdatawrite_range(mapping, gl->gl_vm.start, gl->gl_vm.end);
         error = filemap_fdatawait_range(mapping, gl->gl_vm.start, gl->gl_vm.end);
         mapping_set_error(mapping, error);
@@ -252,7 +255,8 @@ static void inode_go_sync(struct gfs2_glock *gl)
 
         GLOCK_BUG_ON(gl, gl->gl_state != LM_ST_EXCLUSIVE);
 
-        gfs2_log_flush(gl->gl_name.ln_sbd, gl, NORMAL_FLUSH);
+        gfs2_log_flush(gl->gl_name.ln_sbd, gl, GFS2_LOG_HEAD_FLUSH_NORMAL |
+                       GFS2_LFC_INODE_GO_SYNC);
         filemap_fdatawrite(metamapping);
         if (isreg) {
                 struct address_space *mapping = ip->i_inode.i_mapping;
@@ -303,7 +307,9 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
         }
 
         if (ip == GFS2_I(gl->gl_name.ln_sbd->sd_rindex)) {
-                gfs2_log_flush(gl->gl_name.ln_sbd, NULL, NORMAL_FLUSH);
+                gfs2_log_flush(gl->gl_name.ln_sbd, NULL,
+                               GFS2_LOG_HEAD_FLUSH_NORMAL |
+                               GFS2_LFC_INODE_GO_INVAL);
                 gl->gl_name.ln_sbd->sd_rindex_uptodate = 0;
         }
         if (ip && S_ISREG(ip->i_inode.i_mode))
@@ -495,7 +501,8 @@ static void freeze_go_sync(struct gfs2_glock *gl)
                         gfs2_assert_withdraw(sdp, 0);
                 }
                 queue_work(gfs2_freeze_wq, &sdp->sd_freeze_work);
-                gfs2_log_flush(sdp, NULL, FREEZE_FLUSH);
+                gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_FREEZE |
+                               GFS2_LFC_FREEZE_GO_SYNC);
         }
 }
 
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index 6e18e9793ec4..e0557b8a590a 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -44,7 +44,6 @@ struct gfs2_log_header_host {
         u32 lh_flags;           /* GFS2_LOG_HEAD_... */
         u32 lh_tail;            /* Block number of log tail */
         u32 lh_blkno;
-        u32 lh_hash;
 };
 
 /*
@@ -861,5 +860,10 @@ static inline void gfs2_sbstats_inc(const struct gfs2_glock *gl, int which)
 
 extern struct gfs2_rgrpd *gfs2_glock2rgrp(struct gfs2_glock *gl);
 
+static inline unsigned gfs2_max_stuffed_size(const struct gfs2_inode *ip)
+{
+        return GFS2_SB(&ip->i_inode)->sd_sb.sb_bsize - sizeof(struct gfs2_dinode);
+}
+
 #endif /* __INCORE_DOT_H__ */
 
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 4e971b1c7f92..59e0560180ec 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -1152,12 +1152,11 @@ static int gfs2_unlink(struct inode *dir, struct dentry *dentry)
 
         error = gfs2_trans_begin(sdp, 2*RES_DINODE + 3*RES_LEAF + RES_RG_BIT, 0);
         if (error)
-                goto out_end_trans;
+                goto out_gunlock;
 
         error = gfs2_unlink_inode(dip, dentry);
-
-out_end_trans:
         gfs2_trans_end(sdp);
+
 out_gunlock:
         gfs2_glock_dq(ghs + 2);
 out_rgrp:
@@ -1184,11 +1183,10 @@ out_inodes:
 static int gfs2_symlink(struct inode *dir, struct dentry *dentry,
                         const char *symname)
 {
-        struct gfs2_sbd *sdp = GFS2_SB(dir);
         unsigned int size;
 
         size = strlen(symname);
-        if (size > sdp->sd_sb.sb_bsize - sizeof(struct gfs2_dinode) - 1)
+        if (size >= gfs2_max_stuffed_size(GFS2_I(dir)))
                 return -ENAMETOOLONG;
 
         return gfs2_create_inode(dir, dentry, NULL, S_IFLNK | S_IRWXUGO, 0, symname, size, 0, NULL);
@@ -1205,8 +1203,7 @@ static int gfs2_symlink(struct inode *dir, struct dentry *dentry,
 
 static int gfs2_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
 {
-        struct gfs2_sbd *sdp = GFS2_SB(dir);
-        unsigned dsize = sdp->sd_sb.sb_bsize - sizeof(struct gfs2_dinode);
+        unsigned dsize = gfs2_max_stuffed_size(GFS2_I(dir));
         return gfs2_create_inode(dir, dentry, NULL, S_IFDIR | mode, 0, NULL, dsize, 0, NULL);
 }
 
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index 65f33a0ac190..006c6164f759 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -1091,7 +1091,7 @@ static void gdlm_recover_slot(void *arg, struct dlm_slot *slot)
 
         spin_lock(&ls->ls_recover_spin);
         if (ls->ls_recover_size < jid + 1) {
-                fs_err(sdp, "recover_slot jid %d gen %u short size %d",
+                fs_err(sdp, "recover_slot jid %d gen %u short size %d\n",
                        jid, ls->ls_recover_block, ls->ls_recover_size);
                 spin_unlock(&ls->ls_recover_spin);
                 return;
@@ -1153,7 +1153,7 @@ static void gdlm_recovery_result(struct gfs2_sbd *sdp, unsigned int jid,
                 return;
         }
         if (ls->ls_recover_size < jid + 1) {
-                fs_err(sdp, "recovery_result jid %d short size %d",
+                fs_err(sdp, "recovery_result jid %d short size %d\n",
                        jid, ls->ls_recover_size);
                 spin_unlock(&ls->ls_recover_spin);
                 return;
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index f72c44231406..cf6b46247df4 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -14,6 +14,7 @@
 #include <linux/buffer_head.h>
 #include <linux/gfs2_ondisk.h>
 #include <linux/crc32.h>
+#include <linux/crc32c.h>
 #include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/freezer.h>
@@ -538,9 +539,12 @@ static void gfs2_ordered_write(struct gfs2_sbd *sdp)
         list_sort(NULL, &sdp->sd_log_le_ordered, &ip_cmp);
         while (!list_empty(&sdp->sd_log_le_ordered)) {
                 ip = list_entry(sdp->sd_log_le_ordered.next, struct gfs2_inode, i_ordered);
-                list_move(&ip->i_ordered, &written);
-                if (ip->i_inode.i_mapping->nrpages == 0)
+                if (ip->i_inode.i_mapping->nrpages == 0) {
+                        test_and_clear_bit(GIF_ORDERED, &ip->i_flags);
+                        list_del(&ip->i_ordered);
                         continue;
+                }
+                list_move(&ip->i_ordered, &written);
                 spin_unlock(&sdp->sd_ordered_lock);
                 filemap_fdatawrite(ip->i_inode.i_mapping);
                 spin_lock(&sdp->sd_ordered_lock);
@@ -648,49 +652,102 @@ out_of_blocks:
 }
 
 /**
- * log_write_header - Get and initialize a journal header buffer
+ * write_log_header - Write a journal log header buffer at sd_log_flush_head
  * @sdp: The GFS2 superblock
+ * @jd: journal descriptor of the journal to which we are writing
+ * @seq: sequence number
+ * @tail: tail of the log
+ * @flags: log header flags GFS2_LOG_HEAD_*
+ * @op_flags: flags to pass to the bio
  *
  * Returns: the initialized log buffer descriptor
  */
 
-static void log_write_header(struct gfs2_sbd *sdp, u32 flags)
+void gfs2_write_log_header(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,
+                           u64 seq, u32 tail, u32 flags, int op_flags)
 {
         struct gfs2_log_header *lh;
-        unsigned int tail;
-        u32 hash;
-        int op_flags = REQ_PREFLUSH | REQ_FUA | REQ_META | REQ_SYNC;
+        u32 hash, crc;
         struct page *page = mempool_alloc(gfs2_page_pool, GFP_NOIO);
-        enum gfs2_freeze_state state = atomic_read(&sdp->sd_freeze_state);
+        struct gfs2_statfs_change_host *l_sc = &sdp->sd_statfs_local;
+        struct timespec64 tv;
+        struct super_block *sb = sdp->sd_vfs;
+        u64 addr;
+
         lh = page_address(page);
         clear_page(lh);
 
-        gfs2_assert_withdraw(sdp, (state != SFS_FROZEN));
-
-        tail = current_tail(sdp);
-
         lh->lh_header.mh_magic = cpu_to_be32(GFS2_MAGIC);
         lh->lh_header.mh_type = cpu_to_be32(GFS2_METATYPE_LH);
         lh->lh_header.__pad0 = cpu_to_be64(0);
         lh->lh_header.mh_format = cpu_to_be32(GFS2_FORMAT_LH);
         lh->lh_header.mh_jid = cpu_to_be32(sdp->sd_jdesc->jd_jid);
-        lh->lh_sequence = cpu_to_be64(sdp->sd_log_sequence++);
+        lh->lh_sequence = cpu_to_be64(seq);
         lh->lh_flags = cpu_to_be32(flags);
         lh->lh_tail = cpu_to_be32(tail);
         lh->lh_blkno = cpu_to_be32(sdp->sd_log_flush_head);
-        hash = gfs2_disk_hash(page_address(page), sizeof(struct gfs2_log_header));
+        hash = ~crc32(~0, lh, LH_V1_SIZE);
         lh->lh_hash = cpu_to_be32(hash);
 
+        tv = current_kernel_time64();
+        lh->lh_nsec = cpu_to_be32(tv.tv_nsec);
+        lh->lh_sec = cpu_to_be64(tv.tv_sec);
+        addr = gfs2_log_bmap(sdp);
+        lh->lh_addr = cpu_to_be64(addr);
+        lh->lh_jinode = cpu_to_be64(GFS2_I(jd->jd_inode)->i_no_addr);
+
+        /* We may only write local statfs, quota, etc., when writing to our
+           own journal. The values are left 0 when recovering a journal
+           different from our own. */
+        if (!(flags & GFS2_LOG_HEAD_RECOVERY)) {
+                lh->lh_statfs_addr =
+                        cpu_to_be64(GFS2_I(sdp->sd_sc_inode)->i_no_addr);
+                lh->lh_quota_addr =
+                        cpu_to_be64(GFS2_I(sdp->sd_qc_inode)->i_no_addr);
+
+                spin_lock(&sdp->sd_statfs_spin);
+                lh->lh_local_total = cpu_to_be64(l_sc->sc_total);
+                lh->lh_local_free = cpu_to_be64(l_sc->sc_free);
+                lh->lh_local_dinodes = cpu_to_be64(l_sc->sc_dinodes);
+                spin_unlock(&sdp->sd_statfs_spin);
+        }
+
+        BUILD_BUG_ON(offsetof(struct gfs2_log_header, lh_crc) != LH_V1_SIZE);
+
+        crc = crc32c(~0, (void *)lh + LH_V1_SIZE + 4,
+                     sb->s_blocksize - LH_V1_SIZE - 4);
+        lh->lh_crc = cpu_to_be32(crc);
+
+        gfs2_log_write(sdp, page, sb->s_blocksize, 0, addr);
+        gfs2_log_flush_bio(sdp, REQ_OP_WRITE, op_flags);
+        log_flush_wait(sdp);
+}
+
+/**
+ * log_write_header - Get and initialize a journal header buffer
+ * @sdp: The GFS2 superblock
+ * @flags: The log header flags, including log header origin
+ *
+ * Returns: the initialized log buffer descriptor
+ */
+
+static void log_write_header(struct gfs2_sbd *sdp, u32 flags)
+{
+        unsigned int tail;
+        int op_flags = REQ_PREFLUSH | REQ_FUA | REQ_META | REQ_SYNC;
+        enum gfs2_freeze_state state = atomic_read(&sdp->sd_freeze_state);
+
+        gfs2_assert_withdraw(sdp, (state != SFS_FROZEN));
+        tail = current_tail(sdp);
+
         if (test_bit(SDF_NOBARRIERS, &sdp->sd_flags)) {
                 gfs2_ordered_wait(sdp);
                 log_flush_wait(sdp);
                 op_flags = REQ_SYNC | REQ_META | REQ_PRIO;
         }
-
         sdp->sd_log_idle = (tail == sdp->sd_log_flush_head);
-        gfs2_log_write_page(sdp, page);
-        gfs2_log_flush_bio(sdp, REQ_OP_WRITE, op_flags);
-        log_flush_wait(sdp);
+        gfs2_write_log_header(sdp, sdp->sd_jdesc, sdp->sd_log_sequence++, tail,
+                              flags, op_flags);
 
         if (sdp->sd_log_tail != tail)
                 log_pull_tail(sdp, tail);
@@ -700,11 +757,11 @@ static void log_write_header(struct gfs2_sbd *sdp, u32 flags)
  * gfs2_log_flush - flush incore transaction(s)
  * @sdp: the filesystem
  * @gl: The glock structure to flush.  If NULL, flush the whole incore log
+ * @flags: The log header flags: GFS2_LOG_HEAD_FLUSH_* and debug flags
  *
  */
 
-void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl,
-                    enum gfs2_flush_type type)
+void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)
 {
         struct gfs2_trans *tr;
         enum gfs2_freeze_state state = atomic_read(&sdp->sd_freeze_state);
@@ -716,9 +773,9 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl,
                 up_write(&sdp->sd_log_flush_lock);
                 return;
         }
-        trace_gfs2_log_flush(sdp, 1);
+        trace_gfs2_log_flush(sdp, 1, flags);
 
-        if (type == SHUTDOWN_FLUSH)
+        if (flags & GFS2_LOG_HEAD_FLUSH_SHUTDOWN)
                 clear_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
 
         sdp->sd_log_flush_head = sdp->sd_log_head;
@@ -743,11 +800,11 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl,
 
         if (sdp->sd_log_head != sdp->sd_log_flush_head) {
                 log_flush_wait(sdp);
-                log_write_header(sdp, 0);
+                log_write_header(sdp, flags);
         } else if (sdp->sd_log_tail != current_tail(sdp) && !sdp->sd_log_idle){
                 atomic_dec(&sdp->sd_log_blks_free); /* Adjust for unreserved buffer */
                 trace_gfs2_log_blocks(sdp, -1);
-                log_write_header(sdp, 0);
+                log_write_header(sdp, flags);
         }
         lops_after_commit(sdp, tr);
 
@@ -764,7 +821,7 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl,
         spin_unlock(&sdp->sd_ail_lock);
         gfs2_log_unlock(sdp);
 
-        if (type != NORMAL_FLUSH) {
+        if (!(flags & GFS2_LOG_HEAD_FLUSH_NORMAL)) {
                 if (!sdp->sd_log_idle) {
                         for (;;) {
                                 gfs2_ail1_start(sdp);
@@ -774,16 +831,17 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl,
                         }
                         atomic_dec(&sdp->sd_log_blks_free); /* Adjust for unreserved buffer */
                         trace_gfs2_log_blocks(sdp, -1);
-                        log_write_header(sdp, 0);
+                        log_write_header(sdp, flags);
                         sdp->sd_log_head = sdp->sd_log_flush_head;
                 }
-                if (type == SHUTDOWN_FLUSH || type == FREEZE_FLUSH)
+                if (flags & (GFS2_LOG_HEAD_FLUSH_SHUTDOWN |
+                             GFS2_LOG_HEAD_FLUSH_FREEZE))
                         gfs2_log_shutdown(sdp);
-                if (type == FREEZE_FLUSH)
+                if (flags & GFS2_LOG_HEAD_FLUSH_FREEZE)
                         atomic_set(&sdp->sd_freeze_state, SFS_FROZEN);
         }
 
-        trace_gfs2_log_flush(sdp, 0);
+        trace_gfs2_log_flush(sdp, 0, flags);
         up_write(&sdp->sd_log_flush_lock);
 
         kfree(tr);
@@ -879,7 +937,7 @@ void gfs2_log_shutdown(struct gfs2_sbd *sdp)
 
         sdp->sd_log_flush_head = sdp->sd_log_head;
 
-        log_write_header(sdp, GFS2_LOG_HEAD_UNMOUNT);
+        log_write_header(sdp, GFS2_LOG_HEAD_UNMOUNT | GFS2_LFC_SHUTDOWN);
 
         gfs2_assert_warn(sdp, sdp->sd_log_head == sdp->sd_log_tail);
         gfs2_assert_warn(sdp, list_empty(&sdp->sd_ail2_list));
@@ -935,7 +993,8 @@ int gfs2_logd(void *data)
                 did_flush = false;
                 if (gfs2_jrnl_flush_reqd(sdp) || t == 0) {
                         gfs2_ail1_empty(sdp);
-                        gfs2_log_flush(sdp, NULL, NORMAL_FLUSH);
+                        gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_NORMAL |
+                                       GFS2_LFC_LOGD_JFLUSH_REQD);
                         did_flush = true;
                 }
 
@@ -943,7 +1002,8 @@ int gfs2_logd(void *data)
                         gfs2_ail1_start(sdp);
                         gfs2_ail1_wait(sdp);
                         gfs2_ail1_empty(sdp);
-                        gfs2_log_flush(sdp, NULL, NORMAL_FLUSH);
+                        gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_NORMAL |
+                                       GFS2_LFC_LOGD_AIL_FLUSH_REQD);
                         did_flush = true;
                 }
 
diff --git a/fs/gfs2/log.h b/fs/gfs2/log.h
index 9499a6049212..93b52ac1ca1f 100644
--- a/fs/gfs2/log.h
+++ b/fs/gfs2/log.h
@@ -65,14 +65,10 @@ extern unsigned int gfs2_struct2blk(struct gfs2_sbd *sdp, unsigned int nstruct,
 
 extern void gfs2_log_release(struct gfs2_sbd *sdp, unsigned int blks);
 extern int gfs2_log_reserve(struct gfs2_sbd *sdp, unsigned int blks);
-enum gfs2_flush_type {
-        NORMAL_FLUSH = 0,
-        SYNC_FLUSH,
-        SHUTDOWN_FLUSH,
-        FREEZE_FLUSH
-};
+extern void gfs2_write_log_header(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,
+                                  u64 seq, u32 tail, u32 flags, int op_flags);
 extern void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl,
-                           enum gfs2_flush_type type);
+                           u32 type);
 extern void gfs2_log_commit(struct gfs2_sbd *sdp, struct gfs2_trans *trans);
 extern void gfs2_remove_from_ail(struct gfs2_bufdata *bd);
 extern void gfs2_ail1_flush(struct gfs2_sbd *sdp, struct writeback_control *wbc);
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index c8ff7b7954f0..4d6567990baf 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -18,6 +18,7 @@
 #include <linux/fs.h>
 #include <linux/list_sort.h>
 
+#include "dir.h"
 #include "gfs2.h"
 #include "incore.h"
 #include "inode.h"
@@ -138,7 +139,7 @@ static void gfs2_log_incr_head(struct gfs2_sbd *sdp)
                 sdp->sd_log_flush_head = 0;
 }
 
-static u64 gfs2_log_bmap(struct gfs2_sbd *sdp)
+u64 gfs2_log_bmap(struct gfs2_sbd *sdp)
 {
         unsigned int lbn = sdp->sd_log_flush_head;
         struct gfs2_journal_extent *je;
@@ -161,7 +162,7 @@ static u64 gfs2_log_bmap(struct gfs2_sbd *sdp)
  * @bvec: The bio_vec
  * @error: The i/o status
  *
- * This finds the relavent buffers and unlocks then and sets the
+ * This finds the relevant buffers and unlocks them and sets the
  * error flag according to the status of the i/o request. This is
  * used when the log is writing data which has an in-place version
  * that is pinned in the pagecache.
@@ -306,23 +307,22 @@ static struct bio *gfs2_log_get_bio(struct gfs2_sbd *sdp, u64 blkno)
         return gfs2_log_alloc_bio(sdp, blkno);
 }
 
-
 /**
  * gfs2_log_write - write to log
  * @sdp: the filesystem
  * @page: the page to write
  * @size: the size of the data to write
  * @offset: the offset within the page 
+ * @blkno: block number of the log entry
  *
  * Try and add the page segment to the current bio. If that fails,
  * submit the current bio to the device and create a new one, and
  * then add the page segment to that.
  */
 
-static void gfs2_log_write(struct gfs2_sbd *sdp, struct page *page,
-                           unsigned size, unsigned offset)
+void gfs2_log_write(struct gfs2_sbd *sdp, struct page *page,
+                    unsigned size, unsigned offset, u64 blkno)
 {
-        u64 blkno = gfs2_log_bmap(sdp);
         struct bio *bio;
         int ret;
 
@@ -348,7 +348,8 @@ static void gfs2_log_write(struct gfs2_sbd *sdp, struct page *page,
 
 static void gfs2_log_write_bh(struct gfs2_sbd *sdp, struct buffer_head *bh)
 {
-        gfs2_log_write(sdp, bh->b_page, bh->b_size, bh_offset(bh));
+        gfs2_log_write(sdp, bh->b_page, bh->b_size, bh_offset(bh),
+                       gfs2_log_bmap(sdp));
 }
 
 /**
@@ -365,7 +366,8 @@ static void gfs2_log_write_bh(struct gfs2_sbd *sdp, struct buffer_head *bh)
 void gfs2_log_write_page(struct gfs2_sbd *sdp, struct page *page)
 {
         struct super_block *sb = sdp->sd_vfs;
-        gfs2_log_write(sdp, page, sb->s_blocksize, 0);
+        gfs2_log_write(sdp, page, sb->s_blocksize, 0,
+                       gfs2_log_bmap(sdp));
 }
 
 static struct page *gfs2_get_log_desc(struct gfs2_sbd *sdp, u32 ld_type,
diff --git a/fs/gfs2/lops.h b/fs/gfs2/lops.h
index e529f536c117..e4949394f054 100644
--- a/fs/gfs2/lops.h
+++ b/fs/gfs2/lops.h
@@ -26,6 +26,9 @@ extern const struct gfs2_log_operations gfs2_revoke_lops;
 extern const struct gfs2_log_operations gfs2_databuf_lops;
 
 extern const struct gfs2_log_operations *gfs2_log_ops[];
+extern u64 gfs2_log_bmap(struct gfs2_sbd *sdp);
+extern void gfs2_log_write(struct gfs2_sbd *sdp, struct page *page,
+                           unsigned size, unsigned offset, u64 blkno);
 extern void gfs2_log_write_page(struct gfs2_sbd *sdp, struct page *page);
 extern void gfs2_log_flush_bio(struct gfs2_sbd *sdp, int op, int op_flags);
 extern void gfs2_pin(struct gfs2_sbd *sdp, struct buffer_head *bh);
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index 0a89e6f7a314..2d55e2c3333c 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -93,7 +93,7 @@ static int __init init_gfs2_fs(void)
 
         error = gfs2_glock_init();
         if (error)
-                goto fail;
+                goto fail_glock;
 
         error = -ENOMEM;
         gfs2_glock_cachep = kmem_cache_create("gfs2_glock",
@@ -101,7 +101,7 @@ static int __init init_gfs2_fs(void)
                                               0, 0,
                                               gfs2_init_glock_once);
         if (!gfs2_glock_cachep)
-                goto fail;
+                goto fail_cachep1;
 
         gfs2_glock_aspace_cachep = kmem_cache_create("gfs2_glock(aspace)",
                                         sizeof(struct gfs2_glock) +
@@ -109,7 +109,7 @@ static int __init init_gfs2_fs(void)
                                         0, 0, gfs2_init_gl_aspace_once);
 
         if (!gfs2_glock_aspace_cachep)
-                goto fail;
+                goto fail_cachep2;
 
         gfs2_inode_cachep = kmem_cache_create("gfs2_inode",
                                               sizeof(struct gfs2_inode),
@@ -118,107 +118,105 @@ static int __init init_gfs2_fs(void)
                                                   SLAB_ACCOUNT,
                                               gfs2_init_inode_once);
         if (!gfs2_inode_cachep)
-                goto fail;
+                goto fail_cachep3;
 
         gfs2_bufdata_cachep = kmem_cache_create("gfs2_bufdata",
                                                 sizeof(struct gfs2_bufdata),
                                                 0, 0, NULL);
         if (!gfs2_bufdata_cachep)
-                goto fail;
+                goto fail_cachep4;
 
         gfs2_rgrpd_cachep = kmem_cache_create("gfs2_rgrpd",
                                               sizeof(struct gfs2_rgrpd),
                                               0, 0, NULL);
         if (!gfs2_rgrpd_cachep)
-                goto fail;
+                goto fail_cachep5;
 
         gfs2_quotad_cachep = kmem_cache_create("gfs2_quotad",
                                                sizeof(struct gfs2_quota_data),
                                                0, 0, NULL);
         if (!gfs2_quotad_cachep)
-                goto fail;
+                goto fail_cachep6;
 
         gfs2_qadata_cachep = kmem_cache_create("gfs2_qadata",
                                                sizeof(struct gfs2_qadata),
                                                0, 0, NULL);
         if (!gfs2_qadata_cachep)
-                goto fail;
+                goto fail_cachep7;
 
         error = register_shrinker(&gfs2_qd_shrinker);
         if (error)
-                goto fail;
+                goto fail_shrinker;
 
         error = register_filesystem(&gfs2_fs_type);
         if (error)
-                goto fail;
+                goto fail_fs1;
 
         error = register_filesystem(&gfs2meta_fs_type);
         if (error)
-                goto fail_unregister;
+                goto fail_fs2;
 
         error = -ENOMEM;
         gfs_recovery_wq = alloc_workqueue("gfs_recovery",
                                           WQ_MEM_RECLAIM | WQ_FREEZABLE, 0);
         if (!gfs_recovery_wq)
-                goto fail_wq;
+                goto fail_wq1;
 
         gfs2_control_wq = alloc_workqueue("gfs2_control",
                                           WQ_UNBOUND | WQ_FREEZABLE, 0);
         if (!gfs2_control_wq)
-                goto fail_recovery;
+                goto fail_wq2;
 
         gfs2_freeze_wq = alloc_workqueue("freeze_workqueue", 0, 0);
 
         if (!gfs2_freeze_wq)
-                goto fail_control;
+                goto fail_wq3;
 
         gfs2_page_pool = mempool_create_page_pool(64, 0);
         if (!gfs2_page_pool)
-                goto fail_freeze;
+                goto fail_mempool;
 
-        gfs2_register_debugfs();
+        error = gfs2_register_debugfs();
+        if (error)
+                goto fail_debugfs;
 
         pr_info("GFS2 installed\n");
 
         return 0;
 
-fail_freeze:
+fail_debugfs:
+        mempool_destroy(gfs2_page_pool);
+fail_mempool:
         destroy_workqueue(gfs2_freeze_wq);
-fail_control:
+fail_wq3:
         destroy_workqueue(gfs2_control_wq);
-fail_recovery:
+fail_wq2:
         destroy_workqueue(gfs_recovery_wq);
-fail_wq:
+fail_wq1:
         unregister_filesystem(&gfs2meta_fs_type);
-fail_unregister:
+fail_fs2:
         unregister_filesystem(&gfs2_fs_type);
-fail:
-        list_lru_destroy(&gfs2_qd_lru);
-fail_lru:
+fail_fs1:
         unregister_shrinker(&gfs2_qd_shrinker);
+fail_shrinker:
+        kmem_cache_destroy(gfs2_qadata_cachep);
+fail_cachep7:
+        kmem_cache_destroy(gfs2_quotad_cachep);
+fail_cachep6:
+        kmem_cache_destroy(gfs2_rgrpd_cachep);
+fail_cachep5:
+        kmem_cache_destroy(gfs2_bufdata_cachep);
+fail_cachep4:
+        kmem_cache_destroy(gfs2_inode_cachep);
+fail_cachep3:
+        kmem_cache_destroy(gfs2_glock_aspace_cachep);
+fail_cachep2:
+        kmem_cache_destroy(gfs2_glock_cachep);
+fail_cachep1:
         gfs2_glock_exit();
-
-        if (gfs2_qadata_cachep)
-                kmem_cache_destroy(gfs2_qadata_cachep);
-
-        if (gfs2_quotad_cachep)
-                kmem_cache_destroy(gfs2_quotad_cachep);
-
-        if (gfs2_rgrpd_cachep)
-                kmem_cache_destroy(gfs2_rgrpd_cachep);
-
-        if (gfs2_bufdata_cachep)
-                kmem_cache_destroy(gfs2_bufdata_cachep);
-
-        if (gfs2_inode_cachep)
-                kmem_cache_destroy(gfs2_inode_cachep);
-
-        if (gfs2_glock_aspace_cachep)
-                kmem_cache_destroy(gfs2_glock_aspace_cachep);
-
-        if (gfs2_glock_cachep)
-                kmem_cache_destroy(gfs2_glock_cachep);
-
+fail_glock:
+        list_lru_destroy(&gfs2_qd_lru);
+fail_lru:
         gfs2_sys_uninit();
         return error;
 }
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index ad55eb86a250..e6a0a8a89ea7 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1382,7 +1382,7 @@ static void gfs2_kill_sb(struct super_block *sb)
                 return;
         }
 
-        gfs2_log_flush(sdp, NULL, SYNC_FLUSH);
+        gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_SYNC | GFS2_LFC_KILL_SB);
         dput(sdp->sd_root_dir);
         dput(sdp->sd_master_dir);
         sdp->sd_root_dir = NULL;
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index e700fb162664..7a98abd340ee 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -955,7 +955,8 @@ out:
                 gfs2_glock_dq_uninit(&ghs[qx]);
         inode_unlock(&ip->i_inode);
         kfree(ghs);
-        gfs2_log_flush(ip->i_gl->gl_name.ln_sbd, ip->i_gl, NORMAL_FLUSH);
+        gfs2_log_flush(ip->i_gl->gl_name.ln_sbd, ip->i_gl,
+                       GFS2_LOG_HEAD_FLUSH_NORMAL | GFS2_LFC_DO_SYNC);
         return error;
 }
 
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index 9395a3db1a60..b6b258998bcd 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -14,12 +14,14 @@
 #include <linux/buffer_head.h>
 #include <linux/gfs2_ondisk.h>
 #include <linux/crc32.h>
+#include <linux/crc32c.h>
 
 #include "gfs2.h"
 #include "incore.h"
 #include "bmap.h"
 #include "glock.h"
 #include "glops.h"
+#include "log.h"
 #include "lops.h"
 #include "meta_io.h"
 #include "recovery.h"
@@ -117,22 +119,6 @@ void gfs2_revoke_clean(struct gfs2_jdesc *jd)
         }
 }
 
-static int gfs2_log_header_in(struct gfs2_log_header_host *lh, const void *buf)
-{
-        const struct gfs2_log_header *str = buf;
-
-        if (str->lh_header.mh_magic != cpu_to_be32(GFS2_MAGIC) ||
-            str->lh_header.mh_type != cpu_to_be32(GFS2_METATYPE_LH))
-                return 1;
-
-        lh->lh_sequence = be64_to_cpu(str->lh_sequence);
-        lh->lh_flags = be32_to_cpu(str->lh_flags);
-        lh->lh_tail = be32_to_cpu(str->lh_tail);
-        lh->lh_blkno = be32_to_cpu(str->lh_blkno);
-        lh->lh_hash = be32_to_cpu(str->lh_hash);
-        return 0;
-}
-
 /**
  * get_log_header - read the log header for a given segment
  * @jd: the journal
@@ -150,29 +136,37 @@ static int gfs2_log_header_in(struct gfs2_log_header_host *lh, const void *buf)
 static int get_log_header(struct gfs2_jdesc *jd, unsigned int blk,
                           struct gfs2_log_header_host *head)
 {
+        struct gfs2_log_header *lh;
         struct buffer_head *bh;
-        struct gfs2_log_header_host uninitialized_var(lh);
-        const u32 nothing = 0;
-        u32 hash;
+        u32 hash, crc;
         int error;
 
         error = gfs2_replay_read_block(jd, blk, &bh);
         if (error)
                 return error;
+        lh = (void *)bh->b_data;
 
-        hash = crc32_le((u32)~0, bh->b_data, sizeof(struct gfs2_log_header) -
-                                             sizeof(u32));
-        hash = crc32_le(hash, (unsigned char const *)&nothing, sizeof(nothing));
-        hash ^= (u32)~0;
-        error = gfs2_log_header_in(&lh, bh->b_data);
-        brelse(bh);
+        hash = crc32(~0, lh, LH_V1_SIZE - 4);
+        hash = ~crc32_le_shift(hash, 4);  /* assume lh_hash is zero */
 
-        if (error || lh.lh_blkno != blk || lh.lh_hash != hash)
-                return 1;
+        crc = crc32c(~0, (void *)lh + LH_V1_SIZE + 4,
+                     bh->b_size - LH_V1_SIZE - 4);
 
-        *head = lh;
+        error = lh->lh_header.mh_magic != cpu_to_be32(GFS2_MAGIC) ||
+                lh->lh_header.mh_type != cpu_to_be32(GFS2_METATYPE_LH) ||
+                be32_to_cpu(lh->lh_blkno) != blk ||
+                be32_to_cpu(lh->lh_hash) != hash ||
+                (lh->lh_crc != 0 && be32_to_cpu(lh->lh_crc) != crc);
 
-        return 0;
+        brelse(bh);
+
+        if (!error) {
+                head->lh_sequence = be64_to_cpu(lh->lh_sequence);
+                head->lh_flags = be32_to_cpu(lh->lh_flags);
+                head->lh_tail = be32_to_cpu(lh->lh_tail);
+                head->lh_blkno = be32_to_cpu(lh->lh_blkno);
+        }
+        return error;
 }
 
 /**
@@ -370,62 +364,22 @@ static int foreach_descriptor(struct gfs2_jdesc *jd, unsigned int start,
 
 /**
  * clean_journal - mark a dirty journal as being clean
- * @sdp: the filesystem
  * @jd: the journal
- * @gl: the journal's glock
  * @head: the head journal to start from
  *
  * Returns: errno
  */
 
-static int clean_journal(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
+static void clean_journal(struct gfs2_jdesc *jd,
+                          struct gfs2_log_header_host *head)
 {
-        struct gfs2_inode *ip = GFS2_I(jd->jd_inode);
         struct gfs2_sbd *sdp = GFS2_SB(jd->jd_inode);
-        unsigned int lblock;
-        struct gfs2_log_header *lh;
-        u32 hash;
-        struct buffer_head *bh;
-        int error;
-        struct buffer_head bh_map = { .b_state = 0, .b_blocknr = 0 };
-
-        lblock = head->lh_blkno;
-        gfs2_replay_incr_blk(jd, &lblock);
-        bh_map.b_size = 1 << ip->i_inode.i_blkbits;
-        error = gfs2_block_map(&ip->i_inode, lblock, &bh_map, 0);
-        if (error)
-                return error;
-        if (!bh_map.b_blocknr) {
-                gfs2_consist_inode(ip);
-                return -EIO;
-        }
-
-        bh = sb_getblk(sdp->sd_vfs, bh_map.b_blocknr);
-        lock_buffer(bh);
-        memset(bh->b_data, 0, bh->b_size);
-        set_buffer_uptodate(bh);
-        clear_buffer_dirty(bh);
-        unlock_buffer(bh);
-
-        lh = (struct gfs2_log_header *)bh->b_data;
-        memset(lh, 0, sizeof(struct gfs2_log_header));
-        lh->lh_header.mh_magic = cpu_to_be32(GFS2_MAGIC);
-        lh->lh_header.mh_type = cpu_to_be32(GFS2_METATYPE_LH);
-        lh->lh_header.__pad0 = cpu_to_be64(0);
-        lh->lh_header.mh_format = cpu_to_be32(GFS2_FORMAT_LH);
-        lh->lh_header.mh_jid = cpu_to_be32(sdp->sd_jdesc->jd_jid);
-        lh->lh_sequence = cpu_to_be64(head->lh_sequence + 1);
-        lh->lh_flags = cpu_to_be32(GFS2_LOG_HEAD_UNMOUNT);
-        lh->lh_blkno = cpu_to_be32(lblock);
-        hash = gfs2_disk_hash((const char *)lh, sizeof(struct gfs2_log_header));
-        lh->lh_hash = cpu_to_be32(hash);
-
-        set_buffer_dirty(bh);
-        if (sync_dirty_buffer(bh))
-                gfs2_io_error_bh(sdp, bh);
-        brelse(bh);
 
-        return error;
+        sdp->sd_log_flush_head = head->lh_blkno;
+        gfs2_replay_incr_blk(jd, &sdp->sd_log_flush_head);
+        gfs2_write_log_header(sdp, jd, head->lh_sequence + 1, 0,
+                              GFS2_LOG_HEAD_UNMOUNT | GFS2_LOG_HEAD_RECOVERY,
+                              REQ_PREFLUSH | REQ_FUA | REQ_META | REQ_SYNC);
 }
 
 
@@ -552,9 +506,7 @@ void gfs2_recover_func(struct work_struct *work)
                                 goto fail_gunlock_thaw;
                 }
 
-                error = clean_journal(jd, &head);
-                if (error)
-                        goto fail_gunlock_thaw;
+                clean_journal(jd, &head);
 
                 gfs2_glock_dq_uninit(&thaw_gh);
                 t = DIV_ROUND_UP(jiffies - t, HZ);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 95b2a57ded33..8b683917a27e 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -34,6 +34,7 @@
 #include "log.h"
 #include "inode.h"
 #include "trace_gfs2.h"
+#include "dir.h"
 
 #define BFITNOENT ((u32)~0)
 #define NO_BLOCK ((u64)~0)
@@ -489,6 +490,13 @@ void gfs2_rgrp_verify(struct gfs2_rgrpd *rgd)
  * @blk: The data block number
  * @exact: True if this needs to be an exact match
  *
+ * The @exact argument should be set to true by most callers. The exception
+ * is when we need to match blocks which are not represented by the rgrp
+ * bitmap, but which are part of the rgrp (i.e. padding blocks) which are
+ * there for alignment purposes. Another way of looking at it is that @exact
+ * matches only valid data/metadata blocks, but with @exact false, it will
+ * match any block within the extent of the rgrp.
+ *
  * Returns: The resource group, or NULL if not found
  */
 
@@ -1040,17 +1048,30 @@ static void gfs2_rgrp_in(struct gfs2_rgrpd *rgd, const void *buf)
         rgd->rd_free = be32_to_cpu(str->rg_free);
         rgd->rd_dinodes = be32_to_cpu(str->rg_dinodes);
         rgd->rd_igeneration = be64_to_cpu(str->rg_igeneration);
+        /* rd_data0, rd_data and rd_bitbytes already set from rindex */
 }
 
 static void gfs2_rgrp_out(struct gfs2_rgrpd *rgd, void *buf)
 {
+        struct gfs2_rgrpd *next = gfs2_rgrpd_get_next(rgd);
         struct gfs2_rgrp *str = buf;
+        u32 crc;
 
         str->rg_flags = cpu_to_be32(rgd->rd_flags & ~GFS2_RDF_MASK);
         str->rg_free = cpu_to_be32(rgd->rd_free);
         str->rg_dinodes = cpu_to_be32(rgd->rd_dinodes);
-        str->__pad = cpu_to_be32(0);
+        if (next == NULL)
+                str->rg_skip = 0;
+        else if (next->rd_addr > rgd->rd_addr)
+                str->rg_skip = cpu_to_be32(next->rd_addr - rgd->rd_addr);
         str->rg_igeneration = cpu_to_be64(rgd->rd_igeneration);
+        str->rg_data0 = cpu_to_be64(rgd->rd_data0);
+        str->rg_data = cpu_to_be32(rgd->rd_data);
+        str->rg_bitbytes = cpu_to_be32(rgd->rd_bitbytes);
+        str->rg_crc = 0;
+        crc = gfs2_disk_hash(buf, sizeof(struct gfs2_rgrp));
+        str->rg_crc = cpu_to_be32(crc);
+
         memset(&str->rg_reserved, 0, sizeof(str->rg_reserved));
 }
 
@@ -1318,7 +1339,7 @@ start_new_extent:
 
 fail:
         if (sdp->sd_args.ar_discard)
-                fs_warn(sdp, "error %d on discard request, turning discards off for this filesystem", rv);
+                fs_warn(sdp, "error %d on discard request, turning discards off for this filesystem\n", rv);
         sdp->sd_args.ar_discard = 0;
         return -EIO;
 }
@@ -2072,7 +2093,8 @@ next_rgrp:
                 }
                 /* Flushing the log may release space */
                 if (loops == 2)
-                        gfs2_log_flush(sdp, NULL, NORMAL_FLUSH);
+                        gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_NORMAL |
+                                       GFS2_LFC_INPLACE_RESERVE);
         }
 
         return -ENOSPC;
@@ -2453,12 +2475,12 @@ void gfs2_unlink_di(struct inode *inode)
         update_rgrp_lvb_unlinked(rgd, 1);
 }
 
-static void gfs2_free_uninit_di(struct gfs2_rgrpd *rgd, u64 blkno)
+void gfs2_free_di(struct gfs2_rgrpd *rgd, struct gfs2_inode *ip)
 {
         struct gfs2_sbd *sdp = rgd->rd_sbd;
         struct gfs2_rgrpd *tmp_rgd;
 
-        tmp_rgd = rgblk_free(sdp, blkno, 1, GFS2_BLKST_FREE);
+        tmp_rgd = rgblk_free(sdp, ip->i_no_addr, 1, GFS2_BLKST_FREE);
         if (!tmp_rgd)
                 return;
         gfs2_assert_withdraw(sdp, rgd == tmp_rgd);
@@ -2474,12 +2496,6 @@ static void gfs2_free_uninit_di(struct gfs2_rgrpd *rgd, u64 blkno)
         update_rgrp_lvb_unlinked(rgd, -1);
 
         gfs2_statfs_change(sdp, 0, +1, -1);
-}
-
-
-void gfs2_free_di(struct gfs2_rgrpd *rgd, struct gfs2_inode *ip)
-{
-        gfs2_free_uninit_di(rgd, ip->i_no_addr);
         trace_gfs2_block_alloc(ip, rgd, ip->i_no_addr, 1, GFS2_BLKST_FREE);
         gfs2_quota_change(ip, -1, ip->i_inode.i_uid, ip->i_inode.i_gid);
         gfs2_meta_wipe(ip, ip->i_no_addr, 1);
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index d81d46e19726..620be0521866 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -757,7 +757,9 @@ static int gfs2_write_inode(struct inode *inode, struct writeback_control *wbc)
         bool flush_all = (wbc->sync_mode == WB_SYNC_ALL || gfs2_is_jdata(ip));
 
         if (flush_all)
-                gfs2_log_flush(GFS2_SB(inode), ip->i_gl, NORMAL_FLUSH);
+                gfs2_log_flush(GFS2_SB(inode), ip->i_gl,
+                               GFS2_LOG_HEAD_FLUSH_NORMAL |
+                               GFS2_LFC_WRITE_INODE);
         if (bdi->wb.dirty_exceeded)
                 gfs2_ail1_flush(sdp, wbc);
         else
@@ -766,6 +768,12 @@ static int gfs2_write_inode(struct inode *inode, struct writeback_control *wbc)
                 ret = filemap_fdatawait(metamapping);
         if (ret)
                 mark_inode_dirty_sync(inode);
+        else {
+                spin_lock(&inode->i_lock);
+                if (!(inode->i_flags & I_DIRTY))
+                        gfs2_ordered_del_inode(ip);
+                spin_unlock(&inode->i_lock);
+        }
         return ret;
 }
 
@@ -853,7 +861,8 @@ static int gfs2_make_fs_ro(struct gfs2_sbd *sdp)
         gfs2_quota_sync(sdp->sd_vfs, 0);
         gfs2_statfs_sync(sdp->sd_vfs, 0);
 
-        gfs2_log_flush(sdp, NULL, SHUTDOWN_FLUSH);
+        gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_SHUTDOWN |
+                       GFS2_LFC_MAKE_FS_RO);
         wait_event(sdp->sd_reserving_log_wait, atomic_read(&sdp->sd_reserving_log) == 0);
         gfs2_assert_warn(sdp, atomic_read(&sdp->sd_log_blks_free) == sdp->sd_jdesc->jd_blocks);
 
@@ -946,7 +955,8 @@ static int gfs2_sync_fs(struct super_block *sb, int wait)
 
         gfs2_quota_sync(sb, -1);
         if (wait)
-                gfs2_log_flush(sdp, NULL, NORMAL_FLUSH);
+                gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_NORMAL |
+                               GFS2_LFC_SYNC_FS);
         return sdp->sd_log_error;
 }
 
@@ -1650,7 +1660,8 @@ alloc_failed:
         goto out_unlock;
 
 out_truncate:
-        gfs2_log_flush(sdp, ip->i_gl, NORMAL_FLUSH);
+        gfs2_log_flush(sdp, ip->i_gl, GFS2_LOG_HEAD_FLUSH_NORMAL |
+                       GFS2_LFC_EVICT_INODE);
         metamapping = gfs2_glock2aspace(ip->i_gl);
         if (test_bit(GLF_DIRTY, &ip->i_gl->gl_flags)) {
                 filemap_fdatawrite(metamapping);
diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index 9eb9d0a1abd9..c191fa58a1df 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -112,7 +112,7 @@ static ssize_t freeze_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
         }
 
         if (error) {
-                fs_warn(sdp, "freeze %d error %d", n, error);
+                fs_warn(sdp, "freeze %d error %d\n", n, error);
                 return error;
         }
 
@@ -679,7 +679,7 @@ fail_tune:
         sysfs_remove_group(&sdp->sd_kobj, &tune_group);
 fail_reg:
         free_percpu(sdp->sd_lkstats);
-        fs_err(sdp, "error %d adding sysfs files", error);
+        fs_err(sdp, "error %d adding sysfs files\n", error);
         if (sysfs_frees_sdp)
                 kobject_put(&sdp->sd_kobj);
         else
diff --git a/fs/gfs2/trace_gfs2.h b/fs/gfs2/trace_gfs2.h
index f67a709589d3..b9318b49ff8f 100644
--- a/fs/gfs2/trace_gfs2.h
+++ b/fs/gfs2/trace_gfs2.h
@@ -353,26 +353,29 @@ TRACE_EVENT(gfs2_pin,
 /* Flushing the log */
 TRACE_EVENT(gfs2_log_flush,
 
-        TP_PROTO(const struct gfs2_sbd *sdp, int start),
+        TP_PROTO(const struct gfs2_sbd *sdp, int start, u32 flags),
 
-        TP_ARGS(sdp, start),
+        TP_ARGS(sdp, start, flags),
 
         TP_STRUCT__entry(
                 __field(        dev_t,  dev                     )
                 __field(        int,    start                   )
                 __field(        u64,    log_seq                 )
+                __field(        u32,    flags                   )
         ),
 
         TP_fast_assign(
                 __entry->dev            = sdp->sd_vfs->s_dev;
                 __entry->start          = start;
                 __entry->log_seq        = sdp->sd_log_sequence;
+                __entry->flags          = flags;
         ),
 
-        TP_printk("%u,%u log flush %s %llu",
+        TP_printk("%u,%u log flush %s %llu %llx",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->start ? "start" : "end",
-                  (unsigned long long)__entry->log_seq)
+                  (unsigned long long)__entry->log_seq,
+                  (unsigned long long)__entry->flags)
 );
 
 /* Reserving/releasing blocks in the log */
diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c
index ca8b72d0a831..c75cacaa349b 100644
--- a/fs/gfs2/trans.c
+++ b/fs/gfs2/trans.c
@@ -92,7 +92,6 @@ void gfs2_trans_end(struct gfs2_sbd *sdp)
         s64 nbuf;
         int alloced = test_bit(TR_ALLOCED, &tr->tr_flags);
 
-        BUG_ON(!tr);
         current->journal_info = NULL;
 
         if (!test_bit(TR_TOUCHED, &tr->tr_flags)) {
@@ -118,7 +117,8 @@ void gfs2_trans_end(struct gfs2_sbd *sdp)
         up_read(&sdp->sd_log_flush_lock);
 
         if (sdp->sd_vfs->s_flags & SB_SYNCHRONOUS)
-                gfs2_log_flush(sdp, NULL, NORMAL_FLUSH);
+                gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_NORMAL |
+                               GFS2_LFC_TRANS_END);
         if (alloced)
                 sb_end_intwrite(sdp->sd_vfs);
 }
diff --git a/fs/hfsplus/Kconfig b/fs/hfsplus/Kconfig
index 24bc20fd42f7..7cc8b4acf66a 100644
--- a/fs/hfsplus/Kconfig
+++ b/fs/hfsplus/Kconfig
@@ -20,9 +20,6 @@ config HFSPLUS_FS_POSIX_ACL
           POSIX Access Control Lists (ACLs) support permissions for users and
           groups beyond the owner/group/world scheme.
 
-          To learn more about Access Control Lists, visit the POSIX ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
           It needs to understand that POSIX ACLs are treated only under
           Linux. POSIX ACLs doesn't mean something under Mac OS X.
           Mac OS X beginning with version 10.4 ("Tiger") support NFSv4 ACLs,
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 8a85f3f53446..8fe1b0aa2896 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -55,16 +55,6 @@ struct hugetlbfs_config {
         umode_t                 mode;
 };
 
-struct hugetlbfs_inode_info {
-        struct shared_policy policy;
-        struct inode vfs_inode;
-};
-
-static inline struct hugetlbfs_inode_info *HUGETLBFS_I(struct inode *inode)
-{
-        return container_of(inode, struct hugetlbfs_inode_info, vfs_inode);
-}
-
 int sysctl_hugetlb_shm_group;
 
 enum {
@@ -520,8 +510,16 @@ static long hugetlbfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
 
         if (hole_end > hole_start) {
                 struct address_space *mapping = inode->i_mapping;
+                struct hugetlbfs_inode_info *info = HUGETLBFS_I(inode);
 
                 inode_lock(inode);
+
+                /* protected by i_mutex */
+                if (info->seals & F_SEAL_WRITE) {
+                        inode_unlock(inode);
+                        return -EPERM;
+                }
+
                 i_mmap_lock_write(mapping);
                 if (!RB_EMPTY_ROOT(&mapping->i_mmap.rb_root))
                         hugetlb_vmdelete_list(&mapping->i_mmap,
@@ -539,6 +537,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
                                 loff_t len)
 {
         struct inode *inode = file_inode(file);
+        struct hugetlbfs_inode_info *info = HUGETLBFS_I(inode);
         struct address_space *mapping = inode->i_mapping;
         struct hstate *h = hstate_inode(inode);
         struct vm_area_struct pseudo_vma;
@@ -570,6 +569,11 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
         if (error)
                 goto out;
 
+        if ((info->seals & F_SEAL_GROW) && offset + len > inode->i_size) {
+                error = -EPERM;
+                goto out;
+        }
+
         /*
          * Initialize a pseudo vma as this is required by the huge page
          * allocation routines.  If NUMA is configured, use page index
@@ -660,6 +664,7 @@ static int hugetlbfs_setattr(struct dentry *dentry, struct iattr *attr)
         struct hstate *h = hstate_inode(inode);
         int error;
         unsigned int ia_valid = attr->ia_valid;
+        struct hugetlbfs_inode_info *info = HUGETLBFS_I(inode);
 
         BUG_ON(!inode);
 
@@ -668,9 +673,16 @@ static int hugetlbfs_setattr(struct dentry *dentry, struct iattr *attr)
                 return error;
 
         if (ia_valid & ATTR_SIZE) {
-                if (attr->ia_size & ~huge_page_mask(h))
+                loff_t oldsize = inode->i_size;
+                loff_t newsize = attr->ia_size;
+
+                if (newsize & ~huge_page_mask(h))
                         return -EINVAL;
-                error = hugetlb_vmtruncate(inode, attr->ia_size);
+                /* protected by i_mutex */
+                if ((newsize < oldsize && (info->seals & F_SEAL_SHRINK)) ||
+                    (newsize > oldsize && (info->seals & F_SEAL_GROW)))
+                        return -EPERM;
+                error = hugetlb_vmtruncate(inode, newsize);
                 if (error)
                         return error;
         }
@@ -722,6 +734,8 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
 
         inode = new_inode(sb);
         if (inode) {
+                struct hugetlbfs_inode_info *info = HUGETLBFS_I(inode);
+
                 inode->i_ino = get_next_ino();
                 inode_init_owner(inode, dir, mode);
                 lockdep_set_class(&inode->i_mapping->i_mmap_rwsem,
@@ -729,6 +743,7 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                 inode->i_mapping->a_ops = &hugetlbfs_aops;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
                 inode->i_mapping->private_data = resv_map;
+                info->seals = F_SEAL_SEAL;
                 switch (mode & S_IFMT) {
                 default:
                         init_special_inode(inode, mode, dev);
diff --git a/fs/iomap.c b/fs/iomap.c
index 47d29ccffaef..afd163586aa0 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -65,6 +65,8 @@ iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags,
                 return ret;
         if (WARN_ON(iomap.offset > pos))
                 return -EIO;
+        if (WARN_ON(iomap.length == 0))
+                return -EIO;
 
         /*
          * Cut down the length to the one actually provided by the filesystem,
@@ -753,7 +755,8 @@ static ssize_t iomap_dio_complete(struct iomap_dio *dio)
                 err = invalidate_inode_pages2_range(inode->i_mapping,
                                 offset >> PAGE_SHIFT,
                                 (offset + dio->size - 1) >> PAGE_SHIFT);
-                WARN_ON_ONCE(err);
+                if (err)
+                        dio_warn_stale_pagecache(iocb->ki_filp);
         }
 
         inode_dio_end(file_inode(iocb->ki_filp));
@@ -1018,9 +1021,16 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         if (ret)
                 goto out_free_dio;
 
+        /*
+         * Try to invalidate cache pages for the range we're direct
+         * writing.  If this invalidation fails, tough, the write will
+         * still work, but racing two incompatible write paths is a
+         * pretty crazy thing to do, so we don't support it 100%.
+         */
         ret = invalidate_inode_pages2_range(mapping,
                         start >> PAGE_SHIFT, end >> PAGE_SHIFT);
-        WARN_ON_ONCE(ret);
+        if (ret)
+                dio_warn_stale_pagecache(iocb->ki_filp);
         ret = 0;
 
         if (iov_iter_rw(iter) == WRITE && !is_sync_kiocb(iocb) &&
diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
index 4055f51617ef..c125d662777c 100644
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * linux/fs/jbd2/checkpoint.c
  *
@@ -5,10 +6,6 @@
  *
  * Copyright 1999 Red Hat Software --- All Rights Reserved
  *
- * This file is part of the Linux kernel and is made available under
- * the terms of the GNU General Public License, version 2, or at your
- * option, any later version, incorporated herein by reference.
- *
  * Checkpoint routines for the generic filesystem journaling code.
  * Part of the ext2fs journaling system.
  *
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 3c1c31321d9b..8de0e7723316 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * linux/fs/jbd2/commit.c
  *
@@ -5,10 +6,6 @@
  *
  * Copyright 1998 Red Hat corp --- All Rights Reserved
  *
- * This file is part of the Linux kernel and is made available under
- * the terms of the GNU General Public License, version 2, or at your
- * option, any later version, incorporated herein by reference.
- *
  * Journal commit routines for the generic filesystem journaling code;
  * part of the ext2fs journaling system.
  */
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 67546c7ad473..3fbf48ec2188 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * linux/fs/jbd2/journal.c
  *
@@ -5,10 +6,6 @@
  *
  * Copyright 1998 Red Hat corp --- All Rights Reserved
  *
- * This file is part of the Linux kernel and is made available under
- * the terms of the GNU General Public License, version 2, or at your
- * option, any later version, incorporated herein by reference.
- *
  * Generic filesystem journal-writing code; part of the ext2fs
  * journaling system.
  *
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 02dd3360cb20..f99910b69c78 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * linux/fs/jbd2/recovery.c
  *
@@ -5,10 +6,6 @@
  *
  * Copyright 1999-2000 Red Hat Software --- All Rights Reserved
  *
- * This file is part of the Linux kernel and is made available under
- * the terms of the GNU General Public License, version 2, or at your
- * option, any later version, incorporated herein by reference.
- *
  * Journal recovery routines for the generic filesystem journaling code;
  * part of the ext2fs journaling system.
  */
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index f9aefcda5854..696ef15ec942 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * linux/fs/jbd2/revoke.c
  *
@@ -5,10 +6,6 @@
  *
  * Copyright 2000 Red Hat corp --- All Rights Reserved
  *
- * This file is part of the Linux kernel and is made available under
- * the terms of the GNU General Public License, version 2, or at your
- * option, any later version, incorporated herein by reference.
- *
  * Journal revoke routines for the generic filesystem journaling code;
  * part of the ext2fs journaling system.
  *
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 8b08044b3120..ac311037d7a5 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * linux/fs/jbd2/transaction.c
  *
@@ -5,10 +6,6 @@
  *
  * Copyright 1998 Red Hat corp --- All Rights Reserved
  *
- * This file is part of the Linux kernel and is made available under
- * the terms of the GNU General Public License, version 2, or at your
- * option, any later version, incorporated herein by reference.
- *
  * Generic filesystem transaction handling code; part of the ext2fs
  * journaling system.
  *
@@ -495,8 +492,10 @@ void jbd2_journal_free_reserved(handle_t *handle)
 EXPORT_SYMBOL(jbd2_journal_free_reserved);
 
 /**
- * int jbd2_journal_start_reserved(handle_t *handle) - start reserved handle
+ * int jbd2_journal_start_reserved() - start reserved handle
  * @handle: handle to start
+ * @type: for handle statistics
+ * @line_no: for handle statistics
  *
  * Start handle that has been previously reserved with jbd2_journal_reserve().
  * This attaches @handle to the running transaction (or creates one if there's
@@ -626,6 +625,7 @@ error_out:
  * int jbd2_journal_restart() - restart a handle .
  * @handle:  handle to restart
  * @nblocks: nr credits requested
+ * @gfp_mask: memory allocation flags (for start_this_handle)
  *
  * Restart a handle for a multi-transaction filesystem
  * operation.
diff --git a/fs/jffs2/Kconfig b/fs/jffs2/Kconfig
index d8bb6c411e96..ad850c5bf2ca 100644
--- a/fs/jffs2/Kconfig
+++ b/fs/jffs2/Kconfig
@@ -68,8 +68,7 @@ config JFFS2_FS_XATTR
         default n
         help
           Extended attributes are name:value pairs associated with inodes by
-          the kernel or by users (see the attr(5) manual page, or visit
-          <http://acl.bestbits.at/> for details).
+          the kernel or by users (see the attr(5) manual page for details).
 
           If unsure, say N.
 
@@ -82,9 +81,6 @@ config JFFS2_FS_POSIX_ACL
           Posix Access Control Lists (ACLs) support permissions for users and
           groups beyond the owner/group/world scheme.
 
-          To learn more about Access Control Lists, visit the Posix ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
           If you don't know what Access Control Lists are, say N
 
 config JFFS2_FS_SECURITY
diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index d8c274d39ddb..eab04eca95a3 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -362,7 +362,6 @@ error_io:
         ret = -EIO;
 error:
         mutex_unlock(&f->sem);
-        jffs2_do_clear_inode(c, f);
         iget_failed(inode);
         return ERR_PTR(ret);
 }
diff --git a/fs/jfs/Kconfig b/fs/jfs/Kconfig
index 57cef19951db..851de78fdabb 100644
--- a/fs/jfs/Kconfig
+++ b/fs/jfs/Kconfig
@@ -16,9 +16,6 @@ config JFS_POSIX_ACL
           Posix Access Control Lists (ACLs) support permissions for users and
           groups beyond the owner/group/world scheme.
 
-          To learn more about Access Control Lists, visit the Posix ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
           If you don't know what Access Control Lists are, say N
 
 config JFS_SECURITY
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 90373aebfdca..1b9264fd54b6 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -965,9 +965,11 @@ static int __init init_jfs_fs(void)
         int rc;
 
         jfs_inode_cachep =
-            kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
-                            SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_ACCOUNT,
-                            init_once);
+            kmem_cache_create_usercopy("jfs_ip", sizeof(struct jfs_inode_info),
+                        0, SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_ACCOUNT,
+                        offsetof(struct jfs_inode_info, i_inline),
+                        sizeof_field(struct jfs_inode_info, i_inline),
+                        init_once);
         if (jfs_inode_cachep == NULL)
                 return -ENOMEM;
 
diff --git a/fs/mbcache.c b/fs/mbcache.c
index b8b8b9ced9f8..bf41e2e72c18 100644
--- a/fs/mbcache.c
+++ b/fs/mbcache.c
@@ -94,6 +94,7 @@ int mb_cache_entry_create(struct mb_cache *cache, gfp_t mask, u32 key,
         entry->e_key = key;
         entry->e_value = value;
         entry->e_reusable = reusable;
+        entry->e_referenced = 0;
         head = mb_cache_entry_head(cache, key);
         hlist_bl_lock(head);
         hlist_bl_for_each_entry(dup, dup_node, head, e_hash_list) {
@@ -238,7 +239,9 @@ void mb_cache_entry_delete(struct mb_cache *cache, u32 key, u64 value)
                         spin_lock(&cache->c_list_lock);
                         if (!list_empty(&entry->e_list)) {
                                 list_del_init(&entry->e_list);
-                                cache->c_entry_count--;
+                                if (!WARN_ONCE(cache->c_entry_count == 0,
+                "mbcache: attempt to decrement c_entry_count past zero"))
+                                        cache->c_entry_count--;
                                 atomic_dec(&entry->e_refcnt);
                         }
                         spin_unlock(&cache->c_list_lock);
@@ -269,9 +272,6 @@ static unsigned long mb_cache_count(struct shrinker *shrink,
         struct mb_cache *cache = container_of(shrink, struct mb_cache,
                                               c_shrink);
 
-        /* Unlikely, but not impossible */
-        if (unlikely(cache->c_entry_count < 0))
-                return 0;
         return cache->c_entry_count;
 }
 
diff --git a/fs/namei.c b/fs/namei.c
index 7c221fb0836b..921ae32dbc80 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -391,50 +391,6 @@ static inline int do_inode_permission(struct inode *inode, int mask)
 }
 
 /**
- * __inode_permission - Check for access rights to a given inode
- * @inode: Inode to check permission on
- * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
- *
- * Check for read/write/execute permissions on an inode.
- *
- * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
- *
- * This does not check for a read-only file system.  You probably want
- * inode_permission().
- */
-int __inode_permission(struct inode *inode, int mask)
-{
-        int retval;
-
-        if (unlikely(mask & MAY_WRITE)) {
-                /*
-                 * Nobody gets write access to an immutable file.
-                 */
-                if (IS_IMMUTABLE(inode))
-                        return -EPERM;
-
-                /*
-                 * Updating mtime will likely cause i_uid and i_gid to be
-                 * written back improperly if their true value is unknown
-                 * to the vfs.
-                 */
-                if (HAS_UNMAPPED_ID(inode))
-                        return -EACCES;
-        }
-
-        retval = do_inode_permission(inode, mask);
-        if (retval)
-                return retval;
-
-        retval = devcgroup_inode_permission(inode, mask);
-        if (retval)
-                return retval;
-
-        return security_inode_permission(inode, mask);
-}
-EXPORT_SYMBOL(__inode_permission);
-
-/**
  * sb_permission - Check superblock-level permissions
  * @sb: Superblock of inode to check permission on
  * @inode: Inode to check permission on
@@ -472,7 +428,32 @@ int inode_permission(struct inode *inode, int mask)
         retval = sb_permission(inode->i_sb, inode, mask);
         if (retval)
                 return retval;
-        return __inode_permission(inode, mask);
+
+        if (unlikely(mask & MAY_WRITE)) {
+                /*
+                 * Nobody gets write access to an immutable file.
+                 */
+                if (IS_IMMUTABLE(inode))
+                        return -EPERM;
+
+                /*
+                 * Updating mtime will likely cause i_uid and i_gid to be
+                 * written back improperly if their true value is unknown
+                 * to the vfs.
+                 */
+                if (HAS_UNMAPPED_ID(inode))
+                        return -EACCES;
+        }
+
+        retval = do_inode_permission(inode, mask);
+        if (retval)
+                return retval;
+
+        retval = devcgroup_inode_permission(inode, mask);
+        if (retval)
+                return retval;
+
+        return security_inode_permission(inode, mask);
 }
 EXPORT_SYMBOL(inode_permission);
 
