242 files changed, 18761 insertions, 1746 deletions

diff --git a/fs/9p/acl.c b/fs/9p/acl.c
index 535ab6eccb1..4a866cd0628 100644
--- a/fs/9p/acl.c
+++ b/fs/9p/acl.c
@@ -185,12 +185,15 @@ int v9fs_acl_chmod(struct dentry *dentry)
 }
 
 int v9fs_set_create_acl(struct dentry *dentry,
-                        struct posix_acl *dpacl, struct posix_acl *pacl)
+                        struct posix_acl **dpacl, struct posix_acl **pacl)
 {
-        v9fs_set_acl(dentry, ACL_TYPE_DEFAULT, dpacl);
-        v9fs_set_acl(dentry, ACL_TYPE_ACCESS, pacl);
-        posix_acl_release(dpacl);
-        posix_acl_release(pacl);
+        if (dentry) {
+                v9fs_set_acl(dentry, ACL_TYPE_DEFAULT, *dpacl);
+                v9fs_set_acl(dentry, ACL_TYPE_ACCESS, *pacl);
+        }
+        posix_acl_release(*dpacl);
+        posix_acl_release(*pacl);
+        *dpacl = *pacl = NULL;
         return 0;
 }
 
@@ -212,11 +215,11 @@ int v9fs_acl_mode(struct inode *dir, mode_t *modep,
                 struct posix_acl *clone;
 
                 if (S_ISDIR(mode))
-                        *dpacl = acl;
+                        *dpacl = posix_acl_dup(acl);
                 clone = posix_acl_clone(acl, GFP_NOFS);
-                retval = -ENOMEM;
+                posix_acl_release(acl);
                 if (!clone)
-                        goto cleanup;
+                        return -ENOMEM;
 
                 retval = posix_acl_create_masq(clone, &mode);
                 if (retval < 0) {
@@ -225,11 +228,12 @@ int v9fs_acl_mode(struct inode *dir, mode_t *modep,
                 }
                 if (retval > 0)
                         *pacl = clone;
+                else
+                        posix_acl_release(clone);
         }
         *modep  = mode;
         return 0;
 cleanup:
-        posix_acl_release(acl);
         return retval;
 
 }
diff --git a/fs/9p/acl.h b/fs/9p/acl.h
index 7ef3ac9f6d9..c47ea9cf303 100644
--- a/fs/9p/acl.h
+++ b/fs/9p/acl.h
@@ -19,7 +19,7 @@ extern int v9fs_get_acl(struct inode *, struct p9_fid *);
 extern int v9fs_check_acl(struct inode *inode, int mask, unsigned int flags);
 extern int v9fs_acl_chmod(struct dentry *);
 extern int v9fs_set_create_acl(struct dentry *,
-                               struct posix_acl *, struct posix_acl *);
+                               struct posix_acl **, struct posix_acl **);
 extern int v9fs_acl_mode(struct inode *dir, mode_t *modep,
                          struct posix_acl **dpacl, struct posix_acl **pacl);
 #else
@@ -33,8 +33,8 @@ static inline int v9fs_acl_chmod(struct dentry *dentry)
         return 0;
 }
 static inline int v9fs_set_create_acl(struct dentry *dentry,
-                                      struct posix_acl *dpacl,
-                                      struct posix_acl *pacl)
+                                      struct posix_acl **dpacl,
+                                      struct posix_acl **pacl)
 {
         return 0;
 }
diff --git a/fs/9p/cache.c b/fs/9p/cache.c
index 5b335c5086a..945aa5f02f9 100644
--- a/fs/9p/cache.c
+++ b/fs/9p/cache.c
@@ -108,11 +108,10 @@ static uint16_t v9fs_cache_inode_get_key(const void *cookie_netfs_data,
                                          void *buffer, uint16_t bufmax)
 {
         const struct v9fs_inode *v9inode = cookie_netfs_data;
-        memcpy(buffer, &v9inode->fscache_key->path,
-               sizeof(v9inode->fscache_key->path));
+        memcpy(buffer, &v9inode->qid.path, sizeof(v9inode->qid.path));
         P9_DPRINTK(P9_DEBUG_FSC, "inode %p get key %llu", &v9inode->vfs_inode,
-                   v9inode->fscache_key->path);
-        return sizeof(v9inode->fscache_key->path);
+                   v9inode->qid.path);
+        return sizeof(v9inode->qid.path);
 }
 
 static void v9fs_cache_inode_get_attr(const void *cookie_netfs_data,
@@ -129,11 +128,10 @@ static uint16_t v9fs_cache_inode_get_aux(const void *cookie_netfs_data,
                                          void *buffer, uint16_t buflen)
 {
         const struct v9fs_inode *v9inode = cookie_netfs_data;
-        memcpy(buffer, &v9inode->fscache_key->version,
-               sizeof(v9inode->fscache_key->version));
+        memcpy(buffer, &v9inode->qid.version, sizeof(v9inode->qid.version));
         P9_DPRINTK(P9_DEBUG_FSC, "inode %p get aux %u", &v9inode->vfs_inode,
-                   v9inode->fscache_key->version);
-        return sizeof(v9inode->fscache_key->version);
+                   v9inode->qid.version);
+        return sizeof(v9inode->qid.version);
 }
 
 static enum
@@ -143,11 +141,11 @@ fscache_checkaux v9fs_cache_inode_check_aux(void *cookie_netfs_data,
 {
         const struct v9fs_inode *v9inode = cookie_netfs_data;
 
-        if (buflen != sizeof(v9inode->fscache_key->version))
+        if (buflen != sizeof(v9inode->qid.version))
                 return FSCACHE_CHECKAUX_OBSOLETE;
 
-        if (memcmp(buffer, &v9inode->fscache_key->version,
-                   sizeof(v9inode->fscache_key->version)))
+        if (memcmp(buffer, &v9inode->qid.version,
+                   sizeof(v9inode->qid.version)))
                 return FSCACHE_CHECKAUX_OBSOLETE;
 
         return FSCACHE_CHECKAUX_OKAY;
diff --git a/fs/9p/cache.h b/fs/9p/cache.h
index 049507a5b01..40cc54ced5d 100644
--- a/fs/9p/cache.h
+++ b/fs/9p/cache.h
@@ -93,15 +93,6 @@ static inline void v9fs_uncache_page(struct inode *inode, struct page *page)
         BUG_ON(PageFsCache(page));
 }
 
-static inline void v9fs_fscache_set_key(struct inode *inode,
-                                        struct p9_qid *qid)
-{
-        struct v9fs_inode *v9inode = V9FS_I(inode);
-        spin_lock(&v9inode->fscache_lock);
-        v9inode->fscache_key = qid;
-        spin_unlock(&v9inode->fscache_lock);
-}
-
 static inline void v9fs_fscache_wait_on_page_write(struct inode *inode,
                                                    struct page *page)
 {
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index c82b017f51f..ef966188611 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -78,6 +78,25 @@ static const match_table_t tokens = {
         {Opt_err, NULL}
 };
 
+/* Interpret mount options for cache mode */
+static int get_cache_mode(char *s)
+{
+        int version = -EINVAL;
+
+        if (!strcmp(s, "loose")) {
+                version = CACHE_LOOSE;
+                P9_DPRINTK(P9_DEBUG_9P, "Cache mode: loose\n");
+        } else if (!strcmp(s, "fscache")) {
+                version = CACHE_FSCACHE;
+                P9_DPRINTK(P9_DEBUG_9P, "Cache mode: fscache\n");
+        } else if (!strcmp(s, "none")) {
+                version = CACHE_NONE;
+                P9_DPRINTK(P9_DEBUG_9P, "Cache mode: none\n");
+        } else
+                printk(KERN_INFO "9p: Unknown Cache mode %s.\n", s);
+        return version;
+}
+
 /**
  * v9fs_parse_options - parse mount options into session structure
  * @v9ses: existing v9fs session information
@@ -97,7 +116,7 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
         /* setup defaults */
         v9ses->afid = ~0;
         v9ses->debug = 0;
-        v9ses->cache = 0;
+        v9ses->cache = CACHE_NONE;
 #ifdef CONFIG_9P_FSCACHE
         v9ses->cachetag = NULL;
 #endif
@@ -171,13 +190,13 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
                                   "problem allocating copy of cache arg\n");
                                 goto free_and_return;
                         }
+                        ret = get_cache_mode(s);
+                        if (ret == -EINVAL) {
+                                kfree(s);
+                                goto free_and_return;
+                        }
 
-                        if (strcmp(s, "loose") == 0)
-                                v9ses->cache = CACHE_LOOSE;
-                        else if (strcmp(s, "fscache") == 0)
-                                v9ses->cache = CACHE_FSCACHE;
-                        else
-                                v9ses->cache = CACHE_NONE;
+                        v9ses->cache = ret;
                         kfree(s);
                         break;
 
@@ -200,9 +219,15 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
                         } else {
                                 v9ses->flags |= V9FS_ACCESS_SINGLE;
                                 v9ses->uid = simple_strtoul(s, &e, 10);
-                                if (*e != '\0')
-                                        v9ses->uid = ~0;
+                                if (*e != '\0') {
+                                        ret = -EINVAL;
+                                        printk(KERN_INFO "9p: Unknown access "
+                                                        "argument %s.\n", s);
+                                        kfree(s);
+                                        goto free_and_return;
+                                }
                         }
+
                         kfree(s);
                         break;
 
@@ -487,8 +512,8 @@ static void v9fs_inode_init_once(void *foo)
         struct v9fs_inode *v9inode = (struct v9fs_inode *)foo;
 #ifdef CONFIG_9P_FSCACHE
         v9inode->fscache = NULL;
-        v9inode->fscache_key = NULL;
 #endif
+        memset(&v9inode->qid, 0, sizeof(v9inode->qid));
         inode_init_once(&v9inode->vfs_inode);
 }
 
diff --git a/fs/9p/v9fs.h b/fs/9p/v9fs.h
index e5ebedfc5ed..e78956cbd70 100644
--- a/fs/9p/v9fs.h
+++ b/fs/9p/v9fs.h
@@ -125,8 +125,8 @@ struct v9fs_inode {
 #ifdef CONFIG_9P_FSCACHE
         spinlock_t fscache_lock;
         struct fscache_cookie *fscache;
-        struct p9_qid *fscache_key;
 #endif
+        struct p9_qid qid;
         unsigned int cache_validity;
         struct p9_fid *writeback_fid;
         struct mutex v_mutex;
@@ -153,13 +153,13 @@ extern void v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd,
                         void *p);
 extern struct inode *v9fs_inode_from_fid(struct v9fs_session_info *v9ses,
                                          struct p9_fid *fid,
-                                         struct super_block *sb);
+                                         struct super_block *sb, int new);
 extern const struct inode_operations v9fs_dir_inode_operations_dotl;
 extern const struct inode_operations v9fs_file_inode_operations_dotl;
 extern const struct inode_operations v9fs_symlink_inode_operations_dotl;
 extern struct inode *v9fs_inode_from_fid_dotl(struct v9fs_session_info *v9ses,
                                               struct p9_fid *fid,
-                                              struct super_block *sb);
+                                              struct super_block *sb, int new);
 
 /* other default globals */
 #define V9FS_PORT       564
@@ -201,8 +201,27 @@ v9fs_get_inode_from_fid(struct v9fs_session_info *v9ses, struct p9_fid *fid,
                         struct super_block *sb)
 {
         if (v9fs_proto_dotl(v9ses))
-                return v9fs_inode_from_fid_dotl(v9ses, fid, sb);
+                return v9fs_inode_from_fid_dotl(v9ses, fid, sb, 0);
         else
-                return v9fs_inode_from_fid(v9ses, fid, sb);
+                return v9fs_inode_from_fid(v9ses, fid, sb, 0);
 }
+
+/**
+ * v9fs_get_new_inode_from_fid - Helper routine to populate an inode by
+ * issuing a attribute request
+ * @v9ses: session information
+ * @fid: fid to issue attribute request for
+ * @sb: superblock on which to create inode
+ *
+ */
+static inline struct inode *
+v9fs_get_new_inode_from_fid(struct v9fs_session_info *v9ses, struct p9_fid *fid,
+                            struct super_block *sb)
+{
+        if (v9fs_proto_dotl(v9ses))
+                return v9fs_inode_from_fid_dotl(v9ses, fid, sb, 1);
+        else
+                return v9fs_inode_from_fid(v9ses, fid, sb, 1);
+}
+
 #endif
diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
index 4014160903a..f9a28eab781 100644
--- a/fs/9p/v9fs_vfs.h
+++ b/fs/9p/v9fs_vfs.h
@@ -54,9 +54,9 @@ extern struct kmem_cache *v9fs_inode_cache;
 
 struct inode *v9fs_alloc_inode(struct super_block *sb);
 void v9fs_destroy_inode(struct inode *inode);
-struct inode *v9fs_get_inode(struct super_block *sb, int mode);
+struct inode *v9fs_get_inode(struct super_block *sb, int mode, dev_t);
 int v9fs_init_inode(struct v9fs_session_info *v9ses,
-                    struct inode *inode, int mode);
+                    struct inode *inode, int mode, dev_t);
 void v9fs_evict_inode(struct inode *inode);
 ino_t v9fs_qid2ino(struct p9_qid *qid);
 void v9fs_stat2inode(struct p9_wstat *, struct inode *, struct super_block *);
@@ -82,4 +82,6 @@ static inline void v9fs_invalidate_inode_attr(struct inode *inode)
         v9inode->cache_validity |= V9FS_INO_INVALID_ATTR;
         return;
 }
+
+int v9fs_open_to_dotl_flags(int flags);
 #endif
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index ffed55817f0..9d6e1685d92 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -65,7 +65,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
         v9inode = V9FS_I(inode);
         v9ses = v9fs_inode2v9ses(inode);
         if (v9fs_proto_dotl(v9ses))
-                omode = file->f_flags;
+                omode = v9fs_open_to_dotl_flags(file->f_flags);
         else
                 omode = v9fs_uflags2omode(file->f_flags,
                                         v9fs_proto_dotu(v9ses));
@@ -169,7 +169,18 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl)
 
         /* convert posix lock to p9 tlock args */
         memset(&flock, 0, sizeof(flock));
-        flock.type = fl->fl_type;
+        /* map the lock type */
+        switch (fl->fl_type) {
+        case F_RDLCK:
+                flock.type = P9_LOCK_TYPE_RDLCK;
+                break;
+        case F_WRLCK:
+                flock.type = P9_LOCK_TYPE_WRLCK;
+                break;
+        case F_UNLCK:
+                flock.type = P9_LOCK_TYPE_UNLCK;
+                break;
+        }
         flock.start = fl->fl_start;
         if (fl->fl_end == OFFSET_MAX)
                 flock.length = 0;
@@ -245,7 +256,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
 
         /* convert posix lock to p9 tgetlock args */
         memset(&glock, 0, sizeof(glock));
-        glock.type = fl->fl_type;
+        glock.type  = P9_LOCK_TYPE_UNLCK;
         glock.start = fl->fl_start;
         if (fl->fl_end == OFFSET_MAX)
                 glock.length = 0;
@@ -257,17 +268,26 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
         res = p9_client_getlock_dotl(fid, &glock);
         if (res < 0)
                 return res;
-        if (glock.type != F_UNLCK) {
-                fl->fl_type = glock.type;
+        /* map 9p lock type to os lock type */
+        switch (glock.type) {
+        case P9_LOCK_TYPE_RDLCK:
+                fl->fl_type = F_RDLCK;
+                break;
+        case P9_LOCK_TYPE_WRLCK:
+                fl->fl_type = F_WRLCK;
+                break;
+        case P9_LOCK_TYPE_UNLCK:
+                fl->fl_type = F_UNLCK;
+                break;
+        }
+        if (glock.type != P9_LOCK_TYPE_UNLCK) {
                 fl->fl_start = glock.start;
                 if (glock.length == 0)
                         fl->fl_end = OFFSET_MAX;
                 else
                         fl->fl_end = glock.start + glock.length - 1;
                 fl->fl_pid = glock.proc_id;
-        } else
-                fl->fl_type = F_UNLCK;
-
+        }
         return res;
 }
 
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 7f6c6770319..c72e20cdfb9 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -95,15 +95,18 @@ static int unixmode2p9mode(struct v9fs_session_info *v9ses, int mode)
 /**
  * p9mode2unixmode- convert plan9 mode bits to unix mode bits
  * @v9ses: v9fs session information
- * @mode: mode to convert
+ * @stat: p9_wstat from which mode need to be derived
+ * @rdev: major number, minor number in case of device files.
  *
  */
-
-static int p9mode2unixmode(struct v9fs_session_info *v9ses, int mode)
+static int p9mode2unixmode(struct v9fs_session_info *v9ses,
+                           struct p9_wstat *stat, dev_t *rdev)
 {
         int res;
+        int mode = stat->mode;
 
-        res = mode & 0777;
+        res = mode & S_IALLUGO;
+        *rdev = 0;
 
         if ((mode & P9_DMDIR) == P9_DMDIR)
                 res |= S_IFDIR;
@@ -116,9 +119,26 @@ static int p9mode2unixmode(struct v9fs_session_info *v9ses, int mode)
                  && (v9ses->nodev == 0))
                 res |= S_IFIFO;
         else if ((mode & P9_DMDEVICE) && (v9fs_proto_dotu(v9ses))
-                 && (v9ses->nodev == 0))
-                res |= S_IFBLK;
-        else
+                 && (v9ses->nodev == 0)) {
+                char type = 0, ext[32];
+                int major = -1, minor = -1;
+
+                strncpy(ext, stat->extension, sizeof(ext));
+                sscanf(ext, "%c %u %u", &type, &major, &minor);
+                switch (type) {
+                case 'c':
+                        res |= S_IFCHR;
+                        break;
+                case 'b':
+                        res |= S_IFBLK;
+                        break;
+                default:
+                        P9_DPRINTK(P9_DEBUG_ERROR,
+                                "Unknown special type %c %s\n", type,
+                                stat->extension);
+                };
+                *rdev = MKDEV(major, minor);
+        } else
                 res |= S_IFREG;
 
         if (v9fs_proto_dotu(v9ses)) {
@@ -131,7 +151,6 @@ static int p9mode2unixmode(struct v9fs_session_info *v9ses, int mode)
                 if ((mode & P9_DMSETVTX) == P9_DMSETVTX)
                         res |= S_ISVTX;
         }
-
         return res;
 }
 
@@ -216,7 +235,6 @@ struct inode *v9fs_alloc_inode(struct super_block *sb)
                 return NULL;
 #ifdef CONFIG_9P_FSCACHE
         v9inode->fscache = NULL;
-        v9inode->fscache_key = NULL;
         spin_lock_init(&v9inode->fscache_lock);
 #endif
         v9inode->writeback_fid = NULL;
@@ -243,13 +261,13 @@ void v9fs_destroy_inode(struct inode *inode)
 }
 
 int v9fs_init_inode(struct v9fs_session_info *v9ses,
-                    struct inode *inode, int mode)
+                    struct inode *inode, int mode, dev_t rdev)
 {
         int err = 0;
 
         inode_init_owner(inode, NULL, mode);
         inode->i_blocks = 0;
-        inode->i_rdev = 0;
+        inode->i_rdev = rdev;
         inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
         inode->i_mapping->a_ops = &v9fs_addr_operations;
 
@@ -336,7 +354,7 @@ error:
  *
  */
 
-struct inode *v9fs_get_inode(struct super_block *sb, int mode)
+struct inode *v9fs_get_inode(struct super_block *sb, int mode, dev_t rdev)
 {
         int err;
         struct inode *inode;
@@ -349,7 +367,7 @@ struct inode *v9fs_get_inode(struct super_block *sb, int mode)
                 P9_EPRINTK(KERN_WARNING, "Problem allocating inode\n");
                 return ERR_PTR(-ENOMEM);
         }
-        err = v9fs_init_inode(v9ses, inode, mode);
+        err = v9fs_init_inode(v9ses, inode, mode, rdev);
         if (err) {
                 iput(inode);
                 return ERR_PTR(err);
@@ -433,17 +451,62 @@ void v9fs_evict_inode(struct inode *inode)
         }
 }
 
+static int v9fs_test_inode(struct inode *inode, void *data)
+{
+        int umode;
+        dev_t rdev;
+        struct v9fs_inode *v9inode = V9FS_I(inode);
+        struct p9_wstat *st = (struct p9_wstat *)data;
+        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(inode);
+
+        umode = p9mode2unixmode(v9ses, st, &rdev);
+        /* don't match inode of different type */
+        if ((inode->i_mode & S_IFMT) != (umode & S_IFMT))
+                return 0;
+
+        /* compare qid details */
+        if (memcmp(&v9inode->qid.version,
+                   &st->qid.version, sizeof(v9inode->qid.version)))
+                return 0;
+
+        if (v9inode->qid.type != st->qid.type)
+                return 0;
+        return 1;
+}
+
+static int v9fs_test_new_inode(struct inode *inode, void *data)
+{
+        return 0;
+}
+
+static int v9fs_set_inode(struct inode *inode,  void *data)
+{
+        struct v9fs_inode *v9inode = V9FS_I(inode);
+        struct p9_wstat *st = (struct p9_wstat *)data;
+
+        memcpy(&v9inode->qid, &st->qid, sizeof(st->qid));
+        return 0;
+}
+
 static struct inode *v9fs_qid_iget(struct super_block *sb,
                                    struct p9_qid *qid,
-                                   struct p9_wstat *st)
+                                   struct p9_wstat *st,
+                                   int new)
 {
+        dev_t rdev;
         int retval, umode;
         unsigned long i_ino;
         struct inode *inode;
         struct v9fs_session_info *v9ses = sb->s_fs_info;
+        int (*test)(struct inode *, void *);
+
+        if (new)
+                test = v9fs_test_new_inode;
+        else
+                test = v9fs_test_inode;
 
         i_ino = v9fs_qid2ino(qid);
-        inode = iget_locked(sb, i_ino);
+        inode = iget5_locked(sb, i_ino, test, v9fs_set_inode, st);
         if (!inode)
                 return ERR_PTR(-ENOMEM);
         if (!(inode->i_state & I_NEW))
@@ -453,14 +516,14 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
          * FIXME!! we may need support for stale inodes
          * later.
          */
-        umode = p9mode2unixmode(v9ses, st->mode);
-        retval = v9fs_init_inode(v9ses, inode, umode);
+        inode->i_ino = i_ino;
+        umode = p9mode2unixmode(v9ses, st, &rdev);
+        retval = v9fs_init_inode(v9ses, inode, umode, rdev);
         if (retval)
                 goto error;
 
         v9fs_stat2inode(st, inode, sb);
 #ifdef CONFIG_9P_FSCACHE
-        v9fs_fscache_set_key(inode, &st->qid);
         v9fs_cache_inode_get_cookie(inode);
 #endif
         unlock_new_inode(inode);
@@ -474,7 +537,7 @@ error:
 
 struct inode *
 v9fs_inode_from_fid(struct v9fs_session_info *v9ses, struct p9_fid *fid,
-                    struct super_block *sb)
+                    struct super_block *sb, int new)
 {
         struct p9_wstat *st;
         struct inode *inode = NULL;
@@ -483,7 +546,7 @@ v9fs_inode_from_fid(struct v9fs_session_info *v9ses, struct p9_fid *fid,
         if (IS_ERR(st))
                 return ERR_CAST(st);
 
-        inode = v9fs_qid_iget(sb, &st->qid, st);
+        inode = v9fs_qid_iget(sb, &st->qid, st, new);
         p9stat_free(st);
         kfree(st);
         return inode;
@@ -585,19 +648,17 @@ v9fs_create(struct v9fs_session_info *v9ses, struct inode *dir,
         }
 
         /* instantiate inode and assign the unopened fid to the dentry */
-        inode = v9fs_get_inode_from_fid(v9ses, fid, dir->i_sb);
+        inode = v9fs_get_new_inode_from_fid(v9ses, fid, dir->i_sb);
         if (IS_ERR(inode)) {
                 err = PTR_ERR(inode);
                 P9_DPRINTK(P9_DEBUG_VFS, "inode creation failed %d\n", err);
                 goto error;
         }
-        d_instantiate(dentry, inode);
         err = v9fs_fid_add(dentry, fid);
         if (err < 0)
                 goto error;
-
+        d_instantiate(dentry, inode);
         return ofid;
-
 error:
         if (ofid)
                 p9_client_clunk(ofid);
@@ -738,6 +799,7 @@ static int v9fs_vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
                                       struct nameidata *nameidata)
 {
+        struct dentry *res;
         struct super_block *sb;
         struct v9fs_session_info *v9ses;
         struct p9_fid *dfid, *fid;
@@ -769,22 +831,35 @@ struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
 
                 return ERR_PTR(result);
         }
-
-        inode = v9fs_get_inode_from_fid(v9ses, fid, dir->i_sb);
+        /*
+         * Make sure we don't use a wrong inode due to parallel
+         * unlink. For cached mode create calls request for new
+         * inode. But with cache disabled, lookup should do this.
+         */
+        if (v9ses->cache)
+                inode = v9fs_get_inode_from_fid(v9ses, fid, dir->i_sb);
+        else
+                inode = v9fs_get_new_inode_from_fid(v9ses, fid, dir->i_sb);
         if (IS_ERR(inode)) {
                 result = PTR_ERR(inode);
                 inode = NULL;
                 goto error;
         }
-
         result = v9fs_fid_add(dentry, fid);
         if (result < 0)
                 goto error_iput;
-
 inst_out:
-        d_add(dentry, inode);
-        return NULL;
-
+        /*
+         * If we had a rename on the server and a parallel lookup
+         * for the new name, then make sure we instantiate with
+         * the new name. ie look up for a/b, while on server somebody
+         * moved b under k and client parallely did a lookup for
+         * k/b.
+         */
+        res = d_materialise_unique(dentry, inode);
+        if (!IS_ERR(res))
+                return res;
+        result = PTR_ERR(res);
 error_iput:
         iput(inode);
 error:
@@ -950,7 +1025,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
                 return PTR_ERR(st);
 
         v9fs_stat2inode(st, dentry->d_inode, dentry->d_inode->i_sb);
-                generic_fillattr(dentry->d_inode, stat);
+        generic_fillattr(dentry->d_inode, stat);
 
         p9stat_free(st);
         kfree(st);
@@ -1034,6 +1109,7 @@ void
 v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
         struct super_block *sb)
 {
+        mode_t mode;
         char ext[32];
         char tag_name[14];
         unsigned int i_nlink;
@@ -1069,31 +1145,9 @@ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
                                 inode->i_nlink = i_nlink;
                 }
         }
-        inode->i_mode = p9mode2unixmode(v9ses, stat->mode);
-        if ((S_ISBLK(inode->i_mode)) || (S_ISCHR(inode->i_mode))) {
-                char type = 0;
-                int major = -1;
-                int minor = -1;
-
-                strncpy(ext, stat->extension, sizeof(ext));
-                sscanf(ext, "%c %u %u", &type, &major, &minor);
-                switch (type) {
-                case 'c':
-                        inode->i_mode &= ~S_IFBLK;
-                        inode->i_mode |= S_IFCHR;
-                        break;
-                case 'b':
-                        break;
-                default:
-                        P9_DPRINTK(P9_DEBUG_ERROR,
-                                "Unknown special type %c %s\n", type,
-                                stat->extension);
-                };
-                inode->i_rdev = MKDEV(major, minor);
-                init_special_inode(inode, inode->i_mode, inode->i_rdev);
-        } else
-                inode->i_rdev = 0;
-
+        mode = stat->mode & S_IALLUGO;
+        mode |= inode->i_mode & ~S_IALLUGO;
+        inode->i_mode = mode;
         i_size_write(inode, stat->length);
 
         /* not real number of blocks, but 512 byte ones ... */
@@ -1359,6 +1413,8 @@ v9fs_vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t rdev)
 
 int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
 {
+        int umode;
+        dev_t rdev;
         loff_t i_size;
         struct p9_wstat *st;
         struct v9fs_session_info *v9ses;
@@ -1367,6 +1423,12 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
         st = p9_client_stat(fid);
         if (IS_ERR(st))
                 return PTR_ERR(st);
+        /*
+         * Don't update inode if the file type is different
+         */
+        umode = p9mode2unixmode(v9ses, st, &rdev);
+        if ((inode->i_mode & S_IFMT) != (umode & S_IFMT))
+                goto out;
 
         spin_lock(&inode->i_lock);
         /*
@@ -1378,6 +1440,7 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
         if (v9ses->cache)
                 inode->i_size = i_size;
         spin_unlock(&inode->i_lock);
+out:
         p9stat_free(st);
         kfree(st);
         return 0;
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index 691c78f58be..c873172ab37 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -86,18 +86,63 @@ static struct dentry *v9fs_dentry_from_dir_inode(struct inode *inode)
         return dentry;
 }
 
+static int v9fs_test_inode_dotl(struct inode *inode, void *data)
+{
+        struct v9fs_inode *v9inode = V9FS_I(inode);
+        struct p9_stat_dotl *st = (struct p9_stat_dotl *)data;
+
+        /* don't match inode of different type */
+        if ((inode->i_mode & S_IFMT) != (st->st_mode & S_IFMT))
+                return 0;
+
+        if (inode->i_generation != st->st_gen)
+                return 0;
+
+        /* compare qid details */
+        if (memcmp(&v9inode->qid.version,
+                   &st->qid.version, sizeof(v9inode->qid.version)))
+                return 0;
+
+        if (v9inode->qid.type != st->qid.type)
+                return 0;
+        return 1;
+}
+
+/* Always get a new inode */
+static int v9fs_test_new_inode_dotl(struct inode *inode, void *data)
+{
+        return 0;
+}
+
+static int v9fs_set_inode_dotl(struct inode *inode,  void *data)
+{
+        struct v9fs_inode *v9inode = V9FS_I(inode);
+        struct p9_stat_dotl *st = (struct p9_stat_dotl *)data;
+
+        memcpy(&v9inode->qid, &st->qid, sizeof(st->qid));
+        inode->i_generation = st->st_gen;
+        return 0;
+}
+
 static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
                                         struct p9_qid *qid,
                                         struct p9_fid *fid,
-                                        struct p9_stat_dotl *st)
+                                        struct p9_stat_dotl *st,
+                                        int new)
 {
         int retval;
         unsigned long i_ino;
         struct inode *inode;
         struct v9fs_session_info *v9ses = sb->s_fs_info;
+        int (*test)(struct inode *, void *);
+
+        if (new)
+                test = v9fs_test_new_inode_dotl;
+        else
+                test = v9fs_test_inode_dotl;
 
         i_ino = v9fs_qid2ino(qid);
-        inode = iget_locked(sb, i_ino);
+        inode = iget5_locked(sb, i_ino, test, v9fs_set_inode_dotl, st);
         if (!inode)
                 return ERR_PTR(-ENOMEM);
         if (!(inode->i_state & I_NEW))
@@ -107,13 +152,14 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
          * FIXME!! we may need support for stale inodes
          * later.
          */
-        retval = v9fs_init_inode(v9ses, inode, st->st_mode);
+        inode->i_ino = i_ino;
+        retval = v9fs_init_inode(v9ses, inode,
+                                 st->st_mode, new_decode_dev(st->st_rdev));
         if (retval)
                 goto error;
 
         v9fs_stat2inode_dotl(st, inode);
 #ifdef CONFIG_9P_FSCACHE
-        v9fs_fscache_set_key(inode, &st->qid);
         v9fs_cache_inode_get_cookie(inode);
 #endif
         retval = v9fs_get_acl(inode, fid);
@@ -131,20 +177,72 @@ error:
 
 struct inode *
 v9fs_inode_from_fid_dotl(struct v9fs_session_info *v9ses, struct p9_fid *fid,
-                         struct super_block *sb)
+                         struct super_block *sb, int new)
 {
         struct p9_stat_dotl *st;
         struct inode *inode = NULL;
 
-        st = p9_client_getattr_dotl(fid, P9_STATS_BASIC);
+        st = p9_client_getattr_dotl(fid, P9_STATS_BASIC | P9_STATS_GEN);
         if (IS_ERR(st))
                 return ERR_CAST(st);
 
-        inode = v9fs_qid_iget_dotl(sb, &st->qid, fid, st);
+        inode = v9fs_qid_iget_dotl(sb, &st->qid, fid, st, new);
         kfree(st);
         return inode;
 }
 
+struct dotl_openflag_map {
+        int open_flag;
+        int dotl_flag;
+};
+
+static int v9fs_mapped_dotl_flags(int flags)
+{
+        int i;
+        int rflags = 0;
+        struct dotl_openflag_map dotl_oflag_map[] = {
+                { O_CREAT,      P9_DOTL_CREATE },
+                { O_EXCL,       P9_DOTL_EXCL },
+                { O_NOCTTY,     P9_DOTL_NOCTTY },
+                { O_TRUNC,      P9_DOTL_TRUNC },
+                { O_APPEND,     P9_DOTL_APPEND },
+                { O_NONBLOCK,   P9_DOTL_NONBLOCK },
+                { O_DSYNC,      P9_DOTL_DSYNC },
+                { FASYNC,       P9_DOTL_FASYNC },
+                { O_DIRECT,     P9_DOTL_DIRECT },
+                { O_LARGEFILE,  P9_DOTL_LARGEFILE },
+                { O_DIRECTORY,  P9_DOTL_DIRECTORY },
+                { O_NOFOLLOW,   P9_DOTL_NOFOLLOW },
+                { O_NOATIME,    P9_DOTL_NOATIME },
+                { O_CLOEXEC,    P9_DOTL_CLOEXEC },
+                { O_SYNC,       P9_DOTL_SYNC},
+        };
+        for (i = 0; i < ARRAY_SIZE(dotl_oflag_map); i++) {
+                if (flags & dotl_oflag_map[i].open_flag)
+                        rflags |= dotl_oflag_map[i].dotl_flag;
+        }
+        return rflags;
+}
+
+/**
+ * v9fs_open_to_dotl_flags- convert Linux specific open flags to
+ * plan 9 open flag.
+ * @flags: flags to convert
+ */
+int v9fs_open_to_dotl_flags(int flags)
+{
+        int rflags = 0;
+
+        /*
+         * We have same bits for P9_DOTL_READONLY, P9_DOTL_WRONLY
+         * and P9_DOTL_NOACCESS
+         */
+        rflags |= flags & O_ACCMODE;
+        rflags |= v9fs_mapped_dotl_flags(flags);
+
+        return rflags;
+}
+
 /**
  * v9fs_vfs_create_dotl - VFS hook to create files for 9P2000.L protocol.
  * @dir: directory inode that is being created
@@ -213,7 +311,8 @@ v9fs_vfs_create_dotl(struct inode *dir, struct dentry *dentry, int omode,
                            "Failed to get acl values in creat %d\n", err);
                 goto error;
         }
-        err = p9_client_create_dotl(ofid, name, flags, mode, gid, &qid);
+        err = p9_client_create_dotl(ofid, name, v9fs_open_to_dotl_flags(flags),
+                                    mode, gid, &qid);
         if (err < 0) {
                 P9_DPRINTK(P9_DEBUG_VFS,
                                 "p9_client_open_dotl failed in creat %d\n",
@@ -230,19 +329,19 @@ v9fs_vfs_create_dotl(struct inode *dir, struct dentry *dentry, int omode,
                 fid = NULL;
                 goto error;
         }
-        inode = v9fs_get_inode_from_fid(v9ses, fid, dir->i_sb);
+        inode = v9fs_get_new_inode_from_fid(v9ses, fid, dir->i_sb);
         if (IS_ERR(inode)) {
                 err = PTR_ERR(inode);
                 P9_DPRINTK(P9_DEBUG_VFS, "inode creation failed %d\n", err);
                 goto error;
         }
-        d_instantiate(dentry, inode);
         err = v9fs_fid_add(dentry, fid);
         if (err < 0)
                 goto error;
+        d_instantiate(dentry, inode);
 
         /* Now set the ACL based on the default value */
-        v9fs_set_create_acl(dentry, dacl, pacl);
+        v9fs_set_create_acl(dentry, &dacl, &pacl);
 
         v9inode = V9FS_I(inode);
         mutex_lock(&v9inode->v_mutex);
@@ -283,6 +382,7 @@ error:
 err_clunk_old_fid:
         if (ofid)
                 p9_client_clunk(ofid);
+        v9fs_set_create_acl(NULL, &dacl, &pacl);
         return err;
 }
 
@@ -350,17 +450,17 @@ static int v9fs_vfs_mkdir_dotl(struct inode *dir,
                         goto error;
                 }
 
-                inode = v9fs_get_inode_from_fid(v9ses, fid, dir->i_sb);
+                inode = v9fs_get_new_inode_from_fid(v9ses, fid, dir->i_sb);
                 if (IS_ERR(inode)) {
                         err = PTR_ERR(inode);
                         P9_DPRINTK(P9_DEBUG_VFS, "inode creation failed %d\n",
                                 err);
                         goto error;
                 }
-                d_instantiate(dentry, inode);
                 err = v9fs_fid_add(dentry, fid);
                 if (err < 0)
                         goto error;
+                d_instantiate(dentry, inode);
                 fid = NULL;
         } else {
                 /*
@@ -368,7 +468,7 @@ static int v9fs_vfs_mkdir_dotl(struct inode *dir,
                  * inode with stat. We need to get an inode
                  * so that we can set the acl with dentry
                  */
-                inode = v9fs_get_inode(dir->i_sb, mode);
+                inode = v9fs_get_inode(dir->i_sb, mode, 0);
                 if (IS_ERR(inode)) {
                         err = PTR_ERR(inode);
                         goto error;
@@ -376,12 +476,13 @@ static int v9fs_vfs_mkdir_dotl(struct inode *dir,
                 d_instantiate(dentry, inode);
         }
         /* Now set the ACL based on the default value */
-        v9fs_set_create_acl(dentry, dacl, pacl);
+        v9fs_set_create_acl(dentry, &dacl, &pacl);
         inc_nlink(dir);
         v9fs_invalidate_inode_attr(dir);
 error:
         if (fid)
                 p9_client_clunk(fid);
+        v9fs_set_create_acl(NULL, &dacl, &pacl);
         return err;
 }
 
@@ -493,6 +594,7 @@ int v9fs_vfs_setattr_dotl(struct dentry *dentry, struct iattr *iattr)
 void
 v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
 {
+        mode_t mode;
         struct v9fs_inode *v9inode = V9FS_I(inode);
 
         if ((stat->st_result_mask & P9_STATS_BASIC) == P9_STATS_BASIC) {
@@ -505,11 +607,10 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
                 inode->i_uid = stat->st_uid;
                 inode->i_gid = stat->st_gid;
                 inode->i_nlink = stat->st_nlink;
-                inode->i_mode = stat->st_mode;
-                inode->i_rdev = new_decode_dev(stat->st_rdev);
 
-                if ((S_ISBLK(inode->i_mode)) || (S_ISCHR(inode->i_mode)))
-                        init_special_inode(inode, inode->i_mode, inode->i_rdev);
+                mode = stat->st_mode & S_IALLUGO;
+                mode |= inode->i_mode & ~S_IALLUGO;
+                inode->i_mode = mode;
 
                 i_size_write(inode, stat->st_size);
                 inode->i_blocks = stat->st_blocks;
@@ -547,7 +648,7 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
                         inode->i_blocks = stat->st_blocks;
         }
         if (stat->st_result_mask & P9_STATS_GEN)
-                        inode->i_generation = stat->st_gen;
+                inode->i_generation = stat->st_gen;
 
         /* Currently we don't support P9_STATS_BTIME and P9_STATS_DATA_VERSION
          * because the inode structure does not have fields for them.
@@ -603,21 +704,21 @@ v9fs_vfs_symlink_dotl(struct inode *dir, struct dentry *dentry,
                 }
 
                 /* instantiate inode and assign the unopened fid to dentry */
-                inode = v9fs_get_inode_from_fid(v9ses, fid, dir->i_sb);
+                inode = v9fs_get_new_inode_from_fid(v9ses, fid, dir->i_sb);
                 if (IS_ERR(inode)) {
                         err = PTR_ERR(inode);
                         P9_DPRINTK(P9_DEBUG_VFS, "inode creation failed %d\n",
                                         err);
                         goto error;
                 }
-                d_instantiate(dentry, inode);
                 err = v9fs_fid_add(dentry, fid);
                 if (err < 0)
                         goto error;
+                d_instantiate(dentry, inode);
                 fid = NULL;
         } else {
                 /* Not in cached mode. No need to populate inode with stat */
-                inode = v9fs_get_inode(dir->i_sb, S_IFLNK);
+                inode = v9fs_get_inode(dir->i_sb, S_IFLNK, 0);
                 if (IS_ERR(inode)) {
                         err = PTR_ERR(inode);
                         goto error;
@@ -756,24 +857,24 @@ v9fs_vfs_mknod_dotl(struct inode *dir, struct dentry *dentry, int omode,
                         goto error;
                 }
 
-                inode = v9fs_get_inode_from_fid(v9ses, fid, dir->i_sb);
+                inode = v9fs_get_new_inode_from_fid(v9ses, fid, dir->i_sb);
                 if (IS_ERR(inode)) {
                         err = PTR_ERR(inode);
                         P9_DPRINTK(P9_DEBUG_VFS, "inode creation failed %d\n",
                                 err);
                         goto error;
                 }
-                d_instantiate(dentry, inode);
                 err = v9fs_fid_add(dentry, fid);
                 if (err < 0)
                         goto error;
+                d_instantiate(dentry, inode);
                 fid = NULL;
         } else {
                 /*
                  * Not in cached mode. No need to populate inode with stat.
                  * socket syscall returns a fd, so we need instantiate
                  */
-                inode = v9fs_get_inode(dir->i_sb, mode);
+                inode = v9fs_get_inode(dir->i_sb, mode, rdev);
                 if (IS_ERR(inode)) {
                         err = PTR_ERR(inode);
                         goto error;
@@ -781,10 +882,11 @@ v9fs_vfs_mknod_dotl(struct inode *dir, struct dentry *dentry, int omode,
                 d_instantiate(dentry, inode);
         }
         /* Now set the ACL based on the default value */
-        v9fs_set_create_acl(dentry, dacl, pacl);
+        v9fs_set_create_acl(dentry, &dacl, &pacl);
 error:
         if (fid)
                 p9_client_clunk(fid);
+        v9fs_set_create_acl(NULL, &dacl, &pacl);
         return err;
 }
 
@@ -838,6 +940,11 @@ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode)
         st = p9_client_getattr_dotl(fid, P9_STATS_ALL);
         if (IS_ERR(st))
                 return PTR_ERR(st);
+        /*
+         * Don't update inode if the file type is different
+         */
+        if ((inode->i_mode & S_IFMT) != (st->st_mode & S_IFMT))
+                goto out;
 
         spin_lock(&inode->i_lock);
         /*
@@ -849,6 +956,7 @@ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode)
         if (v9ses->cache)
                 inode->i_size = i_size;
         spin_unlock(&inode->i_lock);
+out:
         kfree(st);
         return 0;
 }
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index feef6cdc1fd..c70251d47ed 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -149,7 +149,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
         else
                 sb->s_d_op = &v9fs_dentry_operations;
 
-        inode = v9fs_get_inode(sb, S_IFDIR | mode);
+        inode = v9fs_get_inode(sb, S_IFDIR | mode, 0);
         if (IS_ERR(inode)) {
                 retval = PTR_ERR(inode);
                 goto release_sb;
diff --git a/fs/Kconfig b/fs/Kconfig
index 19891aab9c6..88701cc00e0 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -192,6 +192,10 @@ source "fs/hfsplus/Kconfig"
 source "fs/befs/Kconfig"
 source "fs/bfs/Kconfig"
 source "fs/efs/Kconfig"
+
+# Patched by YAFFS
+source "fs/yaffs2/Kconfig"
+
 source "fs/jffs2/Kconfig"
 # UBIFS File system configuration
 source "fs/ubifs/Kconfig"
diff --git a/fs/Makefile b/fs/Makefile
index fb68c2b8cf8..2999b4d4b26 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -124,3 +124,6 @@ obj-$(CONFIG_GFS2_FS)           += gfs2/
 obj-$(CONFIG_EXOFS_FS)          += exofs/
 obj-$(CONFIG_CEPH_FS)           += ceph/
 obj-$(CONFIG_PSTORE)            += pstore/
+
+# Patched by YAFFS
+obj-$(CONFIG_YAFFS_FS)          += yaffs2/
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 5a9b6843bac..1f3624d3b24 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -109,7 +109,7 @@ struct afs_call {
         unsigned                reply_size;     /* current size of reply */
         unsigned                first_offset;   /* offset into mapping[first] */
         unsigned                last_to;        /* amount of mapping[last] */
-        unsigned short          offset;         /* offset into received data store */
+        unsigned                offset;         /* offset into received data store */
         unsigned char           unmarshall;     /* unmarshalling phase */
         bool                    incoming;       /* T if incoming call */
         bool                    send_pages;     /* T if data from mapping should be sent */
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index e45a323aebb..8ad8c2a0703 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -314,6 +314,7 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
         struct msghdr msg;
         struct kvec iov[1];
         int ret;
+        struct sk_buff *skb;
 
         _enter("%x,{%d},", addr->s_addr, ntohs(call->port));
 
@@ -380,6 +381,8 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
 
 error_do_abort:
         rxrpc_kernel_abort_call(rxcall, RX_USER_ABORT);
+        while ((skb = skb_dequeue(&call->rx_queue)))
+                afs_free_skb(skb);
         rxrpc_kernel_end_call(rxcall);
         call->rxcall = NULL;
 error_kill_call:
diff --git a/fs/aio.c b/fs/aio.c
index e29ec485af2..99bb74461b0 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -228,12 +228,6 @@ static void __put_ioctx(struct kioctx *ctx)
         call_rcu(&ctx->rcu_head, ctx_rcu_free);
 }
 
-static inline void get_ioctx(struct kioctx *kioctx)
-{
-        BUG_ON(atomic_read(&kioctx->users) <= 0);
-        atomic_inc(&kioctx->users);
-}
-
 static inline int try_get_ioctx(struct kioctx *kioctx)
 {
         return atomic_inc_not_zero(&kioctx->users);
@@ -273,7 +267,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
         mm = ctx->mm = current->mm;
         atomic_inc(&mm->mm_count);
 
-        atomic_set(&ctx->users, 1);
+        atomic_set(&ctx->users, 2);
         spin_lock_init(&ctx->ctx_lock);
         spin_lock_init(&ctx->ring_info.ring_lock);
         init_waitqueue_head(&ctx->wait);
@@ -527,11 +521,16 @@ static void aio_fput_routine(struct work_struct *data)
                         fput(req->ki_filp);
 
                 /* Link the iocb into the context's free list */
+                rcu_read_lock();
                 spin_lock_irq(&ctx->ctx_lock);
                 really_put_req(ctx, req);
+                /*
+                 * at that point ctx might've been killed, but actual
+                 * freeing is RCU'd
+                 */
                 spin_unlock_irq(&ctx->ctx_lock);
+                rcu_read_unlock();
 
-                put_ioctx(ctx);
                 spin_lock_irq(&fput_lock);
         }
         spin_unlock_irq(&fput_lock);
@@ -562,7 +561,6 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
          * this function will be executed w/out any aio kthread wakeup.
          */
         if (unlikely(!fput_atomic(req->ki_filp))) {
-                get_ioctx(ctx);
                 spin_lock(&fput_lock);
                 list_add(&req->ki_list, &fput_head);
                 spin_unlock(&fput_lock);
@@ -1256,10 +1254,10 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
         ret = PTR_ERR(ioctx);
         if (!IS_ERR(ioctx)) {
                 ret = put_user(ioctx->user_id, ctxp);
-                if (!ret)
+                if (!ret) {
+                        put_ioctx(ioctx);
                         return 0;
-
-                get_ioctx(ioctx); /* io_destroy() expects us to hold a ref */
+                }
                 io_destroy(ioctx);
         }
 
@@ -1397,6 +1395,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
         if (ret < 0)
                 goto out;
 
+        ret = rw_verify_area(type, kiocb->ki_filp, &kiocb->ki_pos, ret);
+        if (ret < 0)
+                goto out;
+
         kiocb->ki_nr_segs = kiocb->ki_nbytes;
         kiocb->ki_cur_seg = 0;
         /* ki_nbytes/left now reflect bytes instead of segs */
@@ -1408,11 +1410,17 @@ out:
         return ret;
 }
 
-static ssize_t aio_setup_single_vector(struct kiocb *kiocb)
+static ssize_t aio_setup_single_vector(int type, struct file * file, struct kiocb *kiocb)
 {
+        int bytes;
+
+        bytes = rw_verify_area(type, file, &kiocb->ki_pos, kiocb->ki_left);
+        if (bytes < 0)
+                return bytes;
+
         kiocb->ki_iovec = &kiocb->ki_inline_vec;
         kiocb->ki_iovec->iov_base = kiocb->ki_buf;
-        kiocb->ki_iovec->iov_len = kiocb->ki_left;
+        kiocb->ki_iovec->iov_len = bytes;
         kiocb->ki_nr_segs = 1;
         kiocb->ki_cur_seg = 0;
         return 0;
@@ -1437,10 +1445,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 if (unlikely(!access_ok(VERIFY_WRITE, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
-                ret = security_file_permission(file, MAY_READ);
-                if (unlikely(ret))
-                        break;
-                ret = aio_setup_single_vector(kiocb);
+                ret = aio_setup_single_vector(READ, file, kiocb);
                 if (ret)
                         break;
                 ret = -EINVAL;
@@ -1455,10 +1460,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 if (unlikely(!access_ok(VERIFY_READ, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
-                ret = security_file_permission(file, MAY_WRITE);
-                if (unlikely(ret))
-                        break;
-                ret = aio_setup_single_vector(kiocb);
+                ret = aio_setup_single_vector(WRITE, file, kiocb);
                 if (ret)
                         break;
                 ret = -EINVAL;
@@ -1469,9 +1471,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 ret = -EBADF;
                 if (unlikely(!(file->f_mode & FMODE_READ)))
                         break;
-                ret = security_file_permission(file, MAY_READ);
-                if (unlikely(ret))
-                        break;
                 ret = aio_setup_vectored_rw(READ, kiocb, compat);
                 if (ret)
                         break;
@@ -1483,9 +1482,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 ret = -EBADF;
                 if (unlikely(!(file->f_mode & FMODE_WRITE)))
                         break;
-                ret = security_file_permission(file, MAY_WRITE);
-                if (unlikely(ret))
-                        break;
                 ret = aio_setup_vectored_rw(WRITE, kiocb, compat);
                 if (ret)
                         break;
@@ -1622,7 +1618,6 @@ long do_io_submit(aio_context_t ctx_id, long nr,
         struct kioctx *ctx;
         long ret = 0;
         int i;
-        struct blk_plug plug;
 
         if (unlikely(nr < 0))
                 return -EINVAL;
@@ -1639,8 +1634,6 @@ long do_io_submit(aio_context_t ctx_id, long nr,
                 return -EINVAL;
         }
 
-        blk_start_plug(&plug);
-
         /*
          * AKPM: should this return a partial result if some of the IOs were
          * successfully submitted?
@@ -1663,7 +1656,6 @@ long do_io_submit(aio_context_t ctx_id, long nr,
                 if (ret)
                         break;
         }
-        blk_finish_plug(&plug);
 
         put_ioctx(ctx);
         return i ? i : ret;
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index 475f9c597cb..756d3286bee 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -278,6 +278,17 @@ int autofs4_fill_super(struct super_block *, void *, int);
 struct autofs_info *autofs4_new_ino(struct autofs_sb_info *);
 void autofs4_clean_ino(struct autofs_info *);
 
+static inline int autofs_prepare_pipe(struct file *pipe)
+{
+        if (!pipe->f_op || !pipe->f_op->write)
+                return -EINVAL;
+        if (!S_ISFIFO(pipe->f_dentry->d_inode->i_mode))
+                return -EINVAL;
+        /* We want a packet pipe */
+        pipe->f_flags |= O_DIRECT;
+        return 0;
+}
+
 /* Queue management functions */
 
 int autofs4_wait(struct autofs_sb_info *,struct dentry *, enum autofs_notify);
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 509fe1eb66a..de542716245 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -376,7 +376,7 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
                         err = -EBADF;
                         goto out;
                 }
-                if (!pipe->f_op || !pipe->f_op->write) {
+                if (autofs_prepare_pipe(pipe) < 0) {
                         err = -EPIPE;
                         fput(pipe);
                         goto out;
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index 180fa2425e4..7c26678e2ca 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -292,7 +292,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
                 printk("autofs: could not open pipe file descriptor\n");
                 goto fail_dput;
         }
-        if (!pipe->f_op || !pipe->f_op->write)
+        if (autofs_prepare_pipe(pipe) < 0)
                 goto fail_fput;
         sbi->pipe = pipe;
         sbi->pipefd = pipefd;
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 25435987d6a..813ea10fdde 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -90,7 +90,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
 
         return (bytes > 0);
 }
-        
+
 static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
                                  struct autofs_wait_queue *wq,
                                  int type)
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 54b8c28bebc..720d885e8dc 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -474,17 +474,22 @@ befs_follow_link(struct dentry *dentry, struct nameidata *nd)
                 befs_data_stream *data = &befs_ino->i_data.ds;
                 befs_off_t len = data->size;
 
-                befs_debug(sb, "Follow long symlink");
-
-                link = kmalloc(len, GFP_NOFS);
-                if (!link) {
-                        link = ERR_PTR(-ENOMEM);
-                } else if (befs_read_lsymlink(sb, data, link, len) != len) {
-                        kfree(link);
-                        befs_error(sb, "Failed to read entire long symlink");
+                if (len == 0) {
+                        befs_error(sb, "Long symlink with illegal length");
                         link = ERR_PTR(-EIO);
                 } else {
-                        link[len - 1] = '\0';
+                        befs_debug(sb, "Follow long symlink");
+
+                        link = kmalloc(len, GFP_NOFS);
+                        if (!link) {
+                                link = ERR_PTR(-ENOMEM);
+                        } else if (befs_read_lsymlink(sb, data, link, len) != len) {
+                                kfree(link);
+                                befs_error(sb, "Failed to read entire long symlink");
+                                link = ERR_PTR(-EIO);
+                        } else {
+                                link[len - 1] = '\0';
+                        }
                 }
         } else {
                 link = befs_ino->i_data.symlink;
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 303983fabfd..618493e44ae 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -796,7 +796,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                          * might try to exec.  This is because the brk will
                          * follow the loader, and is not movable.  */
 #if defined(CONFIG_X86) || defined(CONFIG_ARM)
-                        load_bias = 0;
+                        /* Memory randomization might have been switched off
+                         * in runtime via sysctl.
+                         * If that is the case, retain the original non-zero
+                         * load_bias value in order to establish proper
+                         * non-randomized mappings.
+                         */
+                        if (current->flags & PF_RANDOMIZE)
+                                load_bias = 0;
+                        else
+                                load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 #else
                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 #endif
@@ -1413,7 +1422,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
         for (i = 1; i < view->n; ++i) {
                 const struct user_regset *regset = &view->regsets[i];
                 do_thread_regset_writeback(t->task, regset);
-                if (regset->core_note_type &&
+                if (regset->core_note_type && regset->get &&
                     (!regset->active || regset->active(t->task, regset))) {
                         int ret;
                         size_t size = regset->n * regset->size;
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 610e8e0b04b..8d78633c00b 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -44,27 +44,31 @@ inline struct block_device *I_BDEV(struct inode *inode)
 {
         return &BDEV_I(inode)->bdev;
 }
-
 EXPORT_SYMBOL(I_BDEV);
 
 /*
- * move the inode from it's current bdi to the a new bdi. if the inode is dirty
- * we need to move it onto the dirty list of @dst so that the inode is always
- * on the right list.
+ * Move the inode from its current bdi to a new bdi. If the inode is dirty we
+ * need to move it onto the dirty list of @dst so that the inode is always on
+ * the right list.
  */
 static void bdev_inode_switch_bdi(struct inode *inode,
                         struct backing_dev_info *dst)
 {
-        spin_lock(&inode_wb_list_lock);
+        struct backing_dev_info *old = inode->i_data.backing_dev_info;
+
+        if (unlikely(dst == old))               /* deadlock avoidance */
+                return;
+        bdi_lock_two(&old->wb, &dst->wb);
         spin_lock(&inode->i_lock);
         inode->i_data.backing_dev_info = dst;
         if (inode->i_state & I_DIRTY)
                 list_move(&inode->i_wb_list, &dst->wb.b_dirty);
         spin_unlock(&inode->i_lock);
-        spin_unlock(&inode_wb_list_lock);
+        spin_unlock(&old->wb.list_lock);
+        spin_unlock(&dst->wb.list_lock);
 }
 
-static sector_t max_block(struct block_device *bdev)
+sector_t blkdev_max_block(struct block_device *bdev)
 {
         sector_t retval = ~((sector_t)0);
         loff_t sz = i_size_read(bdev->bd_inode);
@@ -135,7 +139,7 @@ static int
 blkdev_get_block(struct inode *inode, sector_t iblock,
                 struct buffer_head *bh, int create)
 {
-        if (iblock >= max_block(I_BDEV(inode))) {
+        if (iblock >= blkdev_max_block(I_BDEV(inode))) {
                 if (create)
                         return -EIO;
 
@@ -157,7 +161,7 @@ static int
 blkdev_get_blocks(struct inode *inode, sector_t iblock,
                 struct buffer_head *bh, int create)
 {
-        sector_t end_block = max_block(I_BDEV(inode));
+        sector_t end_block = blkdev_max_block(I_BDEV(inode));
         unsigned long max_blocks = bh->b_size >> inode->i_blkbits;
 
         if ((iblock + max_blocks) > end_block) {
@@ -1075,6 +1079,7 @@ static int __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part);
 static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
 {
         struct gendisk *disk;
+        struct module *owner;
         int ret;
         int partno;
         int perm = 0;
@@ -1100,6 +1105,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
         disk = get_gendisk(bdev->bd_dev, &partno);
         if (!disk)
                 goto out;
+        owner = disk->fops->owner;
 
         disk_block_events(disk);
         mutex_lock_nested(&bdev->bd_mutex, for_part);
@@ -1127,8 +1133,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                         bdev->bd_disk = NULL;
                                         mutex_unlock(&bdev->bd_mutex);
                                         disk_unblock_events(disk);
-                                        module_put(disk->fops->owner);
                                         put_disk(disk);
+                                        module_put(owner);
                                         goto restart;
                                 }
                         }
@@ -1147,8 +1153,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                          * The latter is necessary to prevent ghost
                          * partitions on a removed medium.
                          */
-                        if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
-                                rescan_partitions(disk, bdev);
+                        if (bdev->bd_invalidated) {
+                                if (!ret)
+                                        rescan_partitions(disk, bdev);
+                                else if (ret == -ENOMEDIUM)
+                                        invalidate_partitions(disk, bdev);
+                        }
                         if (ret)
                                 goto out_clear;
                 } else {
@@ -1178,14 +1188,18 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                         if (bdev->bd_disk->fops->open)
                                 ret = bdev->bd_disk->fops->open(bdev, mode);
                         /* the same as first opener case, read comment there */
-                        if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
-                                rescan_partitions(bdev->bd_disk, bdev);
+                        if (bdev->bd_invalidated) {
+                                if (!ret)
+                                        rescan_partitions(bdev->bd_disk, bdev);
+                                else if (ret == -ENOMEDIUM)
+                                        invalidate_partitions(bdev->bd_disk, bdev);
+                        }
                         if (ret)
                                 goto out_unlock_bdev;
                 }
                 /* only one opener holds refs to the module and disk */
-                module_put(disk->fops->owner);
                 put_disk(disk);
+                module_put(owner);
         }
         bdev->bd_openers++;
         if (for_part)
@@ -1205,8 +1219,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
  out_unlock_bdev:
         mutex_unlock(&bdev->bd_mutex);
         disk_unblock_events(disk);
-        module_put(disk->fops->owner);
         put_disk(disk);
+        module_put(owner);
  out:
         bdput(bdev);
 
@@ -1427,8 +1441,6 @@ static int __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
         if (!bdev->bd_openers) {
                 struct module *owner = disk->fops->owner;
 
-                put_disk(disk);
-                module_put(owner);
                 disk_put_part(bdev->bd_part);
                 bdev->bd_part = NULL;
                 bdev->bd_disk = NULL;
@@ -1437,6 +1449,9 @@ static int __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
                 if (bdev != bdev->bd_contains)
                         victim = bdev->bd_contains;
                 bdev->bd_contains = NULL;
+
+                put_disk(disk);
+                module_put(owner);
         }
         mutex_unlock(&bdev->bd_mutex);
         bdput(bdev);
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 7ec14097fef..8006a28390f 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -212,10 +212,17 @@ static noinline int run_ordered_completions(struct btrfs_workers *workers,
 
                 work->ordered_func(work);
 
-                /* now take the lock again and call the freeing code */
+                /* now take the lock again and drop our item from the list */
                 spin_lock(&workers->order_lock);
                 list_del(&work->order_list);
+                spin_unlock(&workers->order_lock);
+
+                /*
+                 * we don't want to call the ordered free functions
+                 * with the lock held though
+                 */
                 work->ordered_free(work);
+                spin_lock(&workers->order_lock);
         }
 
         spin_unlock(&workers->order_lock);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 3b859a3e6a0..66179bcb16f 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1972,7 +1972,7 @@ BTRFS_SETGET_STACK_FUNCS(root_last_snapshot, struct btrfs_root_item,
 
 static inline bool btrfs_root_readonly(struct btrfs_root *root)
 {
-        return root->root_item.flags & BTRFS_ROOT_SUBVOL_RDONLY;
+        return (root->root_item.flags & cpu_to_le64(BTRFS_ROOT_SUBVOL_RDONLY)) != 0;
 }
 
 /* struct btrfs_super_block */
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 1ac8db5dc0a..57106a99b52 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -801,7 +801,8 @@ static int btree_submit_bio_hook(struct inode *inode, int rw, struct bio *bio,
 
 #ifdef CONFIG_MIGRATION
 static int btree_migratepage(struct address_space *mapping,
-                        struct page *newpage, struct page *page)
+                        struct page *newpage, struct page *page,
+                        enum migrate_mode mode)
 {
         /*
          * we can't safely write a btree page from here,
@@ -816,7 +817,7 @@ static int btree_migratepage(struct address_space *mapping,
         if (page_has_private(page) &&
             !try_to_release_page(page, GFP_KERNEL))
                 return -EAGAIN;
-        return migrate_page(mapping, newpage, page);
+        return migrate_page(mapping, newpage, page, mode);
 }
 #endif
 
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 71cd456fdb6..f88d5363114 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1784,6 +1784,9 @@ static int btrfs_discard_extent(struct btrfs_root *root, u64 bytenr,
 
 
                 for (i = 0; i < multi->num_stripes; i++, stripe++) {
+                        if (!stripe->dev->can_discard)
+                                continue;
+
                         ret = btrfs_issue_discard(stripe->dev->bdev,
                                                   stripe->physical,
                                                   stripe->length);
@@ -1791,11 +1794,16 @@ static int btrfs_discard_extent(struct btrfs_root *root, u64 bytenr,
                                 discarded_bytes += stripe->length;
                         else if (ret != -EOPNOTSUPP)
                                 break;
+
+                        /*
+                         * Just in case we get back EOPNOTSUPP for some reason,
+                         * just ignore the return value so we don't screw up
+                         * people calling discard_extent.
+                         */
+                        ret = 0;
                 }
                 kfree(multi);
         }
-        if (discarded_bytes && ret == -EOPNOTSUPP)
-                ret = 0;
 
         if (actual_bytes)
                 *actual_bytes = discarded_bytes;
@@ -3321,7 +3329,8 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
                 smp_mb();
                 nr_pages = min_t(unsigned long, nr_pages,
                        root->fs_info->delalloc_bytes >> PAGE_CACHE_SHIFT);
-                writeback_inodes_sb_nr_if_idle(root->fs_info->sb, nr_pages);
+                writeback_inodes_sb_nr_if_idle(root->fs_info->sb, nr_pages,
+                                                WB_REASON_FS_FREE_SPACE);
 
                 spin_lock(&space_info->lock);
                 if (reserved > space_info->bytes_reserved)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 3601f0aebdd..d42e6bfdd3a 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4124,7 +4124,8 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
 
         /* special case for "." */
         if (filp->f_pos == 0) {
-                over = filldir(dirent, ".", 1, 1, btrfs_ino(inode), DT_DIR);
+                over = filldir(dirent, ".", 1,
+                               filp->f_pos, btrfs_ino(inode), DT_DIR);
                 if (over)
                         return 0;
                 filp->f_pos = 1;
@@ -4133,7 +4134,7 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
         if (filp->f_pos == 1) {
                 u64 pino = parent_ino(filp->f_path.dentry);
                 over = filldir(dirent, "..", 2,
-                               2, pino, DT_DIR);
+                               filp->f_pos, pino, DT_DIR);
                 if (over)
                         return 0;
                 filp->f_pos = 2;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 4ce8a9f41d1..faf7d0bc0a0 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -691,6 +691,8 @@ static noinline int drop_one_dir_item(struct btrfs_trans_handle *trans,
         kfree(name);
 
         iput(inode);
+
+        btrfs_run_delayed_items(trans, root);
         return ret;
 }
 
@@ -799,14 +801,15 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
                                   struct extent_buffer *eb, int slot,
                                   struct btrfs_key *key)
 {
-        struct inode *dir;
-        int ret;
         struct btrfs_inode_ref *ref;
+        struct btrfs_dir_item *di;
+        struct inode *dir;
         struct inode *inode;
-        char *name;
-        int namelen;
         unsigned long ref_ptr;
         unsigned long ref_end;
+        char *name;
+        int namelen;
+        int ret;
         int search_done = 0;
 
         /*
@@ -895,6 +898,7 @@ again:
                                 ret = btrfs_unlink_inode(trans, root, dir,
                                                          inode, victim_name,
                                                          victim_name_len);
+                                btrfs_run_delayed_items(trans, root);
                         }
                         kfree(victim_name);
                         ptr = (unsigned long)(victim_ref + 1) + victim_name_len;
@@ -909,6 +913,25 @@ again:
         }
         btrfs_release_path(path);
 
+        /* look for a conflicting sequence number */
+        di = btrfs_lookup_dir_index_item(trans, root, path, btrfs_ino(dir),
+                                         btrfs_inode_ref_index(eb, ref),
+                                         name, namelen, 0);
+        if (di && !IS_ERR(di)) {
+                ret = drop_one_dir_item(trans, root, path, dir, di);
+                BUG_ON(ret);
+        }
+        btrfs_release_path(path);
+
+        /* look for a conflicing name */
+        di = btrfs_lookup_dir_item(trans, root, path, btrfs_ino(dir),
+                                   name, namelen, 0);
+        if (di && !IS_ERR(di)) {
+                ret = drop_one_dir_item(trans, root, path, dir, di);
+                BUG_ON(ret);
+        }
+        btrfs_release_path(path);
+
 insert:
         /* insert our name */
         ret = btrfs_add_link(trans, dir, inode, name, namelen, 0,
@@ -1456,6 +1479,9 @@ again:
                         ret = btrfs_unlink_inode(trans, root, dir, inode,
                                                  name, name_len);
                         BUG_ON(ret);
+
+                        btrfs_run_delayed_items(trans, root);
+
                         kfree(name);
                         iput(inode);
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 19450bc5363..43baaf0c674 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -500,6 +500,9 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
                         fs_devices->rw_devices--;
                 }
 
+                if (device->can_discard)
+                        fs_devices->num_can_discard--;
+
                 new_device = kmalloc(sizeof(*new_device), GFP_NOFS);
                 BUG_ON(!new_device);
                 memcpy(new_device, device, sizeof(*new_device));
@@ -508,6 +511,7 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
                 new_device->bdev = NULL;
                 new_device->writeable = 0;
                 new_device->in_fs_metadata = 0;
+                new_device->can_discard = 0;
                 list_replace_rcu(&device->dev_list, &new_device->dev_list);
 
                 call_rcu(&device->rcu, free_device);
@@ -547,6 +551,7 @@ int btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
 static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                                 fmode_t flags, void *holder)
 {
+        struct request_queue *q;
         struct block_device *bdev;
         struct list_head *head = &fs_devices->devices;
         struct btrfs_device *device;
@@ -603,6 +608,12 @@ static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                         seeding = 0;
                 }
 
+                q = bdev_get_queue(bdev);
+                if (blk_queue_discard(q)) {
+                        device->can_discard = 1;
+                        fs_devices->num_can_discard++;
+                }
+
                 device->bdev = bdev;
                 device->in_fs_metadata = 0;
                 device->mode = flags;
@@ -1542,6 +1553,7 @@ error:
 
 int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
 {
+        struct request_queue *q;
         struct btrfs_trans_handle *trans;
         struct btrfs_device *device;
         struct block_device *bdev;
@@ -1611,6 +1623,9 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
 
         lock_chunks(root);
 
+        q = bdev_get_queue(bdev);
+        if (blk_queue_discard(q))
+                device->can_discard = 1;
         device->writeable = 1;
         device->work.func = pending_bios_fn;
         generate_random_uuid(device->uuid);
@@ -1646,6 +1661,8 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         root->fs_info->fs_devices->num_devices++;
         root->fs_info->fs_devices->open_devices++;
         root->fs_info->fs_devices->rw_devices++;
+        if (device->can_discard)
+                root->fs_info->fs_devices->num_can_discard++;
         root->fs_info->fs_devices->total_rw_bytes += device->total_bytes;
 
         if (!blk_queue_nonrot(bdev_get_queue(bdev)))
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 7c12d61ae7a..6d866db4e17 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -48,6 +48,7 @@ struct btrfs_device {
         int writeable;
         int in_fs_metadata;
         int missing;
+        int can_discard;
 
         spinlock_t io_lock;
 
@@ -104,6 +105,7 @@ struct btrfs_fs_devices {
         u64 rw_devices;
         u64 missing_devices;
         u64 total_rw_bytes;
+        u64 num_can_discard;
         struct block_device *latest_bdev;
 