diff --git a/fs/ncpfs/Kconfig b/fs/ncpfs/Kconfig
deleted file mode 100644
index c931cf22a1f6..000000000000
--- a/fs/ncpfs/Kconfig
+++ /dev/null
@@ -1,108 +0,0 @@
-#
-# NCP Filesystem configuration
-#
-config NCP_FS
-        tristate "NCP file system support (to mount NetWare volumes)"
-        depends on IPX!=n || INET
-        help
-          NCP (NetWare Core Protocol) is a protocol that runs over IPX and is
-          used by Novell NetWare clients to talk to file servers.  It is to
-          IPX what NFS is to TCP/IP, if that helps.  Saying Y here allows you
-          to mount NetWare file server volumes and to access them just like
-          any other Unix directory.  For details, please read the file
-          <file:Documentation/filesystems/ncpfs.txt> in the kernel source and
-          the IPX-HOWTO from <http://www.tldp.org/docs.html#howto>.
-
-          You do not have to say Y here if you want your Linux box to act as a
-          file *server* for Novell NetWare clients.
-
-          General information about how to connect Linux, Windows machines and
-          Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.
-
-          To compile this as a module, choose M here: the module will be called
-          ncpfs.  Say N unless you are connected to a Novell network.
-
-config NCPFS_PACKET_SIGNING
-        bool "Packet signatures"
-        depends on NCP_FS
-        help
-          NCP allows packets to be signed for stronger security. If you want
-          security, say Y.  Normal users can leave it off.  To be able to use
-          packet signing you must use ncpfs > 2.0.12.
-
-config NCPFS_IOCTL_LOCKING
-        bool "Proprietary file locking"
-        depends on NCP_FS
-        help
-          Allows locking of records on remote volumes.  Say N unless you have
-          special applications which are able to utilize this locking scheme.
-
-config NCPFS_STRONG
-        bool "Clear remove/delete inhibit when needed"
-        depends on NCP_FS
-        help
-          Allows manipulation of files flagged as Delete or Rename Inhibit.
-          To use this feature you must mount volumes with the ncpmount
-          parameter "-s" (ncpfs-2.0.12 and newer).  Say Y unless you are not
-          mounting volumes with -f 444.
-
-config NCPFS_NFS_NS
-        bool "Use NFS namespace if available"
-        depends on NCP_FS
-        help
-          Allows you to utilize NFS namespace on NetWare servers.  It brings
-          you case sensitive filenames.  Say Y.  You can disable it at
-          mount-time with the `-N nfs' parameter of ncpmount.
-
-config NCPFS_OS2_NS
-        bool "Use LONG (OS/2) namespace if available"
-        depends on NCP_FS
-        help
-          Allows you to utilize OS2/LONG namespace on NetWare servers.
-          Filenames in this namespace are limited to 255 characters, they are
-          case insensitive, and case in names is preserved.  Say Y.  You can
-          disable it at mount time with the -N os2 parameter of ncpmount.
-
-config NCPFS_SMALLDOS
-        bool "Lowercase DOS filenames"
-        depends on NCP_FS
-        ---help---
-          If you say Y here, every filename on a NetWare server volume using
-          the OS2/LONG namespace and created under DOS or on a volume using
-          DOS namespace will be converted to lowercase characters.
-          Saying N here will give you these filenames in uppercase.
-
-          This is only a cosmetic option since the OS2/LONG namespace is case
-          insensitive. The only major reason for this option is backward
-          compatibility when moving from DOS to OS2/LONG namespace support.
-          Long filenames (created by Win95) will not be affected.
-
-          This option does not solve the problem that filenames appear
-          differently under Linux and under Windows, since Windows does an
-          additional conversions on the client side. You can achieve similar
-          effects by saying Y to "Allow using of Native Language Support"
-          below.
-
-config NCPFS_NLS
-        bool "Use Native Language Support"
-        depends on NCP_FS
-        select NLS
-        help
-          Allows you to use codepages and I/O charsets for file name
-          translation between the server file system and input/output. This
-          may be useful, if you want to access the server with other operating
-          systems, e.g. Windows 95. See also NLS for more Information.
-
-          To select codepages and I/O charsets use ncpfs-2.2.0.13 or newer.
-
-config NCPFS_EXTRAS
-        bool "Enable symbolic links and execute flags"
-        depends on NCP_FS
-        help
-          This enables the use of symbolic links and an execute permission
-          bit on NCPFS. The file server need not have long name space or NFS
-          name space loaded for these to work.
-
-          To use the new attributes, it is recommended to use the flags
-          '-f 600 -d 755' on the ncpmount command line.
-
diff --git a/fs/ncpfs/Makefile b/fs/ncpfs/Makefile
deleted file mode 100644
index 66fe5f878817..000000000000
--- a/fs/ncpfs/Makefile
+++ /dev/null
@@ -1,17 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0
-#
-# Makefile for the linux ncp filesystem routines.
-#
-
-obj-$(CONFIG_NCP_FS) += ncpfs.o
-
-ncpfs-y      := dir.o file.o inode.o ioctl.o mmap.o ncplib_kernel.o sock.o \
-                ncpsign_kernel.o getopt.o
-
-ncpfs-$(CONFIG_NCPFS_EXTRAS)   += symlink.o
-ncpfs-$(CONFIG_NCPFS_NFS_NS)   += symlink.o
-
-# If you want debugging output, please uncomment the following line
-# ccflags-y := -DDEBUG_NCP=1
-
-CFLAGS_ncplib_kernel.o := -finline-functions
diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
deleted file mode 100644
index 0c57c5c5d40a..000000000000
--- a/fs/ncpfs/dir.c
+++ /dev/null
@@ -1,1232 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- *  dir.c
- *
- *  Copyright (C) 1995, 1996 by Volker Lendecke
- *  Modified for big endian by J.F. Chadima and David S. Miller
- *  Modified 1997 Peter Waltenberg, Bill Hawes, David Woodhouse for 2.1 dcache
- *  Modified 1998, 1999 Wolfram Pienkoss for NLS
- *  Modified 1999 Wolfram Pienkoss for directory caching
- *  Modified 2000 Ben Harris, University of Cambridge for NFS NS meta-info
- *
- */
-
-
-#include <linux/time.h>
-#include <linux/errno.h>
-#include <linux/stat.h>
-#include <linux/kernel.h>
-#include <linux/vmalloc.h>
-#include <linux/mm.h>
-#include <linux/namei.h>
-#include <linux/uaccess.h>
-#include <asm/byteorder.h>
-
-#include "ncp_fs.h"
-
-static void ncp_read_volume_list(struct file *, struct dir_context *,
-                                struct ncp_cache_control *);
-static void ncp_do_readdir(struct file *, struct dir_context *,
-                                struct ncp_cache_control *);
-
-static int ncp_readdir(struct file *, struct dir_context *);
-
-static int ncp_create(struct inode *, struct dentry *, umode_t, bool);
-static struct dentry *ncp_lookup(struct inode *, struct dentry *, unsigned int);
-static int ncp_unlink(struct inode *, struct dentry *);
-static int ncp_mkdir(struct inode *, struct dentry *, umode_t);
-static int ncp_rmdir(struct inode *, struct dentry *);
-static int ncp_rename(struct inode *, struct dentry *,
-                      struct inode *, struct dentry *, unsigned int);
-static int ncp_mknod(struct inode * dir, struct dentry *dentry,
-                     umode_t mode, dev_t rdev);
-#if defined(CONFIG_NCPFS_EXTRAS) || defined(CONFIG_NCPFS_NFS_NS)
-extern int ncp_symlink(struct inode *, struct dentry *, const char *);
-#else
-#define ncp_symlink NULL
-#endif
-                      
-const struct file_operations ncp_dir_operations =
-{
-        .llseek         = generic_file_llseek,
-        .read           = generic_read_dir,
-        .iterate        = ncp_readdir,
-        .unlocked_ioctl = ncp_ioctl,
-#ifdef CONFIG_COMPAT
-        .compat_ioctl   = ncp_compat_ioctl,
-#endif
-};
-
-const struct inode_operations ncp_dir_inode_operations =
-{
-        .create         = ncp_create,
-        .lookup         = ncp_lookup,
-        .unlink         = ncp_unlink,
-        .symlink        = ncp_symlink,
-        .mkdir          = ncp_mkdir,
-        .rmdir          = ncp_rmdir,
-        .mknod          = ncp_mknod,
-        .rename         = ncp_rename,
-        .setattr        = ncp_notify_change,
-};
-
-/*
- * Dentry operations routines
- */
-static int ncp_lookup_validate(struct dentry *, unsigned int);
-static int ncp_hash_dentry(const struct dentry *, struct qstr *);
-static int ncp_compare_dentry(const struct dentry *,
-                unsigned int, const char *, const struct qstr *);
-static int ncp_delete_dentry(const struct dentry *);
-static void ncp_d_prune(struct dentry *dentry);
-
-const struct dentry_operations ncp_dentry_operations =
-{
-        .d_revalidate   = ncp_lookup_validate,
-        .d_hash         = ncp_hash_dentry,
-        .d_compare      = ncp_compare_dentry,
-        .d_delete       = ncp_delete_dentry,
-        .d_prune        = ncp_d_prune,
-};
-
-#define ncp_namespace(i)        (NCP_SERVER(i)->name_space[NCP_FINFO(i)->volNumber])
-
-static inline int ncp_preserve_entry_case(struct inode *i, __u32 nscreator)
-{
-#ifdef CONFIG_NCPFS_SMALLDOS
-        int ns = ncp_namespace(i);
-
-        if ((ns == NW_NS_DOS)
-#ifdef CONFIG_NCPFS_OS2_NS
-                || ((ns == NW_NS_OS2) && (nscreator == NW_NS_DOS))
-#endif /* CONFIG_NCPFS_OS2_NS */
-           )
-                return 0;
-#endif /* CONFIG_NCPFS_SMALLDOS */
-        return 1;
-}
-
-#define ncp_preserve_case(i)    (ncp_namespace(i) != NW_NS_DOS)
-
-static inline int ncp_case_sensitive(const struct inode *i)
-{
-#ifdef CONFIG_NCPFS_NFS_NS
-        return ncp_namespace(i) == NW_NS_NFS;
-#else
-        return 0;
-#endif /* CONFIG_NCPFS_NFS_NS */
-}
-
-/*
- * Note: leave the hash unchanged if the directory
- * is case-sensitive.
- */
-static int 
-ncp_hash_dentry(const struct dentry *dentry, struct qstr *this)
-{
-        struct inode *inode = d_inode_rcu(dentry);
-
-        if (!inode)
-                return 0;
-
-        if (!ncp_case_sensitive(inode)) {
-                struct nls_table *t;
-                unsigned long hash;
-                int i;
-
-                t = NCP_IO_TABLE(dentry->d_sb);
-                hash = init_name_hash(dentry);
-                for (i=0; i<this->len ; i++)
-                        hash = partial_name_hash(ncp_tolower(t, this->name[i]),
-                                                                        hash);
-                this->hash = end_name_hash(hash);
-        }
-        return 0;
-}
-
-static int
-ncp_compare_dentry(const struct dentry *dentry,
-                unsigned int len, const char *str, const struct qstr *name)
-{
-        struct inode *pinode;
-
-        if (len != name->len)
-                return 1;
-
-        pinode = d_inode_rcu(dentry->d_parent);
-        if (!pinode)
-                return 1;
-
-        if (ncp_case_sensitive(pinode))
-                return strncmp(str, name->name, len);
-
-        return ncp_strnicmp(NCP_IO_TABLE(pinode->i_sb), str, name->name, len);
-}
-
-/*
- * This is the callback from dput() when d_count is going to 0.
- * We use this to unhash dentries with bad inodes.
- * Closing files can be safely postponed until iput() - it's done there anyway.
- */
-static int
-ncp_delete_dentry(const struct dentry * dentry)
-{
-        struct inode *inode = d_inode(dentry);
-
-        if (inode) {
-                if (is_bad_inode(inode))
-                        return 1;
-        } else
-        {
-        /* N.B. Unhash negative dentries? */
-        }
-        return 0;
-}
-
-static inline int
-ncp_single_volume(struct ncp_server *server)
-{
-        return (server->m.mounted_vol[0] != '\0');
-}
-
-static inline int ncp_is_server_root(struct inode *inode)
-{
-        return !ncp_single_volume(NCP_SERVER(inode)) &&
-                is_root_inode(inode);
-}
-
-
-/*
- * This is the callback when the dcache has a lookup hit.
- */
-
-
-#ifdef CONFIG_NCPFS_STRONG
-/* try to delete a readonly file (NW R bit set) */
-
-static int
-ncp_force_unlink(struct inode *dir, struct dentry* dentry)
-{
-        int res=0x9c,res2;
-        struct nw_modify_dos_info info;
-        __le32 old_nwattr;
-        struct inode *inode;
-
-        memset(&info, 0, sizeof(info));
-        
-        /* remove the Read-Only flag on the NW server */
-        inode = d_inode(dentry);
-
-        old_nwattr = NCP_FINFO(inode)->nwattr;
-        info.attributes = old_nwattr & ~(aRONLY|aDELETEINHIBIT|aRENAMEINHIBIT);
-        res2 = ncp_modify_file_or_subdir_dos_info_path(NCP_SERVER(inode), inode, NULL, DM_ATTRIBUTES, &info);
-        if (res2)
-                goto leave_me;
-
-        /* now try again the delete operation */
-        res = ncp_del_file_or_subdir2(NCP_SERVER(dir), dentry);
-
-        if (res)  /* delete failed, set R bit again */
-        {
-                info.attributes = old_nwattr;
-                res2 = ncp_modify_file_or_subdir_dos_info_path(NCP_SERVER(inode), inode, NULL, DM_ATTRIBUTES, &info);
-                if (res2)
-                        goto leave_me;
-        }
-leave_me:
-        return(res);
-}
-#endif  /* CONFIG_NCPFS_STRONG */
-
-#ifdef CONFIG_NCPFS_STRONG
-static int
-ncp_force_rename(struct inode *old_dir, struct dentry* old_dentry, char *_old_name,
-                 struct inode *new_dir, struct dentry* new_dentry, char *_new_name)
-{
-        struct nw_modify_dos_info info;
-        int res=0x90,res2;
-        struct inode *old_inode = d_inode(old_dentry);
-        __le32 old_nwattr = NCP_FINFO(old_inode)->nwattr;
-        __le32 new_nwattr = 0; /* shut compiler warning */
-        int old_nwattr_changed = 0;
-        int new_nwattr_changed = 0;
-
-        memset(&info, 0, sizeof(info));
-        
-        /* remove the Read-Only flag on the NW server */
-
-        info.attributes = old_nwattr & ~(aRONLY|aRENAMEINHIBIT|aDELETEINHIBIT);
-        res2 = ncp_modify_file_or_subdir_dos_info_path(NCP_SERVER(old_inode), old_inode, NULL, DM_ATTRIBUTES, &info);
-        if (!res2)
-                old_nwattr_changed = 1;
-        if (new_dentry && d_really_is_positive(new_dentry)) {
-                new_nwattr = NCP_FINFO(d_inode(new_dentry))->nwattr;
-                info.attributes = new_nwattr & ~(aRONLY|aRENAMEINHIBIT|aDELETEINHIBIT);
-                res2 = ncp_modify_file_or_subdir_dos_info_path(NCP_SERVER(new_dir), new_dir, _new_name, DM_ATTRIBUTES, &info);
-                if (!res2)
-                        new_nwattr_changed = 1;
-        }
-        /* now try again the rename operation */
-        /* but only if something really happened */
-        if (new_nwattr_changed || old_nwattr_changed) {
-                res = ncp_ren_or_mov_file_or_subdir(NCP_SERVER(old_dir),
-                                                    old_dir, _old_name,
-                                                    new_dir, _new_name);
-        } 
-        if (res)
-                goto leave_me;
-        /* file was successfully renamed, so:
-           do not set attributes on old file - it no longer exists
-           copy attributes from old file to new */
-        new_nwattr_changed = old_nwattr_changed;
-        new_nwattr = old_nwattr;
-        old_nwattr_changed = 0;
-        
-leave_me:;
-        if (old_nwattr_changed) {
-                info.attributes = old_nwattr;
-                res2 = ncp_modify_file_or_subdir_dos_info_path(NCP_SERVER(old_inode), old_inode, NULL, DM_ATTRIBUTES, &info);
-                /* ignore errors */
-        }
-        if (new_nwattr_changed) {
-                info.attributes = new_nwattr;
-                res2 = ncp_modify_file_or_subdir_dos_info_path(NCP_SERVER(new_dir), new_dir, _new_name, DM_ATTRIBUTES, &info);
-                /* ignore errors */
-        }
-        return(res);
-}
-#endif  /* CONFIG_NCPFS_STRONG */
-
-
-static int
-ncp_lookup_validate(struct dentry *dentry, unsigned int flags)
-{
-        struct ncp_server *server;
-        struct dentry *parent;
-        struct inode *dir;
-        struct ncp_entry_info finfo;
-        int res, val = 0, len;
-        __u8 __name[NCP_MAXPATHLEN + 1];
-
-        if (dentry == dentry->d_sb->s_root)
-                return 1;
-
-        if (flags & LOOKUP_RCU)
-                return -ECHILD;
-
-        parent = dget_parent(dentry);
-        dir = d_inode(parent);
-
-        if (d_really_is_negative(dentry))
-                goto finished;
-
-        server = NCP_SERVER(dir);
-
-        /*
-         * Inspired by smbfs:
-         * The default validation is based on dentry age:
-         * We set the max age at mount time.  (But each
-         * successful server lookup renews the timestamp.)
-         */
-        val = NCP_TEST_AGE(server, dentry);
-        if (val)
-                goto finished;
-
-        ncp_dbg(2, "%pd2 not valid, age=%ld, server lookup\n",
-                dentry, NCP_GET_AGE(dentry));
-
-        len = sizeof(__name);
-        if (ncp_is_server_root(dir)) {
-                res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-                                 dentry->d_name.len, 1);
-                if (!res) {
-                        res = ncp_lookup_volume(server, __name, &(finfo.i));
-                        if (!res)
-                                ncp_update_known_namespace(server, finfo.i.volNumber, NULL);
-                }
-        } else {
-                res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-                                 dentry->d_name.len, !ncp_preserve_case(dir));
-                if (!res)
-                        res = ncp_obtain_info(server, dir, __name, &(finfo.i));
-        }
-        finfo.volume = finfo.i.volNumber;
-        ncp_dbg(2, "looked for %pd/%s, res=%d\n",
-                dentry->d_parent, __name, res);
-        /*
-         * If we didn't find it, or if it has a different dirEntNum to
-         * what we remember, it's not valid any more.
-         */
-        if (!res) {
-                struct inode *inode = d_inode(dentry);
-
-                inode_lock(inode);
-                if (finfo.i.dirEntNum == NCP_FINFO(inode)->dirEntNum) {
-                        ncp_new_dentry(dentry);
-                        val=1;
-                } else
-                        ncp_dbg(2, "found, but dirEntNum changed\n");
-
-                ncp_update_inode2(inode, &finfo);
-                inode_unlock(inode);
-        }
-
-finished:
-        ncp_dbg(2, "result=%d\n", val);
-        dput(parent);
-        return val;
-}
-
-static time_t ncp_obtain_mtime(struct dentry *dentry)
-{
-        struct inode *inode = d_inode(dentry);
-        struct ncp_server *server = NCP_SERVER(inode);
-        struct nw_info_struct i;
-
-        if (!ncp_conn_valid(server) || ncp_is_server_root(inode))
-                return 0;
-
-        if (ncp_obtain_info(server, inode, NULL, &i))
-                return 0;
-
-        return ncp_date_dos2unix(i.modifyTime, i.modifyDate);
-}
-
-static inline void
-ncp_invalidate_dircache_entries(struct dentry *parent)
-{
-        struct ncp_server *server = NCP_SERVER(d_inode(parent));
-        struct dentry *dentry;
-
-        spin_lock(&parent->d_lock);
-        list_for_each_entry(dentry, &parent->d_subdirs, d_child) {
-                dentry->d_fsdata = NULL;
-                ncp_age_dentry(server, dentry);
-        }
-        spin_unlock(&parent->d_lock);
-}
-
-static int ncp_readdir(struct file *file, struct dir_context *ctx)
-{
-        struct dentry *dentry = file->f_path.dentry;
-        struct inode *inode = d_inode(dentry);
-        struct page *page = NULL;
-        struct ncp_server *server = NCP_SERVER(inode);
-        union  ncp_dir_cache *cache = NULL;
-        struct ncp_cache_control ctl;
-        int result, mtime_valid = 0;
-        time_t mtime = 0;
-
-        ctl.page  = NULL;
-        ctl.cache = NULL;
-
-        ncp_dbg(2, "reading %pD2, pos=%d\n", file, (int)ctx->pos);
-
-        result = -EIO;
-        /* Do not generate '.' and '..' when server is dead. */
-        if (!ncp_conn_valid(server))
-                goto out;
-
-        result = 0;
-        if (!dir_emit_dots(file, ctx))
-                goto out;
-
-        page = grab_cache_page(&inode->i_data, 0);
-        if (!page)
-                goto read_really;
-
-        ctl.cache = cache = kmap(page);
-        ctl.head  = cache->head;
-
-        if (!PageUptodate(page) || !ctl.head.eof)
-                goto init_cache;
-
-        if (ctx->pos == 2) {
-                if (jiffies - ctl.head.time >= NCP_MAX_AGE(server))
-                        goto init_cache;
-
-                mtime = ncp_obtain_mtime(dentry);
-                mtime_valid = 1;
-                if ((!mtime) || (mtime != ctl.head.mtime))
-                        goto init_cache;
-        }
-
-        if (ctx->pos > ctl.head.end)
-                goto finished;
-
-        ctl.fpos = ctx->pos + (NCP_DIRCACHE_START - 2);
-        ctl.ofs  = ctl.fpos / NCP_DIRCACHE_SIZE;
-        ctl.idx  = ctl.fpos % NCP_DIRCACHE_SIZE;
-
-        for (;;) {
-                if (ctl.ofs != 0) {
-                        ctl.page = find_lock_page(&inode->i_data, ctl.ofs);
-                        if (!ctl.page)
-                                goto invalid_cache;
-                        ctl.cache = kmap(ctl.page);
-                        if (!PageUptodate(ctl.page))
-                                goto invalid_cache;
-                }
-                while (ctl.idx < NCP_DIRCACHE_SIZE) {
-                        struct dentry *dent;
-                        bool over;
-
-                        spin_lock(&dentry->d_lock);
-                        if (!(NCP_FINFO(inode)->flags & NCPI_DIR_CACHE)) { 
-                                spin_unlock(&dentry->d_lock);
-                                goto invalid_cache;
-                        }
-                        dent = ctl.cache->dentry[ctl.idx];
-                        if (unlikely(!lockref_get_not_dead(&dent->d_lockref))) {
-                                spin_unlock(&dentry->d_lock);
-                                goto invalid_cache;
-                        }
-                        spin_unlock(&dentry->d_lock);
-                        if (d_really_is_negative(dent)) {
-                                dput(dent);
-                                goto invalid_cache;
-                        }
-                        over = !dir_emit(ctx, dent->d_name.name,
-                                        dent->d_name.len,
-                                        d_inode(dent)->i_ino, DT_UNKNOWN);
-                        dput(dent);
-                        if (over)
-                                goto finished;
-                        ctx->pos += 1;
-                        ctl.idx += 1;
-                        if (ctx->pos > ctl.head.end)
-                                goto finished;
-                }
-                if (ctl.page) {
-                        kunmap(ctl.page);
-                        SetPageUptodate(ctl.page);
-                        unlock_page(ctl.page);
-                        put_page(ctl.page);
-                        ctl.page = NULL;
-                }
-                ctl.idx  = 0;
-                ctl.ofs += 1;
-        }
-invalid_cache:
-        if (ctl.page) {
-                kunmap(ctl.page);
-                unlock_page(ctl.page);
-                put_page(ctl.page);
-                ctl.page = NULL;
-        }
-        ctl.cache = cache;
-init_cache:
-        ncp_invalidate_dircache_entries(dentry);
-        if (!mtime_valid) {
-                mtime = ncp_obtain_mtime(dentry);
-                mtime_valid = 1;
-        }
-        ctl.head.mtime = mtime;
-        ctl.head.time = jiffies;
-        ctl.head.eof = 0;
-        ctl.fpos = 2;
-        ctl.ofs = 0;
-        ctl.idx = NCP_DIRCACHE_START;
-        ctl.filled = 0;
-        ctl.valid  = 1;
-read_really:
-        spin_lock(&dentry->d_lock);
-        NCP_FINFO(inode)->flags |= NCPI_DIR_CACHE;
-        spin_unlock(&dentry->d_lock);
-        if (ncp_is_server_root(inode)) {
-                ncp_read_volume_list(file, ctx, &ctl);
-        } else {
-                ncp_do_readdir(file, ctx, &ctl);
-        }
-        ctl.head.end = ctl.fpos - 1;
-        ctl.head.eof = ctl.valid;
-finished:
-        if (ctl.page) {
-                kunmap(ctl.page);
-                SetPageUptodate(ctl.page);
-                unlock_page(ctl.page);
-                put_page(ctl.page);
-        }
-        if (page) {
-                cache->head = ctl.head;
-                kunmap(page);
-                SetPageUptodate(page);
-                unlock_page(page);
-                put_page(page);
-        }
-out:
-        return result;
-}
-
-static void ncp_d_prune(struct dentry *dentry)
-{
-        if (!dentry->d_fsdata)  /* not referenced from page cache */
-                return;
-        NCP_FINFO(d_inode(dentry->d_parent))->flags &= ~NCPI_DIR_CACHE;
-}
-
-static int
-ncp_fill_cache(struct file *file, struct dir_context *ctx,
-                struct ncp_cache_control *ctrl, struct ncp_entry_info *entry,
-                int inval_childs)
-{
-        struct dentry *newdent, *dentry = file->f_path.dentry;
-        struct inode *dir = d_inode(dentry);
-        struct ncp_cache_control ctl = *ctrl;
-        struct qstr qname;
-        int valid = 0;
-        int hashed = 0;
-        ino_t ino = 0;
-        __u8 __name[NCP_MAXPATHLEN + 1];
-
-        qname.len = sizeof(__name);
-        if (ncp_vol2io(NCP_SERVER(dir), __name, &qname.len,
-                        entry->i.entryName, entry->i.nameLen,
-                        !ncp_preserve_entry_case(dir, entry->i.NSCreator)))
-                return 1; /* I'm not sure */
-
-        qname.name = __name;
-
-        newdent = d_hash_and_lookup(dentry, &qname);
-        if (IS_ERR(newdent))
-                goto end_advance;
-        if (!newdent) {
-                newdent = d_alloc(dentry, &qname);
-                if (!newdent)
-                        goto end_advance;
-        } else {
-                hashed = 1;
-
-                /* If case sensitivity changed for this volume, all entries below this one
-                   should be thrown away.  This entry itself is not affected, as its case
-                   sensitivity is controlled by its own parent. */
-                if (inval_childs)
-                        shrink_dcache_parent(newdent);
-
-                /*
-                 * NetWare's OS2 namespace is case preserving yet case
-                 * insensitive.  So we update dentry's name as received from
-                 * server. Parent dir's i_mutex is locked because we're in
-                 * readdir.
-                 */
-                dentry_update_name_case(newdent, &qname);
-        }
-
-        if (d_really_is_negative(newdent)) {
-                struct inode *inode;
-
-                entry->opened = 0;
-                entry->ino = iunique(dir->i_sb, 2);
-                inode = ncp_iget(dir->i_sb, entry);
-                if (inode) {
-                        d_instantiate(newdent, inode);
-                        if (!hashed)
-                                d_rehash(newdent);
-                } else {
-                        spin_lock(&dentry->d_lock);
-                        NCP_FINFO(dir)->flags &= ~NCPI_DIR_CACHE;
-                        spin_unlock(&dentry->d_lock);
-                }
-        } else {
-                struct inode *inode = d_inode(newdent);
-
-                inode_lock_nested(inode, I_MUTEX_CHILD);
-                ncp_update_inode2(inode, entry);
-                inode_unlock(inode);
-        }
-
-        if (ctl.idx >= NCP_DIRCACHE_SIZE) {
-                if (ctl.page) {
-                        kunmap(ctl.page);
-                        SetPageUptodate(ctl.page);
-                        unlock_page(ctl.page);
-                        put_page(ctl.page);
-                }
-                ctl.cache = NULL;
-                ctl.idx  -= NCP_DIRCACHE_SIZE;
-                ctl.ofs  += 1;
-                ctl.page  = grab_cache_page(&dir->i_data, ctl.ofs);
-                if (ctl.page)
-                        ctl.cache = kmap(ctl.page);
-        }
-        if (ctl.cache) {
-                if (d_really_is_positive(newdent)) {
-                        newdent->d_fsdata = newdent;
-                        ctl.cache->dentry[ctl.idx] = newdent;
-                        ino = d_inode(newdent)->i_ino;
-                        ncp_new_dentry(newdent);
-                }
-                valid = 1;
-        }
-        dput(newdent);
-end_advance:
-        if (!valid)
-                ctl.valid = 0;
-        if (!ctl.filled && (ctl.fpos == ctx->pos)) {
-                if (!ino)
-                        ino = iunique(dir->i_sb, 2);
-                ctl.filled = !dir_emit(ctx, qname.name, qname.len,
-                                     ino, DT_UNKNOWN);
-                if (!ctl.filled)
-                        ctx->pos += 1;
-        }
-        ctl.fpos += 1;
-        ctl.idx  += 1;
-        *ctrl = ctl;
-        return (ctl.valid || !ctl.filled);
-}
-
-static void
-ncp_read_volume_list(struct file *file, struct dir_context *ctx,
-                        struct ncp_cache_control *ctl)
-{
-        struct inode *inode = file_inode(file);
-        struct ncp_server *server = NCP_SERVER(inode);
-        struct ncp_volume_info info;
-        struct ncp_entry_info entry;
-        int i;
-
-        ncp_dbg(1, "pos=%ld\n", (unsigned long)ctx->pos);
-
-        for (i = 0; i < NCP_NUMBER_OF_VOLUMES; i++) {
-                int inval_dentry;
-
-                if (ncp_get_volume_info_with_number(server, i, &info) != 0)
-                        return;
-                if (!strlen(info.volume_name))
-                        continue;
-
-                ncp_dbg(1, "found vol: %s\n", info.volume_name);
-
-                if (ncp_lookup_volume(server, info.volume_name,
-                                        &entry.i)) {
-                        ncp_dbg(1, "could not lookup vol %s\n",
-                                info.volume_name);
-                        continue;
-                }
-                inval_dentry = ncp_update_known_namespace(server, entry.i.volNumber, NULL);
-                entry.volume = entry.i.volNumber;
-                if (!ncp_fill_cache(file, ctx, ctl, &entry, inval_dentry))
-                        return;
-        }
-}
-
-static void
-ncp_do_readdir(struct file *file, struct dir_context *ctx,
-                                                struct ncp_cache_control *ctl)
-{
-        struct inode *dir = file_inode(file);
-        struct ncp_server *server = NCP_SERVER(dir);
-        struct nw_search_sequence seq;
-        struct ncp_entry_info entry;
-        int err;
-        void* buf;
-        int more;
-        size_t bufsize;
-
-        ncp_dbg(1, "%pD2, fpos=%ld\n", file, (unsigned long)ctx->pos);
-        ncp_vdbg("init %pD, volnum=%d, dirent=%u\n",
-                 file, NCP_FINFO(dir)->volNumber, NCP_FINFO(dir)->dirEntNum);
-
-        err = ncp_initialize_search(server, dir, &seq);
-        if (err) {
-                ncp_dbg(1, "init failed, err=%d\n", err);
-                return;
-        }
-        /* We MUST NOT use server->buffer_size handshaked with server if we are
-           using UDP, as for UDP server uses max. buffer size determined by
-           MTU, and for TCP server uses hardwired value 65KB (== 66560 bytes). 
-           So we use 128KB, just to be sure, as there is no way how to know
-           this value in advance. */
-        bufsize = 131072;
-        buf = vmalloc(bufsize);
-        if (!buf)
-                return;
-        do {
-                int cnt;
-                char* rpl;
-                size_t rpls;
-
-                err = ncp_search_for_fileset(server, &seq, &more, &cnt, buf, bufsize, &rpl, &rpls);
-                if (err)                /* Error */
-                        break;
-                if (!cnt)               /* prevent endless loop */
-                        break;
-                while (cnt--) {
-                        size_t onerpl;
-                        
-                        if (rpls < offsetof(struct nw_info_struct, entryName))
-                                break;  /* short packet */
-                        ncp_extract_file_info(rpl, &entry.i);
-                        onerpl = offsetof(struct nw_info_struct, entryName) + entry.i.nameLen;
-                        if (rpls < onerpl)
-                                break;  /* short packet */
-                        (void)ncp_obtain_nfs_info(server, &entry.i);
-                        rpl += onerpl;
-                        rpls -= onerpl;
-                        entry.volume = entry.i.volNumber;
-                        if (!ncp_fill_cache(file, ctx, ctl, &entry, 0))
-                                break;
-                }
-        } while (more);
-        vfree(buf);
-        return;
-}
-
-int ncp_conn_logged_in(struct super_block *sb)
-{
-        struct ncp_server* server = NCP_SBP(sb);
-        int result;
-
-        if (ncp_single_volume(server)) {
-                int len;
-                struct dentry* dent;
-                __u32 volNumber;
-                __le32 dirEntNum;
-                __le32 DosDirNum;
-                __u8 __name[NCP_MAXPATHLEN + 1];
-
-                len = sizeof(__name);
-                result = ncp_io2vol(server, __name, &len, server->m.mounted_vol,
-                                    strlen(server->m.mounted_vol), 1);
-                if (result)
-                        goto out;
-                result = -ENOENT;
-                if (ncp_get_volume_root(server, __name, &volNumber, &dirEntNum, &DosDirNum)) {
-                        ncp_vdbg("%s not found\n", server->m.mounted_vol);
-                        goto out;
-                }
-                dent = sb->s_root;
-                if (dent) {
-                        struct inode* ino = d_inode(dent);
-                        if (ino) {
-                                ncp_update_known_namespace(server, volNumber, NULL);
-                                NCP_FINFO(ino)->volNumber = volNumber;
-                                NCP_FINFO(ino)->dirEntNum = dirEntNum;
-                                NCP_FINFO(ino)->DosDirNum = DosDirNum;
-                                result = 0;
-                        } else {
-                                ncp_dbg(1, "d_inode(sb->s_root) == NULL!\n");
-                        }
-                } else {
-                        ncp_dbg(1, "sb->s_root == NULL!\n");
-                }
-        } else
-                result = 0;
-
-out:
-        return result;
-}
-
-static struct dentry *ncp_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
-{
-        struct ncp_server *server = NCP_SERVER(dir);
-        struct inode *inode = NULL;
-        struct ncp_entry_info finfo;
-        int error, res, len;
-        __u8 __name[NCP_MAXPATHLEN + 1];
-
-        error = -EIO;
-        if (!ncp_conn_valid(server))
-                goto finished;
-
-        ncp_vdbg("server lookup for %pd2\n", dentry);
-
-        len = sizeof(__name);
-        if (ncp_is_server_root(dir)) {
-                res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-                                 dentry->d_name.len, 1);
-                if (!res)
-                        res = ncp_lookup_volume(server, __name, &(finfo.i));
-                if (!res)
-                        ncp_update_known_namespace(server, finfo.i.volNumber, NULL);
-        } else {
-                res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-                                 dentry->d_name.len, !ncp_preserve_case(dir));
-                if (!res)
-                        res = ncp_obtain_info(server, dir, __name, &(finfo.i));
-        }
-        ncp_vdbg("looked for %pd2, res=%d\n", dentry, res);
-        /*
-         * If we didn't find an entry, make a negative dentry.
-         */
-        if (res)
-                goto add_entry;
-
-        /*
-         * Create an inode for the entry.
-         */
-        finfo.opened = 0;
-        finfo.ino = iunique(dir->i_sb, 2);
-        finfo.volume = finfo.i.volNumber;
-        error = -EACCES;
-        inode = ncp_iget(dir->i_sb, &finfo);
-
-        if (inode) {
-                ncp_new_dentry(dentry);
-add_entry:
-                d_add(dentry, inode);
-                error = 0;
-        }
-
-finished:
-        ncp_vdbg("result=%d\n", error);
-        return ERR_PTR(error);
-}
-
-/*
- * This code is common to create, mkdir, and mknod.
- */
-static int ncp_instantiate(struct inode *dir, struct dentry *dentry,
-                        struct ncp_entry_info *finfo)
-{
-        struct inode *inode;
-        int error = -EINVAL;
-
-        finfo->ino = iunique(dir->i_sb, 2);
-        inode = ncp_iget(dir->i_sb, finfo);
-        if (!inode)
-                goto out_close;
-        d_instantiate(dentry,inode);
-        error = 0;
-out:
-        return error;
-
-out_close:
-        ncp_vdbg("%pd2 failed, closing file\n", dentry);
-        ncp_close_file(NCP_SERVER(dir), finfo->file_handle);
-        goto out;
-}
-
-int ncp_create_new(struct inode *dir, struct dentry *dentry, umode_t mode,
-                   dev_t rdev, __le32 attributes)
-{
-        struct ncp_server *server = NCP_SERVER(dir);
-        struct ncp_entry_info finfo;
-        int error, result, len;
-        int opmode;
-        __u8 __name[NCP_MAXPATHLEN + 1];
-        
-        ncp_vdbg("creating %pd2, mode=%hx\n", dentry, mode);
-
-        ncp_age_dentry(server, dentry);
-        len = sizeof(__name);
-        error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-                           dentry->d_name.len, !ncp_preserve_case(dir));
-        if (error)
-                goto out;
-
-        error = -EACCES;
-        
-        if (S_ISREG(mode) && 
-            (server->m.flags & NCP_MOUNT_EXTRAS) && 
-            (mode & S_IXUGO))
-                attributes |= aSYSTEM | aSHARED;
-        
-        result = ncp_open_create_file_or_subdir(server, dir, __name,
-                                OC_MODE_CREATE | OC_MODE_OPEN | OC_MODE_REPLACE,
-                                attributes, AR_READ | AR_WRITE, &finfo);
-        opmode = O_RDWR;
-        if (result) {
-                result = ncp_open_create_file_or_subdir(server, dir, __name,
-                                OC_MODE_CREATE | OC_MODE_OPEN | OC_MODE_REPLACE,
-                                attributes, AR_WRITE, &finfo);
-                if (result) {
-                        if (result == 0x87)
-                                error = -ENAMETOOLONG;
-                        else if (result < 0)
-                                error = result;
-                        ncp_dbg(1, "%pd2 failed\n", dentry);
-                        goto out;
-                }
-                opmode = O_WRONLY;
-        }
-        finfo.access = opmode;
-        if (ncp_is_nfs_extras(server, finfo.volume)) {
-                finfo.i.nfs.mode = mode;
-                finfo.i.nfs.rdev = new_encode_dev(rdev);
-                if (ncp_modify_nfs_info(server, finfo.volume,
-                                        finfo.i.dirEntNum,
-                                        mode, new_encode_dev(rdev)) != 0)
-                        goto out;
-        }
-
-        error = ncp_instantiate(dir, dentry, &finfo);
-out:
-        return error;
-}
-
-static int ncp_create(struct inode *dir, struct dentry *dentry, umode_t mode,
-                bool excl)
-{
-        return ncp_create_new(dir, dentry, mode, 0, 0);
-}
-
-static int ncp_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
-{
-        struct ncp_entry_info finfo;
-        struct ncp_server *server = NCP_SERVER(dir);
-        int error, len;
-        __u8 __name[NCP_MAXPATHLEN + 1];
-
-        ncp_dbg(1, "making %pd2\n", dentry);
-
-        ncp_age_dentry(server, dentry);
-        len = sizeof(__name);
-        error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-                           dentry->d_name.len, !ncp_preserve_case(dir));
-        if (error)
-                goto out;
-
-        error = ncp_open_create_file_or_subdir(server, dir, __name,
-                                           OC_MODE_CREATE, aDIR,
-                                           cpu_to_le16(0xffff),
-                                           &finfo);
-        if (error == 0) {
-                if (ncp_is_nfs_extras(server, finfo.volume)) {
-                        mode |= S_IFDIR;
-                        finfo.i.nfs.mode = mode;
-                        if (ncp_modify_nfs_info(server,
-                                                finfo.volume,
-                                                finfo.i.dirEntNum,
-                                                mode, 0) != 0)
-                                goto out;
-                }
-                error = ncp_instantiate(dir, dentry, &finfo);
-        } else if (error > 0) {
-                error = -EACCES;
-        }
-out:
-        return error;
-}
-
-static int ncp_rmdir(struct inode *dir, struct dentry *dentry)
-{
-        struct ncp_server *server = NCP_SERVER(dir);
-        int error, result, len;
-        __u8 __name[NCP_MAXPATHLEN + 1];
-
-        ncp_dbg(1, "removing %pd2\n", dentry);
-
-        len = sizeof(__name);
-        error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-                           dentry->d_name.len, !ncp_preserve_case(dir));
-        if (error)
-                goto out;
-
-        result = ncp_del_file_or_subdir(server, dir, __name);
-        switch (result) {
-                case 0x00:
-                        error = 0;
-                        break;
-                case 0x85:      /* unauthorized to delete file */
-                case 0x8A:      /* unauthorized to delete file */
-                        error = -EACCES;
-                        break;
-                case 0x8F:
-                case 0x90:      /* read only */
-                        error = -EPERM;
-                        break;
-                case 0x9F:      /* in use by another client */
-                        error = -EBUSY;
-                        break;
-                case 0xA0:      /* directory not empty */
-                        error = -ENOTEMPTY;
-                        break;
-                case 0xFF:      /* someone deleted file */
-                        error = -ENOENT;
-                        break;
-                default:
-                        error = result < 0 ? result : -EACCES;
-                        break;
-        }
-out:
-        return error;
-}
-
-static int ncp_unlink(struct inode *dir, struct dentry *dentry)
-{
-        struct inode *inode = d_inode(dentry);
-        struct ncp_server *server;
-        int error;
-
-        server = NCP_SERVER(dir);
-        ncp_dbg(1, "unlinking %pd2\n", dentry);
-        
-        /*
-         * Check whether to close the file ...
-         */
-        if (inode) {
-                ncp_vdbg("closing file\n");
-                ncp_make_closed(inode);
-        }
-
-        error = ncp_del_file_or_subdir2(server, dentry);
-#ifdef CONFIG_NCPFS_STRONG
-        /* 9C is Invalid path.. It should be 8F, 90 - read only, but
-           it is not :-( */
-        if ((error == 0x9C || error == 0x90) && server->m.flags & NCP_MOUNT_STRONG) { /* R/O */
-                error = ncp_force_unlink(dir, dentry);
-        }
-#endif
-        switch (error) {
-                case 0x00:
-                        ncp_dbg(1, "removed %pd2\n", dentry);
-                        break;
-                case 0x85:
-                case 0x8A:
-                        error = -EACCES;
-                        break;
-                case 0x8D:      /* some files in use */
-                case 0x8E:      /* all files in use */
-                        error = -EBUSY;
-                        break;
-                case 0x8F:      /* some read only */
-                case 0x90:      /* all read only */
-                case 0x9C:      /* !!! returned when in-use or read-only by NW4 */
-                        error = -EPERM;
-                        break;
-                case 0xFF:
-                        error = -ENOENT;
-                        break;
-                default:
-                        error = error < 0 ? error : -EACCES;
-                        break;
-        }
-        return error;
-}
-
-static int ncp_rename(struct inode *old_dir, struct dentry *old_dentry,
-                      struct inode *new_dir, struct dentry *new_dentry,
-                      unsigned int flags)
-{
-        struct ncp_server *server = NCP_SERVER(old_dir);
-        int error;
-        int old_len, new_len;
-        __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
-
-        if (flags)
-                return -EINVAL;
-
-        ncp_dbg(1, "%pd2 to %pd2\n", old_dentry, new_dentry);
-
-        ncp_age_dentry(server, old_dentry);
-        ncp_age_dentry(server, new_dentry);
-
-        old_len = sizeof(__old_name);
-        error = ncp_io2vol(server, __old_name, &old_len,
-                           old_dentry->d_name.name, old_dentry->d_name.len,
-                           !ncp_preserve_case(old_dir));
-        if (error)
-                goto out;
-
-        new_len = sizeof(__new_name);
-        error = ncp_io2vol(server, __new_name, &new_len,
-                           new_dentry->d_name.name, new_dentry->d_name.len,
-                           !ncp_preserve_case(new_dir));
-        if (error)
-                goto out;
-
-        error = ncp_ren_or_mov_file_or_subdir(server, old_dir, __old_name,
-                                                      new_dir, __new_name);
-#ifdef CONFIG_NCPFS_STRONG
-        if ((error == 0x90 || error == 0x8B || error == -EACCES) &&
-                        server->m.flags & NCP_MOUNT_STRONG) {   /* RO */
-                error = ncp_force_rename(old_dir, old_dentry, __old_name,
-                                         new_dir, new_dentry, __new_name);
-        }
-#endif
-        switch (error) {
-                case 0x00:
-                        ncp_dbg(1, "renamed %pd -> %pd\n",
-                                old_dentry, new_dentry);
-                        ncp_d_prune(old_dentry);
-                        ncp_d_prune(new_dentry);
-                        break;
-                case 0x9E:
-                        error = -ENAMETOOLONG;
-                        break;
-                case 0xFF:
-                        error = -ENOENT;
-                        break;
-                default:
-                        error = error < 0 ? error : -EACCES;
-                        break;
-        }
-out:
-        return error;
-}
-
-static int ncp_mknod(struct inode * dir, struct dentry *dentry,
-                     umode_t mode, dev_t rdev)
-{
-        if (ncp_is_nfs_extras(NCP_SERVER(dir), NCP_FINFO(dir)->volNumber)) {
-                ncp_dbg(1, "mode = 0%ho\n", mode);
-                return ncp_create_new(dir, dentry, mode, rdev, 0);
-        }
-        return -EPERM; /* Strange, but true */
-}
-
-/* The following routines are taken directly from msdos-fs */
-
-/* Linear day numbers of the respective 1sts in non-leap years. */
-
-static int day_n[] =
-{0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334, 0, 0, 0, 0};
-/* Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec */
-
-static int utc2local(int time)
-{
-        return time - sys_tz.tz_minuteswest * 60;
-}
-
-static int local2utc(int time)
-{
-        return time + sys_tz.tz_minuteswest * 60;
-}
-
-/* Convert a MS-DOS time/date pair to a UNIX date (seconds since 1 1 70). */
-int
-ncp_date_dos2unix(__le16 t, __le16 d)
-{
-        unsigned short time = le16_to_cpu(t), date = le16_to_cpu(d);
-        int month, year, secs;
-
-        /* first subtract and mask after that... Otherwise, if
-           date == 0, bad things happen */
-        month = ((date >> 5) - 1) & 15;
-        year = date >> 9;
-        secs = (time & 31) * 2 + 60 * ((time >> 5) & 63) + (time >> 11) * 3600 +
-                86400 * ((date & 31) - 1 + day_n[month] + (year / 4) + 
-                year * 365 - ((year & 3) == 0 && month < 2 ? 1 : 0) + 3653);
-        /* days since 1.1.70 plus 80's leap day */
-        return local2utc(secs);
-}
-
-
-/* Convert linear UNIX date to a MS-DOS time/date pair. */
-void
-ncp_date_unix2dos(int unix_date, __le16 *time, __le16 *date)
-{
-        int day, year, nl_day, month;
-
-        unix_date = utc2local(unix_date);
-        *time = cpu_to_le16(
-                (unix_date % 60) / 2 + (((unix_date / 60) % 60) << 5) +
-                (((unix_date / 3600) % 24) << 11));
-        day = unix_date / 86400 - 3652;
-        year = day / 365;
-        if ((year + 3) / 4 + 365 * year > day)
-                year--;
-        day -= (year + 3) / 4 + 365 * year;
-        if (day == 59 && !(year & 3)) {
-                nl_day = day;
-                month = 2;
-        } else {
-                nl_day = (year & 3) || day <= 59 ? day : day - 1;
-                for (month = 1; month < 12; month++)
-                        if (day_n[month] > nl_day)
-                                break;
-        }
-        *date = cpu_to_le16(nl_day - day_n[month - 1] + 1 + (month << 5) + (year << 9));
-}
diff --git a/fs/ncpfs/file.c b/fs/ncpfs/file.c
deleted file mode 100644
index 8f8cc0334ddd..000000000000
--- a/fs/ncpfs/file.c
+++ /dev/null
@@ -1,263 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- *  file.c
- *
- *  Copyright (C) 1995, 1996 by Volker Lendecke
- *  Modified 1997 Peter Waltenberg, Bill Hawes, David Woodhouse for 2.1 dcache
- *
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/uaccess.h>
-
-#include <linux/time.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/fcntl.h>
-#include <linux/stat.h>
-#include <linux/mm.h>
-#include <linux/vmalloc.h>
-#include <linux/sched.h>
-
-#include "ncp_fs.h"
-
-static int ncp_fsync(struct file *file, loff_t start, loff_t end, int datasync)
-{
-        return file_write_and_wait_range(file, start, end);
-}
-
-/*
- * Open a file with the specified read/write mode.
- */
-int ncp_make_open(struct inode *inode, int right)
-{
-        int error;
-        int access;
-
-        error = -EINVAL;
-        if (!inode) {
-                pr_err("%s: got NULL inode\n", __func__);
-                goto out;
-        }
-
-        ncp_dbg(1, "opened=%d, volume # %u, dir entry # %u\n",
-                atomic_read(&NCP_FINFO(inode)->opened), 
-                NCP_FINFO(inode)->volNumber, 
-                NCP_FINFO(inode)->dirEntNum);
-        error = -EACCES;
-        mutex_lock(&NCP_FINFO(inode)->open_mutex);
-        if (!atomic_read(&NCP_FINFO(inode)->opened)) {
-                struct ncp_entry_info finfo;
-                int result;
-
-                /* tries max. rights */
-                finfo.access = O_RDWR;
-                result = ncp_open_create_file_or_subdir(NCP_SERVER(inode),
-                                        inode, NULL, OC_MODE_OPEN,
-                                        0, AR_READ | AR_WRITE, &finfo);
-                if (!result)
-                        goto update;
-                /* RDWR did not succeeded, try readonly or writeonly as requested */
-                switch (right) {
-                        case O_RDONLY:
-                                finfo.access = O_RDONLY;
-                                result = ncp_open_create_file_or_subdir(NCP_SERVER(inode),
-                                        inode, NULL, OC_MODE_OPEN,
-                                        0, AR_READ, &finfo);
-                                break;
-                        case O_WRONLY:
-                                finfo.access = O_WRONLY;
-                                result = ncp_open_create_file_or_subdir(NCP_SERVER(inode),
-                                        inode, NULL, OC_MODE_OPEN,
-                                        0, AR_WRITE, &finfo);
-                                break;
-                }
-                if (result) {
-                        ncp_vdbg("failed, result=%d\n", result);
-                        goto out_unlock;
-                }
-                /*
-                 * Update the inode information.
-                 */
-        update:
-                ncp_update_inode(inode, &finfo);
-                atomic_set(&NCP_FINFO(inode)->opened, 1);
-        }
-
-        access = NCP_FINFO(inode)->access;
-        ncp_vdbg("file open, access=%x\n", access);
-        if (access == right || access == O_RDWR) {
-                atomic_inc(&NCP_FINFO(inode)->opened);
-                error = 0;
-        }
-
-out_unlock:
-        mutex_unlock(&NCP_FINFO(inode)->open_mutex);
-out:
-        return error;
-}
-
-static ssize_t
-ncp_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
-{
-        struct file *file = iocb->ki_filp;
-        struct inode *inode = file_inode(file);
-        size_t already_read = 0;
-        off_t pos = iocb->ki_pos;
-        size_t bufsize;
-        int error;
-        void *freepage;
-        size_t freelen;
-
-        ncp_dbg(1, "enter %pD2\n", file);
-
-        if (!iov_iter_count(to))
-                return 0;
-        if (pos > inode->i_sb->s_maxbytes)
-                return 0;
-        iov_iter_truncate(to, inode->i_sb->s_maxbytes - pos);
-
-        error = ncp_make_open(inode, O_RDONLY);
-        if (error) {
-                ncp_dbg(1, "open failed, error=%d\n", error);
-                return error;
-        }
-
-        bufsize = NCP_SERVER(inode)->buffer_size;
-
-        error = -EIO;
-        freelen = ncp_read_bounce_size(bufsize);
-        freepage = vmalloc(freelen);
-        if (!freepage)
-                goto outrel;
-        error = 0;
-        /* First read in as much as possible for each bufsize. */
-        while (iov_iter_count(to)) {
-                int read_this_time;
-                size_t to_read = min_t(size_t,
-                                     bufsize - (pos % bufsize),
-                                     iov_iter_count(to));
-
-                error = ncp_read_bounce(NCP_SERVER(inode),
-                                NCP_FINFO(inode)->file_handle,
-                                pos, to_read, to, &read_this_time, 
-                                freepage, freelen);
-                if (error) {
-                        error = -EIO;   /* NW errno -> Linux errno */
-                        break;
-                }
-                pos += read_this_time;
-                already_read += read_this_time;
-
-                if (read_this_time != to_read)
-                        break;
-        }
-        vfree(freepage);
-
-        iocb->ki_pos = pos;
-
-        file_accessed(file);
-
-        ncp_dbg(1, "exit %pD2\n", file);
-outrel:
-        ncp_inode_close(inode);         
-        return already_read ? already_read : error;
-}
-
-static ssize_t
-ncp_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
-{
-        struct file *file = iocb->ki_filp;
-        struct inode *inode = file_inode(file);
-        size_t already_written = 0;
-        size_t bufsize;
-        int errno;
-        void *bouncebuffer;
-        off_t pos;
-
-        ncp_dbg(1, "enter %pD2\n", file);
-        errno = generic_write_checks(iocb, from);
-        if (errno <= 0)
-                return errno;
-
-        errno = ncp_make_open(inode, O_WRONLY);
-        if (errno) {
-                ncp_dbg(1, "open failed, error=%d\n", errno);
-                return errno;
-        }
-        bufsize = NCP_SERVER(inode)->buffer_size;
-
-        errno = file_update_time(file);
-        if (errno)
-                goto outrel;
-
-        bouncebuffer = vmalloc(bufsize);
-        if (!bouncebuffer) {
-                errno = -EIO;   /* -ENOMEM */
-                goto outrel;
-        }
-        pos = iocb->ki_pos;
-        while (iov_iter_count(from)) {
-                int written_this_time;
-                size_t to_write = min_t(size_t,
-                                      bufsize - (pos % bufsize),
-                                      iov_iter_count(from));
-
-                if (!copy_from_iter_full(bouncebuffer, to_write, from)) {
-                        errno = -EFAULT;
-                        break;
-                }
-                if (ncp_write_kernel(NCP_SERVER(inode), 
-                    NCP_FINFO(inode)->file_handle,
-                    pos, to_write, bouncebuffer, &written_this_time) != 0) {
-                        errno = -EIO;
-                        break;
-                }
-                pos += written_this_time;
-                already_written += written_this_time;
-
-                if (written_this_time != to_write)
-                        break;
-        }
-        vfree(bouncebuffer);
-
-        iocb->ki_pos = pos;
-
-        if (pos > i_size_read(inode)) {
-                inode_lock(inode);
-                if (pos > i_size_read(inode))
-                        i_size_write(inode, pos);
-                inode_unlock(inode);
-        }
-        ncp_dbg(1, "exit %pD2\n", file);
-outrel:
-        ncp_inode_close(inode);         
-        return already_written ? already_written : errno;
-}
-
-static int ncp_release(struct inode *inode, struct file *file) {
-        if (ncp_make_closed(inode)) {
-                ncp_dbg(1, "failed to close\n");
-        }
-        return 0;
-}
-
-const struct file_operations ncp_file_operations =
-{
-        .llseek         = generic_file_llseek,
-        .read_iter      = ncp_file_read_iter,
-        .write_iter     = ncp_file_write_iter,
-        .unlocked_ioctl = ncp_ioctl,
-#ifdef CONFIG_COMPAT
-        .compat_ioctl   = ncp_compat_ioctl,
-#endif
-        .mmap           = ncp_mmap,
-        .release        = ncp_release,
-        .fsync          = ncp_fsync,
-};
-
-const struct inode_operations ncp_file_inode_operations =
-{
-        .setattr        = ncp_notify_change,
-};
diff --git a/fs/ncpfs/getopt.c b/fs/ncpfs/getopt.c
deleted file mode 100644
index 5c941bef14c4..000000000000
--- a/fs/ncpfs/getopt.c
+++ /dev/null
@@ -1,76 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * getopt.c
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/kernel.h>
-#include <linux/string.h>
-
-#include <asm/errno.h>
-
-#include "getopt.h"
-
-/**
- *      ncp_getopt - option parser
- *      @caller: name of the caller, for error messages
- *      @options: the options string
- *      @opts: an array of &struct option entries controlling parser operations
- *      @optopt: output; will contain the current option
- *      @optarg: output; will contain the value (if one exists)
- *      @value: output; may be NULL; will be overwritten with the integer value
- *              of the current argument.
- *
- *      Helper to parse options on the format used by mount ("a=b,c=d,e,f").
- *      Returns opts->val if a matching entry in the 'opts' array is found,
- *      0 when no more tokens are found, -1 if an error is encountered.
- */
-int ncp_getopt(const char *caller, char **options, const struct ncp_option *opts,
-               char **optopt, char **optarg, unsigned long *value)
-{
-        char *token;
-        char *val;
-
-        do {
-                if ((token = strsep(options, ",")) == NULL)
-                        return 0;
-        } while (*token == '\0');
-        if (optopt)
-                *optopt = token;
-
-        if ((val = strchr (token, '=')) != NULL) {
-                *val++ = 0;
-        }
-        *optarg = val;
-        for (; opts->name; opts++) {
-                if (!strcmp(opts->name, token)) {
-                        if (!val) {
-                                if (opts->has_arg & OPT_NOPARAM) {
-                                        return opts->val;
-                                }
-                                pr_info("%s: the %s option requires an argument\n",
-                                        caller, token);
-                                return -EINVAL;
-                        }
-                        if (opts->has_arg & OPT_INT) {
-                                int rc = kstrtoul(val, 0, value);
-
-                                if (rc) {
-                                        pr_info("%s: invalid numeric value in %s=%s\n",
-                                                caller, token, val);
-                                        return rc;
-                                }
-                                return opts->val;
-                        }
-                        if (opts->has_arg & OPT_STRING) {
-                                return opts->val;
-                        }
-                        pr_info("%s: unexpected argument %s to the %s option\n",
-                                caller, val, token);
-                        return -EINVAL;
-                }
-        }
-        pr_info("%s: Unrecognized mount option %s\n", caller, token);
-        return -EOPNOTSUPP;
-}
diff --git a/fs/ncpfs/getopt.h b/fs/ncpfs/getopt.h
deleted file mode 100644
index 30f0da317670..000000000000
--- a/fs/ncpfs/getopt.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _LINUX_GETOPT_H
-#define _LINUX_GETOPT_H
-
-#define OPT_NOPARAM     1
-#define OPT_INT         2
-#define OPT_STRING      4
-struct ncp_option {
-        const char *name;
-        unsigned int has_arg;
-        int val;
-};
-
-extern int ncp_getopt(const char *caller, char **options, const struct ncp_option *opts,
-                      char **optopt, char **optarg, unsigned long *value);
-
-#endif /* _LINUX_GETOPT_H */
diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
deleted file mode 100644
index 41de88cdc053..000000000000
--- a/fs/ncpfs/inode.c
+++ /dev/null
@@ -1,1066 +0,0 @@
-/*
- *  inode.c
- *
- *  Copyright (C) 1995, 1996 by Volker Lendecke
- *  Modified for big endian by J.F. Chadima and David S. Miller
- *  Modified 1997 Peter Waltenberg, Bill Hawes, David Woodhouse for 2.1 dcache
- *  Modified 1998 Wolfram Pienkoss for NLS
- *  Modified 2000 Ben Harris, University of Cambridge for NFS NS meta-info
- *
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/module.h>
-
-#include <linux/uaccess.h>
-#include <asm/byteorder.h>
-
-#include <linux/time.h>
-#include <linux/kernel.h>
-#include <linux/mm.h>
-#include <linux/string.h>
-#include <linux/stat.h>
-#include <linux/errno.h>
-#include <linux/file.h>
-#include <linux/fcntl.h>
-#include <linux/slab.h>
-#include <linux/vmalloc.h>
-#include <linux/init.h>
-#include <linux/vfs.h>
-#include <linux/mount.h>
-#include <linux/seq_file.h>
-#include <linux/sched/signal.h>
-#include <linux/namei.h>
-
-#include <net/sock.h>
-
-#include "ncp_fs.h"
-#include "getopt.h"
-
-#define NCP_DEFAULT_FILE_MODE 0600
-#define NCP_DEFAULT_DIR_MODE 0700
-#define NCP_DEFAULT_TIME_OUT 10
-#define NCP_DEFAULT_RETRY_COUNT 20
-
-static void ncp_evict_inode(struct inode *);
-static void ncp_put_super(struct super_block *);
-static int  ncp_statfs(struct dentry *, struct kstatfs *);
-static int  ncp_show_options(struct seq_file *, struct dentry *);
-
-static struct kmem_cache * ncp_inode_cachep;
-
-static struct inode *ncp_alloc_inode(struct super_block *sb)
-{
-        struct ncp_inode_info *ei;
-        ei = (struct ncp_inode_info *)kmem_cache_alloc(ncp_inode_cachep, GFP_KERNEL);
-        if (!ei)
-                return NULL;
-        return &ei->vfs_inode;
-}
-
-static void ncp_i_callback(struct rcu_head *head)
-{
-        struct inode *inode = container_of(head, struct inode, i_rcu);
-        kmem_cache_free(ncp_inode_cachep, NCP_FINFO(inode));
-}
-
-static void ncp_destroy_inode(struct inode *inode)
-{
-        call_rcu(&inode->i_rcu, ncp_i_callback);
-}
-
-static void init_once(void *foo)
-{
-        struct ncp_inode_info *ei = (struct ncp_inode_info *) foo;
-
-        mutex_init(&ei->open_mutex);
-        inode_init_once(&ei->vfs_inode);
-}
-
-static int init_inodecache(void)
-{
-        ncp_inode_cachep = kmem_cache_create("ncp_inode_cache",
-                                             sizeof(struct ncp_inode_info),
-                                             0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
-                                             init_once);
-        if (ncp_inode_cachep == NULL)
-                return -ENOMEM;
-        return 0;
-}
-
-static void destroy_inodecache(void)
-{
-        /*
-         * Make sure all delayed rcu free inodes are flushed before we
-         * destroy cache.
-         */
-        rcu_barrier();
-        kmem_cache_destroy(ncp_inode_cachep);
-}
-
-static int ncp_remount(struct super_block *sb, int *flags, char* data)
-{
-        sync_filesystem(sb);
-        *flags |= SB_NODIRATIME;
-        return 0;
-}
-
-static const struct super_operations ncp_sops =
-{
-        .alloc_inode    = ncp_alloc_inode,
-        .destroy_inode  = ncp_destroy_inode,
-        .drop_inode     = generic_delete_inode,
-        .evict_inode    = ncp_evict_inode,
-        .put_super      = ncp_put_super,
-        .statfs         = ncp_statfs,
-        .remount_fs     = ncp_remount,
-        .show_options   = ncp_show_options,
-};
-
-/*
- * Fill in the ncpfs-specific information in the inode.
- */
-static void ncp_update_dirent(struct inode *inode, struct ncp_entry_info *nwinfo)
-{
-        NCP_FINFO(inode)->DosDirNum = nwinfo->i.DosDirNum;
-        NCP_FINFO(inode)->dirEntNum = nwinfo->i.dirEntNum;
-        NCP_FINFO(inode)->volNumber = nwinfo->volume;
-}
-
-void ncp_update_inode(struct inode *inode, struct ncp_entry_info *nwinfo)
-{
-        ncp_update_dirent(inode, nwinfo);
-        NCP_FINFO(inode)->nwattr = nwinfo->i.attributes;
-        NCP_FINFO(inode)->access = nwinfo->access;
-        memcpy(NCP_FINFO(inode)->file_handle, nwinfo->file_handle,
-                        sizeof(nwinfo->file_handle));
-        ncp_dbg(1, "updated %s, volnum=%d, dirent=%u\n",
-                nwinfo->i.entryName, NCP_FINFO(inode)->volNumber,
-                NCP_FINFO(inode)->dirEntNum);
-}
-
-static void ncp_update_dates(struct inode *inode, struct nw_info_struct *nwi)
-{
-        /* NFS namespace mode overrides others if it's set. */
-        ncp_dbg(1, "(%s) nfs.mode=0%o\n", nwi->entryName, nwi->nfs.mode);
-        if (nwi->nfs.mode) {
-                /* XXX Security? */
-                inode->i_mode = nwi->nfs.mode;
-        }
-
-        inode->i_blocks = (i_size_read(inode) + NCP_BLOCK_SIZE - 1) >> NCP_BLOCK_SHIFT;
-
-        inode->i_mtime.tv_sec = ncp_date_dos2unix(nwi->modifyTime, nwi->modifyDate);
-        inode->i_ctime.tv_sec = ncp_date_dos2unix(nwi->creationTime, nwi->creationDate);
-        inode->i_atime.tv_sec = ncp_date_dos2unix(0, nwi->lastAccessDate);
-        inode->i_atime.tv_nsec = 0;
-        inode->i_mtime.tv_nsec = 0;
-        inode->i_ctime.tv_nsec = 0;
-}
-
-static void ncp_update_attrs(struct inode *inode, struct ncp_entry_info *nwinfo)
-{
-        struct nw_info_struct *nwi = &nwinfo->i;
-        struct ncp_server *server = NCP_SERVER(inode);
-
-        if (nwi->attributes & aDIR) {
-                inode->i_mode = server->m.dir_mode;
-                /* for directories dataStreamSize seems to be some
-                   Object ID ??? */
-                i_size_write(inode, NCP_BLOCK_SIZE);
-        } else {
-                u32 size;
-
-                inode->i_mode = server->m.file_mode;
-                size = le32_to_cpu(nwi->dataStreamSize);
-                i_size_write(inode, size);
-#ifdef CONFIG_NCPFS_EXTRAS
-                if ((server->m.flags & (NCP_MOUNT_EXTRAS|NCP_MOUNT_SYMLINKS)) 
-                 && (nwi->attributes & aSHARED)) {
-                        switch (nwi->attributes & (aHIDDEN|aSYSTEM)) {
-                                case aHIDDEN:
-                                        if (server->m.flags & NCP_MOUNT_SYMLINKS) {
-                                                if (/* (size >= NCP_MIN_SYMLINK_SIZE)
-                                                 && */ (size <= NCP_MAX_SYMLINK_SIZE)) {
-                                                        inode->i_mode = (inode->i_mode & ~S_IFMT) | S_IFLNK;
-                                                        NCP_FINFO(inode)->flags |= NCPI_KLUDGE_SYMLINK;
-                                                        break;
-                                                }
-                                        }
-                                        /* FALLTHROUGH */
-                                case 0:
-                                        if (server->m.flags & NCP_MOUNT_EXTRAS)
-                                                inode->i_mode |= S_IRUGO;
-                                        break;
-                                case aSYSTEM:
-                                        if (server->m.flags & NCP_MOUNT_EXTRAS)
-                                                inode->i_mode |= (inode->i_mode >> 2) & S_IXUGO;
-                                        break;
-                                /* case aSYSTEM|aHIDDEN: */
-                                default:
-                                        /* reserved combination */
-                                        break;
-                        }
-                }
-#endif
-        }
-        if (nwi->attributes & aRONLY) inode->i_mode &= ~S_IWUGO;
-}
-
-void ncp_update_inode2(struct inode* inode, struct ncp_entry_info *nwinfo)
-{
-        NCP_FINFO(inode)->flags = 0;
-        if (!atomic_read(&NCP_FINFO(inode)->opened)) {
-                NCP_FINFO(inode)->nwattr = nwinfo->i.attributes;
-                ncp_update_attrs(inode, nwinfo);
-        }
-
-        ncp_update_dates(inode, &nwinfo->i);
-        ncp_update_dirent(inode, nwinfo);
-}
-
-/*
- * Fill in the inode based on the ncp_entry_info structure.  Used only for brand new inodes.
- */
-static void ncp_set_attr(struct inode *inode, struct ncp_entry_info *nwinfo)
-{
-        struct ncp_server *server = NCP_SERVER(inode);
-
-        NCP_FINFO(inode)->flags = 0;
-        
-        ncp_update_attrs(inode, nwinfo);
-
-        ncp_dbg(2, "inode->i_mode = %u\n", inode->i_mode);
-
-        set_nlink(inode, 1);
-        inode->i_uid = server->m.uid;
-        inode->i_gid = server->m.gid;
-
-        ncp_update_dates(inode, &nwinfo->i);
-        ncp_update_inode(inode, nwinfo);
-}
-
-#if defined(CONFIG_NCPFS_EXTRAS) || defined(CONFIG_NCPFS_NFS_NS)
-static const struct inode_operations ncp_symlink_inode_operations = {
-        .get_link       = page_get_link,
-        .setattr        = ncp_notify_change,
-};
-#endif
-
-/*
- * Get a new inode.
- */
-struct inode * 
-ncp_iget(struct super_block *sb, struct ncp_entry_info *info)
-{
-        struct inode *inode;
-
-        if (info == NULL) {
-                pr_err("%s: info is NULL\n", __func__);
-                return NULL;
-        }
-
-        inode = new_inode(sb);
-        if (inode) {
-                atomic_set(&NCP_FINFO(inode)->opened, info->opened);
-
-                inode->i_ino = info->ino;
-                ncp_set_attr(inode, info);
-                if (S_ISREG(inode->i_mode)) {
-                        inode->i_op = &ncp_file_inode_operations;
-                        inode->i_fop = &ncp_file_operations;
-                } else if (S_ISDIR(inode->i_mode)) {
-                        inode->i_op = &ncp_dir_inode_operations;
-                        inode->i_fop = &ncp_dir_operations;
-#ifdef CONFIG_NCPFS_NFS_NS
-                } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) || S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
-                        init_special_inode(inode, inode->i_mode,
-                                new_decode_dev(info->i.nfs.rdev));
-#endif
-#if defined(CONFIG_NCPFS_EXTRAS) || defined(CONFIG_NCPFS_NFS_NS)
-                } else if (S_ISLNK(inode->i_mode)) {
-                        inode->i_op = &ncp_symlink_inode_operations;
-                        inode_nohighmem(inode);
-                        inode->i_data.a_ops = &ncp_symlink_aops;
-#endif
-                } else {
-                        make_bad_inode(inode);
-                }
-                insert_inode_hash(inode);
-        } else
-                pr_err("%s: iget failed!\n", __func__);
-        return inode;
-}
-
-static void
-ncp_evict_inode(struct inode *inode)
-{
-        truncate_inode_pages_final(&inode->i_data);
-        clear_inode(inode);
-
-        if (S_ISDIR(inode->i_mode)) {
-                ncp_dbg(2, "put directory %ld\n", inode->i_ino);
-        }
-
-        if (ncp_make_closed(inode) != 0) {
-                /* We can't do anything but complain. */
-                pr_err("%s: could not close\n", __func__);
-        }
-}
-
-static void ncp_stop_tasks(struct ncp_server *server) {
-        struct sock* sk = server->ncp_sock->sk;
-
-        lock_sock(sk);
-        sk->sk_error_report = server->error_report;
-        sk->sk_data_ready   = server->data_ready;
-        sk->sk_write_space  = server->write_space;
-        release_sock(sk);
-        del_timer_sync(&server->timeout_tm);
-
-        flush_work(&server->rcv.tq);
-        if (sk->sk_socket->type == SOCK_STREAM)
-                flush_work(&server->tx.tq);
-        else
-                flush_work(&server->timeout_tq);
-}
-
-static int  ncp_show_options(struct seq_file *seq, struct dentry *root)
-{
-        struct ncp_server *server = NCP_SBP(root->d_sb);
-        unsigned int tmp;
-
-        if (!uid_eq(server->m.uid, GLOBAL_ROOT_UID))
-                seq_printf(seq, ",uid=%u",
-                           from_kuid_munged(&init_user_ns, server->m.uid));
-        if (!gid_eq(server->m.gid, GLOBAL_ROOT_GID))
-                seq_printf(seq, ",gid=%u",
-                           from_kgid_munged(&init_user_ns, server->m.gid));
-        if (!uid_eq(server->m.mounted_uid, GLOBAL_ROOT_UID))
-                seq_printf(seq, ",owner=%u",
-                           from_kuid_munged(&init_user_ns, server->m.mounted_uid));
-        tmp = server->m.file_mode & S_IALLUGO;
-        if (tmp != NCP_DEFAULT_FILE_MODE)
-                seq_printf(seq, ",mode=0%o", tmp);
-        tmp = server->m.dir_mode & S_IALLUGO;
-        if (tmp != NCP_DEFAULT_DIR_MODE)
-                seq_printf(seq, ",dirmode=0%o", tmp);
-        if (server->m.time_out != NCP_DEFAULT_TIME_OUT * HZ / 100) {
-                tmp = server->m.time_out * 100 / HZ;
-                seq_printf(seq, ",timeout=%u", tmp);
-        }
-        if (server->m.retry_count != NCP_DEFAULT_RETRY_COUNT)
-                seq_printf(seq, ",retry=%u", server->m.retry_count);
-        if (server->m.flags != 0)
-                seq_printf(seq, ",flags=%lu", server->m.flags);
-        if (server->m.wdog_pid != NULL)
-                seq_printf(seq, ",wdogpid=%u", pid_vnr(server->m.wdog_pid));
-
-        return 0;
-}
-
-static const struct ncp_option ncp_opts[] = {
-        { "uid",        OPT_INT,        'u' },
-        { "gid",        OPT_INT,        'g' },
-        { "owner",      OPT_INT,        'o' },
-        { "mode",       OPT_INT,        'm' },
-        { "dirmode",    OPT_INT,        'd' },
-        { "timeout",    OPT_INT,        't' },
-        { "retry",      OPT_INT,        'r' },
-        { "flags",      OPT_INT,        'f' },
-        { "wdogpid",    OPT_INT,        'w' },
-        { "ncpfd",      OPT_INT,        'n' },
-        { "infofd",     OPT_INT,        'i' },  /* v5 */
-        { "version",    OPT_INT,        'v' },
-        { NULL,         0,              0 } };
-
-static int ncp_parse_options(struct ncp_mount_data_kernel *data, char *options) {
-        int optval;
-        char *optarg;
-        unsigned long optint;
-        int version = 0;
-        int ret;
-
-        data->flags = 0;
-        data->int_flags = 0;
-        data->mounted_uid = GLOBAL_ROOT_UID;
-        data->wdog_pid = NULL;
-        data->ncp_fd = ~0;
-        data->time_out = NCP_DEFAULT_TIME_OUT;
-        data->retry_count = NCP_DEFAULT_RETRY_COUNT;
-        data->uid = GLOBAL_ROOT_UID;
-        data->gid = GLOBAL_ROOT_GID;
-        data->file_mode = NCP_DEFAULT_FILE_MODE;
-        data->dir_mode = NCP_DEFAULT_DIR_MODE;
-        data->info_fd = -1;
-        data->mounted_vol[0] = 0;
-        
-        while ((optval = ncp_getopt("ncpfs", &options, ncp_opts, NULL, &optarg, &optint)) != 0) {
-                ret = optval;
-                if (ret < 0)
-                        goto err;
-                switch (optval) {
-                        case 'u':
-                                data->uid = make_kuid(current_user_ns(), optint);
-                                if (!uid_valid(data->uid)) {
-                                        ret = -EINVAL;
-                                        goto err;
-                                }
-                                break;
-                        case 'g':
-                                data->gid = make_kgid(current_user_ns(), optint);
-                                if (!gid_valid(data->gid)) {
-                                        ret = -EINVAL;
-                                        goto err;
-                                }
-                                break;
-                        case 'o':
-                                data->mounted_uid = make_kuid(current_user_ns(), optint);
-                                if (!uid_valid(data->mounted_uid)) {
-                                        ret = -EINVAL;
-                                        goto err;
-                                }
-                                break;
-                        case 'm':
-                                data->file_mode = optint;
-                                break;
-                        case 'd':
-                                data->dir_mode = optint;
-                                break;
-                        case 't':
-                                data->time_out = optint;
-                                break;
-                        case 'r':
-                                data->retry_count = optint;
-                                break;
-                        case 'f':
-                                data->flags = optint;
-                                break;
-                        case 'w':
-                                data->wdog_pid = find_get_pid(optint);
-                                break;
-                        case 'n':
-                                data->ncp_fd = optint;
-                                break;
-                        case 'i':
-                                data->info_fd = optint;
-                                break;
-                        case 'v':
-                                ret = -ECHRNG;
-                                if (optint < NCP_MOUNT_VERSION_V4)
-                                        goto err;
-                                if (optint > NCP_MOUNT_VERSION_V5)
-                                        goto err;
-                                version = optint;
-                                break;
-                        
-                }
-        }
-        return 0;
-err:
-        put_pid(data->wdog_pid);
-        data->wdog_pid = NULL;
-        return ret;
-}
-
-static int ncp_fill_super(struct super_block *sb, void *raw_data, int silent)
-{
-        struct ncp_mount_data_kernel data;
-        struct ncp_server *server;
-        struct inode *root_inode;
-        struct socket *sock;
-        int error;
-        int default_bufsize;
-#ifdef CONFIG_NCPFS_PACKET_SIGNING
-        int options;
-#endif
-        struct ncp_entry_info finfo;
-
-        memset(&data, 0, sizeof(data));
-        server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
-        if (!server)
-                return -ENOMEM;
-        sb->s_fs_info = server;
-
-        error = -EFAULT;
-        if (raw_data == NULL)
-                goto out;
-        switch (*(int*)raw_data) {
-                case NCP_MOUNT_VERSION:
-                        {
-                                struct ncp_mount_data* md = (struct ncp_mount_data*)raw_data;
-
-                                data.flags = md->flags;
-                                data.int_flags = NCP_IMOUNT_LOGGEDIN_POSSIBLE;
-                                data.mounted_uid = make_kuid(current_user_ns(), md->mounted_uid);
-                                data.wdog_pid = find_get_pid(md->wdog_pid);
-                                data.ncp_fd = md->ncp_fd;
-                                data.time_out = md->time_out;
-                                data.retry_count = md->retry_count;
-                                data.uid = make_kuid(current_user_ns(), md->uid);
-                                data.gid = make_kgid(current_user_ns(), md->gid);
-                                data.file_mode = md->file_mode;
-                                data.dir_mode = md->dir_mode;
-                                data.info_fd = -1;
-                                memcpy(data.mounted_vol, md->mounted_vol,
-                                        NCP_VOLNAME_LEN+1);
-                        }
-                        break;
-                case NCP_MOUNT_VERSION_V4:
-                        {
-                                struct ncp_mount_data_v4* md = (struct ncp_mount_data_v4*)raw_data;
-
-                                data.flags = md->flags;
-                                data.mounted_uid = make_kuid(current_user_ns(), md->mounted_uid);
-                                data.wdog_pid = find_get_pid(md->wdog_pid);
-                                data.ncp_fd = md->ncp_fd;
-                                data.time_out = md->time_out;
-                                data.retry_count = md->retry_count;
-                                data.uid = make_kuid(current_user_ns(), md->uid);
-                                data.gid = make_kgid(current_user_ns(), md->gid);
-                                data.file_mode = md->file_mode;
-                                data.dir_mode = md->dir_mode;
-                                data.info_fd = -1;
-                        }
-                        break;
-                default:
-                        error = -ECHRNG;
-                        if (memcmp(raw_data, "vers", 4) == 0) {
-                                error = ncp_parse_options(&data, raw_data);
-                        }
-                        if (error)
-                                goto out;
-                        break;
-        }
-        error = -EINVAL;
-        if (!uid_valid(data.mounted_uid) || !uid_valid(data.uid) ||
-            !gid_valid(data.gid))
-                goto out;
-        sock = sockfd_lookup(data.ncp_fd, &error);
-        if (!sock)
-                goto out;
-
-        if (sock->type == SOCK_STREAM)
-                default_bufsize = 0xF000;
-        else
-                default_bufsize = 1024;
-
-        sb->s_flags |= SB_NODIRATIME;   /* probably even noatime */
-        sb->s_maxbytes = 0xFFFFFFFFU;
-        sb->s_blocksize = 1024; /* Eh...  Is this correct? */
-        sb->s_blocksize_bits = 10;
-        sb->s_magic = NCP_SUPER_MAGIC;
-        sb->s_op = &ncp_sops;
-        sb->s_d_op = &ncp_dentry_operations;
-
-        server = NCP_SBP(sb);
-        memset(server, 0, sizeof(*server));
-
-        error = super_setup_bdi(sb);
-        if (error)
-                goto out_fput;
-
-        server->ncp_sock = sock;
-        
-        if (data.info_fd != -1) {
-                struct socket *info_sock = sockfd_lookup(data.info_fd, &error);
-                if (!info_sock)
-                        goto out_fput;
-                server->info_sock = info_sock;
-                error = -EBADFD;
-                if (info_sock->type != SOCK_STREAM)
-                        goto out_fput2;
-        }
-
-/*      server->lock = 0;       */
-        mutex_init(&server->mutex);
-        server->packet = NULL;
-/*      server->buffer_size = 0;        */
-/*      server->conn_status = 0;        */
-/*      server->root_dentry = NULL;     */
-/*      server->root_setuped = 0;       */
-        mutex_init(&server->root_setup_lock);
-#ifdef CONFIG_NCPFS_PACKET_SIGNING
-/*      server->sign_wanted = 0;        */
-/*      server->sign_active = 0;        */
-#endif
-        init_rwsem(&server->auth_rwsem);
-        server->auth.auth_type = NCP_AUTH_NONE;
-/*      server->auth.object_name_len = 0;       */
-/*      server->auth.object_name = NULL;        */
-/*      server->auth.object_type = 0;           */
-/*      server->priv.len = 0;                   */
-/*      server->priv.data = NULL;               */
-
-        server->m = data;
-        /* Although anything producing this is buggy, it happens
-           now because of PATH_MAX changes.. */
-        if (server->m.time_out < 1) {
-                server->m.time_out = 10;
-                pr_info("You need to recompile your ncpfs utils..\n");
-        }
-        server->m.time_out = server->m.time_out * HZ / 100;
-        server->m.file_mode = (server->m.file_mode & S_IRWXUGO) | S_IFREG;
-        server->m.dir_mode = (server->m.dir_mode & S_IRWXUGO) | S_IFDIR;
-
-#ifdef CONFIG_NCPFS_NLS
-        /* load the default NLS charsets */
-        server->nls_vol = load_nls_default();
-        server->nls_io = load_nls_default();
-#endif /* CONFIG_NCPFS_NLS */
-
-        atomic_set(&server->dentry_ttl, 0);     /* no caching */
-
-        INIT_LIST_HEAD(&server->tx.requests);
-        mutex_init(&server->rcv.creq_mutex);
-        server->tx.creq         = NULL;
-        server->rcv.creq        = NULL;
-
-        timer_setup(&server->timeout_tm, ncpdgram_timeout_call, 0);
-#undef NCP_PACKET_SIZE
-#define NCP_PACKET_SIZE 131072
-        error = -ENOMEM;
-        server->packet_size = NCP_PACKET_SIZE;
-        server->packet = vmalloc(NCP_PACKET_SIZE);
-        if (server->packet == NULL)
-                goto out_nls;
-        server->txbuf = vmalloc(NCP_PACKET_SIZE);
-        if (server->txbuf == NULL)
-                goto out_packet;
-        server->rxbuf = vmalloc(NCP_PACKET_SIZE);
-        if (server->rxbuf == NULL)
-                goto out_txbuf;
-
-        lock_sock(sock->sk);
-        server->data_ready      = sock->sk->sk_data_ready;
-        server->write_space     = sock->sk->sk_write_space;
-        server->error_report    = sock->sk->sk_error_report;
-        sock->sk->sk_user_data  = server;
-        sock->sk->sk_data_ready   = ncp_tcp_data_ready;
-        sock->sk->sk_error_report = ncp_tcp_error_report;
-        if (sock->type == SOCK_STREAM) {
-                server->rcv.ptr = (unsigned char*)&server->rcv.buf;
-                server->rcv.len = 10;
-                server->rcv.state = 0;
-                INIT_WORK(&server->rcv.tq, ncp_tcp_rcv_proc);
-                INIT_WORK(&server->tx.tq, ncp_tcp_tx_proc);
-                sock->sk->sk_write_space = ncp_tcp_write_space;
-        } else {
-                INIT_WORK(&server->rcv.tq, ncpdgram_rcv_proc);
-                INIT_WORK(&server->timeout_tq, ncpdgram_timeout_proc);
-        }
-        release_sock(sock->sk);
-
-        ncp_lock_server(server);
-        error = ncp_connect(server);
-        ncp_unlock_server(server);
-        if (error < 0)
-                goto out_rxbuf;
-        ncp_dbg(1, "NCP_SBP(sb) = %p\n", NCP_SBP(sb));
-
-        error = -EMSGSIZE;      /* -EREMOTESIDEINCOMPATIBLE */
-#ifdef CONFIG_NCPFS_PACKET_SIGNING
-        if (ncp_negotiate_size_and_options(server, default_bufsize,
-                NCP_DEFAULT_OPTIONS, &(server->buffer_size), &options) == 0)
-        {
-                if (options != NCP_DEFAULT_OPTIONS)
-                {
-                        if (ncp_negotiate_size_and_options(server, 
-                                default_bufsize,
-                                options & 2, 
-                                &(server->buffer_size), &options) != 0)
-                                
-                        {
-                                goto out_disconnect;
-                        }
-                }
-                ncp_lock_server(server);
-                if (options & 2)
-                        server->sign_wanted = 1;
-                ncp_unlock_server(server);
-        }
-        else 
-#endif  /* CONFIG_NCPFS_PACKET_SIGNING */
-        if (ncp_negotiate_buffersize(server, default_bufsize,
-                                     &(server->buffer_size)) != 0)
-                goto out_disconnect;
-        ncp_dbg(1, "bufsize = %d\n", server->buffer_size);
-
-        memset(&finfo, 0, sizeof(finfo));
-        finfo.i.attributes      = aDIR;
-        finfo.i.dataStreamSize  = 0;    /* ignored */
-        finfo.i.dirEntNum       = 0;
-        finfo.i.DosDirNum       = 0;
-#ifdef CONFIG_NCPFS_SMALLDOS
-        finfo.i.NSCreator       = NW_NS_DOS;
-#endif
-        finfo.volume            = NCP_NUMBER_OF_VOLUMES;
-        /* set dates of mountpoint to Jan 1, 1986; 00:00 */
-        finfo.i.creationTime    = finfo.i.modifyTime
-                                = cpu_to_le16(0x0000);
-        finfo.i.creationDate    = finfo.i.modifyDate
-                                = finfo.i.lastAccessDate
-                                = cpu_to_le16(0x0C21);
-        finfo.i.nameLen         = 0;
-        finfo.i.entryName[0]    = '\0';
-
-        finfo.opened            = 0;
-        finfo.ino               = 2;    /* tradition */
-
-        server->name_space[finfo.volume] = NW_NS_DOS;
-
-        error = -ENOMEM;
-        root_inode = ncp_iget(sb, &finfo);
-        if (!root_inode)
-                goto out_disconnect;
-        ncp_dbg(1, "root vol=%d\n", NCP_FINFO(root_inode)->volNumber);
-        sb->s_root = d_make_root(root_inode);
-        if (!sb->s_root)
-                goto out_disconnect;
-        return 0;
-
-out_disconnect:
-        ncp_lock_server(server);
-        ncp_disconnect(server);
-        ncp_unlock_server(server);
-out_rxbuf:
-        ncp_stop_tasks(server);
-        vfree(server->rxbuf);
-out_txbuf:
-        vfree(server->txbuf);
-out_packet:
-        vfree(server->packet);
-out_nls:
-#ifdef CONFIG_NCPFS_NLS
-        unload_nls(server->nls_io);
-        unload_nls(server->nls_vol);
-#endif
-        mutex_destroy(&server->rcv.creq_mutex);
-        mutex_destroy(&server->root_setup_lock);
-        mutex_destroy(&server->mutex);
-out_fput2:
-        if (server->info_sock)
-                sockfd_put(server->info_sock);
-out_fput:
-        sockfd_put(sock);
-out:
-        put_pid(data.wdog_pid);
-        sb->s_fs_info = NULL;
-        kfree(server);
-        return error;
-}
-
-static void delayed_free(struct rcu_head *p)
-{
-        struct ncp_server *server = container_of(p, struct ncp_server, rcu);
-#ifdef CONFIG_NCPFS_NLS
-        /* unload the NLS charsets */
-        unload_nls(server->nls_vol);
-        unload_nls(server->nls_io);
-#endif /* CONFIG_NCPFS_NLS */
-        kfree(server);
-}
-
-static void ncp_put_super(struct super_block *sb)
-{
-        struct ncp_server *server = NCP_SBP(sb);
-
-        ncp_lock_server(server);
-        ncp_disconnect(server);
-        ncp_unlock_server(server);
-
-        ncp_stop_tasks(server);
-
-        mutex_destroy(&server->rcv.creq_mutex);
-        mutex_destroy(&server->root_setup_lock);
-        mutex_destroy(&server->mutex);
-
-        if (server->info_sock)
-                sockfd_put(server->info_sock);
-        sockfd_put(server->ncp_sock);
-        kill_pid(server->m.wdog_pid, SIGTERM, 1);
-        put_pid(server->m.wdog_pid);
-
-        kfree(server->priv.data);
-        kfree(server->auth.object_name);
-        vfree(server->rxbuf);
-        vfree(server->txbuf);
-        vfree(server->packet);
-        call_rcu(&server->rcu, delayed_free);
-}
-
-static int ncp_statfs(struct dentry *dentry, struct kstatfs *buf)
-{
-        struct dentry* d;
-        struct inode* i;
-        struct ncp_inode_info* ni;
-        struct ncp_server* s;
-        struct ncp_volume_info vi;
-        struct super_block *sb = dentry->d_sb;
-        int err;
-        __u8 dh;
-        
-        d = sb->s_root;
-        if (!d) {
-                goto dflt;
-        }
-        i = d_inode(d);
-        if (!i) {
-                goto dflt;
-        }
-        ni = NCP_FINFO(i);
-        if (!ni) {
-                goto dflt;
-        }
-        s = NCP_SBP(sb);
-        if (!s) {
-                goto dflt;
-        }
-        if (!s->m.mounted_vol[0]) {
-                goto dflt;
-        }
-
-        err = ncp_dirhandle_alloc(s, ni->volNumber, ni->DosDirNum, &dh);
-        if (err) {
-                goto dflt;
-        }
-        err = ncp_get_directory_info(s, dh, &vi);
-        ncp_dirhandle_free(s, dh);
-        if (err) {
-                goto dflt;
-        }
-        buf->f_type = NCP_SUPER_MAGIC;
-        buf->f_bsize = vi.sectors_per_block * 512;
-        buf->f_blocks = vi.total_blocks;
-        buf->f_bfree = vi.free_blocks;
-        buf->f_bavail = vi.free_blocks;
-        buf->f_files = vi.total_dir_entries;
-        buf->f_ffree = vi.available_dir_entries;
-        buf->f_namelen = 12;
-        return 0;
-
-        /* We cannot say how much disk space is left on a mounted
-           NetWare Server, because free space is distributed over
-           volumes, and the current user might have disk quotas. So
-           free space is not that simple to determine. Our decision
-           here is to err conservatively. */
-
-dflt:;
-        buf->f_type = NCP_SUPER_MAGIC;
-        buf->f_bsize = NCP_BLOCK_SIZE;
-        buf->f_blocks = 0;
-        buf->f_bfree = 0;
-        buf->f_bavail = 0;
-        buf->f_namelen = 12;
-        return 0;
-}
-
-int ncp_notify_change(struct dentry *dentry, struct iattr *attr)
-{
-        struct inode *inode = d_inode(dentry);
-        int result = 0;
-        __le32 info_mask;
-        struct nw_modify_dos_info info;
-        struct ncp_server *server;
-
-        result = -EIO;
-
-        server = NCP_SERVER(inode);
-        if (!server)    /* How this could happen? */
-                goto out;
-
-        result = -EPERM;
-        if (IS_DEADDIR(d_inode(dentry)))
-                goto out;
-
-        /* ageing the dentry to force validation */
-        ncp_age_dentry(server, dentry);
-
-        result = setattr_prepare(dentry, attr);
-        if (result < 0)
-                goto out;
-
-        result = -EPERM;
-        if ((attr->ia_valid & ATTR_UID) && !uid_eq(attr->ia_uid, server->m.uid))
-                goto out;
-
-        if ((attr->ia_valid & ATTR_GID) && !gid_eq(attr->ia_gid, server->m.gid))
-                goto out;
-
-        if (((attr->ia_valid & ATTR_MODE) &&
-             (attr->ia_mode &
-              ~(S_IFREG | S_IFDIR | S_IRWXUGO))))
-                goto out;
-
-        info_mask = 0;
-        memset(&info, 0, sizeof(info));
-
-#if 1 
-        if ((attr->ia_valid & ATTR_MODE) != 0)
-        {
-                umode_t newmode = attr->ia_mode;
-
-                info_mask |= DM_ATTRIBUTES;
-
-                if (S_ISDIR(inode->i_mode)) {
-                        newmode &= server->m.dir_mode;
-                } else {
-#ifdef CONFIG_NCPFS_EXTRAS                      
-                        if (server->m.flags & NCP_MOUNT_EXTRAS) {
-                                /* any non-default execute bit set */
-                                if (newmode & ~server->m.file_mode & S_IXUGO)
-                                        info.attributes |= aSHARED | aSYSTEM;
-                                /* read for group/world and not in default file_mode */
-                                else if (newmode & ~server->m.file_mode & S_IRUGO)
-                                        info.attributes |= aSHARED;
-                        } else
-#endif
-                                newmode &= server->m.file_mode;                 
-                }
-                if (newmode & S_IWUGO)
-                        info.attributes &= ~(aRONLY|aRENAMEINHIBIT|aDELETEINHIBIT);
-                else
-                        info.attributes |=  (aRONLY|aRENAMEINHIBIT|aDELETEINHIBIT);
-
-#ifdef CONFIG_NCPFS_NFS_NS
-                if (ncp_is_nfs_extras(server, NCP_FINFO(inode)->volNumber)) {
-                        result = ncp_modify_nfs_info(server,
-                                                     NCP_FINFO(inode)->volNumber,
-                                                     NCP_FINFO(inode)->dirEntNum,
-                                                     attr->ia_mode, 0);
-                        if (result != 0)
-                                goto out;
-                        info.attributes &= ~(aSHARED | aSYSTEM);
-                        {
-                                /* mark partial success */
-                                struct iattr tmpattr;
-                                
-                                tmpattr.ia_valid = ATTR_MODE;
-                                tmpattr.ia_mode = attr->ia_mode;
-
-                                setattr_copy(inode, &tmpattr);
-                                mark_inode_dirty(inode);
-                        }
-                }
-#endif
-        }
-#endif
-
-        /* Do SIZE before attributes, otherwise mtime together with size does not work...
-         */
-        if ((attr->ia_valid & ATTR_SIZE) != 0) {
-                int written;
-
-                ncp_dbg(1, "trying to change size to %llu\n", attr->ia_size);
-
-                if ((result = ncp_make_open(inode, O_WRONLY)) < 0) {
-                        result = -EACCES;
-                        goto out;
-                }
-                ncp_write_kernel(NCP_SERVER(inode), NCP_FINFO(inode)->file_handle,
-                          attr->ia_size, 0, "", &written);
-
-                /* According to ndir, the changes only take effect after
-                   closing the file */
-                ncp_inode_close(inode);
-                result = ncp_make_closed(inode);
-                if (result)
-                        goto out;
-
-                if (attr->ia_size != i_size_read(inode)) {
-                        truncate_setsize(inode, attr->ia_size);
-                        mark_inode_dirty(inode);
-                }
-        }
-        if ((attr->ia_valid & ATTR_CTIME) != 0) {
-                info_mask |= (DM_CREATE_TIME | DM_CREATE_DATE);
-                ncp_date_unix2dos(attr->ia_ctime.tv_sec,
-                             &info.creationTime, &info.creationDate);
-        }
-        if ((attr->ia_valid & ATTR_MTIME) != 0) {
-                info_mask |= (DM_MODIFY_TIME | DM_MODIFY_DATE);
-                ncp_date_unix2dos(attr->ia_mtime.tv_sec,
-                                  &info.modifyTime, &info.modifyDate);
-        }
-        if ((attr->ia_valid & ATTR_ATIME) != 0) {
-                __le16 dummy;
-                info_mask |= (DM_LAST_ACCESS_DATE);
-                ncp_date_unix2dos(attr->ia_atime.tv_sec,
-                                  &dummy, &info.lastAccessDate);
-        }
-        if (info_mask != 0) {
-                result = ncp_modify_file_or_subdir_dos_info(NCP_SERVER(inode),
-                                      inode, info_mask, &info);
-                if (result != 0) {
-                        if (info_mask == (DM_CREATE_TIME | DM_CREATE_DATE)) {
-                                /* NetWare seems not to allow this. I
-                                   do not know why. So, just tell the
-                                   user everything went fine. This is
-                                   a terrible hack, but I do not know
-                                   how to do this correctly. */
-                                result = 0;
-                        } else
-                                goto out;
-                }
-#ifdef CONFIG_NCPFS_STRONG              
-                if ((!result) && (info_mask & DM_ATTRIBUTES))
-                        NCP_FINFO(inode)->nwattr = info.attributes;
-#endif
-        }
-        if (result)
-                goto out;
-
-        setattr_copy(inode, attr);
-        mark_inode_dirty(inode);
-
-out:
-        if (result > 0)
-                result = -EACCES;
-        return result;
-}
-
-static struct dentry *ncp_mount(struct file_system_type *fs_type,
-        int flags, const char *dev_name, void *data)
-{
-        return mount_nodev(fs_type, flags, data, ncp_fill_super);
-}
-
-static struct file_system_type ncp_fs_type = {
-        .owner          = THIS_MODULE,
-        .name           = "ncpfs",
-        .mount          = ncp_mount,
-        .kill_sb        = kill_anon_super,
-        .fs_flags       = FS_BINARY_MOUNTDATA,
-};
-MODULE_ALIAS_FS("ncpfs");
-
-static int __init init_ncp_fs(void)
-{
-        int err;
-        ncp_dbg(1, "called\n");
-
-        err = init_inodecache();
-        if (err)
-                goto out1;
-        err = register_filesystem(&ncp_fs_type);
-        if (err)
-                goto out;
-        return 0;
-out:
-        destroy_inodecache();
-out1:
-        return err;
-}
-
-static void __exit exit_ncp_fs(void)
-{
-        ncp_dbg(1, "called\n");
-        unregister_filesystem(&ncp_fs_type);
-        destroy_inodecache();
-}
-
-module_init(init_ncp_fs)
-module_exit(exit_ncp_fs)
-MODULE_LICENSE("GPL");
diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c
deleted file mode 100644
index d378b98cd7b6..000000000000
--- a/fs/ncpfs/ioctl.c
+++ /dev/null
@@ -1,923 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- *  ioctl.c
- *
- *  Copyright (C) 1995, 1996 by Volker Lendecke
- *  Modified 1997 Peter Waltenberg, Bill Hawes, David Woodhouse for 2.1 dcache
- *  Modified 1998, 1999 Wolfram Pienkoss for NLS
- *
- */
-
-#include <linux/capability.h>
-#include <linux/compat.h>
-#include <linux/errno.h>
-#include <linux/fs.h>
-#include <linux/ioctl.h>
-#include <linux/time.h>
-#include <linux/mm.h>
-#include <linux/mount.h>
-#include <linux/slab.h>
-#include <linux/highuid.h>
-#include <linux/vmalloc.h>
-#include <linux/sched.h>
-#include <linux/cred.h>
-
-#include <linux/uaccess.h>
-
-#include "ncp_fs.h"
-
-/* maximum limit for ncp_objectname_ioctl */
-#define NCP_OBJECT_NAME_MAX_LEN 4096
-/* maximum limit for ncp_privatedata_ioctl */
-#define NCP_PRIVATE_DATA_MAX_LEN 8192
-/* maximum negotiable packet size */
-#define NCP_PACKET_SIZE_INTERNAL 65536
-
-static int
-ncp_get_fs_info(struct ncp_server * server, struct inode *inode,
-                struct ncp_fs_info __user *arg)
-{
-        struct ncp_fs_info info;
-
-        if (copy_from_user(&info, arg, sizeof(info)))
-                return -EFAULT;
-
-        if (info.version != NCP_GET_FS_INFO_VERSION) {
-                ncp_dbg(1, "info.version invalid: %d\n", info.version);
-                return -EINVAL;
-        }
-        /* TODO: info.addr = server->m.serv_addr; */
-        SET_UID(info.mounted_uid, from_kuid_munged(current_user_ns(), server->m.mounted_uid));
-        info.connection         = server->connection;
-        info.buffer_size        = server->buffer_size;
-        info.volume_number      = NCP_FINFO(inode)->volNumber;
-        info.directory_id       = NCP_FINFO(inode)->DosDirNum;
-
-        if (copy_to_user(arg, &info, sizeof(info)))
-                return -EFAULT;
-        return 0;
-}
-
-static int
-ncp_get_fs_info_v2(struct ncp_server * server, struct inode *inode,
-                   struct ncp_fs_info_v2 __user * arg)
-{
-        struct ncp_fs_info_v2 info2;
-
-        if (copy_from_user(&info2, arg, sizeof(info2)))
-                return -EFAULT;
-
-        if (info2.version != NCP_GET_FS_INFO_VERSION_V2) {
-                ncp_dbg(1, "info.version invalid: %d\n", info2.version);
-                return -EINVAL;
-        }
-        info2.mounted_uid   = from_kuid_munged(current_user_ns(), server->m.mounted_uid);
-        info2.connection    = server->connection;
-        info2.buffer_size   = server->buffer_size;
-        info2.volume_number = NCP_FINFO(inode)->volNumber;
-        info2.directory_id  = NCP_FINFO(inode)->DosDirNum;
-        info2.dummy1 = info2.dummy2 = info2.dummy3 = 0;
-
-        if (copy_to_user(arg, &info2, sizeof(info2)))
-                return -EFAULT;
-        return 0;
-}
-
-#ifdef CONFIG_COMPAT
-struct compat_ncp_objectname_ioctl
-{
-        s32             auth_type;
-        u32             object_name_len;
-        compat_caddr_t  object_name;    /* a userspace data, in most cases user name */
-};
-
-struct compat_ncp_fs_info_v2 {
-        s32 version;
-        u32 mounted_uid;
-        u32 connection;
-        u32 buffer_size;
-
-        u32 volume_number;
-        u32 directory_id;
-
-        u32 dummy1;
-        u32 dummy2;
-        u32 dummy3;
-};
-
-struct compat_ncp_ioctl_request {
-        u32 function;
-        u32 size;
-        compat_caddr_t data;
-};
-
-struct compat_ncp_privatedata_ioctl
-{
-        u32             len;
-        compat_caddr_t  data;           /* ~1000 for NDS */
-};
-
-#define NCP_IOC_GET_FS_INFO_V2_32       _IOWR('n', 4, struct compat_ncp_fs_info_v2)
-#define NCP_IOC_NCPREQUEST_32           _IOR('n', 1, struct compat_ncp_ioctl_request)
-#define NCP_IOC_GETOBJECTNAME_32        _IOWR('n', 9, struct compat_ncp_objectname_ioctl)
-#define NCP_IOC_SETOBJECTNAME_32        _IOR('n', 9, struct compat_ncp_objectname_ioctl)
-#define NCP_IOC_GETPRIVATEDATA_32       _IOWR('n', 10, struct compat_ncp_privatedata_ioctl)
-#define NCP_IOC_SETPRIVATEDATA_32       _IOR('n', 10, struct compat_ncp_privatedata_ioctl)
-
-static int
-ncp_get_compat_fs_info_v2(struct ncp_server * server, struct inode *inode,
-                   struct compat_ncp_fs_info_v2 __user * arg)
-{
-        struct compat_ncp_fs_info_v2 info2;
-
-        if (copy_from_user(&info2, arg, sizeof(info2)))
-                return -EFAULT;
-
-        if (info2.version != NCP_GET_FS_INFO_VERSION_V2) {
-                ncp_dbg(1, "info.version invalid: %d\n", info2.version);
-                return -EINVAL;
-        }
-        info2.mounted_uid   = from_kuid_munged(current_user_ns(), server->m.mounted_uid);
-        info2.connection    = server->connection;
-        info2.buffer_size   = server->buffer_size;
-        info2.volume_number = NCP_FINFO(inode)->volNumber;
-        info2.directory_id  = NCP_FINFO(inode)->DosDirNum;
-        info2.dummy1 = info2.dummy2 = info2.dummy3 = 0;
-
-        if (copy_to_user(arg, &info2, sizeof(info2)))
-                return -EFAULT;
-        return 0;
-}
-#endif
-
-#define NCP_IOC_GETMOUNTUID16           _IOW('n', 2, u16)
-#define NCP_IOC_GETMOUNTUID32           _IOW('n', 2, u32)
-#define NCP_IOC_GETMOUNTUID64           _IOW('n', 2, u64)
-
-#ifdef CONFIG_NCPFS_NLS
-/* Here we are select the iocharset and the codepage for NLS.
- * Thanks Petr Vandrovec for idea and many hints.
- */
-static int
-ncp_set_charsets(struct ncp_server* server, struct ncp_nls_ioctl __user *arg)
-{
-        struct ncp_nls_ioctl user;
-        struct nls_table *codepage;
-        struct nls_table *iocharset;
-        struct nls_table *oldset_io;
-        struct nls_table *oldset_cp;
-        int utf8;
-        int err;
-
-        if (copy_from_user(&user, arg, sizeof(user)))
-                return -EFAULT;
-
-        codepage = NULL;
-        user.codepage[NCP_IOCSNAME_LEN] = 0;
-        if (!user.codepage[0] || !strcmp(user.codepage, "default"))
-                codepage = load_nls_default();
-        else {
-                codepage = load_nls(user.codepage);
-                if (!codepage) {
-                        return -EBADRQC;
-                }
-        }
-
-        iocharset = NULL;
-        user.iocharset[NCP_IOCSNAME_LEN] = 0;
-        if (!user.iocharset[0] || !strcmp(user.iocharset, "default")) {
-                iocharset = load_nls_default();
-                utf8 = 0;
-        } else if (!strcmp(user.iocharset, "utf8")) {
-                iocharset = load_nls_default();
-                utf8 = 1;
-        } else {
-                iocharset = load_nls(user.iocharset);
-                if (!iocharset) {
-                        unload_nls(codepage);
-                        return -EBADRQC;
-                }
-                utf8 = 0;
-        }
-
-        mutex_lock(&server->root_setup_lock);
-        if (server->root_setuped) {
-                oldset_cp = codepage;
-                oldset_io = iocharset;
-                err = -EBUSY;
-        } else {
-                if (utf8)
-                        NCP_SET_FLAG(server, NCP_FLAG_UTF8);
-                else
-                        NCP_CLR_FLAG(server, NCP_FLAG_UTF8);
-                oldset_cp = server->nls_vol;
-                server->nls_vol = codepage;
-                oldset_io = server->nls_io;
-                server->nls_io = iocharset;
-                err = 0;
-        }
-        mutex_unlock(&server->root_setup_lock);
-        unload_nls(oldset_cp);
-        unload_nls(oldset_io);
-
-        return err;
-}
-
-static int
-ncp_get_charsets(struct ncp_server* server, struct ncp_nls_ioctl __user *arg)
-{
-        struct ncp_nls_ioctl user;
-        int len;
-
-        memset(&user, 0, sizeof(user));
-        mutex_lock(&server->root_setup_lock);
-        if (server->nls_vol && server->nls_vol->charset) {
-                len = strlen(server->nls_vol->charset);
-                if (len > NCP_IOCSNAME_LEN)
-                        len = NCP_IOCSNAME_LEN;
-                strncpy(user.codepage, server->nls_vol->charset, len);
-                user.codepage[len] = 0;
-        }
-
-        if (NCP_IS_FLAG(server, NCP_FLAG_UTF8))
-                strcpy(user.iocharset, "utf8");
-        else if (server->nls_io && server->nls_io->charset) {
-                len = strlen(server->nls_io->charset);
-                if (len > NCP_IOCSNAME_LEN)
-                        len = NCP_IOCSNAME_LEN;
-                strncpy(user.iocharset, server->nls_io->charset, len);
-                user.iocharset[len] = 0;
-        }
-        mutex_unlock(&server->root_setup_lock);
-
-        if (copy_to_user(arg, &user, sizeof(user)))
-                return -EFAULT;
-        return 0;
-}
-#endif /* CONFIG_NCPFS_NLS */
-
-static long __ncp_ioctl(struct inode *inode, unsigned int cmd, unsigned long arg)
-{
-        struct ncp_server *server = NCP_SERVER(inode);
-        int result;
-        struct ncp_ioctl_request request;
-        char* bouncebuffer;
-        void __user *argp = (void __user *)arg;
-
-        switch (cmd) {
-#ifdef CONFIG_COMPAT
-        case NCP_IOC_NCPREQUEST_32:
-#endif
-        case NCP_IOC_NCPREQUEST:
-#ifdef CONFIG_COMPAT
-                if (cmd == NCP_IOC_NCPREQUEST_32) {
-                        struct compat_ncp_ioctl_request request32;
-                        if (copy_from_user(&request32, argp, sizeof(request32)))
-                                return -EFAULT;
-                        request.function = request32.function;
-                        request.size = request32.size;
-                        request.data = compat_ptr(request32.data);
-                } else
-#endif
-                if (copy_from_user(&request, argp, sizeof(request)))
-                        return -EFAULT;
-
-                if ((request.function > 255)
-                    || (request.size >
-                  NCP_PACKET_SIZE - sizeof(struct ncp_request_header))) {
-                        return -EINVAL;
-                }
-                bouncebuffer = vmalloc(NCP_PACKET_SIZE_INTERNAL);
-                if (!bouncebuffer)
-                        return -ENOMEM;
-                if (copy_from_user(bouncebuffer, request.data, request.size)) {
-                        vfree(bouncebuffer);
-                        return -EFAULT;
-                }
-                ncp_lock_server(server);
-
-                /* FIXME: We hack around in the server's structures
-                   here to be able to use ncp_request */
-
-                server->has_subfunction = 0;
-                server->current_size = request.size;
-                memcpy(server->packet, bouncebuffer, request.size);
-
-                result = ncp_request2(server, request.function,
-                        bouncebuffer, NCP_PACKET_SIZE_INTERNAL);
-                if (result < 0)
-                        result = -EIO;
-                else
-                        result = server->reply_size;
-                ncp_unlock_server(server);
-                ncp_dbg(1, "copy %d bytes\n", result);
-                if (result >= 0)
-                        if (copy_to_user(request.data, bouncebuffer, result))
-                                result = -EFAULT;
-                vfree(bouncebuffer);
-                return result;
-
-        case NCP_IOC_CONN_LOGGED_IN:
-
-                if (!(server->m.int_flags & NCP_IMOUNT_LOGGEDIN_POSSIBLE))
-                        return -EINVAL;
-                mutex_lock(&server->root_setup_lock);
-                if (server->root_setuped)
-                        result = -EBUSY;
-                else {
-                        result = ncp_conn_logged_in(inode->i_sb);
-                        if (result == 0)
-                                server->root_setuped = 1;
-                }
-                mutex_unlock(&server->root_setup_lock);
-                return result;
-
-        case NCP_IOC_GET_FS_INFO:
-                return ncp_get_fs_info(server, inode, argp);
-
-        case NCP_IOC_GET_FS_INFO_V2:
-                return ncp_get_fs_info_v2(server, inode, argp);
-
-#ifdef CONFIG_COMPAT
-        case NCP_IOC_GET_FS_INFO_V2_32:
-                return ncp_get_compat_fs_info_v2(server, inode, argp);
-#endif
-        /* we have too many combinations of CONFIG_COMPAT,
-         * CONFIG_64BIT and CONFIG_UID16, so just handle
-         * any of the possible ioctls */
-        case NCP_IOC_GETMOUNTUID16:
-                {
-                        u16 uid;
-
-                        SET_UID(uid, from_kuid_munged(current_user_ns(), server->m.mounted_uid));
-                        if (put_user(uid, (u16 __user *)argp))
-                                return -EFAULT;
-                        return 0;
-                }
-        case NCP_IOC_GETMOUNTUID32:
-        {
-                uid_t uid = from_kuid_munged(current_user_ns(), server->m.mounted_uid);
-                if (put_user(uid, (u32 __user *)argp))
-                        return -EFAULT;
-                return 0;
-        }
-        case NCP_IOC_GETMOUNTUID64:
-        {
-                uid_t uid = from_kuid_munged(current_user_ns(), server->m.mounted_uid);
-                if (put_user(uid, (u64 __user *)argp))
-                        return -EFAULT;
-                return 0;
-        }
-        case NCP_IOC_GETROOT:
-                {
-                        struct ncp_setroot_ioctl sr;
-
-                        result = -EACCES;
-                        mutex_lock(&server->root_setup_lock);
-                        if (server->m.mounted_vol[0]) {
-                                struct dentry* dentry = inode->i_sb->s_root;
-
-                                if (dentry) {
-                                        struct inode* s_inode = d_inode(dentry);
-
-                                        if (s_inode) {
-                                                sr.volNumber = NCP_FINFO(s_inode)->volNumber;
-                                                sr.dirEntNum = NCP_FINFO(s_inode)->dirEntNum;
-                                                sr.namespace = server->name_space[sr.volNumber];
-                                                result = 0;
-                                        } else
-                                                ncp_dbg(1, "d_inode(s_root)==NULL\n");
-                                } else
-                                        ncp_dbg(1, "s_root==NULL\n");
-                        } else {
-                                sr.volNumber = -1;
-                                sr.namespace = 0;
-                                sr.dirEntNum = 0;
-                                result = 0;
-                        }
-                        mutex_unlock(&server->root_setup_lock);
-                        if (!result && copy_to_user(argp, &sr, sizeof(sr)))
-                                result = -EFAULT;
-                        return result;
-                }
-
-        case NCP_IOC_SETROOT:
-                {
-                        struct ncp_setroot_ioctl sr;
-                        __u32 vnum;
-                        __le32 de;
-                        __le32 dosde;
-                        struct dentry* dentry;
-
-                        if (copy_from_user(&sr, argp, sizeof(sr)))
-                                return -EFAULT;
-                        mutex_lock(&server->root_setup_lock);
-                        if (server->root_setuped)
-                                result = -EBUSY;
-                        else {
-                                if (sr.volNumber < 0) {
-                                        server->m.mounted_vol[0] = 0;
-                                        vnum = NCP_NUMBER_OF_VOLUMES;
-                                        de = 0;
-                                        dosde = 0;
-                                        result = 0;
-                                } else if (sr.volNumber >= NCP_NUMBER_OF_VOLUMES) {
-                                        result = -EINVAL;
-                                } else if (ncp_mount_subdir(server, sr.volNumber,
-                                                        sr.namespace, sr.dirEntNum,
-                                                        &vnum, &de, &dosde)) {
-                                        result = -ENOENT;
-                                } else
-                                        result = 0;
-
-                                if (result == 0) {
-                                        dentry = inode->i_sb->s_root;
-                                        if (dentry) {
-                                                struct inode* s_inode = d_inode(dentry);
-
-                                                if (s_inode) {
-                                                        NCP_FINFO(s_inode)->volNumber = vnum;
-                                                        NCP_FINFO(s_inode)->dirEntNum = de;
-                                                        NCP_FINFO(s_inode)->DosDirNum = dosde;
-                                                        server->root_setuped = 1;
-                                                } else {
-                                                        ncp_dbg(1, "d_inode(s_root)==NULL\n");
-                                                        result = -EIO;
-                                                }
-                                        } else {
-                                                ncp_dbg(1, "s_root==NULL\n");
-                                                result = -EIO;
-                                        }
-                                }
-                        }
-                        mutex_unlock(&server->root_setup_lock);
-
-                        return result;
-                }
-
-#ifdef CONFIG_NCPFS_PACKET_SIGNING
-        case NCP_IOC_SIGN_INIT:
-                {
-                        struct ncp_sign_init sign;
-
-                        if (argp)
-                                if (copy_from_user(&sign, argp, sizeof(sign)))
-                                        return -EFAULT;
-                        ncp_lock_server(server);
-                        mutex_lock(&server->rcv.creq_mutex);
-                        if (argp) {
-                                if (server->sign_wanted) {
-                                        memcpy(server->sign_root,sign.sign_root,8);
-                                        memcpy(server->sign_last,sign.sign_last,16);
-                                        server->sign_active = 1;
-                                }
-                                /* ignore when signatures not wanted */
-                        } else {
-                                server->sign_active = 0;
-                        }
-                        mutex_unlock(&server->rcv.creq_mutex);
-                        ncp_unlock_server(server);
-                        return 0;
-                }
-
-        case NCP_IOC_SIGN_WANTED:
-                {
-                        int state;
-
-                        ncp_lock_server(server);
-                        state = server->sign_wanted;
-                        ncp_unlock_server(server);
-                        if (put_user(state, (int __user *)argp))
-                                return -EFAULT;
-                        return 0;
-                }
-
-        case NCP_IOC_SET_SIGN_WANTED:
-                {
-                        int newstate;
-
-                        /* get only low 8 bits... */
-                        if (get_user(newstate, (unsigned char __user *)argp))
-                                return -EFAULT;
-                        result = 0;
-                        ncp_lock_server(server);
-                        if (server->sign_active) {
-                                /* cannot turn signatures OFF when active */
-                                if (!newstate)
-                                        result = -EINVAL;
-                        } else {
-                                server->sign_wanted = newstate != 0;
-                        }
-                        ncp_unlock_server(server);
-                        return result;
-                }
-
-#endif /* CONFIG_NCPFS_PACKET_SIGNING */
-
-#ifdef CONFIG_NCPFS_IOCTL_LOCKING
-        case NCP_IOC_LOCKUNLOCK:
-                {
-                        struct ncp_lock_ioctl    rqdata;
-
-                        if (copy_from_user(&rqdata, argp, sizeof(rqdata)))
-                                return -EFAULT;
-                        if (rqdata.origin != 0)
-                                return -EINVAL;
-                        /* check for cmd */
-                        switch (rqdata.cmd) {
-                                case NCP_LOCK_EX:
-                                case NCP_LOCK_SH:
-                                                if (rqdata.timeout < 0)
-                                                        return -EINVAL;
-                                                if (rqdata.timeout == 0)
-                                                        rqdata.timeout = NCP_LOCK_DEFAULT_TIMEOUT;
-                                                else if (rqdata.timeout > NCP_LOCK_MAX_TIMEOUT)
-                                                        rqdata.timeout = NCP_LOCK_MAX_TIMEOUT;
-                                                break;
-                                case NCP_LOCK_LOG:
-                                                rqdata.timeout = NCP_LOCK_DEFAULT_TIMEOUT;      /* has no effect */
-                                case NCP_LOCK_CLEAR:
-                                                break;
-                                default:
-                                                return -EINVAL;
-                        }
-                        /* locking needs both read and write access */
-                        if ((result = ncp_make_open(inode, O_RDWR)) != 0)
-                        {
-                                return result;
-                        }
-                        result = -EISDIR;
-                        if (!S_ISREG(inode->i_mode))
-                                goto outrel;
-                        if (rqdata.cmd == NCP_LOCK_CLEAR)
-                        {
-                                result = ncp_ClearPhysicalRecord(NCP_SERVER(inode),
-                                                        NCP_FINFO(inode)->file_handle,
-                                                        rqdata.offset,
-                                                        rqdata.length);
-                                if (result > 0) result = 0;     /* no such lock */
-                        }
-                        else
-                        {
-                                int lockcmd;
-
-                                switch (rqdata.cmd)
-                                {
-                                        case NCP_LOCK_EX:  lockcmd=1; break;
-                                        case NCP_LOCK_SH:  lockcmd=3; break;
-                                        default:           lockcmd=0; break;
-                                }
-                                result = ncp_LogPhysicalRecord(NCP_SERVER(inode),
-                                                        NCP_FINFO(inode)->file_handle,
-                                                        lockcmd,
-                                                        rqdata.offset,
-                                                        rqdata.length,
-                                                        rqdata.timeout);
-                                if (result > 0) result = -EAGAIN;
-                        }
-outrel:
-                        ncp_inode_close(inode);
-                        return result;
-                }
-#endif  /* CONFIG_NCPFS_IOCTL_LOCKING */
-
-#ifdef CONFIG_COMPAT
-        case NCP_IOC_GETOBJECTNAME_32:
-                {
-                        struct compat_ncp_objectname_ioctl user;
-                        size_t outl;
-
-                        if (copy_from_user(&user, argp, sizeof(user)))
-                                return -EFAULT;
-                        down_read(&server->auth_rwsem);
-                        user.auth_type = server->auth.auth_type;
-                        outl = user.object_name_len;
-                        user.object_name_len = server->auth.object_name_len;
-                        if (outl > user.object_name_len)
-                                outl = user.object_name_len;
-                        result = 0;
-                        if (outl) {
-                                if (copy_to_user(compat_ptr(user.object_name),
-                                                 server->auth.object_name,
-                                                 outl))
-                                        result = -EFAULT;
-                        }
-                        up_read(&server->auth_rwsem);
-                        if (!result && copy_to_user(argp, &user, sizeof(user)))
-                                result = -EFAULT;
-                        return result;
-                }
-#endif
-
-        case NCP_IOC_GETOBJECTNAME:
-                {