         /* all of the devices in the FS, protected by a mutex
diff --git a/fs/buffer.c b/fs/buffer.c
index 1a80b048ade..d7586936b25 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -285,7 +285,7 @@ static void free_more_memory(void)
         struct zone *zone;
         int nid;
 
-        wakeup_flusher_threads(1024);
+        wakeup_flusher_threads(1024, WB_REASON_FREE_MORE_MEM);
         yield();
 
         for_each_online_node(nid) {
@@ -968,6 +968,7 @@ init_page_buffers(struct page *page, struct block_device *bdev,
         struct buffer_head *head = page_buffers(page);
         struct buffer_head *bh = head;
         int uptodate = PageUptodate(page);
+        sector_t end_block = blkdev_max_block(I_BDEV(bdev->bd_inode));
 
         do {
                 if (!buffer_mapped(bh)) {
@@ -976,7 +977,8 @@ init_page_buffers(struct page *page, struct block_device *bdev,
                         bh->b_blocknr = block;
                         if (uptodate)
                                 set_buffer_uptodate(bh);
-                        set_buffer_mapped(bh);
+                        if (block < end_block)
+                                set_buffer_mapped(bh);
                 }
                 block++;
                 bh = bh->b_this_page;
@@ -1082,6 +1084,9 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
 static struct buffer_head *
 __getblk_slow(struct block_device *bdev, sector_t block, int size)
 {
+        int ret;
+        struct buffer_head *bh;
+
         /* Size must be multiple of hard sectorsize */
         if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
                         (size < 512 || size > PAGE_SIZE))) {
@@ -1094,20 +1099,21 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
                 return NULL;
         }
 
-        for (;;) {
-                struct buffer_head * bh;
-                int ret;
+retry:
+        bh = __find_get_block(bdev, block, size);
+        if (bh)
+                return bh;
 
+        ret = grow_buffers(bdev, block, size);
+        if (ret == 0) {
+                free_more_memory();
+                goto retry;
+        } else if (ret > 0) {
                 bh = __find_get_block(bdev, block, size);
                 if (bh)
                         return bh;
-
-                ret = grow_buffers(bdev, block, size);
-                if (ret < 0)
-                        return NULL;
-                if (ret == 0)
-                        free_more_memory();
         }
+        return NULL;
 }
 
 /*
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index bc4b12ca537..53e7d72177d 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -566,6 +566,12 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
                 struct inode *dir = dentry->d_inode;
                 struct dentry *child;
 
+                if (!dir) {
+                        dput(dentry);
+                        dentry = ERR_PTR(-ENOENT);
+                        break;
+                }
+
                 /* skip separators */
                 while (*s == sep)
                         s++;
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 6255fa812c7..7cb9dd22531 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -43,6 +43,7 @@
 
 #define CIFS_MIN_RCV_POOL 4
 
+#define MAX_REOPEN_ATT  5 /* these many maximum attempts to reopen a file */
 /*
  * default attribute cache timeout (jiffies)
  */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 1a9fe7f816d..07132c4e99f 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -4079,7 +4079,8 @@ int CIFSFindNext(const int xid, struct cifs_tcon *tcon,
         T2_FNEXT_RSP_PARMS *parms;
         char *response_data;
         int rc = 0;
-        int bytes_returned, name_len;
+        int bytes_returned;
+        unsigned int name_len;
         __u16 params, byte_count;
 
         cFYI(1, "In FindNext");
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index ccc1afa0bf3..b7758094770 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1258,7 +1258,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         /* ignore */
                 } else if (strnicmp(data, "guest", 5) == 0) {
                         /* ignore */
-                } else if (strnicmp(data, "rw", 2) == 0) {
+                } else if (strnicmp(data, "rw", 2) == 0 && strlen(data) == 2) {
                         /* ignore */
                 } else if (strnicmp(data, "ro", 2) == 0) {
                         /* ignore */
@@ -1361,7 +1361,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         vol->server_ino = 1;
                 } else if (strnicmp(data, "noserverino", 9) == 0) {
                         vol->server_ino = 0;
-                } else if (strnicmp(data, "rwpidforward", 4) == 0) {
+                } else if (strnicmp(data, "rwpidforward", 12) == 0) {
                         vol->rwpidforward = 1;
                 } else if (strnicmp(data, "cifsacl", 7) == 0) {
                         vol->cifs_acl = 1;
@@ -2767,10 +2767,10 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 
 /*
  * When the server doesn't allow large posix writes, only allow a wsize of
- * 128k minus the size of the WRITE_AND_X header. That allows for a write up
+ * 2^17-1 minus the size of the WRITE_AND_X header. That allows for a write up
  * to the maximum size described by RFC1002.
  */
-#define CIFS_MAX_RFC1002_WSIZE (128 * 1024 - sizeof(WRITE_REQ) + 4)
+#define CIFS_MAX_RFC1002_WSIZE ((1<<17) - 1 - sizeof(WRITE_REQ) + 4)
 
 /*
  * The default wsize is 1M. find_get_pages seems to return a maximum of 256
@@ -2838,7 +2838,8 @@ cleanup_volume_info_contents(struct smb_vol *volume_info)
         kfree(volume_info->username);
         kzfree(volume_info->password);
         kfree(volume_info->UNC);
-        kfree(volume_info->UNCip);
+        if (volume_info->UNCip != volume_info->UNC + 2)
+                kfree(volume_info->UNCip);
         kfree(volume_info->domainname);
         kfree(volume_info->iocharset);
         kfree(volume_info->prepath);
@@ -3003,7 +3004,7 @@ cifs_get_volume_info(char *mount_data, const char *devname)
 int
 cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
 {
-        int rc = 0;
+        int rc;
         int xid;
         struct cifs_ses *pSesInfo;
         struct cifs_tcon *tcon;
@@ -3032,6 +3033,7 @@ try_mount_again:
                 FreeXid(xid);
         }
 #endif
+        rc = 0;
         tcon = NULL;
         pSesInfo = NULL;
         srvTcp = NULL;
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index fa8c21d913b..ed5c07b0cdb 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -110,8 +110,8 @@ cifs_bp_rename_retry:
         }
         rcu_read_unlock();
         if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) {
-                cERROR(1, "did not end path lookup where expected namelen is %d",
-                        namelen);
+                cFYI(1, "did not end path lookup where expected. namelen=%d "
+                        "dfsplen=%d", namelen, dfsplen);
                 /* presumably this is only possible if racing with a rename
                 of one of the parent directories  (we can not lock the dentries
                 above us to prevent this, but retrying should be harmless) */
@@ -583,10 +583,26 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
                          * If either that or op not supported returned, follow
                          * the normal lookup.
                          */
-                        if ((rc == 0) || (rc == -ENOENT))
+                        switch (rc) {
+                        case 0:
+                                /*
+                                 * The server may allow us to open things like
+                                 * FIFOs, but the client isn't set up to deal
+                                 * with that. If it's not a regular file, just
+                                 * close it and proceed as if it were a normal
+                                 * lookup.
+                                 */
+                                if (newInode && !S_ISREG(newInode->i_mode)) {
+                                        CIFSSMBClose(xid, pTcon, fileHandle);
+                                        break;
+                                }
+                        case -ENOENT:
                                 posix_open = true;
-                        else if ((rc == -EINVAL) || (rc != -EOPNOTSUPP))
+                        case -EOPNOTSUPP:
+                                break;
+                        default:
                                 pTcon->broken_posix_open = true;
+                        }
                 }
                 if (!posix_open)
                         rc = cifs_get_inode_info_unix(&newInode, full_path,
@@ -641,7 +657,7 @@ lookup_out:
 static int
 cifs_d_revalidate(struct dentry *direntry, struct nameidata *nd)
 {
-        if (nd->flags & LOOKUP_RCU)
+        if (nd && (nd->flags & LOOKUP_RCU))
                 return -ECHILD;
 
         if (direntry->d_inode) {
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index a9b4a24f2a1..9040cb0695c 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -973,10 +973,11 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
 struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
                                         bool fsuid_only)
 {
-        struct cifsFileInfo *open_file;
+        struct cifsFileInfo *open_file, *inv_file = NULL;
         struct cifs_sb_info *cifs_sb;
         bool any_available = false;
         int rc;
+        unsigned int refind = 0;
 
         /* Having a null inode here (because mapping->host was set to zero by
         the VFS or MM) should not happen but we had reports of on oops (due to
@@ -996,40 +997,25 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
 
         spin_lock(&cifs_file_list_lock);
 refind_writable:
+        if (refind > MAX_REOPEN_ATT) {
+                spin_unlock(&cifs_file_list_lock);
+                return NULL;
+        }
         list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
                 if (!any_available && open_file->pid != current->tgid)
                         continue;
                 if (fsuid_only && open_file->uid != current_fsuid())
                         continue;
                 if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {
-                        cifsFileInfo_get(open_file);
-
                         if (!open_file->invalidHandle) {
                                 /* found a good writable file */
+                                cifsFileInfo_get(open_file);
                                 spin_unlock(&cifs_file_list_lock);
                                 return open_file;
+                        } else {
+                                if (!inv_file)
+                                        inv_file = open_file;
                         }
-
-                        spin_unlock(&cifs_file_list_lock);
-
-                        /* Had to unlock since following call can block */
-                        rc = cifs_reopen_file(open_file, false);
-                        if (!rc)
-                                return open_file;
-
-                        /* if it fails, try another handle if possible */
-                        cFYI(1, "wp failed on reopen file");
-                        cifsFileInfo_put(open_file);
-
-                        spin_lock(&cifs_file_list_lock);
-
-                        /* else we simply continue to the next entry. Thus
-                           we do not loop on reopen errors.  If we
-                           can not reopen the file, for example if we
-                           reconnected to a server with another client
-                           racing to delete or lock the file we would not
-                           make progress if we restarted before the beginning
-                           of the loop here. */
                 }
         }
         /* couldn't find useable FH with same pid, try any available */
@@ -1037,7 +1023,30 @@ refind_writable:
                 any_available = true;
                 goto refind_writable;
         }
+
+        if (inv_file) {
+                any_available = false;
+                cifsFileInfo_get(inv_file);
+        }
+
         spin_unlock(&cifs_file_list_lock);
+
+        if (inv_file) {
+                rc = cifs_reopen_file(inv_file, false);
+                if (!rc)
+                        return inv_file;
+                else {
+                        spin_lock(&cifs_file_list_lock);
+                        list_move_tail(&inv_file->flist,
+                                        &cifs_inode->openFileList);
+                        spin_unlock(&cifs_file_list_lock);
+                        cifsFileInfo_put(inv_file);
+                        spin_lock(&cifs_file_list_lock);
+                        ++refind;
+                        goto refind_writable;
+                }
+        }
+
         return NULL;
 }
 
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 9b018c8334f..745e5cdca8f 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -562,7 +562,16 @@ int cifs_get_file_info(struct file *filp)
 
         xid = GetXid();
         rc = CIFSSMBQFileInfo(xid, tcon, cfile->netfid, &find_data);
-        if (rc == -EOPNOTSUPP || rc == -EINVAL) {
+        switch (rc) {
+        case 0:
+                cifs_all_info_to_fattr(&fattr, &find_data, cifs_sb, false);
+                break;
+        case -EREMOTE:
+                cifs_create_dfs_fattr(&fattr, inode->i_sb);
+                rc = 0;
+                break;
+        case -EOPNOTSUPP:
+        case -EINVAL:
                 /*
                  * FIXME: legacy server -- fall back to path-based call?
                  * for now, just skip revalidating and mark inode for
@@ -570,18 +579,14 @@ int cifs_get_file_info(struct file *filp)
                  */
                 rc = 0;
                 CIFS_I(inode)->time = 0;
+        default:
                 goto cgfi_exit;
-        } else if (rc == -EREMOTE) {
-                cifs_create_dfs_fattr(&fattr, inode->i_sb);
-                rc = 0;
-        } else if (rc)
-                goto cgfi_exit;
+        }
 
         /*
          * don't bother with SFU junk here -- just mark inode as needing
          * revalidation.
          */
-        cifs_all_info_to_fattr(&fattr, &find_data, cifs_sb, false);
         fattr.cf_uniqueid = CIFS_I(inode)->uniqueid;
         fattr.cf_flags |= CIFS_FATTR_NEED_REVAL;
         cifs_fattr_to_inode(inode, &fattr);
@@ -764,20 +769,10 @@ char *cifs_build_path_to_root(struct smb_vol *vol, struct cifs_sb_info *cifs_sb,
         if (full_path == NULL)
                 return full_path;
 
-        if (dfsplen) {
+        if (dfsplen)
                 strncpy(full_path, tcon->treeName, dfsplen);
-                /* switch slash direction in prepath depending on whether
-                 * windows or posix style path names
-                 */
-                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
-                        int i;
-                        for (i = 0; i < dfsplen; i++) {
-                                if (full_path[i] == '\\')
-                                        full_path[i] = '/';
-                        }
-                }
-        }
         strncpy(full_path + dfsplen, vol->prepath, pplen);
+        convert_delimiter(full_path, CIFS_DIR_SEP(cifs_sb));
         full_path[dfsplen + pplen] = 0; /* add trailing null */
         return full_path;
 }
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 6751e745bbc..c71032ba5b7 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -85,9 +85,12 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name,
 
         dentry = d_lookup(parent, name);
         if (dentry) {
-                /* FIXME: check for inode number changes? */
-                if (dentry->d_inode != NULL)
+                inode = dentry->d_inode;
+                /* update inode in place if i_ino didn't change */
+                if (inode && CIFS_I(inode)->uniqueid == fattr->cf_uniqueid) {
+                        cifs_fattr_to_inode(inode, fattr);
                         return dentry;
+                }
                 d_drop(dentry);
                 dput(dentry);
         }
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index d3e619692ee..0cfae19129b 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -244,16 +244,15 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
         /* copy user */
         /* BB what about null user mounts - check that we do this BB */
         /* copy user */
-        if (ses->user_name != NULL)
+        if (ses->user_name != NULL) {
                 strncpy(bcc_ptr, ses->user_name, MAX_USERNAME_SIZE);
+                bcc_ptr += strnlen(ses->user_name, MAX_USERNAME_SIZE);
+        }
         /* else null user mount */
-
-        bcc_ptr += strnlen(ses->user_name, MAX_USERNAME_SIZE);
         *bcc_ptr = 0;
         bcc_ptr++; /* account for null termination */
 
         /* copy domain */
-
         if (ses->domainName != NULL) {
                 strncpy(bcc_ptr, ses->domainName, 256);
                 bcc_ptr += strnlen(ses->domainName, 256);
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 147aa22c3c3..c1b9c4b1073 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -362,6 +362,8 @@ cifs_call_async(struct TCP_Server_Info *server, struct kvec *iov,
         mid = AllocMidQEntry(hdr, server);
         if (mid == NULL) {
                 mutex_unlock(&server->srv_mutex);
+                atomic_dec(&server->inFlight);
+                wake_up(&server->request_q);
                 return -ENOMEM;
         }
 
diff --git a/fs/dcache.c b/fs/dcache.c
index fbdcbca4072..0b51cfc9291 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -241,6 +241,7 @@ static void dentry_lru_add(struct dentry *dentry)
 static void __dentry_lru_del(struct dentry *dentry)
 {
         list_del_init(&dentry->d_lru);
+        dentry->d_flags &= ~DCACHE_SHRINK_LIST;
         dentry->d_sb->s_nr_dentry_unused--;
         dentry_stat.nr_unused--;
 }
@@ -753,6 +754,7 @@ relock:
                         spin_unlock(&dentry->d_lock);
                 } else {
                         list_move_tail(&dentry->d_lru, &tmp);
+                        dentry->d_flags |= DCACHE_SHRINK_LIST;
                         spin_unlock(&dentry->d_lock);
                         if (!--cnt)
                                 break;
@@ -1144,14 +1146,18 @@ resume:
                 /* 
                  * move only zero ref count dentries to the end 
                  * of the unused list for prune_dcache
+                 *
+                 * Those which are presently on the shrink list, being processed
+                 * by shrink_dentry_list(), shouldn't be moved.  Otherwise the
+                 * loop in shrink_dcache_parent() might not make any progress
+                 * and loop forever.
                  */
-                if (!dentry->d_count) {
+                if (dentry->d_count) {
+                        dentry_lru_del(dentry);
+                } else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
                         dentry_lru_move_tail(dentry);
                         found++;
-                } else {
-                        dentry_lru_del(dentry);
                 }
-
                 /*
                  * We can return to the caller if we have found some (this
                  * ensures forward progress). We'll be coming back to find
@@ -2427,6 +2433,7 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
                         if (d_ancestor(alias, dentry)) {
                                 /* Check for loops */
                                 actual = ERR_PTR(-ELOOP);
+                                spin_unlock(&inode->i_lock);
                         } else if (IS_ROOT(alias)) {
                                 /* Is this an anonymous mountpoint that we
                                  * could splice into our tree? */
@@ -2436,7 +2443,7 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
                                 goto found;
                         } else {
                                 /* Nope, but we must(!) avoid directory
-                                 * aliasing */
+                                 * aliasing. This drops inode->i_lock */
                                 actual = __d_unalias(inode, dentry, alias);
                         }
                         write_sequnlock(&rename_lock);
@@ -2487,16 +2494,14 @@ static int prepend_name(char **buffer, int *buflen, struct qstr *name)
 /**
  * prepend_path - Prepend path string to a buffer
  * @path: the dentry/vfsmount to report
- * @root: root vfsmnt/dentry (may be modified by this function)
+ * @root: root vfsmnt/dentry
  * @buffer: pointer to the end of the buffer
  * @buflen: pointer to buffer length
  *
  * Caller holds the rename_lock.
- *
- * If path is not reachable from the supplied root, then the value of
- * root is changed (without modifying refcounts).
  */
-static int prepend_path(const struct path *path, struct path *root,
+static int prepend_path(const struct path *path,
+                        const struct path *root,
                         char **buffer, int *buflen)
 {
         struct dentry *dentry = path->dentry;
@@ -2531,10 +2536,10 @@ static int prepend_path(const struct path *path, struct path *root,
                 dentry = parent;
         }
 
-out:
         if (!error && !slash)
                 error = prepend(buffer, buflen, "/", 1);
 
+out:
         br_read_unlock(vfsmount_lock);
         return error;
 
@@ -2548,15 +2553,17 @@ global_root:
                 WARN(1, "Root dentry has weird name <%.*s>\n",
                      (int) dentry->d_name.len, dentry->d_name.name);
         }
-        root->mnt = vfsmnt;
-        root->dentry = dentry;
+        if (!slash)
+                error = prepend(buffer, buflen, "/", 1);
+        if (!error)
+                error = vfsmnt->mnt_ns ? 1 : 2;
         goto out;
 }
 
 /**
  * __d_path - return the path of a dentry
  * @path: the dentry/vfsmount to report
- * @root: root vfsmnt/dentry (may be modified by this function)
+ * @root: root vfsmnt/dentry
  * @buf: buffer to return value in
  * @buflen: buffer length
  *
@@ -2567,10 +2574,10 @@ global_root:
  *
  * "buflen" should be positive.
  *
- * If path is not reachable from the supplied root, then the value of
- * root is changed (without modifying refcounts).
+ * If the path is not reachable from the supplied root, return %NULL.
  */
-char *__d_path(const struct path *path, struct path *root,
+char *__d_path(const struct path *path,
+               const struct path *root,
                char *buf, int buflen)
 {
         char *res = buf + buflen;
@@ -2581,7 +2588,28 @@ char *__d_path(const struct path *path, struct path *root,
         error = prepend_path(path, root, &res, &buflen);
         write_sequnlock(&rename_lock);
 
-        if (error)
+        if (error < 0)
+                return ERR_PTR(error);
+        if (error > 0)
+                return NULL;
+        return res;
+}
+
+char *d_absolute_path(const struct path *path,
+               char *buf, int buflen)
+{
+        struct path root = {};
+        char *res = buf + buflen;
+        int error;
+
+        prepend(&res, &buflen, "\0", 1);
+        write_seqlock(&rename_lock);
+        error = prepend_path(path, &root, &res, &buflen);
+        write_sequnlock(&rename_lock);
+
+        if (error > 1)
+                error = -EINVAL;
+        if (error < 0)
                 return ERR_PTR(error);
         return res;
 }
@@ -2589,8 +2617,9 @@ char *__d_path(const struct path *path, struct path *root,
 /*
  * same as __d_path but appends "(deleted)" for unlinked files.
  */
-static int path_with_deleted(const struct path *path, struct path *root,
-                                 char **buf, int *buflen)
+static int path_with_deleted(const struct path *path,
+                             const struct path *root,
+                             char **buf, int *buflen)
 {
         prepend(buf, buflen, "\0", 1);
         if (d_unlinked(path->dentry)) {
@@ -2627,7 +2656,6 @@ char *d_path(const struct path *path, char *buf, int buflen)
 {
         char *res = buf + buflen;
         struct path root;
-        struct path tmp;
         int error;
 
         /*
@@ -2642,9 +2670,8 @@ char *d_path(const struct path *path, char *buf, int buflen)
 
         get_fs_root(current->fs, &root);
         write_seqlock(&rename_lock);
-        tmp = root;
-        error = path_with_deleted(path, &tmp, &res, &buflen);
-        if (error)
+        error = path_with_deleted(path, &root, &res, &buflen);
+        if (error < 0)
                 res = ERR_PTR(error);
         write_sequnlock(&rename_lock);
         path_put(&root);
@@ -2665,7 +2692,6 @@ char *d_path_with_unreachable(const struct path *path, char *buf, int buflen)
 {
         char *res = buf + buflen;
         struct path root;
-        struct path tmp;
         int error;
 
         if (path->dentry->d_op && path->dentry->d_op->d_dname)
@@ -2673,9 +2699,8 @@ char *d_path_with_unreachable(const struct path *path, char *buf, int buflen)
 
         get_fs_root(current->fs, &root);
         write_seqlock(&rename_lock);
-        tmp = root;
-        error = path_with_deleted(path, &tmp, &res, &buflen);
-        if (!error && !path_equal(&tmp, &root))
+        error = path_with_deleted(path, &root, &res, &buflen);
+        if (error > 0)
                 error = prepend_unreachable(&res, &buflen);
         write_sequnlock(&rename_lock);
         path_put(&root);
@@ -2806,19 +2831,18 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
         write_seqlock(&rename_lock);
         if (!d_unlinked(pwd.dentry)) {
                 unsigned long len;
-                struct path tmp = root;
                 char *cwd = page + PAGE_SIZE;
                 int buflen = PAGE_SIZE;
 
                 prepend(&cwd, &buflen, "\0", 1);
-                error = prepend_path(&pwd, &tmp, &cwd, &buflen);
+                error = prepend_path(&pwd, &root, &cwd, &buflen);
                 write_sequnlock(&rename_lock);
 
-                if (error)
+                if (error < 0)
                         goto out;
 
                 /* Unreachable from current root */
-                if (!path_equal(&tmp, &root)) {
+                if (error > 0) {
                         error = prepend_unreachable(&cwd, &buflen);
                         if (error)
                                 goto out;
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 58609bde3b9..c6602d24517 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -417,17 +417,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
                         (unsigned long long)(extent_base + extent_offset), rc);
                 goto out;
         }
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Encrypting extent "
-                                "with iv:\n");
-                ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
-                                "encryption:\n");
-                ecryptfs_dump_hex((char *)
-                                  (page_address(page)
-                                   + (extent_offset * crypt_stat->extent_size)),
-                                  8);
-        }
         rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, 0,
                                           page, (extent_offset
                                                  * crypt_stat->extent_size),
@@ -440,14 +429,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
                 goto out;
         }
         rc = 0;
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Encrypt extent [0x%.16llx]; "
-                        "rc = [%d]\n",
-                        (unsigned long long)(extent_base + extent_offset), rc);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
-                                "encryption:\n");
-                ecryptfs_dump_hex((char *)(page_address(enc_extent_page)), 8);
-        }
 out:
         return rc;
 }
@@ -543,17 +524,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
                         (unsigned long long)(extent_base + extent_offset), rc);
                 goto out;
         }
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Decrypting extent "
-                                "with iv:\n");
-                ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
-                                "decryption:\n");
-                ecryptfs_dump_hex((char *)
-                                  (page_address(enc_extent_page)
-                                   + (extent_offset * crypt_stat->extent_size)),
-                                  8);
-        }
         rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
                                           (extent_offset
                                            * crypt_stat->extent_size),
@@ -567,16 +537,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
                 goto out;
         }
         rc = 0;
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Decrypt extent [0x%.16llx]; "
-                        "rc = [%d]\n",
-                        (unsigned long long)(extent_base + extent_offset), rc);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
-                                "decryption:\n");
-                ecryptfs_dump_hex((char *)(page_address(page)
-                                           + (extent_offset
-                                              * crypt_stat->extent_size)), 8);
-        }
 out:
         return rc;
 }
@@ -1618,7 +1578,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
                 rc = ecryptfs_read_xattr_region(page_virt, ecryptfs_inode);
                 if (rc) {
                         printk(KERN_DEBUG "Valid eCryptfs headers not found in "
-                               "file header region or xattr region\n");
+                               "file header region or xattr region, inode %lu\n",
+                                ecryptfs_inode->i_ino);
                         rc = -EINVAL;
                         goto out;
                 }
@@ -1627,7 +1588,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
                                                 ECRYPTFS_DONT_VALIDATE_HEADER_SIZE);
                 if (rc) {
                         printk(KERN_DEBUG "Valid eCryptfs headers not found in "
-                               "file xattr region either\n");
+                               "file xattr region either, inode %lu\n",
+                                ecryptfs_inode->i_ino);
                         rc = -EINVAL;
                 }
                 if (crypt_stat->mount_crypt_stat->flags
@@ -1638,7 +1600,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
                                "crypto metadata only in the extended attribute "
                                "region, but eCryptfs was mounted without "
                                "xattr support enabled. eCryptfs will not treat "
-                               "this like an encrypted file.\n");
+                               "this like an encrypted file, inode %lu\n",
+                                ecryptfs_inode->i_ino);
                         rc = -EINVAL;
                 }
         }
@@ -1943,7 +1906,7 @@ static unsigned char *portable_filename_chars = ("-.0123456789ABCD"
 
 /* We could either offset on every reverse map or just pad some 0x00's
  * at the front here */
-static const unsigned char filename_rev_map[] = {
+static const unsigned char filename_rev_map[256] = {
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 7 */
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 15 */
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 23 */
@@ -1959,7 +1922,7 @@ static const unsigned char filename_rev_map[] = {
         0x00, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, /* 103 */
         0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, /* 111 */
         0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, /* 119 */
-        0x3D, 0x3E, 0x3F
+        0x3D, 0x3E, 0x3F /* 123 - 255 initialized to 0x00 */
 };
 
 /**
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 4ec9eb00a24..0c1a6527004 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -139,6 +139,27 @@ out:
         return rc;
 }
 
+static void ecryptfs_vma_close(struct vm_area_struct *vma)
+{
+        filemap_write_and_wait(vma->vm_file->f_mapping);
+}
+
+static const struct vm_operations_struct ecryptfs_file_vm_ops = {
+        .close          = ecryptfs_vma_close,
+        .fault          = filemap_fault,
+};
+
+static int ecryptfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        int rc;
+
+        rc = generic_file_mmap(file, vma);
+        if (!rc)
+                vma->vm_ops = &ecryptfs_file_vm_ops;
+
+        return rc;
+}
+
 struct kmem_cache *ecryptfs_file_info_cache;
 
 /**
@@ -348,7 +369,7 @@ const struct file_operations ecryptfs_main_fops = {
 #ifdef CONFIG_COMPAT
         .compat_ioctl = ecryptfs_compat_ioctl,
 #endif
-        .mmap = generic_file_mmap,
+        .mmap = ecryptfs_file_mmap,
         .open = ecryptfs_open,
         .flush = ecryptfs_flush,
         .release = ecryptfs_release,
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 7349ade17de..2717329386d 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -69,6 +69,7 @@ static int ecryptfs_inode_set(struct inode *inode, void *opaque)
         inode->i_ino = lower_inode->i_ino;
         inode->i_version++;
         inode->i_mapping->a_ops = &ecryptfs_aops;
+        inode->i_mapping->backing_dev_info = inode->i_sb->s_bdi;
 
         if (S_ISLNK(inode->i_mode))
                 inode->i_op = &ecryptfs_symlink_iops;
@@ -853,18 +854,6 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
                 size_t num_zeros = (PAGE_CACHE_SIZE
                                     - (ia->ia_size & ~PAGE_CACHE_MASK));
 
-
-                /*
-                 * XXX(truncate) this should really happen at the begginning
-                 * of ->setattr.  But the code is too messy to that as part
-                 * of a larger patch.  ecryptfs is also totally missing out
-                 * on the inode_change_ok check at the beginning of
-                 * ->setattr while would include this.
-                 */
-                rc = inode_newsize_ok(inode, ia->ia_size);
-                if (rc)
-                        goto out;
-
                 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
                         truncate_setsize(inode, ia->ia_size);
                         lower_ia->ia_size = ia->ia_size;
@@ -914,6 +903,28 @@ out:
         return rc;
 }
 
+static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
+{
+        struct ecryptfs_crypt_stat *crypt_stat;
+        loff_t lower_oldsize, lower_newsize;
+
+        crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
+        lower_oldsize = upper_size_to_lower_size(crypt_stat,
+                                                 i_size_read(inode));
+        lower_newsize = upper_size_to_lower_size(crypt_stat, offset);
+        if (lower_newsize > lower_oldsize) {
+                /*
+                 * The eCryptfs inode and the new *lower* size are mixed here
+                 * because we may not have the lower i_mutex held and/or it may
+                 * not be appropriate to call inode_newsize_ok() with inodes
+                 * from other filesystems.
+                 */
+                return inode_newsize_ok(inode, lower_newsize);
+        }
+
+        return 0;
+}
+
 /**
  * ecryptfs_truncate
  * @dentry: The ecryptfs layer dentry
@@ -930,6 +941,10 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
         struct iattr lower_ia = { .ia_valid = 0 };
         int rc;
 
+        rc = ecryptfs_inode_newsize_ok(dentry->d_inode, new_length);
+        if (rc)
+                return rc;
+
         rc = truncate_upper(dentry, &ia, &lower_ia);
         if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
                 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
@@ -1011,6 +1026,16 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
                 }
         }
         mutex_unlock(&crypt_stat->cs_mutex);
+
+        rc = inode_change_ok(inode, ia);
+        if (rc)
+                goto out;
+        if (ia->ia_valid & ATTR_SIZE) {
+                rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);
+                if (rc)
+                        goto out;
+        }
+
         if (S_ISREG(inode->i_mode)) {
                 rc = filemap_write_and_wait(inode->i_mapping);
                 if (rc)
@@ -1094,6 +1119,8 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
         }
 
         rc = vfs_setxattr(lower_dentry, name, value, size, flags);
+        if (!rc)
+                fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode);
 out:
         return rc;
 }
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 27a7fefb83e..89dc18e7e95 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1868,11 +1868,6 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat,
          * just one will be sufficient to decrypt to get the FEK. */
 find_next_matching_auth_tok:
         found_auth_tok = 0;
-        if (auth_tok_key) {
-                up_write(&(auth_tok_key->sem));
-                key_put(auth_tok_key);
-                auth_tok_key = NULL;
-        }
         list_for_each_entry(auth_tok_list_item, &auth_tok_list, list) {
                 candidate_auth_tok = &auth_tok_list_item->auth_tok;
                 if (unlikely(ecryptfs_verbosity > 0)) {
@@ -1909,14 +1904,22 @@ found_matching_auth_tok:
                 memcpy(&(candidate_auth_tok->token.private_key),
                        &(matching_auth_tok->token.private_key),
                        sizeof(struct ecryptfs_private_key));
+                up_write(&(auth_tok_key->sem));
+                key_put(auth_tok_key);
                 rc = decrypt_pki_encrypted_session_key(candidate_auth_tok,
                                                        crypt_stat);
         } else if (candidate_auth_tok->token_type == ECRYPTFS_PASSWORD) {
                 memcpy(&(candidate_auth_tok->token.password),
                        &(matching_auth_tok->token.password),
                        sizeof(struct ecryptfs_password));
+                up_write(&(auth_tok_key->sem));
+                key_put(auth_tok_key);
                 rc = decrypt_passphrase_encrypted_session_key(
                         candidate_auth_tok, crypt_stat);
+        } else {
+                up_write(&(auth_tok_key->sem));
+                key_put(auth_tok_key);
+                rc = -EINVAL;
         }
         if (rc) {
                 struct ecryptfs_auth_tok_list_item *auth_tok_list_item_tmp;
@@ -1956,15 +1959,12 @@ found_matching_auth_tok:
 out_wipe_list:
         wipe_auth_tok_list(&auth_tok_list);
 out:
-        if (auth_tok_key) {
-                up_write(&(auth_tok_key->sem));
-                key_put(auth_tok_key);
-        }
         return rc;
 }
 
 static int
-pki_encrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
+pki_encrypt_session_key(struct key *auth_tok_key,
+                        struct ecryptfs_auth_tok *auth_tok,
                         struct ecryptfs_crypt_stat *crypt_stat,
                         struct ecryptfs_key_record *key_rec)
 {
@@ -1979,6 +1979,8 @@ pki_encrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
                                          crypt_stat->cipher,
                                          crypt_stat->key_size),
                                  crypt_stat, &payload, &payload_len);
+        up_write(&(auth_tok_key->sem));
+        key_put(auth_tok_key);
         if (rc) {
                 ecryptfs_printk(KERN_ERR, "Error generating tag 66 packet\n");
                 goto out;
@@ -2008,6 +2010,8 @@ out:
  * write_tag_1_packet - Write an RFC2440-compatible tag 1 (public key) packet
  * @dest: Buffer into which to write the packet
  * @remaining_bytes: Maximum number of bytes that can be writtn
+ * @auth_tok_key: The authentication token key to unlock and put when done with
+ *                @auth_tok
  * @auth_tok: The authentication token used for generating the tag 1 packet
  * @crypt_stat: The cryptographic context
  * @key_rec: The key record struct for the tag 1 packet
@@ -2018,7 +2022,7 @@ out:
  */
 static int
 write_tag_1_packet(char *dest, size_t *remaining_bytes,
-                   struct ecryptfs_auth_tok *auth_tok,
+                   struct key *auth_tok_key, struct ecryptfs_auth_tok *auth_tok,
                    struct ecryptfs_crypt_stat *crypt_stat,
                    struct ecryptfs_key_record *key_rec, size_t *packet_size)
 {
@@ -2039,12 +2043,15 @@ write_tag_1_packet(char *dest, size_t *remaining_bytes,
                 memcpy(key_rec->enc_key,
                        auth_tok->session_key.encrypted_key,
                        auth_tok->session_key.encrypted_key_size);
+                up_write(&(auth_tok_key->sem));
+                key_put(auth_tok_key);
                 goto encrypted_session_key_set;
         }
         if (auth_tok->session_key.encrypted_key_size == 0)
                 auth_tok->session_key.encrypted_key_size =
                         auth_tok->token.private_key.key_size;
-        rc = pki_encrypt_session_key(auth_tok, crypt_stat, key_rec);
+        rc = pki_encrypt_session_key(auth_tok_key, auth_tok, crypt_stat,
+                                     key_rec);
         if (rc) {
                 printk(KERN_ERR "Failed to encrypt session key via a key "
                        "module; rc = [%d]\n", rc);
@@ -2421,6 +2428,8 @@ ecryptfs_generate_key_packet_set(char *dest_base,
                                                 &max, auth_tok,
                                                 crypt_stat, key_rec,
                                                 &written);
+                        up_write(&(auth_tok_key->sem));
+                        key_put(auth_tok_key);
                         if (rc) {
                                 ecryptfs_printk(KERN_WARNING, "Error "
                                                 "writing tag 3 packet\n");
@@ -2438,8 +2447,8 @@ ecryptfs_generate_key_packet_set(char *dest_base,
                         }
                         (*len) += written;
                 } else if (auth_tok->token_type == ECRYPTFS_PRIVATE_KEY) {
-                        rc = write_tag_1_packet(dest_base + (*len),
-                                                &max, auth_tok,
+                        rc = write_tag_1_packet(dest_base + (*len), &max,
+                                                auth_tok_key, auth_tok,
                                                 crypt_stat, key_rec, &written);
                         if (rc) {
                                 ecryptfs_printk(KERN_WARNING, "Error "
@@ -2448,14 +2457,13 @@ ecryptfs_generate_key_packet_set(char *dest_base,
                         }
                         (*len) += written;
                 } else {
+                        up_write(&(auth_tok_key->sem));
+                        key_put(auth_tok_key);
                         ecryptfs_printk(KERN_WARNING, "Unsupported "
                                         "authentication token type\n");
                         rc = -EINVAL;
                         goto out_free;
                 }
-                up_write(&(auth_tok_key->sem));
-                key_put(auth_tok_key);
-                auth_tok_key = NULL;
         }
         if (likely(max > 0)) {
                 dest_base[(*len)] = 0x00;
@@ -2468,11 +2476,6 @@ out_free:
 out:
         if (rc)
                 (*len) = 0;
-        if (auth_tok_key) {
-                up_write(&(auth_tok_key->sem));
-                key_put(auth_tok_key);
-        }
-
         mutex_unlock(&crypt_stat->keysig_list_mutex);
         return rc;
 }
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
index 69f994a7d52..0dbe58a8b17 100644
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -149,7 +149,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
         (*lower_file) = dentry_open(lower_dentry, lower_mnt, flags, cred);
         if (!IS_ERR(*lower_file))
                 goto out;
-        if (flags & O_RDONLY) {
+        if ((flags & O_ACCMODE) == O_RDONLY) {
                 rc = PTR_ERR((*lower_file));
                 goto out;
         }
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 9f1bb747d77..b4a6befb121 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -175,6 +175,7 @@ enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig,
        ecryptfs_opt_encrypted_view, ecryptfs_opt_fnek_sig,
        ecryptfs_opt_fn_cipher, ecryptfs_opt_fn_cipher_key_bytes,
        ecryptfs_opt_unlink_sigs, ecryptfs_opt_mount_auth_tok_only,
+       ecryptfs_opt_check_dev_ruid,
        ecryptfs_opt_err };
 
 static const match_table_t tokens = {
@@ -191,6 +192,7 @@ static const match_table_t tokens = {
         {ecryptfs_opt_fn_cipher_key_bytes, "ecryptfs_fn_key_bytes=%u"},
         {ecryptfs_opt_unlink_sigs, "ecryptfs_unlink_sigs"},
         {ecryptfs_opt_mount_auth_tok_only, "ecryptfs_mount_auth_tok_only"},
+        {ecryptfs_opt_check_dev_ruid, "ecryptfs_check_dev_ruid"},
         {ecryptfs_opt_err, NULL}
 };
 