-                        struct ncp_objectname_ioctl user;
-                        size_t outl;
-
-                        if (copy_from_user(&user, argp, sizeof(user)))
-                                return -EFAULT;
-                        down_read(&server->auth_rwsem);
-                        user.auth_type = server->auth.auth_type;
-                        outl = user.object_name_len;
-                        user.object_name_len = server->auth.object_name_len;
-                        if (outl > user.object_name_len)
-                                outl = user.object_name_len;
-                        result = 0;
-                        if (outl) {
-                                if (copy_to_user(user.object_name,
-                                                 server->auth.object_name,
-                                                 outl))
-                                        result = -EFAULT;
-                        }
-                        up_read(&server->auth_rwsem);
-                        if (!result && copy_to_user(argp, &user, sizeof(user)))
-                                result = -EFAULT;
-                        return result;
-                }
-
-#ifdef CONFIG_COMPAT
-        case NCP_IOC_SETOBJECTNAME_32:
-#endif
-        case NCP_IOC_SETOBJECTNAME:
-                {
-                        struct ncp_objectname_ioctl user;
-                        void* newname;
-                        void* oldname;
-                        size_t oldnamelen;
-                        void* oldprivate;
-                        size_t oldprivatelen;
-
-#ifdef CONFIG_COMPAT
-                        if (cmd == NCP_IOC_SETOBJECTNAME_32) {
-                                struct compat_ncp_objectname_ioctl user32;
-                                if (copy_from_user(&user32, argp, sizeof(user32)))
-                                        return -EFAULT;
-                                user.auth_type = user32.auth_type;
-                                user.object_name_len = user32.object_name_len;
-                                user.object_name = compat_ptr(user32.object_name);
-                        } else
-#endif
-                        if (copy_from_user(&user, argp, sizeof(user)))
-                                return -EFAULT;
-
-                        if (user.object_name_len > NCP_OBJECT_NAME_MAX_LEN)
-                                return -ENOMEM;
-                        if (user.object_name_len) {
-                                newname = memdup_user(user.object_name,
-                                                      user.object_name_len);
-                                if (IS_ERR(newname))
-                                        return PTR_ERR(newname);
-                        } else {
-                                newname = NULL;
-                        }
-                        down_write(&server->auth_rwsem);
-                        oldname = server->auth.object_name;
-                        oldnamelen = server->auth.object_name_len;
-                        oldprivate = server->priv.data;
-                        oldprivatelen = server->priv.len;
-                        server->auth.auth_type = user.auth_type;
-                        server->auth.object_name_len = user.object_name_len;
-                        server->auth.object_name = newname;
-                        server->priv.len = 0;
-                        server->priv.data = NULL;
-                        up_write(&server->auth_rwsem);
-                        kfree(oldprivate);
-                        kfree(oldname);
-                        return 0;
-                }
-
-#ifdef CONFIG_COMPAT
-        case NCP_IOC_GETPRIVATEDATA_32:
-#endif
-        case NCP_IOC_GETPRIVATEDATA:
-                {
-                        struct ncp_privatedata_ioctl user;
-                        size_t outl;
-
-#ifdef CONFIG_COMPAT
-                        if (cmd == NCP_IOC_GETPRIVATEDATA_32) {
-                                struct compat_ncp_privatedata_ioctl user32;
-                                if (copy_from_user(&user32, argp, sizeof(user32)))
-                                        return -EFAULT;
-                                user.len = user32.len;
-                                user.data = compat_ptr(user32.data);
-                        } else
-#endif
-                        if (copy_from_user(&user, argp, sizeof(user)))
-                                return -EFAULT;
-
-                        down_read(&server->auth_rwsem);
-                        outl = user.len;
-                        user.len = server->priv.len;
-                        if (outl > user.len) outl = user.len;
-                        result = 0;
-                        if (outl) {
-                                if (copy_to_user(user.data,
-                                                 server->priv.data,
-                                                 outl))
-                                        result = -EFAULT;
-                        }
-                        up_read(&server->auth_rwsem);
-                        if (result)
-                                return result;
-#ifdef CONFIG_COMPAT
-                        if (cmd == NCP_IOC_GETPRIVATEDATA_32) {
-                                struct compat_ncp_privatedata_ioctl user32;
-                                user32.len = user.len;
-                                user32.data = (unsigned long) user.data;
-                                if (copy_to_user(argp, &user32, sizeof(user32)))
-                                        return -EFAULT;
-                        } else
-#endif
-                        if (copy_to_user(argp, &user, sizeof(user)))
-                                return -EFAULT;
-
-                        return 0;
-                }
-
-#ifdef CONFIG_COMPAT
-        case NCP_IOC_SETPRIVATEDATA_32:
-#endif
-        case NCP_IOC_SETPRIVATEDATA:
-                {
-                        struct ncp_privatedata_ioctl user;
-                        void* new;
-                        void* old;
-                        size_t oldlen;
-
-#ifdef CONFIG_COMPAT
-                        if (cmd == NCP_IOC_SETPRIVATEDATA_32) {
-                                struct compat_ncp_privatedata_ioctl user32;
-                                if (copy_from_user(&user32, argp, sizeof(user32)))
-                                        return -EFAULT;
-                                user.len = user32.len;
-                                user.data = compat_ptr(user32.data);
-                        } else
-#endif
-                        if (copy_from_user(&user, argp, sizeof(user)))
-                                return -EFAULT;
-
-                        if (user.len > NCP_PRIVATE_DATA_MAX_LEN)
-                                return -ENOMEM;
-                        if (user.len) {
-                                new = memdup_user(user.data, user.len);
-                                if (IS_ERR(new))
-                                        return PTR_ERR(new);
-                        } else {
-                                new = NULL;
-                        }
-                        down_write(&server->auth_rwsem);
-                        old = server->priv.data;
-                        oldlen = server->priv.len;
-                        server->priv.len = user.len;
-                        server->priv.data = new;
-                        up_write(&server->auth_rwsem);
-                        kfree(old);
-                        return 0;
-                }
-
-#ifdef CONFIG_NCPFS_NLS
-        case NCP_IOC_SETCHARSETS:
-                return ncp_set_charsets(server, argp);
-
-        case NCP_IOC_GETCHARSETS:
-                return ncp_get_charsets(server, argp);
-
-#endif /* CONFIG_NCPFS_NLS */
-
-        case NCP_IOC_SETDENTRYTTL:
-                {
-                        u_int32_t user;
-
-                        if (copy_from_user(&user, argp, sizeof(user)))
-                                return -EFAULT;
-                        /* 20 secs at most... */
-                        if (user > 20000)
-                                return -EINVAL;
-                        user = (user * HZ) / 1000;
-                        atomic_set(&server->dentry_ttl, user);
-                        return 0;
-                }
-
-        case NCP_IOC_GETDENTRYTTL:
-                {
-                        u_int32_t user = (atomic_read(&server->dentry_ttl) * 1000) / HZ;
-                        if (copy_to_user(argp, &user, sizeof(user)))
-                                return -EFAULT;
-                        return 0;
-                }
-
-        }
-        return -EINVAL;
-}
-
-long ncp_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
-{
-        struct inode *inode = file_inode(filp);
-        struct ncp_server *server = NCP_SERVER(inode);
-        kuid_t uid = current_uid();
-        int need_drop_write = 0;
-        long ret;
-
-        switch (cmd) {
-        case NCP_IOC_SETCHARSETS:
-        case NCP_IOC_CONN_LOGGED_IN:
-        case NCP_IOC_SETROOT:
-                if (!capable(CAP_SYS_ADMIN)) {
-                        ret = -EPERM;
-                        goto out;
-                }
-                break;
-        }
-        if (!uid_eq(server->m.mounted_uid, uid)) {
-                switch (cmd) {
-                /*
-                 * Only mount owner can issue these ioctls.  Information
-                 * necessary to authenticate to other NDS servers are
-                 * stored here.
-                 */
-                case NCP_IOC_GETOBJECTNAME:
-                case NCP_IOC_SETOBJECTNAME:
-                case NCP_IOC_GETPRIVATEDATA:
-                case NCP_IOC_SETPRIVATEDATA:
-#ifdef CONFIG_COMPAT
-                case NCP_IOC_GETOBJECTNAME_32:
-                case NCP_IOC_SETOBJECTNAME_32:
-                case NCP_IOC_GETPRIVATEDATA_32:
-                case NCP_IOC_SETPRIVATEDATA_32:
-#endif
-                        ret = -EACCES;
-                        goto out;
-                /*
-                 * These require write access on the inode if user id
-                 * does not match.  Note that they do not write to the
-                 * file...  But old code did mnt_want_write, so I keep
-                 * it as is.  Of course not for mountpoint owner, as
-                 * that breaks read-only mounts altogether as ncpmount
-                 * needs working NCP_IOC_NCPREQUEST and
-                 * NCP_IOC_GET_FS_INFO.  Some of these codes (setdentryttl,
-                 * signinit, setsignwanted) should be probably restricted
-                 * to owner only, or even more to CAP_SYS_ADMIN).
-                 */
-                case NCP_IOC_GET_FS_INFO:
-                case NCP_IOC_GET_FS_INFO_V2:
-                case NCP_IOC_NCPREQUEST:
-                case NCP_IOC_SETDENTRYTTL:
-                case NCP_IOC_SIGN_INIT:
-                case NCP_IOC_LOCKUNLOCK:
-                case NCP_IOC_SET_SIGN_WANTED:
-#ifdef CONFIG_COMPAT
-                case NCP_IOC_GET_FS_INFO_V2_32:
-                case NCP_IOC_NCPREQUEST_32:
-#endif
-                        ret = mnt_want_write_file(filp);
-                        if (ret)
-                                goto out;
-                        need_drop_write = 1;
-                        ret = inode_permission(inode, MAY_WRITE);
-                        if (ret)
-                                goto outDropWrite;
-                        break;
-                /*
-                 * Read access required.
-                 */
-                case NCP_IOC_GETMOUNTUID16:
-                case NCP_IOC_GETMOUNTUID32:
-                case NCP_IOC_GETMOUNTUID64:
-                case NCP_IOC_GETROOT:
-                case NCP_IOC_SIGN_WANTED:
-                        ret = inode_permission(inode, MAY_READ);
-                        if (ret)
-                                goto out;
-                        break;
-                /*
-                 * Anybody can read these.
-                 */
-                case NCP_IOC_GETCHARSETS:
-                case NCP_IOC_GETDENTRYTTL:
-                default:
-                /* Three codes below are protected by CAP_SYS_ADMIN above. */
-                case NCP_IOC_SETCHARSETS:
-                case NCP_IOC_CONN_LOGGED_IN:
-                case NCP_IOC_SETROOT:
-                        break;
-                }
-        }
-        ret = __ncp_ioctl(inode, cmd, arg);
-outDropWrite:
-        if (need_drop_write)
-                mnt_drop_write_file(filp);
-out:
-        return ret;
-}
-
-#ifdef CONFIG_COMPAT
-long ncp_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-{
-        long ret;
-
-        arg = (unsigned long) compat_ptr(arg);
-        ret = ncp_ioctl(file, cmd, arg);
-        return ret;
-}
-#endif
diff --git a/fs/ncpfs/mmap.c b/fs/ncpfs/mmap.c
deleted file mode 100644
index a5c5cf2ff007..000000000000
--- a/fs/ncpfs/mmap.c
+++ /dev/null
@@ -1,125 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- *  mmap.c
- *
- *  Copyright (C) 1995, 1996 by Volker Lendecke
- *  Modified 1997 Peter Waltenberg, Bill Hawes, David Woodhouse for 2.1 dcache
- *
- */
-
-#include <linux/stat.h>
-#include <linux/time.h>
-#include <linux/kernel.h>
-#include <linux/gfp.h>
-#include <linux/mm.h>
-#include <linux/shm.h>
-#include <linux/errno.h>
-#include <linux/mman.h>
-#include <linux/string.h>
-#include <linux/fcntl.h>
-#include <linux/memcontrol.h>
-
-#include <linux/uaccess.h>
-
-#include "ncp_fs.h"
-
-/*
- * Fill in the supplied page for mmap
- * XXX: how are we excluding truncate/invalidate here? Maybe need to lock
- * page?
- */
-static int ncp_file_mmap_fault(struct vm_fault *vmf)
-{
-        struct inode *inode = file_inode(vmf->vma->vm_file);
-        char *pg_addr;
-        unsigned int already_read;
-        unsigned int count;
-        int bufsize;
-        int pos; /* XXX: loff_t ? */
-
-        /*
-         * ncpfs has nothing against high pages as long
-         * as recvmsg and memset works on it
-         */
-        vmf->page = alloc_page(GFP_HIGHUSER);
-        if (!vmf->page)
-                return VM_FAULT_OOM;
-        pg_addr = kmap(vmf->page);
-        pos = vmf->pgoff << PAGE_SHIFT;
-
-        count = PAGE_SIZE;
-        /* what we can read in one go */
-        bufsize = NCP_SERVER(inode)->buffer_size;
-
-        already_read = 0;
-        if (ncp_make_open(inode, O_RDONLY) >= 0) {
-                while (already_read < count) {
-                        int read_this_time;
-                        int to_read;
-
-                        to_read = bufsize - (pos % bufsize);
-
-                        to_read = min_t(unsigned int, to_read, count - already_read);
-
-                        if (ncp_read_kernel(NCP_SERVER(inode),
-                                     NCP_FINFO(inode)->file_handle,
-                                     pos, to_read,
-                                     pg_addr + already_read,
-                                     &read_this_time) != 0) {
-                                read_this_time = 0;
-                        }
-                        pos += read_this_time;
-                        already_read += read_this_time;
-
-                        if (read_this_time < to_read) {
-                                break;
-                        }
-                }
-                ncp_inode_close(inode);
-
-        }
-
-        if (already_read < PAGE_SIZE)
-                memset(pg_addr + already_read, 0, PAGE_SIZE - already_read);
-        flush_dcache_page(vmf->page);
-        kunmap(vmf->page);
-
-        /*
-         * If I understand ncp_read_kernel() properly, the above always
-         * fetches from the network, here the analogue of disk.
-         * -- nyc
-         */
-        count_vm_event(PGMAJFAULT);
-        count_memcg_event_mm(vmf->vma->vm_mm, PGMAJFAULT);
-        return VM_FAULT_MAJOR;
-}
-
-static const struct vm_operations_struct ncp_file_mmap =
-{
-        .fault = ncp_file_mmap_fault,
-};
-
-
-/* This is used for a general mmap of a ncp file */
-int ncp_mmap(struct file *file, struct vm_area_struct *vma)
-{
-        struct inode *inode = file_inode(file);
-        
-        ncp_dbg(1, "called\n");
-
-        if (!ncp_conn_valid(NCP_SERVER(inode)))
-                return -EIO;
-
-        /* only PAGE_COW or read-only supported now */
-        if (vma->vm_flags & VM_SHARED)
-                return -EINVAL;
-        /* we do not support files bigger than 4GB... We eventually 
-           supports just 4GB... */
-        if (vma_pages(vma) + vma->vm_pgoff
-           > (1U << (32 - PAGE_SHIFT)))
-                return -EFBIG;
-
-        vma->vm_ops = &ncp_file_mmap;
-        file_accessed(file);
-        return 0;
-}
diff --git a/fs/ncpfs/ncp_fs.h b/fs/ncpfs/ncp_fs.h
deleted file mode 100644
index bdd262b6c198..000000000000
--- a/fs/ncpfs/ncp_fs.h
+++ /dev/null
@@ -1,101 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#include <linux/ncp_fs.h>
-#include "ncp_fs_i.h"
-#include "ncp_fs_sb.h"
-
-#undef NCPFS_PARANOIA
-#ifdef NCPFS_PARANOIA
-#define ncp_vdbg(fmt, ...)                                      \
-        pr_debug(fmt, ##__VA_ARGS__)
-#else
-#define ncp_vdbg(fmt, ...)                                      \
-do {                                                            \
-        if (0)                                                  \
-                pr_debug(fmt, ##__VA_ARGS__);                   \
-} while (0)
-#endif
-
-#ifndef DEBUG_NCP
-#define DEBUG_NCP 0
-#endif
-
-#if DEBUG_NCP > 0 && !defined(DEBUG)
-#define DEBUG
-#endif
-
-#define ncp_dbg(level, fmt, ...)                                \
-do {                                                            \
-        if (level <= DEBUG_NCP)                                 \
-                pr_debug(fmt, ##__VA_ARGS__);                   \
-} while (0)
-
-#define NCP_MAX_RPC_TIMEOUT (6*HZ)
-
-
-struct ncp_entry_info {
-        struct nw_info_struct   i;
-        ino_t                   ino;
-        int                     opened;
-        int                     access;
-        unsigned int            volume;
-        __u8                    file_handle[6];
-};
-
-static inline struct ncp_server *NCP_SBP(const struct super_block *sb)
-{
-        return sb->s_fs_info;
-}
-
-#define NCP_SERVER(inode)       NCP_SBP((inode)->i_sb)
-static inline struct ncp_inode_info *NCP_FINFO(const struct inode *inode)
-{
-        return container_of(inode, struct ncp_inode_info, vfs_inode);
-}
-
-/* linux/fs/ncpfs/inode.c */
-int ncp_notify_change(struct dentry *, struct iattr *);
-struct inode *ncp_iget(struct super_block *, struct ncp_entry_info *);
-void ncp_update_inode(struct inode *, struct ncp_entry_info *);
-void ncp_update_inode2(struct inode *, struct ncp_entry_info *);
-
-/* linux/fs/ncpfs/dir.c */
-extern const struct inode_operations ncp_dir_inode_operations;
-extern const struct file_operations ncp_dir_operations;
-extern const struct dentry_operations ncp_dentry_operations;
-int ncp_conn_logged_in(struct super_block *);
-int ncp_date_dos2unix(__le16 time, __le16 date);
-void ncp_date_unix2dos(int unix_date, __le16 * time, __le16 * date);
-
-/* linux/fs/ncpfs/ioctl.c */
-long ncp_ioctl(struct file *, unsigned int, unsigned long);
-long ncp_compat_ioctl(struct file *, unsigned int, unsigned long);
-
-/* linux/fs/ncpfs/sock.c */
-int ncp_request2(struct ncp_server *server, int function,
-        void* reply, int max_reply_size);
-static inline int ncp_request(struct ncp_server *server, int function) {
-        return ncp_request2(server, function, server->packet, server->packet_size);
-}
-int ncp_connect(struct ncp_server *server);
-int ncp_disconnect(struct ncp_server *server);
-void ncp_lock_server(struct ncp_server *server);
-void ncp_unlock_server(struct ncp_server *server);
-
-/* linux/fs/ncpfs/symlink.c */
-#if defined(CONFIG_NCPFS_EXTRAS) || defined(CONFIG_NCPFS_NFS_NS)
-extern const struct address_space_operations ncp_symlink_aops;
-int ncp_symlink(struct inode*, struct dentry*, const char*);
-#endif
-
-/* linux/fs/ncpfs/file.c */
-extern const struct inode_operations ncp_file_inode_operations;
-extern const struct file_operations ncp_file_operations;
-int ncp_make_open(struct inode *, int);
-
-/* linux/fs/ncpfs/mmap.c */
-int ncp_mmap(struct file *, struct vm_area_struct *);
-
-/* linux/fs/ncpfs/ncplib_kernel.c */
-int ncp_make_closed(struct inode *);
-
-#include "ncplib_kernel.h"
diff --git a/fs/ncpfs/ncp_fs_i.h b/fs/ncpfs/ncp_fs_i.h
deleted file mode 100644
index 3432bafb53a5..000000000000
--- a/fs/ncpfs/ncp_fs_i.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/*
- *  ncp_fs_i.h
- *
- *  Copyright (C) 1995 Volker Lendecke
- *
- */
-
-#ifndef _LINUX_NCP_FS_I
-#define _LINUX_NCP_FS_I
-
-/*
- * This is the ncpfs part of the inode structure. This must contain
- * all the information we need to work with an inode after creation.
- */
-struct ncp_inode_info {
-        __le32  dirEntNum;
-        __le32  DosDirNum;
-        __u8    volNumber;
-        __le32  nwattr;
-        struct mutex open_mutex;
-        atomic_t        opened;
-        int     access;
-        int     flags;
-#define NCPI_KLUDGE_SYMLINK     0x0001
-#define NCPI_DIR_CACHE          0x0002
-        __u8    file_handle[6];
-        struct inode vfs_inode;
-};
-
-#endif  /* _LINUX_NCP_FS_I */
diff --git a/fs/ncpfs/ncp_fs_sb.h b/fs/ncpfs/ncp_fs_sb.h
deleted file mode 100644
index f06cde4adf71..000000000000
--- a/fs/ncpfs/ncp_fs_sb.h
+++ /dev/null
@@ -1,174 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/*
- *  ncp_fs_sb.h
- *
- *  Copyright (C) 1995, 1996 by Volker Lendecke
- *
- */
-
-#ifndef _NCP_FS_SB
-#define _NCP_FS_SB
-
-#include <linux/types.h>
-#include <linux/ncp_mount.h>
-#include <linux/net.h>
-#include <linux/mutex.h>
-#include <linux/backing-dev.h>
-#include <linux/workqueue.h>
-
-#define NCP_DEFAULT_OPTIONS 0           /* 2 for packet signatures */
-
-struct sock;
-
-struct ncp_mount_data_kernel {
-        unsigned long    flags;         /* NCP_MOUNT_* flags */
-        unsigned int     int_flags;     /* internal flags */
-#define NCP_IMOUNT_LOGGEDIN_POSSIBLE    0x0001
-        kuid_t           mounted_uid;   /* Who may umount() this filesystem? */
-        struct pid      *wdog_pid;      /* Who cares for our watchdog packets? */
-        unsigned int     ncp_fd;        /* The socket to the ncp port */
-        unsigned int     time_out;      /* How long should I wait after
-                                           sending a NCP request? */
-        unsigned int     retry_count;   /* And how often should I retry? */
-        unsigned char    mounted_vol[NCP_VOLNAME_LEN + 1];
-        kuid_t           uid;
-        kgid_t           gid;
-        umode_t          file_mode;
-        umode_t          dir_mode;
-        int              info_fd;
-};
-
-struct ncp_server {
-        struct rcu_head rcu;
-        struct ncp_mount_data_kernel m; /* Nearly all of the mount data is of
-                                           interest for us later, so we store
-                                           it completely. */
-
-        __u8 name_space[NCP_NUMBER_OF_VOLUMES + 2];
-
-        struct socket *ncp_sock;/* ncp socket */
-        struct socket *info_sock;
-
-        u8 sequence;
-        u8 task;
-        u16 connection;         /* Remote connection number */
-
-        u8 completion;          /* Status message from server */
-        u8 conn_status;         /* Bit 4 = 1 ==> Server going down, no
-                                   requests allowed anymore.
-                                   Bit 0 = 1 ==> Server is down. */
-
-        int buffer_size;        /* Negotiated bufsize */
-
-        int reply_size;         /* Size of last reply */
-
-        int packet_size;
-        unsigned char *packet;  /* Here we prepare requests and
-                                   receive replies */
-        unsigned char *txbuf;   /* Storage for current request */
-        unsigned char *rxbuf;   /* Storage for reply to current request */
-
-        int lock;               /* To prevent mismatch in protocols. */
-        struct mutex mutex;
-
-        int current_size;       /* for packet preparation */
-        int has_subfunction;
-        int ncp_reply_size;
-
-        int root_setuped;
-        struct mutex root_setup_lock;
-
-        /* info for packet signing */
-        int sign_wanted;        /* 1=Server needs signed packets */
-        int sign_active;        /* 0=don't do signing, 1=do */
-        char sign_root[8];      /* generated from password and encr. key */
-        char sign_last[16];     
-
-        /* Authentication info: NDS or BINDERY, username */
-        struct {
-                int     auth_type;
-                size_t  object_name_len;
-                void*   object_name;
-                int     object_type;
-        } auth;
-        /* Password info */
-        struct {
-                size_t  len;
-                void*   data;
-        } priv;
-        struct rw_semaphore auth_rwsem;
-
-        /* nls info: codepage for volume and charset for I/O */
-        struct nls_table *nls_vol;
-        struct nls_table *nls_io;
-
-        /* maximum age in jiffies */
-        atomic_t dentry_ttl;
-
-        /* miscellaneous */
-        unsigned int flags;
-
-        spinlock_t requests_lock;       /* Lock accesses to tx.requests, tx.creq and rcv.creq when STREAM mode */
-
-        void (*data_ready)(struct sock* sk);
-        void (*error_report)(struct sock* sk);
-        void (*write_space)(struct sock* sk);   /* STREAM mode only */
-        struct {
-                struct work_struct tq;          /* STREAM/DGRAM: data/error ready */
-                struct ncp_request_reply* creq; /* STREAM/DGRAM: awaiting reply from this request */
-                struct mutex creq_mutex;        /* DGRAM only: lock accesses to rcv.creq */
-
-                unsigned int state;             /* STREAM only: receiver state */
-                struct {
-                        __u32 magic __packed;
-                        __u32 len __packed;
-                        __u16 type __packed;
-                        __u16 p1 __packed;
-                        __u16 p2 __packed;
-                        __u16 p3 __packed;
-                        __u16 type2 __packed;
-                } buf;                          /* STREAM only: temporary buffer */
-                unsigned char* ptr;             /* STREAM only: pointer to data */
-                size_t len;                     /* STREAM only: length of data to receive */
-        } rcv;
-        struct {
-                struct list_head requests;      /* STREAM only: queued requests */
-                struct work_struct tq;          /* STREAM only: transmitter ready */
-                struct ncp_request_reply* creq; /* STREAM only: currently transmitted entry */
-        } tx;
-        struct timer_list timeout_tm;           /* DGRAM only: timeout timer */
-        struct work_struct timeout_tq;          /* DGRAM only: associated queue, we run timers from process context */
-        int timeout_last;                       /* DGRAM only: current timeout length */
-        int timeout_retries;                    /* DGRAM only: retries left */
-        struct {
-                size_t len;
-                __u8 data[128];
-        } unexpected_packet;
-};
-
-extern void ncp_tcp_rcv_proc(struct work_struct *work);
-extern void ncp_tcp_tx_proc(struct work_struct *work);
-extern void ncpdgram_rcv_proc(struct work_struct *work);
-extern void ncpdgram_timeout_proc(struct work_struct *work);
-extern void ncpdgram_timeout_call(struct timer_list *t);
-extern void ncp_tcp_data_ready(struct sock* sk);
-extern void ncp_tcp_write_space(struct sock* sk);
-extern void ncp_tcp_error_report(struct sock* sk);
-
-#define NCP_FLAG_UTF8   1
-
-#define NCP_CLR_FLAG(server, flag)      ((server)->flags &= ~(flag))
-#define NCP_SET_FLAG(server, flag)      ((server)->flags |= (flag))
-#define NCP_IS_FLAG(server, flag)       ((server)->flags & (flag))
-
-static inline int ncp_conn_valid(struct ncp_server *server)
-{
-        return ((server->conn_status & 0x11) == 0);
-}
-
-static inline void ncp_invalidate_conn(struct ncp_server *server)
-{
-        server->conn_status |= 0x01;
-}
-
-#endif
diff --git a/fs/ncpfs/ncplib_kernel.c b/fs/ncpfs/ncplib_kernel.c
deleted file mode 100644
index 804adfebba2f..000000000000
--- a/fs/ncpfs/ncplib_kernel.c
+++ /dev/null
@@ -1,1322 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- *  ncplib_kernel.c
- *
- *  Copyright (C) 1995, 1996 by Volker Lendecke
- *  Modified for big endian by J.F. Chadima and David S. Miller
- *  Modified 1997 Peter Waltenberg, Bill Hawes, David Woodhouse for 2.1 dcache
- *  Modified 1999 Wolfram Pienkoss for NLS
- *  Modified 2000 Ben Harris, University of Cambridge for NFS NS meta-info
- *
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include "ncp_fs.h"
-
-static inline void assert_server_locked(struct ncp_server *server)
-{
-        if (server->lock == 0) {
-                ncp_dbg(1, "server not locked!\n");
-        }
-}
-
-static void ncp_add_byte(struct ncp_server *server, __u8 x)
-{
-        assert_server_locked(server);
-        *(__u8 *) (&(server->packet[server->current_size])) = x;
-        server->current_size += 1;
-        return;
-}
-
-static void ncp_add_word(struct ncp_server *server, __le16 x)
-{
-        assert_server_locked(server);
-        put_unaligned(x, (__le16 *) (&(server->packet[server->current_size])));
-        server->current_size += 2;
-        return;
-}
-
-static void ncp_add_be16(struct ncp_server *server, __u16 x)
-{
-        assert_server_locked(server);
-        put_unaligned(cpu_to_be16(x), (__be16 *) (&(server->packet[server->current_size])));
-        server->current_size += 2;
-}
-
-static void ncp_add_dword(struct ncp_server *server, __le32 x)
-{
-        assert_server_locked(server);
-        put_unaligned(x, (__le32 *) (&(server->packet[server->current_size])));
-        server->current_size += 4;
-        return;
-}
-
-static void ncp_add_be32(struct ncp_server *server, __u32 x)
-{
-        assert_server_locked(server);
-        put_unaligned(cpu_to_be32(x), (__be32 *)(&(server->packet[server->current_size])));
-        server->current_size += 4;
-}
-
-static inline void ncp_add_dword_lh(struct ncp_server *server, __u32 x) {
-        ncp_add_dword(server, cpu_to_le32(x));
-}
-
-static void ncp_add_mem(struct ncp_server *server, const void *source, int size)
-{
-        assert_server_locked(server);
-        memcpy(&(server->packet[server->current_size]), source, size);
-        server->current_size += size;
-        return;
-}
-
-static void ncp_add_pstring(struct ncp_server *server, const char *s)
-{
-        int len = strlen(s);
-        assert_server_locked(server);
-        if (len > 255) {
-                ncp_dbg(1, "string too long: %s\n", s);
-                len = 255;
-        }
-        ncp_add_byte(server, len);
-        ncp_add_mem(server, s, len);
-        return;
-}
-
-static inline void ncp_init_request(struct ncp_server *server)
-{
-        ncp_lock_server(server);
-
-        server->current_size = sizeof(struct ncp_request_header);
-        server->has_subfunction = 0;
-}
-
-static inline void ncp_init_request_s(struct ncp_server *server, int subfunction)
-{
-        ncp_lock_server(server);
-        
-        server->current_size = sizeof(struct ncp_request_header) + 2;
-        ncp_add_byte(server, subfunction);
-
-        server->has_subfunction = 1;
-}
-
-static inline char *
-ncp_reply_data(struct ncp_server *server, int offset)
-{
-        return &(server->packet[sizeof(struct ncp_reply_header) + offset]);
-}
-
-static inline u8 BVAL(const void *data)
-{
-        return *(const u8 *)data;
-}
-
-static u8 ncp_reply_byte(struct ncp_server *server, int offset)
-{
-        return *(const u8 *)ncp_reply_data(server, offset);
-}
-
-static inline u16 WVAL_LH(const void *data)
-{
-        return get_unaligned_le16(data);
-}
-
-static u16
-ncp_reply_le16(struct ncp_server *server, int offset)
-{
-        return get_unaligned_le16(ncp_reply_data(server, offset));
-}
-
-static u16
-ncp_reply_be16(struct ncp_server *server, int offset)
-{
-        return get_unaligned_be16(ncp_reply_data(server, offset));
-}
-
-static inline u32 DVAL_LH(const void *data)
-{
-        return get_unaligned_le32(data);
-}
-
-static __le32
-ncp_reply_dword(struct ncp_server *server, int offset)
-{
-        return get_unaligned((__le32 *)ncp_reply_data(server, offset));
-}
-
-static inline __u32 ncp_reply_dword_lh(struct ncp_server* server, int offset) {
-        return le32_to_cpu(ncp_reply_dword(server, offset));
-}
-
-int
-ncp_negotiate_buffersize(struct ncp_server *server, int size, int *target)
-{
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_be16(server, size);
-
-        if ((result = ncp_request(server, 33)) != 0) {
-                ncp_unlock_server(server);
-                return result;
-        }
-        *target = min_t(unsigned int, ncp_reply_be16(server, 0), size);
-
-        ncp_unlock_server(server);
-        return 0;
-}
-
-
-/* options: 
- *      bit 0   ipx checksum
- *      bit 1   packet signing
- */
-int
-ncp_negotiate_size_and_options(struct ncp_server *server, 
-        int size, int options, int *ret_size, int *ret_options) {
-        int result;
-
-        /* there is minimum */
-        if (size < NCP_BLOCK_SIZE) size = NCP_BLOCK_SIZE;
-
-        ncp_init_request(server);
-        ncp_add_be16(server, size);
-        ncp_add_byte(server, options);
-        
-        if ((result = ncp_request(server, 0x61)) != 0)
-        {
-                ncp_unlock_server(server);
-                return result;
-        }
-
-        /* NCP over UDP returns 0 (!!!) */
-        result = ncp_reply_be16(server, 0);
-        if (result >= NCP_BLOCK_SIZE)
-                size = min(result, size);
-        *ret_size = size;
-        *ret_options = ncp_reply_byte(server, 4);
-
-        ncp_unlock_server(server);
-        return 0;
-}
-
-int ncp_get_volume_info_with_number(struct ncp_server* server,
-                             int n, struct ncp_volume_info* target) {
-        int result;
-        int len;
-
-        ncp_init_request_s(server, 44);
-        ncp_add_byte(server, n);
-
-        if ((result = ncp_request(server, 22)) != 0) {
-                goto out;
-        }
-        target->total_blocks = ncp_reply_dword_lh(server, 0);
-        target->free_blocks = ncp_reply_dword_lh(server, 4);
-        target->purgeable_blocks = ncp_reply_dword_lh(server, 8);
-        target->not_yet_purgeable_blocks = ncp_reply_dword_lh(server, 12);
-        target->total_dir_entries = ncp_reply_dword_lh(server, 16);
-        target->available_dir_entries = ncp_reply_dword_lh(server, 20);
-        target->sectors_per_block = ncp_reply_byte(server, 28);
-
-        memset(&(target->volume_name), 0, sizeof(target->volume_name));
-
-        result = -EIO;
-        len = ncp_reply_byte(server, 29);
-        if (len > NCP_VOLNAME_LEN) {
-                ncp_dbg(1, "volume name too long: %d\n", len);
-                goto out;
-        }
-        memcpy(&(target->volume_name), ncp_reply_data(server, 30), len);
-        result = 0;
-out:
-        ncp_unlock_server(server);
-        return result;
-}
-
-int ncp_get_directory_info(struct ncp_server* server, __u8 n, 
-                           struct ncp_volume_info* target) {
-        int result;
-        int len;
-
-        ncp_init_request_s(server, 45);
-        ncp_add_byte(server, n);
-
-        if ((result = ncp_request(server, 22)) != 0) {
-                goto out;
-        }
-        target->total_blocks = ncp_reply_dword_lh(server, 0);
-        target->free_blocks = ncp_reply_dword_lh(server, 4);
-        target->purgeable_blocks = 0;
-        target->not_yet_purgeable_blocks = 0;
-        target->total_dir_entries = ncp_reply_dword_lh(server, 8);
-        target->available_dir_entries = ncp_reply_dword_lh(server, 12);
-        target->sectors_per_block = ncp_reply_byte(server, 20);
-
-        memset(&(target->volume_name), 0, sizeof(target->volume_name));
-
-        result = -EIO;
-        len = ncp_reply_byte(server, 21);
-        if (len > NCP_VOLNAME_LEN) {
-                ncp_dbg(1, "volume name too long: %d\n", len);
-                goto out;
-        }
-        memcpy(&(target->volume_name), ncp_reply_data(server, 22), len);
-        result = 0;
-out:
-        ncp_unlock_server(server);
-        return result;
-}
-
-int
-ncp_close_file(struct ncp_server *server, const char *file_id)
-{
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 0);
-        ncp_add_mem(server, file_id, 6);
-
-        result = ncp_request(server, 66);
-        ncp_unlock_server(server);
-        return result;
-}
-
-int
-ncp_make_closed(struct inode *inode)
-{
-        int err;
-
-        err = 0;
-        mutex_lock(&NCP_FINFO(inode)->open_mutex);
-        if (atomic_read(&NCP_FINFO(inode)->opened) == 1) {
-                atomic_set(&NCP_FINFO(inode)->opened, 0);
-                err = ncp_close_file(NCP_SERVER(inode), NCP_FINFO(inode)->file_handle);
-
-                if (!err)
-                        ncp_vdbg("volnum=%d, dirent=%u, error=%d\n",
-                                 NCP_FINFO(inode)->volNumber,
-                                 NCP_FINFO(inode)->dirEntNum, err);
-        }
-        mutex_unlock(&NCP_FINFO(inode)->open_mutex);
-        return err;
-}
-
-static void ncp_add_handle_path(struct ncp_server *server, __u8 vol_num,
-                                __le32 dir_base, int have_dir_base, 
-                                const char *path)
-{
-        ncp_add_byte(server, vol_num);
-        ncp_add_dword(server, dir_base);
-        if (have_dir_base != 0) {
-                ncp_add_byte(server, 1);        /* dir_base */
-        } else {
-                ncp_add_byte(server, 0xff);     /* no handle */
-        }
-        if (path != NULL) {
-                ncp_add_byte(server, 1);        /* 1 component */
-                ncp_add_pstring(server, path);
-        } else {
-                ncp_add_byte(server, 0);
-        }
-}
-
-int ncp_dirhandle_alloc(struct ncp_server* server, __u8 volnum, __le32 dirent,
-                        __u8* dirhandle) {
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 12);               /* subfunction */
-        ncp_add_byte(server, NW_NS_DOS);
-        ncp_add_byte(server, 0);
-        ncp_add_word(server, 0);
-        ncp_add_handle_path(server, volnum, dirent, 1, NULL);
-        if ((result = ncp_request(server, 87)) == 0) {
-                *dirhandle = ncp_reply_byte(server, 0);
-        }
-        ncp_unlock_server(server);
-        return result;
-}
-
-int ncp_dirhandle_free(struct ncp_server* server, __u8 dirhandle) {
-        int result;
-        
-        ncp_init_request_s(server, 20);
-        ncp_add_byte(server, dirhandle);
-        result = ncp_request(server, 22);
-        ncp_unlock_server(server);
-        return result;
-}
-
-void ncp_extract_file_info(const void *structure, struct nw_info_struct *target)
-{
-        const __u8 *name_len;
-        const int info_struct_size = offsetof(struct nw_info_struct, nameLen);
-
-        memcpy(target, structure, info_struct_size);
-        name_len = structure + info_struct_size;
-        target->nameLen = *name_len;
-        memcpy(target->entryName, name_len + 1, *name_len);
-        target->entryName[*name_len] = '\0';
-        target->volNumber = le32_to_cpu(target->volNumber);
-        return;
-}
-
-#ifdef CONFIG_NCPFS_NFS_NS
-static inline void ncp_extract_nfs_info(const unsigned char *structure,
-                                 struct nw_nfs_info *target)
-{
-        target->mode = DVAL_LH(structure);
-        target->rdev = DVAL_LH(structure + 8);
-}
-#endif
-
-int ncp_obtain_nfs_info(struct ncp_server *server,
-                        struct nw_info_struct *target)
-
-{
-        int result = 0;
-#ifdef CONFIG_NCPFS_NFS_NS
-        __u32 volnum = target->volNumber;
-
-        if (ncp_is_nfs_extras(server, volnum)) {
-                ncp_init_request(server);
-                ncp_add_byte(server, 19);       /* subfunction */
-                ncp_add_byte(server, server->name_space[volnum]);
-                ncp_add_byte(server, NW_NS_NFS);
-                ncp_add_byte(server, 0);
-                ncp_add_byte(server, volnum);
-                ncp_add_dword(server, target->dirEntNum);
-                /* We must retrieve both nlinks and rdev, otherwise some server versions
-                   report zeroes instead of valid data */
-                ncp_add_dword_lh(server, NSIBM_NFS_MODE | NSIBM_NFS_NLINKS | NSIBM_NFS_RDEV);
-
-                if ((result = ncp_request(server, 87)) == 0) {
-                        ncp_extract_nfs_info(ncp_reply_data(server, 0), &target->nfs);
-                        ncp_dbg(1, "(%s) mode=0%o, rdev=0x%x\n",
-                                target->entryName, target->nfs.mode,
-                                target->nfs.rdev);
-                } else {
-                        target->nfs.mode = 0;
-                        target->nfs.rdev = 0;
-                }
-                ncp_unlock_server(server);
-
-        } else
-#endif
-        {
-                target->nfs.mode = 0;
-                target->nfs.rdev = 0;
-        }
-        return result;
-}
-
-/*
- * Returns information for a (one-component) name relative to
- * the specified directory.
- */
-int ncp_obtain_info(struct ncp_server *server, struct inode *dir, const char *path,
-                        struct nw_info_struct *target)
-{
-        __u8  volnum = NCP_FINFO(dir)->volNumber;
-        __le32 dirent = NCP_FINFO(dir)->dirEntNum;
-        int result;
-
-        if (target == NULL) {
-                pr_err("%s: invalid call\n", __func__);
-                return -EINVAL;
-        }
-        ncp_init_request(server);
-        ncp_add_byte(server, 6);        /* subfunction */
-        ncp_add_byte(server, server->name_space[volnum]);
-        ncp_add_byte(server, server->name_space[volnum]); /* N.B. twice ?? */
-        ncp_add_word(server, cpu_to_le16(0x8006));      /* get all */
-        ncp_add_dword(server, RIM_ALL);
-        ncp_add_handle_path(server, volnum, dirent, 1, path);
-
-        if ((result = ncp_request(server, 87)) != 0)
-                goto out;
-        ncp_extract_file_info(ncp_reply_data(server, 0), target);
-        ncp_unlock_server(server);
-        
-        result = ncp_obtain_nfs_info(server, target);
-        return result;
-
-out:
-        ncp_unlock_server(server);
-        return result;
-}
-
-#ifdef CONFIG_NCPFS_NFS_NS
-static int
-ncp_obtain_DOS_dir_base(struct ncp_server *server,
-                __u8 ns, __u8 volnum, __le32 dirent,
-                const char *path, /* At most 1 component */
-                __le32 *DOS_dir_base)
-{
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 6); /* subfunction */
-        ncp_add_byte(server, ns);
-        ncp_add_byte(server, ns);
-        ncp_add_word(server, cpu_to_le16(0x8006)); /* get all */
-        ncp_add_dword(server, RIM_DIRECTORY);
-        ncp_add_handle_path(server, volnum, dirent, 1, path);
-
-        if ((result = ncp_request(server, 87)) == 0)
-        {
-                if (DOS_dir_base) *DOS_dir_base=ncp_reply_dword(server, 0x34);
-        }
-        ncp_unlock_server(server);
-        return result;
-}
-#endif /* CONFIG_NCPFS_NFS_NS */
-
-static inline int
-ncp_get_known_namespace(struct ncp_server *server, __u8 volume)
-{
-#if defined(CONFIG_NCPFS_OS2_NS) || defined(CONFIG_NCPFS_NFS_NS)
-        int result;
-        __u8 *namespace;
-        __u16 no_namespaces;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 24);       /* Subfunction: Get Name Spaces Loaded */
-        ncp_add_word(server, 0);
-        ncp_add_byte(server, volume);
-
-        if ((result = ncp_request(server, 87)) != 0) {
-                ncp_unlock_server(server);
-                return NW_NS_DOS; /* not result ?? */
-        }
-
-        result = NW_NS_DOS;
-        no_namespaces = ncp_reply_le16(server, 0);
-        namespace = ncp_reply_data(server, 2);
-
-        while (no_namespaces > 0) {
-                ncp_dbg(1, "found %d on %d\n", *namespace, volume);
-
-#ifdef CONFIG_NCPFS_NFS_NS
-                if ((*namespace == NW_NS_NFS) && !(server->m.flags&NCP_MOUNT_NO_NFS)) 
-                {
-                        result = NW_NS_NFS;
-                        break;
-                }
-#endif  /* CONFIG_NCPFS_NFS_NS */
-#ifdef CONFIG_NCPFS_OS2_NS
-                if ((*namespace == NW_NS_OS2) && !(server->m.flags&NCP_MOUNT_NO_OS2))
-                {
-                        result = NW_NS_OS2;
-                }
-#endif  /* CONFIG_NCPFS_OS2_NS */
-                namespace += 1;
-                no_namespaces -= 1;
-        }
-        ncp_unlock_server(server);
-        return result;
-#else   /* neither OS2 nor NFS - only DOS */
-        return NW_NS_DOS;
-#endif  /* defined(CONFIG_NCPFS_OS2_NS) || defined(CONFIG_NCPFS_NFS_NS) */
-}
-
-int
-ncp_update_known_namespace(struct ncp_server *server, __u8 volume, int *ret_ns)
-{
-        int ns = ncp_get_known_namespace(server, volume);
-
-        if (ret_ns)
-                *ret_ns = ns;
-
-        ncp_dbg(1, "namespace[%d] = %d\n", volume, server->name_space[volume]);
-
-        if (server->name_space[volume] == ns)
-                return 0;
-        server->name_space[volume] = ns;
-        return 1;
-}
-
-static int
-ncp_ObtainSpecificDirBase(struct ncp_server *server,
-                __u8 nsSrc, __u8 nsDst, __u8 vol_num, __le32 dir_base,
-                const char *path, /* At most 1 component */
-                __le32 *dirEntNum, __le32 *DosDirNum)
-{
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 6); /* subfunction */
-        ncp_add_byte(server, nsSrc);
-        ncp_add_byte(server, nsDst);
-        ncp_add_word(server, cpu_to_le16(0x8006)); /* get all */
-        ncp_add_dword(server, RIM_ALL);
-        ncp_add_handle_path(server, vol_num, dir_base, 1, path);
-
-        if ((result = ncp_request(server, 87)) != 0)
-        {
-                ncp_unlock_server(server);
-                return result;
-        }
-
-        if (dirEntNum)
-                *dirEntNum = ncp_reply_dword(server, 0x30);
-        if (DosDirNum)
-                *DosDirNum = ncp_reply_dword(server, 0x34);
-        ncp_unlock_server(server);
-        return 0;
-}
-
-int
-ncp_mount_subdir(struct ncp_server *server,
-                 __u8 volNumber, __u8 srcNS, __le32 dirEntNum,
-                 __u32* volume, __le32* newDirEnt, __le32* newDosEnt)
-{
-        int dstNS;
-        int result;
-
-        ncp_update_known_namespace(server, volNumber, &dstNS);
-        if ((result = ncp_ObtainSpecificDirBase(server, srcNS, dstNS, volNumber, 
-                                      dirEntNum, NULL, newDirEnt, newDosEnt)) != 0)
-        {
-                return result;
-        }
-        *volume = volNumber;
-        server->m.mounted_vol[1] = 0;
-        server->m.mounted_vol[0] = 'X';
-        return 0;
-}
-
-int 
-ncp_get_volume_root(struct ncp_server *server,
-                    const char *volname, __u32* volume, __le32* dirent, __le32* dosdirent)
-{
-        int result;
-
-        ncp_dbg(1, "looking up vol %s\n", volname);
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 22);       /* Subfunction: Generate dir handle */
-        ncp_add_byte(server, 0);        /* DOS namespace */
-        ncp_add_byte(server, 0);        /* reserved */
-        ncp_add_byte(server, 0);        /* reserved */
-        ncp_add_byte(server, 0);        /* reserved */
-
-        ncp_add_byte(server, 0);        /* faked volume number */
-        ncp_add_dword(server, 0);       /* faked dir_base */
-        ncp_add_byte(server, 0xff);     /* Don't have a dir_base */
-        ncp_add_byte(server, 1);        /* 1 path component */
-        ncp_add_pstring(server, volname);
-
-        if ((result = ncp_request(server, 87)) != 0) {
-                ncp_unlock_server(server);
-                return result;
-        }
-        *dirent = *dosdirent = ncp_reply_dword(server, 4);
-        *volume = ncp_reply_byte(server, 8);
-        ncp_unlock_server(server);
-        return 0;
-}
-
-int
-ncp_lookup_volume(struct ncp_server *server,
-                  const char *volname, struct nw_info_struct *target)
-{
-        int result;
-
-        memset(target, 0, sizeof(*target));
-        result = ncp_get_volume_root(server, volname,
-                        &target->volNumber, &target->dirEntNum, &target->DosDirNum);
-        if (result) {
-                return result;
-        }
-        ncp_update_known_namespace(server, target->volNumber, NULL);
-        target->nameLen = strlen(volname);
-        memcpy(target->entryName, volname, target->nameLen+1);
-        target->attributes = aDIR;
-        /* set dates to Jan 1, 1986  00:00 */
-        target->creationTime = target->modifyTime = cpu_to_le16(0x0000);
-        target->creationDate = target->modifyDate = target->lastAccessDate = cpu_to_le16(0x0C21);
-        target->nfs.mode = 0;
-        return 0;
-}
-
-int ncp_modify_file_or_subdir_dos_info_path(struct ncp_server *server,
-                                            struct inode *dir,
-                                            const char *path,
-                                            __le32 info_mask,
-                                            const struct nw_modify_dos_info *info)
-{
-        __u8  volnum = NCP_FINFO(dir)->volNumber;
-        __le32 dirent = NCP_FINFO(dir)->dirEntNum;
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 7);        /* subfunction */
-        ncp_add_byte(server, server->name_space[volnum]);
-        ncp_add_byte(server, 0);        /* reserved */
-        ncp_add_word(server, cpu_to_le16(0x8006));      /* search attribs: all */
-
-        ncp_add_dword(server, info_mask);
-        ncp_add_mem(server, info, sizeof(*info));
-        ncp_add_handle_path(server, volnum, dirent, 1, path);
-
-        result = ncp_request(server, 87);
-        ncp_unlock_server(server);
-        return result;
-}
-
-int ncp_modify_file_or_subdir_dos_info(struct ncp_server *server,
-                                       struct inode *dir,
-                                       __le32 info_mask,
-                                       const struct nw_modify_dos_info *info)
-{
-        return ncp_modify_file_or_subdir_dos_info_path(server, dir, NULL,
-                info_mask, info);
-}
-
-#ifdef CONFIG_NCPFS_NFS_NS
-int ncp_modify_nfs_info(struct ncp_server *server, __u8 volnum, __le32 dirent,
-                               __u32 mode, __u32 rdev)
-
-{
-        int result = 0;
-
-        ncp_init_request(server);
-        if (server->name_space[volnum] == NW_NS_NFS) {
-                ncp_add_byte(server, 25);       /* subfunction */
-                ncp_add_byte(server, server->name_space[volnum]);
-                ncp_add_byte(server, NW_NS_NFS);
-                ncp_add_byte(server, volnum);
-                ncp_add_dword(server, dirent);
-                /* we must always operate on both nlinks and rdev, otherwise
-                   rdev is not set */
-                ncp_add_dword_lh(server, NSIBM_NFS_MODE | NSIBM_NFS_NLINKS | NSIBM_NFS_RDEV);
-                ncp_add_dword_lh(server, mode);
-                ncp_add_dword_lh(server, 1);    /* nlinks */
-                ncp_add_dword_lh(server, rdev);
-                result = ncp_request(server, 87);
-        }
-        ncp_unlock_server(server);
-        return result;
-}
-#endif
-
-
-static int
-ncp_DeleteNSEntry(struct ncp_server *server,
-                  __u8 have_dir_base, __u8 volnum, __le32 dirent,
-                  const char* name, __u8 ns, __le16 attr)
-{
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 8);        /* subfunction */
-        ncp_add_byte(server, ns);
-        ncp_add_byte(server, 0);        /* reserved */
-        ncp_add_word(server, attr);     /* search attribs: all */
-        ncp_add_handle_path(server, volnum, dirent, have_dir_base, name);
-
-        result = ncp_request(server, 87);
-        ncp_unlock_server(server);
-        return result;
-}
-
-int
-ncp_del_file_or_subdir2(struct ncp_server *server,
-                        struct dentry *dentry)
-{
-        struct inode *inode = d_inode(dentry);
-        __u8  volnum;
-        __le32 dirent;
-
-        if (!inode) {
-                return 0xFF;    /* Any error */
-        }
-        volnum = NCP_FINFO(inode)->volNumber;
-        dirent = NCP_FINFO(inode)->DosDirNum;
-        return ncp_DeleteNSEntry(server, 1, volnum, dirent, NULL, NW_NS_DOS, cpu_to_le16(0x8006));
-}
-
-int
-ncp_del_file_or_subdir(struct ncp_server *server,
-                       struct inode *dir, const char *name)
-{
-        __u8  volnum = NCP_FINFO(dir)->volNumber;
-        __le32 dirent = NCP_FINFO(dir)->dirEntNum;
-        int name_space;
-
-        name_space = server->name_space[volnum];
-#ifdef CONFIG_NCPFS_NFS_NS
-        if (name_space == NW_NS_NFS)
-        {
-                int result;
- 
-                result=ncp_obtain_DOS_dir_base(server, name_space, volnum, dirent, name, &dirent);
-                if (result) return result;
-                name = NULL;
-                name_space = NW_NS_DOS;
-        }
-#endif  /* CONFIG_NCPFS_NFS_NS */
-        return ncp_DeleteNSEntry(server, 1, volnum, dirent, name, name_space, cpu_to_le16(0x8006));
-}
-
-static inline void ConvertToNWfromDWORD(__u16 v0, __u16 v1, __u8 ret[6])
-{
-        __le16 *dest = (__le16 *) ret;
-        dest[1] = cpu_to_le16(v0);
-        dest[2] = cpu_to_le16(v1);
-        dest[0] = cpu_to_le16(v0 + 1);
-        return;
-}
-
-/* If both dir and name are NULL, then in target there's already a
-   looked-up entry that wants to be opened. */
-int ncp_open_create_file_or_subdir(struct ncp_server *server,
-                                   struct inode *dir, const char *name,
-                                   int open_create_mode,
-                                   __le32 create_attributes,
-                                   __le16 desired_acc_rights,
-                                   struct ncp_entry_info *target)
-{
-        __le16 search_attribs = cpu_to_le16(0x0006);
-        __u8  volnum;
-        __le32 dirent;
-        int result;
-
-        volnum = NCP_FINFO(dir)->volNumber;
-        dirent = NCP_FINFO(dir)->dirEntNum;
-
-        if ((create_attributes & aDIR) != 0) {
-                search_attribs |= cpu_to_le16(0x8000);
-        }
-        ncp_init_request(server);
-        ncp_add_byte(server, 1);        /* subfunction */
-        ncp_add_byte(server, server->name_space[volnum]);
-        ncp_add_byte(server, open_create_mode);
-        ncp_add_word(server, search_attribs);
-        ncp_add_dword(server, RIM_ALL);
-        ncp_add_dword(server, create_attributes);
-        /* The desired acc rights seem to be the inherited rights mask
-           for directories */
-        ncp_add_word(server, desired_acc_rights);
-        ncp_add_handle_path(server, volnum, dirent, 1, name);
-
-        if ((result = ncp_request(server, 87)) != 0)
-                goto out;
-        if (!(create_attributes & aDIR))
-                target->opened = 1;
-
-        /* in target there's a new finfo to fill */
-        ncp_extract_file_info(ncp_reply_data(server, 6), &(target->i));
-        target->volume = target->i.volNumber;
-        ConvertToNWfromDWORD(ncp_reply_le16(server, 0),
-                             ncp_reply_le16(server, 2),
-                             target->file_handle);
-        
-        ncp_unlock_server(server);
-
-        (void)ncp_obtain_nfs_info(server, &(target->i));
-        return 0;
-
-out:
-        ncp_unlock_server(server);
-        return result;
-}
-
-int
-ncp_initialize_search(struct ncp_server *server, struct inode *dir,
-                        struct nw_search_sequence *target)
-{
-        __u8  volnum = NCP_FINFO(dir)->volNumber;
-        __le32 dirent = NCP_FINFO(dir)->dirEntNum;
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 2);        /* subfunction */
-        ncp_add_byte(server, server->name_space[volnum]);
-        ncp_add_byte(server, 0);        /* reserved */
-        ncp_add_handle_path(server, volnum, dirent, 1, NULL);
-
-        result = ncp_request(server, 87);
-        if (result)
-                goto out;
-        memcpy(target, ncp_reply_data(server, 0), sizeof(*target));
-
-out:
-        ncp_unlock_server(server);
-        return result;
-}
-
-int ncp_search_for_fileset(struct ncp_server *server,
-                           struct nw_search_sequence *seq,
-                           int* more,
-                           int* cnt,
-                           char* buffer,
-                           size_t bufsize,
-                           char** rbuf,
-                           size_t* rsize)
-{
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 20);
-        ncp_add_byte(server, server->name_space[seq->volNumber]);
-        ncp_add_byte(server, 0);                /* datastream */
-        ncp_add_word(server, cpu_to_le16(0x8006));
-        ncp_add_dword(server, RIM_ALL);
-        ncp_add_word(server, cpu_to_le16(32767));       /* max returned items */
-        ncp_add_mem(server, seq, 9);
-#ifdef CONFIG_NCPFS_NFS_NS
-        if (server->name_space[seq->volNumber] == NW_NS_NFS) {
-                ncp_add_byte(server, 0);        /* 0 byte pattern */
-        } else 
-#endif
-        {
-                ncp_add_byte(server, 2);        /* 2 byte pattern */
-                ncp_add_byte(server, 0xff);     /* following is a wildcard */
-                ncp_add_byte(server, '*');
-        }
-        result = ncp_request2(server, 87, buffer, bufsize);
-        if (result) {
-                ncp_unlock_server(server);
-                return result;
-        }
-        if (server->ncp_reply_size < 12) {
-                ncp_unlock_server(server);
-                return 0xFF;
-        }
-        *rsize = server->ncp_reply_size - 12;
-        ncp_unlock_server(server);
-        buffer = buffer + sizeof(struct ncp_reply_header);
-        *rbuf = buffer + 12;
-        *cnt = WVAL_LH(buffer + 10);
-        *more = BVAL(buffer + 9);
-        memcpy(seq, buffer, 9);
-        return 0;
-}
-
-static int
-ncp_RenameNSEntry(struct ncp_server *server,
-                  struct inode *old_dir, const char *old_name, __le16 old_type,
-                  struct inode *new_dir, const char *new_name)
-{
-        int result = -EINVAL;
-
-        if ((old_dir == NULL) || (old_name == NULL) ||
-            (new_dir == NULL) || (new_name == NULL))
-                goto out;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 4);        /* subfunction */
-        ncp_add_byte(server, server->name_space[NCP_FINFO(old_dir)->volNumber]);
-        ncp_add_byte(server, 1);        /* rename flag */
-        ncp_add_word(server, old_type); /* search attributes */
-
-        /* source Handle Path */
-        ncp_add_byte(server, NCP_FINFO(old_dir)->volNumber);
-        ncp_add_dword(server, NCP_FINFO(old_dir)->dirEntNum);
-        ncp_add_byte(server, 1);
-        ncp_add_byte(server, 1);        /* 1 source component */
-
-        /* dest Handle Path */
-        ncp_add_byte(server, NCP_FINFO(new_dir)->volNumber);
-        ncp_add_dword(server, NCP_FINFO(new_dir)->dirEntNum);
-        ncp_add_byte(server, 1);
-        ncp_add_byte(server, 1);        /* 1 destination component */
-
-        /* source path string */
-        ncp_add_pstring(server, old_name);
-        /* dest path string */
-        ncp_add_pstring(server, new_name);
-
-        result = ncp_request(server, 87);
-        ncp_unlock_server(server);
-out:
-        return result;
-}
-
-int ncp_ren_or_mov_file_or_subdir(struct ncp_server *server,
-                                struct inode *old_dir, const char *old_name,
-                                struct inode *new_dir, const char *new_name)
-{
-        int result;
-        __le16 old_type = cpu_to_le16(0x06);
-
-/* If somebody can do it atomic, call me... vandrove@vc.cvut.cz */
-        result = ncp_RenameNSEntry(server, old_dir, old_name, old_type,
-                                           new_dir, new_name);
-        if (result == 0xFF)     /* File Not Found, try directory */
-        {
-                old_type = cpu_to_le16(0x16);
-                result = ncp_RenameNSEntry(server, old_dir, old_name, old_type,
-                                                   new_dir, new_name);
-        }
-        if (result != 0x92) return result;      /* All except NO_FILES_RENAMED */
-        result = ncp_del_file_or_subdir(server, new_dir, new_name);
-        if (result != 0) return -EACCES;
-        result = ncp_RenameNSEntry(server, old_dir, old_name, old_type,
-                                           new_dir, new_name);
-        return result;
-}
-        
-
-/* We have to transfer to/from user space */
-int
-ncp_read_kernel(struct ncp_server *server, const char *file_id,
-             __u32 offset, __u16 to_read, char *target, int *bytes_read)
-{
-        const char *source;
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 0);
-        ncp_add_mem(server, file_id, 6);
-        ncp_add_be32(server, offset);
-        ncp_add_be16(server, to_read);
-
-        if ((result = ncp_request(server, 72)) != 0) {
-                goto out;
-        }
-        *bytes_read = ncp_reply_be16(server, 0);
-        source = ncp_reply_data(server, 2 + (offset & 1));
-
-        memcpy(target, source, *bytes_read);
-out:
-        ncp_unlock_server(server);
-        return result;
-}
-
-/* There is a problem... egrep and some other silly tools do:
-        x = mmap(NULL, MAP_PRIVATE, PROT_READ|PROT_WRITE, <ncpfs fd>, 32768);
-        read(<ncpfs fd>, x, 32768);
-   Now copying read result by copy_to_user causes pagefault. This pagefault
-   could not be handled because of server was locked due to read. So we have
-   to use temporary buffer. So ncp_unlock_server must be done before
-   copy_to_user (and for write, copy_from_user must be done before 
-   ncp_init_request... same applies for send raw packet ioctl). Because of
-   file is normally read in bigger chunks, caller provides kmalloced 
-   (vmalloced) chunk of memory with size >= to_read...
- */
-int
-ncp_read_bounce(struct ncp_server *server, const char *file_id,
-         __u32 offset, __u16 to_read, struct iov_iter *to,
-         int *bytes_read, void *bounce, __u32 bufsize)
-{
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 0);
-        ncp_add_mem(server, file_id, 6);
-        ncp_add_be32(server, offset);
-        ncp_add_be16(server, to_read);
-        result = ncp_request2(server, 72, bounce, bufsize);
-        ncp_unlock_server(server);
-        if (!result) {
-                int len = get_unaligned_be16((char *)bounce +
-                          sizeof(struct ncp_reply_header));
-                result = -EIO;
-                if (len <= to_read) {
-                        char* source;
-
-                        source = (char*)bounce + 
-                                 sizeof(struct ncp_reply_header) + 2 + 
-                                 (offset & 1);
-                        *bytes_read = len;
-                        result = 0;
-                        if (copy_to_iter(source, len, to) != len)
-                                result = -EFAULT;
-                }
-        }
-        return result;
-}
-
-int
-ncp_write_kernel(struct ncp_server *server, const char *file_id,
-                 __u32 offset, __u16 to_write,
-                 const char *source, int *bytes_written)
-{
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 0);
-        ncp_add_mem(server, file_id, 6);
-        ncp_add_be32(server, offset);
-        ncp_add_be16(server, to_write);
-        ncp_add_mem(server, source, to_write);
-        
-        if ((result = ncp_request(server, 73)) == 0)
-                *bytes_written = to_write;
-        ncp_unlock_server(server);
-        return result;
-}
-
-#ifdef CONFIG_NCPFS_IOCTL_LOCKING
-int
-ncp_LogPhysicalRecord(struct ncp_server *server, const char *file_id,
-          __u8 locktype, __u32 offset, __u32 length, __u16 timeout)
-{
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, locktype);
-        ncp_add_mem(server, file_id, 6);
-        ncp_add_be32(server, offset);
-        ncp_add_be32(server, length);
-        ncp_add_be16(server, timeout);
-
-        if ((result = ncp_request(server, 0x1A)) != 0)
-        {
-                ncp_unlock_server(server);
-                return result;
-        }
-        ncp_unlock_server(server);
-        return 0;
-}
-
-int
-ncp_ClearPhysicalRecord(struct ncp_server *server, const char *file_id,
-          __u32 offset, __u32 length)
-{
-        int result;
-
-        ncp_init_request(server);
-        ncp_add_byte(server, 0);        /* who knows... lanalyzer says that */
-        ncp_add_mem(server, file_id, 6);
-        ncp_add_be32(server, offset);
-        ncp_add_be32(server, length);
-
-        if ((result = ncp_request(server, 0x1E)) != 0)
-        {
-                ncp_unlock_server(server);
-                return result;
-        }
-        ncp_unlock_server(server);
-        return 0;
-}
-#endif  /* CONFIG_NCPFS_IOCTL_LOCKING */
-
-#ifdef CONFIG_NCPFS_NLS
-/* This are the NLS conversion routines with inspirations and code parts
- * from the vfat file system and hints from Petr Vandrovec.
- */
-
-int
-ncp__io2vol(struct ncp_server *server, unsigned char *vname, unsigned int *vlen,
-                const unsigned char *iname, unsigned int ilen, int cc)
-{
-        struct nls_table *in = server->nls_io;
-        struct nls_table *out = server->nls_vol;
-        unsigned char *vname_start;
-        unsigned char *vname_end;
-        const unsigned char *iname_end;
-
-        iname_end = iname + ilen;
-        vname_start = vname;
-        vname_end = vname + *vlen - 1;
-
-        while (iname < iname_end) {
-                int chl;
-                wchar_t ec;
-
-                if (NCP_IS_FLAG(server, NCP_FLAG_UTF8)) {
-                        int k;
-                        unicode_t u;
-
-                        k = utf8_to_utf32(iname, iname_end - iname, &u);
-                        if (k < 0 || u > MAX_WCHAR_T)
-                                return -EINVAL;
-                        iname += k;
-                        ec = u;
-                } else {
-                        if (*iname == NCP_ESC) {
-                                int k;
-
-                                if (iname_end - iname < 5)
-                                        goto nospec;
-
-                                ec = 0;
-                                for (k = 1; k < 5; k++) {
-                                        unsigned char nc;
-
-                                        nc = iname[k] - '0';
-                                        if (nc >= 10) {
-                                                nc -= 'A' - '0' - 10;
-                                                if ((nc < 10) || (nc > 15)) {
-                                                        goto nospec;
-                                                }
-                                        }
-                                        ec = (ec << 4) | nc;
-                                }
-                                iname += 5;
-                        } else {
-nospec:;                        
-                                if ( (chl = in->char2uni(iname, iname_end - iname, &ec)) < 0)
-                                        return chl;
-                                iname += chl;
-                        }
-                }
-
-                /* unitoupper should be here! */
-
-                chl = out->uni2char(ec, vname, vname_end - vname);
-                if (chl < 0)
-                        return chl;
-
-                /* this is wrong... */
-                if (cc) {
-                        int chi;
-
-                        for (chi = 0; chi < chl; chi++){
-                                vname[chi] = ncp_toupper(out, vname[chi]);
-                        }
-                }
-                vname += chl;
-        }
-
-        *vname = 0;
-        *vlen = vname - vname_start;
-        return 0;
-}
-
-int
-ncp__vol2io(struct ncp_server *server, unsigned char *iname, unsigned int *ilen,
-                const unsigned char *vname, unsigned int vlen, int cc)
-{
-        struct nls_table *in = server->nls_vol;
-        struct nls_table *out = server->nls_io;
-        const unsigned char *vname_end;
-        unsigned char *iname_start;
-        unsigned char *iname_end;
-        unsigned char *vname_cc;
-        int err;
-
-        vname_cc = NULL;
-
-        if (cc) {
-                int i;
-
-                /* this is wrong! */
-                vname_cc = kmalloc(vlen, GFP_KERNEL);
-                if (!vname_cc)
-                        return -ENOMEM;
-                for (i = 0; i < vlen; i++)
-                        vname_cc[i] = ncp_tolower(in, vname[i]);
-                vname = vname_cc;
-        }
-
-        iname_start = iname;
-        iname_end = iname + *ilen - 1;
-        vname_end = vname + vlen;
-
-        while (vname < vname_end) {
-                wchar_t ec;
-                int chl;
-
-                if ( (chl = in->char2uni(vname, vname_end - vname, &ec)) < 0) {
-                        err = chl;
-                        goto quit;
-                }
-                vname += chl;
-
-                /* unitolower should be here! */
-
-                if (NCP_IS_FLAG(server, NCP_FLAG_UTF8)) {
-                        int k;
-
-                        k = utf32_to_utf8(ec, iname, iname_end - iname);
-                        if (k < 0) {
-                                err = -ENAMETOOLONG;
-                                goto quit;
-                        }
-                        iname += k;
-                } else {
-                        if ( (chl = out->uni2char(ec, iname, iname_end - iname)) >= 0) {
-                                iname += chl;
-                        } else {
-                                int k;
-
-                                if (iname_end - iname < 5) {
-                                        err = -ENAMETOOLONG;
-                                        goto quit;
-                                }
-                                *iname = NCP_ESC;
-                                for (k = 4; k > 0; k--) {
-                                        unsigned char v;
-                                        
-                                        v = (ec & 0xF) + '0';
-                                        if (v > '9') {
-                                                v += 'A' - '9' - 1;
-                                        }
-                                        iname[k] = v;
-                                        ec >>= 4;
-                                }
-                                iname += 5;
-                        }
-                }
-        }
-
-        *iname = 0;
-        *ilen = iname - iname_start;
-        err = 0;
-quit:;
-        if (cc)
-                kfree(vname_cc);
-        return err;
-}
-
-#else
-
-int
-ncp__io2vol(unsigned char *vname, unsigned int *vlen,
-                const unsigned char *iname, unsigned int ilen, int cc)
-{
-        int i;
-
-        if (*vlen <= ilen)
-                return -ENAMETOOLONG;
-
-        if (cc)
-                for (i = 0; i < ilen; i++) {
-                        *vname = toupper(*iname);
-                        vname++;
-                        iname++;
-                }
-        else {
-                memmove(vname, iname, ilen);
-                vname += ilen;
-        }
-
-        *vlen = ilen;
-        *vname = 0;
-        return 0;
-}
-
-int
-ncp__vol2io(unsigned char *iname, unsigned int *ilen,
-                const unsigned char *vname, unsigned int vlen, int cc)
-{
-        int i;
-
-        if (*ilen <= vlen)
-                return -ENAMETOOLONG;
-
-        if (cc)
-                for (i = 0; i < vlen; i++) {
-                        *iname = tolower(*vname);
-                        iname++;
-                        vname++;
-                }
-        else {
-                memmove(iname, vname, vlen);
-                iname += vlen;
-        }
-
-        *ilen = vlen;
-        *iname = 0;
-        return 0;
-}
-
-#endif
diff --git a/fs/ncpfs/ncplib_kernel.h b/fs/ncpfs/ncplib_kernel.h
deleted file mode 100644
index aaae8aa9bf7d..000000000000
--- a/fs/ncpfs/ncplib_kernel.h
+++ /dev/null
@@ -1,215 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/*
- *  ncplib_kernel.h
- *
- *  Copyright (C) 1995, 1996 by Volker Lendecke
- *  Modified for big endian by J.F. Chadima and David S. Miller
- *  Modified 1997 Peter Waltenberg, Bill Hawes, David Woodhouse for 2.1 dcache
- *  Modified 1998, 1999 Wolfram Pienkoss for NLS
- *  Modified 1999 Wolfram Pienkoss for directory caching
- *
- */
-
-#ifndef _NCPLIB_H
-#define _NCPLIB_H
-
-
-#include <linux/fs.h>
-#include <linux/types.h>
-#include <linux/errno.h>
-#include <linux/slab.h>
-#include <linux/stat.h>
-#include <linux/fcntl.h>
-#include <linux/pagemap.h>
-
-#include <linux/uaccess.h>
-#include <asm/byteorder.h>
-#include <asm/unaligned.h>
-#include <asm/string.h>
-
-#ifdef CONFIG_NCPFS_NLS
-#include <linux/nls.h>
-#else
-#include <linux/ctype.h>
-#endif /* CONFIG_NCPFS_NLS */
-
-#define NCP_MIN_SYMLINK_SIZE    8
-#define NCP_MAX_SYMLINK_SIZE    512
-
-#define NCP_BLOCK_SHIFT         9
-#define NCP_BLOCK_SIZE          (1 << (NCP_BLOCK_SHIFT))
-
-int ncp_negotiate_buffersize(struct ncp_server *, int, int *);
-int ncp_negotiate_size_and_options(struct ncp_server *server, int size,
-                          int options, int *ret_size, int *ret_options);
-
-int ncp_get_volume_info_with_number(struct ncp_server* server, int n,
-                                    struct ncp_volume_info *target);
-
-int ncp_get_directory_info(struct ncp_server* server, __u8 dirhandle,
-                           struct ncp_volume_info* target);
-
-int ncp_close_file(struct ncp_server *, const char *);
-static inline int ncp_read_bounce_size(__u32 size) {
-        return sizeof(struct ncp_reply_header) + 2 + 2 + size + 8;
-};
-int ncp_read_bounce(struct ncp_server *, const char *, __u32, __u16, 
-                struct iov_iter *, int *, void *bounce, __u32 bouncelen);
-int ncp_read_kernel(struct ncp_server *, const char *, __u32, __u16, 
-                char *, int *);
-int ncp_write_kernel(struct ncp_server *, const char *, __u32, __u16,
-                const char *, int *);
-
-static inline void ncp_inode_close(struct inode *inode) {
-        atomic_dec(&NCP_FINFO(inode)->opened);
-}
-
-void ncp_extract_file_info(const void* src, struct nw_info_struct* target);
-int ncp_obtain_info(struct ncp_server *server, struct inode *, const char *,
-                struct nw_info_struct *target);
-int ncp_obtain_nfs_info(struct ncp_server *server, struct nw_info_struct *target);
-int ncp_update_known_namespace(struct ncp_server *server, __u8 volume, int *ret_ns);
-int ncp_get_volume_root(struct ncp_server *server, const char *volname,
-                        __u32 *volume, __le32 *dirent, __le32 *dosdirent);
-int ncp_lookup_volume(struct ncp_server *, const char *, struct nw_info_struct *);
-int ncp_modify_file_or_subdir_dos_info(struct ncp_server *, struct inode *,
-         __le32, const struct nw_modify_dos_info *info);
-int ncp_modify_file_or_subdir_dos_info_path(struct ncp_server *, struct inode *,
-         const char* path, __le32, const struct nw_modify_dos_info *info);
-int ncp_modify_nfs_info(struct ncp_server *, __u8 volnum, __le32 dirent,
-                        __u32 mode, __u32 rdev);
-
-int ncp_del_file_or_subdir2(struct ncp_server *, struct dentry*);
-int ncp_del_file_or_subdir(struct ncp_server *, struct inode *, const char *);
-int ncp_open_create_file_or_subdir(struct ncp_server *, struct inode *, const char *,
-                                int, __le32, __le16, struct ncp_entry_info *);
-
-int ncp_initialize_search(struct ncp_server *, struct inode *,
-                      struct nw_search_sequence *target);
-int ncp_search_for_fileset(struct ncp_server *server,
-                           struct nw_search_sequence *seq,
-                           int* more, int* cnt,
-                           char* buffer, size_t bufsize,
-                           char** rbuf, size_t* rsize);
-
-int ncp_ren_or_mov_file_or_subdir(struct ncp_server *server,
-                              struct inode *, const char *, struct inode *, const char *);
-
-
-int
-ncp_LogPhysicalRecord(struct ncp_server *server,
-                      const char *file_id, __u8 locktype,
-                      __u32 offset, __u32 length, __u16 timeout);
-
-#ifdef CONFIG_NCPFS_IOCTL_LOCKING
-int
-ncp_ClearPhysicalRecord(struct ncp_server *server,
-                        const char *file_id,
-                        __u32 offset, __u32 length);
-#endif  /* CONFIG_NCPFS_IOCTL_LOCKING */
-
-int
-ncp_mount_subdir(struct ncp_server *, __u8, __u8, __le32,
-                 __u32* volume, __le32* dirent, __le32* dosdirent);
-int ncp_dirhandle_alloc(struct ncp_server *, __u8 vol, __le32 dirent, __u8 *dirhandle);
-int ncp_dirhandle_free(struct ncp_server *, __u8 dirhandle);
-
-int ncp_create_new(struct inode *dir, struct dentry *dentry,
-                          umode_t mode, dev_t rdev, __le32 attributes);
-
-static inline int ncp_is_nfs_extras(struct ncp_server* server, unsigned int volnum) {
-#ifdef CONFIG_NCPFS_NFS_NS
-        return (server->m.flags & NCP_MOUNT_NFS_EXTRAS) &&
-               (server->name_space[volnum] == NW_NS_NFS);
-#else
-        return 0;
-#endif
-}
-
-#ifdef CONFIG_NCPFS_NLS
-
-int ncp__io2vol(struct ncp_server *, unsigned char *, unsigned int *,
-                                const unsigned char *, unsigned int, int);
-int ncp__vol2io(struct ncp_server *, unsigned char *, unsigned int *,
-                                const unsigned char *, unsigned int, int);
-
-#define NCP_ESC                 ':'
-#define NCP_IO_TABLE(sb)        (NCP_SBP(sb)->nls_io)
-#define ncp_tolower(t, c)       nls_tolower(t, c)
-#define ncp_toupper(t, c)       nls_toupper(t, c)
-#define ncp_strnicmp(t, s1, s2, len) \
-        nls_strnicmp(t, s1, s2, len)
-#define ncp_io2vol(S,m,i,n,k,U) ncp__io2vol(S,m,i,n,k,U)
-#define ncp_vol2io(S,m,i,n,k,U) ncp__vol2io(S,m,i,n,k,U)
-
-#else
-
-int ncp__io2vol(unsigned char *, unsigned int *,
-                                const unsigned char *, unsigned int, int);
-int ncp__vol2io(unsigned char *, unsigned int *,
-                                const unsigned char *, unsigned int, int);
-
-#define NCP_IO_TABLE(sb)        NULL
-#define ncp_tolower(t, c)       tolower(c)
-#define ncp_toupper(t, c)       toupper(c)
-#define ncp_io2vol(S,m,i,n,k,U) ncp__io2vol(m,i,n,k,U)
-#define ncp_vol2io(S,m,i,n,k,U) ncp__vol2io(m,i,n,k,U)
-
-
-static inline int ncp_strnicmp(const struct nls_table *t,
-                const unsigned char *s1, const unsigned char *s2, int len)
-{
-        while (len--) {
-                if (tolower(*s1++) != tolower(*s2++))
-                        return 1;
-        }
-
-        return 0;
-}
-
-#endif /* CONFIG_NCPFS_NLS */
-
-#define NCP_GET_AGE(dentry)     (jiffies - (dentry)->d_time)
-#define NCP_MAX_AGE(server)     atomic_read(&(server)->dentry_ttl)
-#define NCP_TEST_AGE(server,dentry)     (NCP_GET_AGE(dentry) < NCP_MAX_AGE(server))
-
-static inline void
-ncp_age_dentry(struct ncp_server* server, struct dentry* dentry)
-{
-        dentry->d_time = jiffies - NCP_MAX_AGE(server);
-}
-
-static inline void
-ncp_new_dentry(struct dentry* dentry)
-{
-        dentry->d_time = jiffies;
-}
-
-struct ncp_cache_head {
-        time_t          mtime;
-        unsigned long   time;   /* cache age */
-        unsigned long   end;    /* last valid fpos in cache */
-        int             eof;
-};
-
-#define NCP_DIRCACHE_SIZE       ((int)(PAGE_SIZE/sizeof(struct dentry *)))
-union ncp_dir_cache {
-        struct ncp_cache_head   head;
-        struct dentry           *dentry[NCP_DIRCACHE_SIZE];
-};
-
-#define NCP_FIRSTCACHE_SIZE     ((int)((NCP_DIRCACHE_SIZE * \
-        sizeof(struct dentry *) - sizeof(struct ncp_cache_head)) / \
-        sizeof(struct dentry *)))
-
-#define NCP_DIRCACHE_START      (NCP_DIRCACHE_SIZE - NCP_FIRSTCACHE_SIZE)
-
-struct ncp_cache_control {
-        struct  ncp_cache_head          head;
-        struct  page                    *page;
-        union   ncp_dir_cache           *cache;
-        unsigned long                   fpos, ofs;
-        int                             filled, valid, idx;
-};
-
-#endif /* _NCPLIB_H */
diff --git a/fs/ncpfs/ncpsign_kernel.c b/fs/ncpfs/ncpsign_kernel.c
deleted file mode 100644
index 8085b1a3ba47..000000000000
--- a/fs/ncpfs/ncpsign_kernel.c
+++ /dev/null
@@ -1,128 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- *  ncpsign_kernel.c
- *
- *  Arne de Bruijn (arne@knoware.nl), 1997
- *
- */
-
-
-#ifdef CONFIG_NCPFS_PACKET_SIGNING
-
-#include <linux/string.h>
-#include <linux/ncp.h>
-#include <linux/bitops.h>
-#include "ncp_fs.h"
-#include "ncpsign_kernel.h"
-
-/* i386: 32-bit, little endian, handles mis-alignment */
-#ifdef __i386__
-#define GET_LE32(p) (*(const int *)(p))
-#define PUT_LE32(p,v) { *(int *)(p)=v; }
-#else
-/* from include/ncplib.h */
-#define BVAL(buf,pos) (((const __u8 *)(buf))[pos])
-#define PVAL(buf,pos) ((unsigned)BVAL(buf,pos))
-#define BSET(buf,pos,val) (((__u8 *)(buf))[pos] = (val))
-
-static inline __u16
-WVAL_LH(const __u8 * buf, int pos)
-{
-        return PVAL(buf, pos) | PVAL(buf, pos + 1) << 8;
-}
-static inline __u32
-DVAL_LH(const __u8 * buf, int pos)
-{
-        return WVAL_LH(buf, pos) | WVAL_LH(buf, pos + 2) << 16;
-}
-static inline void
-WSET_LH(__u8 * buf, int pos, __u16 val)
-{
-        BSET(buf, pos, val & 0xff);
-        BSET(buf, pos + 1, val >> 8);
-}
-static inline void
-DSET_LH(__u8 * buf, int pos, __u32 val)
-{
-        WSET_LH(buf, pos, val & 0xffff);
-        WSET_LH(buf, pos + 2, val >> 16);
-}
-
-#define GET_LE32(p) DVAL_LH(p,0)
-#define PUT_LE32(p,v) DSET_LH(p,0,v)
-#endif
-
-static void nwsign(char *r_data1, char *r_data2, char *outdata) {
- int i;
- unsigned int w0,w1,w2,w3;
- static int rbit[4]={0, 2, 1, 3};
-#ifdef __i386__
- unsigned int *data2=(unsigned int *)r_data2;
-#else
- unsigned int data2[16];
- for (i=0;i<16;i++)
-  data2[i]=GET_LE32(r_data2+(i<<2));
-#endif 
- w0=GET_LE32(r_data1);
- w1=GET_LE32(r_data1+4);
- w2=GET_LE32(r_data1+8);
- w3=GET_LE32(r_data1+12);
- for (i=0;i<16;i+=4) {
-  w0=rol32(w0 + ((w1 & w2) | ((~w1) & w3)) + data2[i+0],3);
-  w3=rol32(w3 + ((w0 & w1) | ((~w0) & w2)) + data2[i+1],7);
-  w2=rol32(w2 + ((w3 & w0) | ((~w3) & w1)) + data2[i+2],11);
-  w1=rol32(w1 + ((w2 & w3) | ((~w2) & w0)) + data2[i+3],19);
- }
- for (i=0;i<4;i++) {
-  w0=rol32(w0 + (((w2 | w3) & w1) | (w2 & w3)) + 0x5a827999 + data2[i+0],3);
-  w3=rol32(w3 + (((w1 | w2) & w0) | (w1 & w2)) + 0x5a827999 + data2[i+4],5);
-  w2=rol32(w2 + (((w0 | w1) & w3) | (w0 & w1)) + 0x5a827999 + data2[i+8],9);
-  w1=rol32(w1 + (((w3 | w0) & w2) | (w3 & w0)) + 0x5a827999 + data2[i+12],13);
- }
- for (i=0;i<4;i++) {
-  w0=rol32(w0 + ((w1 ^ w2) ^ w3) + 0x6ed9eba1 + data2[rbit[i]+0],3);
-  w3=rol32(w3 + ((w0 ^ w1) ^ w2) + 0x6ed9eba1 + data2[rbit[i]+8],9);
-  w2=rol32(w2 + ((w3 ^ w0) ^ w1) + 0x6ed9eba1 + data2[rbit[i]+4],11);
-  w1=rol32(w1 + ((w2 ^ w3) ^ w0) + 0x6ed9eba1 + data2[rbit[i]+12],15);
- }
- PUT_LE32(outdata,(w0+GET_LE32(r_data1)) & 0xffffffff);
- PUT_LE32(outdata+4,(w1+GET_LE32(r_data1+4)) & 0xffffffff);
- PUT_LE32(outdata+8,(w2+GET_LE32(r_data1+8)) & 0xffffffff);
- PUT_LE32(outdata+12,(w3+GET_LE32(r_data1+12)) & 0xffffffff);
-}
-
-/* Make a signature for the current packet and add it at the end of the */
-/* packet. */
-void __sign_packet(struct ncp_server *server, const char *packet, size_t size, __u32 totalsize, void *sign_buff) {
-        unsigned char data[64];
-
-        memcpy(data, server->sign_root, 8);
-        *(__u32*)(data + 8) = totalsize;
-        if (size < 52) {
-                memcpy(data + 12, packet, size);
-                memset(data + 12 + size, 0, 52 - size);
-        } else {
-                memcpy(data + 12, packet, 52);
-        }
-        nwsign(server->sign_last, data, server->sign_last);
-        memcpy(sign_buff, server->sign_last, 8);
-}
-
-int sign_verify_reply(struct ncp_server *server, const char *packet, size_t size, __u32 totalsize, const void *sign_buff) {
-        unsigned char data[64];
-        unsigned char hash[16];
-
-        memcpy(data, server->sign_root, 8);
-        *(__u32*)(data + 8) = totalsize;
-        if (size < 52) {
-                memcpy(data + 12, packet, size);
-                memset(data + 12 + size, 0, 52 - size);
-        } else {
-                memcpy(data + 12, packet, 52);
-        }
-        nwsign(server->sign_last, data, hash);
-        return memcmp(sign_buff, hash, 8);
-}
-
-#endif  /* CONFIG_NCPFS_PACKET_SIGNING */
-
diff --git a/fs/ncpfs/ncpsign_kernel.h b/fs/ncpfs/ncpsign_kernel.h
deleted file mode 100644
index 57ff0a0650b8..000000000000
--- a/fs/ncpfs/ncpsign_kernel.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/*
- *  ncpsign_kernel.h
- *
- *  Arne de Bruijn (arne@knoware.nl), 1997
- *
- */
- 
-#ifndef _NCPSIGN_KERNEL_H
-#define _NCPSIGN_KERNEL_H
-
-#ifdef CONFIG_NCPFS_PACKET_SIGNING
-void __sign_packet(struct ncp_server *server, const char *data, size_t size, __u32 totalsize, void *sign_buff);
-int sign_verify_reply(struct ncp_server *server, const char *data, size_t size, __u32 totalsize, const void *sign_buff);
-#endif
-
-static inline size_t sign_packet(struct ncp_server *server, const char *data, size_t size, __u32 totalsize, void *sign_buff) {
-#ifdef CONFIG_NCPFS_PACKET_SIGNING
-        if (server->sign_active) {
-                __sign_packet(server, data, size, totalsize, sign_buff);
-                return 8;
-        }
-#endif
-        return 0;
-}
-
-#endif
diff --git a/fs/ncpfs/sock.c b/fs/ncpfs/sock.c
deleted file mode 100644
index 4c13174d85b7..000000000000
--- a/fs/ncpfs/sock.c
+++ /dev/null
@@ -1,855 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- *  linux/fs/ncpfs/sock.c
- *
- *  Copyright (C) 1992, 1993  Rick Sladkey
- *
- *  Modified 1995, 1996 by Volker Lendecke to be usable for ncp
- *  Modified 1997 Peter Waltenberg, Bill Hawes, David Woodhouse for 2.1 dcache
- *
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/time.h>
-#include <linux/errno.h>
-#include <linux/socket.h>
-#include <linux/fcntl.h>
-#include <linux/stat.h>
-#include <linux/string.h>
-#include <linux/sched/signal.h>
-#include <linux/uaccess.h>
-#include <linux/in.h>
-#include <linux/net.h>
-#include <linux/mm.h>
-#include <linux/netdevice.h>
-#include <linux/signal.h>
-#include <linux/slab.h>
-#include <net/scm.h>
-#include <net/sock.h>
-#include <linux/ipx.h>
-#include <linux/poll.h>
-#include <linux/file.h>
-
-#include "ncp_fs.h"
-
-#include "ncpsign_kernel.h"
-
-static int _recv(struct socket *sock, void *buf, int size, unsigned flags)
-{
-        struct msghdr msg = {NULL, };
-        struct kvec iov = {buf, size};
-        iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &iov, 1, size);
-        return sock_recvmsg(sock, &msg, flags);
-}
-
-static int _send(struct socket *sock, const void *buff, int len)
-{
-        struct msghdr msg = { .msg_flags = 0 };
-        struct kvec vec = {.iov_base = (void *)buff, .iov_len = len};
-        iov_iter_kvec(&msg.msg_iter, WRITE | ITER_KVEC, &vec, 1, len);
-        return sock_sendmsg(sock, &msg);
-}
-
-struct ncp_request_reply {
-        struct list_head req;
-        wait_queue_head_t wq;
-        atomic_t refs;
-        unsigned char* reply_buf;
-        size_t datalen;
-        int result;
-        enum { RQ_DONE, RQ_INPROGRESS, RQ_QUEUED, RQ_IDLE, RQ_ABANDONED } status;
-        struct iov_iter from;
-        struct kvec tx_iov[3];
-        u_int16_t tx_type;
-        u_int32_t sign[6];
-};
-
-static inline struct ncp_request_reply* ncp_alloc_req(void)
-{
-        struct ncp_request_reply *req;
-
-        req = kmalloc(sizeof(struct ncp_request_reply), GFP_KERNEL);
-        if (!req)
-                return NULL;
-
-        init_waitqueue_head(&req->wq);
-        atomic_set(&req->refs, (1));
-        req->status = RQ_IDLE;
-
-        return req;
-}
-
-static void ncp_req_get(struct ncp_request_reply *req)
-{
-        atomic_inc(&req->refs);
-}
-
-static void ncp_req_put(struct ncp_request_reply *req)
-{
-        if (atomic_dec_and_test(&req->refs))
-                kfree(req);
-}
-
-void ncp_tcp_data_ready(struct sock *sk)
-{
-        struct ncp_server *server = sk->sk_user_data;
-
-        server->data_ready(sk);
-        schedule_work(&server->rcv.tq);
-}
-
-void ncp_tcp_error_report(struct sock *sk)
-{
-        struct ncp_server *server = sk->sk_user_data;
-        
-        server->error_report(sk);
-        schedule_work(&server->rcv.tq);
-}
-
-void ncp_tcp_write_space(struct sock *sk)
-{
-        struct ncp_server *server = sk->sk_user_data;
-        
-        /* We do not need any locking: we first set tx.creq, and then we do sendmsg,
-           not vice versa... */
-        server->write_space(sk);
-        if (server->tx.creq)
-                schedule_work(&server->tx.tq);
-}
-
-void ncpdgram_timeout_call(struct timer_list *t)
-{
-        struct ncp_server *server = from_timer(server, t, timeout_tm);
-
-        schedule_work(&server->timeout_tq);
-}
-
-static inline void ncp_finish_request(struct ncp_server *server, struct ncp_request_reply *req, int result)
-{
-        req->result = result;
-        if (req->status != RQ_ABANDONED)
-                memcpy(req->reply_buf, server->rxbuf, req->datalen);
-        req->status = RQ_DONE;
-        wake_up_all(&req->wq);
-        ncp_req_put(req);
-}
-
-static void __abort_ncp_connection(struct ncp_server *server)
-{
-        struct ncp_request_reply *req;
-
-        ncp_invalidate_conn(server);
-        del_timer(&server->timeout_tm);
-        while (!list_empty(&server->tx.requests)) {
-                req = list_entry(server->tx.requests.next, struct ncp_request_reply, req);
-                
-                list_del_init(&req->req);
-                ncp_finish_request(server, req, -EIO);
-        }
-        req = server->rcv.creq;
-        if (req) {
-                server->rcv.creq = NULL;
-                ncp_finish_request(server, req, -EIO);
-                server->rcv.ptr = NULL;
-                server->rcv.state = 0;
-        }
-        req = server->tx.creq;
-        if (req) {
-                server->tx.creq = NULL;
-                ncp_finish_request(server, req, -EIO);
-        }
-}
-
-static inline int get_conn_number(struct ncp_reply_header *rp)
-{
-        return rp->conn_low | (rp->conn_high << 8);
-}
-
-static inline void __ncp_abort_request(struct ncp_server *server, struct ncp_request_reply *req, int err)
-{
-        /* If req is done, we got signal, but we also received answer... */
-        switch (req->status) {
-                case RQ_IDLE:
-                case RQ_DONE:
-                        break;
-                case RQ_QUEUED:
-                        list_del_init(&req->req);
-                        ncp_finish_request(server, req, err);
-                        break;
-                case RQ_INPROGRESS:
-                        req->status = RQ_ABANDONED;
-                        break;
-                case RQ_ABANDONED:
-                        break;
-        }
-}
-
-static inline void ncp_abort_request(struct ncp_server *server, struct ncp_request_reply *req, int err)
-{
-        mutex_lock(&server->rcv.creq_mutex);
-        __ncp_abort_request(server, req, err);
-        mutex_unlock(&server->rcv.creq_mutex);
-}
-
-static inline void __ncptcp_abort(struct ncp_server *server)
-{
-        __abort_ncp_connection(server);
-}
-
-static int ncpdgram_send(struct socket *sock, struct ncp_request_reply *req)
-{
-        struct msghdr msg = { .msg_iter = req->from, .msg_flags = MSG_DONTWAIT };
-        return sock_sendmsg(sock, &msg);
-}
-
-static void __ncptcp_try_send(struct ncp_server *server)
-{
-        struct ncp_request_reply *rq;
-        struct msghdr msg = { .msg_flags = MSG_NOSIGNAL | MSG_DONTWAIT };
-        int result;
-
-        rq = server->tx.creq;
-        if (!rq)
-                return;
-
-        msg.msg_iter = rq->from;
-        result = sock_sendmsg(server->ncp_sock, &msg);
-
-        if (result == -EAGAIN)
-                return;
-
-        if (result < 0) {
-                pr_err("tcp: Send failed: %d\n", result);
-                __ncp_abort_request(server, rq, result);
-                return;
-        }
-        if (!msg_data_left(&msg)) {
-                server->rcv.creq = rq;
-                server->tx.creq = NULL;
-                return;
-        }
-        rq->from = msg.msg_iter;
-}
-
-static inline void ncp_init_header(struct ncp_server *server, struct ncp_request_reply *req, struct ncp_request_header *h)
-{
-        req->status = RQ_INPROGRESS;
-        h->conn_low = server->connection;
-        h->conn_high = server->connection >> 8;
-        h->sequence = ++server->sequence;
-}
-        
-static void ncpdgram_start_request(struct ncp_server *server, struct ncp_request_reply *req)
-{
-        size_t signlen, len = req->tx_iov[1].iov_len;
-        struct ncp_request_header *h = req->tx_iov[1].iov_base;
-        
-        ncp_init_header(server, req, h);
-        signlen = sign_packet(server,
-                        req->tx_iov[1].iov_base + sizeof(struct ncp_request_header) - 1, 
-                        len - sizeof(struct ncp_request_header) + 1,
-                        cpu_to_le32(len), req->sign);
-        if (signlen) {
-                /* NCP over UDP appends signature */
-                req->tx_iov[2].iov_base = req->sign;
-                req->tx_iov[2].iov_len = signlen;
-        }
-        iov_iter_kvec(&req->from, WRITE | ITER_KVEC,
-                        req->tx_iov + 1, signlen ? 2 : 1, len + signlen);
-        server->rcv.creq = req;
-        server->timeout_last = server->m.time_out;
-        server->timeout_retries = server->m.retry_count;
-        ncpdgram_send(server->ncp_sock, req);
-        mod_timer(&server->timeout_tm, jiffies + server->m.time_out);
-}
-
-#define NCP_TCP_XMIT_MAGIC      (0x446D6454)
-#define NCP_TCP_XMIT_VERSION    (1)
-#define NCP_TCP_RCVD_MAGIC      (0x744E6350)
-
-static void ncptcp_start_request(struct ncp_server *server, struct ncp_request_reply *req)
-{
-        size_t signlen, len = req->tx_iov[1].iov_len;
-        struct ncp_request_header *h = req->tx_iov[1].iov_base;
-
-        ncp_init_header(server, req, h);
-        signlen = sign_packet(server, req->tx_iov[1].iov_base + sizeof(struct ncp_request_header) - 1,
-                        len - sizeof(struct ncp_request_header) + 1,
-                        cpu_to_be32(len + 24), req->sign + 4) + 16;
-
-        req->sign[0] = htonl(NCP_TCP_XMIT_MAGIC);
-        req->sign[1] = htonl(len + signlen);
-        req->sign[2] = htonl(NCP_TCP_XMIT_VERSION);
-        req->sign[3] = htonl(req->datalen + 8);
-        /* NCP over TCP prepends signature */
-        req->tx_iov[0].iov_base = req->sign;
-        req->tx_iov[0].iov_len = signlen;
-        iov_iter_kvec(&req->from, WRITE | ITER_KVEC,
-                        req->tx_iov, 2, len + signlen);
-
-        server->tx.creq = req;
-        __ncptcp_try_send(server);
-}
-
-static inline void __ncp_start_request(struct ncp_server *server, struct ncp_request_reply *req)
-{
-        /* we copy the data so that we do not depend on the caller
-           staying alive */
-        memcpy(server->txbuf, req->tx_iov[1].iov_base, req->tx_iov[1].iov_len);
-        req->tx_iov[1].iov_base = server->txbuf;
-
-        if (server->ncp_sock->type == SOCK_STREAM)
-                ncptcp_start_request(server, req);
-        else
-                ncpdgram_start_request(server, req);
-}
-
-static int ncp_add_request(struct ncp_server *server, struct ncp_request_reply *req)
-{
-        mutex_lock(&server->rcv.creq_mutex);
-        if (!ncp_conn_valid(server)) {
-                mutex_unlock(&server->rcv.creq_mutex);
-                pr_err("tcp: Server died\n");
-                return -EIO;
-        }
-        ncp_req_get(req);
-        if (server->tx.creq || server->rcv.creq) {
-                req->status = RQ_QUEUED;
-                list_add_tail(&req->req, &server->tx.requests);
-                mutex_unlock(&server->rcv.creq_mutex);
-                return 0;
-        }
-        __ncp_start_request(server, req);
-        mutex_unlock(&server->rcv.creq_mutex);
-        return 0;
-}
-
-static void __ncp_next_request(struct ncp_server *server)
-{
-        struct ncp_request_reply *req;
-
-        server->rcv.creq = NULL;
-        if (list_empty(&server->tx.requests)) {
-                return;
-        }
-        req = list_entry(server->tx.requests.next, struct ncp_request_reply, req);
-        list_del_init(&req->req);
-        __ncp_start_request(server, req);
-}
-
-static void info_server(struct ncp_server *server, unsigned int id, const void * data, size_t len)
-{
-        if (server->info_sock) {
-                struct msghdr msg = { .msg_flags = MSG_NOSIGNAL };
-                __be32 hdr[2] = {cpu_to_be32(len + 8), cpu_to_be32(id)};
-                struct kvec iov[2] = {
-                        {.iov_base = hdr, .iov_len = 8},
-                        {.iov_base = (void *)data, .iov_len = len},
-                };
-
-                iov_iter_kvec(&msg.msg_iter, ITER_KVEC | WRITE,
-                                iov, 2, len + 8);
-
-                sock_sendmsg(server->info_sock, &msg);
-        }
-}
-
-void ncpdgram_rcv_proc(struct work_struct *work)
-{
-        struct ncp_server *server =
-                container_of(work, struct ncp_server, rcv.tq);
-        struct socket* sock;
-        
-        sock = server->ncp_sock;
-        
-        while (1) {
-                struct ncp_reply_header reply;
-                int result;
-
-                result = _recv(sock, &reply, sizeof(reply), MSG_PEEK | MSG_DONTWAIT);
-                if (result < 0) {
-                        break;
-                }
-                if (result >= sizeof(reply)) {
-                        struct ncp_request_reply *req;
-        
-                        if (reply.type == NCP_WATCHDOG) {
-                                unsigned char buf[10];
-
-                                if (server->connection != get_conn_number(&reply)) {
-                                        goto drop;
-                                }
-                                result = _recv(sock, buf, sizeof(buf), MSG_DONTWAIT);
-                                if (result < 0) {
-                                        ncp_dbg(1, "recv failed with %d\n", result);
-                                        continue;
-                                }
-                                if (result < 10) {
-                                        ncp_dbg(1, "too short (%u) watchdog packet\n", result);
-                                        continue;
-                                }
-                                if (buf[9] != '?') {
-                                        ncp_dbg(1, "bad signature (%02X) in watchdog packet\n", buf[9]);
-                                        continue;
-                                }
-                                buf[9] = 'Y';
-                                _send(sock, buf, sizeof(buf));
-                                continue;
-                        }
-                        if (reply.type != NCP_POSITIVE_ACK && reply.type != NCP_REPLY) {
-                                result = _recv(sock, server->unexpected_packet.data, sizeof(server->unexpected_packet.data), MSG_DONTWAIT);
-                                if (result < 0) {
-                                        continue;
-                                }
-                                info_server(server, 0, server->unexpected_packet.data, result);
-                                continue;
-                        }
-                        mutex_lock(&server->rcv.creq_mutex);
-                        req = server->rcv.creq;
-                        if (req && (req->tx_type == NCP_ALLOC_SLOT_REQUEST || (server->sequence == reply.sequence && 
-                                        server->connection == get_conn_number(&reply)))) {
-                                if (reply.type == NCP_POSITIVE_ACK) {
-                                        server->timeout_retries = server->m.retry_count;
-                                        server->timeout_last = NCP_MAX_RPC_TIMEOUT;
-                                        mod_timer(&server->timeout_tm, jiffies + NCP_MAX_RPC_TIMEOUT);
-                                } else if (reply.type == NCP_REPLY) {
-                                        result = _recv(sock, server->rxbuf, req->datalen, MSG_DONTWAIT);
-#ifdef CONFIG_NCPFS_PACKET_SIGNING
-                                        if (result >= 0 && server->sign_active && req->tx_type != NCP_DEALLOC_SLOT_REQUEST) {
-                                                if (result < 8 + 8) {
-                                                        result = -EIO;
-                                                } else {
-                                                        unsigned int hdrl;
-                                                        
-                                                        result -= 8;
-                                                        hdrl = sock->sk->sk_family == AF_INET ? 8 : 6;
-                                                        if (sign_verify_reply(server, server->rxbuf + hdrl, result - hdrl, cpu_to_le32(result), server->rxbuf + result)) {
-                                                                pr_info("Signature violation\n");
-                                                                result = -EIO;
-                                                        }
-                                                }
-                                        }
-#endif
-                                        del_timer(&server->timeout_tm);
-                                        server->rcv.creq = NULL;
-                                        ncp_finish_request(server, req, result);
-                                        __ncp_next_request(server);
-                                        mutex_unlock(&server->rcv.creq_mutex);
-                                        continue;
-                                }
-                        }
-                        mutex_unlock(&server->rcv.creq_mutex);
-                }
-drop:;          
-                _recv(sock, &reply, sizeof(reply), MSG_DONTWAIT);
-        }
-}
-
-static void __ncpdgram_timeout_proc(struct ncp_server *server)
-{
-        /* If timer is pending, we are processing another request... */
-        if (!timer_pending(&server->timeout_tm)) {
-                struct ncp_request_reply* req;
-                
-                req = server->rcv.creq;
-                if (req) {
-                        int timeout;
-                        
-                        if (server->m.flags & NCP_MOUNT_SOFT) {
-                                if (server->timeout_retries-- == 0) {
-                                        __ncp_abort_request(server, req, -ETIMEDOUT);
-                                        return;
-                                }
-                        }
-                        /* Ignore errors */
-                        ncpdgram_send(server->ncp_sock, req);
-                        timeout = server->timeout_last << 1;
-                        if (timeout > NCP_MAX_RPC_TIMEOUT) {
-                                timeout = NCP_MAX_RPC_TIMEOUT;
-                        }
-                        server->timeout_last = timeout;
-                        mod_timer(&server->timeout_tm, jiffies + timeout);
-                }
-        }
-}
-
-void ncpdgram_timeout_proc(struct work_struct *work)
-{
-        struct ncp_server *server =
-                container_of(work, struct ncp_server, timeout_tq);
-        mutex_lock(&server->rcv.creq_mutex);
-        __ncpdgram_timeout_proc(server);
-        mutex_unlock(&server->rcv.creq_mutex);
-}
-
-static int do_tcp_rcv(struct ncp_server *server, void *buffer, size_t len)
-{
-        int result;
-        
-        if (buffer) {
-                result = _recv(server->ncp_sock, buffer, len, MSG_DONTWAIT);
-        } else {
-                static unsigned char dummy[1024];
-                        
-                if (len > sizeof(dummy)) {
-                        len = sizeof(dummy);
-                }
-                result = _recv(server->ncp_sock, dummy, len, MSG_DONTWAIT);
-        }
-        if (result < 0) {
-                return result;
-        }
-        if (result > len) {
-                pr_err("tcp: bug in recvmsg (%u > %zu)\n", result, len);
-                return -EIO;                    
-        }
-        return result;
-}       
-
-static int __ncptcp_rcv_proc(struct ncp_server *server)
-{
-        /* We have to check the result, so store the complete header */
-        while (1) {
-                int result;
-                struct ncp_request_reply *req;
-                int datalen;
-                int type;
-
-                while (server->rcv.len) {
-                        result = do_tcp_rcv(server, server->rcv.ptr, server->rcv.len);
-                        if (result == -EAGAIN) {
-                                return 0;
-                        }
-                        if (result <= 0) {
-                                req = server->rcv.creq;
-                                if (req) {
-                                        __ncp_abort_request(server, req, -EIO);
-                                } else {
-                                        __ncptcp_abort(server);
-                                }
-                                if (result < 0) {
-                                        pr_err("tcp: error in recvmsg: %d\n", result);
-                                } else {
-                                        ncp_dbg(1, "tcp: EOF\n");
-                                }
-                                return -EIO;
-                        }
-                        if (server->rcv.ptr) {
-                                server->rcv.ptr += result;
-                        }
-                        server->rcv.len -= result;
-                }
-                switch (server->rcv.state) {
-                        case 0:
-                                if (server->rcv.buf.magic != htonl(NCP_TCP_RCVD_MAGIC)) {
-                                        pr_err("tcp: Unexpected reply type %08X\n", ntohl(server->rcv.buf.magic));
-                                        __ncptcp_abort(server);
-                                        return -EIO;
-                                }
-                                datalen = ntohl(server->rcv.buf.len) & 0x0FFFFFFF;
-                                if (datalen < 10) {
-                                        pr_err("tcp: Unexpected reply len %d\n", datalen);
-                                        __ncptcp_abort(server);
-                                        return -EIO;
-                                }
-#ifdef CONFIG_NCPFS_PACKET_SIGNING                              
-                                if (server->sign_active) {
-                                        if (datalen < 18) {
-                                                pr_err("tcp: Unexpected reply len %d\n", datalen);
-                                                __ncptcp_abort(server);
-                                                return -EIO;
-                                        }
-                                        server->rcv.buf.len = datalen - 8;
-                                        server->rcv.ptr = (unsigned char*)&server->rcv.buf.p1;
-                                        server->rcv.len = 8;
-                                        server->rcv.state = 4;
-                                        break;
-                                }
-#endif                          
-                                type = ntohs(server->rcv.buf.type);
-#ifdef CONFIG_NCPFS_PACKET_SIGNING                              
-cont:;                          
-#endif
-                                if (type != NCP_REPLY) {
-                                        if (datalen - 8 <= sizeof(server->unexpected_packet.data)) {
-                                                *(__u16*)(server->unexpected_packet.data) = htons(type);
-                                                server->unexpected_packet.len = datalen - 8;
-
-                                                server->rcv.state = 5;
-                                                server->rcv.ptr = server->unexpected_packet.data + 2;
-                                                server->rcv.len = datalen - 10;
-                                                break;
-                                        }                                       
-                                        ncp_dbg(1, "tcp: Unexpected NCP type %02X\n", type);
-skipdata2:;
-                                        server->rcv.state = 2;
-skipdata:;
-                                        server->rcv.ptr = NULL;
-                                        server->rcv.len = datalen - 10;
-                                        break;
-                                }
-                                req = server->rcv.creq;
-                                if (!req) {
-                                        ncp_dbg(1, "Reply without appropriate request\n");
-                                        goto skipdata2;
-                                }
-                                if (datalen > req->datalen + 8) {
-                                        pr_err("tcp: Unexpected reply len %d (expected at most %zd)\n", datalen, req->datalen + 8);
-                                        server->rcv.state = 3;
-                                        goto skipdata;
-                                }
-                                req->datalen = datalen - 8;
-                                ((struct ncp_reply_header*)server->rxbuf)->type = NCP_REPLY;
-                                server->rcv.ptr = server->rxbuf + 2;
-                                server->rcv.len = datalen - 10;
-                                server->rcv.state = 1;
-                                break;
-#ifdef CONFIG_NCPFS_PACKET_SIGNING                              
-                        case 4:
-                                datalen = server->rcv.buf.len;
-                                type = ntohs(server->rcv.buf.type2);
-                                goto cont;
-#endif
-                        case 1:
-                                req = server->rcv.creq;
-                                if (req->tx_type != NCP_ALLOC_SLOT_REQUEST) {
-                                        if (((struct ncp_reply_header*)server->rxbuf)->sequence != server->sequence) {
-                                                pr_err("tcp: Bad sequence number\n");
-                                                __ncp_abort_request(server, req, -EIO);
-                                                return -EIO;
-                                        }
-                                        if ((((struct ncp_reply_header*)server->rxbuf)->conn_low | (((struct ncp_reply_header*)server->rxbuf)->conn_high << 8)) != server->connection) {
-                                                pr_err("tcp: Connection number mismatch\n");
-                                                __ncp_abort_request(server, req, -EIO);
-                                                return -EIO;
-                                        }
-                                }
-#ifdef CONFIG_NCPFS_PACKET_SIGNING                              
-                                if (server->sign_active && req->tx_type != NCP_DEALLOC_SLOT_REQUEST) {
-                                        if (sign_verify_reply(server, server->rxbuf + 6, req->datalen - 6, cpu_to_be32(req->datalen + 16), &server->rcv.buf.type)) {
-                                                pr_err("tcp: Signature violation\n");
-                                                __ncp_abort_request(server, req, -EIO);
-                                                return -EIO;
-                                        }
-                                }
-#endif                          
-                                ncp_finish_request(server, req, req->datalen);
-                        nextreq:;
-                                __ncp_next_request(server);
-                        case 2:
-                        next:;
-                                server->rcv.ptr = (unsigned char*)&server->rcv.buf;
-                                server->rcv.len = 10;
-                                server->rcv.state = 0;
-                                break;
-                        case 3:
-                                ncp_finish_request(server, server->rcv.creq, -EIO);
-                                goto nextreq;
-                        case 5:
-                                info_server(server, 0, server->unexpected_packet.data, server->unexpected_packet.len);
-                                goto next;
-                }
-        }
-}
-
-void ncp_tcp_rcv_proc(struct work_struct *work)
-{
-        struct ncp_server *server =
-                container_of(work, struct ncp_server, rcv.tq);
-
-        mutex_lock(&server->rcv.creq_mutex);
-        __ncptcp_rcv_proc(server);
-        mutex_unlock(&server->rcv.creq_mutex);
-}
-
-void ncp_tcp_tx_proc(struct work_struct *work)
-{
-        struct ncp_server *server =
-                container_of(work, struct ncp_server, tx.tq);
-        
-        mutex_lock(&server->rcv.creq_mutex);
-        __ncptcp_try_send(server);
-        mutex_unlock(&server->rcv.creq_mutex);
-}
-
-static int do_ncp_rpc_call(struct ncp_server *server, int size,
-                unsigned char* reply_buf, int max_reply_size)
-{
-        int result;
-        struct ncp_request_reply *req;
-
-        req = ncp_alloc_req();
-        if (!req)
-                return -ENOMEM;
-
-        req->reply_buf = reply_buf;
-        req->datalen = max_reply_size;
-        req->tx_iov[1].iov_base = server->packet;
-        req->tx_iov[1].iov_len = size;
-        req->tx_type = *(u_int16_t*)server->packet;
-
-        result = ncp_add_request(server, req);
-        if (result < 0)
-                goto out;
-
-        if (wait_event_interruptible(req->wq, req->status == RQ_DONE)) {
-                ncp_abort_request(server, req, -EINTR);
-                result = -EINTR;
-                goto out;
-        }
-
-        result = req->result;
-
-out:
-        ncp_req_put(req);
-
-        return result;
-}
-
-/*
- * We need the server to be locked here, so check!
- */
-
-static int ncp_do_request(struct ncp_server *server, int size,
-                void* reply, int max_reply_size)
-{
-        int result;
-
-        if (server->lock == 0) {
-                pr_err("Server not locked!\n");
-                return -EIO;
-        }
-        if (!ncp_conn_valid(server)) {
-                return -EIO;
-        }
-        {
-                sigset_t old_set;
-                unsigned long mask, flags;
-
-                spin_lock_irqsave(&current->sighand->siglock, flags);
-                old_set = current->blocked;
-                if (current->flags & PF_EXITING)
-                        mask = 0;
-                else
-                        mask = sigmask(SIGKILL);
-                if (server->m.flags & NCP_MOUNT_INTR) {
-                        /* FIXME: This doesn't seem right at all.  So, like,
-                           we can't handle SIGINT and get whatever to stop?
-                           What if we've blocked it ourselves?  What about
-                           alarms?  Why, in fact, are we mucking with the
-                           sigmask at all? -- r~ */
-                        if (current->sighand->action[SIGINT - 1].sa.sa_handler == SIG_DFL)
-                                mask |= sigmask(SIGINT);
-                        if (current->sighand->action[SIGQUIT - 1].sa.sa_handler == SIG_DFL)
-                                mask |= sigmask(SIGQUIT);
-                }
-                siginitsetinv(&current->blocked, mask);
-                recalc_sigpending();
-                spin_unlock_irqrestore(&current->sighand->siglock, flags);
-                
-                result = do_ncp_rpc_call(server, size, reply, max_reply_size);
-
-                spin_lock_irqsave(&current->sighand->siglock, flags);
-                current->blocked = old_set;
-                recalc_sigpending();
-                spin_unlock_irqrestore(&current->sighand->siglock, flags);
-        }
-
-        ncp_dbg(2, "do_ncp_rpc_call returned %d\n", result);
-
-        return result;
-}
-
-/* ncp_do_request assures that at least a complete reply header is
- * received. It assumes that server->current_size contains the ncp
- * request size
- */
-int ncp_request2(struct ncp_server *server, int function, 
-                void* rpl, int size)
-{
-        struct ncp_request_header *h;
-        struct ncp_reply_header* reply = rpl;
-        int result;
-
-        h = (struct ncp_request_header *) (server->packet);
-        if (server->has_subfunction != 0) {
-                *(__u16 *) & (h->data[0]) = htons(server->current_size - sizeof(*h) - 2);
-        }
-        h->type = NCP_REQUEST;
-        /*
-         * The server shouldn't know or care what task is making a
-         * request, so we always use the same task number.
-         */
-        h->task = 2; /* (current->pid) & 0xff; */
-        h->function = function;
-
-        result = ncp_do_request(server, server->current_size, reply, size);
-        if (result < 0) {
-                ncp_dbg(1, "ncp_request_error: %d\n", result);
-                goto out;
-        }
-        server->completion = reply->completion_code;
-        server->conn_status = reply->connection_state;
-        server->reply_size = result;
-        server->ncp_reply_size = result - sizeof(struct ncp_reply_header);
-
-        result = reply->completion_code;
-
-        if (result != 0)
-                ncp_vdbg("completion code=%x\n", result);
-out:
-        return result;
-}
-
-int ncp_connect(struct ncp_server *server)
-{
-        struct ncp_request_header *h;
-        int result;
-
-        server->connection = 0xFFFF;
-        server->sequence = 255;
-
-        h = (struct ncp_request_header *) (server->packet);
-        h->type = NCP_ALLOC_SLOT_REQUEST;
-        h->task         = 2; /* see above */
-        h->function     = 0;
-
-        result = ncp_do_request(server, sizeof(*h), server->packet, server->packet_size);
-        if (result < 0)
-                goto out;
-        server->connection = h->conn_low + (h->conn_high * 256);
-        result = 0;
-out:
-        return result;
-}
-
-int ncp_disconnect(struct ncp_server *server)
-{
-        struct ncp_request_header *h;
-
-        h = (struct ncp_request_header *) (server->packet);
-        h->type = NCP_DEALLOC_SLOT_REQUEST;
-        h->task         = 2; /* see above */
-        h->function     = 0;
-
-        return ncp_do_request(server, sizeof(*h), server->packet, server->packet_size);
-}
-
-void ncp_lock_server(struct ncp_server *server)
-{
-        mutex_lock(&server->mutex);
-        if (server->lock)
-                pr_warn("%s: was locked!\n", __func__);
-        server->lock = 1;
-}
-
-void ncp_unlock_server(struct ncp_server *server)
-{
-        if (!server->lock) {
-                pr_warn("%s: was not locked!\n", __func__);
-                return;
-        }
-        server->lock = 0;
-        mutex_unlock(&server->mutex);
-}
diff --git a/fs/ncpfs/symlink.c b/fs/ncpfs/symlink.c
deleted file mode 100644
index b6e16da4837a..000000000000
--- a/fs/ncpfs/symlink.c
+++ /dev/null
@@ -1,182 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- *  linux/fs/ncpfs/symlink.c
- *
- *  Code for allowing symbolic links on NCPFS (i.e. NetWare)
- *  Symbolic links are not supported on native NetWare, so we use an
- *  infrequently-used flag (Sh) and store a two-word magic header in
- *  the file to make sure we don't accidentally use a non-link file
- *  as a link.
- *
- *  When using the NFS namespace, we set the mode to indicate a symlink and
- *  don't bother with the magic numbers.
- *
- *  from linux/fs/ext2/symlink.c
- *
- *  Copyright (C) 1998-99, Frank A. Vorstenbosch
- *
- *  ncpfs symlink handling code
- *  NLS support (c) 1999 Petr Vandrovec
- *  Modified 2000 Ben Harris, University of Cambridge for NFS NS meta-info
- *
- */
-
-
-#include <linux/uaccess.h>
-
-#include <linux/errno.h>
-#include <linux/fs.h>
-#include <linux/time.h>
-#include <linux/slab.h>
-#include <linux/mm.h>
-#include <linux/stat.h>
-#include "ncp_fs.h"
-
-/* these magic numbers must appear in the symlink file -- this makes it a bit
-   more resilient against the magic attributes being set on random files. */
-
-#define NCP_SYMLINK_MAGIC0      cpu_to_le32(0x6c6d7973)     /* "symlnk->" */
-#define NCP_SYMLINK_MAGIC1      cpu_to_le32(0x3e2d6b6e)
-
-/* ----- read a symbolic link ------------------------------------------ */
-
-static int ncp_symlink_readpage(struct file *file, struct page *page)
-{
-        struct inode *inode = page->mapping->host;
-        int error, length, len;
-        char *link, *rawlink;
-        char *buf = kmap(page);
-
-        error = -ENOMEM;
-        rawlink = kmalloc(NCP_MAX_SYMLINK_SIZE, GFP_KERNEL);
-        if (!rawlink)
-                goto fail;
-
-        if (ncp_make_open(inode,O_RDONLY))
-                goto failEIO;
-
-        error=ncp_read_kernel(NCP_SERVER(inode),NCP_FINFO(inode)->file_handle,
-                         0,NCP_MAX_SYMLINK_SIZE,rawlink,&length);
-
-        ncp_inode_close(inode);
-        /* Close file handle if no other users... */
-        ncp_make_closed(inode);
-        if (error)
-                goto failEIO;
-
-        if (NCP_FINFO(inode)->flags & NCPI_KLUDGE_SYMLINK) {
-                if (length<NCP_MIN_SYMLINK_SIZE || 
-                    ((__le32 *)rawlink)[0]!=NCP_SYMLINK_MAGIC0 ||
-                    ((__le32 *)rawlink)[1]!=NCP_SYMLINK_MAGIC1)
-                        goto failEIO;
-                link = rawlink + 8;
-                length -= 8;
-        } else {
-                link = rawlink;
-        }
-
-        len = NCP_MAX_SYMLINK_SIZE;
-        error = ncp_vol2io(NCP_SERVER(inode), buf, &len, link, length, 0);
-        kfree(rawlink);
-        if (error)
-                goto fail;
-        SetPageUptodate(page);
-        kunmap(page);
-        unlock_page(page);
-        return 0;
-
-failEIO:
-        error = -EIO;
-        kfree(rawlink);
-fail:
-        SetPageError(page);
-        kunmap(page);
-        unlock_page(page);
-        return error;
-}
-
-/*
- * symlinks can't do much...
- */
-const struct address_space_operations ncp_symlink_aops = {
-        .readpage       = ncp_symlink_readpage,
-};
-        
-/* ----- create a new symbolic link -------------------------------------- */
- 
-int ncp_symlink(struct inode *dir, struct dentry *dentry, const char *symname) {
-        struct inode *inode;
-        char *rawlink;
-        int length, err, i, outlen;
-        int kludge;
-        umode_t mode;
-        __le32 attr;
-        unsigned int hdr;
-
-        ncp_dbg(1, "dir=%p, dentry=%p, symname=%s\n", dir, dentry, symname);
-
-        if (ncp_is_nfs_extras(NCP_SERVER(dir), NCP_FINFO(dir)->volNumber))
-                kludge = 0;
-        else
-#ifdef CONFIG_NCPFS_EXTRAS
-        if (NCP_SERVER(dir)->m.flags & NCP_MOUNT_SYMLINKS)
-                kludge = 1;
-        else
-#endif
-        /* EPERM is returned by VFS if symlink procedure does not exist */
-                return -EPERM;
-  
-        rawlink = kmalloc(NCP_MAX_SYMLINK_SIZE, GFP_KERNEL);
-        if (!rawlink)
-                return -ENOMEM;
-
-        if (kludge) {
-                mode = 0;
-                attr = aSHARED | aHIDDEN;
-                ((__le32 *)rawlink)[0]=NCP_SYMLINK_MAGIC0;
-                ((__le32 *)rawlink)[1]=NCP_SYMLINK_MAGIC1;
-                hdr = 8;
-        } else {
-                mode = S_IFLNK | S_IRWXUGO;
-                attr = 0;
-                hdr = 0;
-        }                       
-
-        length = strlen(symname);
-        /* map to/from server charset, do not touch upper/lower case as
-           symlink can point out of ncp filesystem */
-        outlen = NCP_MAX_SYMLINK_SIZE - hdr;
-        err = ncp_io2vol(NCP_SERVER(dir), rawlink + hdr, &outlen, symname, length, 0);
-        if (err)
-                goto failfree;
-
-        outlen += hdr;
-
-        err = -EIO;
-        if (ncp_create_new(dir,dentry,mode,0,attr)) {
-                goto failfree;
-        }
-
-        inode=d_inode(dentry);
-
-        if (ncp_make_open(inode, O_WRONLY))
-                goto failfree;
-
-        if (ncp_write_kernel(NCP_SERVER(inode), NCP_FINFO(inode)->file_handle, 
-                             0, outlen, rawlink, &i) || i!=outlen) {
-                goto fail;
-        }
-
-        ncp_inode_close(inode);
-        ncp_make_closed(inode);
-        kfree(rawlink);
-        return 0;
-fail:;
-        ncp_inode_close(inode);
-        ncp_make_closed(inode);
-failfree:;
-        kfree(rawlink);
-        return err;
-}
-
-/* ----- EOF ----- */
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index 626d1382002e..6b3b372b59b9 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -8,7 +8,6 @@
 #include <linux/file.h>
 #include <linux/falloc.h>
 #include <linux/nfs_fs.h>
-#include <uapi/linux/btrfs.h>   /* BTRFS_IOC_CLONE/BTRFS_IOC_CLONE_RANGE */
 #include "delegation.h"
 #include "internal.h"
 #include "iostat.h"
diff --git a/fs/nsfs.c b/fs/nsfs.c
index 7c6f76d29f56..36b0772701a0 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -103,14 +103,14 @@ slow:
         goto got_it;
 }
 