@@ -236,6 +238,7 @@ static void ecryptfs_init_mount_crypt_stat(
  * ecryptfs_parse_options
  * @sb: The ecryptfs super block
  * @options: The options passed to the kernel
+ * @check_ruid: set to 1 if device uid should be checked against the ruid
  *
  * Parse mount options:
  * debug=N         - ecryptfs_verbosity level for debug output
@@ -251,7 +254,8 @@ static void ecryptfs_init_mount_crypt_stat(
  *
  * Returns zero on success; non-zero on error
  */
-static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
+static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options,
+                                  uid_t *check_ruid)
 {
         char *p;
         int rc = 0;
@@ -276,6 +280,8 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
         char *cipher_key_bytes_src;
         char *fn_cipher_key_bytes_src;
 
+        *check_ruid = 0;
+
         if (!options) {
                 rc = -EINVAL;
                 goto out;
@@ -380,6 +386,9 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
                         mount_crypt_stat->flags |=
                                 ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY;
                         break;
+                case ecryptfs_opt_check_dev_ruid:
+                        *check_ruid = 1;
+                        break;
                 case ecryptfs_opt_err:
                 default:
                         printk(KERN_WARNING
@@ -475,6 +484,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
         const char *err = "Getting sb failed";
         struct inode *inode;
         struct path path;
+        uid_t check_ruid;
         int rc;
 
         sbi = kmem_cache_zalloc(ecryptfs_sb_info_cache, GFP_KERNEL);
@@ -483,7 +493,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
                 goto out;
         }
 
-        rc = ecryptfs_parse_options(sbi, raw_data);
+        rc = ecryptfs_parse_options(sbi, raw_data, &check_ruid);
         if (rc) {
                 err = "Error parsing options";
                 goto out;
@@ -521,6 +531,15 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
                         "known incompatibilities\n");
                 goto out_free;
         }
+
+        if (check_ruid && path.dentry->d_inode->i_uid != current_uid()) {
+                rc = -EPERM;
+                printk(KERN_ERR "Mount of device (uid: %d) not owned by "
+                       "requested user (uid: %d)\n",
+                       path.dentry->d_inode->i_uid, current_uid());
+                goto out_free;
+        }
+
         ecryptfs_set_superblock_lower(s, path.dentry->d_sb);
         s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
         s->s_blocksize = path.dentry->d_sb->s_blocksize;
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 940a82e63dc..de42310cd4f 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -49,7 +49,10 @@ ecryptfs_miscdev_poll(struct file *file, poll_table *pt)
         mutex_lock(&ecryptfs_daemon_hash_mux);
         /* TODO: Just use file->private_data? */
         rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
-        BUG_ON(rc || !daemon);
+        if (rc || !daemon) {
+                mutex_unlock(&ecryptfs_daemon_hash_mux);
+                return -EINVAL;
+        }
         mutex_lock(&daemon->mux);
         mutex_unlock(&ecryptfs_daemon_hash_mux);
         if (daemon->flags & ECRYPTFS_DAEMON_ZOMBIE) {
@@ -122,6 +125,7 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
                 goto out_unlock_daemon;
         }
         daemon->flags |= ECRYPTFS_DAEMON_MISCDEV_OPEN;
+        file->private_data = daemon;
         atomic_inc(&ecryptfs_num_miscdev_opens);
 out_unlock_daemon:
         mutex_unlock(&daemon->mux);
@@ -152,9 +156,9 @@ ecryptfs_miscdev_release(struct inode *inode, struct file *file)
 
         mutex_lock(&ecryptfs_daemon_hash_mux);
         rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
-        BUG_ON(rc || !daemon);
+        if (rc || !daemon)
+                daemon = file->private_data;
         mutex_lock(&daemon->mux);
-        BUG_ON(daemon->pid != task_pid(current));
         BUG_ON(!(daemon->flags & ECRYPTFS_DAEMON_MISCDEV_OPEN));
         daemon->flags &= ~ECRYPTFS_DAEMON_MISCDEV_OPEN;
         atomic_dec(&ecryptfs_num_miscdev_opens);
@@ -191,31 +195,32 @@ int ecryptfs_send_miscdev(char *data, size_t data_size,
                           struct ecryptfs_msg_ctx *msg_ctx, u8 msg_type,
                           u16 msg_flags, struct ecryptfs_daemon *daemon)
 {
-        int rc = 0;
+        struct ecryptfs_message *msg;
 
-        mutex_lock(&msg_ctx->mux);
-        msg_ctx->msg = kmalloc((sizeof(*msg_ctx->msg) + data_size),
-                               GFP_KERNEL);
-        if (!msg_ctx->msg) {
-                rc = -ENOMEM;
+        msg = kmalloc((sizeof(*msg) + data_size), GFP_KERNEL);
+        if (!msg) {
                 printk(KERN_ERR "%s: Out of memory whilst attempting "
                        "to kmalloc(%zd, GFP_KERNEL)\n", __func__,
-                       (sizeof(*msg_ctx->msg) + data_size));
-                goto out_unlock;
+                       (sizeof(*msg) + data_size));
+                return -ENOMEM;
         }
+
+        mutex_lock(&msg_ctx->mux);
+        msg_ctx->msg = msg;
         msg_ctx->msg->index = msg_ctx->index;
         msg_ctx->msg->data_len = data_size;
         msg_ctx->type = msg_type;
         memcpy(msg_ctx->msg->data, data, data_size);
         msg_ctx->msg_size = (sizeof(*msg_ctx->msg) + data_size);
-        mutex_lock(&daemon->mux);
         list_add_tail(&msg_ctx->daemon_out_list, &daemon->msg_ctx_out_queue);
+        mutex_unlock(&msg_ctx->mux);
+
+        mutex_lock(&daemon->mux);
         daemon->num_queued_msg_ctx++;
         wake_up_interruptible(&daemon->wait);
         mutex_unlock(&daemon->mux);
-out_unlock:
-        mutex_unlock(&msg_ctx->mux);
-        return rc;
+
+        return 0;
 }
 
 /**
@@ -246,8 +251,16 @@ ecryptfs_miscdev_read(struct file *file, char __user *buf, size_t count,
         mutex_lock(&ecryptfs_daemon_hash_mux);
         /* TODO: Just use file->private_data? */
         rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
-        BUG_ON(rc || !daemon);
+        if (rc || !daemon) {
+                mutex_unlock(&ecryptfs_daemon_hash_mux);
+                return -EINVAL;
+        }
         mutex_lock(&daemon->mux);
+        if (task_pid(current) != daemon->pid) {
+                mutex_unlock(&daemon->mux);
+                mutex_unlock(&ecryptfs_daemon_hash_mux);
+                return -EPERM;
+        }
         if (daemon->flags & ECRYPTFS_DAEMON_ZOMBIE) {
                 rc = 0;
                 mutex_unlock(&ecryptfs_daemon_hash_mux);
@@ -284,9 +297,6 @@ check_list:
                  * message from the queue; try again */
                 goto check_list;
         }
-        BUG_ON(euid != daemon->euid);
-        BUG_ON(current_user_ns() != daemon->user_ns);
-        BUG_ON(task_pid(current) != daemon->pid);
         msg_ctx = list_first_entry(&daemon->msg_ctx_out_queue,
                                    struct ecryptfs_msg_ctx, daemon_out_list);
         BUG_ON(!msg_ctx);
@@ -409,11 +419,47 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
         ssize_t sz = 0;
         char *data;
         uid_t euid = current_euid();
+        unsigned char packet_size_peek[3];
         int rc;
 
-        if (count == 0)
+        if (count == 0) {
                 goto out;
+        } else if (count == (1 + 4)) {
+                /* Likely a harmless MSG_HELO or MSG_QUIT - no packet length */
+                goto memdup;
+        } else if (count < (1 + 4 + 1)
+                   || count > (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
+                               + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES)) {
+                printk(KERN_WARNING "%s: Acceptable packet size range is "
+                       "[%d-%lu], but amount of data written is [%zu].",
+                       __func__, (1 + 4 + 1),
+                       (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
+                        + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES), count);
+                return -EINVAL;
+        }
+
+        if (copy_from_user(packet_size_peek, (buf + 1 + 4),
+                           sizeof(packet_size_peek))) {
+                printk(KERN_WARNING "%s: Error while inspecting packet size\n",
+                       __func__);
+                return -EFAULT;
+        }
+
+        rc = ecryptfs_parse_packet_length(packet_size_peek, &packet_size,
+                                          &packet_size_length);
+        if (rc) {
+                printk(KERN_WARNING "%s: Error parsing packet length; "
+                       "rc = [%d]\n", __func__, rc);
+                return rc;
+        }
 
+        if ((1 + 4 + packet_size_length + packet_size) != count) {
+                printk(KERN_WARNING "%s: Invalid packet size [%zu]\n", __func__,
+                       packet_size);
+                return -EINVAL;
+        }
+
+memdup:
         data = memdup_user(buf, count);
         if (IS_ERR(data)) {
                 printk(KERN_ERR "%s: memdup_user returned error [%ld]\n",
@@ -435,23 +481,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
                 }
                 memcpy(&counter_nbo, &data[i], 4);
                 seq = be32_to_cpu(counter_nbo);
-                i += 4;
-                rc = ecryptfs_parse_packet_length(&data[i], &packet_size,
-                                                  &packet_size_length);
-                if (rc) {
-                        printk(KERN_WARNING "%s: Error parsing packet length; "
-                               "rc = [%d]\n", __func__, rc);
-                        goto out_free;
-                }
-                i += packet_size_length;
-                if ((1 + 4 + packet_size_length + packet_size) != count) {
-                        printk(KERN_WARNING "%s: (1 + packet_size_length([%zd])"
-                               " + packet_size([%zd]))([%zd]) != "
-                               "count([%zd]). Invalid packet format.\n",
-                               __func__, packet_size_length, packet_size,
-                               (1 + packet_size_length + packet_size), count);
-                        goto out_free;
-                }
+                i += 4 + packet_size_length;
                 rc = ecryptfs_miscdev_response(&data[i], packet_size,
                                                euid, current_user_ns(),
                                                task_pid(current), seq);
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index 85d43096311..608c1c3fde1 100644
--- a/fs/ecryptfs/read_write.c
+++ b/fs/ecryptfs/read_write.c
@@ -39,15 +39,16 @@
 int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
                          loff_t offset, size_t size)
 {
-        struct ecryptfs_inode_info *inode_info;
+        struct file *lower_file;
         mm_segment_t fs_save;
         ssize_t rc;
 
-        inode_info = ecryptfs_inode_to_private(ecryptfs_inode);
-        BUG_ON(!inode_info->lower_file);
+        lower_file = ecryptfs_inode_to_private(ecryptfs_inode)->lower_file;
+        if (!lower_file)
+                return -EIO;
         fs_save = get_fs();
         set_fs(get_ds());
-        rc = vfs_write(inode_info->lower_file, data, size, &offset);
+        rc = vfs_write(lower_file, data, size, &offset);
         set_fs(fs_save);
         mark_inode_dirty_sync(ecryptfs_inode);
         return rc;
@@ -129,13 +130,18 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
                 pgoff_t ecryptfs_page_idx = (pos >> PAGE_CACHE_SHIFT);
                 size_t start_offset_in_page = (pos & ~PAGE_CACHE_MASK);
                 size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
-                size_t total_remaining_bytes = ((offset + size) - pos);
+                loff_t total_remaining_bytes = ((offset + size) - pos);
+
+                if (fatal_signal_pending(current)) {
+                        rc = -EINTR;
+                        break;
+                }
 
                 if (num_bytes > total_remaining_bytes)
                         num_bytes = total_remaining_bytes;
                 if (pos < offset) {
                         /* remaining zeros to write, up to destination offset */
-                        size_t total_remaining_zeros = (offset - pos);
+                        loff_t total_remaining_zeros = (offset - pos);
 
                         if (num_bytes > total_remaining_zeros)
                                 num_bytes = total_remaining_zeros;
@@ -192,15 +198,19 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
                 }
                 pos += num_bytes;
         }
-        if ((offset + size) > ecryptfs_file_size) {
-                i_size_write(ecryptfs_inode, (offset + size));
+        if (pos > ecryptfs_file_size) {
+                i_size_write(ecryptfs_inode, pos);
                 if (crypt_stat->flags & ECRYPTFS_ENCRYPTED) {
-                        rc = ecryptfs_write_inode_size_to_metadata(
+                        int rc2;
+
+                        rc2 = ecryptfs_write_inode_size_to_metadata(
                                                                 ecryptfs_inode);
-                        if (rc) {
+                        if (rc2) {
                                 printk(KERN_ERR "Problem with "
                                        "ecryptfs_write_inode_size_to_metadata; "
-                                       "rc = [%d]\n", rc);
+                                       "rc = [%d]\n", rc2);
+                                if (!rc)
+                                        rc = rc2;
                                 goto out;
                         }
                 }
@@ -225,15 +235,16 @@ out:
 int ecryptfs_read_lower(char *data, loff_t offset, size_t size,
                         struct inode *ecryptfs_inode)
 {
-        struct ecryptfs_inode_info *inode_info =
-                ecryptfs_inode_to_private(ecryptfs_inode);
+        struct file *lower_file;
         mm_segment_t fs_save;
         ssize_t rc;
 
-        BUG_ON(!inode_info->lower_file);
+        lower_file = ecryptfs_inode_to_private(ecryptfs_inode)->lower_file;
+        if (!lower_file)
+                return -EIO;
         fs_save = get_fs();
         set_fs(get_ds());
-        rc = vfs_read(inode_info->lower_file, data, size, &offset);
+        rc = vfs_read(lower_file, data, size, &offset);
         set_fs(fs_save);
         return rc;
 }
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index f9cfd168fbe..35a852a2682 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -70,6 +70,15 @@
  * simultaneous inserts (A into B and B into A) from racing and
  * constructing a cycle without either insert observing that it is
  * going to.
+ * It is necessary to acquire multiple "ep->mtx"es at once in the
+ * case when one epoll fd is added to another. In this case, we
+ * always acquire the locks in the order of nesting (i.e. after
+ * epoll_ctl(e1, EPOLL_CTL_ADD, e2), e1->mtx will always be acquired
+ * before e2->mtx). Since we disallow cycles of epoll file
+ * descriptors, this ensures that the mutexes are well-ordered. In
+ * order to communicate this nesting to lockdep, when walking a tree
+ * of epoll file descriptors, we use the current recursion depth as
+ * the lockdep subkey.
  * It is possible to drop the "ep->mtx" and to use the global
  * mutex "epmutex" (together with "ep->lock") to have it working,
  * but having "ep->mtx" will make the interface more scalable.
@@ -188,6 +197,12 @@ struct eventpoll {
 
         /* The user that created the eventpoll descriptor */
         struct user_struct *user;
+
+        struct file *file;
+
+        /* used to optimize loop detection check */
+        int visited;
+        struct list_head visited_list_link;
 };
 
 /* Wait structure used by the poll hooks */
@@ -246,6 +261,15 @@ static struct kmem_cache *epi_cache __read_mostly;
 /* Slab cache used to allocate "struct eppoll_entry" */
 static struct kmem_cache *pwq_cache __read_mostly;
 
+/* Visited nodes during ep_loop_check(), so we can unset them when we finish */
+static LIST_HEAD(visited_list);
+
+/*
+ * List of files with newly added links, where we may need to limit the number
+ * of emanating paths. Protected by the epmutex.
+ */
+static LIST_HEAD(tfile_check_list);
+
 #ifdef CONFIG_SYSCTL
 
 #include <linux/sysctl.h>
@@ -267,6 +291,12 @@ ctl_table epoll_table[] = {
 };
 #endif /* CONFIG_SYSCTL */
 
+static const struct file_operations eventpoll_fops;
+
+static inline int is_file_epoll(struct file *f)
+{
+        return f->f_op == &eventpoll_fops;
+}
 
 /* Setup the structure that is used as key for the RB tree */
 static inline void ep_set_ffd(struct epoll_filefd *ffd,
@@ -290,6 +320,11 @@ static inline int ep_is_linked(struct list_head *p)
         return !list_empty(p);
 }
 
+static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_t *p)
+{
+        return container_of(p, struct eppoll_entry, wait);
+}
+
 /* Get the "struct epitem" from a wait queue pointer */
 static inline struct epitem *ep_item_from_wait(wait_queue_t *p)
 {
@@ -437,6 +472,18 @@ static void ep_poll_safewake(wait_queue_head_t *wq)
         put_cpu();
 }
 
+static void ep_remove_wait_queue(struct eppoll_entry *pwq)
+{
+        wait_queue_head_t *whead;
+
+        rcu_read_lock();
+        /* If it is cleared by POLLFREE, it should be rcu-safe */
+        whead = rcu_dereference(pwq->whead);
+        if (whead)
+                remove_wait_queue(whead, &pwq->wait);
+        rcu_read_unlock();
+}
+
 /*
  * This function unregisters poll callbacks from the associated file
  * descriptor.  Must be called with "mtx" held (or "epmutex" if called from
@@ -451,7 +498,7 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
                 pwq = list_first_entry(lsthead, struct eppoll_entry, llink);
 
                 list_del(&pwq->llink);
-                remove_wait_queue(pwq->whead, &pwq->wait);
+                ep_remove_wait_queue(pwq);
                 kmem_cache_free(pwq_cache, pwq);
         }
 }
@@ -464,13 +511,15 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
  * @ep: Pointer to the epoll private data structure.
  * @sproc: Pointer to the scan callback.
  * @priv: Private opaque data passed to the @sproc callback.
+ * @depth: The current depth of recursive f_op->poll calls.
  *
  * Returns: The same integer error code returned by the @sproc callback.
  */
 static int ep_scan_ready_list(struct eventpoll *ep,
                               int (*sproc)(struct eventpoll *,
                                            struct list_head *, void *),
-                              void *priv)
+                              void *priv,
+                              int depth)
 {
         int error, pwake = 0;
         unsigned long flags;
@@ -481,7 +530,7 @@ static int ep_scan_ready_list(struct eventpoll *ep,
          * We need to lock this because we could be hit by
          * eventpoll_release_file() and epoll_ctl().
          */
-        mutex_lock(&ep->mtx);
+        mutex_lock_nested(&ep->mtx, depth);
 
         /*
          * Steal the ready list, and re-init the original one to the
@@ -670,7 +719,7 @@ static int ep_read_events_proc(struct eventpoll *ep, struct list_head *head,
 
 static int ep_poll_readyevents_proc(void *priv, void *cookie, int call_nests)
 {
-        return ep_scan_ready_list(priv, ep_read_events_proc, NULL);
+        return ep_scan_ready_list(priv, ep_read_events_proc, NULL, call_nests + 1);
 }
 
 static unsigned int ep_eventpoll_poll(struct file *file, poll_table *wait)
@@ -700,12 +749,6 @@ static const struct file_operations eventpoll_fops = {
         .llseek         = noop_llseek,
 };
 
-/* Fast test to see if the file is an evenpoll file */
-static inline int is_file_epoll(struct file *f)
-{
-        return f->f_op == &eventpoll_fops;
-}
-
 /*
  * This is called from eventpoll_release() to unlink files from the eventpoll
  * interface. We need to have this facility to cleanup correctly files that are
@@ -737,7 +780,7 @@ void eventpoll_release_file(struct file *file)
 
                 ep = epi->ep;
                 list_del_init(&epi->fllink);
-                mutex_lock(&ep->mtx);
+                mutex_lock_nested(&ep->mtx, 0);
                 ep_remove(ep, epi);
                 mutex_unlock(&ep->mtx);
         }
@@ -816,6 +859,17 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
         struct epitem *epi = ep_item_from_wait(wait);
         struct eventpoll *ep = epi->ep;
 
+        if ((unsigned long)key & POLLFREE) {
+                ep_pwq_from_wait(wait)->whead = NULL;
+                /*
+                 * whead = NULL above can race with ep_remove_wait_queue()
+                 * which can do another remove_wait_queue() after us, so we
+                 * can't use __remove_wait_queue(). whead->lock is held by
+                 * the caller.
+                 */
+                list_del_init(&wait->task_list);
+        }
+
         spin_lock_irqsave(&ep->lock, flags);
 
         /*
@@ -915,6 +969,103 @@ static void ep_rbtree_insert(struct eventpoll *ep, struct epitem *epi)
         rb_insert_color(&epi->rbn, &ep->rbr);
 }
 
+
+
+#define PATH_ARR_SIZE 5
+/*
+ * These are the number paths of length 1 to 5, that we are allowing to emanate
+ * from a single file of interest. For example, we allow 1000 paths of length
+ * 1, to emanate from each file of interest. This essentially represents the
+ * potential wakeup paths, which need to be limited in order to avoid massive
+ * uncontrolled wakeup storms. The common use case should be a single ep which
+ * is connected to n file sources. In this case each file source has 1 path
+ * of length 1. Thus, the numbers below should be more than sufficient. These
+ * path limits are enforced during an EPOLL_CTL_ADD operation, since a modify
+ * and delete can't add additional paths. Protected by the epmutex.
+ */
+static const int path_limits[PATH_ARR_SIZE] = { 1000, 500, 100, 50, 10 };
+static int path_count[PATH_ARR_SIZE];
+
+static int path_count_inc(int nests)
+{
+        /* Allow an arbitrary number of depth 1 paths */
+        if (nests == 0)
+                return 0;
+
+        if (++path_count[nests] > path_limits[nests])
+                return -1;
+        return 0;
+}
+
+static void path_count_init(void)
+{
+        int i;
+
+        for (i = 0; i < PATH_ARR_SIZE; i++)
+                path_count[i] = 0;
+}
+
+static int reverse_path_check_proc(void *priv, void *cookie, int call_nests)
+{
+        int error = 0;
+        struct file *file = priv;
+        struct file *child_file;
+        struct epitem *epi;
+
+        list_for_each_entry(epi, &file->f_ep_links, fllink) {
+                child_file = epi->ep->file;
+                if (is_file_epoll(child_file)) {
+                        if (list_empty(&child_file->f_ep_links)) {
+                                if (path_count_inc(call_nests)) {
+                                        error = -1;
+                                        break;
+                                }
+                        } else {
+                                error = ep_call_nested(&poll_loop_ncalls,
+                                                        EP_MAX_NESTS,
+                                                        reverse_path_check_proc,
+                                                        child_file, child_file,
+                                                        current);
+                        }
+                        if (error != 0)
+                                break;
+                } else {
+                        printk(KERN_ERR "reverse_path_check_proc: "
+                                "file is not an ep!\n");
+                }
+        }
+        return error;
+}
+
+/**
+ * reverse_path_check - The tfile_check_list is list of file *, which have
+ *                      links that are proposed to be newly added. We need to
+ *                      make sure that those added links don't add too many
+ *                      paths such that we will spend all our time waking up
+ *                      eventpoll objects.
+ *
+ * Returns: Returns zero if the proposed links don't create too many paths,
+ *          -1 otherwise.
+ */
+static int reverse_path_check(void)
+{
+        int length = 0;
+        int error = 0;
+        struct file *current_file;
+
+        /* let's call this for all tfiles */
+        list_for_each_entry(current_file, &tfile_check_list, f_tfile_llink) {
+                length++;
+                path_count_init();
+                error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+                                        reverse_path_check_proc, current_file,
+                                        current_file, current);
+                if (error)
+                        break;
+        }
+        return error;
+}
+
 /*
  * Must be called with "mtx" held.
  */
@@ -976,6 +1127,11 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
          */
         ep_rbtree_insert(ep, epi);
 
+        /* now check if we've created too many backpaths */
+        error = -EINVAL;
+        if (reverse_path_check())
+                goto error_remove_epi;
+
         /* We have to drop the new item inside our item list to keep track of it */
         spin_lock_irqsave(&ep->lock, flags);
 
@@ -1000,6 +1156,14 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
 
         return 0;
 
+error_remove_epi:
+        spin_lock(&tfile->f_lock);
+        if (ep_is_linked(&epi->fllink))
+                list_del_init(&epi->fllink);
+        spin_unlock(&tfile->f_lock);
+
+        rb_erase(&epi->rbn, &ep->rbr);
+
 error_unregister:
         ep_unregister_pollwait(ep, epi);
 
@@ -1134,7 +1298,7 @@ static int ep_send_events(struct eventpoll *ep,
         esed.maxevents = maxevents;
         esed.events = events;
 
-        return ep_scan_ready_list(ep, ep_send_events_proc, &esed);
+        return ep_scan_ready_list(ep, ep_send_events_proc, &esed, 0);
 }
 
 static inline struct timespec ep_set_mstimeout(long ms)
@@ -1264,18 +1428,36 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
         int error = 0;
         struct file *file = priv;
         struct eventpoll *ep = file->private_data;
+        struct eventpoll *ep_tovisit;
         struct rb_node *rbp;
         struct epitem *epi;
 
-        mutex_lock(&ep->mtx);
+        mutex_lock_nested(&ep->mtx, call_nests + 1);
+        ep->visited = 1;
+        list_add(&ep->visited_list_link, &visited_list);
         for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
                 epi = rb_entry(rbp, struct epitem, rbn);
                 if (unlikely(is_file_epoll(epi->ffd.file))) {
+                        ep_tovisit = epi->ffd.file->private_data;
+                        if (ep_tovisit->visited)
+                                continue;
                         error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
-                                               ep_loop_check_proc, epi->ffd.file,
-                                               epi->ffd.file->private_data, current);
+                                        ep_loop_check_proc, epi->ffd.file,
+                                        ep_tovisit, current);
                         if (error != 0)
                                 break;
+                } else {
+                        /*
+                         * If we've reached a file that is not associated with
+                         * an ep, then we need to check if the newly added
+                         * links are going to add too many wakeup paths. We do
+                         * this by adding it to the tfile_check_list, if it's
+                         * not already there, and calling reverse_path_check()
+                         * during ep_insert().
+                         */
+                        if (list_empty(&epi->ffd.file->f_tfile_llink))
+                                list_add(&epi->ffd.file->f_tfile_llink,
+                                         &tfile_check_list);
                 }
         }
         mutex_unlock(&ep->mtx);
@@ -1296,8 +1478,31 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
  */
 static int ep_loop_check(struct eventpoll *ep, struct file *file)
 {
-        return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+        int ret;
+        struct eventpoll *ep_cur, *ep_next;
+
+        ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
                               ep_loop_check_proc, file, ep, current);
+        /* clear visited list */
+        list_for_each_entry_safe(ep_cur, ep_next, &visited_list,
+                                                        visited_list_link) {
+                ep_cur->visited = 0;
+                list_del(&ep_cur->visited_list_link);
+        }
+        return ret;
+}
+
+static void clear_tfile_check_list(void)
+{
+        struct file *file;
+
+        /* first clear the tfile_check_list */
+        while (!list_empty(&tfile_check_list)) {
+                file = list_first_entry(&tfile_check_list, struct file,
+                                        f_tfile_llink);
+                list_del_init(&file->f_tfile_llink);
+        }
+        INIT_LIST_HEAD(&tfile_check_list);
 }
 
 /*
@@ -1305,8 +1510,9 @@ static int ep_loop_check(struct eventpoll *ep, struct file *file)
  */
 SYSCALL_DEFINE1(epoll_create1, int, flags)
 {
-        int error;
+        int error, fd;
         struct eventpoll *ep = NULL;
+        struct file *file;
 
         /* Check the EPOLL_* constant for consistency.  */
         BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
@@ -1323,11 +1529,25 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
          * Creates all the items needed to setup an eventpoll file. That is,
          * a file structure and a free file descriptor.
          */
-        error = anon_inode_getfd("[eventpoll]", &eventpoll_fops, ep,
+        fd = get_unused_fd_flags(O_RDWR | (flags & O_CLOEXEC));
+        if (fd < 0) {
+                error = fd;
+                goto out_free_ep;
+        }
+        file = anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep,
                                  O_RDWR | (flags & O_CLOEXEC));
-        if (error < 0)
-                ep_free(ep);
-
+        if (IS_ERR(file)) {
+                error = PTR_ERR(file);
+                goto out_free_fd;
+        }
+        fd_install(fd, file);
+        ep->file = file;
+        return fd;
+
+out_free_fd:
+        put_unused_fd(fd);
+out_free_ep:
+        ep_free(ep);
         return error;
 }
 
@@ -1393,23 +1613,29 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
         /*
          * When we insert an epoll file descriptor, inside another epoll file
          * descriptor, there is the change of creating closed loops, which are
-         * better be handled here, than in more critical paths.
+         * better be handled here, than in more critical paths. While we are
+         * checking for loops we also determine the list of files reachable
+         * and hang them on the tfile_check_list, so we can check that we
+         * haven't created too many possible wakeup paths.
          *
-         * We hold epmutex across the loop check and the insert in this case, in
-         * order to prevent two separate inserts from racing and each doing the
-         * insert "at the same time" such that ep_loop_check passes on both
-         * before either one does the insert, thereby creating a cycle.
+         * We need to hold the epmutex across both ep_insert and ep_remove
+         * b/c we want to make sure we are looking at a coherent view of
+         * epoll network.
          */
-        if (unlikely(is_file_epoll(tfile) && op == EPOLL_CTL_ADD)) {
+        if (op == EPOLL_CTL_ADD || op == EPOLL_CTL_DEL) {
                 mutex_lock(&epmutex);
                 did_lock_epmutex = 1;
-                error = -ELOOP;
-                if (ep_loop_check(ep, tfile) != 0)
-                        goto error_tgt_fput;
+        }
+        if (op == EPOLL_CTL_ADD) {
+                if (is_file_epoll(tfile)) {
+                        error = -ELOOP;
+                        if (ep_loop_check(ep, tfile) != 0)
+                                goto error_tgt_fput;
+                } else
+                        list_add(&tfile->f_tfile_llink, &tfile_check_list);
         }
 
-
-        mutex_lock(&ep->mtx);
+        mutex_lock_nested(&ep->mtx, 0);
 
         /*
          * Try to lookup the file inside our RB tree, Since we grabbed "mtx"
@@ -1426,6 +1652,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                         error = ep_insert(ep, &epds, tfile, fd);
                 } else
                         error = -EEXIST;
+                clear_tfile_check_list();
                 break;
         case EPOLL_CTL_DEL:
                 if (epi)
@@ -1444,7 +1671,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
         mutex_unlock(&ep->mtx);
 
 error_tgt_fput:
-        if (unlikely(did_lock_epmutex))
+        if (did_lock_epmutex)
                 mutex_unlock(&epmutex);
 
         fput(tfile);
diff --git a/fs/exec.c b/fs/exec.c
index 99845622986..188d5974f3e 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1413,6 +1413,8 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
                             printable(bprm->buf[2]) &&
                             printable(bprm->buf[3]))
                                 break; /* -ENOEXEC */
+                        if (try)
+                                break; /* -ENOEXEC */
                         request_module("binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
 #endif
                 }
diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c
index bfc2dc43681..0b3da7cc8ab 100644
--- a/fs/ext3/ialloc.c
+++ b/fs/ext3/ialloc.c
@@ -561,8 +561,12 @@ got:
         if (IS_DIRSYNC(inode))
                 handle->h_sync = 1;
         if (insert_inode_locked(inode) < 0) {
-                err = -EINVAL;
-                goto fail_drop;
+                /*
+                 * Likely a bitmap corruption causing inode to be allocated
+                 * twice.
+                 */
+                err = -EIO;
+                goto fail;
         }
         spin_lock(&sbi->s_next_gen_lock);
         inode->i_generation = sbi->s_next_generation++;
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 3451d23c3ba..db9ba1a3f7f 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1568,7 +1568,13 @@ static int ext3_ordered_writepage(struct page *page,
         int err;
 