-void *ns_get_path(struct path *path, struct task_struct *task,
-                        const struct proc_ns_operations *ns_ops)
+void *ns_get_path_cb(struct path *path, ns_get_path_helper_t *ns_get_cb,
+                     void *private_data)
 {
         struct ns_common *ns;
         void *ret;
 
 again:
-        ns = ns_ops->get(task);
+        ns = ns_get_cb(private_data);
         if (!ns)
                 return ERR_PTR(-ENOENT);
 
@@ -120,6 +120,29 @@ again:
         return ret;
 }
 
+struct ns_get_path_task_args {
+        const struct proc_ns_operations *ns_ops;
+        struct task_struct *task;
+};
+
+static struct ns_common *ns_get_path_task(void *private_data)
+{
+        struct ns_get_path_task_args *args = private_data;
+
+        return args->ns_ops->get(args->task);
+}
+
+void *ns_get_path(struct path *path, struct task_struct *task,
+                  const struct proc_ns_operations *ns_ops)
+{
+        struct ns_get_path_task_args args = {
+                .ns_ops = ns_ops,
+                .task   = task,
+        };
+
+        return ns_get_path_cb(path, ns_get_path_task, &args);
+}
+
 int open_related_ns(struct ns_common *ns,
                    struct ns_common *(*get_ns)(struct ns_common *ns))
 {
diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
index 40b5cc97f7b0..917fadca8a7b 100644
--- a/fs/ocfs2/acl.c
+++ b/fs/ocfs2/acl.c
@@ -311,7 +311,9 @@ struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type)
         if (had_lock < 0)
                 return ERR_PTR(had_lock);
 
+        down_read(&OCFS2_I(inode)->ip_xattr_sem);
         acl = ocfs2_get_acl_nolock(inode, type, di_bh);
+        up_read(&OCFS2_I(inode)->ip_xattr_sem);
 
         ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock);
         brelse(di_bh);
@@ -330,7 +332,9 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh)
         if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL))
                 return 0;
 
+        down_read(&OCFS2_I(inode)->ip_xattr_sem);
         acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh);
+        up_read(&OCFS2_I(inode)->ip_xattr_sem);
         if (IS_ERR(acl) || !acl)
                 return PTR_ERR(acl);
         ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode);
@@ -361,8 +365,10 @@ int ocfs2_init_acl(handle_t *handle,
 
         if (!S_ISLNK(inode->i_mode)) {
                 if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
+                        down_read(&OCFS2_I(dir)->ip_xattr_sem);
                         acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT,
                                                    dir_bh);
+                        up_read(&OCFS2_I(dir)->ip_xattr_sem);
                         if (IS_ERR(acl))
                                 return PTR_ERR(acl);
                 }
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index ab5105f9767e..9a876bb07cac 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -165,6 +165,13 @@ static int ocfs2_dinode_insert_check(struct ocfs2_extent_tree *et,
                                      struct ocfs2_extent_rec *rec);
 static int ocfs2_dinode_sanity_check(struct ocfs2_extent_tree *et);
 static void ocfs2_dinode_fill_root_el(struct ocfs2_extent_tree *et);
+
+static int ocfs2_reuse_blk_from_dealloc(handle_t *handle,
+                                        struct ocfs2_extent_tree *et,
+                                        struct buffer_head **new_eb_bh,
+                                        int blk_wanted, int *blk_given);
+static int ocfs2_is_dealloc_empty(struct ocfs2_extent_tree *et);
+
 static const struct ocfs2_extent_tree_operations ocfs2_dinode_et_ops = {
         .eo_set_last_eb_blk     = ocfs2_dinode_set_last_eb_blk,
         .eo_get_last_eb_blk     = ocfs2_dinode_get_last_eb_blk,
@@ -448,6 +455,7 @@ static void __ocfs2_init_extent_tree(struct ocfs2_extent_tree *et,
         if (!obj)
                 obj = (void *)bh->b_data;
         et->et_object = obj;
+        et->et_dealloc = NULL;
 
         et->et_ops->eo_fill_root_el(et);
         if (!et->et_ops->eo_fill_max_leaf_clusters)
@@ -1158,7 +1166,7 @@ static int ocfs2_add_branch(handle_t *handle,
                             struct buffer_head **last_eb_bh,
                             struct ocfs2_alloc_context *meta_ac)
 {
-        int status, new_blocks, i;
+        int status, new_blocks, i, block_given = 0;
         u64 next_blkno, new_last_eb_blk;
         struct buffer_head *bh;
         struct buffer_head **new_eb_bhs = NULL;
@@ -1213,11 +1221,31 @@ static int ocfs2_add_branch(handle_t *handle,
                 goto bail;
         }
 
-        status = ocfs2_create_new_meta_bhs(handle, et, new_blocks,
-                                           meta_ac, new_eb_bhs);
-        if (status < 0) {
-                mlog_errno(status);
-                goto bail;
+        /* Firstyly, try to reuse dealloc since we have already estimated how
+         * many extent blocks we may use.
+         */
+        if (!ocfs2_is_dealloc_empty(et)) {
+                status = ocfs2_reuse_blk_from_dealloc(handle, et,
+                                                      new_eb_bhs, new_blocks,
+                                                      &block_given);
+                if (status < 0) {
+                        mlog_errno(status);
+                        goto bail;
+                }
+        }
+
+        BUG_ON(block_given > new_blocks);
+
+        if (block_given < new_blocks) {
+                BUG_ON(!meta_ac);
+                status = ocfs2_create_new_meta_bhs(handle, et,
+                                                   new_blocks - block_given,
+                                                   meta_ac,
+                                                   &new_eb_bhs[block_given]);
+                if (status < 0) {
+                        mlog_errno(status);
+                        goto bail;
+                }
         }
 
         /* Note: new_eb_bhs[new_blocks - 1] is the guy which will be
@@ -1340,15 +1368,25 @@ static int ocfs2_shift_tree_depth(handle_t *handle,
                                   struct ocfs2_alloc_context *meta_ac,
                                   struct buffer_head **ret_new_eb_bh)
 {
-        int status, i;
+        int status, i, block_given = 0;
         u32 new_clusters;
         struct buffer_head *new_eb_bh = NULL;
         struct ocfs2_extent_block *eb;
         struct ocfs2_extent_list  *root_el;
         struct ocfs2_extent_list  *eb_el;
 
-        status = ocfs2_create_new_meta_bhs(handle, et, 1, meta_ac,
-                                           &new_eb_bh);
+        if (!ocfs2_is_dealloc_empty(et)) {
+                status = ocfs2_reuse_blk_from_dealloc(handle, et,
+                                                      &new_eb_bh, 1,
+                                                      &block_given);
+        } else if (meta_ac) {
+                status = ocfs2_create_new_meta_bhs(handle, et, 1, meta_ac,
+                                                   &new_eb_bh);
+
+        } else {
+                BUG();
+        }
+
         if (status < 0) {
                 mlog_errno(status);
                 goto bail;
@@ -1511,7 +1549,7 @@ static int ocfs2_grow_tree(handle_t *handle, struct ocfs2_extent_tree *et,
         int depth = le16_to_cpu(el->l_tree_depth);
         struct buffer_head *bh = NULL;
 
-        BUG_ON(meta_ac == NULL);
+        BUG_ON(meta_ac == NULL && ocfs2_is_dealloc_empty(et));
 
         shift = ocfs2_find_branch_target(et, &bh);
         if (shift < 0) {
@@ -2598,11 +2636,8 @@ static void ocfs2_unlink_subtree(handle_t *handle,
         int i;
         struct buffer_head *root_bh = left_path->p_node[subtree_index].bh;
         struct ocfs2_extent_list *root_el = left_path->p_node[subtree_index].el;
-        struct ocfs2_extent_list *el;
         struct ocfs2_extent_block *eb;
 
-        el = path_leaf_el(left_path);
-
         eb = (struct ocfs2_extent_block *)right_path->p_node[subtree_index + 1].bh->b_data;
 
         for(i = 1; i < le16_to_cpu(root_el->l_next_free_rec); i++)
@@ -3938,7 +3973,7 @@ static void ocfs2_adjust_rightmost_records(handle_t *handle,
                                            struct ocfs2_path *path,
                                            struct ocfs2_extent_rec *insert_rec)
 {
-        int ret, i, next_free;
+        int i, next_free;
         struct buffer_head *bh;
         struct ocfs2_extent_list *el;
         struct ocfs2_extent_rec *rec;
@@ -3955,7 +3990,6 @@ static void ocfs2_adjust_rightmost_records(handle_t *handle,
                         ocfs2_error(ocfs2_metadata_cache_get_super(et->et_ci),
                                     "Owner %llu has a bad extent list\n",
                                     (unsigned long long)ocfs2_metadata_cache_owner(et->et_ci));
-                        ret = -EIO;
                         return;
                 }
 
@@ -5057,7 +5091,6 @@ int ocfs2_split_extent(handle_t *handle,
         struct buffer_head *last_eb_bh = NULL;
         struct ocfs2_extent_rec *rec = &el->l_recs[split_index];
         struct ocfs2_merge_ctxt ctxt;
-        struct ocfs2_extent_list *rightmost_el;
 
         if (le32_to_cpu(rec->e_cpos) > le32_to_cpu(split_rec->e_cpos) ||
             ((le32_to_cpu(rec->e_cpos) + le16_to_cpu(rec->e_leaf_clusters)) <
@@ -5093,9 +5126,7 @@ int ocfs2_split_extent(handle_t *handle,
                 }
 
                 eb = (struct ocfs2_extent_block *) last_eb_bh->b_data;
-                rightmost_el = &eb->h_list;
-        } else
-                rightmost_el = path_root_el(path);
+        }
 
         if (rec->e_cpos == split_rec->e_cpos &&
             rec->e_leaf_clusters == split_rec->e_leaf_clusters)
@@ -6585,6 +6616,154 @@ ocfs2_find_per_slot_free_list(int type,
         return fl;
 }
 
+static struct ocfs2_per_slot_free_list *
+ocfs2_find_preferred_free_list(int type,
+                               int preferred_slot,
+                               int *real_slot,
+                               struct ocfs2_cached_dealloc_ctxt *ctxt)
+{
+        struct ocfs2_per_slot_free_list *fl = ctxt->c_first_suballocator;
+
+        while (fl) {
+                if (fl->f_inode_type == type && fl->f_slot == preferred_slot) {
+                        *real_slot = fl->f_slot;
+                        return fl;
+                }
+
+                fl = fl->f_next_suballocator;
+        }
+
+        /* If we can't find any free list matching preferred slot, just use
+         * the first one.
+         */
+        fl = ctxt->c_first_suballocator;
+        *real_slot = fl->f_slot;
+
+        return fl;
+}
+
+/* Return Value 1 indicates empty */
+static int ocfs2_is_dealloc_empty(struct ocfs2_extent_tree *et)
+{
+        struct ocfs2_per_slot_free_list *fl = NULL;
+
+        if (!et->et_dealloc)
+                return 1;
+
+        fl = et->et_dealloc->c_first_suballocator;
+        if (!fl)
+                return 1;
+
+        if (!fl->f_first)
+                return 1;
+
+        return 0;
+}
+
+/* If extent was deleted from tree due to extent rotation and merging, and
+ * no metadata is reserved ahead of time. Try to reuse some extents
+ * just deleted. This is only used to reuse extent blocks.
+ * It is supposed to find enough extent blocks in dealloc if our estimation
+ * on metadata is accurate.
+ */
+static int ocfs2_reuse_blk_from_dealloc(handle_t *handle,
+                                        struct ocfs2_extent_tree *et,
+                                        struct buffer_head **new_eb_bh,
+                                        int blk_wanted, int *blk_given)
+{
+        int i, status = 0, real_slot;
+        struct ocfs2_cached_dealloc_ctxt *dealloc;
+        struct ocfs2_per_slot_free_list *fl;
+        struct ocfs2_cached_block_free *bf;
+        struct ocfs2_extent_block *eb;
+        struct ocfs2_super *osb =
+                OCFS2_SB(ocfs2_metadata_cache_get_super(et->et_ci));
+
+        *blk_given = 0;
+
+        /* If extent tree doesn't have a dealloc, this is not faulty. Just
+         * tell upper caller dealloc can't provide any block and it should
+         * ask for alloc to claim more space.
+         */
+        dealloc = et->et_dealloc;
+        if (!dealloc)
+                goto bail;
+
+        for (i = 0; i < blk_wanted; i++) {
+                /* Prefer to use local slot */
+                fl = ocfs2_find_preferred_free_list(EXTENT_ALLOC_SYSTEM_INODE,
+                                                    osb->slot_num, &real_slot,
+                                                    dealloc);
+                /* If no more block can be reused, we should claim more
+                 * from alloc. Just return here normally.
+                 */
+                if (!fl) {
+                        status = 0;
+                        break;
+                }
+
+                bf = fl->f_first;
+                fl->f_first = bf->free_next;
+
+                new_eb_bh[i] = sb_getblk(osb->sb, bf->free_blk);
+                if (new_eb_bh[i] == NULL) {
+                        status = -ENOMEM;
+                        mlog_errno(status);
+                        goto bail;
+                }
+
+                mlog(0, "Reusing block(%llu) from "
+                     "dealloc(local slot:%d, real slot:%d)\n",
+                     bf->free_blk, osb->slot_num, real_slot);
+
+                ocfs2_set_new_buffer_uptodate(et->et_ci, new_eb_bh[i]);
+
+                status = ocfs2_journal_access_eb(handle, et->et_ci,
+                                                 new_eb_bh[i],
+                                                 OCFS2_JOURNAL_ACCESS_CREATE);
+                if (status < 0) {
+                        mlog_errno(status);
+                        goto bail;
+                }
+
+                memset(new_eb_bh[i]->b_data, 0, osb->sb->s_blocksize);
+                eb = (struct ocfs2_extent_block *) new_eb_bh[i]->b_data;
+
+                /* We can't guarantee that buffer head is still cached, so
+                 * polutlate the extent block again.
+                 */
+                strcpy(eb->h_signature, OCFS2_EXTENT_BLOCK_SIGNATURE);
+                eb->h_blkno = cpu_to_le64(bf->free_blk);
+                eb->h_fs_generation = cpu_to_le32(osb->fs_generation);
+                eb->h_suballoc_slot = cpu_to_le16(real_slot);
+                eb->h_suballoc_loc = cpu_to_le64(bf->free_bg);
+                eb->h_suballoc_bit = cpu_to_le16(bf->free_bit);
+                eb->h_list.l_count =
+                        cpu_to_le16(ocfs2_extent_recs_per_eb(osb->sb));
+
+                /* We'll also be dirtied by the caller, so
+                 * this isn't absolutely necessary.
+                 */
+                ocfs2_journal_dirty(handle, new_eb_bh[i]);
+
+                if (!fl->f_first) {
+                        dealloc->c_first_suballocator = fl->f_next_suballocator;
+                        kfree(fl);
+                }
+                kfree(bf);
+        }
+
+        *blk_given = i;
+
+bail:
+        if (unlikely(status < 0)) {
+                for (i = 0; i < blk_wanted; i++)
+                        brelse(new_eb_bh[i]);
+        }
+
+        return status;
+}
+
 int ocfs2_cache_block_dealloc(struct ocfs2_cached_dealloc_ctxt *ctxt,
                               int type, int slot, u64 suballoc,
                               u64 blkno, unsigned int bit)
@@ -7382,6 +7561,7 @@ int ocfs2_trim_fs(struct super_block *sb, struct fstrim_range *range)
         struct buffer_head *gd_bh = NULL;
         struct ocfs2_dinode *main_bm;
         struct ocfs2_group_desc *gd = NULL;
+        struct ocfs2_trim_fs_info info, *pinfo = NULL;
 
         start = range->start >> osb->s_clustersize_bits;
         len = range->len >> osb->s_clustersize_bits;
@@ -7419,6 +7599,42 @@ int ocfs2_trim_fs(struct super_block *sb, struct fstrim_range *range)
 
         trace_ocfs2_trim_fs(start, len, minlen);
 
+        ocfs2_trim_fs_lock_res_init(osb);
+        ret = ocfs2_trim_fs_lock(osb, NULL, 1);
+        if (ret < 0) {
+                if (ret != -EAGAIN) {
+                        mlog_errno(ret);
+                        ocfs2_trim_fs_lock_res_uninit(osb);
+                        goto out_unlock;
+                }
+
+                mlog(ML_NOTICE, "Wait for trim on device (%s) to "
+                     "finish, which is running from another node.\n",
+                     osb->dev_str);
+                ret = ocfs2_trim_fs_lock(osb, &info, 0);
+                if (ret < 0) {
+                        mlog_errno(ret);
+                        ocfs2_trim_fs_lock_res_uninit(osb);
+                        goto out_unlock;
+                }
+
+                if (info.tf_valid && info.tf_success &&
+                    info.tf_start == start && info.tf_len == len &&
+                    info.tf_minlen == minlen) {
+                        /* Avoid sending duplicated trim to a shared device */
+                        mlog(ML_NOTICE, "The same trim on device (%s) was "
+                             "just done from node (%u), return.\n",
+                             osb->dev_str, info.tf_nodenum);
+                        range->len = info.tf_trimlen;
+                        goto out_trimunlock;
+                }
+        }
+
+        info.tf_nodenum = osb->node_num;
+        info.tf_start = start;
+        info.tf_len = len;
+        info.tf_minlen = minlen;
+
         /* Determine first and last group to examine based on start and len */
         first_group = ocfs2_which_cluster_group(main_bm_inode, start);
         if (first_group == osb->first_cluster_group_blkno)
@@ -7463,6 +7679,13 @@ int ocfs2_trim_fs(struct super_block *sb, struct fstrim_range *range)
                         group += ocfs2_clusters_to_blocks(sb, osb->bitmap_cpg);
         }
         range->len = trimmed * sb->s_blocksize;
+
+        info.tf_trimlen = range->len;
+        info.tf_success = (ret ? 0 : 1);
+        pinfo = &info;
+out_trimunlock:
+        ocfs2_trim_fs_unlock(osb, pinfo);
+        ocfs2_trim_fs_lock_res_uninit(osb);
 out_unlock:
         ocfs2_inode_unlock(main_bm_inode, 0);
         brelse(main_bm_bh);
diff --git a/fs/ocfs2/alloc.h b/fs/ocfs2/alloc.h
index 27b75cf32cfa..250bcacdf9e9 100644
--- a/fs/ocfs2/alloc.h
+++ b/fs/ocfs2/alloc.h
@@ -61,6 +61,7 @@ struct ocfs2_extent_tree {
         ocfs2_journal_access_func               et_root_journal_access;
         void                                    *et_object;
         unsigned int                            et_max_leaf_clusters;
+        struct ocfs2_cached_dealloc_ctxt        *et_dealloc;
 };
 
 /*
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index d1516327b787..e8e205bf2e41 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -797,6 +797,7 @@ struct ocfs2_write_ctxt {
         struct ocfs2_cached_dealloc_ctxt w_dealloc;
 
         struct list_head                w_unwritten_list;
+        unsigned int                    w_unwritten_count;
 };
 
 void ocfs2_unlock_and_free_pages(struct page **pages, int num_pages)
@@ -1386,6 +1387,7 @@ retry:
         desc->c_clear_unwritten = 0;
         list_add_tail(&new->ue_ip_node, &oi->ip_unwritten_list);
         list_add_tail(&new->ue_node, &wc->w_unwritten_list);
+        wc->w_unwritten_count++;
         new = NULL;
 unlock:
         spin_unlock(&oi->ip_lock);
@@ -2256,7 +2258,7 @@ static int ocfs2_dio_wr_get_block(struct inode *inode, sector_t iblock,
                 ue->ue_phys = desc->c_phys;
 
                 list_splice_tail_init(&wc->w_unwritten_list, &dwc->dw_zero_list);
-                dwc->dw_zero_count++;
+                dwc->dw_zero_count += wc->w_unwritten_count;
         }
 
         ret = ocfs2_write_end_nolock(inode->i_mapping, pos, len, len, wc);
@@ -2330,6 +2332,12 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
 
         ocfs2_init_dinode_extent_tree(&et, INODE_CACHE(inode), di_bh);
 
+        /* Attach dealloc with extent tree in case that we may reuse extents
+         * which are already unlinked from current extent tree due to extent
+         * rotation and merging.
+         */
+        et.et_dealloc = &dealloc;
+
         ret = ocfs2_lock_allocators(inode, &et, 0, dwc->dw_zero_count*2,
                                     &data_ac, &meta_ac);
         if (ret) {
diff --git a/fs/ocfs2/cluster/quorum.c b/fs/ocfs2/cluster/quorum.c
index 62e8ec619b4c..af2e7473956e 100644
--- a/fs/ocfs2/cluster/quorum.c
+++ b/fs/ocfs2/cluster/quorum.c
@@ -314,12 +314,13 @@ void o2quo_conn_err(u8 node)
                                 node, qs->qs_connected);
 
                 clear_bit(node, qs->qs_conn_bm);
+
+                if (test_bit(node, qs->qs_hb_bm))
+                        o2quo_set_hold(qs, node);
         }
 
         mlog(0, "node %u, %d total\n", node, qs->qs_connected);
 
-        if (test_bit(node, qs->qs_hb_bm))
-                o2quo_set_hold(qs, node);
 
         spin_unlock(&qs->qs_lock);
 }
diff --git a/fs/ocfs2/cluster/tcp_internal.h b/fs/ocfs2/cluster/tcp_internal.h
index b95e7df5b76a..0276f7f8d5e6 100644
--- a/fs/ocfs2/cluster/tcp_internal.h
+++ b/fs/ocfs2/cluster/tcp_internal.h
@@ -196,7 +196,7 @@ struct o2net_msg_handler {
         u32                     nh_msg_type;
         u32                     nh_key;
         o2net_msg_handler_func  *nh_func;
-        o2net_msg_handler_func  *nh_func_data;
+        void                    *nh_func_data;
         o2net_post_msg_handler_func
                                 *nh_post_func;
         struct kref             nh_kref;
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index 32f9c72dff17..b7520e20a770 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -1958,7 +1958,7 @@ int ocfs2_readdir(struct file *file, struct dir_context *ctx)
 
         trace_ocfs2_readdir((unsigned long long)OCFS2_I(inode)->ip_blkno);
 
-        error = ocfs2_inode_lock_atime(inode, file->f_path.mnt, &lock_level);
+        error = ocfs2_inode_lock_atime(inode, file->f_path.mnt, &lock_level, 1);
         if (lock_level && error >= 0) {
                 /* We release EX lock which used to update atime
                  * and get PR lock again to reduce contention
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 9c3e0f13ca87..a7df226f9449 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -1122,13 +1122,6 @@ recheck:
         /* sleep if we haven't finished voting yet */
         if (sleep) {
                 unsigned long timeo = msecs_to_jiffies(DLM_MASTERY_TIMEOUT_MS);
-
-                /*
-                if (kref_read(&mle->mle_refs) < 2)
-                        mlog(ML_ERROR, "mle (%p) refs=%d, name=%.*s\n", mle,
-                        kref_read(&mle->mle_refs),
-                        res->lockname.len, res->lockname.name);
-                */
                 atomic_set(&mle->woken, 0);
                 (void)wait_event_timeout(mle->wq,
                                          (atomic_read(&mle->woken) == 1),
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 4689940a953c..9479f99c2145 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -259,6 +259,10 @@ static struct ocfs2_lock_res_ops ocfs2_nfs_sync_lops = {
         .flags          = 0,
 };
 
+static struct ocfs2_lock_res_ops ocfs2_trim_fs_lops = {
+        .flags          = LOCK_TYPE_REQUIRES_REFRESH|LOCK_TYPE_USES_LVB,
+};
+
 static struct ocfs2_lock_res_ops ocfs2_orphan_scan_lops = {
         .flags          = LOCK_TYPE_REQUIRES_REFRESH|LOCK_TYPE_USES_LVB,
 };
@@ -676,6 +680,24 @@ static void ocfs2_nfs_sync_lock_res_init(struct ocfs2_lock_res *res,
                                    &ocfs2_nfs_sync_lops, osb);
 }
 
+void ocfs2_trim_fs_lock_res_init(struct ocfs2_super *osb)
+{
+        struct ocfs2_lock_res *lockres = &osb->osb_trim_fs_lockres;
+
+        ocfs2_lock_res_init_once(lockres);
+        ocfs2_build_lock_name(OCFS2_LOCK_TYPE_TRIM_FS, 0, 0, lockres->l_name);
+        ocfs2_lock_res_init_common(osb, lockres, OCFS2_LOCK_TYPE_TRIM_FS,
+                                   &ocfs2_trim_fs_lops, osb);
+}
+
+void ocfs2_trim_fs_lock_res_uninit(struct ocfs2_super *osb)
+{
+        struct ocfs2_lock_res *lockres = &osb->osb_trim_fs_lockres;
+
+        ocfs2_simple_drop_lockres(osb, lockres);
+        ocfs2_lock_res_free(lockres);
+}
+
 static void ocfs2_orphan_scan_lock_res_init(struct ocfs2_lock_res *res,
                                             struct ocfs2_super *osb)
 {
@@ -1742,6 +1764,27 @@ int ocfs2_rw_lock(struct inode *inode, int write)
         return status;
 }
 
+int ocfs2_try_rw_lock(struct inode *inode, int write)
+{
+        int status, level;
+        struct ocfs2_lock_res *lockres;
+        struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+
+        mlog(0, "inode %llu try to take %s RW lock\n",
+             (unsigned long long)OCFS2_I(inode)->ip_blkno,
+             write ? "EXMODE" : "PRMODE");
+
+        if (ocfs2_mount_local(osb))
+                return 0;
+
+        lockres = &OCFS2_I(inode)->ip_rw_lockres;
+
+        level = write ? DLM_LOCK_EX : DLM_LOCK_PR;
+
+        status = ocfs2_cluster_lock(osb, lockres, level, DLM_LKF_NOQUEUE, 0);
+        return status;
+}
+
 void ocfs2_rw_unlock(struct inode *inode, int write)
 {
         int level = write ? DLM_LOCK_EX : DLM_LOCK_PR;
@@ -2486,6 +2529,15 @@ int ocfs2_inode_lock_with_page(struct inode *inode,
         ret = ocfs2_inode_lock_full(inode, ret_bh, ex, OCFS2_LOCK_NONBLOCK);
         if (ret == -EAGAIN) {
                 unlock_page(page);
+                /*
+                 * If we can't get inode lock immediately, we should not return
+                 * directly here, since this will lead to a softlockup problem.
+                 * The method is to get a blocking lock and immediately unlock
+                 * before returning, this can avoid CPU resource waste due to
+                 * lots of retries, and benefits fairness in getting lock.
+                 */
+                if (ocfs2_inode_lock(inode, ret_bh, ex) == 0)
+                        ocfs2_inode_unlock(inode, ex);
                 ret = AOP_TRUNCATED_PAGE;
         }
 
@@ -2494,13 +2546,18 @@ int ocfs2_inode_lock_with_page(struct inode *inode,
 
 int ocfs2_inode_lock_atime(struct inode *inode,
                           struct vfsmount *vfsmnt,
-                          int *level)
+                          int *level, int wait)
 {
         int ret;
 
-        ret = ocfs2_inode_lock(inode, NULL, 0);
+        if (wait)
+                ret = ocfs2_inode_lock(inode, NULL, 0);
+        else
+                ret = ocfs2_try_inode_lock(inode, NULL, 0);
+
         if (ret < 0) {
-                mlog_errno(ret);
+                if (ret != -EAGAIN)
+                        mlog_errno(ret);
                 return ret;
         }
 
@@ -2512,9 +2569,14 @@ int ocfs2_inode_lock_atime(struct inode *inode,
                 struct buffer_head *bh = NULL;
 
                 ocfs2_inode_unlock(inode, 0);
-                ret = ocfs2_inode_lock(inode, &bh, 1);
+                if (wait)
+                        ret = ocfs2_inode_lock(inode, &bh, 1);
+                else
+                        ret = ocfs2_try_inode_lock(inode, &bh, 1);
+
                 if (ret < 0) {
-                        mlog_errno(ret);
+                        if (ret != -EAGAIN)
+                                mlog_errno(ret);
                         return ret;
                 }
                 *level = 1;
@@ -2745,6 +2807,70 @@ void ocfs2_nfs_sync_unlock(struct ocfs2_super *osb, int ex)
                                      ex ? LKM_EXMODE : LKM_PRMODE);
 }
 
+int ocfs2_trim_fs_lock(struct ocfs2_super *osb,
+                       struct ocfs2_trim_fs_info *info, int trylock)
+{
+        int status;
+        struct ocfs2_trim_fs_lvb *lvb;
+        struct ocfs2_lock_res *lockres = &osb->osb_trim_fs_lockres;
+
+        if (info)
+                info->tf_valid = 0;
+
+        if (ocfs2_is_hard_readonly(osb))
+                return -EROFS;
+
+        if (ocfs2_mount_local(osb))
+                return 0;
+
+        status = ocfs2_cluster_lock(osb, lockres, DLM_LOCK_EX,
+                                    trylock ? DLM_LKF_NOQUEUE : 0, 0);
+        if (status < 0) {
+                if (status != -EAGAIN)
+                        mlog_errno(status);
+                return status;
+        }
+
+        if (info) {
+                lvb = ocfs2_dlm_lvb(&lockres->l_lksb);
+                if (ocfs2_dlm_lvb_valid(&lockres->l_lksb) &&
+                    lvb->lvb_version == OCFS2_TRIMFS_LVB_VERSION) {
+                        info->tf_valid = 1;
+                        info->tf_success = lvb->lvb_success;
+                        info->tf_nodenum = be32_to_cpu(lvb->lvb_nodenum);
+                        info->tf_start = be64_to_cpu(lvb->lvb_start);
+                        info->tf_len = be64_to_cpu(lvb->lvb_len);
+                        info->tf_minlen = be64_to_cpu(lvb->lvb_minlen);
+                        info->tf_trimlen = be64_to_cpu(lvb->lvb_trimlen);
+                }
+        }
+
+        return status;
+}
+
+void ocfs2_trim_fs_unlock(struct ocfs2_super *osb,
+                          struct ocfs2_trim_fs_info *info)
+{
+        struct ocfs2_trim_fs_lvb *lvb;
+        struct ocfs2_lock_res *lockres = &osb->osb_trim_fs_lockres;
+
+        if (ocfs2_mount_local(osb))
+                return;
+
+        if (info) {
+                lvb = ocfs2_dlm_lvb(&lockres->l_lksb);
+                lvb->lvb_version = OCFS2_TRIMFS_LVB_VERSION;
+                lvb->lvb_success = info->tf_success;
+                lvb->lvb_nodenum = cpu_to_be32(info->tf_nodenum);
+                lvb->lvb_start = cpu_to_be64(info->tf_start);
+                lvb->lvb_len = cpu_to_be64(info->tf_len);
+                lvb->lvb_minlen = cpu_to_be64(info->tf_minlen);
+                lvb->lvb_trimlen = cpu_to_be64(info->tf_trimlen);
+        }
+
+        ocfs2_cluster_unlock(osb, lockres, DLM_LOCK_EX);
+}
+
 int ocfs2_dentry_lock(struct dentry *dentry, int ex)
 {
         int ret;
diff --git a/fs/ocfs2/dlmglue.h b/fs/ocfs2/dlmglue.h
index a7fc18ba0dc1..256e0a9067b8 100644
--- a/fs/ocfs2/dlmglue.h
+++ b/fs/ocfs2/dlmglue.h
@@ -70,6 +70,29 @@ struct ocfs2_orphan_scan_lvb {
         __be32  lvb_os_seqno;
 };
 
+#define OCFS2_TRIMFS_LVB_VERSION 1
+
+struct ocfs2_trim_fs_lvb {
+        __u8    lvb_version;
+        __u8    lvb_success;
+        __u8    lvb_reserved[2];
+        __be32  lvb_nodenum;
+        __be64  lvb_start;
+        __be64  lvb_len;
+        __be64  lvb_minlen;
+        __be64  lvb_trimlen;
+};
+
+struct ocfs2_trim_fs_info {
+        u8      tf_valid;       /* lvb is valid, or not */
+        u8      tf_success;     /* trim is successful, or not */
+        u32     tf_nodenum;     /* osb node number */
+        u64     tf_start;       /* trim start offset in clusters */
+        u64     tf_len;         /* trim end offset in clusters */
+        u64     tf_minlen;      /* trim minimum contiguous free clusters */
+        u64     tf_trimlen;     /* trimmed length in bytes */
+};
+
 struct ocfs2_lock_holder {
         struct list_head oh_list;
         struct pid *oh_owner_pid;
@@ -116,13 +139,14 @@ void ocfs2_lock_res_free(struct ocfs2_lock_res *res);
 int ocfs2_create_new_inode_locks(struct inode *inode);
 int ocfs2_drop_inode_locks(struct inode *inode);
 int ocfs2_rw_lock(struct inode *inode, int write);
+int ocfs2_try_rw_lock(struct inode *inode, int write);
 void ocfs2_rw_unlock(struct inode *inode, int write);
 int ocfs2_open_lock(struct inode *inode);
 int ocfs2_try_open_lock(struct inode *inode, int write);
 void ocfs2_open_unlock(struct inode *inode);
 int ocfs2_inode_lock_atime(struct inode *inode,
                           struct vfsmount *vfsmnt,
-                          int *level);
+                          int *level, int wait);
 int ocfs2_inode_lock_full_nested(struct inode *inode,
                          struct buffer_head **ret_bh,
                          int ex,
@@ -140,6 +164,9 @@ int ocfs2_inode_lock_with_page(struct inode *inode,
 /* 99% of the time we don't want to supply any additional flags --
  * those are for very specific cases only. */
 #define ocfs2_inode_lock(i, b, e) ocfs2_inode_lock_full_nested(i, b, e, 0, OI_LS_NORMAL)
+#define ocfs2_try_inode_lock(i, b, e)\
+                ocfs2_inode_lock_full_nested(i, b, e, OCFS2_META_LOCK_NOQUEUE,\
+                OI_LS_NORMAL)
 void ocfs2_inode_unlock(struct inode *inode,
                        int ex);
 int ocfs2_super_lock(struct ocfs2_super *osb,
@@ -153,6 +180,12 @@ int ocfs2_rename_lock(struct ocfs2_super *osb);
 void ocfs2_rename_unlock(struct ocfs2_super *osb);
 int ocfs2_nfs_sync_lock(struct ocfs2_super *osb, int ex);
 void ocfs2_nfs_sync_unlock(struct ocfs2_super *osb, int ex);
+void ocfs2_trim_fs_lock_res_init(struct ocfs2_super *osb);
+void ocfs2_trim_fs_lock_res_uninit(struct ocfs2_super *osb);
+int ocfs2_trim_fs_lock(struct ocfs2_super *osb,
+                       struct ocfs2_trim_fs_info *info, int trylock);
+void ocfs2_trim_fs_unlock(struct ocfs2_super *osb,
+                          struct ocfs2_trim_fs_info *info);
 int ocfs2_dentry_lock(struct dentry *dentry, int ex);
 void ocfs2_dentry_unlock(struct dentry *dentry, int ex);
 int ocfs2_file_lock(struct file *file, int ex, int trylock);
diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
index e4719e0a3f99..06cb96462bf9 100644
--- a/fs/ocfs2/extent_map.c
+++ b/fs/ocfs2/extent_map.c
@@ -38,6 +38,7 @@
 #include "inode.h"
 #include "super.h"
 #include "symlink.h"
+#include "aops.h"
 #include "ocfs2_trace.h"
 
 #include "buffer_head_io.h"
@@ -832,6 +833,50 @@ out:
         return ret;
 }
 
+/* Is IO overwriting allocated blocks? */
+int ocfs2_overwrite_io(struct inode *inode, struct buffer_head *di_bh,
+                       u64 map_start, u64 map_len)
+{
+        int ret = 0, is_last;
+        u32 mapping_end, cpos;
+        struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+        struct ocfs2_extent_rec rec;
+
+        if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+                if (ocfs2_size_fits_inline_data(di_bh, map_start + map_len))
+                        return ret;
+                else
+                        return -EAGAIN;
+        }
+
+        cpos = map_start >> osb->s_clustersize_bits;
+        mapping_end = ocfs2_clusters_for_bytes(inode->i_sb,
+                                               map_start + map_len);
+        is_last = 0;
+        while (cpos < mapping_end && !is_last) {
+                ret = ocfs2_get_clusters_nocache(inode, di_bh, cpos,
+                                                 NULL, &rec, &is_last);
+                if (ret) {
+                        mlog_errno(ret);
+                        goto out;
+                }
+
+                if (rec.e_blkno == 0ULL)
+                        break;
+
+                if (rec.e_flags & OCFS2_EXT_REFCOUNTED)
+                        break;
+
+                cpos = le32_to_cpu(rec.e_cpos) +
+                        le16_to_cpu(rec.e_leaf_clusters);
+        }
+
+        if (cpos < mapping_end)
+                ret = -EAGAIN;
+out:
+        return ret;
+}
+
 int ocfs2_seek_data_hole_offset(struct file *file, loff_t *offset, int whence)
 {
         struct inode *inode = file->f_mapping->host;
diff --git a/fs/ocfs2/extent_map.h b/fs/ocfs2/extent_map.h
index 67ea57d2fd59..1057586ec19f 100644
--- a/fs/ocfs2/extent_map.h
+++ b/fs/ocfs2/extent_map.h
@@ -53,6 +53,9 @@ int ocfs2_extent_map_get_blocks(struct inode *inode, u64 v_blkno, u64 *p_blkno,
 int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                  u64 map_start, u64 map_len);
 
+int ocfs2_overwrite_io(struct inode *inode, struct buffer_head *di_bh,
+                       u64 map_start, u64 map_len);
+
 int ocfs2_seek_data_hole_offset(struct file *file, loff_t *offset, int origin);
 
 int ocfs2_xattr_get_clusters(struct inode *inode, u32 v_cluster,
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index a1d051055472..5d1784a365a3 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -140,6 +140,8 @@ static int ocfs2_file_open(struct inode *inode, struct file *file)
                 spin_unlock(&oi->ip_lock);
         }
 
+        file->f_mode |= FMODE_NOWAIT;
+
 leave:
         return status;
 }
@@ -2132,12 +2134,12 @@ out:
 }
 
 static int ocfs2_prepare_inode_for_write(struct file *file,
-                                         loff_t pos,
-                                         size_t count)
+                                         loff_t pos, size_t count, int wait)
 {
-        int ret = 0, meta_level = 0;
+        int ret = 0, meta_level = 0, overwrite_io = 0;
         struct dentry *dentry = file->f_path.dentry;
         struct inode *inode = d_inode(dentry);
+        struct buffer_head *di_bh = NULL;
         loff_t end;
 
         /*
@@ -2145,13 +2147,40 @@ static int ocfs2_prepare_inode_for_write(struct file *file,
          * if we need to make modifications here.
          */
         for(;;) {
-                ret = ocfs2_inode_lock(inode, NULL, meta_level);
+                if (wait)
+                        ret = ocfs2_inode_lock(inode, NULL, meta_level);
+                else
+                        ret = ocfs2_try_inode_lock(inode,
+                                overwrite_io ? NULL : &di_bh, meta_level);
                 if (ret < 0) {
                         meta_level = -1;
-                        mlog_errno(ret);
+                        if (ret != -EAGAIN)
+                                mlog_errno(ret);
                         goto out;
                 }
 
+                /*
+                 * Check if IO will overwrite allocated blocks in case
+                 * IOCB_NOWAIT flag is set.
+                 */
+                if (!wait && !overwrite_io) {
+                        overwrite_io = 1;
+                        if (!down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem)) {
+                                ret = -EAGAIN;
+                                goto out_unlock;
+                        }
+
+                        ret = ocfs2_overwrite_io(inode, di_bh, pos, count);
+                        brelse(di_bh);
+                        di_bh = NULL;
+                        up_read(&OCFS2_I(inode)->ip_alloc_sem);
+                        if (ret < 0) {
+                                if (ret != -EAGAIN)
+                                        mlog_errno(ret);
+                                goto out_unlock;
+                        }
+                }
+
                 /* Clear suid / sgid if necessary. We do this here
                  * instead of later in the write path because
                  * remove_suid() calls ->setattr without any hint that
@@ -2199,7 +2228,9 @@ static int ocfs2_prepare_inode_for_write(struct file *file,
 
 out_unlock:
         trace_ocfs2_prepare_inode_for_write(OCFS2_I(inode)->ip_blkno,
-                                            pos, count);
+                                            pos, count, wait);
+
+        brelse(di_bh);
 
         if (meta_level >= 0)
                 ocfs2_inode_unlock(inode, meta_level);
@@ -2211,7 +2242,7 @@ out:
 static ssize_t ocfs2_file_write_iter(struct kiocb *iocb,
                                     struct iov_iter *from)
 {
-        int direct_io, rw_level;
+        int rw_level;
         ssize_t written = 0;
         ssize_t ret;
         size_t count = iov_iter_count(from);
@@ -2223,6 +2254,8 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb,
         void *saved_ki_complete = NULL;
         int append_write = ((iocb->ki_pos + count) >=
                         i_size_read(inode) ? 1 : 0);
+        int direct_io = iocb->ki_flags & IOCB_DIRECT ? 1 : 0;
+        int nowait = iocb->ki_flags & IOCB_NOWAIT ? 1 : 0;
 
         trace_ocfs2_file_aio_write(inode, file, file->f_path.dentry,
                 (unsigned long long)OCFS2_I(inode)->ip_blkno,
@@ -2230,12 +2263,17 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb,
                 file->f_path.dentry->d_name.name,
                 (unsigned int)from->nr_segs);   /* GRRRRR */
 
+        if (!direct_io && nowait)
+                return -EOPNOTSUPP;
+
         if (count == 0)
                 return 0;
 
-        direct_io = iocb->ki_flags & IOCB_DIRECT ? 1 : 0;
-
-        inode_lock(inode);
+        if (nowait) {
+                if (!inode_trylock(inode))
+                        return -EAGAIN;
+        } else
+                inode_lock(inode);
 
         /*
          * Concurrent O_DIRECT writes are allowed with
@@ -2244,9 +2282,13 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb,
          */
         rw_level = (!direct_io || full_coherency || append_write);
 
-        ret = ocfs2_rw_lock(inode, rw_level);
+        if (nowait)
+                ret = ocfs2_try_rw_lock(inode, rw_level);
+        else
+                ret = ocfs2_rw_lock(inode, rw_level);
         if (ret < 0) {
-                mlog_errno(ret);
+                if (ret != -EAGAIN)
+                        mlog_errno(ret);
                 goto out_mutex;
         }
 
@@ -2260,9 +2302,13 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb,
                  * other nodes to drop their caches.  Buffered I/O
                  * already does this in write_begin().
                  */
-                ret = ocfs2_inode_lock(inode, NULL, 1);
+                if (nowait)
+                        ret = ocfs2_try_inode_lock(inode, NULL, 1);
+                else
+                        ret = ocfs2_inode_lock(inode, NULL, 1);
                 if (ret < 0) {
-                        mlog_errno(ret);
+                        if (ret != -EAGAIN)
+                                mlog_errno(ret);
                         goto out;
                 }
 
@@ -2277,9 +2323,10 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb,
         }
         count = ret;
 
-        ret = ocfs2_prepare_inode_for_write(file, iocb->ki_pos, count);
+        ret = ocfs2_prepare_inode_for_write(file, iocb->ki_pos, count, !nowait);
         if (ret < 0) {
-                mlog_errno(ret);
+                if (ret != -EAGAIN)
+                        mlog_errno(ret);
                 goto out;
         }
 
@@ -2355,6 +2402,8 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb,
         int ret = 0, rw_level = -1, lock_level = 0;
         struct file *filp = iocb->ki_filp;
         struct inode *inode = file_inode(filp);
+        int direct_io = iocb->ki_flags & IOCB_DIRECT ? 1 : 0;
+        int nowait = iocb->ki_flags & IOCB_NOWAIT ? 1 : 0;
 
         trace_ocfs2_file_aio_read(inode, filp, filp->f_path.dentry,
                         (unsigned long long)OCFS2_I(inode)->ip_blkno,
@@ -2369,14 +2418,22 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb,
                 goto bail;
         }
 
+        if (!direct_io && nowait)
+                return -EOPNOTSUPP;
+
         /*
          * buffered reads protect themselves in ->readpage().  O_DIRECT reads
          * need locks to protect pending reads from racing with truncate.
          */
-        if (iocb->ki_flags & IOCB_DIRECT) {
-                ret = ocfs2_rw_lock(inode, 0);
+        if (direct_io) {
+                if (nowait)
+                        ret = ocfs2_try_rw_lock(inode, 0);
+                else
+                        ret = ocfs2_rw_lock(inode, 0);
+
                 if (ret < 0) {
-                        mlog_errno(ret);
+                        if (ret != -EAGAIN)
+                                mlog_errno(ret);
                         goto bail;
                 }
                 rw_level = 0;
@@ -2393,9 +2450,11 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb,
          * like i_size. This allows the checks down below
          * generic_file_aio_read() a chance of actually working.
          */
-        ret = ocfs2_inode_lock_atime(inode, filp->f_path.mnt, &lock_level);
+        ret = ocfs2_inode_lock_atime(inode, filp->f_path.mnt, &lock_level,
+                                     !nowait);
         if (ret < 0) {
-                mlog_errno(ret);
+                if (ret != -EAGAIN)
+                        mlog_errno(ret);
                 goto bail;
         }
         ocfs2_inode_unlock(inode, lock_level);
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index 36304434eacf..e5dcea6cee5f 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -666,23 +666,24 @@ static int __ocfs2_journal_access(handle_t *handle,
         /* we can safely remove this assertion after testing. */
         if (!buffer_uptodate(bh)) {
                 mlog(ML_ERROR, "giving me a buffer that's not uptodate!\n");
-                mlog(ML_ERROR, "b_blocknr=%llu\n",
-                     (unsigned long long)bh->b_blocknr);
+                mlog(ML_ERROR, "b_blocknr=%llu, b_state=0x%lx\n",
+                     (unsigned long long)bh->b_blocknr, bh->b_state);
 
                 lock_buffer(bh);
                 /*
-                 * A previous attempt to write this buffer head failed.
-                 * Nothing we can do but to retry the write and hope for
-                 * the best.
+                 * A previous transaction with a couple of buffer heads fail
+                 * to checkpoint, so all the bhs are marked as BH_Write_EIO.
+                 * For current transaction, the bh is just among those error
+                 * bhs which previous transaction handle. We can't just clear
+                 * its BH_Write_EIO and reuse directly, since other bhs are
+                 * not written to disk yet and that will cause metadata
+                 * inconsistency. So we should set fs read-only to avoid
+                 * further damage.
                  */
                 if (buffer_write_io_error(bh) && !buffer_uptodate(bh)) {
-                        clear_buffer_write_io_error(bh);
-                        set_buffer_uptodate(bh);
-                }
-
-                if (!buffer_uptodate(bh)) {
                         unlock_buffer(bh);
-                        return -EIO;
+                        return ocfs2_error(osb->sb, "A previous attempt to "
+                                        "write this buffer head failed\n");
                 }
                 unlock_buffer(bh);
         }
diff --git a/fs/ocfs2/mmap.c b/fs/ocfs2/mmap.c
index 098f5c712569..fb9a20e3d608 100644
--- a/fs/ocfs2/mmap.c
+++ b/fs/ocfs2/mmap.c
@@ -184,7 +184,7 @@ int ocfs2_mmap(struct file *file, struct vm_area_struct *vma)
         int ret = 0, lock_level = 0;
 
         ret = ocfs2_inode_lock_atime(file_inode(file),
-                                    file->f_path.mnt, &lock_level);
+                                    file->f_path.mnt, &lock_level, 1);
         if (ret < 0) {
                 mlog_errno(ret);
                 goto out;
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 9a50f222ac97..6867eef2e06b 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -404,6 +404,7 @@ struct ocfs2_super
         struct ocfs2_lock_res osb_super_lockres;
         struct ocfs2_lock_res osb_rename_lockres;
         struct ocfs2_lock_res osb_nfs_sync_lockres;
+        struct ocfs2_lock_res osb_trim_fs_lockres;
         struct ocfs2_dlm_debug *osb_dlm_debug;
 
         struct dentry *osb_debug_root;
diff --git a/fs/ocfs2/ocfs2_lockid.h b/fs/ocfs2/ocfs2_lockid.h
index d277aabf5dfb..7051b994c776 100644
--- a/fs/ocfs2/ocfs2_lockid.h
+++ b/fs/ocfs2/ocfs2_lockid.h
@@ -50,6 +50,7 @@ enum ocfs2_lock_type {
         OCFS2_LOCK_TYPE_NFS_SYNC,
         OCFS2_LOCK_TYPE_ORPHAN_SCAN,
         OCFS2_LOCK_TYPE_REFCOUNT,
+        OCFS2_LOCK_TYPE_TRIM_FS,
         OCFS2_NUM_LOCK_TYPES
 };
 
@@ -93,6 +94,9 @@ static inline char ocfs2_lock_type_char(enum ocfs2_lock_type type)
                 case OCFS2_LOCK_TYPE_REFCOUNT:
                         c = 'T';
                         break;
+                case OCFS2_LOCK_TYPE_TRIM_FS:
+                        c = 'I';
+                        break;
                 default:
                         c = '\0';
         }
@@ -115,6 +119,7 @@ static char *ocfs2_lock_type_strings[] = {
         [OCFS2_LOCK_TYPE_NFS_SYNC] = "NFSSync",
         [OCFS2_LOCK_TYPE_ORPHAN_SCAN] = "OrphanScan",
         [OCFS2_LOCK_TYPE_REFCOUNT] = "Refcount",
+        [OCFS2_LOCK_TYPE_TRIM_FS] = "TrimFs",
 };
 
 static inline const char *ocfs2_lock_type_string(enum ocfs2_lock_type type)
diff --git a/fs/ocfs2/ocfs2_trace.h b/fs/ocfs2/ocfs2_trace.h
index a0b5d00ef0a9..e2a11aaece10 100644
--- a/fs/ocfs2/ocfs2_trace.h
+++ b/fs/ocfs2/ocfs2_trace.h
@@ -1449,20 +1449,22 @@ DEFINE_OCFS2_ULL_ULL_ULL_EVENT(ocfs2_remove_inode_range);
 
 TRACE_EVENT(ocfs2_prepare_inode_for_write,
         TP_PROTO(unsigned long long ino, unsigned long long saved_pos,
-                 unsigned long count),
-        TP_ARGS(ino, saved_pos, count),
+                 unsigned long count, int wait),
+        TP_ARGS(ino, saved_pos, count, wait),
         TP_STRUCT__entry(
                 __field(unsigned long long, ino)
                 __field(unsigned long long, saved_pos)
                 __field(unsigned long, count)
+                __field(int, wait)
         ),
         TP_fast_assign(
                 __entry->ino = ino;
                 __entry->saved_pos = saved_pos;
                 __entry->count = count;
+                __entry->wait = wait;
         ),
-        TP_printk("%llu %llu %lu", __entry->ino,
-                  __entry->saved_pos, __entry->count)
+        TP_printk("%llu %llu %lu %d", __entry->ino,
+                  __entry->saved_pos, __entry->count, __entry->wait)
 );
 
 DEFINE_OCFS2_INT_EVENT(generic_file_aio_read_ret);
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index 9f0b95abc09f..d8f5f6ce99dc 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -2438,6 +2438,8 @@ static int ocfs2_block_group_clear_bits(handle_t *handle,
         }
         le16_add_cpu(&bg->bg_free_bits_count, num_bits);
         if (le16_to_cpu(bg->bg_free_bits_count) > le16_to_cpu(bg->bg_bits)) {
+                if (undo_fn)
+                        jbd_unlock_bh_state(group_bh);
                 return ocfs2_error(alloc_inode->i_sb, "Group descriptor # %llu has bit count %u but claims %u are freed. num_bits %d\n",
                                    (unsigned long long)le64_to_cpu(bg->bg_blkno),
                                    le16_to_cpu(bg->bg_bits),
@@ -2563,16 +2565,16 @@ static int _ocfs2_free_clusters(handle_t *handle,
         int status;
         u16 bg_start_bit;
         u64 bg_blkno;
-        struct ocfs2_dinode *fe;
 
         /* You can't ever have a contiguous set of clusters
          * bigger than a block group bitmap so we never have to worry
          * about looping on them.
          * This is expensive. We can safely remove once this stuff has
          * gotten tested really well. */
-        BUG_ON(start_blk != ocfs2_clusters_to_blocks(bitmap_inode->i_sb, ocfs2_blocks_to_clusters(bitmap_inode->i_sb, start_blk)));
+        BUG_ON(start_blk != ocfs2_clusters_to_blocks(bitmap_inode->i_sb,
+                                ocfs2_blocks_to_clusters(bitmap_inode->i_sb,
+                                                         start_blk)));
 
-        fe = (struct ocfs2_dinode *) bitmap_bh->b_data;
 
         ocfs2_block_to_cluster_group(bitmap_inode, start_blk, &bg_blkno,
                                      &bg_start_bit);
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 80efa5699fb0..ffa4952d432b 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -474,9 +474,8 @@ static int ocfs2_init_global_system_inodes(struct ocfs2_super *osb)
                 new = ocfs2_get_system_file_inode(osb, i, osb->slot_num);
                 if (!new) {
                         ocfs2_release_system_inodes(osb);
-                        status = -EINVAL;
+                        status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL;
                         mlog_errno(status);
-                        /* FIXME: Should ERROR_RO_FS */
                         mlog(ML_ERROR, "Unable to load system inode %d, "
                              "possibly corrupt fs?", i);
                         goto bail;
@@ -505,7 +504,7 @@ static int ocfs2_init_local_system_inodes(struct ocfs2_super *osb)
                 new = ocfs2_get_system_file_inode(osb, i, osb->slot_num);
                 if (!new) {
                         ocfs2_release_system_inodes(osb);
-                        status = -EINVAL;
+                        status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL;
                         mlog(ML_ERROR, "status=%d, sysfile=%d, slot=%d\n",
                              status, i, osb->slot_num);
                         goto bail;
@@ -1208,14 +1207,15 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
 read_super_error:
         brelse(bh);
 
+        if (status)
+                mlog_errno(status);
+
         if (osb) {
                 atomic_set(&osb->vol_state, VOLUME_DISABLED);
                 wake_up(&osb->osb_mount_event);
                 ocfs2_dismount_volume(sb, 1);
         }
 
-        if (status)
-                mlog_errno(status);
         return status;
 }
 
@@ -1843,6 +1843,9 @@ static int ocfs2_mount_volume(struct super_block *sb)
         status = ocfs2_dlm_init(osb);
         if (status < 0) {
                 mlog_errno(status);
+                if (status == -EBADR && ocfs2_userspace_stack(osb))
+                        mlog(ML_ERROR, "couldn't mount because cluster name on"
+                        " disk does not match the running cluster name.\n");
                 goto leave;
         }
 
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index c5898c59d411..c261c1dfd374 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -638,14 +638,17 @@ int ocfs2_calc_xattr_init(struct inode *dir,
                                                      si->value_len);
 
         if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
+                down_read(&OCFS2_I(dir)->ip_xattr_sem);
                 acl_len = ocfs2_xattr_get_nolock(dir, dir_bh,
                                         OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT,
                                         "", NULL, 0);
+                up_read(&OCFS2_I(dir)->ip_xattr_sem);
                 if (acl_len > 0) {
                         a_size = ocfs2_xattr_entry_real_size(0, acl_len);
                         if (S_ISDIR(mode))
                                 a_size <<= 1;
                 } else if (acl_len != 0 && acl_len != -ENODATA) {
+                        ret = acl_len;
                         mlog_errno(ret);
                         return ret;
                 }
@@ -6415,7 +6418,7 @@ static int ocfs2_reflink_xattr_header(handle_t *handle,
                  * and then insert the extents one by one.
                  */
                 if (xv->xr_list.l_tree_depth) {
-                        memcpy(new_xv, &def_xv, sizeof(def_xv));
+                        memcpy(new_xv, &def_xv, OCFS2_XATTR_ROOT_SIZE);
                         vb->vb_xv = new_xv;
                         vb->vb_bh = value_bh;
                         ocfs2_init_xattr_value_extent_tree(&data_et,
diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
index 36f1390b5ed7..62d49e53061c 100644
--- a/fs/orangefs/super.c
+++ b/fs/orangefs/super.c
@@ -610,11 +610,16 @@ void orangefs_kill_sb(struct super_block *sb)
 
 int orangefs_inode_cache_initialize(void)
 {
-        orangefs_inode_cache = kmem_cache_create("orangefs_inode_cache",
-                                              sizeof(struct orangefs_inode_s),
-                                              0,
-                                              ORANGEFS_CACHE_CREATE_FLAGS,
-                                              orangefs_inode_cache_ctor);
+        orangefs_inode_cache = kmem_cache_create_usercopy(
+                                        "orangefs_inode_cache",
+                                        sizeof(struct orangefs_inode_s),
+                                        0,
+                                        ORANGEFS_CACHE_CREATE_FLAGS,
+                                        offsetof(struct orangefs_inode_s,
+                                                link_target),
+                                        sizeof_field(struct orangefs_inode_s,
+                                                link_target),
+                                        orangefs_inode_cache_ctor);
 
         if (!orangefs_inode_cache) {
                 gossip_err("Cannot create orangefs_inode_cache\n");
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 339e4c1c044d..ec6d2983a5cb 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -47,8 +47,11 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
         if (hiwater_rss < mm->hiwater_rss)
                 hiwater_rss = mm->hiwater_rss;
 
-        text = (PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK)) >> 10;
-        lib = (mm->exec_vm << (PAGE_SHIFT-10)) - text;
+        /* split executable areas between text and lib */
+        text = PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK);
+        text = min(text, mm->exec_vm << PAGE_SHIFT);
+        lib = (mm->exec_vm << PAGE_SHIFT) - text;
+
         swap = get_mm_counter(mm, MM_SWAPENTS);
         seq_printf(m,
                 "VmPeak:\t%8lu kB\n"
@@ -76,7 +79,9 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
                 file << (PAGE_SHIFT-10),
                 shmem << (PAGE_SHIFT-10),
                 mm->data_vm << (PAGE_SHIFT-10),
-                mm->stack_vm << (PAGE_SHIFT-10), text, lib,
+                mm->stack_vm << (PAGE_SHIFT-10),
+                text >> 10,
+                lib >> 10,
                 mm_pgtables_bytes(mm) >> 10,
                 swap << (PAGE_SHIFT-10));
         hugetlb_report_usage(m, mm);
@@ -977,14 +982,14 @@ static inline void clear_soft_dirty(struct vm_area_struct *vma,
 static inline void clear_soft_dirty_pmd(struct vm_area_struct *vma,
                 unsigned long addr, pmd_t *pmdp)
 {
-        pmd_t pmd = *pmdp;
+        pmd_t old, pmd = *pmdp;
 
         if (pmd_present(pmd)) {
                 /* See comment in change_huge_pmd() */
-                pmdp_invalidate(vma, addr, pmdp);
-                if (pmd_dirty(*pmdp))
+                old = pmdp_invalidate(vma, addr, pmdp);
+                if (pmd_dirty(old))
                         pmd = pmd_mkdirty(pmd);
-                if (pmd_young(*pmdp))
+                if (pmd_young(old))
                         pmd = pmd_mkyoung(pmd);
 
                 pmd = pmd_wrprotect(pmd);
diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index 691032107f8c..c3129b131e4d 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -41,7 +41,6 @@
 #include <linux/timer.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
-#include <linux/hardirq.h>
 #include <linux/jiffies.h>
 #include <linux/workqueue.h>
 
diff --git a/fs/reiserfs/Kconfig b/fs/reiserfs/Kconfig
index 7cd46666ba2c..86e71c0caf48 100644
--- a/fs/reiserfs/Kconfig
+++ b/fs/reiserfs/Kconfig
@@ -57,8 +57,7 @@ config REISERFS_FS_XATTR
         depends on REISERFS_FS
         help
           Extended attributes are name:value pairs associated with inodes by
-          the kernel or by users (see the attr(5) manual page, or visit
-          <http://acl.bestbits.at/> for details).
+          the kernel or by users (see the attr(5) manual page for details).
 
           If unsure, say N.
 
@@ -70,9 +69,6 @@ config REISERFS_FS_POSIX_ACL
           Posix Access Control Lists (ACLs) support permissions for users and
           groups beyond the owner/group/world scheme.
 
-          To learn more about Access Control Lists, visit the Posix ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
           If you don't know what Access Control Lists are, say N
 
 config REISERFS_FS_SECURITY
diff --git a/fs/super.c b/fs/super.c
index 06bd25d90ba5..672538ca9831 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -225,7 +225,7 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags,
         if (s->s_user_ns != &init_user_ns)
                 s->s_iflags |= SB_I_NODEV;
         INIT_HLIST_NODE(&s->s_instances);
-        INIT_HLIST_BL_HEAD(&s->s_anon);
+        INIT_HLIST_BL_HEAD(&s->s_roots);
         mutex_init(&s->s_sync_lock);
         INIT_LIST_HEAD(&s->s_inodes);
         spin_lock_init(&s->s_inode_list_lock);
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 2b67bda2021b..58eba92a0e41 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * fs/sysfs/dir.c - sysfs core and dir operation implementation
  *
@@ -5,12 +6,10 @@
  * Copyright (c) 2007 SUSE Linux Products GmbH
  * Copyright (c) 2007 Tejun Heo <teheo@suse.de>
  *
- * This file is released under the GPLv2.
- *
  * Please see Documentation/filesystems/sysfs.txt for more information.
  */
 
-#undef DEBUG
+#define pr_fmt(fmt)     "sysfs: " fmt
 
 #include <linux/fs.h>
 #include <linux/kobject.h>
@@ -27,8 +26,8 @@ void sysfs_warn_dup(struct kernfs_node *parent, const char *name)
         if (buf)
                 kernfs_path(parent, buf, PATH_MAX);
 
-        WARN(1, KERN_WARNING "sysfs: cannot create duplicate filename '%s/%s'\n",
-             buf, name);
+        pr_warn("cannot create duplicate filename '%s/%s'\n", buf, name);
+        dump_stack();
 
         kfree(buf);
 }
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 39c75a86c67f..5c13f29bfcdb 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * fs/sysfs/file.c - sysfs regular (text) file implementation
  *
@@ -5,14 +6,11 @@
  * Copyright (c) 2007 SUSE Linux Products GmbH
  * Copyright (c) 2007 Tejun Heo <teheo@suse.de>
  *
- * This file is released under the GPLv2.
- *
  * Please see Documentation/filesystems/sysfs.txt for more information.
  */
 
 #include <linux/module.h>
 #include <linux/kobject.h>
-#include <linux/kallsyms.h>
 #include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/mutex.h>
@@ -70,8 +68,8 @@ static int sysfs_kf_seq_show(struct seq_file *sf, void *v)
          * indicate truncated result or overflow in normal use cases.
          */
         if (count >= (ssize_t)PAGE_SIZE) {
-                print_symbol("fill_read_buffer: %s returned bad count\n",
-                        (unsigned long)ops->show);
+                printk("fill_read_buffer: %pS returned bad count\n",
+                                ops->show);
                 /* Try to struggle along */
                 count = PAGE_SIZE - 1;
         }
diff --git a/fs/sysfs/group.c b/fs/sysfs/group.c
index ac2de0ed69ad..4802ec0e1e3a 100644
--- a/fs/sysfs/group.c
+++ b/fs/sysfs/group.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * fs/sysfs/group.c - Operations for adding/removing multiple files at once.
  *
@@ -5,9 +6,6 @@
  * Copyright (c) 2003 Open Source Development Lab
  * Copyright (c) 2013 Greg Kroah-Hartman
  * Copyright (c) 2013 The Linux Foundation
- *
- * This file is released undert the GPL v2.
- *
  */
 
 #include <linux/kobject.h>
@@ -406,6 +404,6 @@ int __compat_only_sysfs_link_entry_to_kobj(struct kobject *kobj,
 
         kernfs_put(entry);
         kernfs_put(target);
-        return IS_ERR(link) ? PTR_ERR(link) : 0;
+        return PTR_ERR_OR_ZERO(link);
 }
 EXPORT_SYMBOL_GPL(__compat_only_sysfs_link_entry_to_kobj);
diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index fb49510c5dcf..b428d317ae92 100644
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * fs/sysfs/symlink.c - operations for initializing and mounting sysfs
  *
@@ -5,13 +6,9 @@
  * Copyright (c) 2007 SUSE Linux Products GmbH
  * Copyright (c) 2007 Tejun Heo <teheo@suse.de>
  *
- * This file is released under the GPLv2.
- *
  * Please see Documentation/filesystems/sysfs.txt for more information.
  */
 
-#define DEBUG
-
 #include <linux/fs.h>
 #include <linux/magic.h>
 #include <linux/mount.h>
diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
index aecb15f84557..8664db25a9a6 100644
--- a/fs/sysfs/symlink.c
+++ b/fs/sysfs/symlink.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * fs/sysfs/symlink.c - sysfs symlink implementation
  *
@@ -5,8 +6,6 @@
  * Copyright (c) 2007 SUSE Linux Products GmbH
  * Copyright (c) 2007 Tejun Heo <teheo@suse.de>
  *
- * This file is released under the GPLv2.
- *
  * Please see Documentation/filesystems/sysfs.txt for more information.
  */
 
diff --git a/fs/sysfs/sysfs.h b/fs/sysfs/sysfs.h
index 0e2f1cccb812..d098e015fcc9 100644
--- a/fs/sysfs/sysfs.h
+++ b/fs/sysfs/sysfs.h
@@ -1,11 +1,10 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * fs/sysfs/sysfs.h - sysfs internal header file
  *
  * Copyright (c) 2001-3 Patrick Mochel
  * Copyright (c) 2007 SUSE Linux Products GmbH
  * Copyright (c) 2007 Tejun Heo <teheo@suse.de>
- *
- * This file is released under the GPLv2.
  */
 
 #ifndef __SYSFS_INTERNAL_H
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index a2ea4856e67b..9d7fb88e172e 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -1138,38 +1138,24 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry,
         struct ubifs_info *c = dir->i_sb->s_fs_info;
         int err, len = strlen(symname);
         int sz_change = CALC_DENT_SIZE(len);
-        struct fscrypt_str disk_link = FSTR_INIT((char *)symname, len + 1);
-        struct fscrypt_symlink_data *sd = NULL;
+        struct fscrypt_str disk_link;
         struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1,
                                         .new_ino_d = ALIGN(len, 8),
                                         .dirtied_ino = 1 };
         struct fscrypt_name nm;
 
-        if (ubifs_crypt_is_encrypted(dir)) {
-                err = fscrypt_get_encryption_info(dir);
-                if (err)
-                        goto out_budg;
-
-                if (!fscrypt_has_encryption_key(dir)) {
-                        err = -EPERM;
-                        goto out_budg;
-                }
+        dbg_gen("dent '%pd', target '%s' in dir ino %lu", dentry,
+                symname, dir->i_ino);
 
-                disk_link.len = (fscrypt_fname_encrypted_size(dir, len) +
-                                sizeof(struct fscrypt_symlink_data));
-        }
+        err = fscrypt_prepare_symlink(dir, symname, len, UBIFS_MAX_INO_DATA,
+                                      &disk_link);
+        if (err)
+                return err;
 
         /*
          * Budget request settings: new inode, new direntry and changing parent
          * directory inode.
          */
-
-        dbg_gen("dent '%pd', target '%s' in dir ino %lu", dentry,
-                symname, dir->i_ino);
-
-        if (disk_link.len > UBIFS_MAX_INO_DATA)
-                return -ENAMETOOLONG;
-
         err = ubifs_budget_space(c, &req);
         if (err)
                 return err;
@@ -1191,38 +1177,20 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry,
                 goto out_inode;
         }
 
-        if (ubifs_crypt_is_encrypted(dir)) {
-                struct qstr istr = QSTR_INIT(symname, len);
-                struct fscrypt_str ostr;
-
-                sd = kzalloc(disk_link.len, GFP_NOFS);
-                if (!sd) {
-                        err = -ENOMEM;
-                        goto out_inode;
-                }
-
-                ostr.name = sd->encrypted_path;
-                ostr.len = disk_link.len;
-
-                err = fscrypt_fname_usr_to_disk(inode, &istr, &ostr);
-                if (err) {
-                        kfree(sd);
+        if (IS_ENCRYPTED(inode)) {
+                disk_link.name = ui->data; /* encrypt directly into ui->data */
+                err = fscrypt_encrypt_symlink(inode, symname, len, &disk_link);
+                if (err)
                         goto out_inode;
-                }
-
-                sd->len = cpu_to_le16(ostr.len);
-                disk_link.name = (char *)sd;
         } else {
+                memcpy(ui->data, disk_link.name, disk_link.len);
                 inode->i_link = ui->data;
         }
 
-        memcpy(ui->data, disk_link.name, disk_link.len);
-        ((char *)ui->data)[disk_link.len - 1] = '\0';
-
         /*
          * The terminating zero byte is not written to the flash media and it
          * is put just to make later in-memory string processing simpler. Thus,
-         * data length is @len, not @len + %1.
+         * data length is @disk_link.len - 1, not @disk_link.len.
          */
         ui->data_len = disk_link.len - 1;
         inode->i_size = ubifs_inode(inode)->ui_size = disk_link.len - 1;
@@ -1240,11 +1208,10 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry,
                 goto out_cancel;
         mutex_unlock(&dir_ui->ui_mutex);
 
-        ubifs_release_budget(c, &req);
         insert_inode_hash(inode);
         d_instantiate(dentry, inode);
-        fscrypt_free_filename(&nm);
-        return 0;
+        err = 0;
+        goto out_fname;
 
 out_cancel:
         dir->i_size -= sz_change;
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index 9fe194a4fa9b..cf348ba99238 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -1629,49 +1629,17 @@ static const char *ubifs_get_link(struct dentry *dentry,
                                             struct inode *inode,
                                             struct delayed_call *done)
 {
-        int err;
-        struct fscrypt_symlink_data *sd;
         struct ubifs_inode *ui = ubifs_inode(inode);
-        struct fscrypt_str cstr;
-        struct fscrypt_str pstr;
 
-        if (!ubifs_crypt_is_encrypted(inode))
+        if (!IS_ENCRYPTED(inode))
                 return ui->data;
 
         if (!dentry)
                 return ERR_PTR(-ECHILD);
 
-        err = fscrypt_get_encryption_info(inode);
-        if (err)
-                return ERR_PTR(err);
-
-        sd = (struct fscrypt_symlink_data *)ui->data;
-        cstr.name = sd->encrypted_path;
-        cstr.len = le16_to_cpu(sd->len);
-
-        if (cstr.len == 0)
-                return ERR_PTR(-ENOENT);
-
-        if ((cstr.len + sizeof(struct fscrypt_symlink_data) - 1) > ui->data_len)
-                return ERR_PTR(-EIO);
-
-        err = fscrypt_fname_alloc_buffer(inode, cstr.len, &pstr);
-        if (err)
-                return ERR_PTR(err);
-
-        err = fscrypt_fname_disk_to_usr(inode, 0, 0, &cstr, &pstr);
-        if (err) {
-                fscrypt_fname_free_buffer(&pstr);
-                return ERR_PTR(err);
-        }
-
-        pstr.name[pstr.len] = '\0';
-
-        set_delayed_call(done, kfree_link, pstr.name);
-        return pstr.name;
+        return fscrypt_get_symlink(inode, ui->data, ui->data_len, done);
 }
 
-
 const struct address_space_operations ubifs_file_address_operations = {
         .readpage       = ubifs_readpage,
         .writepage      = ubifs_writepage,
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 0beb285b143d..b16ef162344a 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -379,9 +379,7 @@ out:
         }
 done:
         clear_inode(inode);
-#ifdef CONFIG_UBIFS_FS_ENCRYPTION
-        fscrypt_put_encryption_info(inode, NULL);
-#endif
+        fscrypt_put_encryption_info(inode);
 }
 
 static void ubifs_dirty_inode(struct inode *inode, int flags)
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index b6ba80e05bff..8254b8b3690f 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -1467,11 +1467,14 @@ static void init_once(void *foo)
 
 static int __init init_inodecache(void)
 {
-        ufs_inode_cachep = kmem_cache_create("ufs_inode_cache",
-                                             sizeof(struct ufs_inode_info),
-                                             0, (SLAB_RECLAIM_ACCOUNT|
-                                                SLAB_MEM_SPREAD|SLAB_ACCOUNT),
-                                             init_once);
+        ufs_inode_cachep = kmem_cache_create_usercopy("ufs_inode_cache",
+                                sizeof(struct ufs_inode_info), 0,
+                                (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
+                                        SLAB_ACCOUNT),
+                                offsetof(struct ufs_inode_info, i_u1.i_symlink),
+                                sizeof_field(struct ufs_inode_info,
+                                        i_u1.i_symlink),
+                                init_once);
         if (ufs_inode_cachep == NULL)
                 return -ENOMEM;
         return 0;
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 743eaa646898..87a13a7c8270 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -294,10 +294,13 @@ static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
          * pmd_trans_unstable) of the pmd.
          */
         _pmd = READ_ONCE(*pmd);
-        if (!pmd_present(_pmd))
+        if (pmd_none(_pmd))
                 goto out;
 
         ret = false;
+        if (!pmd_present(_pmd))
+                goto out;
+
         if (pmd_trans_huge(_pmd))
                 goto out;
 
@@ -985,24 +988,14 @@ static int resolve_userfault_fork(struct userfaultfd_ctx *ctx,
                                   struct uffd_msg *msg)
 {
         int fd;
-        struct file *file;
-        unsigned int flags = new->flags & UFFD_SHARED_FCNTL_FLAGS;
 
-        fd = get_unused_fd_flags(flags);
+        fd = anon_inode_getfd("[userfaultfd]", &userfaultfd_fops, new,
+                              O_RDWR | (new->flags & UFFD_SHARED_FCNTL_FLAGS));
         if (fd < 0)
                 return fd;
 
-        file = anon_inode_getfile("[userfaultfd]", &userfaultfd_fops, new,
-                                  O_RDWR | flags);
-        if (IS_ERR(file)) {
-                put_unused_fd(fd);
-                return PTR_ERR(file);
-        }
-
-        fd_install(fd, file);
         msg->arg.reserved.reserved1 = 0;
         msg->arg.fork.ufd = fd;
-
         return 0;
 }
 
@@ -1884,24 +1877,10 @@ static void init_once_userfaultfd_ctx(void *mem)
         seqcount_init(&ctx->refile_seq);
 }
 
-/**
- * userfaultfd_file_create - Creates a userfaultfd file pointer.
- * @flags: Flags for the userfaultfd file.
- *
- * This function creates a userfaultfd file pointer, w/out installing
- * it into the fd table. This is useful when the userfaultfd file is
- * used during the initialization of data structures that require
- * extra setup after the userfaultfd creation. So the userfaultfd
- * creation is split into the file pointer creation phase, and the
- * file descriptor installation phase.  In this way races with
- * userspace closing the newly installed file descriptor can be
- * avoided.  Returns a userfaultfd file pointer, or a proper error
- * pointer.
- */
-static struct file *userfaultfd_file_create(int flags)
+SYSCALL_DEFINE1(userfaultfd, int, flags)
 {
-        struct file *file;
         struct userfaultfd_ctx *ctx;
+        int fd;
 
         BUG_ON(!current->mm);
 
@@ -1909,14 +1888,12 @@ static struct file *userfaultfd_file_create(int flags)
         BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC);
         BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK);
 
-        file = ERR_PTR(-EINVAL);
         if (flags & ~UFFD_SHARED_FCNTL_FLAGS)
-                goto out;
+                return -EINVAL;
 
-        file = ERR_PTR(-ENOMEM);
         ctx = kmem_cache_alloc(userfaultfd_ctx_cachep, GFP_KERNEL);
         if (!ctx)
-                goto out;
+                return -ENOMEM;
 
         atomic_set(&ctx->refcount, 1);
         ctx->flags = flags;
@@ -1927,39 +1904,13 @@ static struct file *userfaultfd_file_create(int flags)
         /* prevent the mm struct to be freed */
         mmgrab(ctx->mm);
 
-        file = anon_inode_getfile("[userfaultfd]", &userfaultfd_fops, ctx,
-                                  O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS));
-        if (IS_ERR(file)) {
+        fd = anon_inode_getfd("[userfaultfd]", &userfaultfd_fops, ctx,
+                              O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS));
+        if (fd < 0) {
                 mmdrop(ctx->mm);
                 kmem_cache_free(userfaultfd_ctx_cachep, ctx);
         }
-out:
-        return file;
-}
-
-SYSCALL_DEFINE1(userfaultfd, int, flags)
-{
-        int fd, error;
-        struct file *file;
-
-        error = get_unused_fd_flags(flags & UFFD_SHARED_FCNTL_FLAGS);
-        if (error < 0)
-                return error;
-        fd = error;
-
-        file = userfaultfd_file_create(flags);
-        if (IS_ERR(file)) {
-                error = PTR_ERR(file);
-                goto err_put_unused_fd;
-        }
-        fd_install(fd, file);
-
         return fd;
-
-err_put_unused_fd:
-        put_unused_fd(fd);
-
-        return error;
 }
 
 static int __init userfaultfd_init(void)
diff --git a/fs/xfs/Kconfig b/fs/xfs/Kconfig
index f42fcf1b5465..46bcf0e649f5 100644
--- a/fs/xfs/Kconfig
+++ b/fs/xfs/Kconfig
@@ -48,9 +48,6 @@ config XFS_POSIX_ACL
           POSIX Access Control Lists (ACLs) support permissions for users and
           groups beyond the owner/group/world scheme.
 
-          To learn more about Access Control Lists, visit the POSIX ACLs for
-          Linux website <http://acl.bestbits.at/>.
-
           If you don't know what Access Control Lists are, say N.
 
 config XFS_RT
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index 83ed7715f856..c02781a4c091 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -167,7 +167,7 @@ xfs_alloc_lookup_ge(
  * Lookup the first record less than or equal to [bno, len]
  * in the btree given by cur.
  */
-static int                              /* error */
+int                                     /* error */
 xfs_alloc_lookup_le(
         struct xfs_btree_cur    *cur,   /* btree cursor */
         xfs_agblock_t           bno,    /* starting block of extent */
@@ -520,7 +520,7 @@ xfs_alloc_fixup_trees(
         return 0;
 }
 
-static bool
+static xfs_failaddr_t
 xfs_agfl_verify(
         struct xfs_buf  *bp)
 {
@@ -528,10 +528,19 @@ xfs_agfl_verify(
         struct xfs_agfl *agfl = XFS_BUF_TO_AGFL(bp);
         int             i;
 
+        /*
+         * There is no verification of non-crc AGFLs because mkfs does not
+         * initialise the AGFL to zero or NULL. Hence the only valid part of the
+         * AGFL is what the AGF says is active. We can't get to the AGF, so we
+         * can't verify just those entries are valid.
+         */
+        if (!xfs_sb_version_hascrc(&mp->m_sb))
+                return NULL;
+
         if (!uuid_equal(&agfl->agfl_uuid, &mp->m_sb.sb_meta_uuid))
-                return false;
+                return __this_address;
         if (be32_to_cpu(agfl->agfl_magicnum) != XFS_AGFL_MAGIC)
-                return false;
+                return __this_address;
         /*
          * during growfs operations, the perag is not fully initialised,
          * so we can't use it for any useful checking. growfs ensures we can't
@@ -539,16 +548,17 @@ xfs_agfl_verify(
          * so we can detect and avoid this problem.
          */
         if (bp->b_pag && be32_to_cpu(agfl->agfl_seqno) != bp->b_pag->pag_agno)
-                return false;
+                return __this_address;
 
         for (i = 0; i < XFS_AGFL_SIZE(mp); i++) {
                 if (be32_to_cpu(agfl->agfl_bno[i]) != NULLAGBLOCK &&
                     be32_to_cpu(agfl->agfl_bno[i]) >= mp->m_sb.sb_agblocks)
-                        return false;
+                        return __this_address;
         }
 
-        return xfs_log_check_lsn(mp,
-                                 be64_to_cpu(XFS_BUF_TO_AGFL(bp)->agfl_lsn));
+        if (!xfs_log_check_lsn(mp, be64_to_cpu(XFS_BUF_TO_AGFL(bp)->agfl_lsn)))
+                return __this_address;
+        return NULL;
 }
 
 static void
@@ -556,6 +566,7 @@ xfs_agfl_read_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t  fa;
 
         /*
          * There is no verification of non-crc AGFLs because mkfs does not
@@ -567,28 +578,29 @@ xfs_agfl_read_verify(
                 return;
 
         if (!xfs_buf_verify_cksum(bp, XFS_AGFL_CRC_OFF))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_agfl_verify(bp))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-
-        if (bp->b_error)
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_agfl_verify(bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 }
 
 static void
 xfs_agfl_write_verify(
         struct xfs_buf  *bp)
 {
-        struct xfs_mount *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_mount        *mp = bp->b_target->bt_mount;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
+        xfs_failaddr_t          fa;
 
         /* no verification of non-crc AGFLs */
         if (!xfs_sb_version_hascrc(&mp->m_sb))
                 return;
 
-        if (!xfs_agfl_verify(bp)) {
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+        fa = xfs_agfl_verify(bp);
+        if (fa) {
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
 
@@ -602,6 +614,7 @@ const struct xfs_buf_ops xfs_agfl_buf_ops = {
         .name = "xfs_agfl",
         .verify_read = xfs_agfl_read_verify,
         .verify_write = xfs_agfl_write_verify,
+        .verify_struct = xfs_agfl_verify,
 };
 
 /*
@@ -2397,19 +2410,19 @@ xfs_alloc_put_freelist(
         return 0;
 }
 
-static bool
+static xfs_failaddr_t
 xfs_agf_verify(
-        struct xfs_mount *mp,
-        struct xfs_buf  *bp)
- {
-        struct xfs_agf  *agf = XFS_BUF_TO_AGF(bp);
+        struct xfs_buf          *bp)
+{
+        struct xfs_mount        *mp = bp->b_target->bt_mount;
+        struct xfs_agf          *agf = XFS_BUF_TO_AGF(bp);
 
         if (xfs_sb_version_hascrc(&mp->m_sb)) {
                 if (!uuid_equal(&agf->agf_uuid, &mp->m_sb.sb_meta_uuid))
-                        return false;
+                        return __this_address;
                 if (!xfs_log_check_lsn(mp,
                                 be64_to_cpu(XFS_BUF_TO_AGF(bp)->agf_lsn)))
-                        return false;
+                        return __this_address;
         }
 
         if (!(agf->agf_magicnum == cpu_to_be32(XFS_AGF_MAGIC) &&
@@ -2418,18 +2431,18 @@ xfs_agf_verify(
               be32_to_cpu(agf->agf_flfirst) < XFS_AGFL_SIZE(mp) &&
               be32_to_cpu(agf->agf_fllast) < XFS_AGFL_SIZE(mp) &&
               be32_to_cpu(agf->agf_flcount) <= XFS_AGFL_SIZE(mp)))
-                return false;
+                return __this_address;
 
         if (be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) < 1 ||
             be32_to_cpu(agf->agf_levels[XFS_BTNUM_CNT]) < 1 ||
             be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) > XFS_BTREE_MAXLEVELS ||
             be32_to_cpu(agf->agf_levels[XFS_BTNUM_CNT]) > XFS_BTREE_MAXLEVELS)
-                return false;
+                return __this_address;
 
         if (xfs_sb_version_hasrmapbt(&mp->m_sb) &&
             (be32_to_cpu(agf->agf_levels[XFS_BTNUM_RMAP]) < 1 ||
              be32_to_cpu(agf->agf_levels[XFS_BTNUM_RMAP]) > XFS_BTREE_MAXLEVELS))
-                return false;
+                return __this_address;
 
         /*
          * during growfs operations, the perag is not fully initialised,
@@ -2438,18 +2451,18 @@ xfs_agf_verify(
          * so we can detect and avoid this problem.
          */
         if (bp->b_pag && be32_to_cpu(agf->agf_seqno) != bp->b_pag->pag_agno)
-                return false;
+                return __this_address;
 
         if (xfs_sb_version_haslazysbcount(&mp->m_sb) &&
             be32_to_cpu(agf->agf_btreeblks) > be32_to_cpu(agf->agf_length))
-                return false;
+                return __this_address;
 
         if (xfs_sb_version_hasreflink(&mp->m_sb) &&
             (be32_to_cpu(agf->agf_refcount_level) < 1 ||
              be32_to_cpu(agf->agf_refcount_level) > XFS_BTREE_MAXLEVELS))
-                return false;
+                return __this_address;
 
-        return true;;
+        return NULL;
 
 }
 
@@ -2458,28 +2471,29 @@ xfs_agf_read_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t  fa;
 
         if (xfs_sb_version_hascrc(&mp->m_sb) &&
             !xfs_buf_verify_cksum(bp, XFS_AGF_CRC_OFF))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (XFS_TEST_ERROR(!xfs_agf_verify(mp, bp), mp,
-                                XFS_ERRTAG_ALLOC_READ_AGF))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-
-        if (bp->b_error)
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_agf_verify(bp);
+                if (XFS_TEST_ERROR(fa, mp, XFS_ERRTAG_ALLOC_READ_AGF))
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 }
 
 static void
 xfs_agf_write_verify(
         struct xfs_buf  *bp)
 {
-        struct xfs_mount *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_mount        *mp = bp->b_target->bt_mount;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
+        xfs_failaddr_t          fa;
 
-        if (!xfs_agf_verify(mp, bp)) {
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+        fa = xfs_agf_verify(bp);
+        if (fa) {
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
 
@@ -2496,6 +2510,7 @@ const struct xfs_buf_ops xfs_agf_buf_ops = {
         .name = "xfs_agf",
         .verify_read = xfs_agf_read_verify,
         .verify_write = xfs_agf_write_verify,
+        .verify_struct = xfs_agf_verify,
 };
 
 /*
@@ -2981,3 +2996,22 @@ xfs_verify_fsbno(
                 return false;
         return xfs_verify_agbno(mp, agno, XFS_FSB_TO_AGBNO(mp, fsbno));
 }
+
+/* Is there a record covering a given extent? */
+int
+xfs_alloc_has_record(
+        struct xfs_btree_cur    *cur,
+        xfs_agblock_t           bno,
+        xfs_extlen_t            len,
+        bool                    *exists)
+{
+        union xfs_btree_irec    low;
+        union xfs_btree_irec    high;
+
+        memset(&low, 0, sizeof(low));
+        low.a.ar_startblock = bno;
+        memset(&high, 0xFF, sizeof(high));
+        high.a.ar_startblock = bno + len - 1;
+
+        return xfs_btree_has_record(cur, &low, &high, exists);
+}
diff --git a/fs/xfs/libxfs/xfs_alloc.h b/fs/xfs/libxfs/xfs_alloc.h
index 7ba2d129d504..65a0cafe06e4 100644
--- a/fs/xfs/libxfs/xfs_alloc.h
+++ b/fs/xfs/libxfs/xfs_alloc.h
@@ -198,6 +198,13 @@ xfs_free_extent(
         enum xfs_ag_resv_type   type);  /* block reservation type */
 
 int                             /* error */
+xfs_alloc_lookup_le(
+        struct xfs_btree_cur    *cur,   /* btree cursor */
+        xfs_agblock_t           bno,    /* starting block of extent */
+        xfs_extlen_t            len,    /* length of extent */
+        int                     *stat); /* success/failure */
+
+int                             /* error */
 xfs_alloc_lookup_ge(
         struct xfs_btree_cur    *cur,   /* btree cursor */
         xfs_agblock_t           bno,    /* starting block of extent */
@@ -237,4 +244,7 @@ bool xfs_verify_agbno(struct xfs_mount *mp, xfs_agnumber_t agno,
                 xfs_agblock_t agbno);
 bool xfs_verify_fsbno(struct xfs_mount *mp, xfs_fsblock_t fsbno);
 
+int xfs_alloc_has_record(struct xfs_btree_cur *cur, xfs_agblock_t bno,
+                xfs_extlen_t len, bool *exist);
+
 #endif  /* __XFS_ALLOC_H__ */
diff --git a/fs/xfs/libxfs/xfs_alloc_btree.c b/fs/xfs/libxfs/xfs_alloc_btree.c
index cfde0a0f9706..6840b588187e 100644
--- a/fs/xfs/libxfs/xfs_alloc_btree.c
+++ b/fs/xfs/libxfs/xfs_alloc_btree.c
@@ -307,13 +307,14 @@ xfs_cntbt_diff_two_keys(
                 be32_to_cpu(k2->alloc.ar_startblock);
 }
 
-static bool
+static xfs_failaddr_t
 xfs_allocbt_verify(
         struct xfs_buf          *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
         struct xfs_btree_block  *block = XFS_BUF_TO_BLOCK(bp);
         struct xfs_perag        *pag = bp->b_pag;
+        xfs_failaddr_t          fa;
         unsigned int            level;
 
         /*
@@ -331,29 +332,31 @@ xfs_allocbt_verify(
         level = be16_to_cpu(block->bb_level);
         switch (block->bb_magic) {
         case cpu_to_be32(XFS_ABTB_CRC_MAGIC):
-                if (!xfs_btree_sblock_v5hdr_verify(bp))
-                        return false;
+                fa = xfs_btree_sblock_v5hdr_verify(bp);
+                if (fa)
+                        return fa;
                 /* fall through */
         case cpu_to_be32(XFS_ABTB_MAGIC):
                 if (pag && pag->pagf_init) {
                         if (level >= pag->pagf_levels[XFS_BTNUM_BNOi])
-                                return false;
+                                return __this_address;
                 } else if (level >= mp->m_ag_maxlevels)
-                        return false;
+                        return __this_address;
                 break;
         case cpu_to_be32(XFS_ABTC_CRC_MAGIC):
-                if (!xfs_btree_sblock_v5hdr_verify(bp))
-                        return false;
+                fa = xfs_btree_sblock_v5hdr_verify(bp);
+                if (fa)
+                        return fa;
                 /* fall through */
         case cpu_to_be32(XFS_ABTC_MAGIC):
                 if (pag && pag->pagf_init) {
                         if (level >= pag->pagf_levels[XFS_BTNUM_CNTi])
-                                return false;
+                                return __this_address;
                 } else if (level >= mp->m_ag_maxlevels)
-                        return false;
+                        return __this_address;
                 break;
         default:
-                return false;
+                return __this_address;
         }
 
         return xfs_btree_sblock_verify(bp, mp->m_alloc_mxr[level != 0]);
@@ -363,25 +366,30 @@ static void
 xfs_allocbt_read_verify(
         struct xfs_buf  *bp)
 {
+        xfs_failaddr_t  fa;
+
         if (!xfs_btree_sblock_verify_crc(bp))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_allocbt_verify(bp))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_allocbt_verify(bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 
-        if (bp->b_error) {
+        if (bp->b_error)
                 trace_xfs_btree_corrupt(bp, _RET_IP_);
-                xfs_verifier_error(bp);
-        }
 }
 
 static void
 xfs_allocbt_write_verify(
         struct xfs_buf  *bp)
 {
-        if (!xfs_allocbt_verify(bp)) {
+        xfs_failaddr_t  fa;
+
+        fa = xfs_allocbt_verify(bp);
+        if (fa) {
                 trace_xfs_btree_corrupt(bp, _RET_IP_);
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
         xfs_btree_sblock_calc_crc(bp);
@@ -392,6 +400,7 @@ const struct xfs_buf_ops xfs_allocbt_buf_ops = {
         .name = "xfs_allocbt",
         .verify_read = xfs_allocbt_read_verify,
         .verify_write = xfs_allocbt_write_verify,
+        .verify_struct = xfs_allocbt_verify,
 };
 
 
diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index a76914db72ef..ce4a34a2751d 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -717,7 +717,6 @@ xfs_attr_leaf_addname(xfs_da_args_t *args)
         return error;
 out_defer_cancel:
         xfs_defer_cancel(args->dfops);
-        args->trans = NULL;
         return error;
 }
 
@@ -770,7 +769,6 @@ xfs_attr_leaf_removename(xfs_da_args_t *args)
         return 0;
 out_defer_cancel:
         xfs_defer_cancel(args->dfops);
-        args->trans = NULL;
         return error;
 }
 
@@ -1045,7 +1043,6 @@ out:
         return retval;
 out_defer_cancel:
         xfs_defer_cancel(args->dfops);
-        args->trans = NULL;
         goto out;
 }
 
@@ -1186,7 +1183,6 @@ out:
         return error;
 out_defer_cancel:
         xfs_defer_cancel(args->dfops);
-        args->trans = NULL;
         goto out;
 }
 
diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index 601eaa36f1ad..2135b8e67dcc 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -247,14 +247,15 @@ xfs_attr3_leaf_hdr_to_disk(
         }
 }
 
-static bool
+static xfs_failaddr_t
 xfs_attr3_leaf_verify(
-        struct xfs_buf          *bp)
+        struct xfs_buf                  *bp)
 {
-        struct xfs_mount        *mp = bp->b_target->bt_mount;
-        struct xfs_attr_leafblock *leaf = bp->b_addr;
-        struct xfs_perag *pag = bp->b_pag;
-        struct xfs_attr3_icleaf_hdr ichdr;
+        struct xfs_attr3_icleaf_hdr     ichdr;
+        struct xfs_mount                *mp = bp->b_target->bt_mount;
+        struct xfs_attr_leafblock       *leaf = bp->b_addr;
+        struct xfs_perag                *pag = bp->b_pag;
+        struct xfs_attr_leaf_entry      *entries;
 
         xfs_attr3_leaf_hdr_from_disk(mp->m_attr_geo, &ichdr, leaf);
 
@@ -262,17 +263,17 @@ xfs_attr3_leaf_verify(
                 struct xfs_da3_node_hdr *hdr3 = bp->b_addr;
 
                 if (ichdr.magic != XFS_ATTR3_LEAF_MAGIC)
-                        return false;
+                        return __this_address;
 
                 if (!uuid_equal(&hdr3->info.uuid, &mp->m_sb.sb_meta_uuid))
-                        return false;
+                        return __this_address;
                 if (be64_to_cpu(hdr3->info.blkno) != bp->b_bn)
-                        return false;
+                        return __this_address;
                 if (!xfs_log_check_lsn(mp, be64_to_cpu(hdr3->info.lsn)))
-                        return false;
+                        return __this_address;
         } else {
                 if (ichdr.magic != XFS_ATTR_LEAF_MAGIC)
-                        return false;
+                        return __this_address;
         }
         /*
          * In recovery there is a transient state where count == 0 is valid
@@ -280,12 +281,27 @@ xfs_attr3_leaf_verify(
          * if the attr didn't fit in shortform.
          */
         if (pag && pag->pagf_init && ichdr.count == 0)
-                return false;
+                return __this_address;
+
+        /*
+         * firstused is the block offset of the first name info structure.
+         * Make sure it doesn't go off the block or crash into the header.
+         */
+        if (ichdr.firstused > mp->m_attr_geo->blksize)
+                return __this_address;
+        if (ichdr.firstused < xfs_attr3_leaf_hdr_size(leaf))
+                return __this_address;
+
+        /* Make sure the entries array doesn't crash into the name info. */
+        entries = xfs_attr3_leaf_entryp(bp->b_addr);
+        if ((char *)&entries[ichdr.count] >
+            (char *)bp->b_addr + ichdr.firstused)
+                return __this_address;
 
         /* XXX: need to range check rest of attr header values */
         /* XXX: hash order check? */
 
-        return true;
+        return NULL;
 }
 
 static void
@@ -293,12 +309,13 @@ xfs_attr3_leaf_write_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
         struct xfs_attr3_leaf_hdr *hdr3 = bp->b_addr;
+        xfs_failaddr_t          fa;
 
-        if (!xfs_attr3_leaf_verify(bp)) {
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+        fa = xfs_attr3_leaf_verify(bp);
+        if (fa) {
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
 
@@ -322,21 +339,23 @@ xfs_attr3_leaf_read_verify(
         struct xfs_buf          *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t          fa;
 
         if (xfs_sb_version_hascrc(&mp->m_sb) &&
              !xfs_buf_verify_cksum(bp, XFS_ATTR3_LEAF_CRC_OFF))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_attr3_leaf_verify(bp))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-
-        if (bp->b_error)
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_attr3_leaf_verify(bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 }
 
 const struct xfs_buf_ops xfs_attr3_leaf_buf_ops = {
         .name = "xfs_attr3_leaf",
         .verify_read = xfs_attr3_leaf_read_verify,
         .verify_write = xfs_attr3_leaf_write_verify,
+        .verify_struct = xfs_attr3_leaf_verify,
 };
 
 int
@@ -870,6 +889,80 @@ xfs_attr_shortform_allfit(
         return xfs_attr_shortform_bytesfit(dp, bytes);
 }
 
+/* Verify the consistency of an inline attribute fork. */
+xfs_failaddr_t
+xfs_attr_shortform_verify(
+        struct xfs_inode                *ip)
+{
+        struct xfs_attr_shortform       *sfp;
+        struct xfs_attr_sf_entry        *sfep;
+        struct xfs_attr_sf_entry        *next_sfep;
+        char                            *endp;
+        struct xfs_ifork                *ifp;
+        int                             i;
+        int                             size;
+
+        ASSERT(ip->i_d.di_aformat == XFS_DINODE_FMT_LOCAL);
+        ifp = XFS_IFORK_PTR(ip, XFS_ATTR_FORK);
+        sfp = (struct xfs_attr_shortform *)ifp->if_u1.if_data;
+        size = ifp->if_bytes;
+
+        /*
+         * Give up if the attribute is way too short.
+         */
+        if (size < sizeof(struct xfs_attr_sf_hdr))
+                return __this_address;
+
+        endp = (char *)sfp + size;
+
+        /* Check all reported entries */
+        sfep = &sfp->list[0];
+        for (i = 0; i < sfp->hdr.count; i++) {
+                /*
+                 * struct xfs_attr_sf_entry has a variable length.
+                 * Check the fixed-offset parts of the structure are
+                 * within the data buffer.
+                 */
+                if (((char *)sfep + sizeof(*sfep)) >= endp)
+                        return __this_address;
+
+                /* Don't allow names with known bad length. */
+                if (sfep->namelen == 0)
+                        return __this_address;
+
+                /*
+                 * Check that the variable-length part of the structure is
+                 * within the data buffer.  The next entry starts after the
+                 * name component, so nextentry is an acceptable test.
+                 */
+                next_sfep = XFS_ATTR_SF_NEXTENTRY(sfep);
+                if ((char *)next_sfep > endp)
+                        return __this_address;
+
+                /*
+                 * Check for unknown flags.  Short form doesn't support
+                 * the incomplete or local bits, so we can use the namespace
+                 * mask here.
+                 */
+                if (sfep->flags & ~XFS_ATTR_NSP_ONDISK_MASK)
+                        return __this_address;
+
+                /*
+                 * Check for invalid namespace combinations.  We only allow
+                 * one namespace flag per xattr, so we can just count the
+                 * bits (i.e. hweight) here.
+                 */
+                if (hweight8(sfep->flags & XFS_ATTR_NSP_ONDISK_MASK) > 1)
+                        return __this_address;
+
+                sfep = next_sfep;
+        }
+        if ((void *)sfep != (void *)endp)
+                return __this_address;
+
+        return NULL;
+}
+
 /*
  * Convert a leaf attribute list to shortform attribute list
  */
@@ -2173,7 +2266,8 @@ xfs_attr3_leaf_lookup_int(
         leaf = bp->b_addr;
         xfs_attr3_leaf_hdr_from_disk(args->geo, &ichdr, leaf);
         entries = xfs_attr3_leaf_entryp(leaf);
-        ASSERT(ichdr.count < args->geo->blksize / 8);
+        if (ichdr.count >= args->geo->blksize / 8)
+                return -EFSCORRUPTED;
 
         /*
          * Binary search.  (note: small blocks will skip this loop)
@@ -2189,8 +2283,10 @@ xfs_attr3_leaf_lookup_int(
                 else
                         break;
         }
-        ASSERT(probe >= 0 && (!ichdr.count || probe < ichdr.count));
-        ASSERT(span <= 4 || be32_to_cpu(entry->hashval) == hashval);
+        if (!(probe >= 0 && (!ichdr.count || probe < ichdr.count)))
+                return -EFSCORRUPTED;
+        if (!(span <= 4 || be32_to_cpu(entry->hashval) == hashval))
+                return -EFSCORRUPTED;
 
         /*
          * Since we may have duplicate hashval's, find the first matching
diff --git a/fs/xfs/libxfs/xfs_attr_leaf.h b/fs/xfs/libxfs/xfs_attr_leaf.h
index 894124efb421..4da08af5b134 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.h
+++ b/fs/xfs/libxfs/xfs_attr_leaf.h
@@ -53,6 +53,7 @@ int	xfs_attr_shortform_to_leaf(struct xfs_da_args *args,
 int     xfs_attr_shortform_remove(struct xfs_da_args *args);
 int     xfs_attr_shortform_allfit(struct xfs_buf *bp, struct xfs_inode *dp);
 int     xfs_attr_shortform_bytesfit(struct xfs_inode *dp, int bytes);
+xfs_failaddr_t xfs_attr_shortform_verify(struct xfs_inode *ip);
 void    xfs_attr_fork_remove(struct xfs_inode *ip, struct xfs_trans *tp);
 