         J_ASSERT(PageLocked(page));
-        WARN_ON_ONCE(IS_RDONLY(inode));
+        /*
+         * We don't want to warn for emergency remount. The condition is
+         * ordered to avoid dereferencing inode->i_sb in non-error case to
+         * avoid slow-downs.
+         */
+        WARN_ON_ONCE(IS_RDONLY(inode) &&
+                     !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
 
         /*
          * We give up here if we're reentered, because it might be for a
@@ -1642,7 +1648,13 @@ static int ext3_writeback_writepage(struct page *page,
         int err;
 
         J_ASSERT(PageLocked(page));
-        WARN_ON_ONCE(IS_RDONLY(inode));
+        /*
+         * We don't want to warn for emergency remount. The condition is
+         * ordered to avoid dereferencing inode->i_sb in non-error case to
+         * avoid slow-downs.
+         */
+        WARN_ON_ONCE(IS_RDONLY(inode) &&
+                     !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
 
         if (ext3_journal_current_handle())
                 goto out_fail;
@@ -1684,7 +1696,13 @@ static int ext3_journalled_writepage(struct page *page,
         int err;
 
         J_ASSERT(PageLocked(page));
-        WARN_ON_ONCE(IS_RDONLY(inode));
+        /*
+         * We don't want to warn for emergency remount. The condition is
+         * ordered to avoid dereferencing inode->i_sb in non-error case to
+         * avoid slow-downs.
+         */
+        WARN_ON_ONCE(IS_RDONLY(inode) &&
+                     !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
 
         if (ext3_journal_current_handle())
                 goto no_write;
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 34b6d9bfc48..e5a71111cb3 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -2210,9 +2210,11 @@ static int ext3_symlink (struct inode * dir,
                 /*
                  * For non-fast symlinks, we just allocate inode and put it on
                  * orphan list in the first transaction => we need bitmap,
-                 * group descriptor, sb, inode block, quota blocks.
+                 * group descriptor, sb, inode block, quota blocks, and
+                 * possibly selinux xattr blocks.
                  */
-                credits = 4 + EXT3_MAXQUOTAS_INIT_BLOCKS(dir->i_sb);
+                credits = 4 + EXT3_MAXQUOTAS_INIT_BLOCKS(dir->i_sb) +
+                          EXT3_XATTR_TRANS_BLOCKS;
         } else {
                 /*
                  * Fast symlink. We have to add entry to directory
diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
index 32e6cc23bd9..d565759d82e 100644
--- a/fs/ext3/xattr.c
+++ b/fs/ext3/xattr.c
@@ -803,8 +803,16 @@ inserted:
                         /* We need to allocate a new block */
                         ext3_fsblk_t goal = ext3_group_first_block_no(sb,
                                                 EXT3_I(inode)->i_block_group);
-                        ext3_fsblk_t block = ext3_new_block(handle, inode,
-                                                        goal, &error);
+                        ext3_fsblk_t block;
+
+                        /*
+                         * Protect us agaist concurrent allocations to the
+                         * same inode from ext3_..._writepage(). Reservation
+                         * code does not expect racing allocations.
+                         */
+                        mutex_lock(&EXT3_I(inode)->truncate_mutex);
+                        block = ext3_new_block(handle, inode, goal, &error);
+                        mutex_unlock(&EXT3_I(inode)->truncate_mutex);
                         if (error)
                                 goto cleanup;
                         ea_idebug(inode, "creating block %d", block);
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 264f6949511..ebe95f56514 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -514,7 +514,8 @@ ext4_fsblk_t ext4_count_free_blocks(struct super_block *sb)
                 if (bitmap_bh == NULL)
                         continue;
 
-                x = ext4_count_free(bitmap_bh, sb->s_blocksize);
+                x = ext4_count_free(bitmap_bh->b_data,
+                                    EXT4_BLOCKS_PER_GROUP(sb) / 8);
                 printk(KERN_DEBUG "group %u: stored = %d, counted = %u\n",
                         i, ext4_free_blks_count(sb, gdp), x);
                 bitmap_count += x;
diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c
index fa3af81ac56..012faaaec4a 100644
--- a/fs/ext4/bitmap.c
+++ b/fs/ext4/bitmap.c
@@ -15,15 +15,13 @@
 
 static const int nibblemap[] = {4, 3, 3, 2, 3, 2, 2, 1, 3, 2, 2, 1, 2, 1, 1, 0};
 
-unsigned int ext4_count_free(struct buffer_head *map, unsigned int numchars)
+unsigned int ext4_count_free(char *bitmap, unsigned int numchars)
 {
         unsigned int i, sum = 0;
 
-        if (!map)
-                return 0;
         for (i = 0; i < numchars; i++)
-                sum += nibblemap[map->b_data[i] & 0xf] +
-                        nibblemap[(map->b_data[i] >> 4) & 0xf];
+                sum += nibblemap[bitmap[i] & 0xf] +
+                        nibblemap[(bitmap[i] >> 4) & 0xf];
         return sum;
 }
 
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 1921392cd70..e0113aa0d3a 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -175,6 +175,7 @@ struct mpage_da_data {
  */
 #define EXT4_IO_END_UNWRITTEN   0x0001
 #define EXT4_IO_END_ERROR       0x0002
+#define EXT4_IO_END_QUEUED      0x0004
 
 struct ext4_io_page {
         struct page     *p_page;
@@ -357,8 +358,7 @@ struct flex_groups {
 
 /* Flags that should be inherited by new inodes from their parent. */
 #define EXT4_FL_INHERITED (EXT4_SECRM_FL | EXT4_UNRM_FL | EXT4_COMPR_FL |\
-                           EXT4_SYNC_FL | EXT4_IMMUTABLE_FL | EXT4_APPEND_FL |\
-                           EXT4_NODUMP_FL | EXT4_NOATIME_FL |\
+                           EXT4_SYNC_FL | EXT4_NODUMP_FL | EXT4_NOATIME_FL |\
                            EXT4_NOCOMPR_FL | EXT4_JOURNAL_DATA_FL |\
                            EXT4_NOTAIL_FL | EXT4_DIRSYNC_FL)
 
@@ -526,6 +526,7 @@ struct ext4_new_group_data {
 #define EXT4_FREE_BLOCKS_METADATA       0x0001
 #define EXT4_FREE_BLOCKS_FORGET         0x0002
 #define EXT4_FREE_BLOCKS_VALIDATED      0x0004
+#define EXT4_FREE_BLOCKS_NO_QUOT_UPDATE 0x0008
 
 /*
  * ioctl commands
@@ -1712,7 +1713,7 @@ struct mmpd_data {
 # define NORET_AND      noreturn,
 
 /* bitmap.c */
-extern unsigned int ext4_count_free(struct buffer_head *, unsigned);
+extern unsigned int ext4_count_free(char *bitmap, unsigned numchars);
 
 /* balloc.c */
 extern unsigned int ext4_block_group(struct super_block *sb,
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index bb85757689b..95af6f87850 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -261,43 +261,45 @@ static inline void ext4_update_inode_fsync_trans(handle_t *handle,
 /* super.c */
 int ext4_force_commit(struct super_block *sb);
 
-static inline int ext4_should_journal_data(struct inode *inode)
+/*
+ * Ext4 inode journal modes
+ */
+#define EXT4_INODE_JOURNAL_DATA_MODE    0x01 /* journal data mode */
+#define EXT4_INODE_ORDERED_DATA_MODE    0x02 /* ordered data mode */
+#define EXT4_INODE_WRITEBACK_DATA_MODE  0x04 /* writeback data mode */
+
+static inline int ext4_inode_journal_mode(struct inode *inode)
 {
         if (EXT4_JOURNAL(inode) == NULL)
-                return 0;
-        if (!S_ISREG(inode->i_mode))
-                return 1;
-        if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)
-                return 1;
-        if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA))
-                return 1;
-        return 0;
+                return EXT4_INODE_WRITEBACK_DATA_MODE;  /* writeback */
+        /* We do not support data journalling with delayed allocation */
+        if (!S_ISREG(inode->i_mode) ||
+            test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)
+                return EXT4_INODE_JOURNAL_DATA_MODE;    /* journal data */
+        if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA) &&
+            !test_opt(inode->i_sb, DELALLOC))
+                return EXT4_INODE_JOURNAL_DATA_MODE;    /* journal data */
+        if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA)
+                return EXT4_INODE_ORDERED_DATA_MODE;    /* ordered */
+        if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)
+                return EXT4_INODE_WRITEBACK_DATA_MODE;  /* writeback */
+        else
+                BUG();
+}
+
+static inline int ext4_should_journal_data(struct inode *inode)
+{
+        return ext4_inode_journal_mode(inode) & EXT4_INODE_JOURNAL_DATA_MODE;
 }
 
 static inline int ext4_should_order_data(struct inode *inode)
 {
-        if (EXT4_JOURNAL(inode) == NULL)
-                return 0;
-        if (!S_ISREG(inode->i_mode))
-                return 0;
-        if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA))
-                return 0;
-        if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA)
-                return 1;
-        return 0;
+        return ext4_inode_journal_mode(inode) & EXT4_INODE_ORDERED_DATA_MODE;
 }
 
 static inline int ext4_should_writeback_data(struct inode *inode)
 {
-        if (!S_ISREG(inode->i_mode))
-                return 0;
-        if (EXT4_JOURNAL(inode) == NULL)
-                return 1;
-        if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA))
-                return 0;
-        if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)
-                return 1;
-        return 0;
+        return ext4_inode_journal_mode(inode) & EXT4_INODE_WRITEBACK_DATA_MODE;
 }
 
 /*
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index f815cc81e7a..611647b28a4 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -341,6 +341,8 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
         ext4_fsblk_t block = ext4_ext_pblock(ext);
         int len = ext4_ext_get_actual_len(ext);
 
+        if (len == 0)
+                return 0;
         return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
 }
 
@@ -2844,7 +2846,7 @@ static int ext4_split_extent_at(handle_t *handle,
                 if (err)
                         goto fix_extent_len;
                 /* update the extent length and mark as initialized */
-                ex->ee_len = cpu_to_le32(ee_len);
+                ex->ee_len = cpu_to_le16(ee_len);
                 ext4_ext_try_to_merge(inode, path, ex);
                 err = ext4_ext_dirty(handle, inode, path + depth);
                 goto out;
@@ -3596,17 +3598,18 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
         }
 
         err = check_eofblocks_fl(handle, inode, map->m_lblk, path, ar.len);
-        if (err)
-                goto out2;
-
-        err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
+        if (!err)
+                err = ext4_ext_insert_extent(handle, inode, path,
+                                             &newex, flags);
         if (err) {
+                int fb_flags = flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE ?
+                        EXT4_FREE_BLOCKS_NO_QUOT_UPDATE : 0;
                 /* free data blocks we just allocated */
                 /* not a good idea to call discard here directly,
                  * but otherwise we'd need to call it every free() */
                 ext4_discard_preallocations(inode);
                 ext4_free_blocks(handle, inode, NULL, ext4_ext_pblock(&newex),
-                                 ext4_ext_get_actual_len(&newex), 0);
+                                 ext4_ext_get_actual_len(&newex), fb_flags);
                 goto out2;
         }
 
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 21bb2f61e50..29272de3023 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -1021,8 +1021,12 @@ got:
         if (IS_DIRSYNC(inode))
                 ext4_handle_sync(handle);
         if (insert_inode_locked(inode) < 0) {
-                err = -EINVAL;
-                goto fail_drop;
+                /*
+                 * Likely a bitmap corruption causing inode to be allocated
+                 * twice.
+                 */
+                err = -EIO;
+                goto fail;
         }
         spin_lock(&sbi->s_next_gen_lock);
         inode->i_generation = sbi->s_next_generation++;
@@ -1189,7 +1193,8 @@ unsigned long ext4_count_free_inodes(struct super_block *sb)
                 if (!bitmap_bh)
                         continue;
 
-                x = ext4_count_free(bitmap_bh, EXT4_INODES_PER_GROUP(sb) / 8);
+                x = ext4_count_free(bitmap_bh->b_data,
+                                    EXT4_INODES_PER_GROUP(sb) / 8);
                 printk(KERN_DEBUG "group %lu: stored = %d, counted = %lu\n",
                         (unsigned long) i, ext4_free_inodes_count(sb, gdp), x);
                 bitmap_count += x;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index e3126c05100..00a5acdd654 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -189,6 +189,9 @@ void ext4_evict_inode(struct inode *inode)
         int err;
 
         trace_ext4_evict_inode(inode);
+
+        ext4_ioend_wait(inode);
+
         if (inode->i_nlink) {
                 truncate_inode_pages(&inode->i_data, 0);
                 goto no_delete;
@@ -1131,6 +1134,15 @@ void ext4_da_update_reserve_space(struct inode *inode,
                 used = ei->i_reserved_data_blocks;
         }
 
+        if (unlikely(ei->i_allocated_meta_blocks > ei->i_reserved_meta_blocks)) {
+                ext4_msg(inode->i_sb, KERN_NOTICE, "%s: ino %lu, allocated %d "
+                         "with only %d reserved metadata blocks\n", __func__,
+                         inode->i_ino, ei->i_allocated_meta_blocks,
+                         ei->i_reserved_meta_blocks);
+                WARN_ON(1);
+                ei->i_allocated_meta_blocks = ei->i_reserved_meta_blocks;
+        }
+
         /* Update per-inode reservations */
         ei->i_reserved_data_blocks -= used;
         ei->i_reserved_meta_blocks -= ei->i_allocated_meta_blocks;
@@ -1849,6 +1861,8 @@ static int ext4_journalled_write_end(struct file *file,
         from = pos & (PAGE_CACHE_SIZE - 1);
         to = from + len;
 
+        BUG_ON(!ext4_handle_valid(handle));
+
         if (copied < len) {
                 if (!PageUptodate(page))
                         copied = 0;
@@ -2121,8 +2135,11 @@ static int mpage_da_submit_io(struct mpage_da_data *mpd,
                                         clear_buffer_unwritten(bh);
                                 }
 
-                                /* skip page if block allocation undone */
-                                if (buffer_delay(bh) || buffer_unwritten(bh))
+                                /*
+                                 * skip page if block allocation undone and
+                                 * block is dirty
+                                 */
+                                if (ext4_bh_delay_or_unwritten(NULL, bh))
                                         skip_page = 1;
                                 bh = bh->b_this_page;
                                 block_start += bh->b_size;
@@ -2148,7 +2165,12 @@ static int mpage_da_submit_io(struct mpage_da_data *mpd,
                         else if (test_opt(inode->i_sb, MBLK_IO_SUBMIT))
                                 err = ext4_bio_write_page(&io_submit, page,
                                                           len, mpd->wbc);
-                        else
+                        else if (buffer_uninit(page_bufs)) {
+                                ext4_set_bh_endio(page_bufs, inode);
+                                err = block_write_full_page_endio(page,
+                                        noalloc_get_block_write,
+                                        mpd->wbc, ext4_end_io_buffer_write);
+                        } else
                                 err = block_write_full_page(page,
                                         noalloc_get_block_write, mpd->wbc);
 
@@ -2564,6 +2586,8 @@ static int __ext4_journalled_writepage(struct page *page,
                 goto out;
         }
 
+        BUG_ON(!ext4_handle_valid(handle));
+
         ret = walk_page_buffers(handle, page_bufs, 0, len, NULL,
                                 do_journal_get_write_access);
 
@@ -2663,8 +2687,12 @@ static int ext4_writepage(struct page *page,
                  * We don't want to do block allocation, so redirty
                  * the page and return.  We may reach here when we do
                  * a journal commit via journal_submit_inode_data_buffers.
-                 * We can also reach here via shrink_page_list
+                 * We can also reach here via shrink_page_list but it
+                 * should never be for direct reclaim so warn if that
+                 * happens
                  */
+                WARN_ON_ONCE((current->flags & (PF_MEMALLOC|PF_KSWAPD)) ==
+                                                                PF_MEMALLOC);
                 goto redirty_page;
         }
         if (commit_write)
@@ -2741,7 +2769,7 @@ static int write_cache_pages_da(struct address_space *mapping,
         index = wbc->range_start >> PAGE_CACHE_SHIFT;
         end = wbc->range_end >> PAGE_CACHE_SHIFT;
 
-        if (wbc->sync_mode == WB_SYNC_ALL)
+        if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
                 tag = PAGECACHE_TAG_TOWRITE;
         else
                 tag = PAGECACHE_TAG_DIRTY;
@@ -2973,7 +3001,7 @@ static int ext4_da_writepages(struct address_space *mapping,
         }
 
 retry:
-        if (wbc->sync_mode == WB_SYNC_ALL)
+        if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
                 tag_pages_for_writeback(mapping, index, end);
 
         while (!ret && wbc->nr_to_write > 0) {
@@ -3093,7 +3121,7 @@ static int ext4_nonda_switch(struct super_block *sb)
          * start pushing delalloc when 1/2 of free blocks are dirty.
          */
         if (free_blocks < 2 * dirty_blocks)
-                writeback_inodes_sb_if_idle(sb);
+                writeback_inodes_sb_if_idle(sb, WB_REASON_FS_FREE_SPACE);
 
         return 0;
 }
@@ -3197,13 +3225,14 @@ static int ext4_da_write_end(struct file *file,
         int write_mode = (int)(unsigned long)fsdata;
 
         if (write_mode == FALL_BACK_TO_NONDELALLOC) {
-                if (ext4_should_order_data(inode)) {
+                switch (ext4_inode_journal_mode(inode)) {
+                case EXT4_INODE_ORDERED_DATA_MODE:
                         return ext4_ordered_write_end(file, mapping, pos,
                                         len, copied, page, fsdata);
-                } else if (ext4_should_writeback_data(inode)) {
+                case EXT4_INODE_WRITEBACK_DATA_MODE:
                         return ext4_writeback_write_end(file, mapping, pos,
                                         len, copied, page, fsdata);
-                } else {
+                default:
                         BUG();
                 }
         }
@@ -3219,7 +3248,7 @@ static int ext4_da_write_end(struct file *file,
          */
 
         new_i_size = pos + copied;
-        if (new_i_size > EXT4_I(inode)->i_disksize) {
+        if (copied && new_i_size > EXT4_I(inode)->i_disksize) {
                 if (ext4_da_should_update_i_disksize(page, end)) {
                         down_write(&EXT4_I(inode)->i_data_sem);
                         if (new_i_size > EXT4_I(inode)->i_disksize) {
@@ -3495,12 +3524,17 @@ static ssize_t ext4_ind_direct_IO(int rw, struct kiocb *iocb,
         }
 
 retry:
-        if (rw == READ && ext4_should_dioread_nolock(inode))
+        if (rw == READ && ext4_should_dioread_nolock(inode)) {
+                if (unlikely(!list_empty(&ei->i_completed_io_list))) {
+                        mutex_lock(&inode->i_mutex);
+                        ext4_flush_completed_IO(inode);
+                        mutex_unlock(&inode->i_mutex);
+                }
                 ret = __blockdev_direct_IO(rw, iocb, inode,
                                  inode->i_sb->s_bdev, iov,
                                  offset, nr_segs,
                                  ext4_get_block, NULL, NULL, 0);
-        else {
+        } else {
                 ret = blockdev_direct_IO(rw, iocb, inode,
                                  inode->i_sb->s_bdev, iov,
                                  offset, nr_segs,
@@ -3635,8 +3669,15 @@ static void ext4_end_io_buffer_write(struct buffer_head *bh, int uptodate)
                 goto out;
         }
 
-        io_end->flag = EXT4_IO_END_UNWRITTEN;
+        /*
+         * It may be over-defensive here to check EXT4_IO_END_UNWRITTEN now,
+         * but being more careful is always safe for the future change.
+         */
         inode = io_end->inode;
+        if (!(io_end->flag & EXT4_IO_END_UNWRITTEN)) {
+                io_end->flag |= EXT4_IO_END_UNWRITTEN;
+                atomic_inc(&EXT4_I(inode)->i_aiodio_unwritten);
+        }
 
         /* Add the io_end to per-inode completed io list*/
         spin_lock_irqsave(&EXT4_I(inode)->i_completed_io_lock, flags);
@@ -3891,18 +3932,25 @@ static const struct address_space_operations ext4_da_aops = {
 
 void ext4_set_aops(struct inode *inode)
 {
-        if (ext4_should_order_data(inode) &&
-                test_opt(inode->i_sb, DELALLOC))
-                inode->i_mapping->a_ops = &ext4_da_aops;
-        else if (ext4_should_order_data(inode))
-                inode->i_mapping->a_ops = &ext4_ordered_aops;
-        else if (ext4_should_writeback_data(inode) &&
-                 test_opt(inode->i_sb, DELALLOC))
-                inode->i_mapping->a_ops = &ext4_da_aops;
-        else if (ext4_should_writeback_data(inode))
-                inode->i_mapping->a_ops = &ext4_writeback_aops;
-        else
+        switch (ext4_inode_journal_mode(inode)) {
+        case EXT4_INODE_ORDERED_DATA_MODE:
+                if (test_opt(inode->i_sb, DELALLOC))
+                        inode->i_mapping->a_ops = &ext4_da_aops;
+                else
+                        inode->i_mapping->a_ops = &ext4_ordered_aops;
+                break;
+        case EXT4_INODE_WRITEBACK_DATA_MODE:
+                if (test_opt(inode->i_sb, DELALLOC))
+                        inode->i_mapping->a_ops = &ext4_da_aops;
+                else
+                        inode->i_mapping->a_ops = &ext4_writeback_aops;
+                break;
+        case EXT4_INODE_JOURNAL_DATA_MODE:
                 inode->i_mapping->a_ops = &ext4_journalled_aops;
+                break;
+        default:
+                BUG();
+        }
 }
 
 /*
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 808c554e773..4cbe1c2c996 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -35,7 +35,7 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 handle_t *handle = NULL;
                 int err, migrate = 0;
                 struct ext4_iloc iloc;
-                unsigned int oldflags;
+                unsigned int oldflags, mask, i;
                 unsigned int jflag;
 
                 if (!inode_owner_or_capable(inode))
@@ -112,9 +112,14 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 if (err)
                         goto flags_err;
 
-                flags = flags & EXT4_FL_USER_MODIFIABLE;
-                flags |= oldflags & ~EXT4_FL_USER_MODIFIABLE;
-                ei->i_flags = flags;
+                for (i = 0, mask = 1; i < 32; i++, mask <<= 1) {
+                        if (!(mask & EXT4_FL_USER_MODIFIABLE))
+                                continue;
+                        if (mask & flags)
+                                ext4_set_inode_flag(inode, i);
+                        else
+                                ext4_clear_inode_flag(inode, i);
+                }
 
                 ext4_set_inode_flags(inode);
                 inode->i_ctime = ext4_current_time(inode);
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 6ed859d5685..b6adf68a5c0 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2528,6 +2528,9 @@ int ext4_mb_release(struct super_block *sb)
         struct ext4_sb_info *sbi = EXT4_SB(sb);
         struct kmem_cache *cachep = get_groupinfo_cache(sb->s_blocksize_bits);
 
+        if (sbi->s_proc)
+                remove_proc_entry("mb_groups", sbi->s_proc);
+
         if (sbi->s_group_info) {
                 for (i = 0; i < ngroups; i++) {
                         grinfo = ext4_get_group_info(sb, i);
@@ -2575,8 +2578,6 @@ int ext4_mb_release(struct super_block *sb)
         }
 
         free_percpu(sbi->s_locality_groups);
-        if (sbi->s_proc)
-                remove_proc_entry("mb_groups", sbi->s_proc);
 
         return 0;
 }
@@ -4583,6 +4584,7 @@ do_more:
                  */
                 new_entry = kmem_cache_alloc(ext4_free_ext_cachep, GFP_NOFS);
                 if (!new_entry) {
+                        ext4_mb_unload_buddy(&e4b);
                         err = -ENOMEM;
                         goto error_return;
                 }
@@ -4637,7 +4639,7 @@ do_more:
         }
         ext4_mark_super_dirty(sb);
 error_return:
-        if (freed)
+        if (freed && !(flags & EXT4_FREE_BLOCKS_NO_QUOT_UPDATE))
                 dquot_free_block(inode, freed);
         brelse(bitmap_bh);
         ext4_std_error(sb, err);
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index b754b7721f5..3d36d5a1e19 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1589,7 +1589,7 @@ static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
                         dxtrace(dx_show_index("node", frames[1].entries));
                         dxtrace(dx_show_index("node",
                                ((struct dx_node *) bh2->b_data)->entries));
-                        err = ext4_handle_dirty_metadata(handle, inode, bh2);
+                        err = ext4_handle_dirty_metadata(handle, dir, bh2);
                         if (err)
                                 goto journal_error;
                         brelse (bh2);
@@ -1615,7 +1615,7 @@ static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
                         if (err)
                                 goto journal_error;
                 }
-                err = ext4_handle_dirty_metadata(handle, inode, frames[0].bh);
+                err = ext4_handle_dirty_metadata(handle, dir, frames[0].bh);
                 if (err) {
                         ext4_std_error(inode->i_sb, err);
                         goto cleanup;
@@ -1866,7 +1866,7 @@ retry:
         ext4_set_de_type(dir->i_sb, de, S_IFDIR);
         inode->i_nlink = 2;
         BUFFER_TRACE(dir_block, "call ext4_handle_dirty_metadata");
-        err = ext4_handle_dirty_metadata(handle, dir, dir_block);
+        err = ext4_handle_dirty_metadata(handle, inode, dir_block);
         if (err)
                 goto out_clear_inode;
         err = ext4_mark_inode_dirty(handle, inode);
@@ -2264,9 +2264,11 @@ static int ext4_symlink(struct inode *dir,
                 /*
                  * For non-fast symlinks, we just allocate inode and put it on
                  * orphan list in the first transaction => we need bitmap,
-                 * group descriptor, sb, inode block, quota blocks.
+                 * group descriptor, sb, inode block, quota blocks, and
+                 * possibly selinux xattr blocks.
                  */
-                credits = 4 + EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb);
+                credits = 4 + EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb) +
+                          EXT4_XATTR_TRANS_BLOCKS;
         } else {
                 /*
                  * Fast symlink. We have to add entry to directory
@@ -2538,7 +2540,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
                 PARENT_INO(dir_bh->b_data, new_dir->i_sb->s_blocksize) =
                                                 cpu_to_le32(new_dir->i_ino);
                 BUFFER_TRACE(dir_bh, "call ext4_handle_dirty_metadata");
-                retval = ext4_handle_dirty_metadata(handle, old_dir, dir_bh);
+                retval = ext4_handle_dirty_metadata(handle, old_inode, dir_bh);
                 if (retval) {
                         ext4_std_error(old_dir->i_sb, retval);
                         goto end_rename;
diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
index 7bb8f76d470..d99d74aca8a 100644
--- a/fs/ext4/page-io.c
+++ b/fs/ext4/page-io.c
@@ -142,7 +142,23 @@ static void ext4_end_io_work(struct work_struct *work)
         unsigned long           flags;
         int                     ret;
 
-        mutex_lock(&inode->i_mutex);
+        if (!mutex_trylock(&inode->i_mutex)) {
+                /*
+                 * Requeue the work instead of waiting so that the work
+                 * items queued after this can be processed.
+                 */
+                queue_work(EXT4_SB(inode->i_sb)->dio_unwritten_wq, &io->work);
+                /*
+                 * To prevent the ext4-dio-unwritten thread from keeping
+                 * requeueing end_io requests and occupying cpu for too long,
+                 * yield the cpu if it sees an end_io request that has already
+                 * been requeued.
+                 */
+                if (io->flag & EXT4_IO_END_QUEUED)
+                        yield();
+                io->flag |= EXT4_IO_END_QUEUED;
+                return;
+        }
         ret = ext4_end_io_nolock(io);
         if (ret < 0) {
                 mutex_unlock(&inode->i_mutex);
@@ -338,8 +354,10 @@ submit_and_retry:
         if ((io_end->num_io_pages >= MAX_IO_PAGES) &&
             (io_end->pages[io_end->num_io_pages-1] != io_page))
                 goto submit_and_retry;
-        if (buffer_uninit(bh))
-                io->io_end->flag |= EXT4_IO_END_UNWRITTEN;
+        if (buffer_uninit(bh) && !(io_end->flag & EXT4_IO_END_UNWRITTEN)) {
+                io_end->flag |= EXT4_IO_END_UNWRITTEN;
+                atomic_inc(&EXT4_I(inode)->i_aiodio_unwritten);
+        }
         io->io_end->size += bh->b_size;
         io->io_next_block++;
         ret = bio_add_page(io->io_bio, bh->b_page, bh->b_size, bh_offset(bh));
@@ -387,6 +405,18 @@ int ext4_bio_write_page(struct ext4_io_submit *io,
 
                 block_end = block_start + blocksize;
                 if (block_start >= len) {
+                        /*
+                         * Comments copied from block_write_full_page_endio:
+                         *
+                         * The page straddles i_size.  It must be zeroed out on
+                         * each and every writepage invocation because it may
+                         * be mmapped.  "A file is mapped in multiples of the
+                         * page size.  For a file that is not a multiple of
+                         * the  page size, the remaining memory is zeroed when
+                         * mapped, and writes to that region are not written
+                         * out to the file."
+                         */
+                        zero_user_segment(page, block_start, block_end);
                         clear_buffer_dirty(bh);
                         set_buffer_uptodate(bh);
                         continue;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 9ea71aa864b..489d406c0d7 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -433,6 +433,7 @@ void __ext4_error(struct super_block *sb, const char *function,
         printk(KERN_CRIT "EXT4-fs error (device %s): %s:%d: comm %s: %pV\n",
                sb->s_id, function, line, current->comm, &vaf);
         va_end(args);
+        save_error_info(sb, function, line);
 
         ext4_handle_error(sb);
 }
@@ -859,6 +860,7 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
         ei->i_reserved_meta_blocks = 0;
         ei->i_allocated_meta_blocks = 0;
         ei->i_da_metadata_calc_len = 0;
+        ei->i_da_metadata_calc_last_lblock = 0;
         spin_lock_init(&(ei->i_block_reservation_lock));
 #ifdef CONFIG_QUOTA
         ei->i_reserved_quota = 0;
@@ -892,7 +894,6 @@ static void ext4_i_callback(struct rcu_head *head)
 
 static void ext4_destroy_inode(struct inode *inode)
 {
-        ext4_ioend_wait(inode);
         if (!list_empty(&(EXT4_I(inode)->i_orphan))) {
                 ext4_msg(inode->i_sb, KERN_ERR,
                          "Inode %lu (%p): orphan list check failed!",
@@ -1114,9 +1115,9 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
                 seq_puts(seq, ",block_validity");
 
         if (!test_opt(sb, INIT_INODE_TABLE))
-                seq_puts(seq, ",noinit_inode_table");
+                seq_puts(seq, ",noinit_itable");
         else if (sbi->s_li_wait_mult != EXT4_DEF_LI_WAIT_MULT)
-                seq_printf(seq, ",init_inode_table=%u",
+                seq_printf(seq, ",init_itable=%u",
                            (unsigned) sbi->s_li_wait_mult);
 
         ext4_show_quota_options(seq, sb);
@@ -1292,8 +1293,7 @@ enum {
         Opt_nomblk_io_submit, Opt_block_validity, Opt_noblock_validity,
         Opt_inode_readahead_blks, Opt_journal_ioprio,
         Opt_dioread_nolock, Opt_dioread_lock,
-        Opt_discard, Opt_nodiscard,
-        Opt_init_inode_table, Opt_noinit_inode_table,
+        Opt_discard, Opt_nodiscard, Opt_init_itable, Opt_noinit_itable,
 };
 
 static const match_table_t tokens = {
@@ -1366,9 +1366,9 @@ static const match_table_t tokens = {
         {Opt_dioread_lock, "dioread_lock"},
         {Opt_discard, "discard"},
         {Opt_nodiscard, "nodiscard"},
-        {Opt_init_inode_table, "init_itable=%u"},
-        {Opt_init_inode_table, "init_itable"},
-        {Opt_noinit_inode_table, "noinit_itable"},
+        {Opt_init_itable, "init_itable=%u"},
+        {Opt_init_itable, "init_itable"},
+        {Opt_noinit_itable, "noinit_itable"},
         {Opt_err, NULL},
 };
 
@@ -1845,7 +1845,7 @@ set_qf_format:
                 case Opt_dioread_lock:
                         clear_opt(sb, DIOREAD_NOLOCK);
                         break;
-                case Opt_init_inode_table:
+                case Opt_init_itable:
                         set_opt(sb, INIT_INODE_TABLE);
                         if (args[0].from) {
                                 if (match_int(&args[0], &option))
@@ -1856,7 +1856,7 @@ set_qf_format:
                                 return 0;
                         sbi->s_li_wait_mult = option;
                         break;
-                case Opt_noinit_inode_table:
+                case Opt_noinit_itable:
                         clear_opt(sb, INIT_INODE_TABLE);
                         break;
                 default:
@@ -1959,17 +1959,16 @@ static int ext4_fill_flex_info(struct super_block *sb)
         struct ext4_group_desc *gdp = NULL;
         ext4_group_t flex_group_count;
         ext4_group_t flex_group;
-        int groups_per_flex = 0;
+        unsigned int groups_per_flex = 0;
         size_t size;
         int i;
 
         sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
-        groups_per_flex = 1 << sbi->s_log_groups_per_flex;
-
-        if (groups_per_flex < 2) {
+        if (sbi->s_log_groups_per_flex < 1 || sbi->s_log_groups_per_flex > 31) {
                 sbi->s_log_groups_per_flex = 0;
                 return 1;
         }
+        groups_per_flex = 1 << sbi->s_log_groups_per_flex;
 
         /* We allocate both existing and potentially added groups */
         flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) +
@@ -3621,7 +3620,8 @@ no_journal:
                 goto failed_mount4;
         }
 
-        ext4_setup_super(sb, es, sb->s_flags & MS_RDONLY);
+        if (ext4_setup_super(sb, es, sb->s_flags & MS_RDONLY))
+                sb->s_flags |= MS_RDONLY;
 
         /* determine the minimum size of new large inodes, if present */
         if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE) {
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index c757adc9725..c2865cc3101 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -487,18 +487,19 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
                 ext4_free_blocks(handle, inode, bh, 0, 1,
                                  EXT4_FREE_BLOCKS_METADATA |
                                  EXT4_FREE_BLOCKS_FORGET);
+                unlock_buffer(bh);
         } else {
                 le32_add_cpu(&BHDR(bh)->h_refcount, -1);
+                if (ce)
+                        mb_cache_entry_release(ce);
+                unlock_buffer(bh);
                 error = ext4_handle_dirty_metadata(handle, inode, bh);
                 if (IS_SYNC(inode))
                         ext4_handle_sync(handle);
                 dquot_free_block(inode, 1);
                 ea_bdebug(bh, "refcount now=%d; releasing",
                           le32_to_cpu(BHDR(bh)->h_refcount));
-                if (ce)
-                        mb_cache_entry_release(ce);
         }
-        unlock_buffer(bh);
 out:
         ext4_std_error(inode->i_sb, error);
         return;
@@ -820,8 +821,14 @@ inserted:
                         if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
                                 goal = goal & EXT4_MAX_BLOCK_FILE_PHYS;
 
+                        /*
+                         * take i_data_sem because we will test
+                         * i_delalloc_reserved_flag in ext4_mb_new_blocks
+                         */
+                        down_read((&EXT4_I(inode)->i_data_sem));
                         block = ext4_new_meta_blocks(handle, inode, goal, 0,
                                                      NULL, &error);
+                        up_read((&EXT4_I(inode)->i_data_sem));
                         if (error)
                                 goto cleanup;
 
diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 4ad64732cbc..dc563788fa8 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -754,6 +754,13 @@ static int fat_ioctl_readdir(struct inode *inode, struct file *filp,
         return ret;
 }
 
+static int fat_ioctl_volume_id(struct inode *dir)
+{
+        struct super_block *sb = dir->i_sb;
+        struct msdos_sb_info *sbi = MSDOS_SB(sb);
+        return sbi->vol_id;
+}
+
 static long fat_dir_ioctl(struct file *filp, unsigned int cmd,
                           unsigned long arg)
 {
@@ -770,6 +777,8 @@ static long fat_dir_ioctl(struct file *filp, unsigned int cmd,
                 short_only = 0;
                 both = 1;
                 break;
+        case VFAT_IOCTL_GET_VOLUME_ID:
+                return fat_ioctl_volume_id(inode);
         default:
                 return fat_generic_ioctl(filp, cmd, arg);
         }
diff --git a/fs/fat/fat.h b/fs/fat/fat.h
index 8276cc282de..74fe5d3ed01 100644
--- a/fs/fat/fat.h
+++ b/fs/fat/fat.h
@@ -78,6 +78,7 @@ struct msdos_sb_info {
         const void *dir_ops;                 /* Opaque; default directory operations */
         int dir_per_block;           /* dir entries per block */
         int dir_per_block_bits;      /* log2(dir_per_block) */
+        unsigned long vol_id;        /* volume ID */
 
         int fatent_shift;
         struct fatent_operations *fatent_ops;
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index cb8d8391ac0..9836839e0eb 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -1245,6 +1245,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
         struct inode *root_inode = NULL, *fat_inode = NULL;
         struct buffer_head *bh;
         struct fat_boot_sector *b;
+        struct fat_boot_bsx *bsx;
         struct msdos_sb_info *sbi;
         u16 logical_sector_size;
         u32 total_sectors, total_clusters, fat_clusters, rootdir_sectors;
@@ -1390,6 +1391,8 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
                         goto out_fail;
                 }
 
+                bsx = (struct fat_boot_bsx *)(bh->b_data + FAT32_BSX_OFFSET);
+
                 fsinfo = (struct fat_boot_fsinfo *)fsinfo_bh->b_data;
                 if (!IS_FSINFO(fsinfo)) {
                         fat_msg(sb, KERN_WARNING, "Invalid FSINFO signature: "
@@ -1405,8 +1408,14 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
                 }
 
                 brelse(fsinfo_bh);
+        } else {
+                bsx = (struct fat_boot_bsx *)(bh->b_data + FAT16_BSX_OFFSET);
         }
 
+        /* interpret volume ID as a little endian 32 bit integer */
+        sbi->vol_id = (((u32)bsx->vol_id[0]) | ((u32)bsx->vol_id[1] << 8) |
+                ((u32)bsx->vol_id[2] << 16) | ((u32)bsx->vol_id[3] << 24));
+
         sbi->dir_per_block = sb->s_blocksize / sizeof(struct msdos_dir_entry);
         sbi->dir_per_block_bits = ffs(sbi->dir_per_block) - 1;
 
diff --git a/fs/fifo.c b/fs/fifo.c
index b1a524d798e..cf6f4345ceb 100644
--- a/fs/fifo.c
+++ b/fs/fifo.c
@@ -14,7 +14,7 @@
 #include <linux/sched.h>
 #include <linux/pipe_fs_i.h>
 
-static void wait_for_partner(struct inode* inode, unsigned int *cnt)
+static int wait_for_partner(struct inode* inode, unsigned int *cnt)
 {
         int cur = *cnt; 
 
@@ -23,6 +23,7 @@ static void wait_for_partner(struct inode* inode, unsigned int *cnt)
                 if (signal_pending(current))
                         break;
         }
+        return cur == *cnt ? -ERESTARTSYS : 0;
 }
 
 static void wake_up_partner(struct inode* inode)
@@ -67,8 +68,7 @@ static int fifo_open(struct inode *inode, struct file *filp)
                                  * seen a writer */
                                 filp->f_version = pipe->w_counter;
                         } else {
-                                wait_for_partner(inode, &pipe->w_counter);
-                                if(signal_pending(current))
+                                if (wait_for_partner(inode, &pipe->w_counter))
                                         goto err_rd;
                         }
                 }
@@ -90,8 +90,7 @@ static int fifo_open(struct inode *inode, struct file *filp)
                         wake_up_partner(inode);
 
                 if (!pipe->readers) {
-                        wait_for_partner(inode, &pipe->r_counter);
-                        if (signal_pending(current))
+                        if (wait_for_partner(inode, &pipe->r_counter))
                                 goto err_wr;
                 }
                 break;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 0f015a0468d..73c3992b2bb 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -35,15 +35,29 @@
 struct wb_writeback_work {
         long nr_pages;
         struct super_block *sb;
+        unsigned long *older_than_this;
         enum writeback_sync_modes sync_mode;
+        unsigned int tagged_writepages:1;
         unsigned int for_kupdate:1;
         unsigned int range_cyclic:1;
         unsigned int for_background:1;
+        enum wb_reason reason;          /* why was writeback initiated? */
 
         struct list_head list;          /* pending work list */
         struct completion *done;        /* set if the caller waits */
 };
 
+const char *wb_reason_name[] = {
+        [WB_REASON_BACKGROUND]          = "background",
+        [WB_REASON_TRY_TO_FREE_PAGES]   = "try_to_free_pages",
+        [WB_REASON_SYNC]                = "sync",
+        [WB_REASON_PERIODIC]            = "periodic",
+        [WB_REASON_LAPTOP_TIMER]        = "laptop_timer",
+        [WB_REASON_FREE_MORE_MEM]       = "free_more_memory",
+        [WB_REASON_FS_FREE_SPACE]       = "fs_free_space",
+        [WB_REASON_FORKER_THREAD]       = "forker_thread"
+};
+
 /*
  * Include the creation of the trace points after defining the
  * wb_writeback_work structure so that the definition remains local to this
@@ -113,7 +127,7 @@ static void bdi_queue_work(struct backing_dev_info *bdi,
 
 static void
 __bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages,
-                      bool range_cyclic)
+                      bool range_cyclic, enum wb_reason reason)
 {
         struct wb_writeback_work *work;
 
@@ -133,6 +147,7 @@ __bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages,
         work->sync_mode = WB_SYNC_NONE;
         work->nr_pages  = nr_pages;
         work->range_cyclic = range_cyclic;
+        work->reason    = reason;
 
         bdi_queue_work(bdi, work);
 }
@@ -148,9 +163,10 @@ __bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages,
  *   completion. Caller need not hold sb s_umount semaphore.
  *
  */
-void bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages)
+void bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages,
+                        enum wb_reason reason)
 {
-        __bdi_start_writeback(bdi, nr_pages, true);
+        __bdi_start_writeback(bdi, nr_pages, true, reason);
 }
 
 /**
@@ -180,12 +196,13 @@ void bdi_start_background_writeback(struct backing_dev_info *bdi)
  */
 void inode_wb_list_del(struct inode *inode)
 {
-        spin_lock(&inode_wb_list_lock);
+        struct backing_dev_info *bdi = inode_to_bdi(inode);
+
+        spin_lock(&bdi->wb.list_lock);
         list_del_init(&inode->i_wb_list);
-        spin_unlock(&inode_wb_list_lock);
+        spin_unlock(&bdi->wb.list_lock);
 }
 
-
 /*
  * Redirty an inode: set its when-it-was dirtied timestamp and move it to the
  * furthest end of its superblock's dirty-inode list.
@@ -195,11 +212,9 @@ void inode_wb_list_del(struct inode *inode)
  * the case then the inode must have been redirtied while it was being written
  * out and we don't reset its dirtied_when.
  */
-static void redirty_tail(struct inode *inode)
+static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
 {
-        struct bdi_writeback *wb = &inode_to_bdi(inode)->wb;
-
-        assert_spin_locked(&inode_wb_list_lock);
+        assert_spin_locked(&wb->list_lock);
         if (!list_empty(&wb->b_dirty)) {
                 struct inode *tail;
 
@@ -213,11 +228,9 @@ static void redirty_tail(struct inode *inode)
 /*
  * requeue inode for re-scanning after bdi->b_io list is exhausted.
  */
-static void requeue_io(struct inode *inode)
+static void requeue_io(struct inode *inode, struct bdi_writeback *wb)
 {
-        struct bdi_writeback *wb = &inode_to_bdi(inode)->wb;
-
-        assert_spin_locked(&inode_wb_list_lock);
+        assert_spin_locked(&wb->list_lock);
         list_move(&inode->i_wb_list, &wb->b_more_io);
 }
 
@@ -225,7 +238,7 @@ static void inode_sync_complete(struct inode *inode)
 {
         /*
          * Prevent speculative execution through
-         * spin_unlock(&inode_wb_list_lock);
+         * spin_unlock(&wb->list_lock);
          */
 
         smp_mb();
@@ -250,31 +263,33 @@ static bool inode_dirtied_after(struct inode *inode, unsigned long t)
 /*
  * Move expired dirty inodes from @delaying_queue to @dispatch_queue.
  */
-static void move_expired_inodes(struct list_head *delaying_queue,
+static int move_expired_inodes(struct list_head *delaying_queue,
                                struct list_head *dispatch_queue,
-                                unsigned long *older_than_this)
+                               struct wb_writeback_work *work)
 {
         LIST_HEAD(tmp);
         struct list_head *pos, *node;
         struct super_block *sb = NULL;
         struct inode *inode;
         int do_sb_sort = 0;
+        int moved = 0;
 
         while (!list_empty(delaying_queue)) {
                 inode = wb_inode(delaying_queue->prev);
-                if (older_than_this &&
-                    inode_dirtied_after(inode, *older_than_this))
+                if (work->older_than_this &&
+                    inode_dirtied_after(inode, *work->older_than_this))
                         break;
                 if (sb && sb != inode->i_sb)
                         do_sb_sort = 1;
                 sb = inode->i_sb;
                 list_move(&inode->i_wb_list, &tmp);
+                moved++;
         }
 
         /* just one sb in list, splice to dispatch_queue and we're done */
         if (!do_sb_sort) {
                 list_splice(&tmp, dispatch_queue);
-                return;
+                goto out;
         }
 
         /* Move inodes from one superblock together */
@@ -286,6 +301,8 @@ static void move_expired_inodes(struct list_head *delaying_queue,
                                 list_move(&inode->i_wb_list, dispatch_queue);
                 }
         }
+out:
+        return moved;
 }
 
 /*
@@ -299,11 +316,13 @@ static void move_expired_inodes(struct list_head *delaying_queue,
  *                                           |
  *                                           +--> dequeue for IO
  */
-static void queue_io(struct bdi_writeback *wb, unsigned long *older_than_this)
+static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work)
 {
-        assert_spin_locked(&inode_wb_list_lock);
+        int moved;
+        assert_spin_locked(&wb->list_lock);
         list_splice_init(&wb->b_more_io, &wb->b_io);
-        move_expired_inodes(&wb->b_dirty, &wb->b_io, older_than_this);
+        moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, work);
+        trace_writeback_queue_io(wb, work, moved);
 }
 
 static int write_inode(struct inode *inode, struct writeback_control *wbc)
@@ -316,7 +335,8 @@ static int write_inode(struct inode *inode, struct writeback_control *wbc)
 /*
  * Wait for writeback on an inode to complete.
  */
-static void inode_wait_for_writeback(struct inode *inode)
+static void inode_wait_for_writeback(struct inode *inode,
+                                     struct bdi_writeback *wb)
 {
         DEFINE_WAIT_BIT(wq, &inode->i_state, __I_SYNC);
         wait_queue_head_t *wqh;
@@ -324,15 +344,15 @@ static void inode_wait_for_writeback(struct inode *inode)
         wqh = bit_waitqueue(&inode->i_state, __I_SYNC);
         while (inode->i_state & I_SYNC) {
                 spin_unlock(&inode->i_lock);
-                spin_unlock(&inode_wb_list_lock);
+                spin_unlock(&wb->list_lock);
                 __wait_on_bit(wqh, &wq, inode_wait, TASK_UNINTERRUPTIBLE);
-                spin_lock(&inode_wb_list_lock);
+                spin_lock(&wb->list_lock);
                 spin_lock(&inode->i_lock);
         }
 }
 
 /*
- * Write out an inode's dirty pages.  Called under inode_wb_list_lock and
+ * Write out an inode's dirty pages.  Called under wb->list_lock and
  * inode->i_lock.  Either the caller has an active reference on the inode or
  * the inode has I_WILL_FREE set.
  *
@@ -343,13 +363,15 @@ static void inode_wait_for_writeback(struct inode *inode)
  * livelocks, etc.
  */
 static int
-writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
+writeback_single_inode(struct inode *inode, struct bdi_writeback *wb,
+                       struct writeback_control *wbc)
 {
         struct address_space *mapping = inode->i_mapping;
+        long nr_to_write = wbc->nr_to_write;
         unsigned dirty;
         int ret;
 
-        assert_spin_locked(&inode_wb_list_lock);
+        assert_spin_locked(&wb->list_lock);
         assert_spin_locked(&inode->i_lock);
 
         if (!atomic_read(&inode->i_count))
@@ -367,14 +389,16 @@ writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
                  * completed a full scan of b_io.
                  */
                 if (wbc->sync_mode != WB_SYNC_ALL) {
-                        requeue_io(inode);
+                        requeue_io(inode, wb);
+                        trace_writeback_single_inode_requeue(inode, wbc,
+                                                             nr_to_write);
                         return 0;
                 }
 
                 /*
                  * It's a data-integrity sync.  We must wait.
                  */
-                inode_wait_for_writeback(inode);
+                inode_wait_for_writeback(inode, wb);
         }
 
         BUG_ON(inode->i_state & I_SYNC);
@@ -383,7 +407,7 @@ writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
         inode->i_state |= I_SYNC;
         inode->i_state &= ~I_DIRTY_PAGES;
         spin_unlock(&inode->i_lock);
-        spin_unlock(&inode_wb_list_lock);
+        spin_unlock(&wb->list_lock);
 
         ret = do_writepages(mapping, wbc);
 
@@ -414,10 +438,19 @@ writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
                         ret = err;
         }
 
-        spin_lock(&inode_wb_list_lock);
+        spin_lock(&wb->list_lock);
         spin_lock(&inode->i_lock);
         inode->i_state &= ~I_SYNC;
         if (!(inode->i_state & I_FREEING)) {
+                /*
+                 * Sync livelock prevention. Each inode is tagged and synced in
+                 * one shot. If still dirty, it will be redirty_tail()'ed below.
+                 * Update the dirty time to prevent enqueue and sync it again.
+                 */
+                if ((inode->i_state & I_DIRTY) &&
+                    (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages))
+                        inode->dirtied_when = jiffies;
+
                 if (mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) {
                         /*
                          * We didn't write back all the pages.  nfs_writepages()
@@ -428,7 +461,7 @@ writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
                                 /*
                                  * slice used up: queue for next turn
                                  */
-                                requeue_io(inode);
+                                requeue_io(inode, wb);
                         } else {
                                 /*
                                  * Writeback blocked by something other than
@@ -437,7 +470,7 @@ writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
                                  * retrying writeback of the dirty page/inode
                                  * that cannot be performed immediately.
                                  */
-                                redirty_tail(inode);
+                                redirty_tail(inode, wb);
                         }
                 } else if (inode->i_state & I_DIRTY) {
                         /*
@@ -446,7 +479,7 @@ writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
                          * submission or metadata updates after data IO
                          * completion.
                          */
-                        redirty_tail(inode);
+                        redirty_tail(inode, wb);
                 } else {
                         /*
                          * The inode is clean.  At this point we either have
@@ -457,33 +490,39 @@ writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
                 }
         }
         inode_sync_complete(inode);
+        trace_writeback_single_inode(inode, wbc, nr_to_write);
         return ret;
 }
 
-/*
- * For background writeback the caller does not have the sb pinned
- * before calling writeback. So make sure that we do pin it, so it doesn't
- * go away while we are writing inodes from it.
- */
-static bool pin_sb_for_writeback(struct super_block *sb)
+static long writeback_chunk_size(struct backing_dev_info *bdi,
+                                 struct wb_writeback_work *work)
 {
-        spin_lock(&sb_lock);
-        if (list_empty(&sb->s_instances)) {
-                spin_unlock(&sb_lock);
-                return false;
-        }
+        long pages;
 
-        sb->s_count++;
-        spin_unlock(&sb_lock);
-
-        if (down_read_trylock(&sb->s_umount)) {
-                if (sb->s_root)
-                        return true;
-                up_read(&sb->s_umount);
+        /*
+         * WB_SYNC_ALL mode does livelock avoidance by syncing dirty
+         * inodes/pages in one big loop. Setting wbc.nr_to_write=LONG_MAX
+         * here avoids calling into writeback_inodes_wb() more than once.
+         *
+         * The intended call sequence for WB_SYNC_ALL writeback is:
+         *
+         *      wb_writeback()
+         *          writeback_sb_inodes()       <== called only once
+         *              write_cache_pages()     <== called once for each inode
+         *                   (quickly) tag currently dirty pages
+         *                   (maybe slowly) sync all tagged pages
+         */
+        if (work->sync_mode == WB_SYNC_ALL || work->tagged_writepages)
+                pages = LONG_MAX;
+        else {
+                pages = min(bdi->avg_write_bandwidth / 2,
+                            global_dirty_limit / DIRTY_SCOPE);
+                pages = min(pages, work->nr_pages);
+                pages = round_down(pages + MIN_WRITEBACK_PAGES,
+                                   MIN_WRITEBACK_PAGES);
         }
 
-        put_super(sb);
-        return false;
+        return pages;
 }
 
 /*
@@ -493,24 +532,36 @@ static bool pin_sb_for_writeback(struct super_block *sb)
  * inodes. Otherwise write only ones which go sequentially
  * in reverse order.
  *
- * Return 1, if the caller writeback routine should be
- * interrupted. Otherwise return 0.
+ * Return the number of pages and/or inodes written.
  */
-static int writeback_sb_inodes(struct super_block *sb, struct bdi_writeback *wb,
-                struct writeback_control *wbc, bool only_this_sb)
+static long writeback_sb_inodes(struct super_block *sb,
+                                struct bdi_writeback *wb,
+                                struct wb_writeback_work *work)
 {
+        struct writeback_control wbc = {
+                .sync_mode              = work->sync_mode,
+                .tagged_writepages      = work->tagged_writepages,
+                .for_kupdate            = work->for_kupdate,
+                .for_background         = work->for_background,
+                .range_cyclic           = work->range_cyclic,
+                .range_start            = 0,
+                .range_end              = LLONG_MAX,
+        };
+        unsigned long start_time = jiffies;
+        long write_chunk;
+        long wrote = 0;  /* count both pages and inodes */
+
         while (!list_empty(&wb->b_io)) {
-                long pages_skipped;
                 struct inode *inode = wb_inode(wb->b_io.prev);
 
                 if (inode->i_sb != sb) {
-                        if (only_this_sb) {
+                        if (work->sb) {
                                 /*
                                  * We only want to write back data for this
                                  * superblock, move all inodes not belonging
                                  * to it back onto the dirty list.
                                  */
-                                redirty_tail(inode);
+                                redirty_tail(inode, wb);
                                 continue;
                         }
 
@@ -519,7 +570,7 @@ static int writeback_sb_inodes(struct super_block *sb, struct bdi_writeback *wb,
                          * Bounce back to the caller to unpin this and
                          * pin the next superblock.
                          */
-                        return 0;
+                        break;
                 }
 
                 /*
@@ -530,104 +581,124 @@ static int writeback_sb_inodes(struct super_block *sb, struct bdi_writeback *wb,
                 spin_lock(&inode->i_lock);
                 if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) {
                         spin_unlock(&inode->i_lock);
-                        requeue_io(inode);
+                        redirty_tail(inode, wb);
                         continue;
                 }
-
-                /*
-                 * Was this inode dirtied after sync_sb_inodes was called?
-                 * This keeps sync from extra jobs and livelock.
-                 */
-                if (inode_dirtied_after(inode, wbc->wb_start)) {
-                        spin_unlock(&inode->i_lock);
-                        return 1;
-                }
-
                 __iget(inode);
+                write_chunk = writeback_chunk_size(wb->bdi, work);
+                wbc.nr_to_write = write_chunk;
+                wbc.pages_skipped = 0;
+
+                writeback_single_inode(inode, wb, &wbc);
 
-                pages_skipped = wbc->pages_skipped;
-                writeback_single_inode(inode, wbc);
-                if (wbc->pages_skipped != pages_skipped) {
+                work->nr_pages -= write_chunk - wbc.nr_to_write;
+                wrote += write_chunk - wbc.nr_to_write;
+                if (!(inode->i_state & I_DIRTY))
+                        wrote++;
+                if (wbc.pages_skipped) {
                         /*
                          * writeback is not making progress due to locked
                          * buffers.  Skip this inode for now.
                          */
-                        redirty_tail(inode);
+                        redirty_tail(inode, wb);
                 }
                 spin_unlock(&inode->i_lock);
-                spin_unlock(&inode_wb_list_lock);
+                spin_unlock(&wb->list_lock);
                 iput(inode);
                 cond_resched();
-                spin_lock(&inode_wb_list_lock);
-                if (wbc->nr_to_write <= 0) {
-                        wbc->more_io = 1;
-                        return 1;
+                spin_lock(&wb->list_lock);
+                /*
+                 * bail out to wb_writeback() often enough to check
+                 * background threshold and other termination conditions.
+                 */
+                if (wrote) {
+                        if (time_is_before_jiffies(start_time + HZ / 10UL))
+                                break;
+                        if (work->nr_pages <= 0)
+                                break;
                 }
-                if (!list_empty(&wb->b_more_io))
-                        wbc->more_io = 1;
         }
-        /* b_io is empty */
-        return 1;
+        return wrote;
 }
 
-void writeback_inodes_wb(struct bdi_writeback *wb,
-                struct writeback_control *wbc)
+static long __writeback_inodes_wb(struct bdi_writeback *wb,
+                                  struct wb_writeback_work *work)
 {
-        int ret = 0;
-
-        if (!wbc->wb_start)
-                wbc->wb_start = jiffies; /* livelock avoidance */
-        spin_lock(&inode_wb_list_lock);
-        if (!wbc->for_kupdate || list_empty(&wb->b_io))
-                queue_io(wb, wbc->older_than_this);
+        unsigned long start_time = jiffies;
+        long wrote = 0;
 
         while (!list_empty(&wb->b_io)) {
                 struct inode *inode = wb_inode(wb->b_io.prev);
                 struct super_block *sb = inode->i_sb;
 
-                if (!pin_sb_for_writeback(sb)) {
-                        requeue_io(inode);
+                if (!grab_super_passive(sb)) {
+                        /*
+                         * grab_super_passive() may fail consistently due to
+                         * s_umount being grabbed by someone else. Don't use
+                         * requeue_io() to avoid busy retrying the inode/sb.
+                         */
+                        redirty_tail(inode, wb);
                         continue;
                 }
-                ret = writeback_sb_inodes(sb, wb, wbc, false);
+                wrote += writeback_sb_inodes(sb, wb, work);
                 drop_super(sb);
 
-                if (ret)
-                        break;
+                /* refer to the same tests at the end of writeback_sb_inodes */
+                if (wrote) {
+                        if (time_is_before_jiffies(start_time + HZ / 10UL))
+                                break;
+                        if (work->nr_pages <= 0)
+                                break;
+                }
         }
-        spin_unlock(&inode_wb_list_lock);
         /* Leave any unwritten inodes on b_io */
+        return wrote;
 }
 
-static void __writeback_inodes_sb(struct super_block *sb,
-                struct bdi_writeback *wb, struct writeback_control *wbc)
+long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages,
+                                enum wb_reason reason)
 {
-        WARN_ON(!rwsem_is_locked(&sb->s_umount));
+        struct wb_writeback_work work = {
+                .nr_pages       = nr_pages,
+                .sync_mode      = WB_SYNC_NONE,
+                .range_cyclic   = 1,
+                .reason         = reason,
+        };
 
-        spin_lock(&inode_wb_list_lock);
-        if (!wbc->for_kupdate || list_empty(&wb->b_io))
-                queue_io(wb, wbc->older_than_this);
-        writeback_sb_inodes(sb, wb, wbc, true);
-        spin_unlock(&inode_wb_list_lock);
-}
+        spin_lock(&wb->list_lock);
+        if (list_empty(&wb->b_io))
+                queue_io(wb, &work);
+        __writeback_inodes_wb(wb, &work);
+        spin_unlock(&wb->list_lock);
 
-/*
- * The maximum number of pages to writeout in a single bdi flush/kupdate
- * operation.  We do this so we don't hold I_SYNC against an inode for
- * enormous amounts of time, which would block a userspace task which has
- * been forced to throttle against that inode.  Also, the code reevaluates
- * the dirty each time it has written this many pages.
- */
-#define MAX_WRITEBACK_PAGES     1024
+        return nr_pages - work.nr_pages;
+}
 
-static inline bool over_bground_thresh(void)
+static bool over_bground_thresh(struct backing_dev_info *bdi)
 {
         unsigned long background_thresh, dirty_thresh;
 
         global_dirty_limits(&background_thresh, &dirty_thresh);
 
-        return (global_page_state(NR_FILE_DIRTY) +
-                global_page_state(NR_UNSTABLE_NFS) > background_thresh);
+        if (global_page_state(NR_FILE_DIRTY) +
+            global_page_state(NR_UNSTABLE_NFS) > background_thresh)
+                return true;
+
+        if (bdi_stat(bdi, BDI_RECLAIMABLE) >
+                                bdi_dirty_limit(bdi, background_thresh))
+                return true;
+
+        return false;
+}
+
+/*
+ * Called under wb->list_lock. If there are multiple wb per bdi,
+ * only the flusher working on the first wb should do it.
+ */
+static void wb_update_bandwidth(struct bdi_writeback *wb,
+                                unsigned long start_time)
+{
+        __bdi_update_bandwidth(wb->bdi, 0, 0, 0, 0, 0, start_time);
 }
 
 /*
@@ -648,47 +719,16 @@ static inline bool over_bground_thresh(void)
 static long wb_writeback(struct bdi_writeback *wb,
                          struct wb_writeback_work *work)
 {
-        struct writeback_control wbc = {
-                .sync_mode              = work->sync_mode,
-                .older_than_this        = NULL,
-                .for_kupdate            = work->for_kupdate,
-                .for_background         = work->for_background,
-                .range_cyclic           = work->range_cyclic,
-        };
+        unsigned long wb_start = jiffies;
+        long nr_pages = work->nr_pages;
         unsigned long oldest_jif;
-        long wrote = 0;
-        long write_chunk;
         struct inode *inode;
+        long progress;
 
-        if (wbc.for_kupdate) {
-                wbc.older_than_this = &oldest_jif;
-                oldest_jif = jiffies -
-                                msecs_to_jiffies(dirty_expire_interval * 10);
-        }
-        if (!wbc.range_cyclic) {
-                wbc.range_start = 0;
-                wbc.range_end = LLONG_MAX;
-        }
-
-        /*
-         * WB_SYNC_ALL mode does livelock avoidance by syncing dirty
-         * inodes/pages in one big loop. Setting wbc.nr_to_write=LONG_MAX
-         * here avoids calling into writeback_inodes_wb() more than once.
-         *
-         * The intended call sequence for WB_SYNC_ALL writeback is:
-         *
-         *      wb_writeback()
-         *          __writeback_inodes_sb()     <== called only once
-         *              write_cache_pages()     <== called once for each inode
-         *                   (quickly) tag currently dirty pages
-         *                   (maybe slowly) sync all tagged pages
-         */
-        if (wbc.sync_mode == WB_SYNC_NONE)
-                write_chunk = MAX_WRITEBACK_PAGES;
-        else
-                write_chunk = LONG_MAX;
+        oldest_jif = jiffies;
+        work->older_than_this = &oldest_jif;
 
-        wbc.wb_start = jiffies; /* livelock avoidance */
+        spin_lock(&wb->list_lock);
         for (;;) {
                 /*
                  * Stop writeback when nr_pages has been consumed
@@ -710,55 +750,57 @@ static long wb_writeback(struct bdi_writeback *wb,
                  * For background writeout, stop when we are below the
                  * background dirty threshold
                  */
-                if (work->for_background && !over_bground_thresh())
+                if (work->for_background && !over_bground_thresh(wb->bdi))
                         break;
 
-                wbc.more_io = 0;
-                wbc.nr_to_write = write_chunk;
-                wbc.pages_skipped = 0;
+                if (work->for_kupdate) {
+                        oldest_jif = jiffies -
+                                msecs_to_jiffies(dirty_expire_interval * 10);
+                        work->older_than_this = &oldest_jif;
+                }
 
-                trace_wbc_writeback_start(&wbc, wb->bdi);
+                trace_writeback_start(wb->bdi, work);
+                if (list_empty(&wb->b_io))
+                        queue_io(wb, work);
                 if (work->sb)
-                        __writeback_inodes_sb(work->sb, wb, &wbc);
+                        progress = writeback_sb_inodes(work->sb, wb, work);
                 else
-                        writeback_inodes_wb(wb, &wbc);
-                trace_wbc_writeback_written(&wbc, wb->bdi);
+                        progress = __writeback_inodes_wb(wb, work);
+                trace_writeback_written(wb->bdi, work);
 
-                work->nr_pages -= write_chunk - wbc.nr_to_write;
-                wrote += write_chunk - wbc.nr_to_write;
+                wb_update_bandwidth(wb, wb_start);
 
                 /*
-                 * If we consumed everything, see if we have more
+                 * Did we write something? Try for more
+                 *
+                 * Dirty inodes are moved to b_io for writeback in batches.
+                 * The completion of the current batch does not necessarily
+                 * mean the overall work is done. So we keep looping as long
+                 * as made some progress on cleaning pages or inodes.
                  */
-                if (wbc.nr_to_write <= 0)
+                if (progress)
                         continue;
                 /*
-                 * Didn't write everything and we don't have more IO, bail
+                 * No more inodes for IO, bail
                  */
-                if (!wbc.more_io)
+                if (list_empty(&wb->b_more_io))
                         break;
                 /*
-                 * Did we write something? Try for more
-                 */
-                if (wbc.nr_to_write < write_chunk)
-                        continue;
-                /*
                  * Nothing written. Wait for some inode to
                  * become available for writeback. Otherwise
                  * we'll just busyloop.
                  */
-                spin_lock(&inode_wb_list_lock);
                 if (!list_empty(&wb->b_more_io))  {
+                        trace_writeback_wait(wb->bdi, work);
                         inode = wb_inode(wb->b_more_io.prev);
-                        trace_wbc_writeback_wait(&wbc, wb->bdi);
                         spin_lock(&inode->i_lock);
-                        inode_wait_for_writeback(inode);
+                        inode_wait_for_writeback(inode, wb);
                         spin_unlock(&inode->i_lock);
                 }
-                spin_unlock(&inode_wb_list_lock);
         }
+        spin_unlock(&wb->list_lock);
 
-        return wrote;
+        return nr_pages - work->nr_pages;
 }
 
 /*
@@ -792,13 +834,14 @@ static unsigned long get_nr_dirty_pages(void)
 
 static long wb_check_background_flush(struct bdi_writeback *wb)
 {
-        if (over_bground_thresh()) {
+        if (over_bground_thresh(wb->bdi)) {
 
                 struct wb_writeback_work work = {
                         .nr_pages       = LONG_MAX,
                         .sync_mode      = WB_SYNC_NONE,
                         .for_background = 1,
                         .range_cyclic   = 1,
+                        .reason         = WB_REASON_BACKGROUND,
                 };
 
                 return wb_writeback(wb, &work);
@@ -832,6 +875,7 @@ static long wb_check_old_data_flush(struct bdi_writeback *wb)
                         .sync_mode      = WB_SYNC_NONE,
                         .for_kupdate    = 1,
                         .range_cyclic   = 1,
+                        .reason         = WB_REASON_PERIODIC,
                 };
 
                 return wb_writeback(wb, &work);
@@ -950,7 +994,7 @@ int bdi_writeback_thread(void *data)
  * Start writeback of `nr_pages' pages.  If `nr_pages' is zero, write back
  * the whole world.
  */
-void wakeup_flusher_threads(long nr_pages)
+void wakeup_flusher_threads(long nr_pages, enum wb_reason reason)
 {
         struct backing_dev_info *bdi;
 
@@ -963,7 +1007,7 @@ void wakeup_flusher_threads(long nr_pages)
         list_for_each_entry_rcu(bdi, &bdi_list, bdi_list) {
                 if (!bdi_has_dirty_io(bdi))
                         continue;
-                __bdi_start_writeback(bdi, nr_pages, false);
+                __bdi_start_writeback(bdi, nr_pages, false, reason);
         }
         rcu_read_unlock();
 }
@@ -1089,10 +1133,10 @@ void __mark_inode_dirty(struct inode *inode, int flags)
                         }
 
                         spin_unlock(&inode->i_lock);
-                        spin_lock(&inode_wb_list_lock);
+                        spin_lock(&bdi->wb.list_lock);
                         inode->dirtied_when = jiffies;
                         list_move(&inode->i_wb_list, &bdi->wb.b_dirty);
-                        spin_unlock(&inode_wb_list_lock);
+                        spin_unlock(&bdi->wb.list_lock);
 
                         if (wakeup_bdi)
                                 bdi_wakeup_thread_delayed(bdi);
@@ -1184,14 +1228,18 @@ static void wait_sb_inodes(struct super_block *sb)
  * on how many (if any) will be written, and this function does not wait
  * for IO completion of submitted IO.
  */
-void writeback_inodes_sb_nr(struct super_block *sb, unsigned long nr)
+void writeback_inodes_sb_nr(struct super_block *sb,
+                            unsigned long nr,
+                            enum wb_reason reason)
 {
         DECLARE_COMPLETION_ONSTACK(done);
         struct wb_writeback_work work = {
-                .sb             = sb,
-                .sync_mode      = WB_SYNC_NONE,
-                .done           = &done,
-                .nr_pages       = nr,
+                .sb                     = sb,
+                .sync_mode              = WB_SYNC_NONE,
+                .tagged_writepages      = 1,
+                .done                   = &done,
+                .nr_pages               = nr,
+                .reason                 = reason,
         };
 