 /*
diff --git a/fs/xfs/libxfs/xfs_attr_remote.c b/fs/xfs/libxfs/xfs_attr_remote.c
index d56caf037ca0..21be186067a2 100644
--- a/fs/xfs/libxfs/xfs_attr_remote.c
+++ b/fs/xfs/libxfs/xfs_attr_remote.c
@@ -65,7 +65,7 @@ xfs_attr3_rmt_blocks(
  * does CRC, location and bounds checking, the unpacking function checks the
  * attribute parameters and owner.
  */
-static bool
+static xfs_failaddr_t
 xfs_attr3_rmt_hdr_ok(
         void                    *ptr,
         xfs_ino_t               ino,
@@ -76,19 +76,19 @@ xfs_attr3_rmt_hdr_ok(
         struct xfs_attr3_rmt_hdr *rmt = ptr;
 
         if (bno != be64_to_cpu(rmt->rm_blkno))
-                return false;
+                return __this_address;
         if (offset != be32_to_cpu(rmt->rm_offset))
-                return false;
+                return __this_address;
         if (size != be32_to_cpu(rmt->rm_bytes))
-                return false;
+                return __this_address;
         if (ino != be64_to_cpu(rmt->rm_owner))
-                return false;
+                return __this_address;
 
         /* ok */
-        return true;
+        return NULL;
 }
 
-static bool
+static xfs_failaddr_t
 xfs_attr3_rmt_verify(
         struct xfs_mount        *mp,
         void                    *ptr,
@@ -98,27 +98,29 @@ xfs_attr3_rmt_verify(
         struct xfs_attr3_rmt_hdr *rmt = ptr;
 
         if (!xfs_sb_version_hascrc(&mp->m_sb))
-                return false;
+                return __this_address;
         if (rmt->rm_magic != cpu_to_be32(XFS_ATTR3_RMT_MAGIC))
-                return false;
+                return __this_address;
         if (!uuid_equal(&rmt->rm_uuid, &mp->m_sb.sb_meta_uuid))
-                return false;
+                return __this_address;
         if (be64_to_cpu(rmt->rm_blkno) != bno)
-                return false;
+                return __this_address;
         if (be32_to_cpu(rmt->rm_bytes) > fsbsize - sizeof(*rmt))
-                return false;
+                return __this_address;
         if (be32_to_cpu(rmt->rm_offset) +
                                 be32_to_cpu(rmt->rm_bytes) > XFS_XATTR_SIZE_MAX)
-                return false;
+                return __this_address;
         if (rmt->rm_owner == 0)
-                return false;
+                return __this_address;
 
-        return true;
+        return NULL;
 }
 
-static void
-xfs_attr3_rmt_read_verify(
-        struct xfs_buf  *bp)
+static int
+__xfs_attr3_rmt_read_verify(
+        struct xfs_buf  *bp,
+        bool            check_crc,
+        xfs_failaddr_t  *failaddr)
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
         char            *ptr;
@@ -128,7 +130,7 @@ xfs_attr3_rmt_read_verify(
 
         /* no verification of non-crc buffers */
         if (!xfs_sb_version_hascrc(&mp->m_sb))
-                return;
+                return 0;
 
         ptr = bp->b_addr;
         bno = bp->b_bn;
@@ -136,23 +138,48 @@ xfs_attr3_rmt_read_verify(
         ASSERT(len >= blksize);
 
         while (len > 0) {
-                if (!xfs_verify_cksum(ptr, blksize, XFS_ATTR3_RMT_CRC_OFF)) {
-                        xfs_buf_ioerror(bp, -EFSBADCRC);
-                        break;
-                }
-                if (!xfs_attr3_rmt_verify(mp, ptr, blksize, bno)) {
-                        xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                        break;
+                if (check_crc &&
+                    !xfs_verify_cksum(ptr, blksize, XFS_ATTR3_RMT_CRC_OFF)) {
+                        *failaddr = __this_address;
+                        return -EFSBADCRC;
                 }
+                *failaddr = xfs_attr3_rmt_verify(mp, ptr, blksize, bno);
+                if (*failaddr)
+                        return -EFSCORRUPTED;
                 len -= blksize;
                 ptr += blksize;
                 bno += BTOBB(blksize);
         }
 
-        if (bp->b_error)
-                xfs_verifier_error(bp);
-        else
-                ASSERT(len == 0);
+        if (len != 0) {
+                *failaddr = __this_address;
+                return -EFSCORRUPTED;
+        }
+
+        return 0;
+}
+
+static void
+xfs_attr3_rmt_read_verify(
+        struct xfs_buf  *bp)
+{
+        xfs_failaddr_t  fa;
+        int             error;
+
+        error = __xfs_attr3_rmt_read_verify(bp, true, &fa);
+        if (error)
+                xfs_verifier_error(bp, error, fa);
+}
+
+static xfs_failaddr_t
+xfs_attr3_rmt_verify_struct(
+        struct xfs_buf  *bp)
+{
+        xfs_failaddr_t  fa;
+        int             error;
+
+        error = __xfs_attr3_rmt_read_verify(bp, false, &fa);
+        return error ? fa : NULL;
 }
 
 static void
@@ -160,6 +187,7 @@ xfs_attr3_rmt_write_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t  fa;
         int             blksize = mp->m_attr_geo->blksize;
         char            *ptr;
         int             len;
@@ -177,9 +205,9 @@ xfs_attr3_rmt_write_verify(
         while (len > 0) {
                 struct xfs_attr3_rmt_hdr *rmt = (struct xfs_attr3_rmt_hdr *)ptr;
 
-                if (!xfs_attr3_rmt_verify(mp, ptr, blksize, bno)) {
-                        xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                        xfs_verifier_error(bp);
+                fa = xfs_attr3_rmt_verify(mp, ptr, blksize, bno);
+                if (fa) {
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                         return;
                 }
 
@@ -188,8 +216,7 @@ xfs_attr3_rmt_write_verify(
                  * xfs_attr3_rmt_hdr_set() for the explanation.
                  */
                 if (rmt->rm_lsn != cpu_to_be64(NULLCOMMITLSN)) {
-                        xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                        xfs_verifier_error(bp);
+                        xfs_verifier_error(bp, -EFSCORRUPTED, __this_address);
                         return;
                 }
                 xfs_update_cksum(ptr, blksize, XFS_ATTR3_RMT_CRC_OFF);
@@ -198,13 +225,16 @@ xfs_attr3_rmt_write_verify(
                 ptr += blksize;
                 bno += BTOBB(blksize);
         }
-        ASSERT(len == 0);
+
+        if (len != 0)
+                xfs_verifier_error(bp, -EFSCORRUPTED, __this_address);
 }
 
 const struct xfs_buf_ops xfs_attr3_rmt_buf_ops = {
         .name = "xfs_attr3_rmt",
         .verify_read = xfs_attr3_rmt_read_verify,
         .verify_write = xfs_attr3_rmt_write_verify,
+        .verify_struct = xfs_attr3_rmt_verify_struct,
 };
 
 STATIC int
@@ -269,7 +299,7 @@ xfs_attr_rmtval_copyout(
                 byte_cnt = min(*valuelen, byte_cnt);
 
                 if (xfs_sb_version_hascrc(&mp->m_sb)) {
-                        if (!xfs_attr3_rmt_hdr_ok(src, ino, *offset,
+                        if (xfs_attr3_rmt_hdr_ok(src, ino, *offset,
                                                   byte_cnt, bno)) {
                                 xfs_alert(mp,
 "remote attribute header mismatch bno/off/len/owner (0x%llx/0x%x/Ox%x/0x%llx)",
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 1bddbba6b80c..daae00ed30c5 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -400,7 +400,7 @@ xfs_bmap_check_leaf_extents(
                 pp = XFS_BMBT_PTR_ADDR(mp, block, 1, mp->m_bmap_dmxr[1]);
                 bno = be64_to_cpu(*pp);
                 XFS_WANT_CORRUPTED_GOTO(mp,
-                                        XFS_FSB_SANITY_CHECK(mp, bno), error0);
+                                        xfs_verify_fsbno(mp, bno), error0);
                 if (bp_release) {
                         bp_release = 0;
                         xfs_trans_brelse(NULL, bp);
@@ -1220,7 +1220,7 @@ xfs_iread_extents(
                 pp = XFS_BMBT_PTR_ADDR(mp, block, 1, mp->m_bmap_dmxr[1]);
                 bno = be64_to_cpu(*pp);
                 XFS_WANT_CORRUPTED_GOTO(mp,
-                        XFS_FSB_SANITY_CHECK(mp, bno), out_brelse);
+                        xfs_verify_fsbno(mp, bno), out_brelse);
                 xfs_trans_brelse(tp, bp);
         }
 
@@ -3337,6 +3337,49 @@ xfs_bmap_btalloc_filestreams(
         return 0;
 }
 
+/* Update all inode and quota accounting for the allocation we just did. */
+static void
+xfs_bmap_btalloc_accounting(
+        struct xfs_bmalloca     *ap,
+        struct xfs_alloc_arg    *args)
+{
+        if (ap->flags & XFS_BMAPI_COWFORK) {
+                /*
+                 * COW fork blocks are in-core only and thus are treated as
+                 * in-core quota reservation (like delalloc blocks) even when
+                 * converted to real blocks. The quota reservation is not
+                 * accounted to disk until blocks are remapped to the data
+                 * fork. So if these blocks were previously delalloc, we
+                 * already have quota reservation and there's nothing to do
+                 * yet.
+                 */
+                if (ap->wasdel)
+                        return;
+
+                /*
+                 * Otherwise, we've allocated blocks in a hole. The transaction
+                 * has acquired in-core quota reservation for this extent.
+                 * Rather than account these as real blocks, however, we reduce
+                 * the transaction quota reservation based on the allocation.
+                 * This essentially transfers the transaction quota reservation
+                 * to that of a delalloc extent.
+                 */
+                ap->ip->i_delayed_blks += args->len;
+                xfs_trans_mod_dquot_byino(ap->tp, ap->ip, XFS_TRANS_DQ_RES_BLKS,
+                                -(long)args->len);
+                return;
+        }
+
+        /* data/attr fork only */
+        ap->ip->i_d.di_nblocks += args->len;
+        xfs_trans_log_inode(ap->tp, ap->ip, XFS_ILOG_CORE);
+        if (ap->wasdel)
+                ap->ip->i_delayed_blks -= args->len;
+        xfs_trans_mod_dquot_byino(ap->tp, ap->ip,
+                ap->wasdel ? XFS_TRANS_DQ_DELBCOUNT : XFS_TRANS_DQ_BCOUNT,
+                args->len);
+}
+
 STATIC int
 xfs_bmap_btalloc(
         struct xfs_bmalloca     *ap)    /* bmap alloc argument struct */
@@ -3347,6 +3390,8 @@ xfs_bmap_btalloc(
         xfs_agnumber_t  fb_agno;        /* ag number of ap->firstblock */
         xfs_agnumber_t  ag;
         xfs_alloc_arg_t args;
+        xfs_fileoff_t   orig_offset;
+        xfs_extlen_t    orig_length;
         xfs_extlen_t    blen;
         xfs_extlen_t    nextminlen = 0;
         int             nullfb;         /* true if ap->firstblock isn't set */
@@ -3356,6 +3401,8 @@ xfs_bmap_btalloc(
         int             stripe_align;
 
         ASSERT(ap->length);
+        orig_offset = ap->offset;
+        orig_length = ap->length;
 
         mp = ap->ip->i_mount;
 
@@ -3571,19 +3618,23 @@ xfs_bmap_btalloc(
                         *ap->firstblock = args.fsbno;
                 ASSERT(nullfb || fb_agno <= args.agno);
                 ap->length = args.len;
-                if (!(ap->flags & XFS_BMAPI_COWFORK))
-                        ap->ip->i_d.di_nblocks += args.len;
-                xfs_trans_log_inode(ap->tp, ap->ip, XFS_ILOG_CORE);
-                if (ap->wasdel)
-                        ap->ip->i_delayed_blks -= args.len;
                 /*
-                 * Adjust the disk quota also. This was reserved
-                 * earlier.
+                 * If the extent size hint is active, we tried to round the
+                 * caller's allocation request offset down to extsz and the
+                 * length up to another extsz boundary.  If we found a free
+                 * extent we mapped it in starting at this new offset.  If the
+                 * newly mapped space isn't long enough to cover any of the
+                 * range of offsets that was originally requested, move the
+                 * mapping up so that we can fill as much of the caller's
+                 * original request as possible.  Free space is apparently
+                 * very fragmented so we're unlikely to be able to satisfy the
+                 * hints anyway.
                  */
-                xfs_trans_mod_dquot_byino(ap->tp, ap->ip,
-                        ap->wasdel ? XFS_TRANS_DQ_DELBCOUNT :
-                                        XFS_TRANS_DQ_BCOUNT,
-                        (long) args.len);
+                if (ap->length <= orig_length)
+                        ap->offset = orig_offset;
+                else if (ap->offset + ap->length < orig_offset + orig_length)
+                        ap->offset = orig_offset + orig_length - ap->length;
+                xfs_bmap_btalloc_accounting(ap, &args);
         } else {
                 ap->blkno = NULLFSBLOCK;
                 ap->length = 0;
@@ -3876,8 +3927,6 @@ xfs_bmapi_reserve_delalloc(
         struct xfs_ifork        *ifp = XFS_IFORK_PTR(ip, whichfork);
         xfs_extlen_t            alen;
         xfs_extlen_t            indlen;
-        char                    rt = XFS_IS_REALTIME_INODE(ip);
-        xfs_extlen_t            extsz;
         int                     error;
         xfs_fileoff_t           aoff = off;
 
@@ -3892,31 +3941,25 @@ xfs_bmapi_reserve_delalloc(
                 prealloc = alen - len;
 
         /* Figure out the extent size, adjust alen */
-        if (whichfork == XFS_COW_FORK)
-                extsz = xfs_get_cowextsz_hint(ip);
-        else
-                extsz = xfs_get_extsz_hint(ip);
-        if (extsz) {
+        if (whichfork == XFS_COW_FORK) {
                 struct xfs_bmbt_irec    prev;
+                xfs_extlen_t            extsz = xfs_get_cowextsz_hint(ip);
 
                 if (!xfs_iext_peek_prev_extent(ifp, icur, &prev))
                         prev.br_startoff = NULLFILEOFF;
 
-                error = xfs_bmap_extsize_align(mp, got, &prev, extsz, rt, eof,
+                error = xfs_bmap_extsize_align(mp, got, &prev, extsz, 0, eof,
                                                1, 0, &aoff, &alen);
                 ASSERT(!error);
         }
 
-        if (rt)
-                extsz = alen / mp->m_sb.sb_rextsize;
-
         /*
          * Make a transaction-less quota reservation for delayed allocation
          * blocks.  This number gets adjusted later.  We return if we haven't
          * allocated blocks already inside this loop.
          */
         error = xfs_trans_reserve_quota_nblks(NULL, ip, (long)alen, 0,
-                        rt ? XFS_QMOPT_RES_RTBLKS : XFS_QMOPT_RES_REGBLKS);
+                                                XFS_QMOPT_RES_REGBLKS);
         if (error)
                 return error;
 
@@ -3927,12 +3970,7 @@ xfs_bmapi_reserve_delalloc(
         indlen = (xfs_extlen_t)xfs_bmap_worst_indlen(ip, alen);
         ASSERT(indlen > 0);
 
-        if (rt) {
-                error = xfs_mod_frextents(mp, -((int64_t)extsz));
-        } else {
-                error = xfs_mod_fdblocks(mp, -((int64_t)alen), false);
-        }
-
+        error = xfs_mod_fdblocks(mp, -((int64_t)alen), false);
         if (error)
                 goto out_unreserve_quota;
 
@@ -3963,14 +4001,11 @@ xfs_bmapi_reserve_delalloc(
         return 0;
 
 out_unreserve_blocks:
-        if (rt)
-                xfs_mod_frextents(mp, extsz);
-        else
-                xfs_mod_fdblocks(mp, alen, false);
+        xfs_mod_fdblocks(mp, alen, false);
 out_unreserve_quota:
         if (XFS_IS_QUOTA_ON(mp))
-                xfs_trans_unreserve_quota_nblks(NULL, ip, (long)alen, 0, rt ?
-                                XFS_QMOPT_RES_RTBLKS : XFS_QMOPT_RES_REGBLKS);
+                xfs_trans_unreserve_quota_nblks(NULL, ip, (long)alen, 0,
+                                                XFS_QMOPT_RES_REGBLKS);
         return error;
 }
 
@@ -4304,8 +4339,16 @@ xfs_bmapi_write(
         while (bno < end && n < *nmap) {
                 bool                    need_alloc = false, wasdelay = false;
 
-                /* in hole or beyoned EOF? */
+                /* in hole or beyond EOF? */
                 if (eof || bma.got.br_startoff > bno) {
+                        /*
+                         * CoW fork conversions should /never/ hit EOF or
+                         * holes.  There should always be something for us
+                         * to work on.
+                         */
+                        ASSERT(!((flags & XFS_BMAPI_CONVERT) &&
+                                 (flags & XFS_BMAPI_COWFORK)));
+
                         if (flags & XFS_BMAPI_DELALLOC) {
                                 /*
                                  * For the COW fork we can reasonably get a
@@ -4824,6 +4867,7 @@ xfs_bmap_del_extent_cow(
                 xfs_iext_insert(ip, icur, &new, state);
                 break;
         }
+        ip->i_delayed_blks -= del->br_blockcount;
 }
 
 /*
diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
index c10aecaaae44..9faf479aba49 100644
--- a/fs/xfs/libxfs/xfs_bmap_btree.c
+++ b/fs/xfs/libxfs/xfs_bmap_btree.c
@@ -425,33 +425,29 @@ xfs_bmbt_diff_two_keys(
                           be64_to_cpu(k2->bmbt.br_startoff);
 }
 
-static bool
+static xfs_failaddr_t
 xfs_bmbt_verify(
         struct xfs_buf          *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
         struct xfs_btree_block  *block = XFS_BUF_TO_BLOCK(bp);
+        xfs_failaddr_t          fa;
         unsigned int            level;
 
         switch (block->bb_magic) {
         case cpu_to_be32(XFS_BMAP_CRC_MAGIC):
-                if (!xfs_sb_version_hascrc(&mp->m_sb))
-                        return false;
-                if (!uuid_equal(&block->bb_u.l.bb_uuid, &mp->m_sb.sb_meta_uuid))
-                        return false;
-                if (be64_to_cpu(block->bb_u.l.bb_blkno) != bp->b_bn)
-                        return false;
                 /*
                  * XXX: need a better way of verifying the owner here. Right now
                  * just make sure there has been one set.
                  */
-                if (be64_to_cpu(block->bb_u.l.bb_owner) == 0)
-                        return false;
+                fa = xfs_btree_lblock_v5hdr_verify(bp, XFS_RMAP_OWN_UNKNOWN);
+                if (fa)
+                        return fa;
                 /* fall through */
         case cpu_to_be32(XFS_BMAP_MAGIC):
                 break;
         default:
-                return false;
+                return __this_address;
         }
 
         /*
@@ -463,46 +459,39 @@ xfs_bmbt_verify(
          */
         level = be16_to_cpu(block->bb_level);
         if (level > max(mp->m_bm_maxlevels[0], mp->m_bm_maxlevels[1]))
-                return false;
-        if (be16_to_cpu(block->bb_numrecs) > mp->m_bmap_dmxr[level != 0])
-                return false;
-
-        /* sibling pointer verification */
-        if (!block->bb_u.l.bb_leftsib ||
-            (block->bb_u.l.bb_leftsib != cpu_to_be64(NULLFSBLOCK) &&
-             !XFS_FSB_SANITY_CHECK(mp, be64_to_cpu(block->bb_u.l.bb_leftsib))))
-                return false;
-        if (!block->bb_u.l.bb_rightsib ||
-            (block->bb_u.l.bb_rightsib != cpu_to_be64(NULLFSBLOCK) &&
-             !XFS_FSB_SANITY_CHECK(mp, be64_to_cpu(block->bb_u.l.bb_rightsib))))
-                return false;
-
-        return true;
+                return __this_address;
+
+        return xfs_btree_lblock_verify(bp, mp->m_bmap_dmxr[level != 0]);
 }
 
 static void
 xfs_bmbt_read_verify(
         struct xfs_buf  *bp)
 {
+        xfs_failaddr_t  fa;
+
         if (!xfs_btree_lblock_verify_crc(bp))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_bmbt_verify(bp))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_bmbt_verify(bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 
-        if (bp->b_error) {
+        if (bp->b_error)
                 trace_xfs_btree_corrupt(bp, _RET_IP_);
-                xfs_verifier_error(bp);
-        }
 }
 
 static void
 xfs_bmbt_write_verify(
         struct xfs_buf  *bp)
 {
-        if (!xfs_bmbt_verify(bp)) {
+        xfs_failaddr_t  fa;
+
+        fa = xfs_bmbt_verify(bp);
+        if (fa) {
                 trace_xfs_btree_corrupt(bp, _RET_IP_);
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
         xfs_btree_lblock_calc_crc(bp);
@@ -512,6 +501,7 @@ const struct xfs_buf_ops xfs_bmbt_buf_ops = {
         .name = "xfs_bmbt",
         .verify_read = xfs_bmbt_read_verify,
         .verify_write = xfs_bmbt_write_verify,
+        .verify_struct = xfs_bmbt_verify,
 };
 
 
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index 5f33adf8eecb..79ee4a1951d1 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -273,7 +273,7 @@ xfs_btree_lblock_calc_crc(
         struct xfs_buf          *bp)
 {
         struct xfs_btree_block  *block = XFS_BUF_TO_BLOCK(bp);
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         if (!xfs_sb_version_hascrc(&bp->b_target->bt_mount->m_sb))
                 return;
@@ -311,7 +311,7 @@ xfs_btree_sblock_calc_crc(
         struct xfs_buf          *bp)
 {
         struct xfs_btree_block  *block = XFS_BUF_TO_BLOCK(bp);
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         if (!xfs_sb_version_hascrc(&bp->b_target->bt_mount->m_sb))
                 return;
@@ -329,7 +329,7 @@ xfs_btree_sblock_verify_crc(
 
         if (xfs_sb_version_hascrc(&mp->m_sb)) {
                 if (!xfs_log_check_lsn(mp, be64_to_cpu(block->bb_u.s.bb_lsn)))
-                        return false;
+                        return __this_address;
                 return xfs_buf_verify_cksum(bp, XFS_BTREE_SBLOCK_CRC_OFF);
         }
 
@@ -853,7 +853,7 @@ xfs_btree_read_bufl(
         xfs_daddr_t             d;              /* real disk block address */
         int                     error;
 
-        if (!XFS_FSB_SANITY_CHECK(mp, fsbno))
+        if (!xfs_verify_fsbno(mp, fsbno))
                 return -EFSCORRUPTED;
         d = XFS_FSB_TO_DADDR(mp, fsbno);
         error = xfs_trans_read_buf(mp, tp, mp->m_ddev_targp, d,
@@ -4529,6 +4529,51 @@ xfs_btree_change_owner(
                         &bbcoi);
 }
 
+/* Verify the v5 fields of a long-format btree block. */
+xfs_failaddr_t
+xfs_btree_lblock_v5hdr_verify(
+        struct xfs_buf          *bp,
+        uint64_t                owner)
+{
+        struct xfs_mount        *mp = bp->b_target->bt_mount;
+        struct xfs_btree_block  *block = XFS_BUF_TO_BLOCK(bp);
+
+        if (!xfs_sb_version_hascrc(&mp->m_sb))
+                return __this_address;
+        if (!uuid_equal(&block->bb_u.l.bb_uuid, &mp->m_sb.sb_meta_uuid))
+                return __this_address;
+        if (block->bb_u.l.bb_blkno != cpu_to_be64(bp->b_bn))
+                return __this_address;
+        if (owner != XFS_RMAP_OWN_UNKNOWN &&
+            be64_to_cpu(block->bb_u.l.bb_owner) != owner)
+                return __this_address;
+        return NULL;
+}
+
+/* Verify a long-format btree block. */
+xfs_failaddr_t
+xfs_btree_lblock_verify(
+        struct xfs_buf          *bp,
+        unsigned int            max_recs)
+{
+        struct xfs_mount        *mp = bp->b_target->bt_mount;
+        struct xfs_btree_block  *block = XFS_BUF_TO_BLOCK(bp);
+
+        /* numrecs verification */
+        if (be16_to_cpu(block->bb_numrecs) > max_recs)
+                return __this_address;
+
+        /* sibling pointer verification */
+        if (block->bb_u.l.bb_leftsib != cpu_to_be64(NULLFSBLOCK) &&
+            !xfs_verify_fsbno(mp, be64_to_cpu(block->bb_u.l.bb_leftsib)))
+                return __this_address;
+        if (block->bb_u.l.bb_rightsib != cpu_to_be64(NULLFSBLOCK) &&
+            !xfs_verify_fsbno(mp, be64_to_cpu(block->bb_u.l.bb_rightsib)))
+                return __this_address;
+
+        return NULL;
+}
+
 /**
  * xfs_btree_sblock_v5hdr_verify() -- verify the v5 fields of a short-format
  *                                    btree block
@@ -4537,7 +4582,7 @@ xfs_btree_change_owner(
  * @max_recs: pointer to the m_*_mxr max records field in the xfs mount
  * @pag_max_level: pointer to the per-ag max level field
  */
-bool
+xfs_failaddr_t
 xfs_btree_sblock_v5hdr_verify(
         struct xfs_buf          *bp)
 {
@@ -4546,14 +4591,14 @@ xfs_btree_sblock_v5hdr_verify(
         struct xfs_perag        *pag = bp->b_pag;
 
         if (!xfs_sb_version_hascrc(&mp->m_sb))
-                return false;
+                return __this_address;
         if (!uuid_equal(&block->bb_u.s.bb_uuid, &mp->m_sb.sb_meta_uuid))
-                return false;
+                return __this_address;
         if (block->bb_u.s.bb_blkno != cpu_to_be64(bp->b_bn))
-                return false;
+                return __this_address;
         if (pag && be32_to_cpu(block->bb_u.s.bb_owner) != pag->pag_agno)
-                return false;
-        return true;
+                return __this_address;
+        return NULL;
 }
 
 /**
@@ -4562,29 +4607,29 @@ xfs_btree_sblock_v5hdr_verify(
  * @bp: buffer containing the btree block
  * @max_recs: maximum records allowed in this btree node
  */
-bool
+xfs_failaddr_t
 xfs_btree_sblock_verify(
         struct xfs_buf          *bp,
         unsigned int            max_recs)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
         struct xfs_btree_block  *block = XFS_BUF_TO_BLOCK(bp);
+        xfs_agblock_t           agno;
 
         /* numrecs verification */
         if (be16_to_cpu(block->bb_numrecs) > max_recs)
-                return false;
+                return __this_address;
 
         /* sibling pointer verification */
-        if (!block->bb_u.s.bb_leftsib ||
-            (be32_to_cpu(block->bb_u.s.bb_leftsib) >= mp->m_sb.sb_agblocks &&
-             block->bb_u.s.bb_leftsib != cpu_to_be32(NULLAGBLOCK)))
-                return false;
-        if (!block->bb_u.s.bb_rightsib ||
-            (be32_to_cpu(block->bb_u.s.bb_rightsib) >= mp->m_sb.sb_agblocks &&
-             block->bb_u.s.bb_rightsib != cpu_to_be32(NULLAGBLOCK)))
-                return false;
+        agno = xfs_daddr_to_agno(mp, XFS_BUF_ADDR(bp));
+        if (block->bb_u.s.bb_leftsib != cpu_to_be32(NULLAGBLOCK) &&
+            !xfs_verify_agbno(mp, agno, be32_to_cpu(block->bb_u.s.bb_leftsib)))
+                return __this_address;
+        if (block->bb_u.s.bb_rightsib != cpu_to_be32(NULLAGBLOCK) &&
+            !xfs_verify_agbno(mp, agno, be32_to_cpu(block->bb_u.s.bb_rightsib)))
+                return __this_address;
 
-        return true;
+        return NULL;
 }
 
 /*
@@ -4953,3 +4998,33 @@ xfs_btree_diff_two_ptrs(
                 return (int64_t)be64_to_cpu(a->l) - be64_to_cpu(b->l);
         return (int64_t)be32_to_cpu(a->s) - be32_to_cpu(b->s);
 }
+
+/* If there's an extent, we're done. */
+STATIC int
+xfs_btree_has_record_helper(
+        struct xfs_btree_cur            *cur,
+        union xfs_btree_rec             *rec,
+        void                            *priv)
+{
+        return XFS_BTREE_QUERY_RANGE_ABORT;
+}
+
+/* Is there a record covering a given range of keys? */
+int
+xfs_btree_has_record(
+        struct xfs_btree_cur    *cur,
+        union xfs_btree_irec    *low,
+        union xfs_btree_irec    *high,
+        bool                    *exists)
+{
+        int                     error;
+
+        error = xfs_btree_query_range(cur, low, high,
+                        &xfs_btree_has_record_helper, NULL);
+        if (error == XFS_BTREE_QUERY_RANGE_ABORT) {
+                *exists = true;
+                return 0;
+        }
+        *exists = false;
+        return error;
+}
diff --git a/fs/xfs/libxfs/xfs_btree.h b/fs/xfs/libxfs/xfs_btree.h
index b57501c6f71d..50440b5618e8 100644
--- a/fs/xfs/libxfs/xfs_btree.h
+++ b/fs/xfs/libxfs/xfs_btree.h
@@ -473,10 +473,6 @@ static inline int xfs_btree_get_level(struct xfs_btree_block *block)
 #define XFS_FILBLKS_MIN(a,b)    min_t(xfs_filblks_t, (a), (b))
 #define XFS_FILBLKS_MAX(a,b)    max_t(xfs_filblks_t, (a), (b))
 
-#define XFS_FSB_SANITY_CHECK(mp,fsb)    \
-        (fsb && XFS_FSB_TO_AGNO(mp, fsb) < mp->m_sb.sb_agcount && \
-                XFS_FSB_TO_AGBNO(mp, fsb) < mp->m_sb.sb_agblocks)
-
 /*
  * Trace hooks.  Currently not implemented as they need to be ported
  * over to the generic tracing functionality, which is some effort.
@@ -496,8 +492,14 @@ static inline int xfs_btree_get_level(struct xfs_btree_block *block)
 #define XFS_BTREE_TRACE_ARGR(c, r)
 #define XFS_BTREE_TRACE_CURSOR(c, t)
 
-bool xfs_btree_sblock_v5hdr_verify(struct xfs_buf *bp);
-bool xfs_btree_sblock_verify(struct xfs_buf *bp, unsigned int max_recs);
+xfs_failaddr_t xfs_btree_sblock_v5hdr_verify(struct xfs_buf *bp);
+xfs_failaddr_t xfs_btree_sblock_verify(struct xfs_buf *bp,
+                unsigned int max_recs);
+xfs_failaddr_t xfs_btree_lblock_v5hdr_verify(struct xfs_buf *bp,
+                uint64_t owner);
+xfs_failaddr_t xfs_btree_lblock_verify(struct xfs_buf *bp,
+                unsigned int max_recs);
+
 uint xfs_btree_compute_maxlevels(struct xfs_mount *mp, uint *limits,
                                  unsigned long len);
 xfs_extlen_t xfs_btree_calc_size(struct xfs_mount *mp, uint *limits,
@@ -545,5 +547,7 @@ void xfs_btree_get_keys(struct xfs_btree_cur *cur,
                 struct xfs_btree_block *block, union xfs_btree_key *key);
 union xfs_btree_key *xfs_btree_high_key_from_key(struct xfs_btree_cur *cur,
                 union xfs_btree_key *key);
+int xfs_btree_has_record(struct xfs_btree_cur *cur, union xfs_btree_irec *low,
+                union xfs_btree_irec *high, bool *exists);
 
 #endif  /* __XFS_BTREE_H__ */
diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c
index 651611530d2f..ea187b4a7991 100644
--- a/fs/xfs/libxfs/xfs_da_btree.c
+++ b/fs/xfs/libxfs/xfs_da_btree.c
@@ -128,7 +128,7 @@ xfs_da_state_free(xfs_da_state_t *state)
         kmem_zone_free(xfs_da_state_zone, state);
 }
 
-static bool
+static xfs_failaddr_t
 xfs_da3_node_verify(
         struct xfs_buf          *bp)
 {
@@ -145,24 +145,24 @@ xfs_da3_node_verify(
                 struct xfs_da3_node_hdr *hdr3 = bp->b_addr;
 
                 if (ichdr.magic != XFS_DA3_NODE_MAGIC)
-                        return false;
+                        return __this_address;
 
                 if (!uuid_equal(&hdr3->info.uuid, &mp->m_sb.sb_meta_uuid))
-                        return false;
+                        return __this_address;
                 if (be64_to_cpu(hdr3->info.blkno) != bp->b_bn)
-                        return false;
+                        return __this_address;
                 if (!xfs_log_check_lsn(mp, be64_to_cpu(hdr3->info.lsn)))
-                        return false;
+                        return __this_address;
         } else {
                 if (ichdr.magic != XFS_DA_NODE_MAGIC)
-                        return false;
+                        return __this_address;
         }
         if (ichdr.level == 0)
-                return false;
+                return __this_address;
         if (ichdr.level > XFS_DA_NODE_MAXDEPTH)
-                return false;
+                return __this_address;
         if (ichdr.count == 0)
-                return false;
+                return __this_address;
 
         /*
          * we don't know if the node is for and attribute or directory tree,
@@ -170,11 +170,11 @@ xfs_da3_node_verify(
          */
         if (ichdr.count > mp->m_dir_geo->node_ents &&
             ichdr.count > mp->m_attr_geo->node_ents)
-                return false;
+                return __this_address;
 
         /* XXX: hash order check? */
 
-        return true;
+        return NULL;
 }
 
 static void
@@ -182,12 +182,13 @@ xfs_da3_node_write_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
         struct xfs_da3_node_hdr *hdr3 = bp->b_addr;
+        xfs_failaddr_t          fa;
 
-        if (!xfs_da3_node_verify(bp)) {
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+        fa = xfs_da3_node_verify(bp);
+        if (fa) {
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
 
@@ -211,19 +212,20 @@ xfs_da3_node_read_verify(
         struct xfs_buf          *bp)
 {
         struct xfs_da_blkinfo   *info = bp->b_addr;
+        xfs_failaddr_t          fa;
 
         switch (be16_to_cpu(info->magic)) {
                 case XFS_DA3_NODE_MAGIC:
                         if (!xfs_buf_verify_cksum(bp, XFS_DA3_NODE_CRC_OFF)) {
-                                xfs_buf_ioerror(bp, -EFSBADCRC);
+                                xfs_verifier_error(bp, -EFSBADCRC,
+                                                __this_address);
                                 break;
                         }
                         /* fall through */
                 case XFS_DA_NODE_MAGIC:
-                        if (!xfs_da3_node_verify(bp)) {
-                                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                                break;
-                        }
+                        fa = xfs_da3_node_verify(bp);
+                        if (fa)
+                                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                         return;
                 case XFS_ATTR_LEAF_MAGIC:
                 case XFS_ATTR3_LEAF_MAGIC:
@@ -236,18 +238,40 @@ xfs_da3_node_read_verify(
                         bp->b_ops->verify_read(bp);
                         return;
                 default:
-                        xfs_buf_ioerror(bp, -EFSCORRUPTED);
+                        xfs_verifier_error(bp, -EFSCORRUPTED, __this_address);
                         break;
         }
+}
+
+/* Verify the structure of a da3 block. */
+static xfs_failaddr_t
+xfs_da3_node_verify_struct(
+        struct xfs_buf          *bp)
+{
+        struct xfs_da_blkinfo   *info = bp->b_addr;
 
-        /* corrupt block */
-        xfs_verifier_error(bp);
+        switch (be16_to_cpu(info->magic)) {
+        case XFS_DA3_NODE_MAGIC:
+        case XFS_DA_NODE_MAGIC:
+                return xfs_da3_node_verify(bp);
+        case XFS_ATTR_LEAF_MAGIC:
+        case XFS_ATTR3_LEAF_MAGIC:
+                bp->b_ops = &xfs_attr3_leaf_buf_ops;
+                return bp->b_ops->verify_struct(bp);
+        case XFS_DIR2_LEAFN_MAGIC:
+        case XFS_DIR3_LEAFN_MAGIC:
+                bp->b_ops = &xfs_dir3_leafn_buf_ops;
+                return bp->b_ops->verify_struct(bp);
+        default:
+                return __this_address;
+        }
 }
 
 const struct xfs_buf_ops xfs_da3_node_buf_ops = {
         .name = "xfs_da3_node",
         .verify_read = xfs_da3_node_read_verify,
         .verify_write = xfs_da3_node_write_verify,
+        .verify_struct = xfs_da3_node_verify_struct,
 };
 
 int
diff --git a/fs/xfs/libxfs/xfs_da_format.h b/fs/xfs/libxfs/xfs_da_format.h
index 3771edcb301d..7e77299b7789 100644
--- a/fs/xfs/libxfs/xfs_da_format.h
+++ b/fs/xfs/libxfs/xfs_da_format.h
@@ -875,4 +875,10 @@ struct xfs_attr3_rmt_hdr {
         ((bufsize) - (xfs_sb_version_hascrc(&(mp)->m_sb) ? \
                         sizeof(struct xfs_attr3_rmt_hdr) : 0))
 
+/* Number of bytes in a directory block. */
+static inline unsigned int xfs_dir2_dirblock_bytes(struct xfs_sb *sbp)
+{
+        return 1 << (sbp->sb_blocklog + sbp->sb_dirblklog);
+}
+
 #endif /* __XFS_DA_FORMAT_H__ */
diff --git a/fs/xfs/libxfs/xfs_dir2.c b/fs/xfs/libxfs/xfs_dir2.c
index e10778c102ea..92f94e190f04 100644
--- a/fs/xfs/libxfs/xfs_dir2.c
+++ b/fs/xfs/libxfs/xfs_dir2.c
@@ -119,8 +119,7 @@ xfs_da_mount(
 
 
         ASSERT(mp->m_sb.sb_versionnum & XFS_SB_VERSION_DIRV2BIT);
-        ASSERT((1 << (mp->m_sb.sb_blocklog + mp->m_sb.sb_dirblklog)) <=
-               XFS_MAX_BLOCKSIZE);
+        ASSERT(xfs_dir2_dirblock_bytes(&mp->m_sb) <= XFS_MAX_BLOCKSIZE);
 
         mp->m_dir_inode_ops = xfs_dir_get_ops(mp, NULL);
         mp->m_nondir_inode_ops = xfs_nondir_get_ops(mp, NULL);
@@ -140,7 +139,7 @@ xfs_da_mount(
         dageo = mp->m_dir_geo;
         dageo->blklog = mp->m_sb.sb_blocklog + mp->m_sb.sb_dirblklog;
         dageo->fsblog = mp->m_sb.sb_blocklog;
-        dageo->blksize = 1 << dageo->blklog;
+        dageo->blksize = xfs_dir2_dirblock_bytes(&mp->m_sb);
         dageo->fsbcount = 1 << mp->m_sb.sb_dirblklog;
 
         /*
diff --git a/fs/xfs/libxfs/xfs_dir2.h b/fs/xfs/libxfs/xfs_dir2.h
index 1a8f2cf977ca..388d67c5c903 100644
--- a/fs/xfs/libxfs/xfs_dir2.h
+++ b/fs/xfs/libxfs/xfs_dir2.h
@@ -340,5 +340,7 @@ xfs_dir2_leaf_tail_p(struct xfs_da_geometry *geo, struct xfs_dir2_leaf *lp)
 #define XFS_READDIR_BUFSIZE     (32768)
 
 unsigned char xfs_dir3_get_dtype(struct xfs_mount *mp, uint8_t filetype);
+void *xfs_dir3_data_endp(struct xfs_da_geometry *geo,
+                struct xfs_dir2_data_hdr *hdr);
 
 #endif  /* __XFS_DIR2_H__ */
diff --git a/fs/xfs/libxfs/xfs_dir2_block.c b/fs/xfs/libxfs/xfs_dir2_block.c
index 43c902f7a68d..2da86a394bcf 100644
--- a/fs/xfs/libxfs/xfs_dir2_block.c
+++ b/fs/xfs/libxfs/xfs_dir2_block.c
@@ -58,7 +58,7 @@ xfs_dir_startup(void)
         xfs_dir_hash_dotdot = xfs_da_hashname((unsigned char *)"..", 2);
 }
 
-static bool
+static xfs_failaddr_t
 xfs_dir3_block_verify(
         struct xfs_buf          *bp)
 {
@@ -67,20 +67,18 @@ xfs_dir3_block_verify(
 
         if (xfs_sb_version_hascrc(&mp->m_sb)) {
                 if (hdr3->magic != cpu_to_be32(XFS_DIR3_BLOCK_MAGIC))
-                        return false;
+                        return __this_address;
                 if (!uuid_equal(&hdr3->uuid, &mp->m_sb.sb_meta_uuid))
-                        return false;
+                        return __this_address;
                 if (be64_to_cpu(hdr3->blkno) != bp->b_bn)
-                        return false;
+                        return __this_address;
                 if (!xfs_log_check_lsn(mp, be64_to_cpu(hdr3->lsn)))
-                        return false;
+                        return __this_address;
         } else {
                 if (hdr3->magic != cpu_to_be32(XFS_DIR2_BLOCK_MAGIC))
-                        return false;
+                        return __this_address;
         }
-        if (__xfs_dir3_data_check(NULL, bp))
-                return false;
-        return true;
+        return __xfs_dir3_data_check(NULL, bp);
 }
 
 static void
@@ -88,15 +86,16 @@ xfs_dir3_block_read_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t          fa;
 
         if (xfs_sb_version_hascrc(&mp->m_sb) &&
              !xfs_buf_verify_cksum(bp, XFS_DIR3_DATA_CRC_OFF))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_dir3_block_verify(bp))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-
-        if (bp->b_error)
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_dir3_block_verify(bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 }
 
 static void
@@ -104,12 +103,13 @@ xfs_dir3_block_write_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
         struct xfs_dir3_blk_hdr *hdr3 = bp->b_addr;
+        xfs_failaddr_t          fa;
 
-        if (!xfs_dir3_block_verify(bp)) {
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+        fa = xfs_dir3_block_verify(bp);
+        if (fa) {
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
 
@@ -126,6 +126,7 @@ const struct xfs_buf_ops xfs_dir3_block_buf_ops = {
         .name = "xfs_dir3_block",
         .verify_read = xfs_dir3_block_read_verify,
         .verify_write = xfs_dir3_block_write_verify,
+        .verify_struct = xfs_dir3_block_verify,
 };
 
 int
diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
index 8727a43115ef..920279485275 100644
--- a/fs/xfs/libxfs/xfs_dir2_data.c
+++ b/fs/xfs/libxfs/xfs_dir2_data.c
@@ -36,9 +36,9 @@
 /*
  * Check the consistency of the data block.
  * The input can also be a block-format directory.
- * Return 0 is the buffer is good, otherwise an error.
+ * Return NULL if the buffer is good, otherwise the address of the error.
  */
-int
+xfs_failaddr_t
 __xfs_dir3_data_check(
         struct xfs_inode        *dp,            /* incore inode pointer */
         struct xfs_buf          *bp)            /* data block's buffer */
@@ -73,6 +73,14 @@ __xfs_dir3_data_check(
          */
         ops = xfs_dir_get_ops(mp, dp);
 
+        /*
+         * If this isn't a directory, or we don't get handed the dir ops,
+         * something is seriously wrong.  Bail out.
+         */
+        if ((dp && !S_ISDIR(VFS_I(dp)->i_mode)) ||
+            ops != xfs_dir_get_ops(mp, NULL))
+                return __this_address;
+
         hdr = bp->b_addr;
         p = (char *)ops->data_entry_p(hdr);
 
@@ -81,7 +89,6 @@ __xfs_dir3_data_check(
         case cpu_to_be32(XFS_DIR2_BLOCK_MAGIC):
                 btp = xfs_dir2_block_tail_p(geo, hdr);
                 lep = xfs_dir2_block_leaf_p(btp);
-                endp = (char *)lep;
 
                 /*
                  * The number of leaf entries is limited by the size of the
@@ -90,17 +97,19 @@ __xfs_dir3_data_check(
                  * so just ensure that the count falls somewhere inside the
                  * block right now.
                  */
-                XFS_WANT_CORRUPTED_RETURN(mp, be32_to_cpu(btp->count) <
-                        ((char *)btp - p) / sizeof(struct xfs_dir2_leaf_entry));
+                if (be32_to_cpu(btp->count) >=
+                    ((char *)btp - p) / sizeof(struct xfs_dir2_leaf_entry))
+                        return __this_address;
                 break;
         case cpu_to_be32(XFS_DIR3_DATA_MAGIC):
         case cpu_to_be32(XFS_DIR2_DATA_MAGIC):
-                endp = (char *)hdr + geo->blksize;
                 break;
         default:
-                XFS_ERROR_REPORT("Bad Magic", XFS_ERRLEVEL_LOW, mp);
-                return -EFSCORRUPTED;
+                return __this_address;
         }
+        endp = xfs_dir3_data_endp(geo, hdr);
+        if (!endp)
+                return __this_address;
 
         /*
          * Account for zero bestfree entries.
@@ -108,22 +117,25 @@ __xfs_dir3_data_check(
         bf = ops->data_bestfree_p(hdr);
         count = lastfree = freeseen = 0;
         if (!bf[0].length) {
-                XFS_WANT_CORRUPTED_RETURN(mp, !bf[0].offset);
+                if (bf[0].offset)
+                        return __this_address;
                 freeseen |= 1 << 0;
         }
         if (!bf[1].length) {
-                XFS_WANT_CORRUPTED_RETURN(mp, !bf[1].offset);
+                if (bf[1].offset)
+                        return __this_address;
                 freeseen |= 1 << 1;
         }
         if (!bf[2].length) {
-                XFS_WANT_CORRUPTED_RETURN(mp, !bf[2].offset);
+                if (bf[2].offset)
+                        return __this_address;
                 freeseen |= 1 << 2;
         }
 
-        XFS_WANT_CORRUPTED_RETURN(mp, be16_to_cpu(bf[0].length) >=
-                                                be16_to_cpu(bf[1].length));
-        XFS_WANT_CORRUPTED_RETURN(mp, be16_to_cpu(bf[1].length) >=
-                                                be16_to_cpu(bf[2].length));
+        if (be16_to_cpu(bf[0].length) < be16_to_cpu(bf[1].length))
+                return __this_address;
+        if (be16_to_cpu(bf[1].length) < be16_to_cpu(bf[2].length))
+                return __this_address;
         /*
          * Loop over the data/unused entries.
          */
@@ -135,22 +147,23 @@ __xfs_dir3_data_check(
                  * doesn't need to be there.
                  */
                 if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {
-                        XFS_WANT_CORRUPTED_RETURN(mp, lastfree == 0);
-                        XFS_WANT_CORRUPTED_RETURN(mp, endp >=
-                                        p + be16_to_cpu(dup->length));
-                        XFS_WANT_CORRUPTED_RETURN(mp,
-                                be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup)) ==
-                                               (char *)dup - (char *)hdr);
+                        if (lastfree != 0)
+                                return __this_address;
+                        if (endp < p + be16_to_cpu(dup->length))
+                                return __this_address;
+                        if (be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup)) !=
+                            (char *)dup - (char *)hdr)
+                                return __this_address;
                         dfp = xfs_dir2_data_freefind(hdr, bf, dup);
                         if (dfp) {
                                 i = (int)(dfp - bf);
-                                XFS_WANT_CORRUPTED_RETURN(mp,
-                                        (freeseen & (1 << i)) == 0);
+                                if ((freeseen & (1 << i)) != 0)
+                                        return __this_address;
                                 freeseen |= 1 << i;
                         } else {
-                                XFS_WANT_CORRUPTED_RETURN(mp,
-                                        be16_to_cpu(dup->length) <=
-                                                be16_to_cpu(bf[2].length));
+                                if (be16_to_cpu(dup->length) >
+                                    be16_to_cpu(bf[2].length))
+                                        return __this_address;
                         }
                         p += be16_to_cpu(dup->length);
                         lastfree = 1;
@@ -163,16 +176,17 @@ __xfs_dir3_data_check(
                  * The linear search is crude but this is DEBUG code.
                  */
                 dep = (xfs_dir2_data_entry_t *)p;
-                XFS_WANT_CORRUPTED_RETURN(mp, dep->namelen != 0);
-                XFS_WANT_CORRUPTED_RETURN(mp,
-                        !xfs_dir_ino_validate(mp, be64_to_cpu(dep->inumber)));
-                XFS_WANT_CORRUPTED_RETURN(mp, endp >=
-                                p + ops->data_entsize(dep->namelen));
-                XFS_WANT_CORRUPTED_RETURN(mp,
-                        be16_to_cpu(*ops->data_entry_tag_p(dep)) ==
-                                               (char *)dep - (char *)hdr);
-                XFS_WANT_CORRUPTED_RETURN(mp,
-                                ops->data_get_ftype(dep) < XFS_DIR3_FT_MAX);
+                if (dep->namelen == 0)
+                        return __this_address;
+                if (xfs_dir_ino_validate(mp, be64_to_cpu(dep->inumber)))
+                        return __this_address;
+                if (endp < p + ops->data_entsize(dep->namelen))
+                        return __this_address;
+                if (be16_to_cpu(*ops->data_entry_tag_p(dep)) !=
+                    (char *)dep - (char *)hdr)
+                        return __this_address;
+                if (ops->data_get_ftype(dep) >= XFS_DIR3_FT_MAX)
+                        return __this_address;
                 count++;
                 lastfree = 0;
                 if (hdr->magic == cpu_to_be32(XFS_DIR2_BLOCK_MAGIC) ||
@@ -188,34 +202,52 @@ __xfs_dir3_data_check(
                                     be32_to_cpu(lep[i].hashval) == hash)
                                         break;
                         }
-                        XFS_WANT_CORRUPTED_RETURN(mp,
-                                                  i < be32_to_cpu(btp->count));
+                        if (i >= be32_to_cpu(btp->count))
+                                return __this_address;
                 }
                 p += ops->data_entsize(dep->namelen);
         }
         /*
          * Need to have seen all the entries and all the bestfree slots.
          */
-        XFS_WANT_CORRUPTED_RETURN(mp, freeseen == 7);
+        if (freeseen != 7)
+                return __this_address;
         if (hdr->magic == cpu_to_be32(XFS_DIR2_BLOCK_MAGIC) ||
             hdr->magic == cpu_to_be32(XFS_DIR3_BLOCK_MAGIC)) {
                 for (i = stale = 0; i < be32_to_cpu(btp->count); i++) {
                         if (lep[i].address ==
                             cpu_to_be32(XFS_DIR2_NULL_DATAPTR))
                                 stale++;
-                        if (i > 0)
-                                XFS_WANT_CORRUPTED_RETURN(mp,
-                                        be32_to_cpu(lep[i].hashval) >=
-                                                be32_to_cpu(lep[i - 1].hashval));
+                        if (i > 0 && be32_to_cpu(lep[i].hashval) <
+                                     be32_to_cpu(lep[i - 1].hashval))
+                                return __this_address;
                 }
-                XFS_WANT_CORRUPTED_RETURN(mp, count ==
-                        be32_to_cpu(btp->count) - be32_to_cpu(btp->stale));
-                XFS_WANT_CORRUPTED_RETURN(mp, stale == be32_to_cpu(btp->stale));
+                if (count != be32_to_cpu(btp->count) - be32_to_cpu(btp->stale))
+                        return __this_address;
+                if (stale != be32_to_cpu(btp->stale))
+                        return __this_address;
         }
-        return 0;
+        return NULL;
+}
+
+#ifdef DEBUG
+void
+xfs_dir3_data_check(
+        struct xfs_inode        *dp,
+        struct xfs_buf          *bp)
+{
+        xfs_failaddr_t          fa;
+
+        fa = __xfs_dir3_data_check(dp, bp);
+        if (!fa)
+                return;
+        xfs_corruption_error(__func__, XFS_ERRLEVEL_LOW, dp->i_mount,
+                        bp->b_addr, __FILE__, __LINE__, fa);
+        ASSERT(0);
 }
+#endif
 
-static bool
+static xfs_failaddr_t
 xfs_dir3_data_verify(
         struct xfs_buf          *bp)
 {
@@ -224,20 +256,18 @@ xfs_dir3_data_verify(
 
         if (xfs_sb_version_hascrc(&mp->m_sb)) {
                 if (hdr3->magic != cpu_to_be32(XFS_DIR3_DATA_MAGIC))
-                        return false;
+                        return __this_address;
                 if (!uuid_equal(&hdr3->uuid, &mp->m_sb.sb_meta_uuid))
-                        return false;
+                        return __this_address;
                 if (be64_to_cpu(hdr3->blkno) != bp->b_bn)
-                        return false;
+                        return __this_address;
                 if (!xfs_log_check_lsn(mp, be64_to_cpu(hdr3->lsn)))
-                        return false;
+                        return __this_address;
         } else {
                 if (hdr3->magic != cpu_to_be32(XFS_DIR2_DATA_MAGIC))
-                        return false;
+                        return __this_address;
         }
-        if (__xfs_dir3_data_check(NULL, bp))
-                return false;
-        return true;
+        return __xfs_dir3_data_check(NULL, bp);
 }
 
 /*
@@ -263,8 +293,7 @@ xfs_dir3_data_reada_verify(
                 bp->b_ops->verify_read(bp);
                 return;
         default:
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSCORRUPTED, __this_address);
                 break;
         }
 }
@@ -274,15 +303,16 @@ xfs_dir3_data_read_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t          fa;
 
         if (xfs_sb_version_hascrc(&mp->m_sb) &&
-             !xfs_buf_verify_cksum(bp, XFS_DIR3_DATA_CRC_OFF))
-                 xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_dir3_data_verify(bp))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-
-        if (bp->b_error)
-                xfs_verifier_error(bp);
+            !xfs_buf_verify_cksum(bp, XFS_DIR3_DATA_CRC_OFF))
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_dir3_data_verify(bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 }
 
 static void
@@ -290,12 +320,13 @@ xfs_dir3_data_write_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
         struct xfs_dir3_blk_hdr *hdr3 = bp->b_addr;
+        xfs_failaddr_t          fa;
 
-        if (!xfs_dir3_data_verify(bp)) {
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+        fa = xfs_dir3_data_verify(bp);
+        if (fa) {
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
 
@@ -312,6 +343,7 @@ const struct xfs_buf_ops xfs_dir3_data_buf_ops = {
         .name = "xfs_dir3_data",
         .verify_read = xfs_dir3_data_read_verify,
         .verify_write = xfs_dir3_data_write_verify,
+        .verify_struct = xfs_dir3_data_verify,
 };
 
 static const struct xfs_buf_ops xfs_dir3_data_reada_buf_ops = {
@@ -515,7 +547,6 @@ xfs_dir2_data_freescan_int(
         struct xfs_dir2_data_hdr *hdr,
         int                     *loghead)
 {
-        xfs_dir2_block_tail_t   *btp;           /* block tail */
         xfs_dir2_data_entry_t   *dep;           /* active data entry */
         xfs_dir2_data_unused_t  *dup;           /* unused data entry */
         struct xfs_dir2_data_free *bf;
@@ -537,12 +568,7 @@ xfs_dir2_data_freescan_int(
          * Set up pointers.
          */
         p = (char *)ops->data_entry_p(hdr);
-        if (hdr->magic == cpu_to_be32(XFS_DIR2_BLOCK_MAGIC) ||
-            hdr->magic == cpu_to_be32(XFS_DIR3_BLOCK_MAGIC)) {
-                btp = xfs_dir2_block_tail_p(geo, hdr);
-                endp = (char *)xfs_dir2_block_leaf_p(btp);
-        } else
-                endp = (char *)hdr + geo->blksize;
+        endp = xfs_dir3_data_endp(geo, hdr);
         /*
          * Loop over the block's entries.
          */
@@ -755,17 +781,9 @@ xfs_dir2_data_make_free(
         /*
          * Figure out where the end of the data area is.
          */
-        if (hdr->magic == cpu_to_be32(XFS_DIR2_DATA_MAGIC) ||
-            hdr->magic == cpu_to_be32(XFS_DIR3_DATA_MAGIC))
-                endptr = (char *)hdr + args->geo->blksize;
-        else {
-                xfs_dir2_block_tail_t   *btp;   /* block tail */
+        endptr = xfs_dir3_data_endp(args->geo, hdr);
+        ASSERT(endptr != NULL);
 
-                ASSERT(hdr->magic == cpu_to_be32(XFS_DIR2_BLOCK_MAGIC) ||
-                        hdr->magic == cpu_to_be32(XFS_DIR3_BLOCK_MAGIC));
-                btp = xfs_dir2_block_tail_p(args->geo, hdr);
-                endptr = (char *)xfs_dir2_block_leaf_p(btp);
-        }
         /*
          * If this isn't the start of the block, then back up to
          * the previous entry and see if it's free.
@@ -1067,3 +1085,21 @@ xfs_dir2_data_use_free(
         }
         *needscanp = needscan;
 }
+
+/* Find the end of the entry data in a data/block format dir block. */
+void *
+xfs_dir3_data_endp(
+        struct xfs_da_geometry          *geo,
+        struct xfs_dir2_data_hdr        *hdr)
+{
+        switch (hdr->magic) {
+        case cpu_to_be32(XFS_DIR3_BLOCK_MAGIC):
+        case cpu_to_be32(XFS_DIR2_BLOCK_MAGIC):
+                return xfs_dir2_block_leaf_p(xfs_dir2_block_tail_p(geo, hdr));
+        case cpu_to_be32(XFS_DIR3_DATA_MAGIC):
+        case cpu_to_be32(XFS_DIR2_DATA_MAGIC):
+                return (char *)hdr + geo->blksize;
+        default:
+                return NULL;
+        }
+}
diff --git a/fs/xfs/libxfs/xfs_dir2_leaf.c b/fs/xfs/libxfs/xfs_dir2_leaf.c
index 27297a689d9c..d7e630f41f9c 100644
--- a/fs/xfs/libxfs/xfs_dir2_leaf.c
+++ b/fs/xfs/libxfs/xfs_dir2_leaf.c
@@ -50,13 +50,7 @@ static void xfs_dir3_leaf_log_tail(struct xfs_da_args *args,
  * Pop an assert if something is wrong.
  */
 #ifdef DEBUG
-#define xfs_dir3_leaf_check(dp, bp) \
-do { \
-        if (!xfs_dir3_leaf1_check((dp), (bp))) \
-                ASSERT(0); \
-} while (0);
-
-STATIC bool
+static xfs_failaddr_t
 xfs_dir3_leaf1_check(
         struct xfs_inode        *dp,
         struct xfs_buf          *bp)
@@ -69,17 +63,32 @@ xfs_dir3_leaf1_check(
         if (leafhdr.magic == XFS_DIR3_LEAF1_MAGIC) {
                 struct xfs_dir3_leaf_hdr *leaf3 = bp->b_addr;
                 if (be64_to_cpu(leaf3->info.blkno) != bp->b_bn)
-                        return false;
+                        return __this_address;
         } else if (leafhdr.magic != XFS_DIR2_LEAF1_MAGIC)
-                return false;
+                return __this_address;
 
         return xfs_dir3_leaf_check_int(dp->i_mount, dp, &leafhdr, leaf);
 }
+
+static inline void
+xfs_dir3_leaf_check(
+        struct xfs_inode        *dp,
+        struct xfs_buf          *bp)
+{
+        xfs_failaddr_t          fa;
+
+        fa = xfs_dir3_leaf1_check(dp, bp);
+        if (!fa)
+                return;
+        xfs_corruption_error(__func__, XFS_ERRLEVEL_LOW, dp->i_mount,
+                        bp->b_addr, __FILE__, __LINE__, fa);
+        ASSERT(0);
+}
 #else
 #define xfs_dir3_leaf_check(dp, bp)
 #endif
 
-bool
+xfs_failaddr_t
 xfs_dir3_leaf_check_int(
         struct xfs_mount        *mp,
         struct xfs_inode        *dp,
@@ -114,27 +123,27 @@ xfs_dir3_leaf_check_int(
          * We can deduce a value for that from di_size.
          */
         if (hdr->count > ops->leaf_max_ents(geo))
-                return false;
+                return __this_address;
 
         /* Leaves and bests don't overlap in leaf format. */
         if ((hdr->magic == XFS_DIR2_LEAF1_MAGIC ||
              hdr->magic == XFS_DIR3_LEAF1_MAGIC) &&
             (char *)&ents[hdr->count] > (char *)xfs_dir2_leaf_bests_p(ltp))
-                return false;
+                return __this_address;
 
         /* Check hash value order, count stale entries.  */
         for (i = stale = 0; i < hdr->count; i++) {
                 if (i + 1 < hdr->count) {
                         if (be32_to_cpu(ents[i].hashval) >
                                         be32_to_cpu(ents[i + 1].hashval))
-                                return false;
+                                return __this_address;
                 }
                 if (ents[i].address == cpu_to_be32(XFS_DIR2_NULL_DATAPTR))
                         stale++;
         }
         if (hdr->stale != stale)
-                return false;
-        return true;
+                return __this_address;
+        return NULL;
 }
 
 /*
@@ -142,7 +151,7 @@ xfs_dir3_leaf_check_int(
  * kernels we don't get assertion failures in xfs_dir3_leaf_hdr_from_disk() due
  * to incorrect magic numbers.
  */
-static bool
+static xfs_failaddr_t
 xfs_dir3_leaf_verify(
         struct xfs_buf          *bp,
         uint16_t                magic)
@@ -160,16 +169,16 @@ xfs_dir3_leaf_verify(
                                                          : XFS_DIR3_LEAFN_MAGIC;
 
                 if (leaf3->info.hdr.magic != cpu_to_be16(magic3))
-                        return false;
+                        return __this_address;
                 if (!uuid_equal(&leaf3->info.uuid, &mp->m_sb.sb_meta_uuid))
-                        return false;
+                        return __this_address;
                 if (be64_to_cpu(leaf3->info.blkno) != bp->b_bn)
-                        return false;
+                        return __this_address;
                 if (!xfs_log_check_lsn(mp, be64_to_cpu(leaf3->info.lsn)))
-                        return false;
+                        return __this_address;
         } else {
                 if (leaf->hdr.info.magic != cpu_to_be16(magic))
-                        return false;
+                        return __this_address;
         }
 
         return xfs_dir3_leaf_check_int(mp, NULL, NULL, leaf);
@@ -181,15 +190,16 @@ __read_verify(
         uint16_t        magic)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t          fa;
 
         if (xfs_sb_version_hascrc(&mp->m_sb) &&
              !xfs_buf_verify_cksum(bp, XFS_DIR3_LEAF_CRC_OFF))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_dir3_leaf_verify(bp, magic))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-
-        if (bp->b_error)
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_dir3_leaf_verify(bp, magic);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 }
 
 static void
@@ -198,12 +208,13 @@ __write_verify(
         uint16_t        magic)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
         struct xfs_dir3_leaf_hdr *hdr3 = bp->b_addr;
+        xfs_failaddr_t          fa;
 
-        if (!xfs_dir3_leaf_verify(bp, magic)) {
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+        fa = xfs_dir3_leaf_verify(bp, magic);
+        if (fa) {
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
 
@@ -216,6 +227,13 @@ __write_verify(
         xfs_buf_update_cksum(bp, XFS_DIR3_LEAF_CRC_OFF);
 }
 
+static xfs_failaddr_t
+xfs_dir3_leaf1_verify(
+        struct xfs_buf  *bp)
+{
+        return xfs_dir3_leaf_verify(bp, XFS_DIR2_LEAF1_MAGIC);
+}
+
 static void
 xfs_dir3_leaf1_read_verify(
         struct xfs_buf  *bp)
@@ -230,6 +248,13 @@ xfs_dir3_leaf1_write_verify(
         __write_verify(bp, XFS_DIR2_LEAF1_MAGIC);
 }
 
+static xfs_failaddr_t
+xfs_dir3_leafn_verify(
+        struct xfs_buf  *bp)
+{
+        return xfs_dir3_leaf_verify(bp, XFS_DIR2_LEAFN_MAGIC);
+}
+
 static void
 xfs_dir3_leafn_read_verify(
         struct xfs_buf  *bp)
@@ -248,12 +273,14 @@ const struct xfs_buf_ops xfs_dir3_leaf1_buf_ops = {
         .name = "xfs_dir3_leaf1",
         .verify_read = xfs_dir3_leaf1_read_verify,
         .verify_write = xfs_dir3_leaf1_write_verify,
+        .verify_struct = xfs_dir3_leaf1_verify,
 };
 
 const struct xfs_buf_ops xfs_dir3_leafn_buf_ops = {
         .name = "xfs_dir3_leafn",
         .verify_read = xfs_dir3_leafn_read_verify,
         .verify_write = xfs_dir3_leafn_write_verify,
+        .verify_struct = xfs_dir3_leafn_verify,
 };
 
 int
diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
index 682e2bf370c7..239d97a64296 100644
--- a/fs/xfs/libxfs/xfs_dir2_node.c
+++ b/fs/xfs/libxfs/xfs_dir2_node.c
@@ -53,13 +53,7 @@ static int xfs_dir2_node_addname_int(xfs_da_args_t *args,
  * Check internal consistency of a leafn block.
  */
 #ifdef DEBUG
-#define xfs_dir3_leaf_check(dp, bp) \
-do { \
-        if (!xfs_dir3_leafn_check((dp), (bp))) \
-                ASSERT(0); \
-} while (0);
-
-static bool
+static xfs_failaddr_t
 xfs_dir3_leafn_check(
         struct xfs_inode        *dp,
         struct xfs_buf          *bp)
@@ -72,17 +66,32 @@ xfs_dir3_leafn_check(
         if (leafhdr.magic == XFS_DIR3_LEAFN_MAGIC) {
                 struct xfs_dir3_leaf_hdr *leaf3 = bp->b_addr;
                 if (be64_to_cpu(leaf3->info.blkno) != bp->b_bn)
-                        return false;
+                        return __this_address;
         } else if (leafhdr.magic != XFS_DIR2_LEAFN_MAGIC)
-                return false;
+                return __this_address;
 
         return xfs_dir3_leaf_check_int(dp->i_mount, dp, &leafhdr, leaf);
 }
+
+static inline void
+xfs_dir3_leaf_check(
+        struct xfs_inode        *dp,
+        struct xfs_buf          *bp)
+{
+        xfs_failaddr_t          fa;
+
+        fa = xfs_dir3_leafn_check(dp, bp);
+        if (!fa)
+                return;
+        xfs_corruption_error(__func__, XFS_ERRLEVEL_LOW, dp->i_mount,
+                        bp->b_addr, __FILE__, __LINE__, fa);
+        ASSERT(0);
+}
 #else
 #define xfs_dir3_leaf_check(dp, bp)
 #endif
 
-static bool
+static xfs_failaddr_t
 xfs_dir3_free_verify(
         struct xfs_buf          *bp)
 {
@@ -93,21 +102,21 @@ xfs_dir3_free_verify(
                 struct xfs_dir3_blk_hdr *hdr3 = bp->b_addr;
 
                 if (hdr3->magic != cpu_to_be32(XFS_DIR3_FREE_MAGIC))
-                        return false;
+                        return __this_address;
                 if (!uuid_equal(&hdr3->uuid, &mp->m_sb.sb_meta_uuid))
-                        return false;
+                        return __this_address;
                 if (be64_to_cpu(hdr3->blkno) != bp->b_bn)
-                        return false;
+                        return __this_address;
                 if (!xfs_log_check_lsn(mp, be64_to_cpu(hdr3->lsn)))
-                        return false;
+                        return __this_address;
         } else {
                 if (hdr->magic != cpu_to_be32(XFS_DIR2_FREE_MAGIC))
-                        return false;
+                        return __this_address;
         }
 
         /* XXX: should bounds check the xfs_dir3_icfree_hdr here */
 
-        return true;
+        return NULL;
 }
 
 static void
@@ -115,15 +124,16 @@ xfs_dir3_free_read_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t          fa;
 
         if (xfs_sb_version_hascrc(&mp->m_sb) &&
             !xfs_buf_verify_cksum(bp, XFS_DIR3_FREE_CRC_OFF))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_dir3_free_verify(bp))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-
-        if (bp->b_error)
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_dir3_free_verify(bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 }
 
 static void
@@ -131,12 +141,13 @@ xfs_dir3_free_write_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
         struct xfs_dir3_blk_hdr *hdr3 = bp->b_addr;
+        xfs_failaddr_t          fa;
 
-        if (!xfs_dir3_free_verify(bp)) {
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+        fa = xfs_dir3_free_verify(bp);
+        if (fa) {
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
 
@@ -153,10 +164,11 @@ const struct xfs_buf_ops xfs_dir3_free_buf_ops = {
         .name = "xfs_dir3_free",
         .verify_read = xfs_dir3_free_read_verify,
         .verify_write = xfs_dir3_free_write_verify,
+        .verify_struct = xfs_dir3_free_verify,
 };
 
 /* Everything ok in the free block header? */
-static bool
+static xfs_failaddr_t
 xfs_dir3_free_header_check(
         struct xfs_inode        *dp,
         xfs_dablk_t             fbno,
@@ -174,22 +186,22 @@ xfs_dir3_free_header_check(
                 struct xfs_dir3_free_hdr *hdr3 = bp->b_addr;
 
                 if (be32_to_cpu(hdr3->firstdb) != firstdb)
-                        return false;
+                        return __this_address;
                 if (be32_to_cpu(hdr3->nvalid) > maxbests)
-                        return false;
+                        return __this_address;
                 if (be32_to_cpu(hdr3->nvalid) < be32_to_cpu(hdr3->nused))
-                        return false;
+                        return __this_address;
         } else {
                 struct xfs_dir2_free_hdr *hdr = bp->b_addr;
 
                 if (be32_to_cpu(hdr->firstdb) != firstdb)
-                        return false;
+                        return __this_address;
                 if (be32_to_cpu(hdr->nvalid) > maxbests)
-                        return false;
+                        return __this_address;
                 if (be32_to_cpu(hdr->nvalid) < be32_to_cpu(hdr->nused))
-                        return false;
+                        return __this_address;
         }
-        return true;
+        return NULL;
 }
 
 static int
@@ -200,6 +212,7 @@ __xfs_dir3_free_read(
         xfs_daddr_t             mappedbno,
         struct xfs_buf          **bpp)
 {
+        xfs_failaddr_t          fa;
         int                     err;
 
         err = xfs_da_read_buf(tp, dp, fbno, mappedbno, bpp,
@@ -208,9 +221,9 @@ __xfs_dir3_free_read(
                 return err;
 
         /* Check things that we can't do in the verifier. */
-        if (!xfs_dir3_free_header_check(dp, fbno, *bpp)) {
-                xfs_buf_ioerror(*bpp, -EFSCORRUPTED);
-                xfs_verifier_error(*bpp);
+        fa = xfs_dir3_free_header_check(dp, fbno, *bpp);
+        if (fa) {
+                xfs_verifier_error(*bpp, -EFSCORRUPTED, fa);
                 xfs_trans_brelse(tp, *bpp);
                 return -EFSCORRUPTED;
         }
@@ -1906,7 +1919,7 @@ xfs_dir2_node_addname_int(
                                         (unsigned long long)ifbno, lastfbno);
                                 if (fblk) {
                                         xfs_alert(mp,
-                                " fblk 0x%p blkno %llu index %d magic 0x%x",
+                                " fblk "PTR_FMT" blkno %llu index %d magic 0x%x",
                                                 fblk,
                                                 (unsigned long long)fblk->blkno,
                                                 fblk->index,
diff --git a/fs/xfs/libxfs/xfs_dir2_priv.h b/fs/xfs/libxfs/xfs_dir2_priv.h
index 4badd26c47e6..753aeeeffc18 100644
--- a/fs/xfs/libxfs/xfs_dir2_priv.h
+++ b/fs/xfs/libxfs/xfs_dir2_priv.h
@@ -39,12 +39,13 @@ extern int xfs_dir2_leaf_to_block(struct xfs_da_args *args,
 
 /* xfs_dir2_data.c */
 #ifdef DEBUG
-#define xfs_dir3_data_check(dp,bp) __xfs_dir3_data_check(dp, bp);
+extern void xfs_dir3_data_check(struct xfs_inode *dp, struct xfs_buf *bp);
 #else
 #define xfs_dir3_data_check(dp,bp)
 #endif
 
-extern int __xfs_dir3_data_check(struct xfs_inode *dp, struct xfs_buf *bp);
+extern xfs_failaddr_t __xfs_dir3_data_check(struct xfs_inode *dp,
+                struct xfs_buf *bp);
 extern int xfs_dir3_data_read(struct xfs_trans *tp, struct xfs_inode *dp,
                 xfs_dablk_t bno, xfs_daddr_t mapped_bno, struct xfs_buf **bpp);
 extern int xfs_dir3_data_readahead(struct xfs_inode *dp, xfs_dablk_t bno,
@@ -89,8 +90,9 @@ xfs_dir3_leaf_find_entry(struct xfs_dir3_icleaf_hdr *leafhdr,
                 int lowstale, int highstale, int *lfloglow, int *lfloghigh);
 extern int xfs_dir2_node_to_leaf(struct xfs_da_state *state);
 
-extern bool xfs_dir3_leaf_check_int(struct xfs_mount *mp, struct xfs_inode *dp,
-                struct xfs_dir3_icleaf_hdr *hdr, struct xfs_dir2_leaf *leaf);
+extern xfs_failaddr_t xfs_dir3_leaf_check_int(struct xfs_mount *mp,
+                struct xfs_inode *dp, struct xfs_dir3_icleaf_hdr *hdr,
+                struct xfs_dir2_leaf *leaf);
 
 /* xfs_dir2_node.c */
 extern int xfs_dir2_leaf_to_node(struct xfs_da_args *args,
@@ -127,7 +129,7 @@ extern int xfs_dir2_sf_create(struct xfs_da_args *args, xfs_ino_t pino);
 extern int xfs_dir2_sf_lookup(struct xfs_da_args *args);
 extern int xfs_dir2_sf_removename(struct xfs_da_args *args);
 extern int xfs_dir2_sf_replace(struct xfs_da_args *args);
-extern int xfs_dir2_sf_verify(struct xfs_inode *ip);
+extern xfs_failaddr_t xfs_dir2_sf_verify(struct xfs_inode *ip);
 
 /* xfs_dir2_readdir.c */
 extern int xfs_readdir(struct xfs_trans *tp, struct xfs_inode *dp,
diff --git a/fs/xfs/libxfs/xfs_dir2_sf.c b/fs/xfs/libxfs/xfs_dir2_sf.c
index be8b9755f66a..0c75a7f00883 100644
--- a/fs/xfs/libxfs/xfs_dir2_sf.c
+++ b/fs/xfs/libxfs/xfs_dir2_sf.c
@@ -156,7 +156,6 @@ xfs_dir2_block_to_sf(
         xfs_dir2_sf_hdr_t       *sfhp)          /* shortform directory hdr */
 {
         xfs_dir2_data_hdr_t     *hdr;           /* block header */
-        xfs_dir2_block_tail_t   *btp;           /* block tail pointer */
         xfs_dir2_data_entry_t   *dep;           /* data entry pointer */
         xfs_inode_t             *dp;            /* incore directory inode */
         xfs_dir2_data_unused_t  *dup;           /* unused data pointer */
@@ -192,9 +191,8 @@ xfs_dir2_block_to_sf(
         /*
          * Set up to loop over the block's entries.
          */
-        btp = xfs_dir2_block_tail_p(args->geo, hdr);
         ptr = (char *)dp->d_ops->data_entry_p(hdr);
-        endptr = (char *)xfs_dir2_block_leaf_p(btp);
+        endptr = xfs_dir3_data_endp(args->geo, hdr);
         sfep = xfs_dir2_sf_firstentry(sfp);
         /*
          * Loop over the active and unused entries.
@@ -630,7 +628,7 @@ xfs_dir2_sf_check(
 #endif  /* DEBUG */
 
 /* Verify the consistency of an inline directory. */
-int
+xfs_failaddr_t
 xfs_dir2_sf_verify(
         struct xfs_inode                *ip)
 {
@@ -665,7 +663,7 @@ xfs_dir2_sf_verify(
          */
         if (size <= offsetof(struct xfs_dir2_sf_hdr, parent) ||
             size < xfs_dir2_sf_hdr_size(sfp->i8count))
-                return -EFSCORRUPTED;
+                return __this_address;
 
         endp = (char *)sfp + size;
 
@@ -674,7 +672,7 @@ xfs_dir2_sf_verify(
         i8count = ino > XFS_DIR2_MAX_SHORT_INUM;
         error = xfs_dir_ino_validate(mp, ino);
         if (error)
-                return error;
+                return __this_address;
         offset = dops->data_first_offset;
 
         /* Check all reported entries */
@@ -686,11 +684,11 @@ xfs_dir2_sf_verify(
                  * within the data buffer.
                  */
                 if (((char *)sfep + sizeof(*sfep)) >= endp)
-                        return -EFSCORRUPTED;
+                        return __this_address;
 
                 /* Don't allow names with known bad length. */
                 if (sfep->namelen == 0)
-                        return -EFSCORRUPTED;
+                        return __this_address;
 
                 /*
                  * Check that the variable-length part of the structure is
@@ -699,23 +697,23 @@ xfs_dir2_sf_verify(
                  */
                 next_sfep = dops->sf_nextentry(sfp, sfep);
                 if (endp < (char *)next_sfep)
-                        return -EFSCORRUPTED;
+                        return __this_address;
 
                 /* Check that the offsets always increase. */
                 if (xfs_dir2_sf_get_offset(sfep) < offset)
-                        return -EFSCORRUPTED;
+                        return __this_address;
 
                 /* Check the inode number. */
                 ino = dops->sf_get_ino(sfp, sfep);
                 i8count += ino > XFS_DIR2_MAX_SHORT_INUM;
                 error = xfs_dir_ino_validate(mp, ino);
                 if (error)
-                        return error;
+                        return __this_address;
 
                 /* Check the file type. */
                 filetype = dops->sf_get_ftype(sfep);
                 if (filetype >= XFS_DIR3_FT_MAX)
-                        return -EFSCORRUPTED;
+                        return __this_address;
 
                 offset = xfs_dir2_sf_get_offset(sfep) +
                                 dops->data_entsize(sfep->namelen);
@@ -723,16 +721,16 @@ xfs_dir2_sf_verify(
                 sfep = next_sfep;
         }
         if (i8count != sfp->i8count)
-                return -EFSCORRUPTED;
+                return __this_address;
         if ((void *)sfep != (void *)endp)
-                return -EFSCORRUPTED;
+                return __this_address;
 
         /* Make sure this whole thing ought to be in local format. */
         if (offset + (sfp->count + 2) * (uint)sizeof(xfs_dir2_leaf_entry_t) +
             (uint)sizeof(xfs_dir2_block_tail_t) > mp->m_dir_geo->blksize)
-                return -EFSCORRUPTED;
+                return __this_address;
 
-        return 0;
+        return NULL;
 }
 
 /*
diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c
index 747085b4ef44..8b7a6c3cb599 100644
--- a/fs/xfs/libxfs/xfs_dquot_buf.c
+++ b/fs/xfs/libxfs/xfs_dquot_buf.c
@@ -42,18 +42,14 @@ xfs_calc_dquots_per_chunk(
 /*
  * Do some primitive error checking on ondisk dquot data structures.
  */
-int
-xfs_dqcheck(
+xfs_failaddr_t
+xfs_dquot_verify(
         struct xfs_mount *mp,
         xfs_disk_dquot_t *ddq,
         xfs_dqid_t       id,
         uint             type,    /* used only when IO_dorepair is true */
-        uint             flags,
-        const char       *str)
+        uint             flags)
 {
-        xfs_dqblk_t      *d = (xfs_dqblk_t *)ddq;
-        int             errs = 0;
-
         /*
          * We can encounter an uninitialized dquot buffer for 2 reasons:
          * 1. If we crash while deleting the quotainode(s), and those blks got
@@ -69,87 +65,57 @@ xfs_dqcheck(
          * This is all fine; things are still consistent, and we haven't lost
          * any quota information. Just don't complain about bad dquot blks.
          */
-        if (ddq->d_magic != cpu_to_be16(XFS_DQUOT_MAGIC)) {
-                if (flags & XFS_QMOPT_DOWARN)
-                        xfs_alert(mp,
-                        "%s : XFS dquot ID 0x%x, magic 0x%x != 0x%x",
-                        str, id, be16_to_cpu(ddq->d_magic), XFS_DQUOT_MAGIC);
-                errs++;
-        }
-        if (ddq->d_version != XFS_DQUOT_VERSION) {
-                if (flags & XFS_QMOPT_DOWARN)
-                        xfs_alert(mp,
-                        "%s : XFS dquot ID 0x%x, version 0x%x != 0x%x",
-                        str, id, ddq->d_version, XFS_DQUOT_VERSION);
-                errs++;
-        }
+        if (ddq->d_magic != cpu_to_be16(XFS_DQUOT_MAGIC))
+                return __this_address;
+        if (ddq->d_version != XFS_DQUOT_VERSION)
+                return __this_address;
 
         if (ddq->d_flags != XFS_DQ_USER &&
             ddq->d_flags != XFS_DQ_PROJ &&
-            ddq->d_flags != XFS_DQ_GROUP) {
-                if (flags & XFS_QMOPT_DOWARN)
-                        xfs_alert(mp,
-                        "%s : XFS dquot ID 0x%x, unknown flags 0x%x",
-                        str, id, ddq->d_flags);
-                errs++;
-        }
+            ddq->d_flags != XFS_DQ_GROUP)
+                return __this_address;
 
-        if (id != -1 && id != be32_to_cpu(ddq->d_id)) {
-                if (flags & XFS_QMOPT_DOWARN)
-                        xfs_alert(mp,
-                        "%s : ondisk-dquot 0x%p, ID mismatch: "
-                        "0x%x expected, found id 0x%x",
-                        str, ddq, id, be32_to_cpu(ddq->d_id));
-                errs++;
-        }
+        if (id != -1 && id != be32_to_cpu(ddq->d_id))
+                return __this_address;
 
-        if (!errs && ddq->d_id) {
-                if (ddq->d_blk_softlimit &&
-                    be64_to_cpu(ddq->d_bcount) >
-                                be64_to_cpu(ddq->d_blk_softlimit)) {
-                        if (!ddq->d_btimer) {
-                                if (flags & XFS_QMOPT_DOWARN)
-                                        xfs_alert(mp,
-                        "%s : Dquot ID 0x%x (0x%p) BLK TIMER NOT STARTED",
-                                        str, (int)be32_to_cpu(ddq->d_id), ddq);
-                                errs++;
-                        }
-                }
-                if (ddq->d_ino_softlimit &&
-                    be64_to_cpu(ddq->d_icount) >
-                                be64_to_cpu(ddq->d_ino_softlimit)) {
-                        if (!ddq->d_itimer) {
-                                if (flags & XFS_QMOPT_DOWARN)
-                                        xfs_alert(mp,
-                        "%s : Dquot ID 0x%x (0x%p) INODE TIMER NOT STARTED",
-                                        str, (int)be32_to_cpu(ddq->d_id), ddq);
-                                errs++;
-                        }
-                }
-                if (ddq->d_rtb_softlimit &&
-                    be64_to_cpu(ddq->d_rtbcount) >
-                                be64_to_cpu(ddq->d_rtb_softlimit)) {
-                        if (!ddq->d_rtbtimer) {
-                                if (flags & XFS_QMOPT_DOWARN)
-                                        xfs_alert(mp,
-                        "%s : Dquot ID 0x%x (0x%p) RTBLK TIMER NOT STARTED",
-                                        str, (int)be32_to_cpu(ddq->d_id), ddq);
-                                errs++;
-                        }
-                }
-        }
+        if (!ddq->d_id)
+                return NULL;
+
+        if (ddq->d_blk_softlimit &&
+            be64_to_cpu(ddq->d_bcount) > be64_to_cpu(ddq->d_blk_softlimit) &&
+            !ddq->d_btimer)
+                return __this_address;
+
+        if (ddq->d_ino_softlimit &&
+            be64_to_cpu(ddq->d_icount) > be64_to_cpu(ddq->d_ino_softlimit) &&
+            !ddq->d_itimer)
+                return __this_address;
 
-        if (!errs || !(flags & XFS_QMOPT_DQREPAIR))
-                return errs;
+        if (ddq->d_rtb_softlimit &&
+            be64_to_cpu(ddq->d_rtbcount) > be64_to_cpu(ddq->d_rtb_softlimit) &&
+            !ddq->d_rtbtimer)
+                return __this_address;
+
+        return NULL;
+}
+
+/*
+ * Do some primitive error checking on ondisk dquot data structures.
+ */
+int
+xfs_dquot_repair(
+        struct xfs_mount        *mp,
+        struct xfs_disk_dquot   *ddq,
+        xfs_dqid_t              id,
+        uint                    type)
+{
+        struct xfs_dqblk        *d = (struct xfs_dqblk *)ddq;
 
-        if (flags & XFS_QMOPT_DOWARN)
-                xfs_notice(mp, "Re-initializing dquot ID 0x%x", id);
 
         /*
          * Typically, a repair is only requested by quotacheck.
          */
         ASSERT(id != -1);
-        ASSERT(flags & XFS_QMOPT_DQREPAIR);
         memset(d, 0, sizeof(xfs_dqblk_t));
 
         d->dd_diskdq.d_magic = cpu_to_be16(XFS_DQUOT_MAGIC);
@@ -163,7 +129,7 @@ xfs_dqcheck(
                                  XFS_DQUOT_CRC_OFF);
         }
 
-        return errs;
+        return 0;
 }
 
 STATIC bool
@@ -198,13 +164,13 @@ xfs_dquot_buf_verify_crc(
         return true;
 }
 
-STATIC bool
+STATIC xfs_failaddr_t
 xfs_dquot_buf_verify(
         struct xfs_mount        *mp,
-        struct xfs_buf          *bp,
-        int                     warn)
+        struct xfs_buf          *bp)
 {
         struct xfs_dqblk        *d = (struct xfs_dqblk *)bp->b_addr;
+        xfs_failaddr_t          fa;
         xfs_dqid_t              id = 0;
         int                     ndquots;
         int                     i;
@@ -228,33 +194,43 @@ xfs_dquot_buf_verify(
          */
         for (i = 0; i < ndquots; i++) {
                 struct xfs_disk_dquot   *ddq;
-                int                     error;
 
                 ddq = &d[i].dd_diskdq;
 
                 if (i == 0)
                         id = be32_to_cpu(ddq->d_id);
 
-                error = xfs_dqcheck(mp, ddq, id + i, 0, warn, __func__);
-                if (error)
-                        return false;
+                fa = xfs_dquot_verify(mp, ddq, id + i, 0, 0);
+                if (fa)
+                        return fa;
         }
-        return true;
+
+        return NULL;
+}
+
+static xfs_failaddr_t
+xfs_dquot_buf_verify_struct(
+        struct xfs_buf          *bp)
+{
+        struct xfs_mount        *mp = bp->b_target->bt_mount;
+
+        return xfs_dquot_buf_verify(mp, bp);
 }
 
 static void
 xfs_dquot_buf_read_verify(
-        struct xfs_buf  *bp)
+        struct xfs_buf          *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t          fa;
 
         if (!xfs_dquot_buf_verify_crc(mp, bp))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_dquot_buf_verify(mp, bp, XFS_QMOPT_DOWARN))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-
-        if (bp->b_error)
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_dquot_buf_verify(mp, bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, __this_address);
+        }
 }
 
 /*
@@ -270,7 +246,7 @@ xfs_dquot_buf_readahead_verify(
         struct xfs_mount        *mp = bp->b_target->bt_mount;
 
         if (!xfs_dquot_buf_verify_crc(mp, bp) ||
-            !xfs_dquot_buf_verify(mp, bp, 0)) {
+            xfs_dquot_buf_verify(mp, bp) != NULL) {
                 xfs_buf_ioerror(bp, -EIO);
                 bp->b_flags &= ~XBF_DONE;
         }
@@ -283,21 +259,21 @@ xfs_dquot_buf_readahead_verify(
  */
 static void
 xfs_dquot_buf_write_verify(
-        struct xfs_buf  *bp)
+        struct xfs_buf          *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t          fa;
 
-        if (!xfs_dquot_buf_verify(mp, bp, XFS_QMOPT_DOWARN)) {
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
-                return;
-        }
+        fa = xfs_dquot_buf_verify(mp, bp);
+        if (fa)
+                xfs_verifier_error(bp, -EFSCORRUPTED, __this_address);
 }
 
 const struct xfs_buf_ops xfs_dquot_buf_ops = {
         .name = "xfs_dquot",
         .verify_read = xfs_dquot_buf_read_verify,
         .verify_write = xfs_dquot_buf_write_verify,
+        .verify_struct = xfs_dquot_buf_verify_struct,
 };
 
 const struct xfs_buf_ops xfs_dquot_buf_ra_ops = {
diff --git a/fs/xfs/libxfs/xfs_fs.h b/fs/xfs/libxfs/xfs_fs.h
index b90924104596..faf1a4edd618 100644
--- a/fs/xfs/libxfs/xfs_fs.h
+++ b/fs/xfs/libxfs/xfs_fs.h
@@ -233,6 +233,13 @@ typedef struct xfs_fsop_resblks {
 #define XFS_MAX_LOG_BLOCKS      (1024 * 1024ULL)
 #define XFS_MIN_LOG_BYTES       (10 * 1024 * 1024ULL)
 
+/*
+ * Limits on sb_agblocks/sb_agblklog -- mkfs won't format AGs smaller than
+ * 16MB or larger than 1TB.
+ */
+#define XFS_MIN_AG_BYTES        (1ULL << 24)    /* 16 MB */
+#define XFS_MAX_AG_BYTES        (1ULL << 40)    /* 1 TB */
+
 /* keep the maximum size under 2^31 by a small amount */
 #define XFS_MAX_LOG_BYTES \
         ((2 * 1024 * 1024 * 1024ULL) - XFS_MIN_LOG_BYTES)
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index 3b57ef0f2f76..0e2cf5f0be1f 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -2491,7 +2491,7 @@ xfs_check_agi_unlinked(
 #define xfs_check_agi_unlinked(agi)
 #endif
 
-static bool
+static xfs_failaddr_t
 xfs_agi_verify(
         struct xfs_buf  *bp)
 {
@@ -2500,28 +2500,28 @@ xfs_agi_verify(
 
         if (xfs_sb_version_hascrc(&mp->m_sb)) {
                 if (!uuid_equal(&agi->agi_uuid, &mp->m_sb.sb_meta_uuid))
-                        return false;
+                        return __this_address;
                 if (!xfs_log_check_lsn(mp,
                                 be64_to_cpu(XFS_BUF_TO_AGI(bp)->agi_lsn)))
-                        return false;
+                        return __this_address;
         }
 
         /*
          * Validate the magic number of the agi block.
          */
         if (agi->agi_magicnum != cpu_to_be32(XFS_AGI_MAGIC))
-                return false;
+                return __this_address;
         if (!XFS_AGI_GOOD_VERSION(be32_to_cpu(agi->agi_versionnum)))
-                return false;
+                return __this_address;
 
         if (be32_to_cpu(agi->agi_level) < 1 ||
             be32_to_cpu(agi->agi_level) > XFS_BTREE_MAXLEVELS)
-                return false;
+                return __this_address;
 
         if (xfs_sb_version_hasfinobt(&mp->m_sb) &&
             (be32_to_cpu(agi->agi_free_level) < 1 ||
              be32_to_cpu(agi->agi_free_level) > XFS_BTREE_MAXLEVELS))
-                return false;
+                return __this_address;
 
         /*
          * during growfs operations, the perag is not fully initialised,
@@ -2530,10 +2530,10 @@ xfs_agi_verify(
          * so we can detect and avoid this problem.
          */
         if (bp->b_pag && be32_to_cpu(agi->agi_seqno) != bp->b_pag->pag_agno)
-                return false;
+                return __this_address;
 
         xfs_check_agi_unlinked(agi);
-        return true;
+        return NULL;
 }
 
 static void
@@ -2541,28 +2541,29 @@ xfs_agi_read_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t  fa;
 
         if (xfs_sb_version_hascrc(&mp->m_sb) &&
             !xfs_buf_verify_cksum(bp, XFS_AGI_CRC_OFF))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (XFS_TEST_ERROR(!xfs_agi_verify(bp), mp,
-                                XFS_ERRTAG_IALLOC_READ_AGI))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-
-        if (bp->b_error)
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_agi_verify(bp);
+                if (XFS_TEST_ERROR(fa, mp, XFS_ERRTAG_IALLOC_READ_AGI))
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 }
 
 static void
 xfs_agi_write_verify(
         struct xfs_buf  *bp)
 {
-        struct xfs_mount *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_mount        *mp = bp->b_target->bt_mount;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
+        xfs_failaddr_t          fa;
 
-        if (!xfs_agi_verify(bp)) {
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+        fa = xfs_agi_verify(bp);
+        if (fa) {
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
 
@@ -2578,6 +2579,7 @@ const struct xfs_buf_ops xfs_agi_buf_ops = {
         .name = "xfs_agi",
         .verify_read = xfs_agi_read_verify,
         .verify_write = xfs_agi_write_verify,
+        .verify_struct = xfs_agi_verify,
 };
 
 /*
@@ -2751,3 +2753,102 @@ xfs_verify_dir_ino(
                 return false;
         return xfs_verify_ino(mp, ino);
 }
+
+/* Is there an inode record covering a given range of inode numbers? */
+int
+xfs_ialloc_has_inode_record(
+        struct xfs_btree_cur    *cur,
+        xfs_agino_t             low,
+        xfs_agino_t             high,
+        bool                    *exists)
+{
+        struct xfs_inobt_rec_incore     irec;
+        xfs_agino_t             agino;
+        uint16_t                holemask;
+        int                     has_record;
+        int                     i;
+        int                     error;
+
+        *exists = false;
+        error = xfs_inobt_lookup(cur, low, XFS_LOOKUP_LE, &has_record);
+        while (error == 0 && has_record) {
+                error = xfs_inobt_get_rec(cur, &irec, &has_record);
+                if (error || irec.ir_startino > high)
+                        break;
+
+                agino = irec.ir_startino;
+                holemask = irec.ir_holemask;
+                for (i = 0; i < XFS_INOBT_HOLEMASK_BITS; holemask >>= 1,
+                                i++, agino += XFS_INODES_PER_HOLEMASK_BIT) {
+                        if (holemask & 1)
+                                continue;
+                        if (agino + XFS_INODES_PER_HOLEMASK_BIT > low &&
+                                        agino <= high) {
+                                *exists = true;
+                                return 0;
+                        }
+                }
+
+                error = xfs_btree_increment(cur, 0, &has_record);
+        }
+        return error;
+}
+
+/* Is there an inode record covering a given extent? */
+int
+xfs_ialloc_has_inodes_at_extent(
+        struct xfs_btree_cur    *cur,
+        xfs_agblock_t           bno,
+        xfs_extlen_t            len,
+        bool                    *exists)
+{
+        xfs_agino_t             low;
+        xfs_agino_t             high;
+
+        low = XFS_OFFBNO_TO_AGINO(cur->bc_mp, bno, 0);
+        high = XFS_OFFBNO_TO_AGINO(cur->bc_mp, bno + len, 0) - 1;
+
+        return xfs_ialloc_has_inode_record(cur, low, high, exists);
+}
+
+struct xfs_ialloc_count_inodes {
+        xfs_agino_t                     count;
+        xfs_agino_t                     freecount;
+};
+
+/* Record inode counts across all inobt records. */
+STATIC int
+xfs_ialloc_count_inodes_rec(
+        struct xfs_btree_cur            *cur,
+        union xfs_btree_rec             *rec,
+        void                            *priv)
+{
+        struct xfs_inobt_rec_incore     irec;
+        struct xfs_ialloc_count_inodes  *ci = priv;
+
+        xfs_inobt_btrec_to_irec(cur->bc_mp, rec, &irec);
+        ci->count += irec.ir_count;
+        ci->freecount += irec.ir_freecount;
+
+        return 0;
+}
+
+/* Count allocated and free inodes under an inobt. */
+int
+xfs_ialloc_count_inodes(
+        struct xfs_btree_cur            *cur,
+        xfs_agino_t                     *count,
+        xfs_agino_t                     *freecount)
+{
+        struct xfs_ialloc_count_inodes  ci = {0};
+        int                             error;
+
+        ASSERT(cur->bc_btnum == XFS_BTNUM_INO);
+        error = xfs_btree_query_all(cur, xfs_ialloc_count_inodes_rec, &ci);
+        if (error)
+                return error;
+
+        *count = ci.count;
+        *freecount = ci.freecount;
+        return 0;
+}
diff --git a/fs/xfs/libxfs/xfs_ialloc.h b/fs/xfs/libxfs/xfs_ialloc.h
index 66a8de0b1caa..c5402bb4ce0c 100644
--- a/fs/xfs/libxfs/xfs_ialloc.h
+++ b/fs/xfs/libxfs/xfs_ialloc.h
@@ -170,6 +170,12 @@ int xfs_read_agi(struct xfs_mount *mp, struct xfs_trans *tp,
 union xfs_btree_rec;
 void xfs_inobt_btrec_to_irec(struct xfs_mount *mp, union xfs_btree_rec *rec,
                 struct xfs_inobt_rec_incore *irec);
+int xfs_ialloc_has_inodes_at_extent(struct xfs_btree_cur *cur,
+                xfs_agblock_t bno, xfs_extlen_t len, bool *exists);
+int xfs_ialloc_has_inode_record(struct xfs_btree_cur *cur, xfs_agino_t low,
+                xfs_agino_t high, bool *exists);
+int xfs_ialloc_count_inodes(struct xfs_btree_cur *cur, xfs_agino_t *count,
+                xfs_agino_t *freecount);
 
 int xfs_ialloc_cluster_alignment(struct xfs_mount *mp);
 void xfs_ialloc_agino_range(struct xfs_mount *mp, xfs_agnumber_t agno,
diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c
index 317caba9faa6..af197a5f3a82 100644
--- a/fs/xfs/libxfs/xfs_ialloc_btree.c
+++ b/fs/xfs/libxfs/xfs_ialloc_btree.c
@@ -141,21 +141,42 @@ xfs_finobt_alloc_block(
         union xfs_btree_ptr     *new,
         int                     *stat)
 {
+        if (cur->bc_mp->m_inotbt_nores)
+                return xfs_inobt_alloc_block(cur, start, new, stat);
         return __xfs_inobt_alloc_block(cur, start, new, stat,
                         XFS_AG_RESV_METADATA);
 }
 
 STATIC int
-xfs_inobt_free_block(
+__xfs_inobt_free_block(
         struct xfs_btree_cur    *cur,
-        struct xfs_buf          *bp)
+        struct xfs_buf          *bp,
+        enum xfs_ag_resv_type   resv)
 {
         struct xfs_owner_info   oinfo;
 
         xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_INOBT);
         return xfs_free_extent(cur->bc_tp,
                         XFS_DADDR_TO_FSB(cur->bc_mp, XFS_BUF_ADDR(bp)), 1,
-                        &oinfo, XFS_AG_RESV_NONE);
+                        &oinfo, resv);
+}
+
+STATIC int
+xfs_inobt_free_block(
+        struct xfs_btree_cur    *cur,
+        struct xfs_buf          *bp)
+{
+        return __xfs_inobt_free_block(cur, bp, XFS_AG_RESV_NONE);
+}
+
+STATIC int
+xfs_finobt_free_block(
+        struct xfs_btree_cur    *cur,
+        struct xfs_buf          *bp)
+{
+        if (cur->bc_mp->m_inotbt_nores)
+                return xfs_inobt_free_block(cur, bp);
+        return __xfs_inobt_free_block(cur, bp, XFS_AG_RESV_METADATA);
 }
 
 STATIC int
@@ -250,12 +271,13 @@ xfs_inobt_diff_two_keys(
                           be32_to_cpu(k2->inobt.ir_startino);
 }
 
-static int
+static xfs_failaddr_t
 xfs_inobt_verify(
         struct xfs_buf          *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
         struct xfs_btree_block  *block = XFS_BUF_TO_BLOCK(bp);
+        xfs_failaddr_t          fa;
         unsigned int            level;
 
         /*
@@ -271,20 +293,21 @@ xfs_inobt_verify(
         switch (block->bb_magic) {
         case cpu_to_be32(XFS_IBT_CRC_MAGIC):
         case cpu_to_be32(XFS_FIBT_CRC_MAGIC):
-                if (!xfs_btree_sblock_v5hdr_verify(bp))
-                        return false;
+                fa = xfs_btree_sblock_v5hdr_verify(bp);
+                if (fa)
+                        return fa;
                 /* fall through */
         case cpu_to_be32(XFS_IBT_MAGIC):
         case cpu_to_be32(XFS_FIBT_MAGIC):
                 break;
         default:
-                return 0;
+                return NULL;
         }
 
         /* level verification */
         level = be16_to_cpu(block->bb_level);
         if (level >= mp->m_in_maxlevels)
-                return false;
+                return __this_address;
 
         return xfs_btree_sblock_verify(bp, mp->m_inobt_mxr[level != 0]);
 }
@@ -293,25 +316,30 @@ static void
 xfs_inobt_read_verify(
         struct xfs_buf  *bp)
 {
+        xfs_failaddr_t  fa;
+
         if (!xfs_btree_sblock_verify_crc(bp))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_inobt_verify(bp))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_inobt_verify(bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 
-        if (bp->b_error) {
+        if (bp->b_error)
                 trace_xfs_btree_corrupt(bp, _RET_IP_);
-                xfs_verifier_error(bp);
-        }
 }
 
 static void
 xfs_inobt_write_verify(
         struct xfs_buf  *bp)
 {
-        if (!xfs_inobt_verify(bp)) {
+        xfs_failaddr_t  fa;
+
+        fa = xfs_inobt_verify(bp);
+        if (fa) {
                 trace_xfs_btree_corrupt(bp, _RET_IP_);
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
         xfs_btree_sblock_calc_crc(bp);
@@ -322,6 +350,7 @@ const struct xfs_buf_ops xfs_inobt_buf_ops = {
         .name = "xfs_inobt",
         .verify_read = xfs_inobt_read_verify,
         .verify_write = xfs_inobt_write_verify,
+        .verify_struct = xfs_inobt_verify,
 };
 
 STATIC int
@@ -372,7 +401,7 @@ static const struct xfs_btree_ops xfs_finobt_ops = {
         .dup_cursor             = xfs_inobt_dup_cursor,
         .set_root               = xfs_finobt_set_root,
         .alloc_block            = xfs_finobt_alloc_block,
-        .free_block             = xfs_inobt_free_block,
+        .free_block             = xfs_finobt_free_block,
         .get_minrecs            = xfs_inobt_get_minrecs,
         .get_maxrecs            = xfs_inobt_get_maxrecs,
         .init_key_from_rec      = xfs_inobt_init_key_from_rec,
diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
index b9c0bf80669c..4fe17b368316 100644
--- a/fs/xfs/libxfs/xfs_inode_buf.c
+++ b/fs/xfs/libxfs/xfs_inode_buf.c
@@ -115,8 +115,7 @@ xfs_inode_buf_verify(
                                 return;
                         }
 
-                        xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                        xfs_verifier_error(bp);
+                        xfs_verifier_error(bp, -EFSCORRUPTED, __this_address);
 #ifdef DEBUG
                         xfs_alert(mp,
                                 "bad inode magic/vsn daddr %lld #%d (magic=%x)",
@@ -384,7 +383,7 @@ xfs_log_dinode_to_disk(
         }
 }
 
-bool
+xfs_failaddr_t
 xfs_dinode_verify(
         struct xfs_mount        *mp,
         xfs_ino_t               ino,
@@ -393,53 +392,122 @@ xfs_dinode_verify(
         uint16_t                mode;
         uint16_t                flags;
         uint64_t                flags2;
+        uint64_t                di_size;
 
         if (dip->di_magic != cpu_to_be16(XFS_DINODE_MAGIC))
-                return false;
+                return __this_address;
+
+        /* Verify v3 integrity information first */
+        if (dip->di_version >= 3) {
+                if (!xfs_sb_version_hascrc(&mp->m_sb))
+                        return __this_address;
+                if (!xfs_verify_cksum((char *)dip, mp->m_sb.sb_inodesize,
+                                      XFS_DINODE_CRC_OFF))
+                        return __this_address;
+                if (be64_to_cpu(dip->di_ino) != ino)
+                        return __this_address;
+                if (!uuid_equal(&dip->di_uuid, &mp->m_sb.sb_meta_uuid))
+                        return __this_address;
+        }
 
         /* don't allow invalid i_size */
-        if (be64_to_cpu(dip->di_size) & (1ULL << 63))
-                return false;
+        di_size = be64_to_cpu(dip->di_size);
+        if (di_size & (1ULL << 63))
+                return __this_address;
 
         mode = be16_to_cpu(dip->di_mode);
         if (mode && xfs_mode_to_ftype(mode) == XFS_DIR3_FT_UNKNOWN)
-                return false;
+                return __this_address;
 
         /* No zero-length symlinks/dirs. */
-        if ((S_ISLNK(mode) || S_ISDIR(mode)) && dip->di_size == 0)
-                return false;
+        if ((S_ISLNK(mode) || S_ISDIR(mode)) && di_size == 0)
+                return __this_address;
+
+        /* Fork checks carried over from xfs_iformat_fork */
+        if (mode &&
+            be32_to_cpu(dip->di_nextents) + be16_to_cpu(dip->di_anextents) >
+                        be64_to_cpu(dip->di_nblocks))
+                return __this_address;
+
+        if (mode && XFS_DFORK_BOFF(dip) > mp->m_sb.sb_inodesize)
+                return __this_address;
+
+        flags = be16_to_cpu(dip->di_flags);
+
+        if (mode && (flags & XFS_DIFLAG_REALTIME) && !mp->m_rtdev_targp)
+                return __this_address;
+
+        /* Do we have appropriate data fork formats for the mode? */
+        switch (mode & S_IFMT) {
+        case S_IFIFO:
+        case S_IFCHR:
+        case S_IFBLK:
+        case S_IFSOCK:
+                if (dip->di_format != XFS_DINODE_FMT_DEV)
+                        return __this_address;
+                break;
+        case S_IFREG:
+        case S_IFLNK:
+        case S_IFDIR:
+                switch (dip->di_format) {
+                case XFS_DINODE_FMT_LOCAL:
+                        /*
+                         * no local regular files yet
+                         */
+                        if (S_ISREG(mode))
+                                return __this_address;
+                        if (di_size > XFS_DFORK_DSIZE(dip, mp))
+                                return __this_address;
+                        /* fall through */
+                case XFS_DINODE_FMT_EXTENTS:
+                case XFS_DINODE_FMT_BTREE:
+                        break;
+                default:
+                        return __this_address;
+                }
+                break;
+        case 0:
+                /* Uninitialized inode ok. */
+                break;
+        default:
+                return __this_address;
+        }
+
+        if (XFS_DFORK_Q(dip)) {
+                switch (dip->di_aformat) {
+                case XFS_DINODE_FMT_LOCAL:
+                case XFS_DINODE_FMT_EXTENTS:
+                case XFS_DINODE_FMT_BTREE:
+                        break;
+                default:
+                        return __this_address;
+                }
+        }
 
         /* only version 3 or greater inodes are extensively verified here */
         if (dip->di_version < 3)
-                return true;
-
-        if (!xfs_sb_version_hascrc(&mp->m_sb))
-                return false;
-        if (!xfs_verify_cksum((char *)dip, mp->m_sb.sb_inodesize,
-                              XFS_DINODE_CRC_OFF))
-                return false;
-        if (be64_to_cpu(dip->di_ino) != ino)
-                return false;
-        if (!uuid_equal(&dip->di_uuid, &mp->m_sb.sb_meta_uuid))
-                return false;
+                return NULL;
 
-        flags = be16_to_cpu(dip->di_flags);
         flags2 = be64_to_cpu(dip->di_flags2);
 
         /* don't allow reflink/cowextsize if we don't have reflink */
         if ((flags2 & (XFS_DIFLAG2_REFLINK | XFS_DIFLAG2_COWEXTSIZE)) &&
             !xfs_sb_version_hasreflink(&mp->m_sb))
-                return false;
+                return __this_address;
+
+        /* only regular files get reflink */
+        if ((flags2 & XFS_DIFLAG2_REFLINK) && (mode & S_IFMT) != S_IFREG)
+                return __this_address;
 
         /* don't let reflink and realtime mix */
         if ((flags2 & XFS_DIFLAG2_REFLINK) && (flags & XFS_DIFLAG_REALTIME))
-                return false;
+                return __this_address;
 
         /* don't let reflink and dax mix */
         if ((flags2 & XFS_DIFLAG2_REFLINK) && (flags2 & XFS_DIFLAG2_DAX))
-                return false;
+                return __this_address;
 
-        return true;
+        return NULL;
 }
 
 void
@@ -479,6 +547,7 @@ xfs_iread(
 {
         xfs_buf_t       *bp;
         xfs_dinode_t    *dip;
+        xfs_failaddr_t  fa;
         int             error;
 
         /*
@@ -510,11 +579,10 @@ xfs_iread(
                 return error;
 
         /* even unallocated inodes are verified */
-        if (!xfs_dinode_verify(mp, ip->i_ino, dip)) {
-                xfs_alert(mp, "%s: validation failed for inode %lld",
-                                __func__, ip->i_ino);
-
-                XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, dip);
+        fa = xfs_dinode_verify(mp, ip->i_ino, dip);
+        if (fa) {
+                xfs_inode_verifier_error(ip, -EFSCORRUPTED, "dinode", dip,
+                                sizeof(*dip), fa);
                 error = -EFSCORRUPTED;
                 goto out_brelse;
         }
diff --git a/fs/xfs/libxfs/xfs_inode_buf.h b/fs/xfs/libxfs/xfs_inode_buf.h
index a9c97a356c30..8a5e1da52d74 100644
--- a/fs/xfs/libxfs/xfs_inode_buf.h
+++ b/fs/xfs/libxfs/xfs_inode_buf.h
@@ -82,7 +82,7 @@ void	xfs_inobp_check(struct xfs_mount *, struct xfs_buf *);
 #define xfs_inobp_check(mp, bp)
 #endif /* DEBUG */
 
-bool    xfs_dinode_verify(struct xfs_mount *mp, xfs_ino_t ino,
-                          struct xfs_dinode *dip);
+xfs_failaddr_t xfs_dinode_verify(struct xfs_mount *mp, xfs_ino_t ino,
+                           struct xfs_dinode *dip);
 
 #endif  /* __XFS_INODE_BUF_H__ */
diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c
index c79a1616b79d..866d2861c625 100644
--- a/fs/xfs/libxfs/xfs_inode_fork.c
+++ b/fs/xfs/libxfs/xfs_inode_fork.c
@@ -35,6 +35,8 @@
 #include "xfs_da_format.h"
 #include "xfs_da_btree.h"
 #include "xfs_dir2_priv.h"
+#include "xfs_attr_leaf.h"
+#include "xfs_shared.h"
 
 kmem_zone_t *xfs_ifork_zone;
 
@@ -62,69 +64,11 @@ xfs_iformat_fork(
         int                     error = 0;
         xfs_fsize_t             di_size;
 
-        if (unlikely(be32_to_cpu(dip->di_nextents) +
-                     be16_to_cpu(dip->di_anextents) >
-                     be64_to_cpu(dip->di_nblocks))) {
-                xfs_warn(ip->i_mount,
-                        "corrupt dinode %Lu, extent total = %d, nblocks = %Lu.",
-                        (unsigned long long)ip->i_ino,
-                        (int)(be32_to_cpu(dip->di_nextents) +
-                              be16_to_cpu(dip->di_anextents)),
-                        (unsigned long long)
-                                be64_to_cpu(dip->di_nblocks));
-                XFS_CORRUPTION_ERROR("xfs_iformat(1)", XFS_ERRLEVEL_LOW,
-                                     ip->i_mount, dip);
-                return -EFSCORRUPTED;
-        }
-
-        if (unlikely(dip->di_forkoff > ip->i_mount->m_sb.sb_inodesize)) {
-                xfs_warn(ip->i_mount, "corrupt dinode %Lu, forkoff = 0x%x.",
-                        (unsigned long long)ip->i_ino,
-                        dip->di_forkoff);
-                XFS_CORRUPTION_ERROR("xfs_iformat(2)", XFS_ERRLEVEL_LOW,
-                                     ip->i_mount, dip);
-                return -EFSCORRUPTED;
-        }
-
-        if (unlikely((ip->i_d.di_flags & XFS_DIFLAG_REALTIME) &&
-                     !ip->i_mount->m_rtdev_targp)) {
-                xfs_warn(ip->i_mount,
-                        "corrupt dinode %Lu, has realtime flag set.",
-                        ip->i_ino);
-                XFS_CORRUPTION_ERROR("xfs_iformat(realtime)",
-                                     XFS_ERRLEVEL_LOW, ip->i_mount, dip);
-                return -EFSCORRUPTED;
-        }
-
-        if (unlikely(xfs_is_reflink_inode(ip) && !S_ISREG(inode->i_mode))) {
-                xfs_warn(ip->i_mount,
-                        "corrupt dinode %llu, wrong file type for reflink.",
-                        ip->i_ino);
-                XFS_CORRUPTION_ERROR("xfs_iformat(reflink)",
-                                     XFS_ERRLEVEL_LOW, ip->i_mount, dip);
-                return -EFSCORRUPTED;
-        }
-
-        if (unlikely(xfs_is_reflink_inode(ip) &&
-            (ip->i_d.di_flags & XFS_DIFLAG_REALTIME))) {
-                xfs_warn(ip->i_mount,
-                        "corrupt dinode %llu, has reflink+realtime flag set.",
-                        ip->i_ino);
-                XFS_CORRUPTION_ERROR("xfs_iformat(reflink)",
-                                     XFS_ERRLEVEL_LOW, ip->i_mount, dip);
-                return -EFSCORRUPTED;
-        }
-
         switch (inode->i_mode & S_IFMT) {
         case S_IFIFO:
         case S_IFCHR:
         case S_IFBLK:
         case S_IFSOCK:
-                if (unlikely(dip->di_format != XFS_DINODE_FMT_DEV)) {
-                        XFS_CORRUPTION_ERROR("xfs_iformat(3)", XFS_ERRLEVEL_LOW,
-                                              ip->i_mount, dip);
-                        return -EFSCORRUPTED;
-                }
                 ip->i_d.di_size = 0;
                 inode->i_rdev = xfs_to_linux_dev_t(xfs_dinode_get_rdev(dip));
                 break;
@@ -134,32 +78,7 @@ xfs_iformat_fork(
         case S_IFDIR:
                 switch (dip->di_format) {
                 case XFS_DINODE_FMT_LOCAL:
-                        /*
-                         * no local regular files yet
-                         */
-                        if (unlikely(S_ISREG(be16_to_cpu(dip->di_mode)))) {
-                                xfs_warn(ip->i_mount,
-                        "corrupt inode %Lu (local format for regular file).",
-                                        (unsigned long long) ip->i_ino);
-                                XFS_CORRUPTION_ERROR("xfs_iformat(4)",
-                                                     XFS_ERRLEVEL_LOW,
-                                                     ip->i_mount, dip);
-                                return -EFSCORRUPTED;
-                        }
-
                         di_size = be64_to_cpu(dip->di_size);
-                        if (unlikely(di_size < 0 ||
-                                     di_size > XFS_DFORK_DSIZE(dip, ip->i_mount))) {
-                                xfs_warn(ip->i_mount,
-                        "corrupt inode %Lu (bad size %Ld for local inode).",
-                                        (unsigned long long) ip->i_ino,
-                                        (long long) di_size);
-                                XFS_CORRUPTION_ERROR("xfs_iformat(5)",
-                                                     XFS_ERRLEVEL_LOW,
-                                                     ip->i_mount, dip);
-                                return -EFSCORRUPTED;
-                        }
-
                         size = (int)di_size;
                         error = xfs_iformat_local(ip, dip, XFS_DATA_FORK, size);
                         break;
@@ -170,28 +89,16 @@ xfs_iformat_fork(
                         error = xfs_iformat_btree(ip, dip, XFS_DATA_FORK);
                         break;
                 default:
-                        XFS_ERROR_REPORT("xfs_iformat(6)", XFS_ERRLEVEL_LOW,
-                                         ip->i_mount);
                         return -EFSCORRUPTED;
                 }
                 break;
 
         default:
-                XFS_ERROR_REPORT("xfs_iformat(7)", XFS_ERRLEVEL_LOW, ip->i_mount);
                 return -EFSCORRUPTED;
         }
         if (error)
                 return error;
 
-        /* Check inline dir contents. */
-        if (S_ISDIR(inode->i_mode) && dip->di_format == XFS_DINODE_FMT_LOCAL) {
-                error = xfs_dir2_sf_verify(ip);
-                if (error) {
-                        xfs_idestroy_fork(ip, XFS_DATA_FORK);
-                        return error;
-                }
-        }
-
         if (xfs_is_reflink_inode(ip)) {
                 ASSERT(ip->i_cowfp == NULL);
                 xfs_ifork_init_cow(ip);
@@ -208,18 +115,6 @@ xfs_iformat_fork(
                 atp = (xfs_attr_shortform_t *)XFS_DFORK_APTR(dip);
                 size = be16_to_cpu(atp->hdr.totsize);
 
-                if (unlikely(size < sizeof(struct xfs_attr_sf_hdr))) {
-                        xfs_warn(ip->i_mount,
-                                "corrupt inode %Lu (bad attr fork size %Ld).",
-                                (unsigned long long) ip->i_ino,
-                                (long long) size);
-                        XFS_CORRUPTION_ERROR("xfs_iformat(8)",
-                                             XFS_ERRLEVEL_LOW,
-                                             ip->i_mount, dip);
-                        error = -EFSCORRUPTED;
-                        break;
-                }
-
                 error = xfs_iformat_local(ip, dip, XFS_ATTR_FORK, size);
                 break;
         case XFS_DINODE_FMT_EXTENTS:
@@ -403,6 +298,7 @@ xfs_iformat_btree(
          */
         if (unlikely(XFS_IFORK_NEXTENTS(ip, whichfork) <=
                                         XFS_IFORK_MAXEXT(ip, whichfork) ||
+                     nrecs == 0 ||
                      XFS_BMDR_SPACE_CALC(nrecs) >
                                         XFS_DFORK_SIZE(dip, mp, whichfork) ||
                      XFS_IFORK_NEXTENTS(ip, whichfork) > ip->i_d.di_nblocks) ||
@@ -827,3 +723,45 @@ xfs_ifork_init_cow(
         ip->i_cformat = XFS_DINODE_FMT_EXTENTS;
         ip->i_cnextents = 0;
 }
+
+/* Default fork content verifiers. */
+struct xfs_ifork_ops xfs_default_ifork_ops = {
+        .verify_attr    = xfs_attr_shortform_verify,
+        .verify_dir     = xfs_dir2_sf_verify,
+        .verify_symlink = xfs_symlink_shortform_verify,
+};
+
+/* Verify the inline contents of the data fork of an inode. */
+xfs_failaddr_t
+xfs_ifork_verify_data(
+        struct xfs_inode        *ip,
+        struct xfs_ifork_ops    *ops)
+{
+        /* Non-local data fork, we're done. */
+        if (ip->i_d.di_format != XFS_DINODE_FMT_LOCAL)
+                return NULL;
+
+        /* Check the inline data fork if there is one. */
+        switch (VFS_I(ip)->i_mode & S_IFMT) {
+        case S_IFDIR:
+                return ops->verify_dir(ip);
+        case S_IFLNK:
+                return ops->verify_symlink(ip);
+        default:
+                return NULL;
+        }
+}
+
+/* Verify the inline contents of the attr fork of an inode. */
+xfs_failaddr_t
+xfs_ifork_verify_attr(
+        struct xfs_inode        *ip,
+        struct xfs_ifork_ops    *ops)
+{
+        /* There has to be an attr fork allocated if aformat is local. */
+        if (ip->i_d.di_aformat != XFS_DINODE_FMT_LOCAL)
+                return NULL;
+        if (!XFS_IFORK_PTR(ip, XFS_ATTR_FORK))
+                return __this_address;
+        return ops->verify_attr(ip);
+}
diff --git a/fs/xfs/libxfs/xfs_inode_fork.h b/fs/xfs/libxfs/xfs_inode_fork.h
index b9f0098e33b8..dd8aba0dd119 100644
--- a/fs/xfs/libxfs/xfs_inode_fork.h
+++ b/fs/xfs/libxfs/xfs_inode_fork.h
@@ -186,4 +186,18 @@ extern struct kmem_zone	*xfs_ifork_zone;
 
 extern void xfs_ifork_init_cow(struct xfs_inode *ip);
 
+typedef xfs_failaddr_t (*xfs_ifork_verifier_t)(struct xfs_inode *);
+
+struct xfs_ifork_ops {
+        xfs_ifork_verifier_t    verify_symlink;
+        xfs_ifork_verifier_t    verify_dir;
+        xfs_ifork_verifier_t    verify_attr;
+};
+extern struct xfs_ifork_ops     xfs_default_ifork_ops;
+
+xfs_failaddr_t xfs_ifork_verify_data(struct xfs_inode *ip,
+                struct xfs_ifork_ops *ops);
+xfs_failaddr_t xfs_ifork_verify_attr(struct xfs_inode *ip,
+                struct xfs_ifork_ops *ops);
+
 #endif  /* __XFS_INODE_FORK_H__ */
diff --git a/fs/xfs/libxfs/xfs_log_rlimit.c b/fs/xfs/libxfs/xfs_log_rlimit.c
index c10597973333..cc4cbe290939 100644
--- a/fs/xfs/libxfs/xfs_log_rlimit.c
+++ b/fs/xfs/libxfs/xfs_log_rlimit.c
@@ -55,7 +55,7 @@ xfs_log_calc_max_attrsetm_res(
  * the maximum one in terms of the pre-calculated values which were done
  * at mount time.
  */
-STATIC void
+void
 xfs_log_get_max_trans_res(
         struct xfs_mount        *mp,
         struct xfs_trans_res    *max_resp)
diff --git a/fs/xfs/libxfs/xfs_quota_defs.h b/fs/xfs/libxfs/xfs_quota_defs.h
index d69c772271cb..bb1b13a9b5f4 100644
--- a/fs/xfs/libxfs/xfs_quota_defs.h
+++ b/fs/xfs/libxfs/xfs_quota_defs.h
@@ -112,8 +112,6 @@ typedef uint16_t	xfs_qwarncnt_t;
 #define XFS_QMOPT_PQUOTA        0x0000008 /* project dquot requested */
 #define XFS_QMOPT_FORCE_RES     0x0000010 /* ignore quota limits */
 #define XFS_QMOPT_SBVERSION     0x0000040 /* change superblock version num */
-#define XFS_QMOPT_DOWARN        0x0000400 /* increase warning cnt if needed */
-#define XFS_QMOPT_DQREPAIR      0x0001000 /* repair dquot if damaged */
 #define XFS_QMOPT_GQUOTA        0x0002000 /* group dquot requested */
 #define XFS_QMOPT_ENOSPC        0x0004000 /* enospc instead of edquot (prj) */
 #define XFS_QMOPT_DQNEXT        0x0008000 /* return next dquot >= this ID */
@@ -153,8 +151,11 @@ typedef uint16_t	xfs_qwarncnt_t;
                 (XFS_QMOPT_UQUOTA | XFS_QMOPT_PQUOTA | XFS_QMOPT_GQUOTA)
 #define XFS_QMOPT_RESBLK_MASK   (XFS_QMOPT_RES_REGBLKS | XFS_QMOPT_RES_RTBLKS)
 
-extern int xfs_dqcheck(struct xfs_mount *mp, xfs_disk_dquot_t *ddq,
-                       xfs_dqid_t id, uint type, uint flags, const char *str);
+extern xfs_failaddr_t xfs_dquot_verify(struct xfs_mount *mp,
+                struct xfs_disk_dquot *ddq, xfs_dqid_t id, uint type,
+                uint flags);
 extern int xfs_calc_dquots_per_chunk(unsigned int nbblks);
+extern int xfs_dquot_repair(struct xfs_mount *mp, struct xfs_disk_dquot *ddq,
+                xfs_dqid_t id, uint type);
 
 #endif  /* __XFS_QUOTA_H__ */
diff --git a/fs/xfs/libxfs/xfs_refcount.c b/fs/xfs/libxfs/xfs_refcount.c
index c40d26763075..bee68c23d612 100644
--- a/fs/xfs/libxfs/xfs_refcount.c
+++ b/fs/xfs/libxfs/xfs_refcount.c
@@ -1696,3 +1696,22 @@ out_cursor:
         xfs_trans_brelse(tp, agbp);
         goto out_trans;
 }
+
+/* Is there a record covering a given extent? */
+int
+xfs_refcount_has_record(
+        struct xfs_btree_cur    *cur,
+        xfs_agblock_t           bno,
+        xfs_extlen_t            len,
+        bool                    *exists)
+{
+        union xfs_btree_irec    low;
+        union xfs_btree_irec    high;
+
+        memset(&low, 0, sizeof(low));
+        low.rc.rc_startblock = bno;
+        memset(&high, 0xFF, sizeof(high));
+        high.rc.rc_startblock = bno + len - 1;
+
+        return xfs_btree_has_record(cur, &low, &high, exists);
+}
diff --git a/fs/xfs/libxfs/xfs_refcount.h b/fs/xfs/libxfs/xfs_refcount.h
index eafb9d1f3b37..2a731ac68fe4 100644
--- a/fs/xfs/libxfs/xfs_refcount.h
+++ b/fs/xfs/libxfs/xfs_refcount.h
@@ -83,4 +83,7 @@ static inline xfs_fileoff_t xfs_refcount_max_unmap(int log_res)
         return (log_res * 3 / 4) / XFS_REFCOUNT_ITEM_OVERHEAD;
 }
 
+extern int xfs_refcount_has_record(struct xfs_btree_cur *cur,
+                xfs_agblock_t bno, xfs_extlen_t len, bool *exists);
+
 #endif  /* __XFS_REFCOUNT_H__ */
diff --git a/fs/xfs/libxfs/xfs_refcount_btree.c b/fs/xfs/libxfs/xfs_refcount_btree.c
index 3c59dd3d58d7..8479769e470d 100644
--- a/fs/xfs/libxfs/xfs_refcount_btree.c
+++ b/fs/xfs/libxfs/xfs_refcount_btree.c
@@ -223,29 +223,31 @@ xfs_refcountbt_diff_two_keys(
                           be32_to_cpu(k2->refc.rc_startblock);
 }
 
-STATIC bool
+STATIC xfs_failaddr_t
 xfs_refcountbt_verify(
         struct xfs_buf          *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
         struct xfs_btree_block  *block = XFS_BUF_TO_BLOCK(bp);
         struct xfs_perag        *pag = bp->b_pag;
+        xfs_failaddr_t          fa;
         unsigned int            level;
 
         if (block->bb_magic != cpu_to_be32(XFS_REFC_CRC_MAGIC))
-                return false;
+                return __this_address;
 
         if (!xfs_sb_version_hasreflink(&mp->m_sb))
-                return false;
-        if (!xfs_btree_sblock_v5hdr_verify(bp))
-                return false;
+                return __this_address;
+        fa = xfs_btree_sblock_v5hdr_verify(bp);
+        if (fa)
+                return fa;
 
         level = be16_to_cpu(block->bb_level);
         if (pag && pag->pagf_init) {
                 if (level >= pag->pagf_refcount_level)
-                        return false;
+                        return __this_address;
         } else if (level >= mp->m_refc_maxlevels)
-                return false;
+                return __this_address;
 
         return xfs_btree_sblock_verify(bp, mp->m_refc_mxr[level != 0]);
 }
@@ -254,25 +256,30 @@ STATIC void
 xfs_refcountbt_read_verify(
         struct xfs_buf  *bp)
 {
+        xfs_failaddr_t  fa;
+
         if (!xfs_btree_sblock_verify_crc(bp))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_refcountbt_verify(bp))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_refcountbt_verify(bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 
-        if (bp->b_error) {
+        if (bp->b_error)
                 trace_xfs_btree_corrupt(bp, _RET_IP_);
-                xfs_verifier_error(bp);
-        }
 }
 
 STATIC void
 xfs_refcountbt_write_verify(
         struct xfs_buf  *bp)
 {
-        if (!xfs_refcountbt_verify(bp)) {
+        xfs_failaddr_t  fa;
+
+        fa = xfs_refcountbt_verify(bp);
+        if (fa) {
                 trace_xfs_btree_corrupt(bp, _RET_IP_);
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
         xfs_btree_sblock_calc_crc(bp);
@@ -283,6 +290,7 @@ const struct xfs_buf_ops xfs_refcountbt_buf_ops = {
         .name                   = "xfs_refcountbt",
         .verify_read            = xfs_refcountbt_read_verify,
         .verify_write           = xfs_refcountbt_write_verify,
+        .verify_struct          = xfs_refcountbt_verify,
 };
 
 STATIC int
diff --git a/fs/xfs/libxfs/xfs_rmap.c b/fs/xfs/libxfs/xfs_rmap.c
index 50db920ceeeb..79822cf6ebe3 100644
--- a/fs/xfs/libxfs/xfs_rmap.c
+++ b/fs/xfs/libxfs/xfs_rmap.c
@@ -2387,3 +2387,70 @@ xfs_rmap_compare(
         else
                 return 0;
 }
+
+/* Is there a record covering a given extent? */
+int
+xfs_rmap_has_record(
+        struct xfs_btree_cur    *cur,
+        xfs_agblock_t           bno,
+        xfs_extlen_t            len,
+        bool                    *exists)
+{
+        union xfs_btree_irec    low;
+        union xfs_btree_irec    high;
+
+        memset(&low, 0, sizeof(low));
+        low.r.rm_startblock = bno;
+        memset(&high, 0xFF, sizeof(high));
+        high.r.rm_startblock = bno + len - 1;
+
+        return xfs_btree_has_record(cur, &low, &high, exists);
+}
+
+/*
+ * Is there a record for this owner completely covering a given physical
+ * extent?  If so, *has_rmap will be set to true.  If there is no record
+ * or the record only covers part of the range, we set *has_rmap to false.
+ * This function doesn't perform range lookups or offset checks, so it is
+ * not suitable for checking data fork blocks.
+ */
+int
+xfs_rmap_record_exists(
+        struct xfs_btree_cur    *cur,
+        xfs_agblock_t           bno,
+        xfs_extlen_t            len,
+        struct xfs_owner_info   *oinfo,
+        bool                    *has_rmap)
+{
+        uint64_t                owner;
+        uint64_t                offset;
+        unsigned int            flags;
+        int                     has_record;
+        struct xfs_rmap_irec    irec;
+        int                     error;
+
+        xfs_owner_info_unpack(oinfo, &owner, &offset, &flags);
+        ASSERT(XFS_RMAP_NON_INODE_OWNER(owner) ||
+               (flags & XFS_RMAP_BMBT_BLOCK));
+
+        error = xfs_rmap_lookup_le(cur, bno, len, owner, offset, flags,
+                        &has_record);
+        if (error)
+                return error;
+        if (!has_record) {
+                *has_rmap = false;
+                return 0;
+        }
+
+        error = xfs_rmap_get_rec(cur, &irec, &has_record);
+        if (error)
+                return error;
+        if (!has_record) {
+                *has_rmap = false;
+                return 0;
+        }
+
+        *has_rmap = (irec.rm_owner == owner && irec.rm_startblock <= bno &&
+                     irec.rm_startblock + irec.rm_blockcount >= bno + len);
+        return 0;
+}
diff --git a/fs/xfs/libxfs/xfs_rmap.h b/fs/xfs/libxfs/xfs_rmap.h
index 0fcd5b1ba729..380e53be98d5 100644
--- a/fs/xfs/libxfs/xfs_rmap.h
+++ b/fs/xfs/libxfs/xfs_rmap.h
@@ -233,5 +233,10 @@ int xfs_rmap_compare(const struct xfs_rmap_irec *a,
 union xfs_btree_rec;
 int xfs_rmap_btrec_to_irec(union xfs_btree_rec *rec,
                 struct xfs_rmap_irec *irec);
+int xfs_rmap_has_record(struct xfs_btree_cur *cur, xfs_agblock_t bno,
+                xfs_extlen_t len, bool *exists);
+int xfs_rmap_record_exists(struct xfs_btree_cur *cur, xfs_agblock_t bno,
+                xfs_extlen_t len, struct xfs_owner_info *oinfo,
+                bool *has_rmap);
 
 #endif  /* __XFS_RMAP_H__ */
diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
index 9d9c9192584c..e829c3e489ea 100644
--- a/fs/xfs/libxfs/xfs_rmap_btree.c
+++ b/fs/xfs/libxfs/xfs_rmap_btree.c
@@ -303,13 +303,14 @@ xfs_rmapbt_diff_two_keys(
         return 0;
 }
 
-static bool
+static xfs_failaddr_t
 xfs_rmapbt_verify(
         struct xfs_buf          *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
         struct xfs_btree_block  *block = XFS_BUF_TO_BLOCK(bp);
         struct xfs_perag        *pag = bp->b_pag;
+        xfs_failaddr_t          fa;
         unsigned int            level;
 
         /*
@@ -325,19 +326,20 @@ xfs_rmapbt_verify(
          * in this case.
          */
         if (block->bb_magic != cpu_to_be32(XFS_RMAP_CRC_MAGIC))
-                return false;
+                return __this_address;
 
         if (!xfs_sb_version_hasrmapbt(&mp->m_sb))
-                return false;
-        if (!xfs_btree_sblock_v5hdr_verify(bp))
-                return false;
+                return __this_address;
+        fa = xfs_btree_sblock_v5hdr_verify(bp);
+        if (fa)
+                return fa;
 
         level = be16_to_cpu(block->bb_level);
         if (pag && pag->pagf_init) {
                 if (level >= pag->pagf_levels[XFS_BTNUM_RMAPi])
-                        return false;
+                        return __this_address;
         } else if (level >= mp->m_rmap_maxlevels)
-                return false;
+                return __this_address;
 
         return xfs_btree_sblock_verify(bp, mp->m_rmap_mxr[level != 0]);
 }
@@ -346,25 +348,30 @@ static void
 xfs_rmapbt_read_verify(
         struct xfs_buf  *bp)
 {
+        xfs_failaddr_t  fa;
+
         if (!xfs_btree_sblock_verify_crc(bp))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_rmapbt_verify(bp))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_rmapbt_verify(bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 
-        if (bp->b_error) {
+        if (bp->b_error)
                 trace_xfs_btree_corrupt(bp, _RET_IP_);
-                xfs_verifier_error(bp);
-        }
 }
 
 static void
 xfs_rmapbt_write_verify(
         struct xfs_buf  *bp)
 {
-        if (!xfs_rmapbt_verify(bp)) {
+        xfs_failaddr_t  fa;
+
+        fa = xfs_rmapbt_verify(bp);
+        if (fa) {
                 trace_xfs_btree_corrupt(bp, _RET_IP_);
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
         xfs_btree_sblock_calc_crc(bp);
@@ -375,6 +382,7 @@ const struct xfs_buf_ops xfs_rmapbt_buf_ops = {
         .name                   = "xfs_rmapbt",
         .verify_read            = xfs_rmapbt_read_verify,
         .verify_write           = xfs_rmapbt_write_verify,
+        .verify_struct          = xfs_rmapbt_verify,
 };
 
 STATIC int
diff --git a/fs/xfs/libxfs/xfs_rtbitmap.c b/fs/xfs/libxfs/xfs_rtbitmap.c
index 3fb29a5ea915..106be2d0bb88 100644
--- a/fs/xfs/libxfs/xfs_rtbitmap.c
+++ b/fs/xfs/libxfs/xfs_rtbitmap.c
@@ -1097,3 +1097,24 @@ xfs_verify_rtbno(
 {
         return rtbno < mp->m_sb.sb_rblocks;
 }
+
+/* Is the given extent all free? */
+int
+xfs_rtalloc_extent_is_free(
+        struct xfs_mount                *mp,
+        struct xfs_trans                *tp,
+        xfs_rtblock_t                   start,
+        xfs_extlen_t                    len,
+        bool                            *is_free)
+{
+        xfs_rtblock_t                   end;
+        int                             matches;
+        int                             error;
+
+        error = xfs_rtcheck_range(mp, tp, start, len, 1, &end, &matches);
+        if (error)
+                return error;
+
+        *is_free = matches;
+        return 0;
+}
diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
index 9b5aae2bcc0b..46af6aa60a8e 100644
--- a/fs/xfs/libxfs/xfs_sb.c
+++ b/fs/xfs/libxfs/xfs_sb.c
@@ -40,6 +40,8 @@
 #include "xfs_rmap_btree.h"
 #include "xfs_bmap.h"
 #include "xfs_refcount_btree.h"
+#include "xfs_da_format.h"
+#include "xfs_da_btree.h"
 
 /*
  * Physical superblock buffer manipulations. Shared with libxfs in userspace.
@@ -116,6 +118,9 @@ xfs_mount_validate_sb(
         bool            check_inprogress,
         bool            check_version)
 {
+        u32             agcount = 0;
+        u32             rem;
+
         if (sbp->sb_magicnum != XFS_SB_MAGIC) {
                 xfs_warn(mp, "bad magic number");
                 return -EWRONGFS;
@@ -226,6 +231,13 @@ xfs_mount_validate_sb(
                 return -EINVAL;
         }
 
+        /* Compute agcount for this number of dblocks and agblocks */
+        if (sbp->sb_agblocks) {
+                agcount = div_u64_rem(sbp->sb_dblocks, sbp->sb_agblocks, &rem);
+                if (rem)
+                        agcount++;
+        }
+
         /*
          * More sanity checking.  Most of these were stolen directly from
          * xfs_repair.
@@ -250,6 +262,10 @@ xfs_mount_validate_sb(
             sbp->sb_inodesize != (1 << sbp->sb_inodelog)                ||
             sbp->sb_logsunit > XLOG_MAX_RECORD_BSIZE                    ||
             sbp->sb_inopblock != howmany(sbp->sb_blocksize,sbp->sb_inodesize) ||
+            XFS_FSB_TO_B(mp, sbp->sb_agblocks) < XFS_MIN_AG_BYTES       ||
+            XFS_FSB_TO_B(mp, sbp->sb_agblocks) > XFS_MAX_AG_BYTES       ||
+            sbp->sb_agblklog != xfs_highbit32(sbp->sb_agblocks - 1) + 1 ||
+            agcount == 0 || agcount != sbp->sb_agcount                  ||
             (sbp->sb_blocklog - sbp->sb_inodelog != sbp->sb_inopblog)   ||
             (sbp->sb_rextsize * sbp->sb_blocksize > XFS_MAX_RTEXTSIZE)  ||
             (sbp->sb_rextsize * sbp->sb_blocksize < XFS_MIN_RTEXTSIZE)  ||
@@ -640,11 +656,10 @@ xfs_sb_read_verify(
         error = xfs_sb_verify(bp, true);
 
 out_error:
-        if (error) {
+        if (error == -EFSCORRUPTED || error == -EFSBADCRC)
+                xfs_verifier_error(bp, error, __this_address);
+        else if (error)
                 xfs_buf_ioerror(bp, error);
-                if (error == -EFSCORRUPTED || error == -EFSBADCRC)
-                        xfs_verifier_error(bp);
-        }
 }
 
 /*
@@ -673,13 +688,12 @@ xfs_sb_write_verify(
         struct xfs_buf          *bp)
 {
         struct xfs_mount        *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
         int                     error;
 
         error = xfs_sb_verify(bp, false);
         if (error) {
-                xfs_buf_ioerror(bp, error);
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, error, __this_address);
                 return;
         }
 
@@ -876,3 +890,88 @@ xfs_sync_sb(
                 xfs_trans_set_sync(tp);
         return xfs_trans_commit(tp);
 }
+
+int
+xfs_fs_geometry(
+        struct xfs_sb           *sbp,
+        struct xfs_fsop_geom    *geo,
+        int                     struct_version)
+{
+        memset(geo, 0, sizeof(struct xfs_fsop_geom));
+
+        geo->blocksize = sbp->sb_blocksize;
+        geo->rtextsize = sbp->sb_rextsize;
+        geo->agblocks = sbp->sb_agblocks;
+        geo->agcount = sbp->sb_agcount;
+        geo->logblocks = sbp->sb_logblocks;
+        geo->sectsize = sbp->sb_sectsize;
+        geo->inodesize = sbp->sb_inodesize;
+        geo->imaxpct = sbp->sb_imax_pct;
+        geo->datablocks = sbp->sb_dblocks;
+        geo->rtblocks = sbp->sb_rblocks;
+        geo->rtextents = sbp->sb_rextents;
+        geo->logstart = sbp->sb_logstart;
+        BUILD_BUG_ON(sizeof(geo->uuid) != sizeof(sbp->sb_uuid));
+        memcpy(geo->uuid, &sbp->sb_uuid, sizeof(sbp->sb_uuid));
+
+        if (struct_version < 2)
+                return 0;
+
+        geo->sunit = sbp->sb_unit;
+        geo->swidth = sbp->sb_width;
+
+        if (struct_version < 3)
+                return 0;
+
+        geo->version = XFS_FSOP_GEOM_VERSION;
+        geo->flags = XFS_FSOP_GEOM_FLAGS_NLINK |
+                     XFS_FSOP_GEOM_FLAGS_DIRV2;
+        if (xfs_sb_version_hasattr(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_ATTR;
+        if (xfs_sb_version_hasquota(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_QUOTA;
+        if (xfs_sb_version_hasalign(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_IALIGN;
+        if (xfs_sb_version_hasdalign(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_DALIGN;
+        if (xfs_sb_version_hasextflgbit(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_EXTFLG;
+        if (xfs_sb_version_hassector(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_SECTOR;
+        if (xfs_sb_version_hasasciici(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_DIRV2CI;
+        if (xfs_sb_version_haslazysbcount(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_LAZYSB;
+        if (xfs_sb_version_hasattr2(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_ATTR2;
+        if (xfs_sb_version_hasprojid32bit(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_PROJID32;
+        if (xfs_sb_version_hascrc(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_V5SB;
+        if (xfs_sb_version_hasftype(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_FTYPE;
+        if (xfs_sb_version_hasfinobt(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_FINOBT;
+        if (xfs_sb_version_hassparseinodes(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_SPINODES;
+        if (xfs_sb_version_hasrmapbt(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_RMAPBT;
+        if (xfs_sb_version_hasreflink(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_REFLINK;
+        if (xfs_sb_version_hassector(sbp))
+                geo->logsectsize = sbp->sb_logsectsize;
+        else
+                geo->logsectsize = BBSIZE;
+        geo->rtsectsize = sbp->sb_blocksize;
+        geo->dirblocksize = xfs_dir2_dirblock_bytes(sbp);
+
+        if (struct_version < 4)
+                return 0;
+
+        if (xfs_sb_version_haslogv2(sbp))
+                geo->flags |= XFS_FSOP_GEOM_FLAGS_LOGV2;
+
+        geo->logsunit = sbp->sb_logsunit;
+
+        return 0;
+}
diff --git a/fs/xfs/libxfs/xfs_sb.h b/fs/xfs/libxfs/xfs_sb.h
index 961e6475a309..63dcd2a1a657 100644
--- a/fs/xfs/libxfs/xfs_sb.h
+++ b/fs/xfs/libxfs/xfs_sb.h
@@ -34,4 +34,8 @@ extern void	xfs_sb_from_disk(struct xfs_sb *to, struct xfs_dsb *from);
 extern void     xfs_sb_to_disk(struct xfs_dsb *to, struct xfs_sb *from);
 extern void     xfs_sb_quota_from_disk(struct xfs_sb *sbp);
 
+#define XFS_FS_GEOM_MAX_STRUCT_VER      (4)
+extern int      xfs_fs_geometry(struct xfs_sb *sbp, struct xfs_fsop_geom *geo,
+                                int struct_version);
+
 #endif  /* __XFS_SB_H__ */
diff --git a/fs/xfs/libxfs/xfs_shared.h b/fs/xfs/libxfs/xfs_shared.h
index c6f4eb46fe26..d0b84da0cb1e 100644
--- a/fs/xfs/libxfs/xfs_shared.h
+++ b/fs/xfs/libxfs/xfs_shared.h
@@ -76,6 +76,9 @@ struct xfs_log_item_desc {
 int     xfs_log_calc_unit_res(struct xfs_mount *mp, int unit_bytes);
 int     xfs_log_calc_minimum_size(struct xfs_mount *);
 
+struct xfs_trans_res;
+void    xfs_log_get_max_trans_res(struct xfs_mount *mp,
+                                  struct xfs_trans_res *max_resp);
 
 /*
  * Values for t_flags.
@@ -143,5 +146,6 @@ bool xfs_symlink_hdr_ok(xfs_ino_t ino, uint32_t offset,
                         uint32_t size, struct xfs_buf *bp);
 void xfs_symlink_local_to_remote(struct xfs_trans *tp, struct xfs_buf *bp,
                                  struct xfs_inode *ip, struct xfs_ifork *ifp);
+xfs_failaddr_t xfs_symlink_shortform_verify(struct xfs_inode *ip);
 
 #endif /* __XFS_SHARED_H__ */
diff --git a/fs/xfs/libxfs/xfs_symlink_remote.c b/fs/xfs/libxfs/xfs_symlink_remote.c
index c484877129a0..5ef5f354587e 100644
--- a/fs/xfs/libxfs/xfs_symlink_remote.c
+++ b/fs/xfs/libxfs/xfs_symlink_remote.c
@@ -98,7 +98,7 @@ xfs_symlink_hdr_ok(
         return true;
 }
 
-static bool
+static xfs_failaddr_t
 xfs_symlink_verify(
         struct xfs_buf          *bp)
 {
@@ -106,22 +106,22 @@ xfs_symlink_verify(
         struct xfs_dsymlink_hdr *dsl = bp->b_addr;
 
         if (!xfs_sb_version_hascrc(&mp->m_sb))
-                return false;
+                return __this_address;
         if (dsl->sl_magic != cpu_to_be32(XFS_SYMLINK_MAGIC))
-                return false;
+                return __this_address;
         if (!uuid_equal(&dsl->sl_uuid, &mp->m_sb.sb_meta_uuid))
-                return false;
+                return __this_address;
         if (bp->b_bn != be64_to_cpu(dsl->sl_blkno))
-                return false;
+                return __this_address;
         if (be32_to_cpu(dsl->sl_offset) +
                                 be32_to_cpu(dsl->sl_bytes) >= XFS_SYMLINK_MAXLEN)
-                return false;
+                return __this_address;
         if (dsl->sl_owner == 0)
-                return false;
+                return __this_address;
         if (!xfs_log_check_lsn(mp, be64_to_cpu(dsl->sl_lsn)))
-                return false;
+                return __this_address;
 
-        return true;
+        return NULL;
 }
 
 static void
@@ -129,18 +129,19 @@ xfs_symlink_read_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t  fa;
 
         /* no verification of non-crc buffers */
         if (!xfs_sb_version_hascrc(&mp->m_sb))
                 return;
 
         if (!xfs_buf_verify_cksum(bp, XFS_SYMLINK_CRC_OFF))
-                xfs_buf_ioerror(bp, -EFSBADCRC);
-        else if (!xfs_symlink_verify(bp))
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-
-        if (bp->b_error)
-                xfs_verifier_error(bp);
+                xfs_verifier_error(bp, -EFSBADCRC, __this_address);
+        else {
+                fa = xfs_symlink_verify(bp);
+                if (fa)
+                        xfs_verifier_error(bp, -EFSCORRUPTED, fa);
+        }
 }
 
 static void
@@ -148,15 +149,16 @@ xfs_symlink_write_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
+        xfs_failaddr_t          fa;
 
         /* no verification of non-crc buffers */
         if (!xfs_sb_version_hascrc(&mp->m_sb))
                 return;
 
-        if (!xfs_symlink_verify(bp)) {
-                xfs_buf_ioerror(bp, -EFSCORRUPTED);
-                xfs_verifier_error(bp);
+        fa = xfs_symlink_verify(bp);
+        if (fa) {
+                xfs_verifier_error(bp, -EFSCORRUPTED, fa);
                 return;
         }
 
@@ -171,6 +173,7 @@ const struct xfs_buf_ops xfs_symlink_buf_ops = {
         .name = "xfs_symlink",
         .verify_read = xfs_symlink_read_verify,
         .verify_write = xfs_symlink_write_verify,
+        .verify_struct = xfs_symlink_verify,
 };
 
 void
@@ -207,3 +210,37 @@ xfs_symlink_local_to_remote(
         xfs_trans_log_buf(tp, bp, 0, sizeof(struct xfs_dsymlink_hdr) +
                                         ifp->if_bytes - 1);
 }
+
+/* Verify the consistency of an inline symlink. */
+xfs_failaddr_t
+xfs_symlink_shortform_verify(
+        struct xfs_inode        *ip)
+{
+        char                    *sfp;
+        char                    *endp;
+        struct xfs_ifork        *ifp;
+        int                     size;
+
+        ASSERT(ip->i_d.di_format == XFS_DINODE_FMT_LOCAL);
+        ifp = XFS_IFORK_PTR(ip, XFS_DATA_FORK);
+        sfp = (char *)ifp->if_u1.if_data;
+        size = ifp->if_bytes;
+        endp = sfp + size;
+
+        /* Zero length symlinks can exist while we're deleting a remote one. */
+        if (size == 0)
+                return NULL;
+
+        /* No negative sizes or overly long symlink targets. */
+        if (size < 0 || size > XFS_SYMLINK_MAXLEN)
+                return __this_address;
+
+        /* No NULLs in the target either. */
+        if (memchr(sfp, 0, size - 1))
+                return __this_address;
+
+        /* We /did/ null-terminate the buffer, right? */
+        if (*endp != 0)
+                return __this_address;
+        return NULL;
+}
diff --git a/fs/xfs/libxfs/xfs_trans_resv.c b/fs/xfs/libxfs/xfs_trans_resv.c
index 6bd916bd35e2..5f17641f040f 100644
--- a/fs/xfs/libxfs/xfs_trans_resv.c
+++ b/fs/xfs/libxfs/xfs_trans_resv.c
@@ -34,6 +34,9 @@
 #include "xfs_trans_space.h"
 #include "xfs_trace.h"
 
+#define _ALLOC  true
+#define _FREE   false
+
 /*
  * A buffer has a format structure overhead in the log in addition
  * to the data, so we need to take this into account when reserving
@@ -132,43 +135,77 @@ xfs_calc_inode_res(
 }
 
 /*
- * The free inode btree is a conditional feature and the log reservation
- * requirements differ slightly from that of the traditional inode allocation
- * btree. The finobt tracks records for inode chunks with at least one free
- * inode. A record can be removed from the tree for an inode allocation
- * or free and thus the finobt reservation is unconditional across:
+ * Inode btree record insertion/removal modifies the inode btree and free space
+ * btrees (since the inobt does not use the agfl). This requires the following
+ * reservation:
  *
- *      - inode allocation
- *      - inode free
- *      - inode chunk allocation
+ * the inode btree: max depth * blocksize
+ * the allocation btrees: 2 trees * (max depth - 1) * block size
  *
- * The 'modify' param indicates to include the record modification scenario. The
- * 'alloc' param indicates to include the reservation for free space btree
- * modifications on behalf of finobt modifications. This is required only for
- * transactions that do not already account for free space btree modifications.
+ * The caller must account for SB and AG header modifications, etc.
+ */
+STATIC uint
+xfs_calc_inobt_res(
+        struct xfs_mount        *mp)
+{
+        return xfs_calc_buf_res(mp->m_in_maxlevels, XFS_FSB_TO_B(mp, 1)) +
+                xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
+                                 XFS_FSB_TO_B(mp, 1));
+}
+
+/*
+ * The free inode btree is a conditional feature. The behavior differs slightly
+ * from that of the traditional inode btree in that the finobt tracks records
+ * for inode chunks with at least one free inode. A record can be removed from
+ * the tree during individual inode allocation. Therefore the finobt
+ * reservation is unconditional for both the inode chunk allocation and
+ * individual inode allocation (modify) cases.
  *
- * the free inode btree: max depth * block size
- * the allocation btrees: 2 trees * (max depth - 1) * block size
- * the free inode btree entry: block size
+ * Behavior aside, the reservation for finobt modification is equivalent to the
+ * traditional inobt: cover a full finobt shape change plus block allocation.
  */
 STATIC uint
 xfs_calc_finobt_res(
-        struct xfs_mount        *mp,
-        int                     alloc,
-        int                     modify)
+        struct xfs_mount        *mp)
 {
-        uint res;
-
         if (!xfs_sb_version_hasfinobt(&mp->m_sb))
                 return 0;
 
-        res = xfs_calc_buf_res(mp->m_in_maxlevels, XFS_FSB_TO_B(mp, 1));
-        if (alloc)
-                res += xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
-                                        XFS_FSB_TO_B(mp, 1));
-        if (modify)
-                res += (uint)XFS_FSB_TO_B(mp, 1);
+        return xfs_calc_inobt_res(mp);
+}
 
+/*
+ * Calculate the reservation required to allocate or free an inode chunk. This
+ * includes:
+ *
+ * the allocation btrees: 2 trees * (max depth - 1) * block size
+ * the inode chunk: m_ialloc_blks * N
+ *
+ * The size N of the inode chunk reservation depends on whether it is for
+ * allocation or free and which type of create transaction is in use. An inode
+ * chunk free always invalidates the buffers and only requires reservation for
+ * headers (N == 0). An inode chunk allocation requires a chunk sized
+ * reservation on v4 and older superblocks to initialize the chunk. No chunk
+ * reservation is required for allocation on v5 supers, which use ordered
+ * buffers to initialize.
+ */
+STATIC uint
+xfs_calc_inode_chunk_res(
+        struct xfs_mount        *mp,
+        bool                    alloc)
+{
+        uint                    res, size = 0;
+
+        res = xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
+                               XFS_FSB_TO_B(mp, 1));
+        if (alloc) {
+                /* icreate tx uses ordered buffers */
+                if (xfs_sb_version_hascrc(&mp->m_sb))
+                        return res;
+                size = XFS_FSB_TO_B(mp, 1);
+        }
+
+        res += xfs_calc_buf_res(mp->m_ialloc_blks, size);
         return res;
 }
 
@@ -232,8 +269,6 @@ xfs_calc_write_reservation(
  *    the super block to reflect the freed blocks: sector size
  *    worst case split in allocation btrees per extent assuming 4 extents:
  *              4 exts * 2 trees * (2 * max depth - 1) * block size
- *    the inode btree: max depth * blocksize
- *    the allocation btrees: 2 trees * (max depth - 1) * block size
  */
 STATIC uint
 xfs_calc_itruncate_reservation(
@@ -245,12 +280,7 @@ xfs_calc_itruncate_reservation(
                                       XFS_FSB_TO_B(mp, 1))),
                     (xfs_calc_buf_res(9, mp->m_sb.sb_sectsize) +
                      xfs_calc_buf_res(xfs_allocfree_log_count(mp, 4),
-                                      XFS_FSB_TO_B(mp, 1)) +
-                    xfs_calc_buf_res(5, 0) +
-                    xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
-                                     XFS_FSB_TO_B(mp, 1)) +
-                    xfs_calc_buf_res(2 + mp->m_ialloc_blks +
-                                     mp->m_in_maxlevels, 0)));
+                                      XFS_FSB_TO_B(mp, 1))));
 }
 
 /*
@@ -282,13 +312,14 @@ xfs_calc_rename_reservation(
  * For removing an inode from unlinked list at first, we can modify:
  *    the agi hash list and counters: sector size
  *    the on disk inode before ours in the agi hash list: inode cluster size
+ *    the on disk inode in the agi hash list: inode cluster size
  */
 STATIC uint
 xfs_calc_iunlink_remove_reservation(
         struct xfs_mount        *mp)
 {
         return xfs_calc_buf_res(1, mp->m_sb.sb_sectsize) +
-               max_t(uint, XFS_FSB_TO_B(mp, 1), mp->m_inode_cluster_size);
+               2 * max_t(uint, XFS_FSB_TO_B(mp, 1), mp->m_inode_cluster_size);
 }
 
 /*
@@ -320,13 +351,13 @@ xfs_calc_link_reservation(
 /*
  * For adding an inode to unlinked list we can modify:
  *    the agi hash list: sector size
- *    the unlinked inode: inode size
+ *    the on disk inode: inode cluster size
  */
 STATIC uint
 xfs_calc_iunlink_add_reservation(xfs_mount_t *mp)
 {
         return xfs_calc_buf_res(1, mp->m_sb.sb_sectsize) +
-                xfs_calc_inode_res(mp, 1);
+                max_t(uint, XFS_FSB_TO_B(mp, 1), mp->m_inode_cluster_size);
 }
 
 /*
@@ -379,45 +410,16 @@ xfs_calc_create_resv_modify(
                 xfs_calc_buf_res(1, mp->m_sb.sb_sectsize) +
                 (uint)XFS_FSB_TO_B(mp, 1) +
                 xfs_calc_buf_res(XFS_DIROP_LOG_COUNT(mp), XFS_FSB_TO_B(mp, 1)) +
-                xfs_calc_finobt_res(mp, 1, 1);
-}
-
-/*
- * For create we can allocate some inodes giving:
- *    the agi and agf of the ag getting the new inodes: 2 * sectorsize
- *    the superblock for the nlink flag: sector size
- *    the inode blocks allocated: mp->m_ialloc_blks * blocksize
- *    the inode btree: max depth * blocksize
- *    the allocation btrees: 2 trees * (max depth - 1) * block size
- */
-STATIC uint
-xfs_calc_create_resv_alloc(
-        struct xfs_mount        *mp)
-{
-        return xfs_calc_buf_res(2, mp->m_sb.sb_sectsize) +
-                mp->m_sb.sb_sectsize +
-                xfs_calc_buf_res(mp->m_ialloc_blks, XFS_FSB_TO_B(mp, 1)) +
-                xfs_calc_buf_res(mp->m_in_maxlevels, XFS_FSB_TO_B(mp, 1)) +
-                xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
-                                 XFS_FSB_TO_B(mp, 1));
-}
-
-STATIC uint
-__xfs_calc_create_reservation(
-        struct xfs_mount        *mp)
-{
-        return XFS_DQUOT_LOGRES(mp) +
-                MAX(xfs_calc_create_resv_alloc(mp),
-                    xfs_calc_create_resv_modify(mp));
+                xfs_calc_finobt_res(mp);
 }
 
 /*
  * For icreate we can allocate some inodes giving:
  *    the agi and agf of the ag getting the new inodes: 2 * sectorsize
  *    the superblock for the nlink flag: sector size
- *    the inode btree: max depth * blocksize
- *    the allocation btrees: 2 trees * (max depth - 1) * block size
- *    the finobt (record insertion)
+ *    the inode chunk (allocation, optional init)
+ *    the inobt (record insertion)
+ *    the finobt (optional, record insertion)
  */
 STATIC uint
 xfs_calc_icreate_resv_alloc(
@@ -425,10 +427,9 @@ xfs_calc_icreate_resv_alloc(
 {
         return xfs_calc_buf_res(2, mp->m_sb.sb_sectsize) +
                 mp->m_sb.sb_sectsize +
-                xfs_calc_buf_res(mp->m_in_maxlevels, XFS_FSB_TO_B(mp, 1)) +
-                xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
-                                 XFS_FSB_TO_B(mp, 1)) +
-                xfs_calc_finobt_res(mp, 0, 0);
+                xfs_calc_inode_chunk_res(mp, _ALLOC) +
+                xfs_calc_inobt_res(mp) +
+                xfs_calc_finobt_res(mp);
 }
 
 STATIC uint
@@ -440,26 +441,12 @@ xfs_calc_icreate_reservation(xfs_mount_t *mp)
 }
 
 STATIC uint
-xfs_calc_create_reservation(
-        struct xfs_mount        *mp)
-{
-        if (xfs_sb_version_hascrc(&mp->m_sb))
-                return xfs_calc_icreate_reservation(mp);
-        return __xfs_calc_create_reservation(mp);
-
-}
-
-STATIC uint
 xfs_calc_create_tmpfile_reservation(
         struct xfs_mount        *mp)
 {
         uint    res = XFS_DQUOT_LOGRES(mp);
 
-        if (xfs_sb_version_hascrc(&mp->m_sb))
-                res += xfs_calc_icreate_resv_alloc(mp);
-        else
-                res += xfs_calc_create_resv_alloc(mp);
-
+        res += xfs_calc_icreate_resv_alloc(mp);
         return res + xfs_calc_iunlink_add_reservation(mp);
 }
 
@@ -470,7 +457,7 @@ STATIC uint
 xfs_calc_mkdir_reservation(
         struct xfs_mount        *mp)
 {
-        return xfs_calc_create_reservation(mp);
+        return xfs_calc_icreate_reservation(mp);
 }
 
 
@@ -483,20 +470,24 @@ STATIC uint
 xfs_calc_symlink_reservation(
         struct xfs_mount        *mp)
 {
-        return xfs_calc_create_reservation(mp) +
+        return xfs_calc_icreate_reservation(mp) +
                xfs_calc_buf_res(1, XFS_SYMLINK_MAXLEN);
 }
 
 /*
  * In freeing an inode we can modify:
  *    the inode being freed: inode size
- *    the super block free inode counter: sector size
- *    the agi hash list and counters: sector size
- *    the inode btree entry: block size
- *    the on disk inode before ours in the agi hash list: inode cluster size
- *    the inode btree: max depth * blocksize
- *    the allocation btrees: 2 trees * (max depth - 1) * block size
+ *    the super block free inode counter, AGF and AGFL: sector size
+ *    the on disk inode (agi unlinked list removal)
+ *    the inode chunk (invalidated, headers only)
+ *    the inode btree
  *    the finobt (record insertion, removal or modification)
+ *
+ * Note that the inode chunk res. includes an allocfree res. for freeing of the
+ * inode chunk. This is technically extraneous because the inode chunk free is
+ * deferred (it occurs after a transaction roll). Include the extra reservation
+ * anyways since we've had reports of ifree transaction overruns due to too many
+ * agfl fixups during inode chunk frees.
  */
 STATIC uint
 xfs_calc_ifree_reservation(
@@ -504,15 +495,11 @@ xfs_calc_ifree_reservation(
 {
         return XFS_DQUOT_LOGRES(mp) +
                 xfs_calc_inode_res(mp, 1) +
-                xfs_calc_buf_res(1, mp->m_sb.sb_sectsize) +
-                xfs_calc_buf_res(1, XFS_FSB_TO_B(mp, 1)) +
+                xfs_calc_buf_res(3, mp->m_sb.sb_sectsize) +
                 xfs_calc_iunlink_remove_reservation(mp) +
-                xfs_calc_buf_res(1, 0) +
-                xfs_calc_buf_res(2 + mp->m_ialloc_blks +
-                                 mp->m_in_maxlevels, 0) +
-                xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
-                                 XFS_FSB_TO_B(mp, 1)) +
-                xfs_calc_finobt_res(mp, 0, 1);
+                xfs_calc_inode_chunk_res(mp, _FREE) +
+                xfs_calc_inobt_res(mp) +
+                xfs_calc_finobt_res(mp);
 }
 
 /*
@@ -842,7 +829,7 @@ xfs_trans_resv_calc(
         resp->tr_symlink.tr_logcount = XFS_SYMLINK_LOG_COUNT;
         resp->tr_symlink.tr_logflags |= XFS_TRANS_PERM_LOG_RES;
 
-        resp->tr_create.tr_logres = xfs_calc_create_reservation(mp);
+        resp->tr_create.tr_logres = xfs_calc_icreate_reservation(mp);
         resp->tr_create.tr_logcount = XFS_CREATE_LOG_COUNT;
         resp->tr_create.tr_logflags |= XFS_TRANS_PERM_LOG_RES;
 
diff --git a/fs/xfs/scrub/agheader.c b/fs/xfs/scrub/agheader.c
index 2a9b4f9e93c6..fd975524f460 100644
--- a/fs/xfs/scrub/agheader.c
+++ b/fs/xfs/scrub/agheader.c
@@ -32,30 +32,17 @@
 #include "xfs_inode.h"
 #include "xfs_alloc.h"
 #include "xfs_ialloc.h"
+#include "xfs_rmap.h"
 #include "scrub/xfs_scrub.h"
 #include "scrub/scrub.h"
 #include "scrub/common.h"
 #include "scrub/trace.h"
 
 /*
- * Set up scrub to check all the static metadata in each AG.
- * This means the SB, AGF, AGI, and AGFL headers.
+ * Walk all the blocks in the AGFL.  The fn function can return any negative
+ * error code or XFS_BTREE_QUERY_RANGE_ABORT.
  */
 int
-xfs_scrub_setup_ag_header(
-        struct xfs_scrub_context        *sc,
-        struct xfs_inode                *ip)
-{
-        struct xfs_mount                *mp = sc->mp;
-
-        if (sc->sm->sm_agno >= mp->m_sb.sb_agcount ||
-            sc->sm->sm_ino || sc->sm->sm_gen)
-                return -EINVAL;
-        return xfs_scrub_setup_fs(sc, ip);
-}
-
-/* Walk all the blocks in the AGFL. */
-int
 xfs_scrub_walk_agfl(
         struct xfs_scrub_context        *sc,
         int                             (*fn)(struct xfs_scrub_context *,
@@ -115,6 +102,36 @@ xfs_scrub_walk_agfl(
 
 /* Superblock */
 
+/* Cross-reference with the other btrees. */
+STATIC void
+xfs_scrub_superblock_xref(
+        struct xfs_scrub_context        *sc,
+        struct xfs_buf                  *bp)
+{
+        struct xfs_owner_info           oinfo;
+        struct xfs_mount                *mp = sc->mp;
+        xfs_agnumber_t                  agno = sc->sm->sm_agno;
+        xfs_agblock_t                   agbno;
+        int                             error;
+
+        if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        agbno = XFS_SB_BLOCK(mp);
+
+        error = xfs_scrub_ag_init(sc, agno, &sc->sa);
+        if (!xfs_scrub_xref_process_error(sc, agno, agbno, &error))
+                return;
+
+        xfs_scrub_xref_is_used_space(sc, agbno, 1);
+        xfs_scrub_xref_is_not_inode_chunk(sc, agbno, 1);
+        xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_FS);
+        xfs_scrub_xref_is_owned_by(sc, agbno, 1, &oinfo);
+        xfs_scrub_xref_is_not_shared(sc, agbno, 1);
+
+        /* scrub teardown will take care of sc->sa for us */
+}
+
 /*
  * Scrub the filesystem superblock.
  *
@@ -143,6 +160,22 @@ xfs_scrub_superblock(
         error = xfs_trans_read_buf(mp, sc->tp, mp->m_ddev_targp,
                   XFS_AGB_TO_DADDR(mp, agno, XFS_SB_BLOCK(mp)),
                   XFS_FSS_TO_BB(mp, 1), 0, &bp, &xfs_sb_buf_ops);
+        /*
+         * The superblock verifier can return several different error codes
+         * if it thinks the superblock doesn't look right.  For a mount these
+         * would all get bounced back to userspace, but if we're here then the
+         * fs mounted successfully, which means that this secondary superblock
+         * is simply incorrect.  Treat all these codes the same way we treat
+         * any corruption.
+         */
+        switch (error) {
+        case -EINVAL:   /* also -EWRONGFS */
+        case -ENOSYS:
+        case -EFBIG:
+                error = -EFSCORRUPTED;
+        default:
+                break;
+        }
         if (!xfs_scrub_process_error(sc, agno, XFS_SB_BLOCK(mp), &error))
                 return error;
 
@@ -387,11 +420,175 @@ xfs_scrub_superblock(
                         BBTOB(bp->b_length) - sizeof(struct xfs_dsb)))
                 xfs_scrub_block_set_corrupt(sc, bp);
 
+        xfs_scrub_superblock_xref(sc, bp);
+
         return error;
 }
 
 /* AGF */
 
+/* Tally freespace record lengths. */
+STATIC int
+xfs_scrub_agf_record_bno_lengths(
+        struct xfs_btree_cur            *cur,
+        struct xfs_alloc_rec_incore     *rec,
+        void                            *priv)
+{
+        xfs_extlen_t                    *blocks = priv;
+
+        (*blocks) += rec->ar_blockcount;
+        return 0;
+}
+
+/* Check agf_freeblks */
+static inline void
+xfs_scrub_agf_xref_freeblks(
+        struct xfs_scrub_context        *sc)
+{
+        struct xfs_agf                  *agf = XFS_BUF_TO_AGF(sc->sa.agf_bp);
+        xfs_extlen_t                    blocks = 0;
+        int                             error;
+
+        if (!sc->sa.bno_cur)
+                return;
+
+        error = xfs_alloc_query_all(sc->sa.bno_cur,
+                        xfs_scrub_agf_record_bno_lengths, &blocks);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.bno_cur))
+                return;
+        if (blocks != be32_to_cpu(agf->agf_freeblks))
+                xfs_scrub_block_xref_set_corrupt(sc, sc->sa.agf_bp);
+}
+
+/* Cross reference the AGF with the cntbt (freespace by length btree) */
+static inline void
+xfs_scrub_agf_xref_cntbt(
+        struct xfs_scrub_context        *sc)
+{
+        struct xfs_agf                  *agf = XFS_BUF_TO_AGF(sc->sa.agf_bp);
+        xfs_agblock_t                   agbno;
+        xfs_extlen_t                    blocks;
+        int                             have;
+        int                             error;
+
+        if (!sc->sa.cnt_cur)
+                return;
+
+        /* Any freespace at all? */
+        error = xfs_alloc_lookup_le(sc->sa.cnt_cur, 0, -1U, &have);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.cnt_cur))
+                return;
+        if (!have) {
+                if (agf->agf_freeblks != be32_to_cpu(0))
+                        xfs_scrub_block_xref_set_corrupt(sc, sc->sa.agf_bp);
+                return;
+        }
+
+        /* Check agf_longest */
+        error = xfs_alloc_get_rec(sc->sa.cnt_cur, &agbno, &blocks, &have);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.cnt_cur))
+                return;
+        if (!have || blocks != be32_to_cpu(agf->agf_longest))
+                xfs_scrub_block_xref_set_corrupt(sc, sc->sa.agf_bp);
+}
+
+/* Check the btree block counts in the AGF against the btrees. */
+STATIC void
+xfs_scrub_agf_xref_btreeblks(
+        struct xfs_scrub_context        *sc)
+{
+        struct xfs_agf                  *agf = XFS_BUF_TO_AGF(sc->sa.agf_bp);
+        struct xfs_mount                *mp = sc->mp;
+        xfs_agblock_t                   blocks;
+        xfs_agblock_t                   btreeblks;
+        int                             error;
+
+        /* Check agf_rmap_blocks; set up for agf_btreeblks check */
+        if (sc->sa.rmap_cur) {
+                error = xfs_btree_count_blocks(sc->sa.rmap_cur, &blocks);
+                if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.rmap_cur))
+                        return;
+                btreeblks = blocks - 1;
+                if (blocks != be32_to_cpu(agf->agf_rmap_blocks))
+                        xfs_scrub_block_xref_set_corrupt(sc, sc->sa.agf_bp);
+        } else {
+                btreeblks = 0;
+        }
+
+        /*
+         * No rmap cursor; we can't xref if we have the rmapbt feature.
+         * We also can't do it if we're missing the free space btree cursors.
+         */
+        if ((xfs_sb_version_hasrmapbt(&mp->m_sb) && !sc->sa.rmap_cur) ||
+            !sc->sa.bno_cur || !sc->sa.cnt_cur)
+                return;
+
+        /* Check agf_btreeblks */
+        error = xfs_btree_count_blocks(sc->sa.bno_cur, &blocks);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.bno_cur))
+                return;
+        btreeblks += blocks - 1;
+
+        error = xfs_btree_count_blocks(sc->sa.cnt_cur, &blocks);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.cnt_cur))
+                return;
+        btreeblks += blocks - 1;
+
+        if (btreeblks != be32_to_cpu(agf->agf_btreeblks))
+                xfs_scrub_block_xref_set_corrupt(sc, sc->sa.agf_bp);
+}
+
+/* Check agf_refcount_blocks against tree size */
+static inline void
+xfs_scrub_agf_xref_refcblks(
+        struct xfs_scrub_context        *sc)
+{
+        struct xfs_agf                  *agf = XFS_BUF_TO_AGF(sc->sa.agf_bp);
+        xfs_agblock_t                   blocks;
+        int                             error;
+
+        if (!sc->sa.refc_cur)
+                return;
+
+        error = xfs_btree_count_blocks(sc->sa.refc_cur, &blocks);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.refc_cur))
+                return;
+        if (blocks != be32_to_cpu(agf->agf_refcount_blocks))
+                xfs_scrub_block_xref_set_corrupt(sc, sc->sa.agf_bp);
+}
+
+/* Cross-reference with the other btrees. */
+STATIC void
+xfs_scrub_agf_xref(
+        struct xfs_scrub_context        *sc)
+{
+        struct xfs_owner_info           oinfo;
+        struct xfs_mount                *mp = sc->mp;
+        xfs_agblock_t                   agbno;
+        int                             error;
+
+        if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        agbno = XFS_AGF_BLOCK(mp);
+
+        error = xfs_scrub_ag_btcur_init(sc, &sc->sa);
+        if (error)
+                return;
+
+        xfs_scrub_xref_is_used_space(sc, agbno, 1);
+        xfs_scrub_agf_xref_freeblks(sc);
+        xfs_scrub_agf_xref_cntbt(sc);
+        xfs_scrub_xref_is_not_inode_chunk(sc, agbno, 1);
+        xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_FS);
+        xfs_scrub_xref_is_owned_by(sc, agbno, 1, &oinfo);
+        xfs_scrub_agf_xref_btreeblks(sc);
+        xfs_scrub_xref_is_not_shared(sc, agbno, 1);
+        xfs_scrub_agf_xref_refcblks(sc);
+
+        /* scrub teardown will take care of sc->sa for us */
+}
+
 /* Scrub the AGF. */
 int
 xfs_scrub_agf(
@@ -414,6 +611,7 @@ xfs_scrub_agf(
                         &sc->sa.agf_bp, &sc->sa.agfl_bp);
         if (!xfs_scrub_process_error(sc, agno, XFS_AGF_BLOCK(sc->mp), &error))
                 goto out;
+        xfs_scrub_buffer_recheck(sc, sc->sa.agf_bp);
 
         agf = XFS_BUF_TO_AGF(sc->sa.agf_bp);
 
@@ -470,6 +668,7 @@ xfs_scrub_agf(
         if (agfl_count != 0 && fl_count != agfl_count)
                 xfs_scrub_block_set_corrupt(sc, sc->sa.agf_bp);
 
+        xfs_scrub_agf_xref(sc);
 out:
         return error;
 }
@@ -477,11 +676,28 @@ out:
 /* AGFL */
 
 struct xfs_scrub_agfl_info {
+        struct xfs_owner_info           oinfo;
         unsigned int                    sz_entries;
         unsigned int                    nr_entries;
         xfs_agblock_t                   *entries;
 };
 
+/* Cross-reference with the other btrees. */
+STATIC void
+xfs_scrub_agfl_block_xref(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   agbno,
+        struct xfs_owner_info           *oinfo)
+{
+        if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        xfs_scrub_xref_is_used_space(sc, agbno, 1);
+        xfs_scrub_xref_is_not_inode_chunk(sc, agbno, 1);
+        xfs_scrub_xref_is_owned_by(sc, agbno, 1, oinfo);
+        xfs_scrub_xref_is_not_shared(sc, agbno, 1);
+}
+
 /* Scrub an AGFL block. */
 STATIC int
 xfs_scrub_agfl_block(
@@ -499,6 +715,8 @@ xfs_scrub_agfl_block(
         else
                 xfs_scrub_block_set_corrupt(sc, sc->sa.agfl_bp);
 
+        xfs_scrub_agfl_block_xref(sc, agbno, priv);
+
         return 0;
 }
 
@@ -513,6 +731,37 @@ xfs_scrub_agblock_cmp(
         return (int)*a - (int)*b;
 }
 
+/* Cross-reference with the other btrees. */
+STATIC void
+xfs_scrub_agfl_xref(
+        struct xfs_scrub_context        *sc)
+{
+        struct xfs_owner_info           oinfo;
+        struct xfs_mount                *mp = sc->mp;
+        xfs_agblock_t                   agbno;
+        int                             error;
+
+        if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        agbno = XFS_AGFL_BLOCK(mp);
+
+        error = xfs_scrub_ag_btcur_init(sc, &sc->sa);
+        if (error)
+                return;
+
+        xfs_scrub_xref_is_used_space(sc, agbno, 1);
+        xfs_scrub_xref_is_not_inode_chunk(sc, agbno, 1);
+        xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_FS);
+        xfs_scrub_xref_is_owned_by(sc, agbno, 1, &oinfo);
+        xfs_scrub_xref_is_not_shared(sc, agbno, 1);
+
+        /*
+         * Scrub teardown will take care of sc->sa for us.  Leave sc->sa
+         * active so that the agfl block xref can use it too.
+         */
+}
+
 /* Scrub the AGFL. */
 int
 xfs_scrub_agfl(
@@ -532,6 +781,12 @@ xfs_scrub_agfl(
                 goto out;
         if (!sc->sa.agf_bp)
                 return -EFSCORRUPTED;
+        xfs_scrub_buffer_recheck(sc, sc->sa.agfl_bp);
+
+        xfs_scrub_agfl_xref(sc);
+
+        if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                goto out;
 
         /* Allocate buffer to ensure uniqueness of AGFL entries. */
         agf = XFS_BUF_TO_AGF(sc->sa.agf_bp);
@@ -548,6 +803,7 @@ xfs_scrub_agfl(
         }
 
         /* Check the blocks in the AGFL. */
+        xfs_rmap_ag_owner(&sai.oinfo, XFS_RMAP_OWN_AG);
         error = xfs_scrub_walk_agfl(sc, xfs_scrub_agfl_block, &sai);
         if (error)
                 goto out_free;
@@ -575,6 +831,56 @@ out:
 
 /* AGI */
 
+/* Check agi_count/agi_freecount */
+static inline void
+xfs_scrub_agi_xref_icounts(
+        struct xfs_scrub_context        *sc)
+{
+        struct xfs_agi                  *agi = XFS_BUF_TO_AGI(sc->sa.agi_bp);
+        xfs_agino_t                     icount;
+        xfs_agino_t                     freecount;
+        int                             error;
+
+        if (!sc->sa.ino_cur)
+                return;
+
+        error = xfs_ialloc_count_inodes(sc->sa.ino_cur, &icount, &freecount);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.ino_cur))
+                return;
+        if (be32_to_cpu(agi->agi_count) != icount ||
+            be32_to_cpu(agi->agi_freecount) != freecount)
+                xfs_scrub_block_xref_set_corrupt(sc, sc->sa.agi_bp);
+}
+
+/* Cross-reference with the other btrees. */
+STATIC void
+xfs_scrub_agi_xref(
+        struct xfs_scrub_context        *sc)
+{
+        struct xfs_owner_info           oinfo;
+        struct xfs_mount                *mp = sc->mp;
+        xfs_agblock_t                   agbno;
+        int                             error;
+
+        if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        agbno = XFS_AGI_BLOCK(mp);
+
+        error = xfs_scrub_ag_btcur_init(sc, &sc->sa);
+        if (error)
+                return;
+
+        xfs_scrub_xref_is_used_space(sc, agbno, 1);
+        xfs_scrub_xref_is_not_inode_chunk(sc, agbno, 1);
+        xfs_scrub_agi_xref_icounts(sc);
+        xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_FS);
+        xfs_scrub_xref_is_owned_by(sc, agbno, 1, &oinfo);
+        xfs_scrub_xref_is_not_shared(sc, agbno, 1);
+
+        /* scrub teardown will take care of sc->sa for us */
+}
+
 /* Scrub the AGI. */
 int
 xfs_scrub_agi(
@@ -598,6 +904,7 @@ xfs_scrub_agi(
                         &sc->sa.agf_bp, &sc->sa.agfl_bp);
         if (!xfs_scrub_process_error(sc, agno, XFS_AGI_BLOCK(sc->mp), &error))
                 goto out;
+        xfs_scrub_buffer_recheck(sc, sc->sa.agi_bp);
 
         agi = XFS_BUF_TO_AGI(sc->sa.agi_bp);
 
@@ -653,6 +960,7 @@ xfs_scrub_agi(
         if (agi->agi_pad32 != cpu_to_be32(0))
                 xfs_scrub_block_set_corrupt(sc, sc->sa.agi_bp);
 
+        xfs_scrub_agi_xref(sc);
 out:
         return error;
 }
diff --git a/fs/xfs/scrub/alloc.c b/fs/xfs/scrub/alloc.c
index 059663e13414..517c079d3f68 100644
--- a/fs/xfs/scrub/alloc.c
+++ b/fs/xfs/scrub/alloc.c
@@ -31,6 +31,7 @@
 #include "xfs_sb.h"
 #include "xfs_alloc.h"
 #include "xfs_rmap.h"
+#include "xfs_alloc.h"
 #include "scrub/xfs_scrub.h"
 #include "scrub/scrub.h"
 #include "scrub/common.h"
@@ -49,6 +50,64 @@ xfs_scrub_setup_ag_allocbt(
 }
 
 /* Free space btree scrubber. */
+/*
+ * Ensure there's a corresponding cntbt/bnobt record matching this
+ * bnobt/cntbt record, respectively.
+ */
+STATIC void
+xfs_scrub_allocbt_xref_other(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   agbno,
+        xfs_extlen_t                    len)
+{
+        struct xfs_btree_cur            **pcur;
+        xfs_agblock_t                   fbno;
+        xfs_extlen_t                    flen;
+        int                             has_otherrec;
+        int                             error;
+
+        if (sc->sm->sm_type == XFS_SCRUB_TYPE_BNOBT)
+                pcur = &sc->sa.cnt_cur;
+        else
+                pcur = &sc->sa.bno_cur;
+        if (!*pcur)
+                return;
+
+        error = xfs_alloc_lookup_le(*pcur, agbno, len, &has_otherrec);
+        if (!xfs_scrub_should_check_xref(sc, &error, pcur))
+                return;
+        if (!has_otherrec) {
+                xfs_scrub_btree_xref_set_corrupt(sc, *pcur, 0);
+                return;
+        }
+
+        error = xfs_alloc_get_rec(*pcur, &fbno, &flen, &has_otherrec);
+        if (!xfs_scrub_should_check_xref(sc, &error, pcur))
+                return;
+        if (!has_otherrec) {
+                xfs_scrub_btree_xref_set_corrupt(sc, *pcur, 0);
+                return;
+        }
+
+        if (fbno != agbno || flen != len)
+                xfs_scrub_btree_xref_set_corrupt(sc, *pcur, 0);
+}
+
+/* Cross-reference with the other btrees. */
+STATIC void
+xfs_scrub_allocbt_xref(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   agbno,
+        xfs_extlen_t                    len)
+{
+        if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        xfs_scrub_allocbt_xref_other(sc, agbno, len);
+        xfs_scrub_xref_is_not_inode_chunk(sc, agbno, len);
+        xfs_scrub_xref_has_no_owner(sc, agbno, len);
+        xfs_scrub_xref_is_not_shared(sc, agbno, len);
+}
 
 /* Scrub a bnobt/cntbt record. */
 STATIC int
@@ -70,6 +129,8 @@ xfs_scrub_allocbt_rec(
             !xfs_verify_agbno(mp, agno, bno + len - 1))
                 xfs_scrub_btree_set_corrupt(bs->sc, bs->cur, 0);
 
+        xfs_scrub_allocbt_xref(bs->sc, bno, len);
+
         return error;
 }
 
@@ -100,3 +161,23 @@ xfs_scrub_cntbt(
 {
         return xfs_scrub_allocbt(sc, XFS_BTNUM_CNT);
 }
+
+/* xref check that the extent is not free */
+void
+xfs_scrub_xref_is_used_space(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   agbno,
+        xfs_extlen_t                    len)
+{
+        bool                            is_freesp;
+        int                             error;
+
+        if (!sc->sa.bno_cur)
+                return;
+
+        error = xfs_alloc_has_record(sc->sa.bno_cur, agbno, len, &is_freesp);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.bno_cur))
+                return;
+        if (is_freesp)
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.bno_cur, 0);
+}
diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c
index 42fec0bcd9e1..d00282130492 100644
--- a/fs/xfs/scrub/bmap.c
+++ b/fs/xfs/scrub/bmap.c
@@ -37,6 +37,7 @@
 #include "xfs_bmap_util.h"
 #include "xfs_bmap_btree.h"
 #include "xfs_rmap.h"
+#include "xfs_refcount.h"
 #include "scrub/xfs_scrub.h"
 #include "scrub/scrub.h"
 #include "scrub/common.h"
@@ -99,6 +100,201 @@ struct xfs_scrub_bmap_info {
         int                             whichfork;
 };
 
+/* Look for a corresponding rmap for this irec. */
+static inline bool
+xfs_scrub_bmap_get_rmap(
+        struct xfs_scrub_bmap_info      *info,
+        struct xfs_bmbt_irec            *irec,
+        xfs_agblock_t                   agbno,
+        uint64_t                        owner,
+        struct xfs_rmap_irec            *rmap)
+{
+        xfs_fileoff_t                   offset;
+        unsigned int                    rflags = 0;
+        int                             has_rmap;
+        int                             error;
+
+        if (info->whichfork == XFS_ATTR_FORK)
+                rflags |= XFS_RMAP_ATTR_FORK;
+
+        /*
+         * CoW staging extents are owned (on disk) by the refcountbt, so
+         * their rmaps do not have offsets.
+         */
+        if (info->whichfork == XFS_COW_FORK)
+                offset = 0;
+        else
+                offset = irec->br_startoff;
+
+        /*
+         * If the caller thinks this could be a shared bmbt extent (IOWs,
+         * any data fork extent of a reflink inode) then we have to use the
+         * range rmap lookup to make sure we get the correct owner/offset.
+         */
+        if (info->is_shared) {
+                error = xfs_rmap_lookup_le_range(info->sc->sa.rmap_cur, agbno,
+                                owner, offset, rflags, rmap, &has_rmap);
+                if (!xfs_scrub_should_check_xref(info->sc, &error,
+                                &info->sc->sa.rmap_cur))
+                        return false;
+                goto out;
+        }
+
+        /*
+         * Otherwise, use the (faster) regular lookup.
+         */
+        error = xfs_rmap_lookup_le(info->sc->sa.rmap_cur, agbno, 0, owner,
+                        offset, rflags, &has_rmap);
+        if (!xfs_scrub_should_check_xref(info->sc, &error,
+                        &info->sc->sa.rmap_cur))
+                return false;
+        if (!has_rmap)
+                goto out;
+
+        error = xfs_rmap_get_rec(info->sc->sa.rmap_cur, rmap, &has_rmap);
+        if (!xfs_scrub_should_check_xref(info->sc, &error,
+                        &info->sc->sa.rmap_cur))
+                return false;
+
+out:
+        if (!has_rmap)
+                xfs_scrub_fblock_xref_set_corrupt(info->sc, info->whichfork,
+                        irec->br_startoff);
+        return has_rmap;
+}
+
+/* Make sure that we have rmapbt records for this extent. */
+STATIC void
+xfs_scrub_bmap_xref_rmap(
+        struct xfs_scrub_bmap_info      *info,
+        struct xfs_bmbt_irec            *irec,
+        xfs_agblock_t                   agbno)
+{
+        struct xfs_rmap_irec            rmap;
+        unsigned long long              rmap_end;
+        uint64_t                        owner;
+
+        if (!info->sc->sa.rmap_cur)
+                return;
+
+        if (info->whichfork == XFS_COW_FORK)
+                owner = XFS_RMAP_OWN_COW;
+        else
+                owner = info->sc->ip->i_ino;
+
+        /* Find the rmap record for this irec. */
+        if (!xfs_scrub_bmap_get_rmap(info, irec, agbno, owner, &rmap))
+                return;
+
+        /* Check the rmap. */
+        rmap_end = (unsigned long long)rmap.rm_startblock + rmap.rm_blockcount;
+        if (rmap.rm_startblock > agbno ||
+            agbno + irec->br_blockcount > rmap_end)
+                xfs_scrub_fblock_xref_set_corrupt(info->sc, info->whichfork,
+                                irec->br_startoff);
+
+        /*
+         * Check the logical offsets if applicable.  CoW staging extents
+         * don't track logical offsets since the mappings only exist in
+         * memory.
+         */
+        if (info->whichfork != XFS_COW_FORK) {
+                rmap_end = (unsigned long long)rmap.rm_offset +
+                                rmap.rm_blockcount;
+                if (rmap.rm_offset > irec->br_startoff ||
+                    irec->br_startoff + irec->br_blockcount > rmap_end)
+                        xfs_scrub_fblock_xref_set_corrupt(info->sc,
+                                        info->whichfork, irec->br_startoff);
+        }
+
+        if (rmap.rm_owner != owner)
+                xfs_scrub_fblock_xref_set_corrupt(info->sc, info->whichfork,
+                                irec->br_startoff);
+
+        /*
+         * Check for discrepancies between the unwritten flag in the irec and
+         * the rmap.  Note that the (in-memory) CoW fork distinguishes between
+         * unwritten and written extents, but we don't track that in the rmap
+         * records because the blocks are owned (on-disk) by the refcountbt,
+         * which doesn't track unwritten state.
+         */
+        if (owner != XFS_RMAP_OWN_COW &&
+            irec->br_state == XFS_EXT_UNWRITTEN &&
+            !(rmap.rm_flags & XFS_RMAP_UNWRITTEN))
+                xfs_scrub_fblock_xref_set_corrupt(info->sc, info->whichfork,
+                                irec->br_startoff);
+
+        if (info->whichfork == XFS_ATTR_FORK &&
+            !(rmap.rm_flags & XFS_RMAP_ATTR_FORK))
+                xfs_scrub_fblock_xref_set_corrupt(info->sc, info->whichfork,
+                                irec->br_startoff);
+        if (rmap.rm_flags & XFS_RMAP_BMBT_BLOCK)
+                xfs_scrub_fblock_xref_set_corrupt(info->sc, info->whichfork,
+                                irec->br_startoff);
+}
+
+/* Cross-reference a single rtdev extent record. */
+STATIC void
+xfs_scrub_bmap_rt_extent_xref(
+        struct xfs_scrub_bmap_info      *info,
+        struct xfs_inode                *ip,
+        struct xfs_btree_cur            *cur,
+        struct xfs_bmbt_irec            *irec)
+{
+        if (info->sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        xfs_scrub_xref_is_used_rt_space(info->sc, irec->br_startblock,
+                        irec->br_blockcount);
+}
+
+/* Cross-reference a single datadev extent record. */
+STATIC void
+xfs_scrub_bmap_extent_xref(
+        struct xfs_scrub_bmap_info      *info,
+        struct xfs_inode                *ip,
+        struct xfs_btree_cur            *cur,
+        struct xfs_bmbt_irec            *irec)
+{
+        struct xfs_mount                *mp = info->sc->mp;
+        xfs_agnumber_t                  agno;
+        xfs_agblock_t                   agbno;
+        xfs_extlen_t                    len;
+        int                             error;
+
+        if (info->sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        agno = XFS_FSB_TO_AGNO(mp, irec->br_startblock);
+        agbno = XFS_FSB_TO_AGBNO(mp, irec->br_startblock);
+        len = irec->br_blockcount;
+
+        error = xfs_scrub_ag_init(info->sc, agno, &info->sc->sa);
+        if (!xfs_scrub_fblock_process_error(info->sc, info->whichfork,
+                        irec->br_startoff, &error))
+                return;
+
+        xfs_scrub_xref_is_used_space(info->sc, agbno, len);
+        xfs_scrub_xref_is_not_inode_chunk(info->sc, agbno, len);
+        xfs_scrub_bmap_xref_rmap(info, irec, agbno);
+        switch (info->whichfork) {
+        case XFS_DATA_FORK:
+                if (xfs_is_reflink_inode(info->sc->ip))
+                        break;
+                /* fall through */
+        case XFS_ATTR_FORK:
+                xfs_scrub_xref_is_not_shared(info->sc, agbno,
+                                irec->br_blockcount);
+                break;
+        case XFS_COW_FORK:
+                xfs_scrub_xref_is_cow_staging(info->sc, agbno,
+                                irec->br_blockcount);
+                break;
+        }
+
+        xfs_scrub_ag_free(info->sc, &info->sc->sa);
+}
+
 /* Scrub a single extent record. */
 STATIC int
 xfs_scrub_bmap_extent(
@@ -109,6 +305,7 @@ xfs_scrub_bmap_extent(
 {
         struct xfs_mount                *mp = info->sc->mp;
         struct xfs_buf                  *bp = NULL;
+        xfs_filblks_t                   end;
         int                             error = 0;
 
         if (cur)
@@ -136,19 +333,23 @@ xfs_scrub_bmap_extent(
                                 irec->br_startoff);
 
         /* Make sure the extent points to a valid place. */
+        if (irec->br_blockcount > MAXEXTLEN)
+                xfs_scrub_fblock_set_corrupt(info->sc, info->whichfork,
+                                irec->br_startoff);
         if (irec->br_startblock + irec->br_blockcount <= irec->br_startblock)
                 xfs_scrub_fblock_set_corrupt(info->sc, info->whichfork,
                                 irec->br_startoff);
+        end = irec->br_startblock + irec->br_blockcount - 1;
         if (info->is_rt &&
             (!xfs_verify_rtbno(mp, irec->br_startblock) ||
-             !xfs_verify_rtbno(mp, irec->br_startblock +
-                                irec->br_blockcount - 1)))
+             !xfs_verify_rtbno(mp, end)))
                 xfs_scrub_fblock_set_corrupt(info->sc, info->whichfork,
                                 irec->br_startoff);
         if (!info->is_rt &&
             (!xfs_verify_fsbno(mp, irec->br_startblock) ||
-             !xfs_verify_fsbno(mp, irec->br_startblock +
-                                irec->br_blockcount - 1)))
+             !xfs_verify_fsbno(mp, end) ||
+             XFS_FSB_TO_AGNO(mp, irec->br_startblock) !=
+                                XFS_FSB_TO_AGNO(mp, end)))
                 xfs_scrub_fblock_set_corrupt(info->sc, info->whichfork,
                                 irec->br_startoff);
 
@@ -158,6 +359,11 @@ xfs_scrub_bmap_extent(
                 xfs_scrub_fblock_set_corrupt(info->sc, info->whichfork,
                                 irec->br_startoff);
 
+        if (info->is_rt)
+                xfs_scrub_bmap_rt_extent_xref(info, ip, cur, irec);
+        else
+                xfs_scrub_bmap_extent_xref(info, ip, cur, irec);
+
         info->lastoff = irec->br_startoff + irec->br_blockcount;
         return error;
 }
@@ -235,7 +441,6 @@ xfs_scrub_bmap(
         struct xfs_ifork                *ifp;
         xfs_fileoff_t                   endoff;
         struct xfs_iext_cursor          icur;
-        bool                            found;
         int                             error = 0;
 
         ifp = XFS_IFORK_PTR(ip, whichfork);
@@ -314,9 +519,7 @@ xfs_scrub_bmap(
         /* Scrub extent records. */
         info.lastoff = 0;
         ifp = XFS_IFORK_PTR(ip, whichfork);
-        for (found = xfs_iext_lookup_extent(ip, ifp, 0, &icur, &irec);
-             found != 0;
-             found = xfs_iext_next_extent(ifp, &icur, &irec)) {
+        for_each_xfs_iext(ifp, &icur, &irec) {
                 if (xfs_scrub_should_terminate(sc, &error))
                         break;
                 if (isnullstartblock(irec.br_startblock))
diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c
index df0766132ace..54218168c8f9 100644
--- a/fs/xfs/scrub/btree.c
+++ b/fs/xfs/scrub/btree.c
@@ -42,12 +42,14 @@
  * Check for btree operation errors.  See the section about handling
  * operational errors in common.c.
  */
-bool
-xfs_scrub_btree_process_error(
+static bool
+__xfs_scrub_btree_process_error(
         struct xfs_scrub_context        *sc,
         struct xfs_btree_cur            *cur,
         int                             level,
-        int                             *error)
+        int                             *error,
+        __u32                           errflag,
+        void                            *ret_ip)
 {
         if (*error == 0)
                 return true;
@@ -60,36 +62,80 @@ xfs_scrub_btree_process_error(
         case -EFSBADCRC:
         case -EFSCORRUPTED:
                 /* Note the badness but don't abort. */
-                sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
+                sc->sm->sm_flags |= errflag;
                 *error = 0;
                 /* fall through */
         default:
                 if (cur->bc_flags & XFS_BTREE_ROOT_IN_INODE)
                         trace_xfs_scrub_ifork_btree_op_error(sc, cur, level,
-                                        *error, __return_address);
+                                        *error, ret_ip);
                 else
                         trace_xfs_scrub_btree_op_error(sc, cur, level,
-                                        *error, __return_address);
+                                        *error, ret_ip);
                 break;
         }
         return false;
 }
 
+bool
+xfs_scrub_btree_process_error(
+        struct xfs_scrub_context        *sc,
+        struct xfs_btree_cur            *cur,
+        int                             level,
+        int                             *error)
+{
+        return __xfs_scrub_btree_process_error(sc, cur, level, error,
+                        XFS_SCRUB_OFLAG_CORRUPT, __return_address);
+}
+
+bool
+xfs_scrub_btree_xref_process_error(
+        struct xfs_scrub_context        *sc,
+        struct xfs_btree_cur            *cur,
+        int                             level,
+        int                             *error)
+{
+        return __xfs_scrub_btree_process_error(sc, cur, level, error,
+                        XFS_SCRUB_OFLAG_XFAIL, __return_address);
+}
+
 /* Record btree block corruption. */
-void
-xfs_scrub_btree_set_corrupt(
+static void
+__xfs_scrub_btree_set_corrupt(
         struct xfs_scrub_context        *sc,
         struct xfs_btree_cur            *cur,
-        int                             level)
+        int                             level,
+        __u32                           errflag,
+        void                            *ret_ip)
 {
-        sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
+        sc->sm->sm_flags |= errflag;
 
         if (cur->bc_flags & XFS_BTREE_ROOT_IN_INODE)
                 trace_xfs_scrub_ifork_btree_error(sc, cur, level,
-                                __return_address);
+                                ret_ip);
         else
                 trace_xfs_scrub_btree_error(sc, cur, level,
-                                __return_address);
+                                ret_ip);
+}
+
+void
+xfs_scrub_btree_set_corrupt(
+        struct xfs_scrub_context        *sc,
+        struct xfs_btree_cur            *cur,
+        int                             level)
+{
+        __xfs_scrub_btree_set_corrupt(sc, cur, level, XFS_SCRUB_OFLAG_CORRUPT,
+                        __return_address);
+}
+
+void
+xfs_scrub_btree_xref_set_corrupt(
+        struct xfs_scrub_context        *sc,
+        struct xfs_btree_cur            *cur,
+        int                             level)
+{
+        __xfs_scrub_btree_set_corrupt(sc, cur, level, XFS_SCRUB_OFLAG_XCORRUPT,
+                        __return_address);
 }
 
 /*
@@ -268,6 +314,8 @@ xfs_scrub_btree_block_check_sibling(
         pp = xfs_btree_ptr_addr(ncur, ncur->bc_ptrs[level + 1], pblock);
         if (!xfs_scrub_btree_ptr_ok(bs, level + 1, pp))
                 goto out;
+        if (pbp)
+                xfs_scrub_buffer_recheck(bs->sc, pbp);
 
         if (xfs_btree_diff_two_ptrs(cur, pp, sibling))
                 xfs_scrub_btree_set_corrupt(bs->sc, cur, level);
@@ -315,6 +363,97 @@ out:
         return error;
 }
 
+struct check_owner {
+        struct list_head        list;
+        xfs_daddr_t             daddr;
+        int                     level;
+};
+
+/*
+ * Make sure this btree block isn't in the free list and that there's
+ * an rmap record for it.
+ */
+STATIC int
+xfs_scrub_btree_check_block_owner(
+        struct xfs_scrub_btree          *bs,
+        int                             level,
+        xfs_daddr_t                     daddr)
+{
+        xfs_agnumber_t                  agno;
+        xfs_agblock_t                   agbno;
+        xfs_btnum_t                     btnum;
+        bool                            init_sa;
+        int                             error = 0;
+
+        if (!bs->cur)
+                return 0;
+
+        btnum = bs->cur->bc_btnum;
+        agno = xfs_daddr_to_agno(bs->cur->bc_mp, daddr);
+        agbno = xfs_daddr_to_agbno(bs->cur->bc_mp, daddr);
+
+        init_sa = bs->cur->bc_flags & XFS_BTREE_LONG_PTRS;
+        if (init_sa) {
+                error = xfs_scrub_ag_init(bs->sc, agno, &bs->sc->sa);
+                if (!xfs_scrub_btree_xref_process_error(bs->sc, bs->cur,
+                                level, &error))
+                        return error;
+        }
+
+        xfs_scrub_xref_is_used_space(bs->sc, agbno, 1);
+        /*
+         * The bnobt scrubber aliases bs->cur to bs->sc->sa.bno_cur, so we
+         * have to nullify it (to shut down further block owner checks) if
+         * self-xref encounters problems.
+         */
+        if (!bs->sc->sa.bno_cur && btnum == XFS_BTNUM_BNO)
+                bs->cur = NULL;
+
+        xfs_scrub_xref_is_owned_by(bs->sc, agbno, 1, bs->oinfo);
+        if (!bs->sc->sa.rmap_cur && btnum == XFS_BTNUM_RMAP)
+                bs->cur = NULL;
+
+        if (init_sa)
+                xfs_scrub_ag_free(bs->sc, &bs->sc->sa);
+
+        return error;
+}
+
+/* Check the owner of a btree block. */
+STATIC int
+xfs_scrub_btree_check_owner(
+        struct xfs_scrub_btree          *bs,
+        int                             level,
+        struct xfs_buf                  *bp)
+{
+        struct xfs_btree_cur            *cur = bs->cur;
+        struct check_owner              *co;
+
+        if ((cur->bc_flags & XFS_BTREE_ROOT_IN_INODE) && bp == NULL)
+                return 0;
+
+        /*
+         * We want to cross-reference each btree block with the bnobt
+         * and the rmapbt.  We cannot cross-reference the bnobt or
+         * rmapbt while scanning the bnobt or rmapbt, respectively,
+         * because we cannot alter the cursor and we'd prefer not to
+         * duplicate cursors.  Therefore, save the buffer daddr for
+         * later scanning.
+         */
+        if (cur->bc_btnum == XFS_BTNUM_BNO || cur->bc_btnum == XFS_BTNUM_RMAP) {
+                co = kmem_alloc(sizeof(struct check_owner),
+                                KM_MAYFAIL | KM_NOFS);
+                if (!co)
+                        return -ENOMEM;
+                co->level = level;
+                co->daddr = XFS_BUF_ADDR(bp);
+                list_add_tail(&co->list, &bs->to_check);
+                return 0;
+        }
+
+        return xfs_scrub_btree_check_block_owner(bs, level, XFS_BUF_ADDR(bp));
+}
+
 /*
  * Grab and scrub a btree block given a btree pointer.  Returns block
  * and buffer pointers (if applicable) if they're ok to use.
@@ -349,6 +488,16 @@ xfs_scrub_btree_get_block(
                 xfs_scrub_btree_set_corrupt(bs->sc, bs->cur, level);
                 return 0;
         }
+        if (*pbp)
+                xfs_scrub_buffer_recheck(bs->sc, *pbp);
+
+        /*
+         * Check the block's owner; this function absorbs error codes
+         * for us.
+         */
+        error = xfs_scrub_btree_check_owner(bs, level, *pbp);
+        if (error)
+                return error;
 
         /*
          * Check the block's siblings; this function absorbs error codes
@@ -421,6 +570,8 @@ xfs_scrub_btree(
         struct xfs_btree_block          *block;
         int                             level;
         struct xfs_buf                  *bp;
+        struct check_owner              *co;
+        struct check_owner              *n;
         int                             i;
         int                             error = 0;
 
@@ -512,5 +663,14 @@ xfs_scrub_btree(
         }
 
 out:
+        /* Process deferred owner checks on btree blocks. */
+        list_for_each_entry_safe(co, n, &bs.to_check, list) {
+                if (!error && bs.cur)
+                        error = xfs_scrub_btree_check_block_owner(&bs,
+                                        co->level, co->daddr);
+                list_del(&co->list);
+                kmem_free(co);
+        }
+
         return error;
 }
diff --git a/fs/xfs/scrub/btree.h b/fs/xfs/scrub/btree.h
index 4de825a626d1..e2b868ede70b 100644
--- a/fs/xfs/scrub/btree.h
+++ b/fs/xfs/scrub/btree.h
@@ -26,10 +26,19 @@
 bool xfs_scrub_btree_process_error(struct xfs_scrub_context *sc,
                 struct xfs_btree_cur *cur, int level, int *error);
 
+/* Check for btree xref operation errors. */
+bool xfs_scrub_btree_xref_process_error(struct xfs_scrub_context *sc,
+                                struct xfs_btree_cur *cur, int level,
+                                int *error);
+
 /* Check for btree corruption. */
 void xfs_scrub_btree_set_corrupt(struct xfs_scrub_context *sc,
                 struct xfs_btree_cur *cur, int level);
 
+/* Check for btree xref discrepancies. */
+void xfs_scrub_btree_xref_set_corrupt(struct xfs_scrub_context *sc,
+                struct xfs_btree_cur *cur, int level);
+
 struct xfs_scrub_btree;
 typedef int (*xfs_scrub_btree_rec_fn)(
         struct xfs_scrub_btree  *bs,
diff --git a/fs/xfs/scrub/common.c b/fs/xfs/scrub/common.c
index ac95fe911d96..8033ab9d8f47 100644
--- a/fs/xfs/scrub/common.c
+++ b/fs/xfs/scrub/common.c
@@ -78,12 +78,14 @@
  */
 