         WARN_ON(!rwsem_is_locked(&sb->s_umount));
@@ -1208,9 +1256,9 @@ EXPORT_SYMBOL(writeback_inodes_sb_nr);
  * on how many (if any) will be written, and this function does not wait
  * for IO completion of submitted IO.
  */
-void writeback_inodes_sb(struct super_block *sb)
+void writeback_inodes_sb(struct super_block *sb, enum wb_reason reason)
 {
-        return writeback_inodes_sb_nr(sb, get_nr_dirty_pages());
+        return writeback_inodes_sb_nr(sb, get_nr_dirty_pages(), reason);
 }
 EXPORT_SYMBOL(writeback_inodes_sb);
 
@@ -1221,11 +1269,11 @@ EXPORT_SYMBOL(writeback_inodes_sb);
  * Invoke writeback_inodes_sb if no writeback is currently underway.
  * Returns 1 if writeback was started, 0 if not.
  */
-int writeback_inodes_sb_if_idle(struct super_block *sb)
+int writeback_inodes_sb_if_idle(struct super_block *sb, enum wb_reason reason)
 {
         if (!writeback_in_progress(sb->s_bdi)) {
                 down_read(&sb->s_umount);
-                writeback_inodes_sb(sb);
+                writeback_inodes_sb(sb, reason);
                 up_read(&sb->s_umount);
                 return 1;
         } else
@@ -1242,11 +1290,12 @@ EXPORT_SYMBOL(writeback_inodes_sb_if_idle);
  * Returns 1 if writeback was started, 0 if not.
  */
 int writeback_inodes_sb_nr_if_idle(struct super_block *sb,
-                                   unsigned long nr)
+                                   unsigned long nr,
+                                   enum wb_reason reason)
 {
         if (!writeback_in_progress(sb->s_bdi)) {
                 down_read(&sb->s_umount);
-                writeback_inodes_sb_nr(sb, nr);
+                writeback_inodes_sb_nr(sb, nr, reason);
                 up_read(&sb->s_umount);
                 return 1;
         } else
@@ -1270,6 +1319,7 @@ void sync_inodes_sb(struct super_block *sb)
                 .nr_pages       = LONG_MAX,
                 .range_cyclic   = 0,
                 .done           = &done,
+                .reason         = WB_REASON_SYNC,
         };
 
         WARN_ON(!rwsem_is_locked(&sb->s_umount));
@@ -1293,6 +1343,7 @@ EXPORT_SYMBOL(sync_inodes_sb);
  */
 int write_inode_now(struct inode *inode, int sync)
 {
+        struct bdi_writeback *wb = &inode_to_bdi(inode)->wb;
         int ret;
         struct writeback_control wbc = {
                 .nr_to_write = LONG_MAX,
@@ -1305,11 +1356,11 @@ int write_inode_now(struct inode *inode, int sync)
                 wbc.nr_to_write = 0;
 
         might_sleep();
-        spin_lock(&inode_wb_list_lock);
+        spin_lock(&wb->list_lock);
         spin_lock(&inode->i_lock);
-        ret = writeback_single_inode(inode, &wbc);
+        ret = writeback_single_inode(inode, wb, &wbc);
         spin_unlock(&inode->i_lock);
-        spin_unlock(&inode_wb_list_lock);
+        spin_unlock(&wb->list_lock);
         if (sync)
                 inode_sync_wait(inode);
         return ret;
@@ -1329,13 +1380,14 @@ EXPORT_SYMBOL(write_inode_now);
  */
 int sync_inode(struct inode *inode, struct writeback_control *wbc)
 {
+        struct bdi_writeback *wb = &inode_to_bdi(inode)->wb;
         int ret;
 
-        spin_lock(&inode_wb_list_lock);
+        spin_lock(&wb->list_lock);
         spin_lock(&inode->i_lock);
-        ret = writeback_single_inode(inode, wbc);
+        ret = writeback_single_inode(inode, wb, wbc);
         spin_unlock(&inode->i_lock);
-        spin_unlock(&inode_wb_list_lock);
+        spin_unlock(&wb->list_lock);
         return ret;
 }
 EXPORT_SYMBOL(sync_inode);
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 640fc229df1..c858b5c8320 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -19,6 +19,7 @@
 #include <linux/pipe_fs_i.h>
 #include <linux/swap.h>
 #include <linux/splice.h>
+#include <linux/freezer.h>
 
 MODULE_ALIAS_MISCDEV(FUSE_MINOR);
 MODULE_ALIAS("devname:fuse");
@@ -258,10 +259,14 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
         forget->forget_one.nlookup = nlookup;
 
         spin_lock(&fc->lock);
-        fc->forget_list_tail->next = forget;
-        fc->forget_list_tail = forget;
-        wake_up(&fc->waitq);
-        kill_fasync(&fc->fasync, SIGIO, POLL_IN);
+        if (fc->connected) {
+                fc->forget_list_tail->next = forget;
+                fc->forget_list_tail = forget;
+                wake_up(&fc->waitq);
+                kill_fasync(&fc->fasync, SIGIO, POLL_IN);
+        } else {
+                kfree(forget);
+        }
         spin_unlock(&fc->lock);
 }
 
@@ -383,7 +388,10 @@ __acquires(fc->lock)
          * Wait it out.
          */
         spin_unlock(&fc->lock);
-        wait_event(req->waitq, req->state == FUSE_REQ_FINISHED);
+
+        while (req->state != FUSE_REQ_FINISHED)
+                wait_event_freezable(req->waitq,
+                                     req->state == FUSE_REQ_FINISHED);
         spin_lock(&fc->lock);
 
         if (!req->aborted)
@@ -1358,6 +1366,10 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
         if (outarg.namelen > FUSE_NAME_MAX)
                 goto err;
 
+        err = -EINVAL;
+        if (size != sizeof(outarg) + outarg.namelen + 1)
+                goto err;
+
         name.name = buf;
         name.len = outarg.namelen;
         err = fuse_copy_one(cs, buf, outarg.namelen + 1);
@@ -1504,7 +1516,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
         else if (outarg->offset + num > file_size)
                 num = file_size - outarg->offset;
 
-        while (num) {
+        while (num && req->num_pages < FUSE_MAX_PAGES_PER_REQ) {
                 struct page *page;
                 unsigned int this_num;
 
@@ -1518,6 +1530,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
 
                 num -= this_num;
                 total_len += this_num;
+                index++;
         }
         req->misc.retrieve_in.offset = outarg->offset;
         req->misc.retrieve_in.size = total_len;
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index d5016071459..c04a025c677 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -858,6 +858,7 @@ int fuse_update_attributes(struct inode *inode, struct kstat *stat,
                 if (stat) {
                         generic_fillattr(inode, stat);
                         stat->mode = fi->orig_i_mode;
+                        stat->ino = fi->orig_ino;
                 }
         }
 
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 82a66466a24..79fca8dfa3e 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1710,7 +1710,7 @@ static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
         size_t n;
         u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
 
-        for (n = 0; n < count; n++) {
+        for (n = 0; n < count; n++, iov++) {
                 if (iov->iov_len > (size_t) max)
                         return -ENOMEM;
                 max -= iov->iov_len;
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index b788becada7..f6215501097 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -82,6 +82,9 @@ struct fuse_inode {
             preserve the original mode */
         mode_t orig_i_mode;
 
+        /** 64 bit inode number */
+        u64 orig_ino;
+
         /** Version of last attribute change */
         u64 attr_version;
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 38f84cd48b6..69a1e0f04f4 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -91,6 +91,7 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
         fi->nlookup = 0;
         fi->attr_version = 0;
         fi->writectr = 0;
+        fi->orig_ino = 0;
         INIT_LIST_HEAD(&fi->write_files);
         INIT_LIST_HEAD(&fi->queued_writes);
         INIT_LIST_HEAD(&fi->writepages);
@@ -140,6 +141,18 @@ static int fuse_remount_fs(struct super_block *sb, int *flags, char *data)
         return 0;
 }
 
+/*
+ * ino_t is 32-bits on 32-bit arch. We have to squash the 64-bit value down
+ * so that it will fit.
+ */
+static ino_t fuse_squash_ino(u64 ino64)
+{
+        ino_t ino = (ino_t) ino64;
+        if (sizeof(ino_t) < sizeof(u64))
+                ino ^= ino64 >> (sizeof(u64) - sizeof(ino_t)) * 8;
+        return ino;
+}
+
 void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
                                    u64 attr_valid)
 {
@@ -149,7 +162,7 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
         fi->attr_version = ++fc->attr_version;
         fi->i_time = attr_valid;
 
-        inode->i_ino     = attr->ino;
+        inode->i_ino     = fuse_squash_ino(attr->ino);
         inode->i_mode    = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
         inode->i_nlink   = attr->nlink;
         inode->i_uid     = attr->uid;
@@ -175,6 +188,8 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
         fi->orig_i_mode = inode->i_mode;
         if (!(fc->flags & FUSE_DEFAULT_PERMISSIONS))
                 inode->i_mode &= ~S_ISVTX;
+
+        fi->orig_ino = attr->ino;
 }
 
 void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 2a77071fb7b..fa780e66691 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1018,13 +1018,13 @@ hostdata_error:
                 fsname++;
         if (lm->lm_mount == NULL) {
                 fs_info(sdp, "Now mounting FS...\n");
-                complete(&sdp->sd_locking_init);
+                complete_all(&sdp->sd_locking_init);
                 return 0;
         }
         ret = lm->lm_mount(sdp, fsname);
         if (ret == 0)
                 fs_info(sdp, "Joined cluster. Now mounting FS...\n");
-        complete(&sdp->sd_locking_init);
+        complete_all(&sdp->sd_locking_init);
         return ret;
 }
 
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 3ebc437736f..1cbdeea1db4 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -46,11 +46,26 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         case HFS_EXT_CNID:
                 hfs_inode_read_fork(tree->inode, mdb->drXTExtRec, mdb->drXTFlSize,
                                     mdb->drXTFlSize, be32_to_cpu(mdb->drXTClpSiz));
+                if (HFS_I(tree->inode)->alloc_blocks >
+                                        HFS_I(tree->inode)->first_blocks) {
+                        printk(KERN_ERR "hfs: invalid btree extent records\n");
+                        unlock_new_inode(tree->inode);
+                        goto free_inode;
+                }
+
                 tree->inode->i_mapping->a_ops = &hfs_btree_aops;
                 break;
         case HFS_CAT_CNID:
                 hfs_inode_read_fork(tree->inode, mdb->drCTExtRec, mdb->drCTFlSize,
                                     mdb->drCTFlSize, be32_to_cpu(mdb->drCTClpSiz));
+
+                if (!HFS_I(tree->inode)->first_blocks) {
+                        printk(KERN_ERR "hfs: invalid btree extent records "
+                                                                "(0 size).\n");
+                        unlock_new_inode(tree->inode);
+                        goto free_inode;
+                }
+
                 tree->inode->i_mapping->a_ops = &hfs_btree_aops;
                 break;
         default:
@@ -59,11 +74,6 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         }
         unlock_new_inode(tree->inode);
 
-        if (!HFS_I(tree->inode)->first_blocks) {
-                printk(KERN_ERR "hfs: invalid btree extent records (0 size).\n");
-                goto free_inode;
-        }
-
         mapping = tree->inode->i_mapping;
         page = read_mapping_page(mapping, 0, NULL);
         if (IS_ERR(page))
diff --git a/fs/hfs/trans.c b/fs/hfs/trans.c
index e673a88b8ae..b1ce4c7ad3f 100644
--- a/fs/hfs/trans.c
+++ b/fs/hfs/trans.c
@@ -40,6 +40,8 @@ int hfs_mac2asc(struct super_block *sb, char *out, const struct hfs_name *in)
 
         src = in->name;
         srclen = in->len;
+        if (srclen > HFS_NAMELEN)
+                srclen = HFS_NAMELEN;
         dst = out;
         dstlen = HFS_MAX_NAMELEN;
         if (nls_io) {
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index b4ba1b31933..408073ae7a2 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -360,6 +360,10 @@ int hfsplus_rename_cat(u32 cnid,
         err = hfs_brec_find(&src_fd);
         if (err)
                 goto out;
+        if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
+                err = -EIO;
+                goto out;
+        }
 
         hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
                                 src_fd.entrylength);
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index 4df5059c25d..159f5ebf519 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -146,6 +146,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 filp->f_pos++;
                 /* fall through */
         case 1:
+                if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+                        err = -EIO;
+                        goto out;
+                }
+
                 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
                         fd.entrylength);
                 if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
@@ -177,6 +182,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         err = -EIO;
                         goto out;
                 }
+
+                if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+                        err = -EIO;
+                        goto out;
+                }
+
                 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
                         fd.entrylength);
                 type = be16_to_cpu(entry.type);
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index d6857523336..4e7f64b705d 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -13,6 +13,7 @@
 #include <linux/fs.h>
 #include <linux/mutex.h>
 #include <linux/buffer_head.h>
+#include <linux/blkdev.h>
 #include "hfsplus_raw.h"
 
 #define DBG_BNODE_REFS  0x00000001
@@ -110,7 +111,9 @@ struct hfsplus_vh;
 struct hfs_btree;
 
 struct hfsplus_sb_info {
+        void *s_vhdr_buf;
         struct hfsplus_vh *s_vhdr;
+        void *s_backup_vhdr_buf;
         struct hfsplus_vh *s_backup_vhdr;
         struct hfs_btree *ext_tree;
         struct hfs_btree *cat_tree;
@@ -258,6 +261,15 @@ struct hfsplus_readdir_data {
         struct hfsplus_cat_key key;
 };
 
+/*
+ * Find minimum acceptible I/O size for an hfsplus sb.
+ */
+static inline unsigned short hfsplus_min_io_size(struct super_block *sb)
+{
+        return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev),
+                     HFSPLUS_SECTOR_SIZE);
+}
+
 #define hfs_btree_open hfsplus_btree_open
 #define hfs_btree_close hfsplus_btree_close
 #define hfs_btree_write hfsplus_btree_write
@@ -436,8 +448,8 @@ int hfsplus_compare_dentry(const struct dentry *parent,
 /* wrapper.c */
 int hfsplus_read_wrapper(struct super_block *);
 int hfs_part_find(struct super_block *, sector_t *, sector_t *);
-int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
-                void *data, int rw);
+int hfsplus_submit_bio(struct super_block *sb, sector_t sector,
+                void *buf, void **data, int rw);
 
 /* time macros */
 #define __hfsp_mt2ut(t)         (be32_to_cpu(t) - 2082844800U)
diff --git a/fs/hfsplus/part_tbl.c b/fs/hfsplus/part_tbl.c
index 40ad88c12c6..eb355d81e27 100644
--- a/fs/hfsplus/part_tbl.c
+++ b/fs/hfsplus/part_tbl.c
@@ -88,11 +88,12 @@ static int hfs_parse_old_pmap(struct super_block *sb, struct old_pmap *pm,
         return -ENOENT;
 }
 
-static int hfs_parse_new_pmap(struct super_block *sb, struct new_pmap *pm,
-                sector_t *part_start, sector_t *part_size)
+static int hfs_parse_new_pmap(struct super_block *sb, void *buf,
+                struct new_pmap *pm, sector_t *part_start, sector_t *part_size)
 {
         struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
         int size = be32_to_cpu(pm->pmMapBlkCnt);
+        int buf_size = hfsplus_min_io_size(sb);
         int res;
         int i = 0;
 
@@ -107,11 +108,14 @@ static int hfs_parse_new_pmap(struct super_block *sb, struct new_pmap *pm,
                 if (++i >= size)
                         return -ENOENT;
 
-                res = hfsplus_submit_bio(sb->s_bdev,
-                                         *part_start + HFS_PMAP_BLK + i,
-                                         pm, READ);
-                if (res)
-                        return res;
+                pm = (struct new_pmap *)((u8 *)pm + HFSPLUS_SECTOR_SIZE);
+                if ((u8 *)pm - (u8 *)buf >= buf_size) {
+                        res = hfsplus_submit_bio(sb,
+                                                 *part_start + HFS_PMAP_BLK + i,
+                                                 buf, (void **)&pm, READ);
+                        if (res)
+                                return res;
+                }
         } while (pm->pmSig == cpu_to_be16(HFS_NEW_PMAP_MAGIC));
 
         return -ENOENT;
@@ -124,15 +128,15 @@ static int hfs_parse_new_pmap(struct super_block *sb, struct new_pmap *pm,
 int hfs_part_find(struct super_block *sb,
                 sector_t *part_start, sector_t *part_size)
 {
-        void *data;
+        void *buf, *data;
         int res;
 
-        data = kmalloc(HFSPLUS_SECTOR_SIZE, GFP_KERNEL);
-        if (!data)
+        buf = kmalloc(hfsplus_min_io_size(sb), GFP_KERNEL);
+        if (!buf)
                 return -ENOMEM;
 
-        res = hfsplus_submit_bio(sb->s_bdev, *part_start + HFS_PMAP_BLK,
-                                 data, READ);
+        res = hfsplus_submit_bio(sb, *part_start + HFS_PMAP_BLK,
+                                 buf, &data, READ);
         if (res)
                 goto out;
 
@@ -141,13 +145,13 @@ int hfs_part_find(struct super_block *sb,
                 res = hfs_parse_old_pmap(sb, data, part_start, part_size);
                 break;
         case HFS_NEW_PMAP_MAGIC:
-                res = hfs_parse_new_pmap(sb, data, part_start, part_size);
+                res = hfs_parse_new_pmap(sb, buf, data, part_start, part_size);
                 break;
         default:
                 res = -ENOENT;
                 break;
         }
 out:
-        kfree(data);
+        kfree(buf);
         return res;
 }
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 84a47b709f5..c3a76fd25f2 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -197,17 +197,17 @@ int hfsplus_sync_fs(struct super_block *sb, int wait)
                 write_backup = 1;
         }
 
-        error2 = hfsplus_submit_bio(sb->s_bdev,
+        error2 = hfsplus_submit_bio(sb,
                                    sbi->part_start + HFSPLUS_VOLHEAD_SECTOR,
-                                   sbi->s_vhdr, WRITE_SYNC);
+                                   sbi->s_vhdr_buf, NULL, WRITE_SYNC);
         if (!error)
                 error = error2;
         if (!write_backup)
                 goto out;
 
-        error2 = hfsplus_submit_bio(sb->s_bdev,
+        error2 = hfsplus_submit_bio(sb,
                                   sbi->part_start + sbi->sect_count - 2,
-                                  sbi->s_backup_vhdr, WRITE_SYNC);
+                                  sbi->s_backup_vhdr_buf, NULL, WRITE_SYNC);
         if (!error)
                 error2 = error;
 out:
@@ -251,8 +251,8 @@ static void hfsplus_put_super(struct super_block *sb)
         hfs_btree_close(sbi->ext_tree);
         iput(sbi->alloc_file);
         iput(sbi->hidden_dir);
-        kfree(sbi->s_vhdr);
-        kfree(sbi->s_backup_vhdr);
+        kfree(sbi->s_vhdr_buf);
+        kfree(sbi->s_backup_vhdr_buf);
         unload_nls(sbi->nls);
         kfree(sb->s_fs_info);
         sb->s_fs_info = NULL;
@@ -508,8 +508,8 @@ out_close_cat_tree:
 out_close_ext_tree:
         hfs_btree_close(sbi->ext_tree);
 out_free_vhdr:
-        kfree(sbi->s_vhdr);
-        kfree(sbi->s_backup_vhdr);
+        kfree(sbi->s_vhdr_buf);
+        kfree(sbi->s_backup_vhdr_buf);
 out_unload_nls:
         unload_nls(sbi->nls);
         unload_nls(nls);
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 4ac88ff79aa..aac1563174e 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -31,25 +31,67 @@ static void hfsplus_end_io_sync(struct bio *bio, int err)
         complete(bio->bi_private);
 }
 
-int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
-                void *data, int rw)
+/*
+ * hfsplus_submit_bio - Perfrom block I/O
+ * @sb: super block of volume for I/O
+ * @sector: block to read or write, for blocks of HFSPLUS_SECTOR_SIZE bytes
+ * @buf: buffer for I/O
+ * @data: output pointer for location of requested data
+ * @rw: direction of I/O
+ *
+ * The unit of I/O is hfsplus_min_io_size(sb), which may be bigger than
+ * HFSPLUS_SECTOR_SIZE, and @buf must be sized accordingly. On reads
+ * @data will return a pointer to the start of the requested sector,
+ * which may not be the same location as @buf.
+ *
+ * If @sector is not aligned to the bdev logical block size it will
+ * be rounded down. For writes this means that @buf should contain data
+ * that starts at the rounded-down address. As long as the data was
+ * read using hfsplus_submit_bio() and the same buffer is used things
+ * will work correctly.
+ */
+int hfsplus_submit_bio(struct super_block *sb, sector_t sector,
+                void *buf, void **data, int rw)
 {
         DECLARE_COMPLETION_ONSTACK(wait);
         struct bio *bio;
         int ret = 0;
+        u64 io_size;
+        loff_t start;
+        int offset;
+
+        /*
+         * Align sector to hardware sector size and find offset. We
+         * assume that io_size is a power of two, which _should_
+         * be true.
+         */
+        io_size = hfsplus_min_io_size(sb);
+        start = (loff_t)sector << HFSPLUS_SECTOR_SHIFT;
+        offset = start & (io_size - 1);
+        sector &= ~((io_size >> HFSPLUS_SECTOR_SHIFT) - 1);
 
         bio = bio_alloc(GFP_NOIO, 1);
         bio->bi_sector = sector;
-        bio->bi_bdev = bdev;
+        bio->bi_bdev = sb->s_bdev;
         bio->bi_end_io = hfsplus_end_io_sync;
         bio->bi_private = &wait;
 
-        /*
-         * We always submit one sector at a time, so bio_add_page must not fail.
-         */
-        if (bio_add_page(bio, virt_to_page(data), HFSPLUS_SECTOR_SIZE,
-                         offset_in_page(data)) != HFSPLUS_SECTOR_SIZE)
-                BUG();
+        if (!(rw & WRITE) && data)
+                *data = (u8 *)buf + offset;
+
+        while (io_size > 0) {
+                unsigned int page_offset = offset_in_page(buf);
+                unsigned int len = min_t(unsigned int, PAGE_SIZE - page_offset,
+                                         io_size);
+
+                ret = bio_add_page(bio, virt_to_page(buf), len, page_offset);
+                if (ret != len) {
+                        ret = -EIO;
+                        goto out;
+                }
+                io_size -= len;
+                buf = (u8 *)buf + len;
+        }
 
         submit_bio(rw, bio);
         wait_for_completion(&wait);
@@ -57,8 +99,9 @@ int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
         if (!bio_flagged(bio, BIO_UPTODATE))
                 ret = -EIO;
 
+out:
         bio_put(bio);
-        return ret;
+        return ret < 0 ? ret : 0;
 }
 
 static int hfsplus_read_mdb(void *bufptr, struct hfsplus_wd *wd)
@@ -147,17 +190,17 @@ int hfsplus_read_wrapper(struct super_block *sb)
         }
 
         error = -ENOMEM;
-        sbi->s_vhdr = kmalloc(HFSPLUS_SECTOR_SIZE, GFP_KERNEL);
-        if (!sbi->s_vhdr)
+        sbi->s_vhdr_buf = kmalloc(hfsplus_min_io_size(sb), GFP_KERNEL);
+        if (!sbi->s_vhdr_buf)
                 goto out;
-        sbi->s_backup_vhdr = kmalloc(HFSPLUS_SECTOR_SIZE, GFP_KERNEL);
-        if (!sbi->s_backup_vhdr)
+        sbi->s_backup_vhdr_buf = kmalloc(hfsplus_min_io_size(sb), GFP_KERNEL);
+        if (!sbi->s_backup_vhdr_buf)
                 goto out_free_vhdr;
 
 reread:
-        error = hfsplus_submit_bio(sb->s_bdev,
-                                   part_start + HFSPLUS_VOLHEAD_SECTOR,
-                                   sbi->s_vhdr, READ);
+        error = hfsplus_submit_bio(sb, part_start + HFSPLUS_VOLHEAD_SECTOR,
+                                   sbi->s_vhdr_buf, (void **)&sbi->s_vhdr,
+                                   READ);
         if (error)
                 goto out_free_backup_vhdr;
 
@@ -186,9 +229,9 @@ reread:
                 goto reread;
         }
 
-        error = hfsplus_submit_bio(sb->s_bdev,
-                                   part_start + part_size - 2,
-                                   sbi->s_backup_vhdr, READ);
+        error = hfsplus_submit_bio(sb, part_start + part_size - 2,
+                                   sbi->s_backup_vhdr_buf,
+                                   (void **)&sbi->s_backup_vhdr, READ);
         if (error)
                 goto out_free_backup_vhdr;
 
@@ -232,9 +275,9 @@ reread:
         return 0;
 
 out_free_backup_vhdr:
-        kfree(sbi->s_backup_vhdr);
+        kfree(sbi->s_backup_vhdr_buf);
 out_free_vhdr:
-        kfree(sbi->s_vhdr);
+        kfree(sbi->s_vhdr_buf);
 out:
         return error;
 }
diff --git a/fs/hppfs/hppfs.c b/fs/hppfs/hppfs.c
index 85c098a499f..9d71c95b193 100644
--- a/fs/hppfs/hppfs.c
+++ b/fs/hppfs/hppfs.c
@@ -16,6 +16,7 @@
 #include <linux/statfs.h>
 #include <linux/types.h>
 #include <linux/pid_namespace.h>
+#include <linux/namei.h>
 #include <asm/uaccess.h>
 #include "os.h"
 
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 7aafeb8fa30..6327a069d83 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -238,17 +238,10 @@ static ssize_t hugetlbfs_read(struct file *filp, char __user *buf,
         loff_t isize;
         ssize_t retval = 0;
 
-        mutex_lock(&inode->i_mutex);
-
         /* validate length */
         if (len == 0)
                 goto out;
 
-        isize = i_size_read(inode);
-        if (!isize)
-                goto out;
-
-        end_index = (isize - 1) >> huge_page_shift(h);
         for (;;) {
                 struct page *page;
                 unsigned long nr, ret;
@@ -256,18 +249,21 @@ static ssize_t hugetlbfs_read(struct file *filp, char __user *buf,
 
                 /* nr is the maximum number of bytes to copy from this page */
                 nr = huge_page_size(h);
+                isize = i_size_read(inode);
+                if (!isize)
+                        goto out;
+                end_index = (isize - 1) >> huge_page_shift(h);
                 if (index >= end_index) {
                         if (index > end_index)
                                 goto out;
                         nr = ((isize - 1) & ~huge_page_mask(h)) + 1;
-                        if (nr <= offset) {
+                        if (nr <= offset)
                                 goto out;
-                        }
                 }
                 nr = nr - offset;
 
                 /* Find the page */
-                page = find_get_page(mapping, index);
+                page = find_lock_page(mapping, index);
                 if (unlikely(page == NULL)) {
                         /*
                          * We have a HOLE, zero out the user-buffer for the
@@ -279,17 +275,18 @@ static ssize_t hugetlbfs_read(struct file *filp, char __user *buf,
                         else
                                 ra = 0;
                 } else {
+                        unlock_page(page);
+
                         /*
                          * We have the page, copy it to user space buffer.
                          */
                         ra = hugetlbfs_read_actor(page, offset, buf, len, nr);
                         ret = ra;
+                        page_cache_release(page);
                 }
                 if (ra < 0) {
                         if (retval == 0)
                                 retval = ra;
-                        if (page)
-                                page_cache_release(page);
                         goto out;
                 }
 
@@ -299,16 +296,12 @@ static ssize_t hugetlbfs_read(struct file *filp, char __user *buf,
                 index += offset >> huge_page_shift(h);
                 offset &= ~huge_page_mask(h);
 
-                if (page)
-                        page_cache_release(page);
-
                 /* short read or no more work */
                 if ((ret != nr) || (len == 0))
                         break;
         }
 out:
         *ppos = ((loff_t)index << huge_page_shift(h)) + offset;
-        mutex_unlock(&inode->i_mutex);
         return retval;
 }
 
@@ -575,7 +568,8 @@ static int hugetlbfs_set_page_dirty(struct page *page)
 }
 
 static int hugetlbfs_migrate_page(struct address_space *mapping,
-                                struct page *newpage, struct page *page)
+                                struct page *newpage, struct page *page,
+                                enum migrate_mode mode)
 {
         int rc;
 
diff --git a/fs/inode.c b/fs/inode.c
index dbf0e760c0a..7aa468a4b19 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -37,7 +37,7 @@
  *   inode_lru, inode->i_lru
  * inode_sb_list_lock protects:
  *   sb->s_inodes, inode->i_sb_list
- * inode_wb_list_lock protects:
+ * bdi->wb.list_lock protects:
  *   bdi->wb.b_{dirty,io,more_io}, inode->i_wb_list
  * inode_hash_lock protects:
  *   inode_hashtable, inode->i_hash
@@ -48,7 +48,7 @@
  *   inode->i_lock
  *     inode_lru_lock
  *
- * inode_wb_list_lock
+ * bdi->wb.list_lock
  *   inode->i_lock
  *
  * inode_hash_lock
@@ -68,7 +68,6 @@ static LIST_HEAD(inode_lru);
 static DEFINE_SPINLOCK(inode_lru_lock);
 
 __cacheline_aligned_in_smp DEFINE_SPINLOCK(inode_sb_list_lock);
-__cacheline_aligned_in_smp DEFINE_SPINLOCK(inode_wb_list_lock);
 
 /*
  * iprune_sem provides exclusion between the icache shrinking and the
diff --git a/fs/internal.h b/fs/internal.h
index b29c46e4e32..c905f59dbbe 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -97,6 +97,7 @@ extern struct file *get_empty_filp(void);
  * super.c
  */
 extern int do_remount_sb(struct super_block *, int, void *, int);
+extern bool grab_super_passive(struct super_block *sb);
 extern void __put_super(struct super_block *sb);
 extern void put_super(struct super_block *sb);
 extern struct dentry *mount_fs(struct file_system_type *,
@@ -135,3 +136,5 @@ extern void inode_wb_list_del(struct inode *inode);
 extern int get_nr_dirty_inodes(void);
 extern void evict_inodes(struct super_block *);
 extern int invalidate_inodes(struct super_block *, bool);
+
+extern struct dentry *__d_alloc(struct super_block *, const struct qstr *);
diff --git a/fs/ioprio.c b/fs/ioprio.c
index 7da2a06508e..95a6c2b04e0 100644
--- a/fs/ioprio.c
+++ b/fs/ioprio.c
@@ -30,7 +30,7 @@
 
 int set_task_ioprio(struct task_struct *task, int ioprio)
 {
-        int err;
+        int err, i;
         struct io_context *ioc;
         const struct cred *cred = current_cred(), *tcred;
 
@@ -60,12 +60,17 @@ int set_task_ioprio(struct task_struct *task, int ioprio)
                         err = -ENOMEM;
                         break;
                 }
+                /* let other ioc users see the new values */
+                smp_wmb();
                 task->io_context = ioc;
         } while (1);
 
         if (!err) {
                 ioc->ioprio = ioprio;
-                ioc->ioprio_changed = 1;
+                /* make sure schedulers see the new ioprio value */
+                wmb();
+                for (i = 0; i < IOC_IOPRIO_CHANGED_BITS; i++)
+                        set_bit(i, ioc->ioprio_changed);
         }
 
         task_unlock(task);
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index e2d4285fbe9..9f36384e2e8 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -1131,6 +1131,14 @@ static int journal_get_superblock(journal_t *journal)
                 goto out;
         }
 
+        if (be32_to_cpu(sb->s_first) == 0 ||
+            be32_to_cpu(sb->s_first) >= journal->j_maxlen) {
+                printk(KERN_WARNING
+                        "JBD: Invalid start block of journal: %u\n",
+                        be32_to_cpu(sb->s_first));
+                goto out;
+        }
+
         return 0;
 
 out:
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index eef6979821a..36c2e800e73 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -683,7 +683,7 @@ start_journal_io:
         if (commit_transaction->t_need_data_flush &&
             (journal->j_fs_dev != journal->j_dev) &&
             (journal->j_flags & JBD2_BARRIER))
-                blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+                blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
 
         /* Done it all: now write the commit record asynchronously. */
         if (JBD2_HAS_INCOMPAT_FEATURE(journal,
@@ -819,7 +819,7 @@ wait_for_iobuf:
         if (JBD2_HAS_INCOMPAT_FEATURE(journal,
                                       JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT) &&
             journal->j_flags & JBD2_BARRIER) {
-                blkdev_issue_flush(journal->j_dev, GFP_KERNEL, NULL);
+                blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL);
         }
 
         if (err)
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 0dfa5b598e6..40c5fb73e9c 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1251,6 +1251,14 @@ static int journal_get_superblock(journal_t *journal)
                 goto out;
         }
 
+        if (be32_to_cpu(sb->s_first) == 0 ||
+            be32_to_cpu(sb->s_first) >= journal->j_maxlen) {
+                printk(KERN_WARNING
+                        "JBD2: Invalid start block of journal: %u\n",
+                        be32_to_cpu(sb->s_first));
+                goto out;
+        }
+
         return 0;
 
 out:
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 2d7109414cd..9baa39ea6be 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1902,6 +1902,8 @@ zap_buffer_unlocked:
         clear_buffer_mapped(bh);
         clear_buffer_req(bh);
         clear_buffer_new(bh);
+        clear_buffer_delay(bh);
+        clear_buffer_unwritten(bh);
         bh->b_bdev = NULL;
         return may_free;
 }
diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c
index 31dce611337..4bbd5211bb3 100644
--- a/fs/jffs2/gc.c
+++ b/fs/jffs2/gc.c
@@ -225,8 +225,8 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
                         return 0;
 
                 D1(printk(KERN_DEBUG "No progress from erasing blocks; doing GC anyway\n"));
-                spin_lock(&c->erase_completion_lock);
                 mutex_lock(&c->alloc_sem);
+                spin_lock(&c->erase_completion_lock);
         }
 
         /* First, work out which block we're garbage-collecting */
diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c
index f848b52c67b..046bb77c601 100644
--- a/fs/lockd/clnt4xdr.c
+++ b/fs/lockd/clnt4xdr.c
@@ -241,7 +241,7 @@ static int decode_nlm4_stat(struct xdr_stream *xdr, __be32 *stat)
         p = xdr_inline_decode(xdr, 4);
         if (unlikely(p == NULL))
                 goto out_overflow;
-        if (unlikely(*p > nlm4_failed))
+        if (unlikely(ntohl(*p) > ntohl(nlm4_failed)))
                 goto out_bad_xdr;
         *stat = *p;
         return 0;
diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
index 180ac34feb9..36057cedac6 100644
--- a/fs/lockd/clntxdr.c
+++ b/fs/lockd/clntxdr.c
@@ -236,7 +236,7 @@ static int decode_nlm_stat(struct xdr_stream *xdr,
         p = xdr_inline_decode(xdr, 4);
         if (unlikely(p == NULL))
                 goto out_overflow;
-        if (unlikely(*p > nlm_lck_denied_grace_period))
+        if (unlikely(ntohl(*p) > ntohl(nlm_lck_denied_grace_period)))
                 goto out_enum;
         *stat = *p;
         return 0;
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index abfff9d7979..1743064cd0c 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -440,7 +440,7 @@ static int param_set_##name(const char *val, struct kernel_param *kp)	\
         __typeof__(type) num = which_strtol(val, &endp, 0);             \
         if (endp == val || *endp || num < (min) || num > (max))         \
                 return -EINVAL;                                         \
-        *((int *) kp->arg) = num;                                       \
+        *((type *) kp->arg) = num;                                      \
         return 0;                                                       \
 }
 
diff --git a/fs/locks.c b/fs/locks.c
index b286539d547..35388d524c7 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -315,7 +315,7 @@ static int flock_make_lock(struct file *filp, struct file_lock **lock,
         return 0;
 }
 