 /* Check for operational errors. */
-bool
-xfs_scrub_process_error(
+static bool
+__xfs_scrub_process_error(
         struct xfs_scrub_context        *sc,
         xfs_agnumber_t                  agno,
         xfs_agblock_t                   bno,
-        int                             *error)
+        int                             *error,
+        __u32                           errflag,
+        void                            *ret_ip)
 {
         switch (*error) {
         case 0:
@@ -95,24 +97,48 @@ xfs_scrub_process_error(
         case -EFSBADCRC:
         case -EFSCORRUPTED:
                 /* Note the badness but don't abort. */
-                sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
+                sc->sm->sm_flags |= errflag;
                 *error = 0;
                 /* fall through */
         default:
                 trace_xfs_scrub_op_error(sc, agno, bno, *error,
-                                __return_address);
+                                ret_ip);
                 break;
         }
         return false;
 }
 
-/* Check for operational errors for a file offset. */
 bool
-xfs_scrub_fblock_process_error(
+xfs_scrub_process_error(
+        struct xfs_scrub_context        *sc,
+        xfs_agnumber_t                  agno,
+        xfs_agblock_t                   bno,
+        int                             *error)
+{
+        return __xfs_scrub_process_error(sc, agno, bno, error,
+                        XFS_SCRUB_OFLAG_CORRUPT, __return_address);
+}
+
+bool
+xfs_scrub_xref_process_error(
+        struct xfs_scrub_context        *sc,
+        xfs_agnumber_t                  agno,
+        xfs_agblock_t                   bno,
+        int                             *error)
+{
+        return __xfs_scrub_process_error(sc, agno, bno, error,
+                        XFS_SCRUB_OFLAG_XFAIL, __return_address);
+}
+
+/* Check for operational errors for a file offset. */
+static bool
+__xfs_scrub_fblock_process_error(
         struct xfs_scrub_context        *sc,
         int                             whichfork,
         xfs_fileoff_t                   offset,
-        int                             *error)
+        int                             *error,
+        __u32                           errflag,
+        void                            *ret_ip)
 {
         switch (*error) {
         case 0:
@@ -124,17 +150,39 @@ xfs_scrub_fblock_process_error(
         case -EFSBADCRC:
         case -EFSCORRUPTED:
                 /* Note the badness but don't abort. */
-                sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
+                sc->sm->sm_flags |= errflag;
                 *error = 0;
                 /* fall through */
         default:
                 trace_xfs_scrub_file_op_error(sc, whichfork, offset, *error,
-                                __return_address);
+                                ret_ip);
                 break;
         }
         return false;
 }
 
+bool
+xfs_scrub_fblock_process_error(
+        struct xfs_scrub_context        *sc,
+        int                             whichfork,
+        xfs_fileoff_t                   offset,
+        int                             *error)
+{
+        return __xfs_scrub_fblock_process_error(sc, whichfork, offset, error,
+                        XFS_SCRUB_OFLAG_CORRUPT, __return_address);
+}
+
+bool
+xfs_scrub_fblock_xref_process_error(
+        struct xfs_scrub_context        *sc,
+        int                             whichfork,
+        xfs_fileoff_t                   offset,
+        int                             *error)
+{
+        return __xfs_scrub_fblock_process_error(sc, whichfork, offset, error,
+                        XFS_SCRUB_OFLAG_XFAIL, __return_address);
+}
+
 /*
  * Handling scrub corruption/optimization/warning checks.
  *
@@ -183,6 +231,16 @@ xfs_scrub_block_set_corrupt(
         trace_xfs_scrub_block_error(sc, bp->b_bn, __return_address);
 }
 
+/* Record a corruption while cross-referencing. */
+void
+xfs_scrub_block_xref_set_corrupt(
+        struct xfs_scrub_context        *sc,
+        struct xfs_buf                  *bp)
+{
+        sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
+        trace_xfs_scrub_block_error(sc, bp->b_bn, __return_address);
+}
+
 /*
  * Record a corrupt inode.  The trace data will include the block given
  * by bp if bp is given; otherwise it will use the block location of the
@@ -198,6 +256,17 @@ xfs_scrub_ino_set_corrupt(
         trace_xfs_scrub_ino_error(sc, ino, bp ? bp->b_bn : 0, __return_address);
 }
 
+/* Record a corruption while cross-referencing with an inode. */
+void
+xfs_scrub_ino_xref_set_corrupt(
+        struct xfs_scrub_context        *sc,
+        xfs_ino_t                       ino,
+        struct xfs_buf                  *bp)
+{
+        sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
+        trace_xfs_scrub_ino_error(sc, ino, bp ? bp->b_bn : 0, __return_address);
+}
+
 /* Record corruption in a block indexed by a file fork. */
 void
 xfs_scrub_fblock_set_corrupt(
@@ -209,6 +278,17 @@ xfs_scrub_fblock_set_corrupt(
         trace_xfs_scrub_fblock_error(sc, whichfork, offset, __return_address);
 }
 
+/* Record a corruption while cross-referencing a fork block. */
+void
+xfs_scrub_fblock_xref_set_corrupt(
+        struct xfs_scrub_context        *sc,
+        int                             whichfork,
+        xfs_fileoff_t                   offset)
+{
+        sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
+        trace_xfs_scrub_fblock_error(sc, whichfork, offset, __return_address);
+}
+
 /*
  * Warn about inodes that need administrative review but is not
  * incorrect.
@@ -245,6 +325,59 @@ xfs_scrub_set_incomplete(
 }
 
 /*
+ * rmap scrubbing -- compute the number of blocks with a given owner,
+ * at least according to the reverse mapping data.
+ */
+
+struct xfs_scrub_rmap_ownedby_info {
+        struct xfs_owner_info   *oinfo;
+        xfs_filblks_t           *blocks;
+};
+
+STATIC int
+xfs_scrub_count_rmap_ownedby_irec(
+        struct xfs_btree_cur                    *cur,
+        struct xfs_rmap_irec                    *rec,
+        void                                    *priv)
+{
+        struct xfs_scrub_rmap_ownedby_info      *sroi = priv;
+        bool                                    irec_attr;
+        bool                                    oinfo_attr;
+
+        irec_attr = rec->rm_flags & XFS_RMAP_ATTR_FORK;
+        oinfo_attr = sroi->oinfo->oi_flags & XFS_OWNER_INFO_ATTR_FORK;
+
+        if (rec->rm_owner != sroi->oinfo->oi_owner)
+                return 0;
+
+        if (XFS_RMAP_NON_INODE_OWNER(rec->rm_owner) || irec_attr == oinfo_attr)
+                (*sroi->blocks) += rec->rm_blockcount;
+
+        return 0;
+}
+
+/*
+ * Calculate the number of blocks the rmap thinks are owned by something.
+ * The caller should pass us an rmapbt cursor.
+ */
+int
+xfs_scrub_count_rmap_ownedby_ag(
+        struct xfs_scrub_context                *sc,
+        struct xfs_btree_cur                    *cur,
+        struct xfs_owner_info                   *oinfo,
+        xfs_filblks_t                           *blocks)
+{
+        struct xfs_scrub_rmap_ownedby_info      sroi;
+
+        sroi.oinfo = oinfo;
+        *blocks = 0;
+        sroi.blocks = blocks;
+
+        return xfs_rmap_query_all(cur, xfs_scrub_count_rmap_ownedby_irec,
+                        &sroi);
+}
+
+/*
  * AG scrubbing
  *
  * These helpers facilitate locking an allocation group's header
@@ -302,7 +435,7 @@ xfs_scrub_ag_read_headers(
         error = xfs_alloc_read_agfl(mp, sc->tp, agno, agfl);
         if (error && want_ag_read_header_failure(sc, XFS_SCRUB_TYPE_AGFL))
                 goto out;
-
+        error = 0;
 out:
         return error;
 }
@@ -472,7 +605,7 @@ xfs_scrub_setup_ag_btree(
                         return error;
         }
 
-        error = xfs_scrub_setup_ag_header(sc, ip);
+        error = xfs_scrub_setup_fs(sc, ip);
         if (error)
                 return error;
 
@@ -503,18 +636,11 @@ xfs_scrub_get_inode(
         struct xfs_scrub_context        *sc,
         struct xfs_inode                *ip_in)
 {
+        struct xfs_imap                 imap;
         struct xfs_mount                *mp = sc->mp;
         struct xfs_inode                *ip = NULL;
         int                             error;
 
-        /*
-         * If userspace passed us an AG number or a generation number
-         * without an inode number, they haven't got a clue so bail out
-         * immediately.
-         */
-        if (sc->sm->sm_agno || (sc->sm->sm_gen && !sc->sm->sm_ino))
-                return -EINVAL;
-
         /* We want to scan the inode we already had opened. */
         if (sc->sm->sm_ino == 0 || sc->sm->sm_ino == ip_in->i_ino) {
                 sc->ip = ip_in;
@@ -526,10 +652,33 @@ xfs_scrub_get_inode(
                 return -ENOENT;
         error = xfs_iget(mp, NULL, sc->sm->sm_ino,
                         XFS_IGET_UNTRUSTED | XFS_IGET_DONTCACHE, 0, &ip);
-        if (error == -ENOENT || error == -EINVAL) {
-                /* inode doesn't exist... */
-                return -ENOENT;
-        } else if (error) {
+        switch (error) {
+        case -ENOENT:
+                /* Inode doesn't exist, just bail out. */
+                return error;
+        case 0:
+                /* Got an inode, continue. */
+                break;
+        case -EINVAL:
+                /*
+                 * -EINVAL with IGET_UNTRUSTED could mean one of several
+                 * things: userspace gave us an inode number that doesn't
+                 * correspond to fs space, or doesn't have an inobt entry;
+                 * or it could simply mean that the inode buffer failed the
+                 * read verifiers.
+                 *
+                 * Try just the inode mapping lookup -- if it succeeds, then
+                 * the inode buffer verifier failed and something needs fixing.
+                 * Otherwise, we really couldn't find it so tell userspace
+                 * that it no longer exists.
+                 */
+                error = xfs_imap(sc->mp, sc->tp, sc->sm->sm_ino, &imap,
+                                XFS_IGET_UNTRUSTED | XFS_IGET_DONTCACHE);
+                if (error)
+                        return -ENOENT;
+                error = -EFSCORRUPTED;
+                /* fall through */
+        default:
                 trace_xfs_scrub_op_error(sc,
                                 XFS_INO_TO_AGNO(mp, sc->sm->sm_ino),
                                 XFS_INO_TO_AGBNO(mp, sc->sm->sm_ino),
@@ -572,3 +721,61 @@ out:
         /* scrub teardown will unlock and release the inode for us */
         return error;
 }
+
+/*
+ * Predicate that decides if we need to evaluate the cross-reference check.
+ * If there was an error accessing the cross-reference btree, just delete
+ * the cursor and skip the check.
+ */
+bool
+xfs_scrub_should_check_xref(
+        struct xfs_scrub_context        *sc,
+        int                             *error,
+        struct xfs_btree_cur            **curpp)
+{
+        if (*error == 0)
+                return true;
+
+        if (curpp) {
+                /* If we've already given up on xref, just bail out. */
+                if (!*curpp)
+                        return false;
+
+                /* xref error, delete cursor and bail out. */
+                xfs_btree_del_cursor(*curpp, XFS_BTREE_ERROR);
+                *curpp = NULL;
+        }
+
+        sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XFAIL;
+        trace_xfs_scrub_xref_error(sc, *error, __return_address);
+
+        /*
+         * Errors encountered during cross-referencing with another
+         * data structure should not cause this scrubber to abort.
+         */
+        *error = 0;
+        return false;
+}
+
+/* Run the structure verifiers on in-memory buffers to detect bad memory. */
+void
+xfs_scrub_buffer_recheck(
+        struct xfs_scrub_context        *sc,
+        struct xfs_buf                  *bp)
+{
+        xfs_failaddr_t                  fa;
+
+        if (bp->b_ops == NULL) {
+                xfs_scrub_block_set_corrupt(sc, bp);
+                return;
+        }
+        if (bp->b_ops->verify_struct == NULL) {
+                xfs_scrub_set_incomplete(sc);
+                return;
+        }
+        fa = bp->b_ops->verify_struct(bp);
+        if (!fa)
+                return;
+        sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
+        trace_xfs_scrub_block_error(sc, bp->b_bn, fa);
+}
diff --git a/fs/xfs/scrub/common.h b/fs/xfs/scrub/common.h
index 5c043855570e..ddb65d22c76a 100644
--- a/fs/xfs/scrub/common.h
+++ b/fs/xfs/scrub/common.h
@@ -56,6 +56,11 @@ bool xfs_scrub_process_error(struct xfs_scrub_context *sc, xfs_agnumber_t agno,
 bool xfs_scrub_fblock_process_error(struct xfs_scrub_context *sc, int whichfork,
                 xfs_fileoff_t offset, int *error);
 
+bool xfs_scrub_xref_process_error(struct xfs_scrub_context *sc,
+                xfs_agnumber_t agno, xfs_agblock_t bno, int *error);
+bool xfs_scrub_fblock_xref_process_error(struct xfs_scrub_context *sc,
+                int whichfork, xfs_fileoff_t offset, int *error);
+
 void xfs_scrub_block_set_preen(struct xfs_scrub_context *sc,
                 struct xfs_buf *bp);
 void xfs_scrub_ino_set_preen(struct xfs_scrub_context *sc, xfs_ino_t ino,
@@ -68,6 +73,13 @@ void xfs_scrub_ino_set_corrupt(struct xfs_scrub_context *sc, xfs_ino_t ino,
 void xfs_scrub_fblock_set_corrupt(struct xfs_scrub_context *sc, int whichfork,
                 xfs_fileoff_t offset);
 
+void xfs_scrub_block_xref_set_corrupt(struct xfs_scrub_context *sc,
+                struct xfs_buf *bp);
+void xfs_scrub_ino_xref_set_corrupt(struct xfs_scrub_context *sc, xfs_ino_t ino,
+                struct xfs_buf *bp);
+void xfs_scrub_fblock_xref_set_corrupt(struct xfs_scrub_context *sc,
+                int whichfork, xfs_fileoff_t offset);
+
 void xfs_scrub_ino_set_warning(struct xfs_scrub_context *sc, xfs_ino_t ino,
                 struct xfs_buf *bp);
 void xfs_scrub_fblock_set_warning(struct xfs_scrub_context *sc, int whichfork,
@@ -76,10 +88,12 @@ void xfs_scrub_fblock_set_warning(struct xfs_scrub_context *sc, int whichfork,
 void xfs_scrub_set_incomplete(struct xfs_scrub_context *sc);
 int xfs_scrub_checkpoint_log(struct xfs_mount *mp);
 
+/* Are we set up for a cross-referencing check? */
+bool xfs_scrub_should_check_xref(struct xfs_scrub_context *sc, int *error,
+                           struct xfs_btree_cur **curpp);
+
 /* Setup functions */
 int xfs_scrub_setup_fs(struct xfs_scrub_context *sc, struct xfs_inode *ip);
-int xfs_scrub_setup_ag_header(struct xfs_scrub_context *sc,
-                              struct xfs_inode *ip);
 int xfs_scrub_setup_ag_allocbt(struct xfs_scrub_context *sc,
                                struct xfs_inode *ip);
 int xfs_scrub_setup_ag_iallocbt(struct xfs_scrub_context *sc,
@@ -134,11 +148,16 @@ int xfs_scrub_walk_agfl(struct xfs_scrub_context *sc,
                         int (*fn)(struct xfs_scrub_context *, xfs_agblock_t bno,
                                   void *),
                         void *priv);
+int xfs_scrub_count_rmap_ownedby_ag(struct xfs_scrub_context *sc,
+                                    struct xfs_btree_cur *cur,
+                                    struct xfs_owner_info *oinfo,
+                                    xfs_filblks_t *blocks);
 
 int xfs_scrub_setup_ag_btree(struct xfs_scrub_context *sc,
                              struct xfs_inode *ip, bool force_log);
 int xfs_scrub_get_inode(struct xfs_scrub_context *sc, struct xfs_inode *ip_in);
 int xfs_scrub_setup_inode_contents(struct xfs_scrub_context *sc,
                                    struct xfs_inode *ip, unsigned int resblks);
+void xfs_scrub_buffer_recheck(struct xfs_scrub_context *sc, struct xfs_buf *bp);
 
 #endif  /* __XFS_SCRUB_COMMON_H__ */
diff --git a/fs/xfs/scrub/dabtree.c b/fs/xfs/scrub/dabtree.c
index d94edd93cba8..bffdb7dc09bf 100644
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -233,11 +233,28 @@ xfs_scrub_da_btree_write_verify(
                 return;
         }
 }
+static void *
+xfs_scrub_da_btree_verify(
+        struct xfs_buf          *bp)
+{
+        struct xfs_da_blkinfo   *info = bp->b_addr;
+
+        switch (be16_to_cpu(info->magic)) {
+        case XFS_DIR2_LEAF1_MAGIC:
+        case XFS_DIR3_LEAF1_MAGIC:
+                bp->b_ops = &xfs_dir3_leaf1_buf_ops;
+                return bp->b_ops->verify_struct(bp);
+        default:
+                bp->b_ops = &xfs_da3_node_buf_ops;
+                return bp->b_ops->verify_struct(bp);
+        }
+}
 
 static const struct xfs_buf_ops xfs_scrub_da_btree_buf_ops = {
         .name = "xfs_scrub_da_btree",
         .verify_read = xfs_scrub_da_btree_read_verify,
         .verify_write = xfs_scrub_da_btree_write_verify,
+        .verify_struct = xfs_scrub_da_btree_verify,
 };
 
 /* Check a block's sibling. */
@@ -276,6 +293,9 @@ xfs_scrub_da_btree_block_check_sibling(
                 xfs_scrub_da_set_corrupt(ds, level);
                 return error;
         }
+        if (ds->state->altpath.blk[level].bp)
+                xfs_scrub_buffer_recheck(ds->sc,
+                                ds->state->altpath.blk[level].bp);
 
         /* Compare upper level pointer to sibling pointer. */
         if (ds->state->altpath.blk[level].blkno != sibling)
@@ -358,6 +378,8 @@ xfs_scrub_da_btree_block(
                         &xfs_scrub_da_btree_buf_ops);
         if (!xfs_scrub_da_process_error(ds, level, &error))
                 goto out_nobuf;
+        if (blk->bp)
+                xfs_scrub_buffer_recheck(ds->sc, blk->bp);
 
         /*
          * We didn't find a dir btree root block, which means that
diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
index 69e1efdd4019..50b6a26b0299 100644
--- a/fs/xfs/scrub/dir.c
+++ b/fs/xfs/scrub/dir.c
@@ -92,7 +92,7 @@ xfs_scrub_dir_check_ftype(
          * inodes can trigger immediate inactive cleanup of the inode.
          */
         error = xfs_iget(mp, sdc->sc->tp, inum, 0, 0, &ip);
-        if (!xfs_scrub_fblock_process_error(sdc->sc, XFS_DATA_FORK, offset,
+        if (!xfs_scrub_fblock_xref_process_error(sdc->sc, XFS_DATA_FORK, offset,
                         &error))
                 goto out;
 
@@ -200,6 +200,7 @@ xfs_scrub_dir_rec(
         struct xfs_inode                *dp = ds->dargs.dp;
         struct xfs_dir2_data_entry      *dent;
         struct xfs_buf                  *bp;
+        char                            *p, *endp;
         xfs_ino_t                       ino;
         xfs_dablk_t                     rec_bno;
         xfs_dir2_db_t                   db;
@@ -237,9 +238,37 @@ xfs_scrub_dir_rec(
                 xfs_scrub_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
                 goto out;
         }
+        xfs_scrub_buffer_recheck(ds->sc, bp);
 
-        /* Retrieve the entry, sanity check it, and compare hashes. */
         dent = (struct xfs_dir2_data_entry *)(((char *)bp->b_addr) + off);
+
+        /* Make sure we got a real directory entry. */
+        p = (char *)mp->m_dir_inode_ops->data_entry_p(bp->b_addr);
+        endp = xfs_dir3_data_endp(mp->m_dir_geo, bp->b_addr);
+        if (!endp) {
+                xfs_scrub_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
+                goto out_relse;
+        }
+        while (p < endp) {
+                struct xfs_dir2_data_entry      *dep;
+                struct xfs_dir2_data_unused     *dup;
+
+                dup = (struct xfs_dir2_data_unused *)p;
+                if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {
+                        p += be16_to_cpu(dup->length);
+                        continue;
+                }
+                dep = (struct xfs_dir2_data_entry *)p;
+                if (dep == dent)
+                        break;
+                p += mp->m_dir_inode_ops->data_entsize(dep->namelen);
+        }
+        if (p >= endp) {
+                xfs_scrub_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
+                goto out_relse;
+        }
+
+        /* Retrieve the entry, sanity check it, and compare hashes. */
         ino = be64_to_cpu(dent->inumber);
         hash = be32_to_cpu(ent->hashval);
         tag = be16_to_cpup(dp->d_ops->data_entry_tag_p(dent));
@@ -324,6 +353,7 @@ xfs_scrub_directory_data_bestfree(
         }
         if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
                 goto out;
+        xfs_scrub_buffer_recheck(sc, bp);
 
         /* XXX: Check xfs_dir3_data_hdr.pad is zero once we start setting it. */
 
@@ -361,13 +391,7 @@ xfs_scrub_directory_data_bestfree(
 
         /* Make sure the bestfrees are actually the best free spaces. */
         ptr = (char *)d_ops->data_entry_p(bp->b_addr);
-        if (is_block) {
-                struct xfs_dir2_block_tail      *btp;
-
-                btp = xfs_dir2_block_tail_p(mp->m_dir_geo, bp->b_addr);
-                endptr = (char *)xfs_dir2_block_leaf_p(btp);
-        } else
-                endptr = (char *)bp->b_addr + BBTOB(bp->b_length);
+        endptr = xfs_dir3_data_endp(mp->m_dir_geo, bp->b_addr);
 
         /* Iterate the entries, stopping when we hit or go past the end. */
         while (ptr < endptr) {
@@ -474,6 +498,7 @@ xfs_scrub_directory_leaf1_bestfree(
         error = xfs_dir3_leaf_read(sc->tp, sc->ip, lblk, -1, &bp);
         if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
                 goto out;
+        xfs_scrub_buffer_recheck(sc, bp);
 
         leaf = bp->b_addr;
         d_ops->leaf_hdr_from_disk(&leafhdr, leaf);
@@ -559,6 +584,7 @@ xfs_scrub_directory_free_bestfree(
         error = xfs_dir2_free_read(sc->tp, sc->ip, lblk, &bp);
         if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
                 goto out;
+        xfs_scrub_buffer_recheck(sc, bp);
 
         if (xfs_sb_version_hascrc(&sc->mp->m_sb)) {
                 struct xfs_dir3_free_hdr        *hdr3 = bp->b_addr;
diff --git a/fs/xfs/scrub/ialloc.c b/fs/xfs/scrub/ialloc.c
index 496d6f2fbb9e..63ab3f98430d 100644
--- a/fs/xfs/scrub/ialloc.c
+++ b/fs/xfs/scrub/ialloc.c
@@ -58,6 +58,56 @@ xfs_scrub_setup_ag_iallocbt(
 
 /* Inode btree scrubber. */
 
+/*
+ * If we're checking the finobt, cross-reference with the inobt.
+ * Otherwise we're checking the inobt; if there is an finobt, make sure
+ * we have a record or not depending on freecount.
+ */
+static inline void
+xfs_scrub_iallocbt_chunk_xref_other(
+        struct xfs_scrub_context        *sc,
+        struct xfs_inobt_rec_incore     *irec,
+        xfs_agino_t                     agino)
+{
+        struct xfs_btree_cur            **pcur;
+        bool                            has_irec;
+        int                             error;
+
+        if (sc->sm->sm_type == XFS_SCRUB_TYPE_FINOBT)
+                pcur = &sc->sa.ino_cur;
+        else
+                pcur = &sc->sa.fino_cur;
+        if (!(*pcur))
+                return;
+        error = xfs_ialloc_has_inode_record(*pcur, agino, agino, &has_irec);
+        if (!xfs_scrub_should_check_xref(sc, &error, pcur))
+                return;
+        if (((irec->ir_freecount > 0 && !has_irec) ||
+             (irec->ir_freecount == 0 && has_irec)))
+                xfs_scrub_btree_xref_set_corrupt(sc, *pcur, 0);
+}
+
+/* Cross-reference with the other btrees. */
+STATIC void
+xfs_scrub_iallocbt_chunk_xref(
+        struct xfs_scrub_context        *sc,
+        struct xfs_inobt_rec_incore     *irec,
+        xfs_agino_t                     agino,
+        xfs_agblock_t                   agbno,
+        xfs_extlen_t                    len)
+{
+        struct xfs_owner_info           oinfo;
+
+        if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        xfs_scrub_xref_is_used_space(sc, agbno, len);
+        xfs_scrub_iallocbt_chunk_xref_other(sc, irec, agino);
+        xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_INODES);
+        xfs_scrub_xref_is_owned_by(sc, agbno, len, &oinfo);
+        xfs_scrub_xref_is_not_shared(sc, agbno, len);
+}
+
 /* Is this chunk worth checking? */
 STATIC bool
 xfs_scrub_iallocbt_chunk(
@@ -76,6 +126,8 @@ xfs_scrub_iallocbt_chunk(
             !xfs_verify_agbno(mp, agno, bno + len - 1))
                 xfs_scrub_btree_set_corrupt(bs->sc, bs->cur, 0);
 
+        xfs_scrub_iallocbt_chunk_xref(bs->sc, irec, agino, bno, len);
+
         return true;
 }
 
@@ -190,8 +242,14 @@ xfs_scrub_iallocbt_check_freemask(
                 }
 
                 /* If any part of this is a hole, skip it. */
-                if (ir_holemask)
+                if (ir_holemask) {
+                        xfs_scrub_xref_is_not_owned_by(bs->sc, agbno,
+                                        blks_per_cluster, &oinfo);
                         continue;
+                }
+
+                xfs_scrub_xref_is_owned_by(bs->sc, agbno, blks_per_cluster,
+                                &oinfo);
 
                 /* Grab the inode cluster buffer. */
                 imap.im_blkno = XFS_AGB_TO_DADDR(mp, bs->cur->bc_private.a.agno,
@@ -227,6 +285,7 @@ xfs_scrub_iallocbt_rec(
         union xfs_btree_rec             *rec)
 {
         struct xfs_mount                *mp = bs->cur->bc_mp;
+        xfs_filblks_t                   *inode_blocks = bs->private;
         struct xfs_inobt_rec_incore     irec;
         uint64_t                        holes;
         xfs_agnumber_t                  agno = bs->cur->bc_private.a.agno;
@@ -264,6 +323,9 @@ xfs_scrub_iallocbt_rec(
             (agbno & (xfs_icluster_size_fsb(mp) - 1)))
                 xfs_scrub_btree_set_corrupt(bs->sc, bs->cur, 0);
 
+        *inode_blocks += XFS_B_TO_FSB(mp,
+                        irec.ir_count * mp->m_sb.sb_inodesize);
+
         /* Handle non-sparse inodes */
         if (!xfs_inobt_issparse(irec.ir_holemask)) {
                 len = XFS_B_TO_FSB(mp,
@@ -308,6 +370,72 @@ out:
         return error;
 }
 
+/*
+ * Make sure the inode btrees are as large as the rmap thinks they are.
+ * Don't bother if we're missing btree cursors, as we're already corrupt.
+ */
+STATIC void
+xfs_scrub_iallocbt_xref_rmap_btreeblks(
+        struct xfs_scrub_context        *sc,
+        int                             which)
+{
+        struct xfs_owner_info           oinfo;
+        xfs_filblks_t                   blocks;
+        xfs_extlen_t                    inobt_blocks = 0;
+        xfs_extlen_t                    finobt_blocks = 0;
+        int                             error;
+
+        if (!sc->sa.ino_cur || !sc->sa.rmap_cur ||
+            (xfs_sb_version_hasfinobt(&sc->mp->m_sb) && !sc->sa.fino_cur))
+                return;
+
+        /* Check that we saw as many inobt blocks as the rmap says. */
+        error = xfs_btree_count_blocks(sc->sa.ino_cur, &inobt_blocks);
+        if (!xfs_scrub_process_error(sc, 0, 0, &error))
+                return;
+
+        if (sc->sa.fino_cur) {
+                error = xfs_btree_count_blocks(sc->sa.fino_cur, &finobt_blocks);
+                if (!xfs_scrub_process_error(sc, 0, 0, &error))
+                        return;
+        }
+
+        xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_INOBT);
+        error = xfs_scrub_count_rmap_ownedby_ag(sc, sc->sa.rmap_cur, &oinfo,
+                        &blocks);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.rmap_cur))
+                return;
+        if (blocks != inobt_blocks + finobt_blocks)
+                xfs_scrub_btree_set_corrupt(sc, sc->sa.ino_cur, 0);
+}
+
+/*
+ * Make sure that the inobt records point to the same number of blocks as
+ * the rmap says are owned by inodes.
+ */
+STATIC void
+xfs_scrub_iallocbt_xref_rmap_inodes(
+        struct xfs_scrub_context        *sc,
+        int                             which,
+        xfs_filblks_t                   inode_blocks)
+{
+        struct xfs_owner_info           oinfo;
+        xfs_filblks_t                   blocks;
+        int                             error;
+
+        if (!sc->sa.rmap_cur)
+                return;
+
+        /* Check that we saw as many inode blocks as the rmap knows about. */
+        xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_INODES);
+        error = xfs_scrub_count_rmap_ownedby_ag(sc, sc->sa.rmap_cur, &oinfo,
+                        &blocks);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.rmap_cur))
+                return;
+        if (blocks != inode_blocks)
+                xfs_scrub_btree_set_corrupt(sc, sc->sa.ino_cur, 0);
+}
+
 /* Scrub the inode btrees for some AG. */
 STATIC int
 xfs_scrub_iallocbt(
@@ -316,10 +444,29 @@ xfs_scrub_iallocbt(
 {
         struct xfs_btree_cur            *cur;
         struct xfs_owner_info           oinfo;
+        xfs_filblks_t                   inode_blocks = 0;
+        int                             error;
 
         xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_INOBT);
         cur = which == XFS_BTNUM_INO ? sc->sa.ino_cur : sc->sa.fino_cur;
-        return xfs_scrub_btree(sc, cur, xfs_scrub_iallocbt_rec, &oinfo, NULL);
+        error = xfs_scrub_btree(sc, cur, xfs_scrub_iallocbt_rec, &oinfo,
+                        &inode_blocks);
+        if (error)
+                return error;
+
+        xfs_scrub_iallocbt_xref_rmap_btreeblks(sc, which);
+
+        /*
+         * If we're scrubbing the inode btree, inode_blocks is the number of
+         * blocks pointed to by all the inode chunk records.  Therefore, we
+         * should compare to the number of inode chunk blocks that the rmap
+         * knows about.  We can't do this for the finobt since it only points
+         * to inode chunks with free inodes.
+         */
+        if (which == XFS_BTNUM_INO)
+                xfs_scrub_iallocbt_xref_rmap_inodes(sc, which, inode_blocks);
+
+        return error;
 }
 
 int
@@ -335,3 +482,46 @@ xfs_scrub_finobt(
 {
         return xfs_scrub_iallocbt(sc, XFS_BTNUM_FINO);
 }
+
+/* See if an inode btree has (or doesn't have) an inode chunk record. */
+static inline void
+xfs_scrub_xref_inode_check(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   agbno,
+        xfs_extlen_t                    len,
+        struct xfs_btree_cur            **icur,
+        bool                            should_have_inodes)
+{
+        bool                            has_inodes;
+        int                             error;
+
+        if (!(*icur))
+                return;
+
+        error = xfs_ialloc_has_inodes_at_extent(*icur, agbno, len, &has_inodes);
+        if (!xfs_scrub_should_check_xref(sc, &error, icur))
+                return;
+        if (has_inodes != should_have_inodes)
+                xfs_scrub_btree_xref_set_corrupt(sc, *icur, 0);
+}
+
+/* xref check that the extent is not covered by inodes */
+void
+xfs_scrub_xref_is_not_inode_chunk(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   agbno,
+        xfs_extlen_t                    len)
+{
+        xfs_scrub_xref_inode_check(sc, agbno, len, &sc->sa.ino_cur, false);
+        xfs_scrub_xref_inode_check(sc, agbno, len, &sc->sa.fino_cur, false);
+}
+
+/* xref check that the extent is covered by inodes */
+void
+xfs_scrub_xref_is_inode_chunk(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   agbno,
+        xfs_extlen_t                    len)
+{
+        xfs_scrub_xref_inode_check(sc, agbno, len, &sc->sa.ino_cur, true);
+}
diff --git a/fs/xfs/scrub/inode.c b/fs/xfs/scrub/inode.c
index f120fb20452f..21297bef8df1 100644
--- a/fs/xfs/scrub/inode.c
+++ b/fs/xfs/scrub/inode.c
@@ -36,9 +36,13 @@
 #include "xfs_ialloc.h"
 #include "xfs_da_format.h"
 #include "xfs_reflink.h"
+#include "xfs_rmap.h"
+#include "xfs_bmap.h"
+#include "xfs_bmap_util.h"
 #include "scrub/xfs_scrub.h"
 #include "scrub/scrub.h"
 #include "scrub/common.h"
+#include "scrub/btree.h"
 #include "scrub/trace.h"
 
 /*
@@ -64,7 +68,7 @@ xfs_scrub_setup_inode(
                 break;
         case -EFSCORRUPTED:
         case -EFSBADCRC:
-                return 0;
+                return xfs_scrub_trans_alloc(sc->sm, mp, &sc->tp);
         default:
                 return error;
         }
@@ -392,6 +396,14 @@ xfs_scrub_dinode(
                 break;
         }
 
+        /* di_[amc]time.nsec */
+        if (be32_to_cpu(dip->di_atime.t_nsec) >= NSEC_PER_SEC)
+                xfs_scrub_ino_set_corrupt(sc, ino, bp);
+        if (be32_to_cpu(dip->di_mtime.t_nsec) >= NSEC_PER_SEC)
+                xfs_scrub_ino_set_corrupt(sc, ino, bp);
+        if (be32_to_cpu(dip->di_ctime.t_nsec) >= NSEC_PER_SEC)
+                xfs_scrub_ino_set_corrupt(sc, ino, bp);
+
         /*
          * di_size.  xfs_dinode_verify checks for things that screw up
          * the VFS such as the upper bit being set and zero-length
@@ -495,6 +507,8 @@ xfs_scrub_dinode(
         }
 
         if (dip->di_version >= 3) {
+                if (be32_to_cpu(dip->di_crtime.t_nsec) >= NSEC_PER_SEC)
+                        xfs_scrub_ino_set_corrupt(sc, ino, bp);
                 xfs_scrub_inode_flags2(sc, bp, dip, ino, mode, flags, flags2);
                 xfs_scrub_inode_cowextsize(sc, bp, dip, ino, mode, flags,
                                 flags2);
@@ -546,7 +560,7 @@ xfs_scrub_inode_map_raw(
          */
         bp->b_ops = &xfs_inode_buf_ops;
         dip = xfs_buf_offset(bp, imap.im_boffset);
-        if (!xfs_dinode_verify(mp, ino, dip) ||
+        if (xfs_dinode_verify(mp, ino, dip) != NULL ||
             !xfs_dinode_good_version(mp, dip->di_version)) {
                 xfs_scrub_ino_set_corrupt(sc, ino, bp);
                 goto out_buf;
@@ -567,18 +581,155 @@ out_buf:
         return error;
 }
 
+/*
+ * Make sure the finobt doesn't think this inode is free.
+ * We don't have to check the inobt ourselves because we got the inode via
+ * IGET_UNTRUSTED, which checks the inobt for us.
+ */
+static void
+xfs_scrub_inode_xref_finobt(
+        struct xfs_scrub_context        *sc,
+        xfs_ino_t                       ino)
+{
+        struct xfs_inobt_rec_incore     rec;
+        xfs_agino_t                     agino;
+        int                             has_record;
+        int                             error;
+
+        if (!sc->sa.fino_cur)
+                return;
+
+        agino = XFS_INO_TO_AGINO(sc->mp, ino);
+
+        /*
+         * Try to get the finobt record.  If we can't get it, then we're
+         * in good shape.
+         */
+        error = xfs_inobt_lookup(sc->sa.fino_cur, agino, XFS_LOOKUP_LE,
+                        &has_record);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.fino_cur) ||
+            !has_record)
+                return;
+
+        error = xfs_inobt_get_rec(sc->sa.fino_cur, &rec, &has_record);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.fino_cur) ||
+            !has_record)
+                return;
+
+        /*
+         * Otherwise, make sure this record either doesn't cover this inode,
+         * or that it does but it's marked present.
+         */
+        if (rec.ir_startino > agino ||
+            rec.ir_startino + XFS_INODES_PER_CHUNK <= agino)
+                return;
+
+        if (rec.ir_free & XFS_INOBT_MASK(agino - rec.ir_startino))
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.fino_cur, 0);
+}
+
+/* Cross reference the inode fields with the forks. */
+STATIC void
+xfs_scrub_inode_xref_bmap(
+        struct xfs_scrub_context        *sc,
+        struct xfs_dinode               *dip)
+{
+        xfs_extnum_t                    nextents;
+        xfs_filblks_t                   count;
+        xfs_filblks_t                   acount;
+        int                             error;
+
+        /* Walk all the extents to check nextents/naextents/nblocks. */
+        error = xfs_bmap_count_blocks(sc->tp, sc->ip, XFS_DATA_FORK,
+                        &nextents, &count);
+        if (!xfs_scrub_should_check_xref(sc, &error, NULL))
+                return;
+        if (nextents < be32_to_cpu(dip->di_nextents))
+                xfs_scrub_ino_xref_set_corrupt(sc, sc->ip->i_ino, NULL);
+
+        error = xfs_bmap_count_blocks(sc->tp, sc->ip, XFS_ATTR_FORK,
+                        &nextents, &acount);
+        if (!xfs_scrub_should_check_xref(sc, &error, NULL))
+                return;
+        if (nextents != be16_to_cpu(dip->di_anextents))
+                xfs_scrub_ino_xref_set_corrupt(sc, sc->ip->i_ino, NULL);
+
+        /* Check nblocks against the inode. */
+        if (count + acount != be64_to_cpu(dip->di_nblocks))
+                xfs_scrub_ino_xref_set_corrupt(sc, sc->ip->i_ino, NULL);
+}
+
+/* Cross-reference with the other btrees. */
+STATIC void
+xfs_scrub_inode_xref(
+        struct xfs_scrub_context        *sc,
+        xfs_ino_t                       ino,
+        struct xfs_dinode               *dip)
+{
+        struct xfs_owner_info           oinfo;
+        xfs_agnumber_t                  agno;
+        xfs_agblock_t                   agbno;
+        int                             error;
+
+        if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        agno = XFS_INO_TO_AGNO(sc->mp, ino);
+        agbno = XFS_INO_TO_AGBNO(sc->mp, ino);
+
+        error = xfs_scrub_ag_init(sc, agno, &sc->sa);
+        if (!xfs_scrub_xref_process_error(sc, agno, agbno, &error))
+                return;
+
+        xfs_scrub_xref_is_used_space(sc, agbno, 1);
+        xfs_scrub_inode_xref_finobt(sc, ino);
+        xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_INODES);
+        xfs_scrub_xref_is_owned_by(sc, agbno, 1, &oinfo);
+        xfs_scrub_xref_is_not_shared(sc, agbno, 1);
+        xfs_scrub_inode_xref_bmap(sc, dip);
+
+        xfs_scrub_ag_free(sc, &sc->sa);
+}
+
+/*
+ * If the reflink iflag disagrees with a scan for shared data fork extents,
+ * either flag an error (shared extents w/ no flag) or a preen (flag set w/o
+ * any shared extents).  We already checked for reflink iflag set on a non
+ * reflink filesystem.
+ */
+static void
+xfs_scrub_inode_check_reflink_iflag(
+        struct xfs_scrub_context        *sc,
+        xfs_ino_t                       ino,
+        struct xfs_buf                  *bp)
+{
+        struct xfs_mount                *mp = sc->mp;
+        bool                            has_shared;
+        int                             error;
+
+        if (!xfs_sb_version_hasreflink(&mp->m_sb))
+                return;
+
+        error = xfs_reflink_inode_has_shared_extents(sc->tp, sc->ip,
+                        &has_shared);
+        if (!xfs_scrub_xref_process_error(sc, XFS_INO_TO_AGNO(mp, ino),
+                        XFS_INO_TO_AGBNO(mp, ino), &error))
+                return;
+        if (xfs_is_reflink_inode(sc->ip) && !has_shared)
+                xfs_scrub_ino_set_preen(sc, ino, bp);
+        else if (!xfs_is_reflink_inode(sc->ip) && has_shared)
+                xfs_scrub_ino_set_corrupt(sc, ino, bp);
+}
+
 /* Scrub an inode. */
 int
 xfs_scrub_inode(
         struct xfs_scrub_context        *sc)
 {
         struct xfs_dinode               di;
-        struct xfs_mount                *mp = sc->mp;
         struct xfs_buf                  *bp = NULL;
         struct xfs_dinode               *dip;
         xfs_ino_t                       ino;
-
-        bool                            has_shared;
         int                             error = 0;
 
         /* Did we get the in-core inode, or are we doing this manually? */
@@ -603,19 +754,14 @@ xfs_scrub_inode(
                 goto out;
 
         /*
-         * Does this inode have the reflink flag set but no shared extents?
-         * Set the preening flag if this is the case.
+         * Look for discrepancies between file's data blocks and the reflink
+         * iflag.  We already checked the iflag against the file mode when
+         * we scrubbed the dinode.
          */
-        if (xfs_is_reflink_inode(sc->ip)) {
-                error = xfs_reflink_inode_has_shared_extents(sc->tp, sc->ip,
-                                &has_shared);
-                if (!xfs_scrub_process_error(sc, XFS_INO_TO_AGNO(mp, ino),
-                                XFS_INO_TO_AGBNO(mp, ino), &error))
-                        goto out;
-                if (!has_shared)
-                        xfs_scrub_ino_set_preen(sc, ino, bp);
-        }
+        if (S_ISREG(VFS_I(sc->ip)->i_mode))
+                xfs_scrub_inode_check_reflink_iflag(sc, ino, bp);
 
+        xfs_scrub_inode_xref(sc, ino, dip);
 out:
         if (bp)
                 xfs_trans_brelse(sc->tp, bp);
diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c
index 63a25334fc83..0d3851410c74 100644
--- a/fs/xfs/scrub/parent.c
+++ b/fs/xfs/scrub/parent.c
@@ -169,9 +169,9 @@ xfs_scrub_parent_validate(
          * immediate inactive cleanup of the inode.
          */
         error = xfs_iget(mp, sc->tp, dnum, 0, 0, &dp);
-        if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, 0, &error))
+        if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
                 goto out;
-        if (dp == sc->ip) {
+        if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) {
                 xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
                 goto out_rele;
         }
@@ -185,7 +185,7 @@ xfs_scrub_parent_validate(
          */
         if (xfs_ilock_nowait(dp, XFS_IOLOCK_SHARED)) {
                 error = xfs_scrub_parent_count_parent_dentries(sc, dp, &nlink);
-                if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, 0,
+                if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0,
                                 &error))
                         goto out_unlock;
                 if (nlink != expected_nlink)
@@ -205,7 +205,7 @@ xfs_scrub_parent_validate(
 
         /* Go looking for our dentry. */
         error = xfs_scrub_parent_count_parent_dentries(sc, dp, &nlink);
-        if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, 0, &error))
+        if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
                 goto out_unlock;
 
         /* Drop the parent lock, relock this inode. */
diff --git a/fs/xfs/scrub/quota.c b/fs/xfs/scrub/quota.c
index 3d9037eceaf1..51daa4ae2627 100644
--- a/fs/xfs/scrub/quota.c
+++ b/fs/xfs/scrub/quota.c
@@ -67,13 +67,6 @@ xfs_scrub_setup_quota(
 {
         uint                            dqtype;
 
-        /*
-         * If userspace gave us an AG number or inode data, they don't
-         * know what they're doing.  Get out.
-         */
-        if (sc->sm->sm_agno || sc->sm->sm_ino || sc->sm->sm_gen)
-                return -EINVAL;
-
         dqtype = xfs_scrub_quota_to_dqtype(sc);
         if (dqtype == 0)
                 return -EINVAL;
diff --git a/fs/xfs/scrub/refcount.c b/fs/xfs/scrub/refcount.c
index 2f88a8d44bd0..400f1561cd3d 100644
--- a/fs/xfs/scrub/refcount.c
+++ b/fs/xfs/scrub/refcount.c
@@ -31,6 +31,7 @@
 #include "xfs_sb.h"
 #include "xfs_alloc.h"
 #include "xfs_rmap.h"
+#include "xfs_refcount.h"
 #include "scrub/xfs_scrub.h"
 #include "scrub/scrub.h"
 #include "scrub/common.h"
@@ -50,6 +51,307 @@ xfs_scrub_setup_ag_refcountbt(
 
 /* Reference count btree scrubber. */
 
+/*
+ * Confirming Reference Counts via Reverse Mappings
+ *
+ * We want to count the reverse mappings overlapping a refcount record
+ * (bno, len, refcount), allowing for the possibility that some of the
+ * overlap may come from smaller adjoining reverse mappings, while some
+ * comes from single extents which overlap the range entirely.  The
+ * outer loop is as follows:
+ *
+ * 1. For all reverse mappings overlapping the refcount extent,
+ *    a. If a given rmap completely overlaps, mark it as seen.
+ *    b. Otherwise, record the fragment (in agbno order) for later
+ *       processing.
+ *
+ * Once we've seen all the rmaps, we know that for all blocks in the
+ * refcount record we want to find $refcount owners and we've already
+ * visited $seen extents that overlap all the blocks.  Therefore, we
+ * need to find ($refcount - $seen) owners for every block in the
+ * extent; call that quantity $target_nr.  Proceed as follows:
+ *
+ * 2. Pull the first $target_nr fragments from the list; all of them
+ *    should start at or before the start of the extent.
+ *    Call this subset of fragments the working set.
+ * 3. Until there are no more unprocessed fragments,
+ *    a. Find the shortest fragments in the set and remove them.
+ *    b. Note the block number of the end of these fragments.
+ *    c. Pull the same number of fragments from the list.  All of these
+ *       fragments should start at the block number recorded in the
+ *       previous step.
+ *    d. Put those fragments in the set.
+ * 4. Check that there are $target_nr fragments remaining in the list,
+ *    and that they all end at or beyond the end of the refcount extent.
+ *
+ * If the refcount is correct, all the check conditions in the algorithm
+ * should always hold true.  If not, the refcount is incorrect.
+ */
+struct xfs_scrub_refcnt_frag {
+        struct list_head                list;
+        struct xfs_rmap_irec            rm;
+};
+
+struct xfs_scrub_refcnt_check {
+        struct xfs_scrub_context        *sc;
+        struct list_head                fragments;
+
+        /* refcount extent we're examining */
+        xfs_agblock_t                   bno;
+        xfs_extlen_t                    len;
+        xfs_nlink_t                     refcount;
+
+        /* number of owners seen */
+        xfs_nlink_t                     seen;
+};
+
+/*
+ * Decide if the given rmap is large enough that we can redeem it
+ * towards refcount verification now, or if it's a fragment, in
+ * which case we'll hang onto it in the hopes that we'll later
+ * discover that we've collected exactly the correct number of
+ * fragments as the refcountbt says we should have.
+ */
+STATIC int
+xfs_scrub_refcountbt_rmap_check(
+        struct xfs_btree_cur            *cur,
+        struct xfs_rmap_irec            *rec,
+        void                            *priv)
+{
+        struct xfs_scrub_refcnt_check   *refchk = priv;
+        struct xfs_scrub_refcnt_frag    *frag;
+        xfs_agblock_t                   rm_last;
+        xfs_agblock_t                   rc_last;
+        int                             error = 0;
+
+        if (xfs_scrub_should_terminate(refchk->sc, &error))
+                return error;
+
+        rm_last = rec->rm_startblock + rec->rm_blockcount - 1;
+        rc_last = refchk->bno + refchk->len - 1;
+
+        /* Confirm that a single-owner refc extent is a CoW stage. */
+        if (refchk->refcount == 1 && rec->rm_owner != XFS_RMAP_OWN_COW) {
+                xfs_scrub_btree_xref_set_corrupt(refchk->sc, cur, 0);
+                return 0;
+        }
+
+        if (rec->rm_startblock <= refchk->bno && rm_last >= rc_last) {
+                /*
+                 * The rmap overlaps the refcount record, so we can confirm
+                 * one refcount owner seen.
+                 */
+                refchk->seen++;
+        } else {
+                /*
+                 * This rmap covers only part of the refcount record, so
+                 * save the fragment for later processing.  If the rmapbt
+                 * is healthy each rmap_irec we see will be in agbno order
+                 * so we don't need insertion sort here.
+                 */
+                frag = kmem_alloc(sizeof(struct xfs_scrub_refcnt_frag),
+                                KM_MAYFAIL | KM_NOFS);
+                if (!frag)
+                        return -ENOMEM;
+                memcpy(&frag->rm, rec, sizeof(frag->rm));
+                list_add_tail(&frag->list, &refchk->fragments);
+        }
+
+        return 0;
+}
+
+/*
+ * Given a bunch of rmap fragments, iterate through them, keeping
+ * a running tally of the refcount.  If this ever deviates from
+ * what we expect (which is the refcountbt's refcount minus the
+ * number of extents that totally covered the refcountbt extent),
+ * we have a refcountbt error.
+ */
+STATIC void
+xfs_scrub_refcountbt_process_rmap_fragments(
+        struct xfs_scrub_refcnt_check   *refchk)
+{
+        struct list_head                worklist;
+        struct xfs_scrub_refcnt_frag    *frag;
+        struct xfs_scrub_refcnt_frag    *n;
+        xfs_agblock_t                   bno;
+        xfs_agblock_t                   rbno;
+        xfs_agblock_t                   next_rbno;
+        xfs_nlink_t                     nr;
+        xfs_nlink_t                     target_nr;
+
+        target_nr = refchk->refcount - refchk->seen;
+        if (target_nr == 0)
+                return;
+
+        /*
+         * There are (refchk->rc.rc_refcount - refchk->nr refcount)
+         * references we haven't found yet.  Pull that many off the
+         * fragment list and figure out where the smallest rmap ends
+         * (and therefore the next rmap should start).  All the rmaps
+         * we pull off should start at or before the beginning of the
+         * refcount record's range.
+         */
+        INIT_LIST_HEAD(&worklist);
+        rbno = NULLAGBLOCK;
+        nr = 1;
+
+        /* Make sure the fragments actually /are/ in agbno order. */
+        bno = 0;
+        list_for_each_entry(frag, &refchk->fragments, list) {
+                if (frag->rm.rm_startblock < bno)
+                        goto done;
+                bno = frag->rm.rm_startblock;
+        }
+
+        /*
+         * Find all the rmaps that start at or before the refc extent,
+         * and put them on the worklist.
+         */
+        list_for_each_entry_safe(frag, n, &refchk->fragments, list) {
+                if (frag->rm.rm_startblock > refchk->bno)
+                        goto done;
+                bno = frag->rm.rm_startblock + frag->rm.rm_blockcount;
+                if (bno < rbno)
+                        rbno = bno;
+                list_move_tail(&frag->list, &worklist);
+                if (nr == target_nr)
+                        break;
+                nr++;
+        }
+
+        /*
+         * We should have found exactly $target_nr rmap fragments starting
+         * at or before the refcount extent.
+         */
+        if (nr != target_nr)
+                goto done;
+
+        while (!list_empty(&refchk->fragments)) {
+                /* Discard any fragments ending at rbno from the worklist. */
+                nr = 0;
+                next_rbno = NULLAGBLOCK;
+                list_for_each_entry_safe(frag, n, &worklist, list) {
+                        bno = frag->rm.rm_startblock + frag->rm.rm_blockcount;
+                        if (bno != rbno) {
+                                if (bno < next_rbno)
+                                        next_rbno = bno;
+                                continue;
+                        }
+                        list_del(&frag->list);
+                        kmem_free(frag);
+                        nr++;
+                }
+
+                /* Try to add nr rmaps starting at rbno to the worklist. */
+                list_for_each_entry_safe(frag, n, &refchk->fragments, list) {
+                        bno = frag->rm.rm_startblock + frag->rm.rm_blockcount;
+                        if (frag->rm.rm_startblock != rbno)
+                                goto done;
+                        list_move_tail(&frag->list, &worklist);
+                        if (next_rbno > bno)
+                                next_rbno = bno;
+                        nr--;
+                        if (nr == 0)
+                                break;
+                }
+
+                /*
+                 * If we get here and nr > 0, this means that we added fewer
+                 * items to the worklist than we discarded because the fragment
+                 * list ran out of items.  Therefore, we cannot maintain the
+                 * required refcount.  Something is wrong, so we're done.
+                 */
+                if (nr)
+                        goto done;
+
+                rbno = next_rbno;
+        }
+
+        /*
+         * Make sure the last extent we processed ends at or beyond
+         * the end of the refcount extent.
+         */
+        if (rbno < refchk->bno + refchk->len)
+                goto done;
+
+        /* Actually record us having seen the remaining refcount. */
+        refchk->seen = refchk->refcount;
+done:
+        /* Delete fragments and work list. */
+        list_for_each_entry_safe(frag, n, &worklist, list) {
+                list_del(&frag->list);
+                kmem_free(frag);
+        }
+        list_for_each_entry_safe(frag, n, &refchk->fragments, list) {
+                list_del(&frag->list);
+                kmem_free(frag);
+        }
+}
+
+/* Use the rmap entries covering this extent to verify the refcount. */
+STATIC void
+xfs_scrub_refcountbt_xref_rmap(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   bno,
+        xfs_extlen_t                    len,
+        xfs_nlink_t                     refcount)
+{
+        struct xfs_scrub_refcnt_check   refchk = {
+                .sc = sc,
+                .bno = bno,
+                .len = len,
+                .refcount = refcount,
+                .seen = 0,
+        };
+        struct xfs_rmap_irec            low;
+        struct xfs_rmap_irec            high;
+        struct xfs_scrub_refcnt_frag    *frag;
+        struct xfs_scrub_refcnt_frag    *n;
+        int                             error;
+
+        if (!sc->sa.rmap_cur)
+                return;
+
+        /* Cross-reference with the rmapbt to confirm the refcount. */
+        memset(&low, 0, sizeof(low));
+        low.rm_startblock = bno;
+        memset(&high, 0xFF, sizeof(high));
+        high.rm_startblock = bno + len - 1;
+
+        INIT_LIST_HEAD(&refchk.fragments);
+        error = xfs_rmap_query_range(sc->sa.rmap_cur, &low, &high,
+                        &xfs_scrub_refcountbt_rmap_check, &refchk);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.rmap_cur))
+                goto out_free;
+
+        xfs_scrub_refcountbt_process_rmap_fragments(&refchk);
+        if (refcount != refchk.seen)
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.rmap_cur, 0);
+
+out_free:
+        list_for_each_entry_safe(frag, n, &refchk.fragments, list) {
+                list_del(&frag->list);
+                kmem_free(frag);
+        }
+}
+
+/* Cross-reference with the other btrees. */
+STATIC void
+xfs_scrub_refcountbt_xref(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   agbno,
+        xfs_extlen_t                    len,
+        xfs_nlink_t                     refcount)
+{
+        if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        xfs_scrub_xref_is_used_space(sc, agbno, len);
+        xfs_scrub_xref_is_not_inode_chunk(sc, agbno, len);
+        xfs_scrub_refcountbt_xref_rmap(sc, agbno, len, refcount);
+}
+
 /* Scrub a refcountbt record. */
 STATIC int
 xfs_scrub_refcountbt_rec(
@@ -57,6 +359,7 @@ xfs_scrub_refcountbt_rec(
         union xfs_btree_rec             *rec)
 {
         struct xfs_mount                *mp = bs->cur->bc_mp;
+        xfs_agblock_t                   *cow_blocks = bs->private;
         xfs_agnumber_t                  agno = bs->cur->bc_private.a.agno;
         xfs_agblock_t                   bno;
         xfs_extlen_t                    len;
@@ -72,6 +375,8 @@ xfs_scrub_refcountbt_rec(
         has_cowflag = (bno & XFS_REFC_COW_START);
         if ((refcount == 1 && !has_cowflag) || (refcount != 1 && has_cowflag))
                 xfs_scrub_btree_set_corrupt(bs->sc, bs->cur, 0);
+        if (has_cowflag)
+                (*cow_blocks) += len;
 
         /* Check the extent. */
         bno &= ~XFS_REFC_COW_START;
@@ -83,17 +388,128 @@ xfs_scrub_refcountbt_rec(
         if (refcount == 0)
                 xfs_scrub_btree_set_corrupt(bs->sc, bs->cur, 0);
 
+        xfs_scrub_refcountbt_xref(bs->sc, bno, len, refcount);
+
         return error;
 }
 
+/* Make sure we have as many refc blocks as the rmap says. */
+STATIC void
+xfs_scrub_refcount_xref_rmap(
+        struct xfs_scrub_context        *sc,
+        struct xfs_owner_info           *oinfo,
+        xfs_filblks_t                   cow_blocks)
+{
+        xfs_extlen_t                    refcbt_blocks = 0;
+        xfs_filblks_t                   blocks;
+        int                             error;
+
+        if (!sc->sa.rmap_cur)
+                return;
+
+        /* Check that we saw as many refcbt blocks as the rmap knows about. */
+        error = xfs_btree_count_blocks(sc->sa.refc_cur, &refcbt_blocks);
+        if (!xfs_scrub_btree_process_error(sc, sc->sa.refc_cur, 0, &error))
+                return;
+        error = xfs_scrub_count_rmap_ownedby_ag(sc, sc->sa.rmap_cur, oinfo,
+                        &blocks);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.rmap_cur))
+                return;
+        if (blocks != refcbt_blocks)
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.rmap_cur, 0);
+
+        /* Check that we saw as many cow blocks as the rmap knows about. */
+        xfs_rmap_ag_owner(oinfo, XFS_RMAP_OWN_COW);
+        error = xfs_scrub_count_rmap_ownedby_ag(sc, sc->sa.rmap_cur, oinfo,
+                        &blocks);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.rmap_cur))
+                return;
+        if (blocks != cow_blocks)
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.rmap_cur, 0);
+}
+
 /* Scrub the refcount btree for some AG. */
 int
 xfs_scrub_refcountbt(
         struct xfs_scrub_context        *sc)
 {
         struct xfs_owner_info           oinfo;
+        xfs_agblock_t                   cow_blocks = 0;
+        int                             error;
 
         xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_REFC);
-        return xfs_scrub_btree(sc, sc->sa.refc_cur, xfs_scrub_refcountbt_rec,
-                        &oinfo, NULL);
+        error = xfs_scrub_btree(sc, sc->sa.refc_cur, xfs_scrub_refcountbt_rec,
+                        &oinfo, &cow_blocks);
+        if (error)
+                return error;
+
+        xfs_scrub_refcount_xref_rmap(sc, &oinfo, cow_blocks);
+
+        return 0;
+}
+
+/* xref check that a cow staging extent is marked in the refcountbt. */
+void
+xfs_scrub_xref_is_cow_staging(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   agbno,
+        xfs_extlen_t                    len)
+{
+        struct xfs_refcount_irec        rc;
+        bool                            has_cowflag;
+        int                             has_refcount;
+        int                             error;
+
+        if (!sc->sa.refc_cur)
+                return;
+
+        /* Find the CoW staging extent. */
+        error = xfs_refcount_lookup_le(sc->sa.refc_cur,
+                        agbno + XFS_REFC_COW_START, &has_refcount);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.refc_cur))
+                return;
+        if (!has_refcount) {
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.refc_cur, 0);
+                return;
+        }
+
+        error = xfs_refcount_get_rec(sc->sa.refc_cur, &rc, &has_refcount);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.refc_cur))
+                return;
+        if (!has_refcount) {
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.refc_cur, 0);
+                return;
+        }
+
+        /* CoW flag must be set, refcount must be 1. */
+        has_cowflag = (rc.rc_startblock & XFS_REFC_COW_START);
+        if (!has_cowflag || rc.rc_refcount != 1)
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.refc_cur, 0);
+
+        /* Must be at least as long as what was passed in */
+        if (rc.rc_blockcount < len)
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.refc_cur, 0);
+}
+
+/*
+ * xref check that the extent is not shared.  Only file data blocks
+ * can have multiple owners.
+ */
+void
+xfs_scrub_xref_is_not_shared(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   agbno,
+        xfs_extlen_t                    len)
+{
+        bool                            shared;
+        int                             error;
+
+        if (!sc->sa.refc_cur)
+                return;
+
+        error = xfs_refcount_has_record(sc->sa.refc_cur, agbno, len, &shared);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.refc_cur))
+                return;
+        if (shared)
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.refc_cur, 0);
 }
diff --git a/fs/xfs/scrub/rmap.c b/fs/xfs/scrub/rmap.c
index 97846c424690..8f2a7c3ff455 100644
--- a/fs/xfs/scrub/rmap.c
+++ b/fs/xfs/scrub/rmap.c
@@ -32,6 +32,7 @@
 #include "xfs_alloc.h"
 #include "xfs_ialloc.h"
 #include "xfs_rmap.h"
+#include "xfs_refcount.h"
 #include "scrub/xfs_scrub.h"
 #include "scrub/scrub.h"
 #include "scrub/common.h"
@@ -51,6 +52,61 @@ xfs_scrub_setup_ag_rmapbt(
 
 /* Reverse-mapping scrubber. */
 
+/* Cross-reference a rmap against the refcount btree. */
+STATIC void
+xfs_scrub_rmapbt_xref_refc(
+        struct xfs_scrub_context        *sc,
+        struct xfs_rmap_irec            *irec)
+{
+        xfs_agblock_t                   fbno;
+        xfs_extlen_t                    flen;
+        bool                            non_inode;
+        bool                            is_bmbt;
+        bool                            is_attr;
+        bool                            is_unwritten;
+        int                             error;
+
+        if (!sc->sa.refc_cur)
+                return;
+
+        non_inode = XFS_RMAP_NON_INODE_OWNER(irec->rm_owner);
+        is_bmbt = irec->rm_flags & XFS_RMAP_BMBT_BLOCK;
+        is_attr = irec->rm_flags & XFS_RMAP_ATTR_FORK;
+        is_unwritten = irec->rm_flags & XFS_RMAP_UNWRITTEN;
+
+        /* If this is shared, must be a data fork extent. */
+        error = xfs_refcount_find_shared(sc->sa.refc_cur, irec->rm_startblock,
+                        irec->rm_blockcount, &fbno, &flen, false);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.refc_cur))
+                return;
+        if (flen != 0 && (non_inode || is_attr || is_bmbt || is_unwritten))
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.refc_cur, 0);
+}
+
+/* Cross-reference with the other btrees. */
+STATIC void
+xfs_scrub_rmapbt_xref(
+        struct xfs_scrub_context        *sc,
+        struct xfs_rmap_irec            *irec)
+{
+        xfs_agblock_t                   agbno = irec->rm_startblock;
+        xfs_extlen_t                    len = irec->rm_blockcount;
+
+        if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+                return;
+
+        xfs_scrub_xref_is_used_space(sc, agbno, len);
+        if (irec->rm_owner == XFS_RMAP_OWN_INODES)
+                xfs_scrub_xref_is_inode_chunk(sc, agbno, len);
+        else
+                xfs_scrub_xref_is_not_inode_chunk(sc, agbno, len);
+        if (irec->rm_owner == XFS_RMAP_OWN_COW)
+                xfs_scrub_xref_is_cow_staging(sc, irec->rm_startblock,
+                                irec->rm_blockcount);
+        else
+                xfs_scrub_rmapbt_xref_refc(sc, irec);
+}
+
 /* Scrub an rmapbt record. */
 STATIC int
 xfs_scrub_rmapbt_rec(
@@ -121,6 +177,8 @@ xfs_scrub_rmapbt_rec(
                     irec.rm_owner > XFS_RMAP_OWN_FS)
                         xfs_scrub_btree_set_corrupt(bs->sc, bs->cur, 0);
         }
+
+        xfs_scrub_rmapbt_xref(bs->sc, &irec);
 out:
         return error;
 }
@@ -136,3 +194,68 @@ xfs_scrub_rmapbt(
         return xfs_scrub_btree(sc, sc->sa.rmap_cur, xfs_scrub_rmapbt_rec,
                         &oinfo, NULL);
 }
+
+/* xref check that the extent is owned by a given owner */
+static inline void
+xfs_scrub_xref_check_owner(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   bno,
+        xfs_extlen_t                    len,
+        struct xfs_owner_info           *oinfo,
+        bool                            should_have_rmap)
+{
+        bool                            has_rmap;
+        int                             error;
+
+        if (!sc->sa.rmap_cur)
+                return;
+
+        error = xfs_rmap_record_exists(sc->sa.rmap_cur, bno, len, oinfo,
+                        &has_rmap);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.rmap_cur))
+                return;
+        if (has_rmap != should_have_rmap)
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.rmap_cur, 0);
+}
+
+/* xref check that the extent is owned by a given owner */
+void
+xfs_scrub_xref_is_owned_by(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   bno,
+        xfs_extlen_t                    len,
+        struct xfs_owner_info           *oinfo)
+{
+        xfs_scrub_xref_check_owner(sc, bno, len, oinfo, true);
+}
+
+/* xref check that the extent is not owned by a given owner */
+void
+xfs_scrub_xref_is_not_owned_by(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   bno,
+        xfs_extlen_t                    len,
+        struct xfs_owner_info           *oinfo)
+{
+        xfs_scrub_xref_check_owner(sc, bno, len, oinfo, false);
+}
+
+/* xref check that the extent has no reverse mapping at all */
+void
+xfs_scrub_xref_has_no_owner(
+        struct xfs_scrub_context        *sc,
+        xfs_agblock_t                   bno,
+        xfs_extlen_t                    len)
+{
+        bool                            has_rmap;
+        int                             error;
+
+        if (!sc->sa.rmap_cur)
+                return;
+
+        error = xfs_rmap_has_record(sc->sa.rmap_cur, bno, len, &has_rmap);
+        if (!xfs_scrub_should_check_xref(sc, &error, &sc->sa.rmap_cur))
+                return;
+        if (has_rmap)
+                xfs_scrub_btree_xref_set_corrupt(sc, sc->sa.rmap_cur, 0);
+}
diff --git a/fs/xfs/scrub/rtbitmap.c b/fs/xfs/scrub/rtbitmap.c
index c6fedb698008..26390991369a 100644
--- a/fs/xfs/scrub/rtbitmap.c
+++ b/fs/xfs/scrub/rtbitmap.c
@@ -43,22 +43,14 @@ xfs_scrub_setup_rt(
         struct xfs_scrub_context        *sc,
         struct xfs_inode                *ip)
 {
-        struct xfs_mount                *mp = sc->mp;
-        int                             error = 0;
-
-        /*
-         * If userspace gave us an AG number or inode data, they don't
-         * know what they're doing.  Get out.
-         */
-        if (sc->sm->sm_agno || sc->sm->sm_ino || sc->sm->sm_gen)
-                return -EINVAL;
+        int                             error;
 
         error = xfs_scrub_setup_fs(sc, ip);
         if (error)
                 return error;
 
         sc->ilock_flags = XFS_ILOCK_EXCL | XFS_ILOCK_RTBITMAP;
-        sc->ip = mp->m_rbmip;
+        sc->ip = sc->mp->m_rbmip;
         xfs_ilock(sc->ip, sc->ilock_flags);
 
         return 0;
@@ -106,3 +98,26 @@ xfs_scrub_rtsummary(
         /* XXX: implement this some day */
         return -ENOENT;
 }
+
+
+/* xref check that the extent is not free in the rtbitmap */
+void
+xfs_scrub_xref_is_used_rt_space(
+        struct xfs_scrub_context        *sc,
+        xfs_rtblock_t                   fsbno,
+        xfs_extlen_t                    len)
+{
+        bool                            is_free;
+        int                             error;
+
+        xfs_ilock(sc->mp->m_rbmip, XFS_ILOCK_SHARED | XFS_ILOCK_RTBITMAP);
+        error = xfs_rtalloc_extent_is_free(sc->mp, sc->tp, fsbno, len,
+                        &is_free);
+        if (!xfs_scrub_should_check_xref(sc, &error, NULL))
+                goto out_unlock;
+        if (is_free)
+                xfs_scrub_ino_xref_set_corrupt(sc, sc->mp->m_rbmip->i_ino,
+                                NULL);
+out_unlock:
+        xfs_iunlock(sc->mp->m_rbmip, XFS_ILOCK_SHARED | XFS_ILOCK_RTBITMAP);
+}
diff --git a/fs/xfs/scrub/scrub.c b/fs/xfs/scrub/scrub.c
index ab3aef2ae823..26c75967a072 100644
--- a/fs/xfs/scrub/scrub.c
+++ b/fs/xfs/scrub/scrub.c
@@ -110,6 +110,16 @@
  * structure itself is corrupt, the CORRUPT flag will be set.  If
  * the metadata is correct but otherwise suboptimal, the PREEN flag
  * will be set.
+ *
+ * We perform secondary validation of filesystem metadata by
+ * cross-referencing every record with all other available metadata.
+ * For example, for block mapping extents, we verify that there are no
+ * records in the free space and inode btrees corresponding to that
+ * space extent and that there is a corresponding entry in the reverse
+ * mapping btree.  Inconsistent metadata is noted by setting the
+ * XCORRUPT flag; btree query function errors are noted by setting the
+ * XFAIL flag and deleting the cursor to prevent further attempts to
+ * cross-reference with a defective btree.
  */
 
 /*
@@ -128,8 +138,6 @@ xfs_scrub_probe(
 {
         int                             error = 0;
 
-        if (sc->sm->sm_ino || sc->sm->sm_agno)
-                return -EINVAL;
         if (xfs_scrub_should_terminate(sc, &error))
                 return error;
 
@@ -151,7 +159,8 @@ xfs_scrub_teardown(
                 sc->tp = NULL;
         }
         if (sc->ip) {
-                xfs_iunlock(sc->ip, sc->ilock_flags);
+                if (sc->ilock_flags)
+                        xfs_iunlock(sc->ip, sc->ilock_flags);
                 if (sc->ip != ip_in &&
                     !xfs_internal_inum(sc->mp, sc->ip->i_ino))
                         iput(VFS_I(sc->ip));
@@ -167,106 +176,130 @@ xfs_scrub_teardown(
 /* Scrubbing dispatch. */
 
 static const struct xfs_scrub_meta_ops meta_scrub_ops[] = {
-        { /* ioctl presence test */
+        [XFS_SCRUB_TYPE_PROBE] = {      /* ioctl presence test */
+                .type   = ST_NONE,
                 .setup  = xfs_scrub_setup_fs,
                 .scrub  = xfs_scrub_probe,
         },
-        { /* superblock */
-                .setup  = xfs_scrub_setup_ag_header,
+        [XFS_SCRUB_TYPE_SB] = {         /* superblock */
+                .type   = ST_PERAG,
+                .setup  = xfs_scrub_setup_fs,
                 .scrub  = xfs_scrub_superblock,
         },
-        { /* agf */
-                .setup  = xfs_scrub_setup_ag_header,
+        [XFS_SCRUB_TYPE_AGF] = {        /* agf */
+                .type   = ST_PERAG,
+                .setup  = xfs_scrub_setup_fs,
                 .scrub  = xfs_scrub_agf,
         },
-        { /* agfl */
-                .setup  = xfs_scrub_setup_ag_header,
+        [XFS_SCRUB_TYPE_AGFL]= {        /* agfl */
+                .type   = ST_PERAG,
+                .setup  = xfs_scrub_setup_fs,
                 .scrub  = xfs_scrub_agfl,
         },
-        { /* agi */
-                .setup  = xfs_scrub_setup_ag_header,
+        [XFS_SCRUB_TYPE_AGI] = {        /* agi */
+                .type   = ST_PERAG,
+                .setup  = xfs_scrub_setup_fs,
                 .scrub  = xfs_scrub_agi,
         },
-        { /* bnobt */
+        [XFS_SCRUB_TYPE_BNOBT] = {      /* bnobt */
+                .type   = ST_PERAG,
                 .setup  = xfs_scrub_setup_ag_allocbt,
                 .scrub  = xfs_scrub_bnobt,
         },
-        { /* cntbt */
+        [XFS_SCRUB_TYPE_CNTBT] = {      /* cntbt */
+                .type   = ST_PERAG,
                 .setup  = xfs_scrub_setup_ag_allocbt,
                 .scrub  = xfs_scrub_cntbt,
         },
-        { /* inobt */
+        [XFS_SCRUB_TYPE_INOBT] = {      /* inobt */
+                .type   = ST_PERAG,
                 .setup  = xfs_scrub_setup_ag_iallocbt,
                 .scrub  = xfs_scrub_inobt,
         },
-        { /* finobt */
+        [XFS_SCRUB_TYPE_FINOBT] = {     /* finobt */
+                .type   = ST_PERAG,
                 .setup  = xfs_scrub_setup_ag_iallocbt,
                 .scrub  = xfs_scrub_finobt,
                 .has    = xfs_sb_version_hasfinobt,
         },
-        { /* rmapbt */
+        [XFS_SCRUB_TYPE_RMAPBT] = {     /* rmapbt */
+                .type   = ST_PERAG,
                 .setup  = xfs_scrub_setup_ag_rmapbt,
                 .scrub  = xfs_scrub_rmapbt,
                 .has    = xfs_sb_version_hasrmapbt,
         },
-        { /* refcountbt */
+        [XFS_SCRUB_TYPE_REFCNTBT] = {   /* refcountbt */
+                .type   = ST_PERAG,
                 .setup  = xfs_scrub_setup_ag_refcountbt,
                 .scrub  = xfs_scrub_refcountbt,
                 .has    = xfs_sb_version_hasreflink,
         },
-        { /* inode record */
+        [XFS_SCRUB_TYPE_INODE] = {      /* inode record */
+                .type   = ST_INODE,
                 .setup  = xfs_scrub_setup_inode,
                 .scrub  = xfs_scrub_inode,
         },
-        { /* inode data fork */
+        [XFS_SCRUB_TYPE_BMBTD] = {      /* inode data fork */
+                .type   = ST_INODE,
                 .setup  = xfs_scrub_setup_inode_bmap,
                 .scrub  = xfs_scrub_bmap_data,
         },
-        { /* inode attr fork */
+        [XFS_SCRUB_TYPE_BMBTA] = {      /* inode attr fork */
+                .type   = ST_INODE,
                 .setup  = xfs_scrub_setup_inode_bmap,
                 .scrub  = xfs_scrub_bmap_attr,
         },
-        { /* inode CoW fork */
+        [XFS_SCRUB_TYPE_BMBTC] = {      /* inode CoW fork */
+                .type   = ST_INODE,
                 .setup  = xfs_scrub_setup_inode_bmap,
                 .scrub  = xfs_scrub_bmap_cow,
         },
-        { /* directory */
+        [XFS_SCRUB_TYPE_DIR] = {        /* directory */
+                .type   = ST_INODE,
                 .setup  = xfs_scrub_setup_directory,
                 .scrub  = xfs_scrub_directory,
         },
-        { /* extended attributes */
+        [XFS_SCRUB_TYPE_XATTR] = {      /* extended attributes */
+                .type   = ST_INODE,
                 .setup  = xfs_scrub_setup_xattr,
                 .scrub  = xfs_scrub_xattr,
         },
-        { /* symbolic link */
+        [XFS_SCRUB_TYPE_SYMLINK] = {    /* symbolic link */
+                .type   = ST_INODE,
                 .setup  = xfs_scrub_setup_symlink,
                 .scrub  = xfs_scrub_symlink,
         },
-        { /* parent pointers */
+        [XFS_SCRUB_TYPE_PARENT] = {     /* parent pointers */
+                .type   = ST_INODE,
                 .setup  = xfs_scrub_setup_parent,
                 .scrub  = xfs_scrub_parent,
         },
-        { /* realtime bitmap */
+        [XFS_SCRUB_TYPE_RTBITMAP] = {   /* realtime bitmap */
+                .type   = ST_FS,
                 .setup  = xfs_scrub_setup_rt,
                 .scrub  = xfs_scrub_rtbitmap,
                 .has    = xfs_sb_version_hasrealtime,
         },
-        { /* realtime summary */
+        [XFS_SCRUB_TYPE_RTSUM] = {      /* realtime summary */
+                .type   = ST_FS,
                 .setup  = xfs_scrub_setup_rt,
                 .scrub  = xfs_scrub_rtsummary,
                 .has    = xfs_sb_version_hasrealtime,
         },
-        { /* user quota */
-                .setup = xfs_scrub_setup_quota,
-                .scrub = xfs_scrub_quota,
+        [XFS_SCRUB_TYPE_UQUOTA] = {     /* user quota */
+                .type   = ST_FS,
+                .setup  = xfs_scrub_setup_quota,
+                .scrub  = xfs_scrub_quota,
         },
-        { /* group quota */
-                .setup = xfs_scrub_setup_quota,
-                .scrub = xfs_scrub_quota,
+        [XFS_SCRUB_TYPE_GQUOTA] = {     /* group quota */
+                .type   = ST_FS,
+                .setup  = xfs_scrub_setup_quota,
+                .scrub  = xfs_scrub_quota,
         },
-        { /* project quota */
-                .setup = xfs_scrub_setup_quota,
-                .scrub = xfs_scrub_quota,
+        [XFS_SCRUB_TYPE_PQUOTA] = {     /* project quota */
+                .type   = ST_FS,
+                .setup  = xfs_scrub_setup_quota,
+                .scrub  = xfs_scrub_quota,
         },
 };
 
@@ -284,44 +317,56 @@ xfs_scrub_experimental_warning(
 "EXPERIMENTAL online scrub feature in use. Use at your own risk!");
 }
 
-/* Dispatch metadata scrubbing. */
-int
-xfs_scrub_metadata(
-        struct xfs_inode                *ip,
+static int
+xfs_scrub_validate_inputs(
+        struct xfs_mount                *mp,
         struct xfs_scrub_metadata       *sm)
 {
-        struct xfs_scrub_context        sc;
-        struct xfs_mount                *mp = ip->i_mount;
+        int                             error;
         const struct xfs_scrub_meta_ops *ops;
-        bool                            try_harder = false;
-        int                             error = 0;
-
-        trace_xfs_scrub_start(ip, sm, error);
-
-        /* Forbidden if we are shut down or mounted norecovery. */
-        error = -ESHUTDOWN;
-        if (XFS_FORCED_SHUTDOWN(mp))
-                goto out;
-        error = -ENOTRECOVERABLE;
-        if (mp->m_flags & XFS_MOUNT_NORECOVERY)
-                goto out;
 
-        /* Check our inputs. */
         error = -EINVAL;
+        /* Check our inputs. */
         sm->sm_flags &= ~XFS_SCRUB_FLAGS_OUT;
         if (sm->sm_flags & ~XFS_SCRUB_FLAGS_IN)
                 goto out;
+        /* sm_reserved[] must be zero */
         if (memchr_inv(sm->sm_reserved, 0, sizeof(sm->sm_reserved)))
                 goto out;
 
-        /* Do we know about this type of metadata? */
         error = -ENOENT;
+        /* Do we know about this type of metadata? */
         if (sm->sm_type >= XFS_SCRUB_TYPE_NR)
                 goto out;
         ops = &meta_scrub_ops[sm->sm_type];
-        if (ops->scrub == NULL)
+        if (ops->setup == NULL || ops->scrub == NULL)
                 goto out;
+        /* Does this fs even support this type of metadata? */
+        if (ops->has && !ops->has(&mp->m_sb))
+                goto out;
+
+        error = -EINVAL;
+        /* restricting fields must be appropriate for type */
+        switch (ops->type) {
+        case ST_NONE:
+        case ST_FS:
+                if (sm->sm_ino || sm->sm_gen || sm->sm_agno)
+                        goto out;
+                break;
+        case ST_PERAG:
+                if (sm->sm_ino || sm->sm_gen ||
+                    sm->sm_agno >= mp->m_sb.sb_agcount)
+                        goto out;
+                break;
+        case ST_INODE:
+                if (sm->sm_agno || (sm->sm_gen && !sm->sm_ino))
+                        goto out;
+                break;
+        default:
+                goto out;
+        }
 
+        error = -EOPNOTSUPP;
         /*
          * We won't scrub any filesystem that doesn't have the ability
          * to record unwritten extents.  The option was made default in
@@ -331,20 +376,46 @@ xfs_scrub_metadata(
          * We also don't support v1-v3 filesystems, which aren't
          * mountable.
          */
-        error = -EOPNOTSUPP;
         if (!xfs_sb_version_hasextflgbit(&mp->m_sb))
                 goto out;
 
-        /* Does this fs even support this type of metadata? */
-        error = -ENOENT;
-        if (ops->has && !ops->has(&mp->m_sb))
-                goto out;
-
         /* We don't know how to repair anything yet. */
-        error = -EOPNOTSUPP;
         if (sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR)
                 goto out;
 
+        error = 0;
+out:
+        return error;
+}
+
+/* Dispatch metadata scrubbing. */
+int
+xfs_scrub_metadata(
+        struct xfs_inode                *ip,
+        struct xfs_scrub_metadata       *sm)
+{
+        struct xfs_scrub_context        sc;
+        struct xfs_mount                *mp = ip->i_mount;
+        bool                            try_harder = false;
+        int                             error = 0;
+
+        BUILD_BUG_ON(sizeof(meta_scrub_ops) !=
+                (sizeof(struct xfs_scrub_meta_ops) * XFS_SCRUB_TYPE_NR));
+
+        trace_xfs_scrub_start(ip, sm, error);
+
+        /* Forbidden if we are shut down or mounted norecovery. */
+        error = -ESHUTDOWN;
+        if (XFS_FORCED_SHUTDOWN(mp))
+                goto out;
+        error = -ENOTRECOVERABLE;
+        if (mp->m_flags & XFS_MOUNT_NORECOVERY)
+                goto out;
+
+        error = xfs_scrub_validate_inputs(mp, sm);
+        if (error)
+                goto out;
+
         xfs_scrub_experimental_warning(mp);
 
 retry_op:
@@ -352,7 +423,7 @@ retry_op:
         memset(&sc, 0, sizeof(sc));
         sc.mp = ip->i_mount;
         sc.sm = sm;
-        sc.ops = ops;
+        sc.ops = &meta_scrub_ops[sm->sm_type];
         sc.try_harder = try_harder;
         sc.sa.agno = NULLAGNUMBER;
         error = sc.ops->setup(&sc, ip);
diff --git a/fs/xfs/scrub/scrub.h b/fs/xfs/scrub/scrub.h
index e9ec041cf713..0d92af86f67a 100644
--- a/fs/xfs/scrub/scrub.h
+++ b/fs/xfs/scrub/scrub.h
@@ -22,6 +22,14 @@
 
 struct xfs_scrub_context;
 
+/* Type info and names for the scrub types. */
+enum xfs_scrub_type {
+        ST_NONE = 1,    /* disabled */
+        ST_PERAG,       /* per-AG metadata */
+        ST_FS,          /* per-FS metadata */
+        ST_INODE,       /* per-inode metadata */
+};
+
 struct xfs_scrub_meta_ops {
         /* Acquire whatever resources are needed for the operation. */
         int             (*setup)(struct xfs_scrub_context *,
@@ -32,6 +40,9 @@ struct xfs_scrub_meta_ops {
 
         /* Decide if we even have this piece of metadata. */
         bool            (*has)(struct xfs_sb *);
+
+        /* type describing required/allowed inputs */
+        enum xfs_scrub_type     type;
 };
 
 /* Buffer pointers and btree cursors for an entire AG. */
@@ -112,4 +123,30 @@ xfs_scrub_quota(struct xfs_scrub_context *sc)
 }
 #endif
 
+/* cross-referencing helpers */
+void xfs_scrub_xref_is_used_space(struct xfs_scrub_context *sc,
+                xfs_agblock_t agbno, xfs_extlen_t len);
+void xfs_scrub_xref_is_not_inode_chunk(struct xfs_scrub_context *sc,
+                xfs_agblock_t agbno, xfs_extlen_t len);
+void xfs_scrub_xref_is_inode_chunk(struct xfs_scrub_context *sc,
+                xfs_agblock_t agbno, xfs_extlen_t len);
+void xfs_scrub_xref_is_owned_by(struct xfs_scrub_context *sc,
+                xfs_agblock_t agbno, xfs_extlen_t len,
+                struct xfs_owner_info *oinfo);
+void xfs_scrub_xref_is_not_owned_by(struct xfs_scrub_context *sc,
+                xfs_agblock_t agbno, xfs_extlen_t len,
+                struct xfs_owner_info *oinfo);
+void xfs_scrub_xref_has_no_owner(struct xfs_scrub_context *sc,
+                xfs_agblock_t agbno, xfs_extlen_t len);
+void xfs_scrub_xref_is_cow_staging(struct xfs_scrub_context *sc,
+                xfs_agblock_t bno, xfs_extlen_t len);
+void xfs_scrub_xref_is_not_shared(struct xfs_scrub_context *sc,
+                xfs_agblock_t bno, xfs_extlen_t len);
+#ifdef CONFIG_XFS_RT
+void xfs_scrub_xref_is_used_rt_space(struct xfs_scrub_context *sc,
+                xfs_rtblock_t rtbno, xfs_extlen_t len);
+#else
+# define xfs_scrub_xref_is_used_rt_space(sc, rtbno, len) do { } while (0)
+#endif
+
 #endif  /* __XFS_SCRUB_SCRUB_H__ */
diff --git a/fs/xfs/scrub/trace.h b/fs/xfs/scrub/trace.h
index c4ebfb5c1ee8..4dc896852bf0 100644
--- a/fs/xfs/scrub/trace.h
+++ b/fs/xfs/scrub/trace.h
@@ -50,7 +50,7 @@ DECLARE_EVENT_CLASS(xfs_scrub_class,
                 __entry->flags = sm->sm_flags;
                 __entry->error = error;
         ),
-        TP_printk("dev %d:%d ino %llu type %u agno %u inum %llu gen %u flags 0x%x error %d",
+        TP_printk("dev %d:%d ino 0x%llx type %u agno %u inum %llu gen %u flags 0x%x error %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->type,
@@ -90,7 +90,7 @@ TRACE_EVENT(xfs_scrub_op_error,
                 __entry->error = error;
                 __entry->ret_ip = ret_ip;
         ),
-        TP_printk("dev %d:%d type %u agno %u agbno %u error %d ret_ip %pF",
+        TP_printk("dev %d:%d type %u agno %u agbno %u error %d ret_ip %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->type,
                   __entry->agno,
@@ -121,7 +121,7 @@ TRACE_EVENT(xfs_scrub_file_op_error,
                 __entry->error = error;
                 __entry->ret_ip = ret_ip;
         ),
-        TP_printk("dev %d:%d ino %llu fork %d type %u offset %llu error %d ret_ip %pF",
+        TP_printk("dev %d:%d ino 0x%llx fork %d type %u offset %llu error %d ret_ip %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->whichfork,
@@ -156,7 +156,7 @@ DECLARE_EVENT_CLASS(xfs_scrub_block_error_class,
                 __entry->bno = bno;
                 __entry->ret_ip = ret_ip;
         ),
-        TP_printk("dev %d:%d type %u agno %u agbno %u ret_ip %pF",
+        TP_printk("dev %d:%d type %u agno %u agbno %u ret_ip %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->type,
                   __entry->agno,
@@ -207,7 +207,7 @@ DECLARE_EVENT_CLASS(xfs_scrub_ino_error_class,
                 __entry->bno = bno;
                 __entry->ret_ip = ret_ip;
         ),
-        TP_printk("dev %d:%d ino %llu type %u agno %u agbno %u ret_ip %pF",
+        TP_printk("dev %d:%d ino 0x%llx type %u agno %u agbno %u ret_ip %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->type,
@@ -246,7 +246,7 @@ DECLARE_EVENT_CLASS(xfs_scrub_fblock_error_class,
                 __entry->offset = offset;
                 __entry->ret_ip = ret_ip;
         ),
-        TP_printk("dev %d:%d ino %llu fork %d type %u offset %llu ret_ip %pF",
+        TP_printk("dev %d:%d ino 0x%llx fork %d type %u offset %llu ret_ip %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->whichfork,
@@ -277,7 +277,7 @@ TRACE_EVENT(xfs_scrub_incomplete,
                 __entry->type = sc->sm->sm_type;
                 __entry->ret_ip = ret_ip;
         ),
-        TP_printk("dev %d:%d type %u ret_ip %pF",
+        TP_printk("dev %d:%d type %u ret_ip %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->type,
                   __entry->ret_ip)
@@ -311,7 +311,7 @@ TRACE_EVENT(xfs_scrub_btree_op_error,
                 __entry->error = error;
                 __entry->ret_ip = ret_ip;
         ),
-        TP_printk("dev %d:%d type %u btnum %d level %d ptr %d agno %u agbno %u error %d ret_ip %pF",
+        TP_printk("dev %d:%d type %u btnum %d level %d ptr %d agno %u agbno %u error %d ret_ip %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->type,
                   __entry->btnum,
@@ -354,7 +354,7 @@ TRACE_EVENT(xfs_scrub_ifork_btree_op_error,
                 __entry->error = error;
                 __entry->ret_ip = ret_ip;
         ),
-        TP_printk("dev %d:%d ino %llu fork %d type %u btnum %d level %d ptr %d agno %u agbno %u error %d ret_ip %pF",
+        TP_printk("dev %d:%d ino 0x%llx fork %d type %u btnum %d level %d ptr %d agno %u agbno %u error %d ret_ip %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->whichfork,
@@ -393,7 +393,7 @@ TRACE_EVENT(xfs_scrub_btree_error,
                 __entry->ptr = cur->bc_ptrs[level];
                 __entry->ret_ip = ret_ip;
         ),
-        TP_printk("dev %d:%d type %u btnum %d level %d ptr %d agno %u agbno %u ret_ip %pF",
+        TP_printk("dev %d:%d type %u btnum %d level %d ptr %d agno %u agbno %u ret_ip %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->type,
                   __entry->btnum,
@@ -433,7 +433,7 @@ TRACE_EVENT(xfs_scrub_ifork_btree_error,
                 __entry->ptr = cur->bc_ptrs[level];
                 __entry->ret_ip = ret_ip;
         ),
-        TP_printk("dev %d:%d ino %llu fork %d type %u btnum %d level %d ptr %d agno %u agbno %u ret_ip %pF",
+        TP_printk("dev %d:%d ino 0x%llx fork %d type %u btnum %d level %d ptr %d agno %u agbno %u ret_ip %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->whichfork,
@@ -491,6 +491,28 @@ DEFINE_EVENT(xfs_scrub_sbtree_class, name, \
 DEFINE_SCRUB_SBTREE_EVENT(xfs_scrub_btree_rec);
 DEFINE_SCRUB_SBTREE_EVENT(xfs_scrub_btree_key);
 
+TRACE_EVENT(xfs_scrub_xref_error,
+        TP_PROTO(struct xfs_scrub_context *sc, int error, void *ret_ip),
+        TP_ARGS(sc, error, ret_ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(int, type)
+                __field(int, error)
+                __field(void *, ret_ip)
+        ),
+        TP_fast_assign(
+                __entry->dev = sc->mp->m_super->s_dev;
+                __entry->type = sc->sm->sm_type;
+                __entry->error = error;
+                __entry->ret_ip = ret_ip;
+        ),
+        TP_printk("dev %d:%d type %u xref error %d ret_ip %pF",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->type,
+                  __entry->error,
+                  __entry->ret_ip)
+);
+
 #endif /* _TRACE_XFS_SCRUB_TRACE_H */
 
 #undef TRACE_INCLUDE_PATH
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 4fc526a27a94..9c6a830da0ee 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -390,6 +390,19 @@ xfs_map_blocks(
         if (XFS_FORCED_SHUTDOWN(mp))
                 return -EIO;
 
+        /*
+         * Truncate can race with writeback since writeback doesn't take the
+         * iolock and truncate decreases the file size before it starts
+         * truncating the pages between new_size and old_size.  Therefore, we
+         * can end up in the situation where writeback gets a CoW fork mapping
+         * but the truncate makes the mapping invalid and we end up in here
+         * trying to get a new mapping.  Bail out here so that we simply never
+         * get a valid mapping and so we drop the write altogether.  The page
+         * truncation will kill the contents anyway.
+         */
+        if (type == XFS_IO_COW && offset > i_size_read(inode))
+                return 0;
+
         ASSERT(type != XFS_IO_COW);
         if (type == XFS_IO_UNWRITTEN)
                 bmapi_flags |= XFS_BMAPI_IGSTATE;
@@ -791,7 +804,7 @@ xfs_aops_discard_page(
                 goto out_invalidate;
 
         xfs_alert(ip->i_mount,
-                "page discard on page %p, inode 0x%llx, offset %llu.",
+                "page discard on page "PTR_FMT", inode 0x%llx, offset %llu.",
                         page, ip->i_ino, offset);
 
         xfs_ilock(ip, XFS_ILOCK_EXCL);
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 6d37ab43195f..c83f549dc17b 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1872,7 +1872,7 @@ xfs_swap_extents(
          */
         lock_two_nondirectories(VFS_I(ip), VFS_I(tip));
         lock_flags = XFS_MMAPLOCK_EXCL;
-        xfs_lock_two_inodes(ip, tip, XFS_MMAPLOCK_EXCL);
+        xfs_lock_two_inodes(ip, XFS_MMAPLOCK_EXCL, tip, XFS_MMAPLOCK_EXCL);
 
         /* Verify that both files have the same format */
         if ((VFS_I(ip)->i_mode & S_IFMT) != (VFS_I(tip)->i_mode & S_IFMT)) {
@@ -1919,7 +1919,7 @@ xfs_swap_extents(
          * Lock and join the inodes to the tansaction so that transaction commit
          * or cancel will unlock the inodes from this point onwards.
          */
-        xfs_lock_two_inodes(ip, tip, XFS_ILOCK_EXCL);
+        xfs_lock_two_inodes(ip, XFS_ILOCK_EXCL, tip, XFS_ILOCK_EXCL);
         lock_flags |= XFS_ILOCK_EXCL;
         xfs_trans_ijoin(tp, ip, 0);
         xfs_trans_ijoin(tp, tip, 0);
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 4c6e86d861fd..d1da2ee9e6db 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -236,6 +236,7 @@ _xfs_buf_alloc(
         init_completion(&bp->b_iowait);
         INIT_LIST_HEAD(&bp->b_lru);
         INIT_LIST_HEAD(&bp->b_list);
+        INIT_LIST_HEAD(&bp->b_li_list);
         sema_init(&bp->b_sema, 0); /* held, no waiters */
         spin_lock_init(&bp->b_lock);
         XB_SET_OWNER(bp);
@@ -585,7 +586,7 @@ _xfs_buf_find(
                  * returning a specific error on buffer lookup failures.
                  */
                 xfs_alert(btp->bt_mount,
-                          "%s: Block out of range: block 0x%llx, EOFS 0x%llx ",
+                          "%s: daddr 0x%llx out of range, EOFS 0x%llx",
                           __func__, cmap.bm_bn, eofs);
                 WARN_ON(1);
                 return NULL;
@@ -1180,13 +1181,14 @@ xfs_buf_ioend_async(
 }
 
 void
-xfs_buf_ioerror(
+__xfs_buf_ioerror(
         xfs_buf_t               *bp,
-        int                     error)
+        int                     error,
+        xfs_failaddr_t          failaddr)
 {
         ASSERT(error <= 0 && error >= -1000);
         bp->b_error = error;
-        trace_xfs_buf_ioerror(bp, error, _RET_IP_);
+        trace_xfs_buf_ioerror(bp, error, failaddr);
 }
 
 void
@@ -1195,8 +1197,9 @@ xfs_buf_ioerror_alert(
         const char              *func)
 {
         xfs_alert(bp->b_target->bt_mount,
-"metadata I/O error: block 0x%llx (\"%s\") error %d numblks %d",
-                (uint64_t)XFS_BUF_ADDR(bp), func, -bp->b_error, bp->b_length);
+"metadata I/O error in \"%s\" at daddr 0x%llx len %d error %d",
+                        func, (uint64_t)XFS_BUF_ADDR(bp), bp->b_length,
+                        -bp->b_error);
 }
 
 int
@@ -1378,9 +1381,10 @@ _xfs_buf_ioapply(
                          */
                         if (xfs_sb_version_hascrc(&mp->m_sb)) {
                                 xfs_warn(mp,
-                                        "%s: no ops on block 0x%llx/0x%x",
+                                        "%s: no buf ops on daddr 0x%llx len %d",
                                         __func__, bp->b_bn, bp->b_length);
-                                xfs_hex_dump(bp->b_addr, 64);
+                                xfs_hex_dump(bp->b_addr,
+                                                XFS_CORRUPTION_DUMP_LEN);
                                 dump_stack();
                         }
                 }
@@ -1671,7 +1675,7 @@ xfs_wait_buftarg(
                         list_del_init(&bp->b_lru);
                         if (bp->b_flags & XBF_WRITE_FAIL) {
                                 xfs_alert(btp->bt_mount,
-"Corruption Alert: Buffer at block 0x%llx had permanent write failures!",
+"Corruption Alert: Buffer at daddr 0x%llx had permanent write failures!",
                                         (long long)bp->b_bn);
                                 xfs_alert(btp->bt_mount,
 "Please run xfs_repair to determine the extent of the problem.");
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index f873bb786824..2f4c91452861 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -140,6 +140,7 @@ struct xfs_buf_ops {
         char *name;
         void (*verify_read)(struct xfs_buf *);
         void (*verify_write)(struct xfs_buf *);
+        xfs_failaddr_t (*verify_struct)(struct xfs_buf *bp);
 };
 
 typedef struct xfs_buf {
@@ -175,7 +176,8 @@ typedef struct xfs_buf {
         struct workqueue_struct *b_ioend_wq;    /* I/O completion wq */
         xfs_buf_iodone_t        b_iodone;       /* I/O completion function */
         struct completion       b_iowait;       /* queue for I/O waiters */
-        void                    *b_fspriv;
+        void                    *b_log_item;
+        struct list_head        b_li_list;      /* Log items list head */
         struct xfs_trans        *b_transp;
         struct page             **b_pages;      /* array of page pointers */
         struct page             *b_page_array[XB_PAGES]; /* inline pages */
@@ -315,7 +317,9 @@ extern void xfs_buf_unlock(xfs_buf_t *);
 /* Buffer Read and Write Routines */
 extern int xfs_bwrite(struct xfs_buf *bp);
 extern void xfs_buf_ioend(struct xfs_buf *bp);
-extern void xfs_buf_ioerror(xfs_buf_t *, int);
+extern void __xfs_buf_ioerror(struct xfs_buf *bp, int error,
+                xfs_failaddr_t failaddr);
+#define xfs_buf_ioerror(bp, err) __xfs_buf_ioerror((bp), (err), __this_address)
 extern void xfs_buf_ioerror_alert(struct xfs_buf *, const char *func);
 extern void xfs_buf_submit(struct xfs_buf *bp);
 extern int xfs_buf_submit_wait(struct xfs_buf *bp);
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index e0a0af0946f2..270ddb4d2313 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -61,14 +61,14 @@ xfs_buf_log_format_size(
  */
 STATIC void
 xfs_buf_item_size_segment(
-        struct xfs_buf_log_item *bip,
-        struct xfs_buf_log_format *blfp,
-        int                     *nvecs,
-        int                     *nbytes)
+        struct xfs_buf_log_item         *bip,
+        struct xfs_buf_log_format       *blfp,
+        int                             *nvecs,
+        int                             *nbytes)
 {
-        struct xfs_buf          *bp = bip->bli_buf;
-        int                     next_bit;
-        int                     last_bit;
+        struct xfs_buf                  *bp = bip->bli_buf;
+        int                             next_bit;
+        int                             last_bit;
 
         last_bit = xfs_next_bit(blfp->blf_data_map, blfp->blf_map_size, 0);
         if (last_bit == -1)
@@ -218,12 +218,12 @@ xfs_buf_item_format_segment(
         uint                    offset,
         struct xfs_buf_log_format *blfp)
 {
-        struct xfs_buf  *bp = bip->bli_buf;
-        uint            base_size;
-        int             first_bit;
-        int             last_bit;
-        int             next_bit;
-        uint            nbits;
+        struct xfs_buf          *bp = bip->bli_buf;
+        uint                    base_size;
+        int                     first_bit;
+        int                     last_bit;
+        int                     next_bit;
+        uint                    nbits;
 
         /* copy the flags across from the base format item */
         blfp->blf_flags = bip->__bli_format.blf_flags;
@@ -406,12 +406,12 @@ xfs_buf_item_unpin(
         int                     remove)
 {
         struct xfs_buf_log_item *bip = BUF_ITEM(lip);
-        xfs_buf_t       *bp = bip->bli_buf;
-        struct xfs_ail  *ailp = lip->li_ailp;
-        int             stale = bip->bli_flags & XFS_BLI_STALE;
-        int             freed;
+        xfs_buf_t               *bp = bip->bli_buf;
+        struct xfs_ail          *ailp = lip->li_ailp;
+        int                     stale = bip->bli_flags & XFS_BLI_STALE;
+        int                     freed;
 
-        ASSERT(bp->b_fspriv == bip);
+        ASSERT(bp->b_log_item == bip);
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
 
         trace_xfs_buf_item_unpin(bip);
@@ -456,13 +456,14 @@ xfs_buf_item_unpin(
                  */
                 if (bip->bli_flags & XFS_BLI_STALE_INODE) {
                         xfs_buf_do_callbacks(bp);
-                        bp->b_fspriv = NULL;
+                        bp->b_log_item = NULL;
+                        list_del_init(&bp->b_li_list);
                         bp->b_iodone = NULL;
                 } else {
                         spin_lock(&ailp->xa_lock);
                         xfs_trans_ail_delete(ailp, lip, SHUTDOWN_LOG_IO_ERROR);
                         xfs_buf_item_relse(bp);
-                        ASSERT(bp->b_fspriv == NULL);
+                        ASSERT(bp->b_log_item == NULL);
                 }
                 xfs_buf_relse(bp);
         } else if (freed && remove) {
@@ -722,18 +723,15 @@ xfs_buf_item_free_format(
 
 /*
  * Allocate a new buf log item to go with the given buffer.
- * Set the buffer's b_fsprivate field to point to the new
- * buf log item.  If there are other item's attached to the
- * buffer (see xfs_buf_attach_iodone() below), then put the
- * buf log item at the front.
+ * Set the buffer's b_log_item field to point to the new
+ * buf log item.
  */
 int
 xfs_buf_item_init(
         struct xfs_buf  *bp,
         struct xfs_mount *mp)
 {
-        struct xfs_log_item     *lip = bp->b_fspriv;
-        struct xfs_buf_log_item *bip;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
         int                     chunks;
         int                     map_size;
         int                     error;
@@ -741,13 +739,14 @@ xfs_buf_item_init(
 
         /*
          * Check to see if there is already a buf log item for
-         * this buffer.  If there is, it is guaranteed to be
-         * the first.  If we do already have one, there is
+         * this buffer. If we do already have one, there is
          * nothing to do here so return.
          */
         ASSERT(bp->b_target->bt_mount == mp);
-        if (lip != NULL && lip->li_type == XFS_LI_BUF)
+        if (bip != NULL) {
+                ASSERT(bip->bli_item.li_type == XFS_LI_BUF);
                 return 0;
+        }
 
         bip = kmem_zone_zalloc(xfs_buf_item_zone, KM_SLEEP);
         xfs_log_item_init(mp, &bip->bli_item, XFS_LI_BUF, &xfs_buf_item_ops);
@@ -781,13 +780,7 @@ xfs_buf_item_init(
                 bip->bli_formats[i].blf_map_size = map_size;
         }
 
-        /*
-         * Put the buf item into the list of items attached to the
-         * buffer at the front.
-         */
-        if (bp->b_fspriv)
-                bip->bli_item.li_bio_list = bp->b_fspriv;
-        bp->b_fspriv = bip;
+        bp->b_log_item = bip;
         xfs_buf_hold(bp);
         return 0;
 }
@@ -880,7 +873,7 @@ xfs_buf_item_log_segment(
  */
 void
 xfs_buf_item_log(
-        xfs_buf_log_item_t      *bip,
+        struct xfs_buf_log_item *bip,
         uint                    first,
         uint                    last)
 {
@@ -943,7 +936,7 @@ xfs_buf_item_dirty_format(
 
 STATIC void
 xfs_buf_item_free(
-        xfs_buf_log_item_t      *bip)
+        struct xfs_buf_log_item *bip)
 {
         xfs_buf_item_free_format(bip);
         kmem_free(bip->bli_item.li_lv_shadow);
@@ -961,13 +954,13 @@ void
 xfs_buf_item_relse(
         xfs_buf_t       *bp)
 {
-        xfs_buf_log_item_t      *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         trace_xfs_buf_item_relse(bp, _RET_IP_);
         ASSERT(!(bip->bli_item.li_flags & XFS_LI_IN_AIL));
 
-        bp->b_fspriv = bip->bli_item.li_bio_list;
-        if (bp->b_fspriv == NULL)
+        bp->b_log_item = NULL;
+        if (list_empty(&bp->b_li_list))
                 bp->b_iodone = NULL;
 
         xfs_buf_rele(bp);
@@ -980,9 +973,7 @@ xfs_buf_item_relse(
  * to be called when the buffer's I/O completes.  If it is not set
  * already, set the buffer's b_iodone() routine to be
  * xfs_buf_iodone_callbacks() and link the log item into the list of
- * items rooted at b_fsprivate.  Items are always added as the second
- * entry in the list if there is a first, because the buf item code
- * assumes that the buf log item is first.
+ * items rooted at b_li_list.
  */
 void
 xfs_buf_attach_iodone(
@@ -990,18 +981,10 @@ xfs_buf_attach_iodone(
         void            (*cb)(xfs_buf_t *, xfs_log_item_t *),
         xfs_log_item_t  *lip)
 {
-        xfs_log_item_t  *head_lip;
-
         ASSERT(xfs_buf_islocked(bp));
 
         lip->li_cb = cb;
-        head_lip = bp->b_fspriv;
-        if (head_lip) {
-                lip->li_bio_list = head_lip->li_bio_list;
-                head_lip->li_bio_list = lip;
-        } else {
-                bp->b_fspriv = lip;
-        }
+        list_add_tail(&lip->li_bio_list, &bp->b_li_list);
 
         ASSERT(bp->b_iodone == NULL ||
                bp->b_iodone == xfs_buf_iodone_callbacks);
@@ -1011,12 +994,12 @@ xfs_buf_attach_iodone(
 /*
  * We can have many callbacks on a buffer. Running the callbacks individually
  * can cause a lot of contention on the AIL lock, so we allow for a single
- * callback to be able to scan the remaining lip->li_bio_list for other items
- * of the same type and callback to be processed in the first call.
+ * callback to be able to scan the remaining items in bp->b_li_list for other
+ * items of the same type and callback to be processed in the first call.
  *
  * As a result, the loop walking the callback list below will also modify the
  * list. it removes the first item from the list and then runs the callback.
- * The loop then restarts from the new head of the list. This allows the
+ * The loop then restarts from the new first item int the list. This allows the
  * callback to scan and modify the list attached to the buffer and we don't
  * have to care about maintaining a next item pointer.
  */
@@ -1024,18 +1007,26 @@ STATIC void
 xfs_buf_do_callbacks(
         struct xfs_buf          *bp)
 {
+        struct xfs_buf_log_item *blip = bp->b_log_item;
         struct xfs_log_item     *lip;
 
-        while ((lip = bp->b_fspriv) != NULL) {
-                bp->b_fspriv = lip->li_bio_list;
-                ASSERT(lip->li_cb != NULL);
+        /* If there is a buf_log_item attached, run its callback */
+        if (blip) {
+                lip = &blip->bli_item;
+                lip->li_cb(bp, lip);
+        }
+
+        while (!list_empty(&bp->b_li_list)) {
+                lip = list_first_entry(&bp->b_li_list, struct xfs_log_item,
+                                       li_bio_list);
+
                 /*
-                 * Clear the next pointer so we don't have any
+                 * Remove the item from the list, so we don't have any
                  * confusion if the item is added to another buf.
                  * Don't touch the log item after calling its
                  * callback, because it could have freed itself.
                  */
-                lip->li_bio_list = NULL;
+                list_del_init(&lip->li_bio_list);
                 lip->li_cb(bp, lip);
         }
 }
@@ -1052,13 +1043,22 @@ STATIC void
 xfs_buf_do_callbacks_fail(
         struct xfs_buf          *bp)
 {
-        struct xfs_log_item     *next;
-        struct xfs_log_item     *lip = bp->b_fspriv;
-        struct xfs_ail          *ailp = lip->li_ailp;
+        struct xfs_log_item     *lip;
+        struct xfs_ail          *ailp;
 
+        /*
+         * Buffer log item errors are handled directly by xfs_buf_item_push()
+         * and xfs_buf_iodone_callback_error, and they have no IO error
+         * callbacks. Check only for items in b_li_list.
+         */
+        if (list_empty(&bp->b_li_list))
+                return;
+
+        lip = list_first_entry(&bp->b_li_list, struct xfs_log_item,
+                        li_bio_list);
+        ailp = lip->li_ailp;
         spin_lock(&ailp->xa_lock);
-        for (; lip; lip = next) {
-                next = lip->li_bio_list;
+        list_for_each_entry(lip, &bp->b_li_list, li_bio_list) {
                 if (lip->li_ops->iop_error)
                         lip->li_ops->iop_error(lip, bp);
         }
@@ -1069,13 +1069,23 @@ static bool
 xfs_buf_iodone_callback_error(
         struct xfs_buf          *bp)
 {
-        struct xfs_log_item     *lip = bp->b_fspriv;
-        struct xfs_mount        *mp = lip->li_mountp;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
+        struct xfs_log_item     *lip;
+        struct xfs_mount        *mp;
         static ulong            lasttime;
         static xfs_buftarg_t    *lasttarg;
         struct xfs_error_cfg    *cfg;
 
         /*
+         * The failed buffer might not have a buf_log_item attached or the
+         * log_item list might be empty. Get the mp from the available
+         * xfs_log_item
+         */
+        lip = list_first_entry_or_null(&bp->b_li_list, struct xfs_log_item,
+                                       li_bio_list);
+        mp = lip ? lip->li_mountp : bip->bli_item.li_mountp;
+
+        /*
          * If we've already decided to shutdown the filesystem because of
          * I/O errors, there's no point in giving this a retry.
          */
@@ -1183,7 +1193,8 @@ xfs_buf_iodone_callbacks(
         bp->b_first_retry_time = 0;
 
         xfs_buf_do_callbacks(bp);
-        bp->b_fspriv = NULL;
+        bp->b_log_item = NULL;
+        list_del_init(&bp->b_li_list);
         bp->b_iodone = NULL;
         xfs_buf_ioend(bp);
 }
@@ -1228,10 +1239,9 @@ xfs_buf_iodone(
 bool
 xfs_buf_resubmit_failed_buffers(
         struct xfs_buf          *bp,
-        struct xfs_log_item     *lip,
         struct list_head        *buffer_list)
 {
-        struct xfs_log_item     *next;
+        struct xfs_log_item     *lip;
 
         /*
          * Clear XFS_LI_FAILED flag from all items before resubmit
@@ -1239,10 +1249,8 @@ xfs_buf_resubmit_failed_buffers(
          * XFS_LI_FAILED set/clear is protected by xa_lock, caller  this
          * function already have it acquired
          */
-        for (; lip; lip = next) {
-                next = lip->li_bio_list;
+        list_for_each_entry(lip, &bp->b_li_list, li_bio_list)
                 xfs_clear_li_failed(lip);
-        }
 
         /* Add this buffer back to the delayed write list */
         return xfs_buf_delwri_queue(bp, buffer_list);
diff --git a/fs/xfs/xfs_buf_item.h b/fs/xfs/xfs_buf_item.h
index 9690ce62c9a7..643f53dcfe51 100644
--- a/fs/xfs/xfs_buf_item.h
+++ b/fs/xfs/xfs_buf_item.h
@@ -50,7 +50,7 @@ struct xfs_buf_log_item;
  * needed to log buffers.  It tracks how many times the lock has been
  * locked, and which 128 byte chunks of the buffer are dirty.
  */
-typedef struct xfs_buf_log_item {
+struct xfs_buf_log_item {
         xfs_log_item_t          bli_item;       /* common item structure */
         struct xfs_buf          *bli_buf;       /* real buffer pointer */
         unsigned int            bli_flags;      /* misc flags */
@@ -59,11 +59,11 @@ typedef struct xfs_buf_log_item {
         int                     bli_format_count;       /* count of headers */
         struct xfs_buf_log_format *bli_formats; /* array of in-log header ptrs */
         struct xfs_buf_log_format __bli_format; /* embedded in-log header */
-} xfs_buf_log_item_t;
+};
 
 int     xfs_buf_item_init(struct xfs_buf *, struct xfs_mount *);
 void    xfs_buf_item_relse(struct xfs_buf *);
-void    xfs_buf_item_log(xfs_buf_log_item_t *, uint, uint);
+void    xfs_buf_item_log(struct xfs_buf_log_item *, uint, uint);
 bool    xfs_buf_item_dirty_format(struct xfs_buf_log_item *);
 void    xfs_buf_attach_iodone(struct xfs_buf *,
                               void(*)(struct xfs_buf *, xfs_log_item_t *),
@@ -71,7 +71,6 @@ void	xfs_buf_attach_iodone(struct xfs_buf *,
 void    xfs_buf_iodone_callbacks(struct xfs_buf *);
 void    xfs_buf_iodone(struct xfs_buf *, struct xfs_log_item *);
 bool    xfs_buf_resubmit_failed_buffers(struct xfs_buf *,
-                                        struct xfs_log_item *,
                                         struct list_head *);
 
 extern kmem_zone_t      *xfs_buf_item_zone;
diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c
index 0c58918bc0ad..b6ae3597bfb0 100644
--- a/fs/xfs/xfs_dir2_readdir.c
+++ b/fs/xfs/xfs_dir2_readdir.c
@@ -152,7 +152,6 @@ xfs_dir2_block_getdents(
         struct xfs_inode        *dp = args->dp; /* incore directory inode */
         xfs_dir2_data_hdr_t     *hdr;           /* block header */
         struct xfs_buf          *bp;            /* buffer for block */
-        xfs_dir2_block_tail_t   *btp;           /* block tail */
         xfs_dir2_data_entry_t   *dep;           /* block data entry */
         xfs_dir2_data_unused_t  *dup;           /* block unused entry */
         char                    *endptr;        /* end of the data entries */
@@ -185,9 +184,8 @@ xfs_dir2_block_getdents(
         /*
          * Set up values for the loop.
          */
-        btp = xfs_dir2_block_tail_p(geo, hdr);
         ptr = (char *)dp->d_ops->data_entry_p(hdr);
-        endptr = (char *)xfs_dir2_block_leaf_p(btp);
+        endptr = xfs_dir3_data_endp(geo, hdr);
 
         /*
          * Loop over the data portion of the block.
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index f248708c10ff..43572f8a1b8e 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -399,52 +399,6 @@ error0:
         return error;
 }
 
-STATIC int
-xfs_qm_dqrepair(
-        struct xfs_mount        *mp,
-        struct xfs_trans        *tp,
-        struct xfs_dquot        *dqp,
-        xfs_dqid_t              firstid,
-        struct xfs_buf          **bpp)
-{
-        int                     error;
-        struct xfs_disk_dquot   *ddq;
-        struct xfs_dqblk        *d;
-        int                     i;
-
-        /*
-         * Read the buffer without verification so we get the corrupted
-         * buffer returned to us. make sure we verify it on write, though.
-         */
-        error = xfs_trans_read_buf(mp, tp, mp->m_ddev_targp, dqp->q_blkno,
-                                   mp->m_quotainfo->qi_dqchunklen,
-                                   0, bpp, NULL);
-
-        if (error) {
-                ASSERT(*bpp == NULL);
-                return error;
-        }
-        (*bpp)->b_ops = &xfs_dquot_buf_ops;
-
-        ASSERT(xfs_buf_islocked(*bpp));
-        d = (struct xfs_dqblk *)(*bpp)->b_addr;
-
-        /* Do the actual repair of dquots in this buffer */
-        for (i = 0; i < mp->m_quotainfo->qi_dqperchunk; i++) {
-                ddq = &d[i].dd_diskdq;
-                error = xfs_dqcheck(mp, ddq, firstid + i,
-                                       dqp->dq_flags & XFS_DQ_ALLTYPES,
-                                       XFS_QMOPT_DQREPAIR, "xfs_qm_dqrepair");
-                if (error) {
-                        /* repair failed, we're screwed */
-                        xfs_trans_brelse(tp, *bpp);
-                        return -EIO;
-                }
-        }
-
-        return 0;
-}
-
 /*
  * Maps a dquot to the buffer containing its on-disk version.
  * This returns a ptr to the buffer containing the on-disk dquot
@@ -526,14 +480,6 @@ xfs_qm_dqtobp(
                                            dqp->q_blkno,
                                            mp->m_quotainfo->qi_dqchunklen,
                                            0, &bp, &xfs_dquot_buf_ops);
-
-                if (error == -EFSCORRUPTED && (flags & XFS_QMOPT_DQREPAIR)) {
-                        xfs_dqid_t firstid = (xfs_dqid_t)map.br_startoff *
-                                                mp->m_quotainfo->qi_dqperchunk;
-                        ASSERT(bp == NULL);
-                        error = xfs_qm_dqrepair(mp, tp, dqp, firstid, &bp);
-                }
-
                 if (error) {
                         ASSERT(bp == NULL);
                         return error;
@@ -1010,6 +956,7 @@ xfs_qm_dqflush(
         struct xfs_mount        *mp = dqp->q_mount;
         struct xfs_buf          *bp;
         struct xfs_disk_dquot   *ddqp;
+        xfs_failaddr_t          fa;
         int                     error;
 
         ASSERT(XFS_DQ_IS_LOCKED(dqp));
@@ -1056,9 +1003,10 @@ xfs_qm_dqflush(
         /*
          * A simple sanity check in case we got a corrupted dquot..
          */
-        error = xfs_dqcheck(mp, &dqp->q_core, be32_to_cpu(ddqp->d_id), 0,
-                           XFS_QMOPT_DOWARN, "dqflush (incore copy)");
-        if (error) {
+        fa = xfs_dquot_verify(mp, &dqp->q_core, be32_to_cpu(ddqp->d_id), 0, 0);
+        if (fa) {
+                xfs_alert(mp, "corrupt dquot ID 0x%x in memory at %pS",
+                                be32_to_cpu(ddqp->d_id), fa);
                 xfs_buf_relse(bp);
                 xfs_dqfunlock(dqp);
                 xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
diff --git a/fs/xfs/xfs_dquot_item.c b/fs/xfs/xfs_dquot_item.c
index 664dea105e76..96eaa6933709 100644
--- a/fs/xfs/xfs_dquot_item.c
+++ b/fs/xfs/xfs_dquot_item.c
@@ -150,10 +150,7 @@ xfs_dquot_item_error(
         struct xfs_log_item     *lip,
         struct xfs_buf          *bp)
 {
-        struct xfs_dquot        *dqp;
-
-        dqp = DQUOT_ITEM(lip)->qli_dquot;
-        ASSERT(!completion_done(&dqp->q_flush));
+        ASSERT(!completion_done(&DQUOT_ITEM(lip)->qli_dquot->q_flush));
         xfs_set_li_failed(lip, bp);
 }
 
@@ -179,7 +176,7 @@ xfs_qm_dquot_logitem_push(
                 if (!xfs_buf_trylock(bp))
                         return XFS_ITEM_LOCKED;
 
-                if (!xfs_buf_resubmit_failed_buffers(bp, lip, buffer_list))
+                if (!xfs_buf_resubmit_failed_buffers(bp, buffer_list))
                         rval = XFS_ITEM_FLUSHING;
 
                 xfs_buf_unlock(bp);
@@ -212,7 +209,7 @@ xfs_qm_dquot_logitem_push(
 
         error = xfs_qm_dqflush(dqp, &bp);
         if (error) {
-                xfs_warn(dqp->q_mount, "%s: push error %d on dqp %p",
+                xfs_warn(dqp->q_mount, "%s: push error %d on dqp "PTR_FMT,
                         __func__, error, dqp);
         } else {
                 if (!xfs_buf_delwri_queue(bp, buffer_list))
diff --git a/fs/xfs/xfs_error.c b/fs/xfs/xfs_error.c
index 4c9f35d983b2..ccf520f0b00d 100644
--- a/fs/xfs/xfs_error.c
+++ b/fs/xfs/xfs_error.c
@@ -24,6 +24,7 @@
 #include "xfs_errortag.h"
 #include "xfs_error.h"
 #include "xfs_sysfs.h"
+#include "xfs_inode.h"
 
 #ifdef DEBUG
 
@@ -314,12 +315,12 @@ xfs_error_report(
         struct xfs_mount        *mp,
         const char              *filename,
         int                     linenum,
-        void                    *ra)
+        xfs_failaddr_t          failaddr)
 {
         if (level <= xfs_error_level) {
                 xfs_alert_tag(mp, XFS_PTAG_ERROR_REPORT,
                 "Internal error %s at line %d of file %s.  Caller %pS",
-                            tag, linenum, filename, ra);
+                            tag, linenum, filename, failaddr);
 
                 xfs_stack_trace();
         }
@@ -333,11 +334,11 @@ xfs_corruption_error(
         void                    *p,
         const char              *filename,
         int                     linenum,
-        void                    *ra)
+        xfs_failaddr_t          failaddr)
 {
         if (level <= xfs_error_level)
-                xfs_hex_dump(p, 64);
-        xfs_error_report(tag, level, mp, filename, linenum, ra);
+                xfs_hex_dump(p, XFS_CORRUPTION_DUMP_LEN);
+        xfs_error_report(tag, level, mp, filename, linenum, failaddr);
         xfs_alert(mp, "Corruption detected. Unmount and run xfs_repair");
 }
 
@@ -347,19 +348,62 @@ xfs_corruption_error(
  */
 void
 xfs_verifier_error(
-        struct xfs_buf          *bp)
+        struct xfs_buf          *bp,
+        int                     error,
+        xfs_failaddr_t          failaddr)
 {
-        struct xfs_mount *mp = bp->b_target->bt_mount;
+        struct xfs_mount        *mp = bp->b_target->bt_mount;
+        xfs_failaddr_t          fa;
+
+        fa = failaddr ? failaddr : __return_address;
+        __xfs_buf_ioerror(bp, error, fa);
 
         xfs_alert(mp, "Metadata %s detected at %pS, %s block 0x%llx",
                   bp->b_error == -EFSBADCRC ? "CRC error" : "corruption",
-                  __return_address, bp->b_ops->name, bp->b_bn);
+                  fa, bp->b_ops->name, bp->b_bn);
 
         xfs_alert(mp, "Unmount and run xfs_repair");
 
         if (xfs_error_level >= XFS_ERRLEVEL_LOW) {
-                xfs_alert(mp, "First 64 bytes of corrupted metadata buffer:");
-                xfs_hex_dump(xfs_buf_offset(bp, 0), 64);
+                xfs_alert(mp, "First %d bytes of corrupted metadata buffer:",
+                                XFS_CORRUPTION_DUMP_LEN);
+                xfs_hex_dump(xfs_buf_offset(bp, 0), XFS_CORRUPTION_DUMP_LEN);
+        }
+
+        if (xfs_error_level >= XFS_ERRLEVEL_HIGH)
+                xfs_stack_trace();
+}
+
+/*
+ * Warnings for inode corruption problems.  Don't bother with the stack
+ * trace unless the error level is turned up high.
+ */
+void
+xfs_inode_verifier_error(
+        struct xfs_inode        *ip,
+        int                     error,
+        const char              *name,
+        void                    *buf,
+        size_t                  bufsz,
+        xfs_failaddr_t          failaddr)
+{
+        struct xfs_mount        *mp = ip->i_mount;
+        xfs_failaddr_t          fa;
+        int                     sz;
+
+        fa = failaddr ? failaddr : __return_address;
+
+        xfs_alert(mp, "Metadata %s detected at %pS, inode 0x%llx %s",
+                  error == -EFSBADCRC ? "CRC error" : "corruption",
+                  fa, ip->i_ino, name);
+
+        xfs_alert(mp, "Unmount and run xfs_repair");
+
+        if (buf && xfs_error_level >= XFS_ERRLEVEL_LOW) {
+                sz = min_t(size_t, XFS_CORRUPTION_DUMP_LEN, bufsz);
+                xfs_alert(mp, "First %d bytes of corrupted metadata buffer:",
+                                sz);
+                xfs_hex_dump(buf, sz);
         }
 
         if (xfs_error_level >= XFS_ERRLEVEL_HIGH)
diff --git a/fs/xfs/xfs_error.h b/fs/xfs/xfs_error.h
index ea816c1bf8db..7e728c5a46b8 100644
--- a/fs/xfs/xfs_error.h
+++ b/fs/xfs/xfs_error.h
@@ -21,11 +21,16 @@
 struct xfs_mount;
 
 extern void xfs_error_report(const char *tag, int level, struct xfs_mount *mp,
-                        const char *filename, int linenum, void *ra);
+                        const char *filename, int linenum,
+                        xfs_failaddr_t failaddr);
 extern void xfs_corruption_error(const char *tag, int level,
                         struct xfs_mount *mp, void *p, const char *filename,
-                        int linenum, void *ra);
-extern void xfs_verifier_error(struct xfs_buf *bp);
+                        int linenum, xfs_failaddr_t failaddr);
+extern void xfs_verifier_error(struct xfs_buf *bp, int error,
+                        xfs_failaddr_t failaddr);
+extern void xfs_inode_verifier_error(struct xfs_inode *ip, int error,
+                        const char *name, void *buf, size_t bufsz,
+                        xfs_failaddr_t failaddr);
 
 #define XFS_ERROR_REPORT(e, lvl, mp)    \
         xfs_error_report(e, lvl, mp, __FILE__, __LINE__, __return_address)
@@ -37,6 +42,9 @@ extern void xfs_verifier_error(struct xfs_buf *bp);
 #define XFS_ERRLEVEL_LOW        1
 #define XFS_ERRLEVEL_HIGH       5
 
+/* Dump 128 bytes of any corrupt buffer */
+#define XFS_CORRUPTION_DUMP_LEN         (128)
+
 /*
  * Macros to set EFSCORRUPTED & return/branch.
  */
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 8601275cc5e6..9ea08326f876 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -1048,7 +1048,7 @@ __xfs_filemap_fault(
         if (IS_DAX(inode)) {
                 pfn_t pfn;
 
-                ret = dax_iomap_fault(vmf, pe_size, &pfn, &xfs_iomap_ops);
+                ret = dax_iomap_fault(vmf, pe_size, &pfn, NULL, &xfs_iomap_ops);
                 if (ret & VM_FAULT_NEEDDSYNC)
                         ret = dax_finish_sync_fault(vmf, pe_size, pfn);
         } else {
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 60a2e128cb6a..8b4545623e25 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -49,83 +49,6 @@
  * File system operations
  */
 
-int
-xfs_fs_geometry(
-        xfs_mount_t             *mp,
-        xfs_fsop_geom_t         *geo,
-        int                     new_version)
-{
-
-        memset(geo, 0, sizeof(*geo));
-
-        geo->blocksize = mp->m_sb.sb_blocksize;
-        geo->rtextsize = mp->m_sb.sb_rextsize;
-        geo->agblocks = mp->m_sb.sb_agblocks;
-        geo->agcount = mp->m_sb.sb_agcount;
-        geo->logblocks = mp->m_sb.sb_logblocks;
-        geo->sectsize = mp->m_sb.sb_sectsize;
-        geo->inodesize = mp->m_sb.sb_inodesize;
-        geo->imaxpct = mp->m_sb.sb_imax_pct;
-        geo->datablocks = mp->m_sb.sb_dblocks;
-        geo->rtblocks = mp->m_sb.sb_rblocks;
-        geo->rtextents = mp->m_sb.sb_rextents;
-        geo->logstart = mp->m_sb.sb_logstart;
-        ASSERT(sizeof(geo->uuid)==sizeof(mp->m_sb.sb_uuid));
-        memcpy(geo->uuid, &mp->m_sb.sb_uuid, sizeof(mp->m_sb.sb_uuid));
-        if (new_version >= 2) {
-                geo->sunit = mp->m_sb.sb_unit;
-                geo->swidth = mp->m_sb.sb_width;
-        }
-        if (new_version >= 3) {
-                geo->version = XFS_FSOP_GEOM_VERSION;
-                geo->flags = XFS_FSOP_GEOM_FLAGS_NLINK |
-                             XFS_FSOP_GEOM_FLAGS_DIRV2 |
-                        (xfs_sb_version_hasattr(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_ATTR : 0) |
-                        (xfs_sb_version_hasquota(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_QUOTA : 0) |
-                        (xfs_sb_version_hasalign(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_IALIGN : 0) |
-                        (xfs_sb_version_hasdalign(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_DALIGN : 0) |
-                        (xfs_sb_version_hasextflgbit(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_EXTFLG : 0) |
-                        (xfs_sb_version_hassector(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_SECTOR : 0) |
-                        (xfs_sb_version_hasasciici(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_DIRV2CI : 0) |
-                        (xfs_sb_version_haslazysbcount(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_LAZYSB : 0) |
-                        (xfs_sb_version_hasattr2(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_ATTR2 : 0) |
-                        (xfs_sb_version_hasprojid32bit(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_PROJID32 : 0) |
-                        (xfs_sb_version_hascrc(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_V5SB : 0) |
-                        (xfs_sb_version_hasftype(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_FTYPE : 0) |
-                        (xfs_sb_version_hasfinobt(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_FINOBT : 0) |
-                        (xfs_sb_version_hassparseinodes(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_SPINODES : 0) |
-                        (xfs_sb_version_hasrmapbt(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_RMAPBT : 0) |
-                        (xfs_sb_version_hasreflink(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_REFLINK : 0);
-                geo->logsectsize = xfs_sb_version_hassector(&mp->m_sb) ?
-                                mp->m_sb.sb_logsectsize : BBSIZE;
-                geo->rtsectsize = mp->m_sb.sb_blocksize;
-                geo->dirblocksize = mp->m_dir_geo->blksize;
-        }
-        if (new_version >= 4) {
-                geo->flags |=
-                        (xfs_sb_version_haslogv2(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_LOGV2 : 0);
-                geo->logsunit = mp->m_sb.sb_logsunit;
-        }
-        return 0;
-}
-
 static struct xfs_buf *
 xfs_growfs_get_hdr_buf(
         struct xfs_mount        *mp,
@@ -955,7 +878,7 @@ xfs_do_force_shutdown(
 
         if (!(flags & SHUTDOWN_FORCE_UMOUNT)) {
                 xfs_notice(mp,
-        "%s(0x%x) called from line %d of file %s.  Return address = 0x%p",
+        "%s(0x%x) called from line %d of file %s.  Return address = "PTR_FMT,
                         __func__, flags, lnnum, fname, __return_address);
         }
         /*
diff --git a/fs/xfs/xfs_fsops.h b/fs/xfs/xfs_fsops.h
index 2954c13a3acd..20484ed5e919 100644
--- a/fs/xfs/xfs_fsops.h
+++ b/fs/xfs/xfs_fsops.h
@@ -18,7 +18,6 @@
 #ifndef __XFS_FSOPS_H__
 #define __XFS_FSOPS_H__
 
-extern int xfs_fs_geometry(xfs_mount_t *mp, xfs_fsop_geom_t *geo, int nversion);
 extern int xfs_growfs_data(xfs_mount_t *mp, xfs_growfs_data_t *in);
 extern int xfs_growfs_log(xfs_mount_t *mp, xfs_growfs_log_t *in);
 extern int xfs_fs_counts(xfs_mount_t *mp, xfs_fsop_counts_t *cnt);
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index 3bcb8fd2a826..d53a316162d6 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -296,6 +296,7 @@ xfs_reinit_inode(
         uint32_t        generation = inode->i_generation;
         uint64_t        version = inode_peek_iversion(inode);
         umode_t         mode = inode->i_mode;
+        dev_t           dev = inode->i_rdev;
 
         error = inode_init_always(mp->m_super, inode);
 
@@ -303,6 +304,7 @@ xfs_reinit_inode(
         inode->i_generation = generation;
         inode_set_iversion_queried(inode, version);
         inode->i_mode = mode;
+        inode->i_rdev = dev;
         return error;
 }
 
@@ -474,6 +476,11 @@ xfs_iget_cache_miss(
         if (error)
                 goto out_destroy;
 
+        if (!xfs_inode_verify_forks(ip)) {
+                error = -EFSCORRUPTED;
+                goto out_destroy;
+        }
+
         trace_xfs_iget_miss(ip);
 
         if ((VFS_I(ip)->i_mode == 0) && !(flags & XFS_IGET_CREATE)) {
@@ -1651,28 +1658,15 @@ xfs_inode_clear_eofblocks_tag(
 }
 
 /*
- * Automatic CoW Reservation Freeing
- *
- * These functions automatically garbage collect leftover CoW reservations
- * that were made on behalf of a cowextsize hint when we start to run out
- * of quota or when the reservations sit around for too long.  If the file
- * has dirty pages or is undergoing writeback, its CoW reservations will
- * be retained.
- *
- * The actual garbage collection piggybacks off the same code that runs
- * the speculative EOF preallocation garbage collector.
+ * Set ourselves up to free CoW blocks from this file.  If it's already clean
+ * then we can bail out quickly, but otherwise we must back off if the file
+ * is undergoing some kind of write.
  */
-STATIC int
-xfs_inode_free_cowblocks(
+static bool
+xfs_prep_free_cowblocks(
         struct xfs_inode        *ip,
-        int                     flags,
-        void                    *args)
+        struct xfs_ifork        *ifp)
 {
-        int ret;
-        struct xfs_eofblocks *eofb = args;
-        int match;
-        struct xfs_ifork        *ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);
-
         /*
          * Just clear the tag if we have an empty cow fork or none at all. It's
          * possible the inode was fully unshared since it was originally tagged.
@@ -1680,7 +1674,7 @@ xfs_inode_free_cowblocks(
         if (!xfs_is_reflink_inode(ip) || !ifp->if_bytes) {
                 trace_xfs_inode_free_cowblocks_invalid(ip);
                 xfs_inode_clear_cowblocks_tag(ip);
-                return 0;
+                return false;
         }
 
         /*
@@ -1691,6 +1685,35 @@ xfs_inode_free_cowblocks(
             mapping_tagged(VFS_I(ip)->i_mapping, PAGECACHE_TAG_DIRTY) ||
             mapping_tagged(VFS_I(ip)->i_mapping, PAGECACHE_TAG_WRITEBACK) ||
             atomic_read(&VFS_I(ip)->i_dio_count))
+                return false;
+
+        return true;
+}
+
+/*
+ * Automatic CoW Reservation Freeing
+ *
+ * These functions automatically garbage collect leftover CoW reservations
+ * that were made on behalf of a cowextsize hint when we start to run out
+ * of quota or when the reservations sit around for too long.  If the file
+ * has dirty pages or is undergoing writeback, its CoW reservations will
+ * be retained.
+ *
+ * The actual garbage collection piggybacks off the same code that runs
+ * the speculative EOF preallocation garbage collector.
+ */
+STATIC int
+xfs_inode_free_cowblocks(
+        struct xfs_inode        *ip,
+        int                     flags,
+        void                    *args)
+{
+        struct xfs_eofblocks    *eofb = args;
+        struct xfs_ifork        *ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);
+        int                     match;
+        int                     ret = 0;
+
+        if (!xfs_prep_free_cowblocks(ip, ifp))
                 return 0;
 
         if (eofb) {
@@ -1711,7 +1734,12 @@ xfs_inode_free_cowblocks(
         xfs_ilock(ip, XFS_IOLOCK_EXCL);
         xfs_ilock(ip, XFS_MMAPLOCK_EXCL);
 
-        ret = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, false);
+        /*
+         * Check again, nobody else should be able to dirty blocks or change
+         * the reflink iflag now that we have the first two locks held.
+         */
+        if (xfs_prep_free_cowblocks(ip, ifp))
+                ret = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, false);
 
         xfs_iunlock(ip, XFS_MMAPLOCK_EXCL);
         xfs_iunlock(ip, XFS_IOLOCK_EXCL);
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 9f424e0aef1f..604ee384a00a 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -547,23 +547,36 @@ again:
 
 /*
  * xfs_lock_two_inodes() can only be used to lock one type of lock at a time -
- * the iolock, the mmaplock or the ilock, but not more than one at a time. If we
- * lock more than one at a time, lockdep will report false positives saying we
- * have violated locking orders.
+ * the mmaplock or the ilock, but not more than one type at a time. If we lock
+ * more than one at a time, lockdep will report false positives saying we have
+ * violated locking orders.  The iolock must be double-locked separately since
+ * we use i_rwsem for that.  We now support taking one lock EXCL and the other
+ * SHARED.
  */
 void
 xfs_lock_two_inodes(
-        xfs_inode_t             *ip0,
-        xfs_inode_t             *ip1,
-        uint                    lock_mode)
+        struct xfs_inode        *ip0,
+        uint                    ip0_mode,
+        struct xfs_inode        *ip1,
+        uint                    ip1_mode)
 {
-        xfs_inode_t             *temp;
+        struct xfs_inode        *temp;
+        uint                    mode_temp;
         int                     attempts = 0;
         xfs_log_item_t          *lp;
 
-        ASSERT(!(lock_mode & (XFS_IOLOCK_SHARED|XFS_IOLOCK_EXCL)));
-        if (lock_mode & (XFS_MMAPLOCK_SHARED|XFS_MMAPLOCK_EXCL))
-                ASSERT(!(lock_mode & (XFS_ILOCK_SHARED|XFS_ILOCK_EXCL)));
+        ASSERT(hweight32(ip0_mode) == 1);
+        ASSERT(hweight32(ip1_mode) == 1);
+        ASSERT(!(ip0_mode & (XFS_IOLOCK_SHARED|XFS_IOLOCK_EXCL)));
+        ASSERT(!(ip1_mode & (XFS_IOLOCK_SHARED|XFS_IOLOCK_EXCL)));
+        ASSERT(!(ip0_mode & (XFS_MMAPLOCK_SHARED|XFS_MMAPLOCK_EXCL)) ||
+               !(ip0_mode & (XFS_ILOCK_SHARED|XFS_ILOCK_EXCL)));
+        ASSERT(!(ip1_mode & (XFS_MMAPLOCK_SHARED|XFS_MMAPLOCK_EXCL)) ||
+               !(ip1_mode & (XFS_ILOCK_SHARED|XFS_ILOCK_EXCL)));
+        ASSERT(!(ip1_mode & (XFS_MMAPLOCK_SHARED|XFS_MMAPLOCK_EXCL)) ||
+               !(ip0_mode & (XFS_ILOCK_SHARED|XFS_ILOCK_EXCL)));
+        ASSERT(!(ip0_mode & (XFS_MMAPLOCK_SHARED|XFS_MMAPLOCK_EXCL)) ||
+               !(ip1_mode & (XFS_ILOCK_SHARED|XFS_ILOCK_EXCL)));
 
         ASSERT(ip0->i_ino != ip1->i_ino);
 
@@ -571,10 +584,13 @@ xfs_lock_two_inodes(
                 temp = ip0;
                 ip0 = ip1;
                 ip1 = temp;
+                mode_temp = ip0_mode;
+                ip0_mode = ip1_mode;
+                ip1_mode = mode_temp;
         }
 
  again:
-        xfs_ilock(ip0, xfs_lock_inumorder(lock_mode, 0));
+        xfs_ilock(ip0, xfs_lock_inumorder(ip0_mode, 0));
 
         /*
          * If the first lock we have locked is in the AIL, we must TRY to get
@@ -583,18 +599,17 @@ xfs_lock_two_inodes(
          */
         lp = (xfs_log_item_t *)ip0->i_itemp;
         if (lp && (lp->li_flags & XFS_LI_IN_AIL)) {
-                if (!xfs_ilock_nowait(ip1, xfs_lock_inumorder(lock_mode, 1))) {
-                        xfs_iunlock(ip0, lock_mode);
+                if (!xfs_ilock_nowait(ip1, xfs_lock_inumorder(ip1_mode, 1))) {
+                        xfs_iunlock(ip0, ip0_mode);
                         if ((++attempts % 5) == 0)
                                 delay(1); /* Don't just spin the CPU */
                         goto again;
                 }
         } else {
-                xfs_ilock(ip1, xfs_lock_inumorder(lock_mode, 1));
+                xfs_ilock(ip1, xfs_lock_inumorder(ip1_mode, 1));
         }
 }
 
-
 void
 __xfs_iflock(
         struct xfs_inode        *ip)
@@ -1422,7 +1437,7 @@ xfs_link(
         if (error)
                 goto std_return;
 
-        xfs_lock_two_inodes(sip, tdp, XFS_ILOCK_EXCL);
+        xfs_lock_two_inodes(sip, XFS_ILOCK_EXCL, tdp, XFS_ILOCK_EXCL);
 
         xfs_trans_ijoin(tp, sip, XFS_ILOCK_EXCL);
         xfs_trans_ijoin(tp, tdp, XFS_ILOCK_EXCL);
@@ -2215,7 +2230,7 @@ xfs_ifree_cluster(
         xfs_buf_t               *bp;
         xfs_inode_t             *ip;
         xfs_inode_log_item_t    *iip;
-        xfs_log_item_t          *lip;
+        struct xfs_log_item     *lip;
         struct xfs_perag        *pag;
         xfs_ino_t               inum;
 
@@ -2273,8 +2288,7 @@ xfs_ifree_cluster(
                  * stale first, we will not attempt to lock them in the loop
                  * below as the XFS_ISTALE flag will be set.
                  */
-                lip = bp->b_fspriv;
-                while (lip) {
+                list_for_each_entry(lip, &bp->b_li_list, li_bio_list) {
                         if (lip->li_type == XFS_LI_INODE) {
                                 iip = (xfs_inode_log_item_t *)lip;
                                 ASSERT(iip->ili_logged == 1);
@@ -2284,7 +2298,6 @@ xfs_ifree_cluster(
                                                         &iip->ili_item.li_lsn);
                                 xfs_iflags_set(iip->ili_inode, XFS_ISTALE);
                         }
-                        lip = lip->li_bio_list;
                 }
 
 
@@ -2452,6 +2465,7 @@ xfs_ifree(
 
         VFS_I(ip)->i_mode = 0;          /* mark incore inode as free */
         ip->i_d.di_flags = 0;
+        ip->i_d.di_flags2 = 0;
         ip->i_d.di_dmevmask = 0;
         ip->i_d.di_forkoff = 0;         /* mark the attr fork not in use */
         ip->i_d.di_format = XFS_DINODE_FMT_EXTENTS;
@@ -2587,7 +2601,7 @@ xfs_remove(
                 goto std_return;
         }
 
-        xfs_lock_two_inodes(dp, ip, XFS_ILOCK_EXCL);
+        xfs_lock_two_inodes(dp, XFS_ILOCK_EXCL, ip, XFS_ILOCK_EXCL);
 
         xfs_trans_ijoin(tp, dp, XFS_ILOCK_EXCL);
         xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
@@ -3480,6 +3494,36 @@ abort_out:
         return error;
 }
 
+/*
+ * If there are inline format data / attr forks attached to this inode,
+ * make sure they're not corrupt.
+ */
+bool
+xfs_inode_verify_forks(
+        struct xfs_inode        *ip)
+{
+        struct xfs_ifork        *ifp;
+        xfs_failaddr_t          fa;
+
+        fa = xfs_ifork_verify_data(ip, &xfs_default_ifork_ops);
+        if (fa) {
+                ifp = XFS_IFORK_PTR(ip, XFS_DATA_FORK);
+                xfs_inode_verifier_error(ip, -EFSCORRUPTED, "data fork",
+                                ifp->if_u1.if_data, ifp->if_bytes, fa);
+                return false;
+        }
+
+        fa = xfs_ifork_verify_attr(ip, &xfs_default_ifork_ops);
+        if (fa) {
+                ifp = XFS_IFORK_PTR(ip, XFS_ATTR_FORK);
+                xfs_inode_verifier_error(ip, -EFSCORRUPTED, "attr fork",
+                                ifp ? ifp->if_u1.if_data : NULL,
+                                ifp ? ifp->if_bytes : 0, fa);
+                return false;
+        }
+        return true;
+}
+
 STATIC int
 xfs_iflush_int(
         struct xfs_inode        *ip,
@@ -3502,7 +3546,7 @@ xfs_iflush_int(
         if (XFS_TEST_ERROR(dip->di_magic != cpu_to_be16(XFS_DINODE_MAGIC),
                                mp, XFS_ERRTAG_IFLUSH_1)) {
                 xfs_alert_tag(mp, XFS_PTAG_IFLUSH,
-                        "%s: Bad inode %Lu magic number 0x%x, ptr 0x%p",
+                        "%s: Bad inode %Lu magic number 0x%x, ptr "PTR_FMT,
                         __func__, ip->i_ino, be16_to_cpu(dip->di_magic), dip);
                 goto corrupt_out;
         }
@@ -3512,7 +3556,7 @@ xfs_iflush_int(
                     (ip->i_d.di_format != XFS_DINODE_FMT_BTREE),
                     mp, XFS_ERRTAG_IFLUSH_3)) {
                         xfs_alert_tag(mp, XFS_PTAG_IFLUSH,
-                                "%s: Bad regular inode %Lu, ptr 0x%p",
+                                "%s: Bad regular inode %Lu, ptr "PTR_FMT,
                                 __func__, ip->i_ino, ip);
                         goto corrupt_out;
                 }
@@ -3523,7 +3567,7 @@ xfs_iflush_int(
                     (ip->i_d.di_format != XFS_DINODE_FMT_LOCAL),
                     mp, XFS_ERRTAG_IFLUSH_4)) {
                         xfs_alert_tag(mp, XFS_PTAG_IFLUSH,
-                                "%s: Bad directory inode %Lu, ptr 0x%p",
+                                "%s: Bad directory inode %Lu, ptr "PTR_FMT,
                                 __func__, ip->i_ino, ip);
                         goto corrupt_out;
                 }
@@ -3532,7 +3576,7 @@ xfs_iflush_int(
                                 ip->i_d.di_nblocks, mp, XFS_ERRTAG_IFLUSH_5)) {
                 xfs_alert_tag(mp, XFS_PTAG_IFLUSH,
                         "%s: detected corrupt incore inode %Lu, "
-                        "total extents = %d, nblocks = %Ld, ptr 0x%p",
+                        "total extents = %d, nblocks = %Ld, ptr "PTR_FMT,
                         __func__, ip->i_ino,
                         ip->i_d.di_nextents + ip->i_d.di_anextents,
                         ip->i_d.di_nblocks, ip);
@@ -3541,7 +3585,7 @@ xfs_iflush_int(
         if (XFS_TEST_ERROR(ip->i_d.di_forkoff > mp->m_sb.sb_inodesize,
                                 mp, XFS_ERRTAG_IFLUSH_6)) {
                 xfs_alert_tag(mp, XFS_PTAG_IFLUSH,
-                        "%s: bad inode %Lu, forkoff 0x%x, ptr 0x%p",
+                        "%s: bad inode %Lu, forkoff 0x%x, ptr "PTR_FMT,
                         __func__, ip->i_ino, ip->i_d.di_forkoff, ip);
                 goto corrupt_out;
         }
@@ -3558,10 +3602,8 @@ xfs_iflush_int(
         if (ip->i_d.di_version < 3)
                 ip->i_d.di_flushiter++;
 
-        /* Check the inline directory data. */
-        if (S_ISDIR(VFS_I(ip)->i_mode) &&
-            ip->i_d.di_format == XFS_DINODE_FMT_LOCAL &&
-            xfs_dir2_sf_verify(ip))
+        /* Check the inline fork data before we write out. */
+        if (!xfs_inode_verify_forks(ip))
                 goto corrupt_out;
 
         /*
@@ -3624,7 +3666,7 @@ xfs_iflush_int(
         /* generate the checksum. */
         xfs_dinode_calc_crc(mp, dip);
 
-        ASSERT(bp->b_fspriv != NULL);
+        ASSERT(!list_empty(&bp->b_li_list));
         ASSERT(bp->b_iodone != NULL);
         return 0;
 
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index d383e392ec9d..3e8dc990d41c 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -423,7 +423,8 @@ void		xfs_iunpin_wait(xfs_inode_t *);
 #define xfs_ipincount(ip)       ((unsigned int) atomic_read(&ip->i_pincount))
 
 int             xfs_iflush(struct xfs_inode *, struct xfs_buf **);
-void            xfs_lock_two_inodes(xfs_inode_t *, xfs_inode_t *, uint);
+void            xfs_lock_two_inodes(struct xfs_inode *ip0, uint ip0_mode,
+                                struct xfs_inode *ip1, uint ip1_mode);
 
 xfs_extlen_t    xfs_get_extsz_hint(struct xfs_inode *ip);
 xfs_extlen_t    xfs_get_cowextsz_hint(struct xfs_inode *ip);
@@ -491,4 +492,6 @@ extern struct kmem_zone	*xfs_inode_zone;
 /* The default CoW extent size hint. */
 #define XFS_DEFAULT_COWEXTSZ_HINT 32
 
+bool xfs_inode_verify_forks(struct xfs_inode *ip);
+
 #endif  /* __XFS_INODE_H__ */
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 7571abf5dfb3..d5037f060d6f 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -522,7 +522,7 @@ xfs_inode_item_push(
                 if (!xfs_buf_trylock(bp))
                         return XFS_ITEM_LOCKED;
 
-                if (!xfs_buf_resubmit_failed_buffers(bp, lip, buffer_list))
+                if (!xfs_buf_resubmit_failed_buffers(bp, buffer_list))
                         rval = XFS_ITEM_FLUSHING;
 
                 xfs_buf_unlock(bp);
@@ -713,37 +713,23 @@ xfs_iflush_done(
         struct xfs_log_item     *lip)
 {
         struct xfs_inode_log_item *iip;
-        struct xfs_log_item     *blip;
-        struct xfs_log_item     *next;
-        struct xfs_log_item     *prev;
+        struct xfs_log_item     *blip, *n;
         struct xfs_ail          *ailp = lip->li_ailp;
         int                     need_ail = 0;
+        LIST_HEAD(tmp);
 
         /*
          * Scan the buffer IO completions for other inodes being completed and
          * attach them to the current inode log item.
          */
-        blip = bp->b_fspriv;
-        prev = NULL;
-        while (blip != NULL) {
-                if (blip->li_cb != xfs_iflush_done) {
-                        prev = blip;
-                        blip = blip->li_bio_list;
-                        continue;
-                }
 
-                /* remove from list */
-                next = blip->li_bio_list;
-                if (!prev) {
-                        bp->b_fspriv = next;
-                } else {
-                        prev->li_bio_list = next;
-                }
+        list_add_tail(&lip->li_bio_list, &tmp);
 
-                /* add to current list */
-                blip->li_bio_list = lip->li_bio_list;
-                lip->li_bio_list = blip;
+        list_for_each_entry_safe(blip, n, &bp->b_li_list, li_bio_list) {
+                if (lip->li_cb != xfs_iflush_done)
+                        continue;
 
+                list_move_tail(&blip->li_bio_list, &tmp);
                 /*
                  * while we have the item, do the unlocked check for needing
                  * the AIL lock.
@@ -752,8 +738,6 @@ xfs_iflush_done(
                 if ((iip->ili_logged && blip->li_lsn == iip->ili_flush_lsn) ||
                     (blip->li_flags & XFS_LI_FAILED))
                         need_ail++;
-
-                blip = next;
         }
 
         /* make sure we capture the state of the initial inode. */
@@ -776,7 +760,7 @@ xfs_iflush_done(
 
                 /* this is an opencoded batch version of xfs_trans_ail_delete */
                 spin_lock(&ailp->xa_lock);
-                for (blip = lip; blip; blip = blip->li_bio_list) {
+                list_for_each_entry(blip, &tmp, li_bio_list) {
                         if (INODE_ITEM(blip)->ili_logged &&
                             blip->li_lsn == INODE_ITEM(blip)->ili_flush_lsn)
                                 mlip_changed |= xfs_ail_delete_one(ailp, blip);
@@ -802,15 +786,14 @@ xfs_iflush_done(
          * ili_last_fields bits now that we know that the data corresponding to
          * them is safely on disk.
          */
-        for (blip = lip; blip; blip = next) {
-                next = blip->li_bio_list;
-                blip->li_bio_list = NULL;
-
+        list_for_each_entry_safe(blip, n, &tmp, li_bio_list) {
+                list_del_init(&blip->li_bio_list);
                 iip = INODE_ITEM(blip);
                 iip->ili_logged = 0;
                 iip->ili_last_fields = 0;
                 xfs_ifunlock(iip->ili_inode);
         }
+        list_del(&tmp);
 }
 
 /*
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 20dc65fef6a4..89fb1eb80aae 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -45,6 +45,7 @@
 #include <linux/fsmap.h>
 #include "xfs_fsmap.h"
 #include "scrub/xfs_scrub.h"
+#include "xfs_sb.h"
 
 #include <linux/capability.h>
 #include <linux/cred.h>
@@ -809,7 +810,7 @@ xfs_ioc_fsgeometry_v1(
         xfs_fsop_geom_t         fsgeo;
         int                     error;
 
-        error = xfs_fs_geometry(mp, &fsgeo, 3);
+        error = xfs_fs_geometry(&mp->m_sb, &fsgeo, 3);
         if (error)
                 return error;
 
@@ -831,7 +832,7 @@ xfs_ioc_fsgeometry(
         xfs_fsop_geom_t         fsgeo;
         int                     error;
 
-        error = xfs_fs_geometry(mp, &fsgeo, 4);
+        error = xfs_fs_geometry(&mp->m_sb, &fsgeo, 4);
         if (error)
                 return error;
 
diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
index 35c79e246fde..10fbde359649 100644
--- a/fs/xfs/xfs_ioctl32.c
+++ b/fs/xfs/xfs_ioctl32.c
@@ -37,6 +37,7 @@
 #include "xfs_ioctl.h"
 #include "xfs_ioctl32.h"
 #include "xfs_trace.h"
+#include "xfs_sb.h"
 
 #define  _NATIVE_IOC(cmd, type) \
           _IOC(_IOC_DIR(cmd), _IOC_TYPE(cmd), _IOC_NR(cmd), sizeof(type))
@@ -66,7 +67,7 @@ xfs_compat_ioc_fsgeometry_v1(
         xfs_fsop_geom_t           fsgeo;
         int                       error;
 
-        error = xfs_fs_geometry(mp, &fsgeo, 3);
+        error = xfs_fs_geometry(&mp->m_sb, &fsgeo, 3);
         if (error)
                 return error;
         /* The 32-bit variant simply has some padding at the end */
diff --git a/fs/xfs/xfs_linux.h b/fs/xfs/xfs_linux.h
index 99562ec0de56..bee51a14a906 100644
--- a/fs/xfs/xfs_linux.h
+++ b/fs/xfs/xfs_linux.h
@@ -285,8 +285,22 @@ static inline uint64_t howmany_64(uint64_t x, uint32_t y)
 #define XFS_IS_REALTIME_INODE(ip)                       \
         (((ip)->i_d.di_flags & XFS_DIFLAG_REALTIME) &&  \
          (ip)->i_mount->m_rtdev_targp)
+#define XFS_IS_REALTIME_MOUNT(mp) ((mp)->m_rtdev_targp ? 1 : 0)
 #else
 #define XFS_IS_REALTIME_INODE(ip) (0)
+#define XFS_IS_REALTIME_MOUNT(mp) (0)
+#endif
+
+/*
+ * Starting in Linux 4.15, the %p (raw pointer value) printk modifier
+ * prints a hashed version of the pointer to avoid leaking kernel
+ * pointers into dmesg.  If we're trying to debug the kernel we want the
+ * raw values, so override this behavior as best we can.
+ */
+#ifdef DEBUG
+# define PTR_FMT "%px"
+#else
+# define PTR_FMT "%p"
 #endif
 
 #endif /* __XFS_LINUX__ */
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index a503af96d780..3e5ba1ecc080 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -1047,6 +1047,7 @@ xfs_log_item_init(
 
         INIT_LIST_HEAD(&item->li_ail);
         INIT_LIST_HEAD(&item->li_cil);
+        INIT_LIST_HEAD(&item->li_bio_list);
 }
 
 /*
@@ -1242,7 +1243,7 @@ xlog_space_left(
 static void
 xlog_iodone(xfs_buf_t *bp)
 {
-        struct xlog_in_core     *iclog = bp->b_fspriv;
+        struct xlog_in_core     *iclog = bp->b_log_item;
         struct xlog             *l = iclog->ic_log;
         int                     aborted = 0;
 
@@ -1773,7 +1774,7 @@ STATIC int
 xlog_bdstrat(
         struct xfs_buf          *bp)
 {
-        struct xlog_in_core     *iclog = bp->b_fspriv;
+        struct xlog_in_core     *iclog = bp->b_log_item;
 
         xfs_buf_lock(bp);
         if (iclog->ic_state & XLOG_STATE_IOERROR) {
@@ -1919,7 +1920,7 @@ xlog_sync(
         }
 
         bp->b_io_length = BTOBB(count);
-        bp->b_fspriv = iclog;
+        bp->b_log_item = iclog;
         bp->b_flags &= ~XBF_FLUSH;
         bp->b_flags |= (XBF_ASYNC | XBF_SYNCIO | XBF_WRITE | XBF_FUA);
 
@@ -1958,7 +1959,7 @@ xlog_sync(
                 XFS_BUF_SET_ADDR(bp, 0);             /* logical 0 */
                 xfs_buf_associate_memory(bp,
                                 (char *)&iclog->ic_header + count, split);
-                bp->b_fspriv = iclog;
+                bp->b_log_item = iclog;
                 bp->b_flags &= ~XBF_FLUSH;
                 bp->b_flags |= (XBF_ASYNC | XBF_SYNCIO | XBF_WRITE | XBF_FUA);
 
@@ -2117,7 +2118,9 @@ xlog_print_trans(
 
         /* dump core transaction and ticket info */
         xfs_warn(mp, "transaction summary:");
-        xfs_warn(mp, "  flags   = 0x%x", tp->t_flags);
+        xfs_warn(mp, "  log res   = %d", tp->t_log_res);
+        xfs_warn(mp, "  log count = %d", tp->t_log_count);
+        xfs_warn(mp, "  flags     = 0x%x", tp->t_flags);
 
         xlog_print_tic_res(mp, tp->t_ticket);
 
@@ -2242,7 +2245,7 @@ xlog_write_setup_ophdr(
                 break;
         default:
                 xfs_warn(log->l_mp,
-                        "Bad XFS transaction clientid 0x%x in ticket 0x%p",
+                        "Bad XFS transaction clientid 0x%x in ticket "PTR_FMT,
                         ophdr->oh_clientid, ticket);
                 return NULL;
         }
@@ -3924,7 +3927,7 @@ xlog_verify_iclog(
                 }
                 if (clientid != XFS_TRANSACTION && clientid != XFS_LOG)
                         xfs_warn(log->l_mp,
-                                "%s: invalid clientid %d op 0x%p offset 0x%lx",
+                                "%s: invalid clientid %d op "PTR_FMT" offset 0x%lx",
                                 __func__, clientid, ophead,
                                 (unsigned long)field_offset);
 
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 28d1abfe835e..00240c9ee72e 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -400,9 +400,9 @@ xlog_recover_iodone(
          * On v5 supers, a bli could be attached to update the metadata LSN.
          * Clean it up.
          */
-        if (bp->b_fspriv)
+        if (bp->b_log_item)
                 xfs_buf_item_relse(bp);
-        ASSERT(bp->b_fspriv == NULL);
+        ASSERT(bp->b_log_item == NULL);
 
         bp->b_iodone = NULL;
         xfs_buf_ioend(bp);
@@ -2218,7 +2218,7 @@ xlog_recover_do_inode_buffer(
                                 next_unlinked_offset - reg_buf_offset;
                 if (unlikely(*logged_nextp == 0)) {
                         xfs_alert(mp,
-                "Bad inode buffer log record (ptr = 0x%p, bp = 0x%p). "
+                "Bad inode buffer log record (ptr = "PTR_FMT", bp = "PTR_FMT"). "
                 "Trying to replay bad (0) inode di_next_unlinked field.",
                                 item, bp);
                         XFS_ERROR_REPORT("xlog_recover_do_inode_buf",
@@ -2630,7 +2630,7 @@ xlog_recover_validate_buf_type(
                 ASSERT(!bp->b_iodone || bp->b_iodone == xlog_recover_iodone);
                 bp->b_iodone = xlog_recover_iodone;
                 xfs_buf_item_init(bp, mp);
-                bip = bp->b_fspriv;
+                bip = bp->b_log_item;
                 bip->bli_item.li_lsn = current_lsn;
         }
 }
@@ -2652,7 +2652,7 @@ xlog_recover_do_reg_buffer(
         int                     i;
         int                     bit;
         int                     nbits;
-        int                     error;
+        xfs_failaddr_t          fa;
 
         trace_xfs_log_recover_buf_reg_buf(mp->m_log, buf_f);
 
@@ -2687,7 +2687,7 @@ xlog_recover_do_reg_buffer(
                  * the first dquot in the buffer should do. XXXThis is
                  * probably a good thing to do for other buf types also.
                  */
-                error = 0;
+                fa = NULL;
                 if (buf_f->blf_flags &
                    (XFS_BLF_UDQUOT_BUF|XFS_BLF_PDQUOT_BUF|XFS_BLF_GDQUOT_BUF)) {
                         if (item->ri_buf[i].i_addr == NULL) {
@@ -2701,11 +2701,14 @@ xlog_recover_do_reg_buffer(
                                         item->ri_buf[i].i_len, __func__);
                                 goto next;
                         }
-                        error = xfs_dqcheck(mp, item->ri_buf[i].i_addr,
-                                               -1, 0, XFS_QMOPT_DOWARN,
-                                               "dquot_buf_recover");
-                        if (error)
+                        fa = xfs_dquot_verify(mp, item->ri_buf[i].i_addr,
+                                               -1, 0, 0);
+                        if (fa) {
+                                xfs_alert(mp,
+        "dquot corrupt at %pS trying to replay into block 0x%llx",
+                                        fa, bp->b_bn);
                                 goto next;
+                        }
                 }
 
                 memcpy(xfs_buf_offset(bp,
@@ -2957,6 +2960,10 @@ xfs_recover_inode_owner_change(
         if (error)
                 goto out_free_ip;
 
+        if (!xfs_inode_verify_forks(ip)) {
+                error = -EFSCORRUPTED;
+                goto out_free_ip;
+        }
 
         if (in_f->ilf_fields & XFS_ILOG_DOWNER) {
                 ASSERT(in_f->ilf_fields & XFS_ILOG_DBROOT);
@@ -3042,7 +3049,7 @@ xlog_recover_inode_pass2(
          */
         if (unlikely(dip->di_magic != cpu_to_be16(XFS_DINODE_MAGIC))) {
                 xfs_alert(mp,
-        "%s: Bad inode magic number, dip = 0x%p, dino bp = 0x%p, ino = %Ld",
+        "%s: Bad inode magic number, dip = "PTR_FMT", dino bp = "PTR_FMT", ino = %Ld",
                         __func__, dip, bp, in_f->ilf_ino);
                 XFS_ERROR_REPORT("xlog_recover_inode_pass2(1)",
                                  XFS_ERRLEVEL_LOW, mp);
@@ -3052,7 +3059,7 @@ xlog_recover_inode_pass2(
         ldip = item->ri_buf[1].i_addr;
         if (unlikely(ldip->di_magic != XFS_DINODE_MAGIC)) {
                 xfs_alert(mp,
-                        "%s: Bad inode log record, rec ptr 0x%p, ino %Ld",
+                        "%s: Bad inode log record, rec ptr "PTR_FMT", ino %Ld",
                         __func__, item, in_f->ilf_ino);
                 XFS_ERROR_REPORT("xlog_recover_inode_pass2(2)",
                                  XFS_ERRLEVEL_LOW, mp);
@@ -3110,8 +3117,8 @@ xlog_recover_inode_pass2(
                         XFS_CORRUPTION_ERROR("xlog_recover_inode_pass2(3)",
                                          XFS_ERRLEVEL_LOW, mp, ldip);
                         xfs_alert(mp,
-                "%s: Bad regular inode log record, rec ptr 0x%p, "
-                "ino ptr = 0x%p, ino bp = 0x%p, ino %Ld",
+                "%s: Bad regular inode log record, rec ptr "PTR_FMT", "
+                "ino ptr = "PTR_FMT", ino bp = "PTR_FMT", ino %Ld",
                                 __func__, item, dip, bp, in_f->ilf_ino);
                         error = -EFSCORRUPTED;
                         goto out_release;
@@ -3123,8 +3130,8 @@ xlog_recover_inode_pass2(
                         XFS_CORRUPTION_ERROR("xlog_recover_inode_pass2(4)",
                                              XFS_ERRLEVEL_LOW, mp, ldip);
                         xfs_alert(mp,
-                "%s: Bad dir inode log record, rec ptr 0x%p, "
-                "ino ptr = 0x%p, ino bp = 0x%p, ino %Ld",
+                "%s: Bad dir inode log record, rec ptr "PTR_FMT", "
+                "ino ptr = "PTR_FMT", ino bp = "PTR_FMT", ino %Ld",
                                 __func__, item, dip, bp, in_f->ilf_ino);
                         error = -EFSCORRUPTED;
                         goto out_release;
@@ -3134,8 +3141,8 @@ xlog_recover_inode_pass2(
                 XFS_CORRUPTION_ERROR("xlog_recover_inode_pass2(5)",
                                      XFS_ERRLEVEL_LOW, mp, ldip);
                 xfs_alert(mp,
-        "%s: Bad inode log record, rec ptr 0x%p, dino ptr 0x%p, "
-        "dino bp 0x%p, ino %Ld, total extents = %d, nblocks = %Ld",
+        "%s: Bad inode log record, rec ptr "PTR_FMT", dino ptr "PTR_FMT", "
+        "dino bp "PTR_FMT", ino %Ld, total extents = %d, nblocks = %Ld",
                         __func__, item, dip, bp, in_f->ilf_ino,
                         ldip->di_nextents + ldip->di_anextents,
                         ldip->di_nblocks);
@@ -3146,8 +3153,8 @@ xlog_recover_inode_pass2(
                 XFS_CORRUPTION_ERROR("xlog_recover_inode_pass2(6)",
                                      XFS_ERRLEVEL_LOW, mp, ldip);
                 xfs_alert(mp,
-        "%s: Bad inode log record, rec ptr 0x%p, dino ptr 0x%p, "
-        "dino bp 0x%p, ino %Ld, forkoff 0x%x", __func__,
+        "%s: Bad inode log record, rec ptr "PTR_FMT", dino ptr "PTR_FMT", "
+        "dino bp "PTR_FMT", ino %Ld, forkoff 0x%x", __func__,
                         item, dip, bp, in_f->ilf_ino, ldip->di_forkoff);
                 error = -EFSCORRUPTED;
                 goto out_release;
@@ -3157,7 +3164,7 @@ xlog_recover_inode_pass2(
                 XFS_CORRUPTION_ERROR("xlog_recover_inode_pass2(7)",
                                      XFS_ERRLEVEL_LOW, mp, ldip);
                 xfs_alert(mp,
-                        "%s: Bad inode log record length %d, rec ptr 0x%p",
+                        "%s: Bad inode log record length %d, rec ptr "PTR_FMT,
                         __func__, item->ri_buf[1].i_len, item);
                 error = -EFSCORRUPTED;
                 goto out_release;
@@ -3303,6 +3310,7 @@ xlog_recover_dquot_pass2(
         xfs_mount_t             *mp = log->l_mp;
         xfs_buf_t               *bp;
         struct xfs_disk_dquot   *ddq, *recddq;
+        xfs_failaddr_t          fa;
         int                     error;
         xfs_dq_logformat_t      *dq_f;
         uint                    type;
@@ -3345,10 +3353,12 @@ xlog_recover_dquot_pass2(
          */
         dq_f = item->ri_buf[0].i_addr;
         ASSERT(dq_f);
-        error = xfs_dqcheck(mp, recddq, dq_f->qlf_id, 0, XFS_QMOPT_DOWARN,
-                           "xlog_recover_dquot_pass2 (log copy)");
-        if (error)
+        fa = xfs_dquot_verify(mp, recddq, dq_f->qlf_id, 0, 0);
+        if (fa) {
+                xfs_alert(mp, "corrupt dquot ID 0x%x in log at %pS",
+                                dq_f->qlf_id, fa);
                 return -EIO;
+        }
         ASSERT(dq_f->qlf_len == 1);
 
         /*
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index c879b517cc94..98fd41cbb9e1 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -162,6 +162,7 @@ xfs_free_perag(
                 ASSERT(pag);
                 ASSERT(atomic_read(&pag->pag_ref) == 0);
                 xfs_buf_hash_destroy(pag);
+                mutex_destroy(&pag->pag_ici_reclaim_lock);
                 call_rcu(&pag->rcu_head, __xfs_free_perag);
         }
 }
@@ -248,6 +249,7 @@ xfs_initialize_perag(
 out_hash_destroy:
         xfs_buf_hash_destroy(pag);
 out_free_pag:
+        mutex_destroy(&pag->pag_ici_reclaim_lock);
         kmem_free(pag);
 out_unwind_new_pags:
         /* unwind any prior newly initialized pags */
@@ -256,6 +258,7 @@ out_unwind_new_pags:
                 if (!pag)
                         break;
                 xfs_buf_hash_destroy(pag);
+                mutex_destroy(&pag->pag_ici_reclaim_lock);
                 kmem_free(pag);
         }
         return error;
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index b897b11afb2c..5b848f4b637f 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -162,7 +162,7 @@ xfs_qm_dqpurge(
                  */
                 error = xfs_qm_dqflush(dqp, &bp);
                 if (error) {
-                        xfs_warn(mp, "%s: dquot %p flush failed",
+                        xfs_warn(mp, "%s: dquot "PTR_FMT" flush failed",
                                 __func__, dqp);
                 } else {
                         error = xfs_bwrite(bp);
@@ -291,8 +291,7 @@ xfs_qm_dqattach_one(
          * exist on disk and we didn't ask it to allocate; ESRCH if quotas got
          * turned off suddenly.
          */
-        error = xfs_qm_dqget(ip->i_mount, ip, id, type,
-                             doalloc | XFS_QMOPT_DOWARN, &dqp);
+        error = xfs_qm_dqget(ip->i_mount, ip, id, type, doalloc, &dqp);
         if (error)
                 return error;
 
@@ -481,7 +480,7 @@ xfs_qm_dquot_isolate(
 
                 error = xfs_qm_dqflush(dqp, &bp);
                 if (error) {
-                        xfs_warn(dqp->q_mount, "%s: dquot %p flush failed",
+                        xfs_warn(dqp->q_mount, "%s: dquot "PTR_FMT" flush failed",
                                  __func__, dqp);
                         goto out_unlock_dirty;
                 }
@@ -574,7 +573,7 @@ xfs_qm_set_defquota(
         struct xfs_def_quota    *defq;
         int                     error;
 
-        error = xfs_qm_dqread(mp, 0, type, XFS_QMOPT_DOWARN, &dqp);
+        error = xfs_qm_dqread(mp, 0, type, 0, &dqp);
 
         if (!error) {
                 xfs_disk_dquot_t        *ddqp = &dqp->q_core;
@@ -652,7 +651,7 @@ xfs_qm_init_quotainfo(
                         XFS_IS_UQUOTA_RUNNING(mp) ? XFS_DQ_USER :
                          (XFS_IS_GQUOTA_RUNNING(mp) ? XFS_DQ_GROUP :
                           XFS_DQ_PROJ),
-                        XFS_QMOPT_DOWARN, &dqp);
+                        0, &dqp);
 
         if (!error) {
                 xfs_disk_dquot_t        *ddqp = &dqp->q_core;
@@ -843,6 +842,7 @@ xfs_qm_reset_dqcounts(
 {
         struct xfs_dqblk        *dqb;
         int                     j;
+        xfs_failaddr_t          fa;
 
         trace_xfs_reset_dqcounts(bp, _RET_IP_);
 
@@ -864,10 +864,13 @@ xfs_qm_reset_dqcounts(
                 /*
                  * Do a sanity check, and if needed, repair the dqblk. Don't
                  * output any warnings because it's perfectly possible to
-                 * find uninitialised dquot blks. See comment in xfs_dqcheck.
+                 * find uninitialised dquot blks. See comment in
+                 * xfs_dquot_verify.
                  */
-                xfs_dqcheck(mp, ddq, id+j, type, XFS_QMOPT_DQREPAIR,
-                            "xfs_quotacheck");
+                fa = xfs_dquot_verify(mp, ddq, id + j, type, 0);
+                if (fa)
+                        xfs_dquot_repair(mp, ddq, id + j, type);
+
                 /*
                  * Reset type in case we are reusing group quota file for
                  * project quotas or vice versa
@@ -1074,8 +1077,7 @@ xfs_qm_quotacheck_dqadjust(
         struct xfs_dquot        *dqp;
         int                     error;
 
-        error = xfs_qm_dqget(mp, ip, id, type,
-                             XFS_QMOPT_DQALLOC | XFS_QMOPT_DOWARN, &dqp);
+        error = xfs_qm_dqget(mp, ip, id, type, XFS_QMOPT_DQALLOC, &dqp);
         if (error) {
                 /*
                  * Shouldn't be able to turn off quotas here.
@@ -1696,8 +1698,7 @@ xfs_qm_vop_dqalloc(
                         xfs_iunlock(ip, lockflags);
                         error = xfs_qm_dqget(mp, NULL, uid,
                                                  XFS_DQ_USER,
-                                                 XFS_QMOPT_DQALLOC |
-                                                 XFS_QMOPT_DOWARN,
+                                                 XFS_QMOPT_DQALLOC,
                                                  &uq);
                         if (error) {
                                 ASSERT(error != -ENOENT);
@@ -1723,8 +1724,7 @@ xfs_qm_vop_dqalloc(
                         xfs_iunlock(ip, lockflags);
                         error = xfs_qm_dqget(mp, NULL, gid,
                                                  XFS_DQ_GROUP,
-                                                 XFS_QMOPT_DQALLOC |
-                                                 XFS_QMOPT_DOWARN,
+                                                 XFS_QMOPT_DQALLOC,
                                                  &gq);
                         if (error) {
                                 ASSERT(error != -ENOENT);
@@ -1743,8 +1743,7 @@ xfs_qm_vop_dqalloc(
                         xfs_iunlock(ip, lockflags);
                         error = xfs_qm_dqget(mp, NULL, (xfs_dqid_t)prid,
                                                  XFS_DQ_PROJ,
-                                                 XFS_QMOPT_DQALLOC |
-                                                 XFS_QMOPT_DOWARN,
+                                                 XFS_QMOPT_DQALLOC,
                                                  &pq);
                         if (error) {
                                 ASSERT(error != -ENOENT);
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index 47aea2e82c26..270246943a06 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -464,6 +464,13 @@ retry:
         error = xfs_trans_commit(tp);
         if (error)
                 return error;
+
+        /*
+         * Allocation succeeded but the requested range was not even partially
+         * satisfied?  Bail out!
+         */
+        if (nimaps == 0)
+                return -ENOSPC;
 convert:
         return xfs_reflink_convert_cow_extent(ip, imap, offset_fsb, count_fsb,
                         &dfops);
@@ -599,10 +606,6 @@ xfs_reflink_cancel_cow_blocks(
                                         del.br_startblock, del.br_blockcount,
                                         NULL);
 
-                        /* Update quota accounting */
-                        xfs_trans_mod_dquot_byino(*tpp, ip, XFS_TRANS_DQ_BCOUNT,
-                                        -(long)del.br_blockcount);
-
                         /* Roll the transaction */
                         xfs_defer_ijoin(&dfops, ip);
                         error = xfs_defer_finish(tpp, &dfops);
@@ -613,6 +616,13 @@ xfs_reflink_cancel_cow_blocks(
 
                         /* Remove the mapping from the CoW fork. */
                         xfs_bmap_del_extent_cow(ip, &icur, &got, &del);
+
+                        /* Remove the quota reservation */
+                        error = xfs_trans_reserve_quota_nblks(NULL, ip,
+                                        -(long)del.br_blockcount, 0,
+                                        XFS_QMOPT_RES_REGBLKS);
+                        if (error)
+                                break;
                 } else {
                         /* Didn't do anything, push cursor back. */
                         xfs_iext_prev(ifp, &icur);
@@ -795,6 +805,10 @@ xfs_reflink_end_cow(
                 if (error)
                         goto out_defer;
 
+                /* Charge this new data fork mapping to the on-disk quota. */
+                xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_DELBCOUNT,
+                                (long)del.br_blockcount);
+
                 /* Remove the mapping from the CoW fork. */
                 xfs_bmap_del_extent_cow(ip, &icur, &got, &del);
 
@@ -944,7 +958,7 @@ xfs_reflink_set_inode_flag(
         if (src->i_ino == dest->i_ino)
                 xfs_ilock(src, XFS_ILOCK_EXCL);
         else
-                xfs_lock_two_inodes(src, dest, XFS_ILOCK_EXCL);
+                xfs_lock_two_inodes(src, XFS_ILOCK_EXCL, dest, XFS_ILOCK_EXCL);
 
         if (!xfs_is_reflink_inode(src)) {
                 trace_xfs_reflink_set_inode_flag(src);
@@ -1202,13 +1216,16 @@ xfs_reflink_remap_blocks(
 
         /* drange = (destoff, destoff + len); srange = (srcoff, srcoff + len) */
         while (len) {
+                uint            lock_mode;
+
                 trace_xfs_reflink_remap_blocks_loop(src, srcoff, len,
                                 dest, destoff);
+
                 /* Read extent from the source file */
                 nimaps = 1;
-                xfs_ilock(src, XFS_ILOCK_EXCL);
+                lock_mode = xfs_ilock_data_map_shared(src);
                 error = xfs_bmapi_read(src, srcoff, len, &imap, &nimaps, 0);
-                xfs_iunlock(src, XFS_ILOCK_EXCL);
+                xfs_iunlock(src, lock_mode);
                 if (error)
                         goto err;
                 ASSERT(nimaps == 1);
@@ -1245,6 +1262,50 @@ err:
 }
 
 /*
+ * Grab the exclusive iolock for a data copy from src to dest, making
+ * sure to abide vfs locking order (lowest pointer value goes first) and
+ * breaking the pnfs layout leases on dest before proceeding.  The loop
+ * is needed because we cannot call the blocking break_layout() with the
+ * src iolock held, and therefore have to back out both locks.
+ */
+static int
+xfs_iolock_two_inodes_and_break_layout(
+        struct inode            *src,
+        struct inode            *dest)
+{
+        int                     error;
+
+retry:
+        if (src < dest) {
+                inode_lock_shared(src);
+                inode_lock_nested(dest, I_MUTEX_NONDIR2);
+        } else {
+                /* src >= dest */
+                inode_lock(dest);
+        }
+
+        error = break_layout(dest, false);
+        if (error == -EWOULDBLOCK) {
+                inode_unlock(dest);
+                if (src < dest)
+                        inode_unlock_shared(src);
+                error = break_layout(dest, true);
+                if (error)
+                        return error;
+                goto retry;
+        }
+        if (error) {
+                inode_unlock(dest);
+                if (src < dest)
+                        inode_unlock_shared(src);
+                return error;
+        }
+        if (src > dest)
+                inode_lock_shared_nested(src, I_MUTEX_NONDIR2);
+        return 0;
+}
+
+/*
  * Link a range of blocks from one file to another.
  */
 int
@@ -1274,11 +1335,14 @@ xfs_reflink_remap_range(
                 return -EIO;
 
         /* Lock both files against IO */
-        lock_two_nondirectories(inode_in, inode_out);
+        ret = xfs_iolock_two_inodes_and_break_layout(inode_in, inode_out);
+        if (ret)
+                return ret;
         if (same_inode)
                 xfs_ilock(src, XFS_MMAPLOCK_EXCL);
         else
-                xfs_lock_two_inodes(src, dest, XFS_MMAPLOCK_EXCL);
+                xfs_lock_two_inodes(src, XFS_MMAPLOCK_SHARED, dest,
+                                XFS_MMAPLOCK_EXCL);
 
         /* Check file eligibility and prepare for block sharing. */
         ret = -EINVAL;
@@ -1295,6 +1359,11 @@ xfs_reflink_remap_range(
         if (ret <= 0)
                 goto out_unlock;
 
+        /* Attach dquots to dest inode before changing block map */
+        ret = xfs_qm_dqattach(dest, 0);
+        if (ret)
+                goto out_unlock;
+
         trace_xfs_reflink_remap_range(src, pos_in, len, dest, pos_out);
 
         /*
@@ -1341,10 +1410,12 @@ xfs_reflink_remap_range(
                         is_dedupe);
 
 out_unlock:
-        xfs_iunlock(src, XFS_MMAPLOCK_EXCL);
+        xfs_iunlock(dest, XFS_MMAPLOCK_EXCL);
+        if (!same_inode)
+                xfs_iunlock(src, XFS_MMAPLOCK_SHARED);
+        inode_unlock(inode_out);
         if (!same_inode)
-                xfs_iunlock(dest, XFS_MMAPLOCK_EXCL);
-        unlock_two_nondirectories(inode_in, inode_out);
+                inode_unlock_shared(inode_in);
         if (ret)
                 trace_xfs_reflink_remap_range_error(dest, ret, _RET_IP_);
         return ret;
diff --git a/fs/xfs/xfs_rtalloc.h b/fs/xfs/xfs_rtalloc.h
index 3f30f846d7f2..dfee3c991155 100644
--- a/fs/xfs/xfs_rtalloc.h
+++ b/fs/xfs/xfs_rtalloc.h
@@ -139,6 +139,9 @@ int xfs_rtalloc_query_all(struct xfs_trans *tp,
                           xfs_rtalloc_query_range_fn fn,
                           void *priv);
 bool xfs_verify_rtbno(struct xfs_mount *mp, xfs_rtblock_t rtbno);
+int xfs_rtalloc_extent_is_free(struct xfs_mount *mp, struct xfs_trans *tp,
+                               xfs_rtblock_t start, xfs_extlen_t len,
+                               bool *is_free);
 #else
 # define xfs_rtallocate_extent(t,b,min,max,l,f,p,rb)    (ENOSYS)
 # define xfs_rtfree_extent(t,b,l)                       (ENOSYS)
@@ -148,6 +151,7 @@ bool xfs_verify_rtbno(struct xfs_mount *mp, xfs_rtblock_t rtbno);
 # define xfs_rtalloc_query_all(t,f,p)                   (ENOSYS)
 # define xfs_rtbuf_get(m,t,b,i,p)                       (ENOSYS)
 # define xfs_verify_rtbno(m, r)                 (false)
+# define xfs_rtalloc_extent_is_free(m,t,s,l,i)          (ENOSYS)
 static inline int               /* error */
 xfs_rtmount_init(
         xfs_mount_t     *mp)    /* file system mount structure */
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 1dacccc367f8..f3e0001f9992 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1153,6 +1153,14 @@ xfs_fs_statfs(
             ((mp->m_qflags & (XFS_PQUOTA_ACCT|XFS_PQUOTA_ENFD))) ==
                               (XFS_PQUOTA_ACCT|XFS_PQUOTA_ENFD))
                 xfs_qm_statvfs(ip, statp);
+
+        if (XFS_IS_REALTIME_MOUNT(mp) &&
+            (ip->i_d.di_flags & (XFS_DIFLAG_RTINHERIT | XFS_DIFLAG_REALTIME))) {
+                statp->f_blocks = sbp->sb_rblocks;
+                statp->f_bavail = statp->f_bfree =
+                        sbp->sb_frextents * sbp->sb_rextsize;
+        }
+
         return 0;
 }
 
@@ -1660,7 +1668,7 @@ xfs_fs_fill_super(
                 }
                 if (xfs_sb_version_hasreflink(&mp->m_sb))
                         xfs_alert(mp,
-                "DAX and reflink have not been tested together!");
+                "DAX and reflink cannot be used together!");
         }
 
         if (mp->m_flags & XFS_MOUNT_DISCARD) {
@@ -1684,10 +1692,6 @@ xfs_fs_fill_super(
         "EXPERIMENTAL reverse mapping btree feature enabled. Use at your own risk!");
         }
 
-        if (xfs_sb_version_hasreflink(&mp->m_sb))
-                xfs_alert(mp,
-        "EXPERIMENTAL reflink feature enabled. Use at your own risk!");
-
         error = xfs_mountfs(mp);
         if (error)
                 goto out_filestream_unmount;
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index d718a10c2271..945de08af7ba 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -72,7 +72,7 @@ DECLARE_EVENT_CLASS(xfs_attr_list_class,
                 __entry->flags = ctx->flags;
         ),
         TP_printk("dev %d:%d ino 0x%llx cursor h/b/o 0x%x/0x%x/%u dupcnt %u "
-                  "alist 0x%p size %u count %u firstu %u flags %d %s",
+                  "alist %p size %u count %u firstu %u flags %d %s",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                    __entry->ino,
                    __entry->hashval,
@@ -119,7 +119,7 @@ DECLARE_EVENT_CLASS(xfs_perag_class,
                 __entry->refcount = refcount;
                 __entry->caller_ip = caller_ip;
         ),
-        TP_printk("dev %d:%d agno %u refcount %d caller %ps",
+        TP_printk("dev %d:%d agno %u refcount %d caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->agno,
                   __entry->refcount,
@@ -200,7 +200,7 @@ TRACE_EVENT(xfs_attr_list_node_descend,
                 __entry->bt_before = be32_to_cpu(btree->before);
         ),
         TP_printk("dev %d:%d ino 0x%llx cursor h/b/o 0x%x/0x%x/%u dupcnt %u "
-                  "alist 0x%p size %u count %u firstu %u flags %d %s "
+                  "alist %p size %u count %u firstu %u flags %d %s "
                   "node hashval %u, node before %u",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                    __entry->ino,
@@ -251,8 +251,8 @@ DECLARE_EVENT_CLASS(xfs_bmap_class,
                 __entry->bmap_state = state;
                 __entry->caller_ip = caller_ip;
         ),
-        TP_printk("dev %d:%d ino 0x%llx state %s cur 0x%p/%d "
-                  "offset %lld block %lld count %lld flag %d caller %ps",
+        TP_printk("dev %d:%d ino 0x%llx state %s cur %p/%d "
+                  "offset %lld block %lld count %lld flag %d caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __print_flags(__entry->bmap_state, "|", XFS_BMAP_EXT_FLAGS),
@@ -301,7 +301,7 @@ DECLARE_EVENT_CLASS(xfs_buf_class,
                 __entry->caller_ip = caller_ip;
         ),
         TP_printk("dev %d:%d bno 0x%llx nblks 0x%x hold %d pincount %d "
-                  "lock %d flags %s caller %ps",
+                  "lock %d flags %s caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long long)__entry->bno,
                   __entry->nblks,
@@ -370,7 +370,7 @@ DECLARE_EVENT_CLASS(xfs_buf_flags_class,
                 __entry->caller_ip = caller_ip;
         ),
         TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d "
-                  "lock %d flags %s caller %ps",
+                  "lock %d flags %s caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long long)__entry->bno,
                   __entry->buffer_length,
@@ -390,7 +390,7 @@ DEFINE_BUF_FLAGS_EVENT(xfs_buf_get);
 DEFINE_BUF_FLAGS_EVENT(xfs_buf_read);
 
 TRACE_EVENT(xfs_buf_ioerror,
-        TP_PROTO(struct xfs_buf *bp, int error, unsigned long caller_ip),
+        TP_PROTO(struct xfs_buf *bp, int error, xfs_failaddr_t caller_ip),
         TP_ARGS(bp, error, caller_ip),
         TP_STRUCT__entry(
                 __field(dev_t, dev)
@@ -401,7 +401,7 @@ TRACE_EVENT(xfs_buf_ioerror,
                 __field(int, pincount)
                 __field(unsigned, lockval)
                 __field(int, error)
-                __field(unsigned long, caller_ip)
+                __field(xfs_failaddr_t, caller_ip)
         ),
         TP_fast_assign(
                 __entry->dev = bp->b_target->bt_dev;
@@ -415,7 +415,7 @@ TRACE_EVENT(xfs_buf_ioerror,
                 __entry->caller_ip = caller_ip;
         ),
         TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d "
-                  "lock %d error %d flags %s caller %ps",
+                  "lock %d error %d flags %s caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long long)__entry->bno,
                   __entry->buffer_length,
@@ -460,7 +460,7 @@ DECLARE_EVENT_CLASS(xfs_buf_item_class,
         ),
         TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d "
                   "lock %d flags %s recur %d refcount %d bliflags %s "
-                  "lidesc 0x%p liflags %s",
+                  "lidesc %p liflags %s",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long long)__entry->buf_bno,
                   __entry->buf_len,
@@ -579,7 +579,7 @@ DECLARE_EVENT_CLASS(xfs_lock_class,
                 __entry->lock_flags = lock_flags;
                 __entry->caller_ip = caller_ip;
         ),
-        TP_printk("dev %d:%d ino 0x%llx flags %s caller %ps",
+        TP_printk("dev %d:%d ino 0x%llx flags %s caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __print_flags(__entry->lock_flags, "|", XFS_LOCK_FLAGS),
@@ -697,7 +697,7 @@ DECLARE_EVENT_CLASS(xfs_iref_class,
                 __entry->pincount = atomic_read(&ip->i_pincount);
                 __entry->caller_ip = caller_ip;
         ),
-        TP_printk("dev %d:%d ino 0x%llx count %d pincount %d caller %ps",
+        TP_printk("dev %d:%d ino 0x%llx count %d pincount %d caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->count,
@@ -1028,7 +1028,7 @@ DECLARE_EVENT_CLASS(xfs_log_item_class,
                 __entry->flags = lip->li_flags;
                 __entry->lsn = lip->li_lsn;
         ),
-        TP_printk("dev %d:%d lip 0x%p lsn %d/%d type %s flags %s",
+        TP_printk("dev %d:%d lip %p lsn %d/%d type %s flags %s",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->lip,
                   CYCLE_LSN(__entry->lsn), BLOCK_LSN(__entry->lsn),
@@ -1049,7 +1049,7 @@ TRACE_EVENT(xfs_log_force,
                 __entry->lsn = lsn;
                 __entry->caller_ip = caller_ip;
         ),
-        TP_printk("dev %d:%d lsn 0x%llx caller %ps",
+        TP_printk("dev %d:%d lsn 0x%llx caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->lsn, (void *)__entry->caller_ip)
 )
@@ -1082,7 +1082,7 @@ DECLARE_EVENT_CLASS(xfs_ail_class,
                 __entry->old_lsn = old_lsn;
                 __entry->new_lsn = new_lsn;
         ),
-        TP_printk("dev %d:%d lip 0x%p old lsn %d/%d new lsn %d/%d type %s flags %s",
+        TP_printk("dev %d:%d lip %p old lsn %d/%d new lsn %d/%d type %s flags %s",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->lip,
                   CYCLE_LSN(__entry->old_lsn), BLOCK_LSN(__entry->old_lsn),
@@ -1403,7 +1403,7 @@ TRACE_EVENT(xfs_bunmap,
                 __entry->flags = flags;
         ),
         TP_printk("dev %d:%d ino 0x%llx size 0x%llx bno 0x%llx len 0x%llx"
-                  "flags %s caller %ps",
+                  "flags %s caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->size,
@@ -1517,7 +1517,7 @@ TRACE_EVENT(xfs_agf,
         ),
         TP_printk("dev %d:%d agno %u flags %s length %u roots b %u c %u "
                   "levels b %u c %u flfirst %u fllast %u flcount %u "
-                  "freeblks %u longest %u caller %ps",
+                  "freeblks %u longest %u caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->agno,
                   __print_flags(__entry->flags, "|", XFS_AGF_FLAGS),
@@ -2014,7 +2014,7 @@ DECLARE_EVENT_CLASS(xfs_log_recover_item_class,
                 __entry->count = item->ri_cnt;
                 __entry->total = item->ri_total;
         ),
-        TP_printk("dev %d:%d tid 0x%x lsn 0x%llx, pass %d, item 0x%p, "
+        TP_printk("dev %d:%d tid 0x%x lsn 0x%llx, pass %d, item %p, "
                   "item type %s item region count/total %d/%d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->tid,
@@ -2486,7 +2486,7 @@ DECLARE_EVENT_CLASS(xfs_ag_error_class,
                 __entry->error = error;
                 __entry->caller_ip = caller_ip;
         ),
-        TP_printk("dev %d:%d agno %u error %d caller %ps",
+        TP_printk("dev %d:%d agno %u error %d caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->agno,
                   __entry->error,
@@ -2977,7 +2977,7 @@ DECLARE_EVENT_CLASS(xfs_inode_error_class,
                 __entry->error = error;
                 __entry->caller_ip = caller_ip;
         ),
-        TP_printk("dev %d:%d ino %llx error %d caller %ps",
+        TP_printk("dev %d:%d ino %llx error %d caller %pS",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __entry->error,
@@ -3313,6 +3313,32 @@ DEFINE_GETFSMAP_EVENT(xfs_getfsmap_low_key);
 DEFINE_GETFSMAP_EVENT(xfs_getfsmap_high_key);
 DEFINE_GETFSMAP_EVENT(xfs_getfsmap_mapping);
 
+TRACE_EVENT(xfs_trans_resv_calc,
+        TP_PROTO(struct xfs_mount *mp, unsigned int type,
+                 struct xfs_trans_res *res),
+        TP_ARGS(mp, type, res),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(int, type)
+                __field(uint, logres)
+                __field(int, logcount)
+                __field(int, logflags)
+        ),
+        TP_fast_assign(
+                __entry->dev = mp->m_super->s_dev;
+                __entry->type = type;
+                __entry->logres = res->tr_logres;
+                __entry->logcount = res->tr_logcount;
+                __entry->logflags = res->tr_logflags;
+        ),
+        TP_printk("dev %d:%d type %d logres %u logcount %d flags 0x%x",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->type,
+                  __entry->logres,
+                  __entry->logcount,
+                  __entry->logflags)
+);
+
 #endif /* _TRACE_XFS_H */
 
 #undef TRACE_INCLUDE_PATH
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index a87f657f59c9..86f92df32c42 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -35,6 +35,27 @@
 kmem_zone_t     *xfs_trans_zone;
 kmem_zone_t     *xfs_log_item_desc_zone;
 
+#if defined(CONFIG_TRACEPOINTS)
+static void
+xfs_trans_trace_reservations(
+        struct xfs_mount        *mp)
+{
+        struct xfs_trans_res    resv;
+        struct xfs_trans_res    *res;
+        struct xfs_trans_res    *end_res;
+        int                     i;
+
+        res = (struct xfs_trans_res *)M_RES(mp);
+        end_res = (struct xfs_trans_res *)(M_RES(mp) + 1);
+        for (i = 0; res < end_res; i++, res++)
+                trace_xfs_trans_resv_calc(mp, i, res);
+        xfs_log_get_max_trans_res(mp, &resv);
+        trace_xfs_trans_resv_calc(mp, -1, &resv);
+}
+#else
+# define xfs_trans_trace_reservations(mp)
+#endif
+
 /*
  * Initialize the precomputed transaction reservation values
  * in the mount structure.
@@ -44,6 +65,7 @@ xfs_trans_init(
         struct xfs_mount        *mp)
 {
         xfs_trans_resv_calc(mp, M_RES(mp));
+        xfs_trans_trace_reservations(mp);
 }
 
 /*
diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h
index 815b53d20e26..9d542dfe0052 100644
--- a/fs/xfs/xfs_trans.h
+++ b/fs/xfs/xfs_trans.h
@@ -50,7 +50,7 @@ typedef struct xfs_log_item {
         uint                            li_type;        /* item type */
         uint                            li_flags;       /* misc flags */
         struct xfs_buf                  *li_buf;        /* real buffer pointer */
-        struct xfs_log_item             *li_bio_list;   /* buffer item list */
+        struct list_head                li_bio_list;    /* buffer item list */
         void                            (*li_cb)(struct xfs_buf *,
                                                  struct xfs_log_item *);
                                                         /* buffer item iodone */
diff --git a/fs/xfs/xfs_trans_buf.c b/fs/xfs/xfs_trans_buf.c
index 3ba7a96a8abd..653ce379d36b 100644
--- a/fs/xfs/xfs_trans_buf.c
+++ b/fs/xfs/xfs_trans_buf.c
@@ -82,12 +82,12 @@ _xfs_trans_bjoin(
         ASSERT(bp->b_transp == NULL);
 
         /*
-         * The xfs_buf_log_item pointer is stored in b_fsprivate.  If
+         * The xfs_buf_log_item pointer is stored in b_log_item.  If
          * it doesn't have one yet, then allocate one and initialize it.
          * The checks to see if one is there are in xfs_buf_item_init().
          */
         xfs_buf_item_init(bp, tp->t_mountp);
-        bip = bp->b_fspriv;
+        bip = bp->b_log_item;
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
         ASSERT(!(bip->__bli_format.blf_flags & XFS_BLF_CANCEL));
         ASSERT(!(bip->bli_flags & XFS_BLI_LOGGED));
@@ -118,7 +118,7 @@ xfs_trans_bjoin(
         struct xfs_buf          *bp)
 {
         _xfs_trans_bjoin(tp, bp, 0);
-        trace_xfs_trans_bjoin(bp->b_fspriv);
+        trace_xfs_trans_bjoin(bp->b_log_item);
 }
 
 /*
@@ -139,7 +139,7 @@ xfs_trans_get_buf_map(
         xfs_buf_flags_t         flags)
 {
         xfs_buf_t               *bp;
-        xfs_buf_log_item_t      *bip;
+        struct xfs_buf_log_item *bip;
 
         if (!tp)
                 return xfs_buf_get_map(target, map, nmaps, flags);
@@ -159,7 +159,7 @@ xfs_trans_get_buf_map(
                 }
 
                 ASSERT(bp->b_transp == tp);
-                bip = bp->b_fspriv;
+                bip = bp->b_log_item;
                 ASSERT(bip != NULL);
                 ASSERT(atomic_read(&bip->bli_refcount) > 0);
                 bip->bli_recur++;
@@ -175,7 +175,7 @@ xfs_trans_get_buf_map(
         ASSERT(!bp->b_error);
 
         _xfs_trans_bjoin(tp, bp, 1);
-        trace_xfs_trans_get_buf(bp->b_fspriv);
+        trace_xfs_trans_get_buf(bp->b_log_item);
         return bp;
 }
 
@@ -188,12 +188,13 @@ xfs_trans_get_buf_map(
  * mount structure.
  */
 xfs_buf_t *
-xfs_trans_getsb(xfs_trans_t     *tp,
-                struct xfs_mount *mp,
-                int             flags)
+xfs_trans_getsb(
+        xfs_trans_t             *tp,
+        struct xfs_mount        *mp,
+        int                     flags)
 {
         xfs_buf_t               *bp;
-        xfs_buf_log_item_t      *bip;
+        struct xfs_buf_log_item *bip;
 
         /*
          * Default to just trying to lock the superblock buffer
@@ -210,7 +211,7 @@ xfs_trans_getsb(xfs_trans_t	*tp,
          */
         bp = mp->m_sb_bp;
         if (bp->b_transp == tp) {
-                bip = bp->b_fspriv;
+                bip = bp->b_log_item;
                 ASSERT(bip != NULL);
                 ASSERT(atomic_read(&bip->bli_refcount) > 0);
                 bip->bli_recur++;
@@ -223,7 +224,7 @@ xfs_trans_getsb(xfs_trans_t	*tp,
                 return NULL;
 
         _xfs_trans_bjoin(tp, bp, 1);
-        trace_xfs_trans_getsb(bp->b_fspriv);
+        trace_xfs_trans_getsb(bp->b_log_item);
         return bp;
 }
 
@@ -266,7 +267,7 @@ xfs_trans_read_buf_map(
         if (bp) {
                 ASSERT(xfs_buf_islocked(bp));
                 ASSERT(bp->b_transp == tp);
-                ASSERT(bp->b_fspriv != NULL);
+                ASSERT(bp->b_log_item != NULL);
                 ASSERT(!bp->b_error);
                 ASSERT(bp->b_flags & XBF_DONE);
 
@@ -279,7 +280,7 @@ xfs_trans_read_buf_map(
                         return -EIO;
                 }
 
-                bip = bp->b_fspriv;
+                bip = bp->b_log_item;
                 bip->bli_recur++;
 
                 ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -329,7 +330,7 @@ xfs_trans_read_buf_map(
 
         if (tp) {
                 _xfs_trans_bjoin(tp, bp, 1);
-                trace_xfs_trans_read_buf(bp->b_fspriv);
+                trace_xfs_trans_read_buf(bp->b_log_item);
         }
         *bpp = bp;
         return 0;
@@ -352,10 +353,11 @@ xfs_trans_read_buf_map(
  * brelse() call.
  */
 void
-xfs_trans_brelse(xfs_trans_t    *tp,
-                 xfs_buf_t      *bp)
+xfs_trans_brelse(
+        xfs_trans_t             *tp,
+        xfs_buf_t               *bp)
 {
-        xfs_buf_log_item_t      *bip;
+        struct xfs_buf_log_item *bip;
         int                     freed;
 
         /*
@@ -368,7 +370,7 @@ xfs_trans_brelse(xfs_trans_t	*tp,
         }
 
         ASSERT(bp->b_transp == tp);
-        bip = bp->b_fspriv;
+        bip = bp->b_log_item;
         ASSERT(bip->bli_item.li_type == XFS_LI_BUF);
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
         ASSERT(!(bip->__bli_format.blf_flags & XFS_BLF_CANCEL));
@@ -456,10 +458,11 @@ xfs_trans_brelse(xfs_trans_t	*tp,
  */
 /* ARGSUSED */
 void
-xfs_trans_bhold(xfs_trans_t     *tp,
-                xfs_buf_t       *bp)
+xfs_trans_bhold(
+        xfs_trans_t             *tp,
+        xfs_buf_t               *bp)
 {
-        xfs_buf_log_item_t      *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
@@ -476,10 +479,11 @@ xfs_trans_bhold(xfs_trans_t	*tp,
  * for this transaction.
  */
 void
-xfs_trans_bhold_release(xfs_trans_t     *tp,
-                        xfs_buf_t       *bp)
+xfs_trans_bhold_release(
+        xfs_trans_t             *tp,
+        xfs_buf_t               *bp)
 {
-        xfs_buf_log_item_t      *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
@@ -500,7 +504,7 @@ xfs_trans_dirty_buf(
         struct xfs_trans        *tp,
         struct xfs_buf          *bp)
 {
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
@@ -557,7 +561,7 @@ xfs_trans_log_buf(
         uint                    first,
         uint                    last)
 {
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         ASSERT(first <= last && last < BBTOB(bp->b_length));
         ASSERT(!(bip->bli_flags & XFS_BLI_ORDERED));
@@ -600,10 +604,10 @@ xfs_trans_log_buf(
  */
 void
 xfs_trans_binval(
-        xfs_trans_t     *tp,
-        xfs_buf_t       *bp)
+        xfs_trans_t             *tp,
+        xfs_buf_t               *bp)
 {
-        xfs_buf_log_item_t      *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
         int                     i;
 
         ASSERT(bp->b_transp == tp);
@@ -655,10 +659,10 @@ xfs_trans_binval(
  */
 void
 xfs_trans_inode_buf(
-        xfs_trans_t     *tp,
-        xfs_buf_t       *bp)
+        xfs_trans_t             *tp,
+        xfs_buf_t               *bp)
 {
-        xfs_buf_log_item_t      *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
@@ -679,10 +683,10 @@ xfs_trans_inode_buf(
  */
 void
 xfs_trans_stale_inode_buf(
-        xfs_trans_t     *tp,
-        xfs_buf_t       *bp)
+        xfs_trans_t             *tp,
+        xfs_buf_t               *bp)
 {
-        xfs_buf_log_item_t      *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
@@ -704,10 +708,10 @@ xfs_trans_stale_inode_buf(
 /* ARGSUSED */
 void
 xfs_trans_inode_alloc_buf(
-        xfs_trans_t     *tp,
-        xfs_buf_t       *bp)
+        xfs_trans_t             *tp,
+        xfs_buf_t               *bp)
 {
-        xfs_buf_log_item_t      *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
@@ -729,7 +733,7 @@ xfs_trans_ordered_buf(
         struct xfs_trans        *tp,
         struct xfs_buf          *bp)
 {
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
@@ -759,7 +763,7 @@ xfs_trans_buf_set_type(
         struct xfs_buf          *bp,
         enum xfs_blft           type)
 {
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         if (!tp)
                 return;
@@ -776,8 +780,8 @@ xfs_trans_buf_copy_type(
         struct xfs_buf          *dst_bp,
         struct xfs_buf          *src_bp)
 {
-        struct xfs_buf_log_item *sbip = src_bp->b_fspriv;
-        struct xfs_buf_log_item *dbip = dst_bp->b_fspriv;
+        struct xfs_buf_log_item *sbip = src_bp->b_log_item;
+        struct xfs_buf_log_item *dbip = dst_bp->b_log_item;
         enum xfs_blft           type;
 
         type = xfs_blft_from_flags(&sbip->__bli_format);
@@ -797,11 +801,11 @@ xfs_trans_buf_copy_type(
 /* ARGSUSED */
 void
 xfs_trans_dquot_buf(
-        xfs_trans_t     *tp,
-        xfs_buf_t       *bp,
-        uint            type)
+        xfs_trans_t             *tp,
+        xfs_buf_t               *bp,
+        uint                    type)
 {
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        struct xfs_buf_log_item *bip = bp->b_log_item;
 
         ASSERT(type == XFS_BLF_UDQUOT_BUF ||
                type == XFS_BLF_PDQUOT_BUF ||