-static int assign_type(struct file_lock *fl, int type)
+static int assign_type(struct file_lock *fl, long type)
 {
         switch (type) {
         case F_RDLCK:
@@ -452,7 +452,7 @@ static const struct lock_manager_operations lease_manager_ops = {
 /*
  * Initialize a lease, use the default lock manager operations
  */
-static int lease_init(struct file *filp, int type, struct file_lock *fl)
+static int lease_init(struct file *filp, long type, struct file_lock *fl)
  {
         if (assign_type(fl, type) != 0)
                 return -EINVAL;
@@ -470,7 +470,7 @@ static int lease_init(struct file *filp, int type, struct file_lock *fl)
 }
 
 /* Allocate a file_lock initialised to this type of lease */
-static struct file_lock *lease_alloc(struct file *filp, int type)
+static struct file_lock *lease_alloc(struct file *filp, long type)
 {
         struct file_lock *fl = locks_alloc_lock();
         int error = -ENOMEM;
diff --git a/fs/namei.c b/fs/namei.c
index 14ab8d3f2f0..16bda6cd602 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -136,7 +136,7 @@ static int do_getname(const char __user *filename, char *page)
         return retval;
 }
 
-static char *getname_flags(const char __user * filename, int flags)
+static char *getname_flags(const char __user *filename, int flags, int *empty)
 {
         char *tmp, *result;
 
@@ -147,6 +147,8 @@ static char *getname_flags(const char __user * filename, int flags)
 
                 result = tmp;
                 if (retval < 0) {
+                        if (retval == -ENOENT && empty)
+                                *empty = 1;
                         if (retval != -ENOENT || !(flags & LOOKUP_EMPTY)) {
                                 __putname(tmp);
                                 result = ERR_PTR(retval);
@@ -159,7 +161,7 @@ static char *getname_flags(const char __user * filename, int flags)
 
 char *getname(const char __user * filename)
 {
-        return getname_flags(filename, 0);
+        return getname_flags(filename, 0, 0);
 }
 
 #ifdef CONFIG_AUDITSYSCALL
@@ -779,17 +781,20 @@ static int follow_automount(struct path *path, unsigned flags,
         if ((flags & LOOKUP_NO_AUTOMOUNT) && !(flags & LOOKUP_CONTINUE))
                 return -EISDIR; /* we actually want to stop here */
 
-        /* We want to mount if someone is trying to open/create a file of any
-         * type under the mountpoint, wants to traverse through the mountpoint
-         * or wants to open the mounted directory.
+        /* We don't want to mount if someone's just doing a stat -
+         * unless they're stat'ing a directory and appended a '/' to
+         * the name.
          *
-         * We don't want to mount if someone's just doing a stat and they've
-         * set AT_SYMLINK_NOFOLLOW - unless they're stat'ing a directory and
-         * appended a '/' to the name.
+         * We do, however, want to mount if someone wants to open or
+         * create a file of any type under the mountpoint, wants to
+         * traverse through the mountpoint or wants to open the
+         * mounted directory.  Also, autofs may mark negative dentries
+         * as being automount points.  These will need the attentions
+         * of the daemon to instantiate them before they can be used.
          */
-        if (!(flags & LOOKUP_FOLLOW) &&
-            !(flags & (LOOKUP_CONTINUE | LOOKUP_DIRECTORY |
-                       LOOKUP_OPEN | LOOKUP_CREATE)))
+        if (!(flags & (LOOKUP_CONTINUE | LOOKUP_DIRECTORY |
+                     LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
+            path->dentry->d_inode)
                 return -EISDIR;
 
         current->total_link_count++;
@@ -905,7 +910,7 @@ static int follow_managed(struct path *path, unsigned flags)
                 mntput(path->mnt);
         if (ret == -EISDIR)
                 ret = 0;
-        return ret;
+        return ret < 0 ? ret : need_mntput;
 }
 
 int follow_down_one(struct path *path)
@@ -953,6 +958,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                         break;
                 path->mnt = mounted;
                 path->dentry = mounted->mnt_root;
+                nd->flags |= LOOKUP_JUMPED;
                 nd->seq = read_seqcount_begin(&path->dentry->d_seq);
                 /*
                  * Update the inode too. We don't need to re-check the
@@ -1227,6 +1233,8 @@ retry:
                 path_put_conditional(path, nd);
                 return err;
         }
+        if (err)
+                nd->flags |= LOOKUP_JUMPED;
         *inode = path->dentry->d_inode;
         return 0;
 }
@@ -1747,11 +1755,11 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
         return __lookup_hash(&this, base, NULL);
 }
 
-int user_path_at(int dfd, const char __user *name, unsigned flags,
-                 struct path *path)
+int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
+                 struct path *path, int *empty)
 {
         struct nameidata nd;
-        char *tmp = getname_flags(name, flags);
+        char *tmp = getname_flags(name, flags, empty);
         int err = PTR_ERR(tmp);
         if (!IS_ERR(tmp)) {
 
@@ -1765,6 +1773,12 @@ int user_path_at(int dfd, const char __user *name, unsigned flags,
         return err;
 }
 
+int user_path_at(int dfd, const char __user *name, unsigned flags,
+                 struct path *path)
+{
+        return user_path_at_empty(dfd, name, flags, path, 0);
+}
+
 static int user_path_parent(int dfd, const char __user *path,
                         struct nameidata *nd, char **name)
 {
@@ -2095,7 +2109,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
                 /* sayonara */
                 error = complete_walk(nd);
                 if (error)
-                        return ERR_PTR(-ECHILD);
+                        return ERR_PTR(error);
 
                 error = -ENOTDIR;
                 if (nd->flags & LOOKUP_DIRECTORY) {
@@ -2107,6 +2121,10 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
         }
 
         /* create side of things */
+        /*
+         * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED has been
+         * cleared when we got to the last component we are about to look up
+         */
         error = complete_walk(nd);
         if (error)
                 return ERR_PTR(error);
@@ -2175,6 +2193,9 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
         if (error < 0)
                 goto exit_dput;
 
+        if (error)
+                nd->flags |= LOOKUP_JUMPED;
+
         error = -ENOENT;
         if (!path->dentry->d_inode)
                 goto exit_dput;
@@ -2184,6 +2205,10 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
 
         path_to_nameidata(path, nd);
         nd->inode = path->dentry->d_inode;
+        /* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
+        error = complete_walk(nd);
+        if (error)
+                return ERR_PTR(error);
         error = -EISDIR;
         if (S_ISDIR(nd->inode->i_mode))
                 goto exit;
@@ -2582,6 +2607,7 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
         if (!dir->i_op->rmdir)
                 return -EPERM;
 
+        dget(dentry);
         mutex_lock(&dentry->d_inode->i_mutex);
 
         error = -EBUSY;
@@ -2602,6 +2628,7 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
 
 out:
         mutex_unlock(&dentry->d_inode->i_mutex);
+        dput(dentry);
         if (!error)
                 d_delete(dentry);
         return error;
@@ -3005,6 +3032,7 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
         if (error)
                 return error;
 
+        dget(new_dentry);
         if (target)
                 mutex_lock(&target->i_mutex);
 
@@ -3025,6 +3053,7 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
 out:
         if (target)
                 mutex_unlock(&target->i_mutex);
+        dput(new_dentry);
         if (!error)
                 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
                         d_move(old_dentry,new_dentry);
diff --git a/fs/namespace.c b/fs/namespace.c
index fe59bd145d2..b3d8f51c6fa 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1048,15 +1048,12 @@ static int show_mountinfo(struct seq_file *m, void *v)
         if (err)
                 goto out;
         seq_putc(m, ' ');
-        seq_path_root(m, &mnt_path, &root, " \t\n\\");
-        if (root.mnt != p->root.mnt || root.dentry != p->root.dentry) {
-                /*
-                 * Mountpoint is outside root, discard that one.  Ugly,
-                 * but less so than trying to do that in iterator in a
-                 * race-free way (due to renames).
-                 */
-                return SEQ_SKIP;
-        }
+
+        /* mountpoints outside of chroot jail will give SEQ_SKIP on this */
+        err = seq_path_root(m, &mnt_path, &root, " \t\n\\");
+        if (err)
+                goto out;
+
         seq_puts(m, mnt->mnt_flags & MNT_READONLY ? " ro" : " rw");
         show_mnt_opts(m, mnt);
 
@@ -1109,6 +1106,7 @@ static int show_vfsstat(struct seq_file *m, void *v)
 
         /* device */
         if (mnt->mnt_sb->s_op->show_devname) {
+                seq_puts(m, "device ");
                 err = mnt->mnt_sb->s_op->show_devname(m, mnt);
         } else {
                 if (mnt->mnt_devname) {
@@ -1246,8 +1244,9 @@ void umount_tree(struct vfsmount *mnt, int propagate, struct list_head *kill)
                 list_del_init(&p->mnt_expire);
                 list_del_init(&p->mnt_list);
                 __touch_mnt_namespace(p->mnt_ns);
+                if (p->mnt_ns)
+                        __mnt_make_shortterm(p);
                 p->mnt_ns = NULL;
-                __mnt_make_shortterm(p);
                 list_del_init(&p->mnt_child);
                 if (p->mnt_parent != p) {
                         p->mnt_parent->mnt_ghosts++;
@@ -1757,7 +1756,7 @@ static int do_loopback(struct path *path, char *old_name,
                 return err;
         if (!old_name || !*old_name)
                 return -EINVAL;
-        err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
+        err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
         if (err)
                 return err;
 
@@ -2724,3 +2723,8 @@ struct vfsmount *kern_mount_data(struct file_system_type *type, void *data)
         return vfs_kern_mount(type, MS_KERNMOUNT, type->name, data);
 }
 EXPORT_SYMBOL_GPL(kern_mount_data);
+
+bool our_mnt(struct vfsmount *mnt)
+{
+        return check_mnt(mnt);
+}
diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
index b257383bb56..07df5f1d85e 100644
--- a/fs/nfs/callback.h
+++ b/fs/nfs/callback.h
@@ -38,6 +38,7 @@ enum nfs4_callback_opnum {
 struct cb_process_state {
         __be32                  drc_status;
         struct nfs_client       *clp;
+        int                     slotid;
 };
 
 struct cb_compound_hdr_arg {
@@ -166,7 +167,6 @@ extern unsigned nfs4_callback_layoutrecall(
         void *dummy, struct cb_process_state *cps);
 
 extern void nfs4_check_drain_bc_complete(struct nfs4_session *ses);
-extern void nfs4_cb_take_slot(struct nfs_client *clp);
 
 struct cb_devicenotifyitem {
         uint32_t                cbd_notify_type;
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index d4d1954e9bb..b5c826e17b6 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -324,7 +324,7 @@ validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
         dprintk("%s enter. slotid %d seqid %d\n",
                 __func__, args->csa_slotid, args->csa_sequenceid);
 
-        if (args->csa_slotid > NFS41_BC_MAX_CALLBACKS)
+        if (args->csa_slotid >= NFS41_BC_MAX_CALLBACKS)
                 return htonl(NFS4ERR_BADSLOT);
 
         slot = tbl->slots + args->csa_slotid;
@@ -333,7 +333,7 @@ validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
         /* Normal */
         if (likely(args->csa_sequenceid == slot->seq_nr + 1)) {
                 slot->seq_nr++;
-                return htonl(NFS4_OK);
+                goto out_ok;
         }
 
         /* Replay */
@@ -352,11 +352,14 @@ validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
         /* Wraparound */
         if (args->csa_sequenceid == 1 && (slot->seq_nr + 1) == 0) {
                 slot->seq_nr = 1;
-                return htonl(NFS4_OK);
+                goto out_ok;
         }
 
         /* Misordered request */
         return htonl(NFS4ERR_SEQ_MISORDERED);
+out_ok:
+        tbl->highest_used_slotid = args->csa_slotid;
+        return htonl(NFS4_OK);
 }
 
 /*
@@ -418,26 +421,37 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
                               struct cb_sequenceres *res,
                               struct cb_process_state *cps)
 {
+        struct nfs4_slot_table *tbl;
         struct nfs_client *clp;
         int i;
         __be32 status = htonl(NFS4ERR_BADSESSION);
 
-        cps->clp = NULL;
-
         clp = nfs4_find_client_sessionid(args->csa_addr, &args->csa_sessionid);
         if (clp == NULL)
                 goto out;
 
+        tbl = &clp->cl_session->bc_slot_table;
+
+        spin_lock(&tbl->slot_tbl_lock);
         /* state manager is resetting the session */
         if (test_bit(NFS4_SESSION_DRAINING, &clp->cl_session->session_state)) {
-                status = NFS4ERR_DELAY;
+                spin_unlock(&tbl->slot_tbl_lock);
+                status = htonl(NFS4ERR_DELAY);
+                /* Return NFS4ERR_BADSESSION if we're draining the session
+                 * in order to reset it.
+                 */
+                if (test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state))
+                        status = htonl(NFS4ERR_BADSESSION);
                 goto out;
         }
 
         status = validate_seqid(&clp->cl_session->bc_slot_table, args);
+        spin_unlock(&tbl->slot_tbl_lock);
         if (status)
                 goto out;
 
+        cps->slotid = args->csa_slotid;
+
         /*
          * Check for pending referring calls.  If a match is found, a
          * related callback was received before the response to the original
@@ -454,7 +468,6 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
         res->csr_slotid = args->csa_slotid;
         res->csr_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;
         res->csr_target_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;
-        nfs4_cb_take_slot(clp);
 
 out:
         cps->clp = clp; /* put in nfs4_callback_compound */
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index c6c86a77e04..918ad647afe 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -754,26 +754,15 @@ static void nfs4_callback_free_slot(struct nfs4_session *session)
          * Let the state manager know callback processing done.
          * A single slot, so highest used slotid is either 0 or -1
          */
-        tbl->highest_used_slotid--;
+        tbl->highest_used_slotid = -1;
         nfs4_check_drain_bc_complete(session);
         spin_unlock(&tbl->slot_tbl_lock);
 }
 
-static void nfs4_cb_free_slot(struct nfs_client *clp)
+static void nfs4_cb_free_slot(struct cb_process_state *cps)
 {
-        if (clp && clp->cl_session)
-                nfs4_callback_free_slot(clp->cl_session);
-}
-
-/* A single slot, so highest used slotid is either 0 or -1 */
-void nfs4_cb_take_slot(struct nfs_client *clp)
-{
-        struct nfs4_slot_table *tbl = &clp->cl_session->bc_slot_table;
-
-        spin_lock(&tbl->slot_tbl_lock);
-        tbl->highest_used_slotid++;
-        BUG_ON(tbl->highest_used_slotid != 0);
-        spin_unlock(&tbl->slot_tbl_lock);
+        if (cps->slotid != -1)
+                nfs4_callback_free_slot(cps->clp->cl_session);
 }
 
 #else /* CONFIG_NFS_V4_1 */
@@ -784,7 +773,7 @@ preprocess_nfs41_op(int nop, unsigned int op_nr, struct callback_op **op)
         return htonl(NFS4ERR_MINOR_VERS_MISMATCH);
 }
 
-static void nfs4_cb_free_slot(struct nfs_client *clp)
+static void nfs4_cb_free_slot(struct cb_process_state *cps)
 {
 }
 #endif /* CONFIG_NFS_V4_1 */
@@ -866,6 +855,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
         struct cb_process_state cps = {
                 .drc_status = 0,
                 .clp = NULL,
+                .slotid = -1,
         };
         unsigned int nops = 0;
 
@@ -906,7 +896,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
 
         *hdr_res.status = status;
         *hdr_res.nops = htonl(nops);
-        nfs4_cb_free_slot(cps.clp);
+        nfs4_cb_free_slot(&cps);
         nfs_put_client(cps.clp);
         dprintk("%s: done, status = %u\n", __func__, ntohl(status));
         return rpc_success;
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index dd25c2aec37..ecabbd8f6ee 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -398,12 +398,11 @@ int nfs_inode_return_delegation(struct inode *inode)
         return err;
 }
 
-static void nfs_mark_return_delegation(struct nfs_delegation *delegation)
+static void nfs_mark_return_delegation(struct nfs_server *server,
+                struct nfs_delegation *delegation)
 {
-        struct nfs_client *clp = NFS_SERVER(delegation->inode)->nfs_client;
-
         set_bit(NFS_DELEGATION_RETURN, &delegation->flags);
-        set_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state);
+        set_bit(NFS4CLNT_DELEGRETURN, &server->nfs_client->cl_state);
 }
 
 /**
@@ -441,7 +440,7 @@ static void nfs_mark_return_all_delegation_types(struct nfs_server *server,
                 if ((delegation->type == (FMODE_READ|FMODE_WRITE)) && !(flags & FMODE_WRITE))
                         continue;
                 if (delegation->type & flags)
-                        nfs_mark_return_delegation(delegation);
+                        nfs_mark_return_delegation(server, delegation);
         }
 }
 
@@ -467,6 +466,17 @@ static void nfs_delegation_run_state_manager(struct nfs_client *clp)
                 nfs4_schedule_state_manager(clp);
 }
 
+void nfs_remove_bad_delegation(struct inode *inode)
+{
+        struct nfs_delegation *delegation;
+
+        delegation = nfs_detach_delegation(NFS_I(inode), NFS_SERVER(inode));
+        if (delegation) {
+                nfs_inode_find_state_and_recover(inode, &delegation->stateid);
+                nfs_free_delegation(delegation);
+        }
+}
+
 /**
  * nfs_expire_all_delegation_types
  * @clp: client to process
@@ -508,7 +518,7 @@ static void nfs_mark_return_unreferenced_delegations(struct nfs_server *server)
         list_for_each_entry_rcu(delegation, &server->delegations, super_list) {
                 if (test_and_clear_bit(NFS_DELEGATION_REFERENCED, &delegation->flags))
                         continue;
-                nfs_mark_return_delegation(delegation);
+                nfs_mark_return_delegation(server, delegation);
         }
 }
 
@@ -539,7 +549,8 @@ void nfs_expire_unreferenced_delegations(struct nfs_client *clp)
 int nfs_async_inode_return_delegation(struct inode *inode,
                                       const nfs4_stateid *stateid)
 {
-        struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
+        struct nfs_server *server = NFS_SERVER(inode);
+        struct nfs_client *clp = server->nfs_client;
         struct nfs_delegation *delegation;
 
         rcu_read_lock();
@@ -549,7 +560,7 @@ int nfs_async_inode_return_delegation(struct inode *inode,
                 rcu_read_unlock();
                 return -ENOENT;
         }
-        nfs_mark_return_delegation(delegation);
+        nfs_mark_return_delegation(server, delegation);
         rcu_read_unlock();
 
         nfs_delegation_run_state_manager(clp);
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index d9322e490c5..691a7960918 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -45,6 +45,7 @@ void nfs_expire_unreferenced_delegations(struct nfs_client *clp);
 void nfs_handle_cb_pathdown(struct nfs_client *clp);
 int nfs_client_return_marked_delegations(struct nfs_client *clp);
 int nfs_delegations_present(struct nfs_client *clp);
+void nfs_remove_bad_delegation(struct inode *inode);
 
 void nfs_delegation_mark_reclaim(struct nfs_client *clp);
 void nfs_delegation_reap_unclaimed(struct nfs_client *clp);
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index ededdbd0db3..462a0060173 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -134,18 +134,19 @@ const struct inode_operations nfs4_dir_inode_operations = {
 
 #endif /* CONFIG_NFS_V4 */
 
-static struct nfs_open_dir_context *alloc_nfs_open_dir_context(struct rpc_cred *cred)
+static struct nfs_open_dir_context *alloc_nfs_open_dir_context(struct inode *dir, struct rpc_cred *cred)
 {
         struct nfs_open_dir_context *ctx;
         ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
         if (ctx != NULL) {
                 ctx->duped = 0;
+                ctx->attr_gencount = NFS_I(dir)->attr_gencount;
                 ctx->dir_cookie = 0;
                 ctx->dup_cookie = 0;
                 ctx->cred = get_rpccred(cred);
-        } else
-                ctx = ERR_PTR(-ENOMEM);
-        return ctx;
+                return ctx;
+        }
+        return  ERR_PTR(-ENOMEM);
 }
 
 static void put_nfs_open_dir_context(struct nfs_open_dir_context *ctx)
@@ -173,7 +174,7 @@ nfs_opendir(struct inode *inode, struct file *filp)
         cred = rpc_lookup_cred();
         if (IS_ERR(cred))
                 return PTR_ERR(cred);
-        ctx = alloc_nfs_open_dir_context(cred);
+        ctx = alloc_nfs_open_dir_context(inode, cred);
         if (IS_ERR(ctx)) {
                 res = PTR_ERR(ctx);
                 goto out;
@@ -323,7 +324,6 @@ int nfs_readdir_search_for_pos(struct nfs_cache_array *array, nfs_readdir_descri
 {
         loff_t diff = desc->file->f_pos - desc->current_index;
         unsigned int index;
-        struct nfs_open_dir_context *ctx = desc->file->private_data;
 
         if (diff < 0)
                 goto out_eof;
@@ -336,7 +336,6 @@ int nfs_readdir_search_for_pos(struct nfs_cache_array *array, nfs_readdir_descri
         index = (unsigned int)diff;
         *desc->dir_cookie = array->array[index].cookie;
         desc->cache_entry_index = index;
-        ctx->duped = 0;
         return 0;
 out_eof:
         desc->eof = 1;
@@ -349,14 +348,33 @@ int nfs_readdir_search_for_cookie(struct nfs_cache_array *array, nfs_readdir_des
         int i;
         loff_t new_pos;
         int status = -EAGAIN;
-        struct nfs_open_dir_context *ctx = desc->file->private_data;
 
         for (i = 0; i < array->size; i++) {
                 if (array->array[i].cookie == *desc->dir_cookie) {
+                        struct nfs_inode *nfsi = NFS_I(desc->file->f_path.dentry->d_inode);
+                        struct nfs_open_dir_context *ctx = desc->file->private_data;
+
                         new_pos = desc->current_index + i;
-                        if (new_pos < desc->file->f_pos) {
+                        if (ctx->attr_gencount != nfsi->attr_gencount
+                            || (nfsi->cache_validity & (NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA))) {
+                                ctx->duped = 0;
+                                ctx->attr_gencount = nfsi->attr_gencount;
+                        } else if (new_pos < desc->file->f_pos) {
+                                if (ctx->duped > 0
+                                    && ctx->dup_cookie == *desc->dir_cookie) {
+                                        if (printk_ratelimit()) {
+                                                pr_notice("NFS: directory %s/%s contains a readdir loop."
+                                                                "Please contact your server vendor.  "
+                                                                "Offending cookie: %llu\n",
+                                                                desc->file->f_dentry->d_parent->d_name.name,
+                                                                desc->file->f_dentry->d_name.name,
+                                                                *desc->dir_cookie);
+                                        }
+                                        status = -ELOOP;
+                                        goto out;
+                                }
                                 ctx->dup_cookie = *desc->dir_cookie;
-                                ctx->duped = 1;
+                                ctx->duped = -1;
                         }
                         desc->file->f_pos = new_pos;
                         desc->cache_entry_index = i;
@@ -368,6 +386,7 @@ int nfs_readdir_search_for_cookie(struct nfs_cache_array *array, nfs_readdir_des
                 if (*desc->dir_cookie == array->last_cookie)
                         desc->eof = 1;
         }
+out:
         return status;
 }
 
@@ -740,19 +759,6 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc, void *dirent,
         struct nfs_cache_array *array = NULL;
         struct nfs_open_dir_context *ctx = file->private_data;
 
-        if (ctx->duped != 0 && ctx->dup_cookie == *desc->dir_cookie) {
-                if (printk_ratelimit()) {
-                        pr_notice("NFS: directory %s/%s contains a readdir loop.  "
-                                "Please contact your server vendor.  "
-                                "Offending cookie: %llu\n",
-                                file->f_dentry->d_parent->d_name.name,
-                                file->f_dentry->d_name.name,
-                                *desc->dir_cookie);
-                }
-                res = -ELOOP;
-                goto out;
-        }
-
         array = nfs_readdir_get_array(desc->page);
         if (IS_ERR(array)) {
                 res = PTR_ERR(array);
@@ -774,6 +780,8 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc, void *dirent,
                         *desc->dir_cookie = array->array[i+1].cookie;
                 else
                         *desc->dir_cookie = array->last_cookie;
+                if (ctx->duped != 0)
+                        ctx->duped = 1;
         }
         if (array->eof_index >= 0)
                 desc->eof = 1;
@@ -805,6 +813,7 @@ int uncached_readdir(nfs_readdir_descriptor_t *desc, void *dirent,
         struct page     *page = NULL;
         int             status;
         struct inode *inode = desc->file->f_path.dentry->d_inode;
+        struct nfs_open_dir_context *ctx = desc->file->private_data;
 
         dfprintk(DIRCACHE, "NFS: uncached_readdir() searching for cookie %Lu\n",
                         (unsigned long long)*desc->dir_cookie);
@@ -818,6 +827,7 @@ int uncached_readdir(nfs_readdir_descriptor_t *desc, void *dirent,
         desc->page_index = 0;
         desc->last_cookie = *desc->dir_cookie;
         desc->page = page;
+        ctx->duped = 0;
 
         status = nfs_readdir_xdr_to_array(desc, page, inode);
         if (status < 0)
@@ -1448,12 +1458,12 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
                                 res = NULL;
                                 goto out;
                         /* This turned out not to be a regular file */
+                        case -EISDIR:
                         case -ENOTDIR:
                                 goto no_open;
                         case -ELOOP:
                                 if (!(nd->intent.open.flags & O_NOFOLLOW))
                                         goto no_open;
-                        /* case -EISDIR: */
                         /* case -EINVAL: */
                         default:
                                 res = ERR_CAST(inode);
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 2f093ed1698..6c6e2c46122 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -493,8 +493,11 @@ static int nfs_release_page(struct page *page, gfp_t gfp)
 
         dfprintk(PAGECACHE, "NFS: release_page(%p)\n", page);
 
-        /* Only do I/O if gfp is a superset of GFP_KERNEL */
-        if (mapping && (gfp & GFP_KERNEL) == GFP_KERNEL) {
+        /* Only do I/O if gfp is a superset of GFP_KERNEL, and we're not
+         * doing this memory reclaim for a fs-related allocation.
+         */
+        if (mapping && (gfp & GFP_KERNEL) == GFP_KERNEL &&
+            !(current->flags & PF_FSTRANS)) {
                 int how = FLUSH_SYNC;
 
                 /* Don't let kswapd deadlock waiting for OOM RPC calls */
@@ -887,3 +890,35 @@ static int nfs_setlease(struct file *file, long arg, struct file_lock **fl)
                         file->f_path.dentry->d_name.name, arg);
         return -EINVAL;
 }
+
+#ifdef CONFIG_NFS_V4
+static int
+nfs4_file_open(struct inode *inode, struct file *filp)
+{
+        /*
+         * NFSv4 opens are handled in d_lookup and d_revalidate. If we get to
+         * this point, then something is very wrong
+         */
+        dprintk("NFS: %s called! inode=%p filp=%p\n", __func__, inode, filp);
+        return -ENOTDIR;
+}
+
+const struct file_operations nfs4_file_operations = {
+        .llseek         = nfs_file_llseek,
+        .read           = do_sync_read,
+        .write          = do_sync_write,
+        .aio_read       = nfs_file_read,
+        .aio_write      = nfs_file_write,
+        .mmap           = nfs_file_mmap,
+        .open           = nfs4_file_open,
+        .flush          = nfs_file_flush,
+        .release        = nfs_file_release,
+        .fsync          = nfs_file_fsync,
+        .lock           = nfs_lock,
+        .flock          = nfs_flock,
+        .splice_read    = nfs_file_splice_read,
+        .splice_write   = nfs_file_splice_write,
+        .check_flags    = nfs_check_flags,
+        .setlease       = nfs_setlease,
+};
+#endif /* CONFIG_NFS_V4 */
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 6f4850deb27..c48f9f6ad72 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -291,7 +291,7 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr)
                  */
                 inode->i_op = NFS_SB(sb)->nfs_client->rpc_ops->file_inode_ops;
                 if (S_ISREG(inode->i_mode)) {
-                        inode->i_fop = &nfs_file_operations;
+                        inode->i_fop = NFS_SB(sb)->nfs_client->rpc_ops->file_ops;
                         inode->i_data.a_ops = &nfs_file_aops;
                         inode->i_data.backing_dev_info = &NFS_SB(sb)->backing_dev_info;
                 } else if (S_ISDIR(inode->i_mode)) {
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 2a55347a2da..4f10d8188ab 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -315,7 +315,7 @@ void nfs_commit_release_pages(struct nfs_write_data *data);
 
 #ifdef CONFIG_MIGRATION
 extern int nfs_migrate_page(struct address_space *,
-                struct page *, struct page *);
+                struct page *, struct page *, enum migrate_mode);
 #else
 #define nfs_migrate_page NULL
 #endif
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 38053d823eb..771741f1479 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -853,6 +853,7 @@ const struct nfs_rpc_ops nfs_v3_clientops = {
         .dentry_ops     = &nfs_dentry_operations,
         .dir_inode_ops  = &nfs3_dir_inode_operations,
         .file_inode_ops = &nfs3_file_inode_operations,
+        .file_ops       = &nfs_file_operations,
         .getroot        = nfs3_proc_get_root,
         .getattr        = nfs3_proc_getattr,
         .setattr        = nfs3_proc_setattr,
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index c4a69833dd0..e1c1365ba83 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -209,6 +209,7 @@ struct nfs4_exception {
         long timeout;
         int retry;
         struct nfs4_state *state;
+        struct inode *inode;
 };
 
 struct nfs4_state_recovery_ops {
@@ -344,6 +345,8 @@ extern void nfs4_put_open_state(struct nfs4_state *);
 extern void nfs4_close_state(struct path *, struct nfs4_state *, fmode_t);
 extern void nfs4_close_sync(struct path *, struct nfs4_state *, fmode_t);
 extern void nfs4_state_set_mode_locked(struct nfs4_state *, fmode_t);
+extern void nfs_inode_find_state_and_recover(struct inode *inode,
+                const nfs4_stateid *stateid);
 extern void nfs4_schedule_lease_recovery(struct nfs_client *);
 extern void nfs4_schedule_state_manager(struct nfs_client *);
 extern void nfs4_schedule_stateid_recovery(const struct nfs_server *, struct nfs4_state *);
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index f9d03abcd04..75af81211e4 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -170,7 +170,7 @@ filelayout_set_layoutcommit(struct nfs_write_data *wdata)
 
         pnfs_set_layoutcommit(wdata);
         dprintk("%s ionde %lu pls_end_pos %lu\n", __func__, wdata->inode->i_ino,
-                (unsigned long) wdata->lseg->pls_end_pos);
+                (unsigned long) NFS_I(wdata->inode)->layout->plh_lwb);
 }
 
 /*
@@ -428,6 +428,14 @@ filelayout_check_layout(struct pnfs_layout_hdr *lo,
 
         dprintk("--> %s\n", __func__);
 
+        /* FIXME: remove this check when layout segment support is added */
+        if (lgr->range.offset != 0 ||
+            lgr->range.length != NFS4_MAX_UINT64) {
+                dprintk("%s Only whole file layouts supported. Use MDS i/o\n",
+                        __func__);
+                goto out;
+        }
+
         if (fl->pattern_offset > lgr->range.offset) {
                 dprintk("%s pattern_offset %lld too large\n",
                                 __func__, fl->pattern_offset);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 5879b23e0c9..b7a7e5fe401 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -94,6 +94,8 @@ static int nfs4_map_errors(int err)
         case -NFS4ERR_BADOWNER:
         case -NFS4ERR_BADNAME:
                 return -EINVAL;
+        case -NFS4ERR_SHARE_DENIED:
+                return -EACCES;
         default:
                 dprintk("%s could not handle NFSv4 error %d\n",
                                 __func__, -err);
@@ -254,15 +256,28 @@ static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struc
 {
         struct nfs_client *clp = server->nfs_client;
         struct nfs4_state *state = exception->state;
+        struct inode *inode = exception->inode;
         int ret = errorcode;
 
         exception->retry = 0;
         switch(errorcode) {
                 case 0:
                         return 0;
+                case -NFS4ERR_OPENMODE:
+                        if (nfs_have_delegation(inode, FMODE_READ)) {
+                                nfs_inode_return_delegation(inode);
+                                exception->retry = 1;
+                                return 0;
+                        }
+                        if (state == NULL)
+                                break;
+                        nfs4_schedule_stateid_recovery(server, state);
+                        goto wait_on_recovery;
+                case -NFS4ERR_DELEG_REVOKED:
                 case -NFS4ERR_ADMIN_REVOKED:
                 case -NFS4ERR_BAD_STATEID:
-                case -NFS4ERR_OPENMODE:
+                        if (state != NULL)
+                                nfs_remove_bad_delegation(state->inode);
                         if (state == NULL)
                                 break;
                         nfs4_schedule_stateid_recovery(server, state);
@@ -1305,8 +1320,11 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state
                                  * The show must go on: exit, but mark the
                                  * stateid as needing recovery.
                                  */
+                        case -NFS4ERR_DELEG_REVOKED:
                         case -NFS4ERR_ADMIN_REVOKED:
                         case -NFS4ERR_BAD_STATEID:
+                                nfs_inode_find_state_and_recover(state->inode,
+                                                stateid);
                                 nfs4_schedule_stateid_recovery(server, state);
                         case -EKEYEXPIRED:
                                 /*
@@ -1755,6 +1773,7 @@ static int _nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, in
                         nfs_setattr_update_inode(state->inode, sattr);
                 nfs_post_op_update_inode(state->inode, opendata->o_res.f_attr);
         }
+        nfs_revalidate_inode(server, state->inode);
         nfs4_opendata_put(opendata);
         nfs4_put_state_owner(sp);
         *res = state;
@@ -1862,7 +1881,10 @@ static int nfs4_do_setattr(struct inode *inode, struct rpc_cred *cred,
                            struct nfs4_state *state)
 {
         struct nfs_server *server = NFS_SERVER(inode);
-        struct nfs4_exception exception = { };
+        struct nfs4_exception exception = {
+                .state = state,
+                .inode = inode,
+        };
         int err;
         do {
                 err = nfs4_handle_exception(server,
@@ -3678,8 +3700,11 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
         if (task->tk_status >= 0)
                 return 0;
         switch(task->tk_status) {
+                case -NFS4ERR_DELEG_REVOKED:
                 case -NFS4ERR_ADMIN_REVOKED:
                 case -NFS4ERR_BAD_STATEID:
+                        if (state != NULL)
+                                nfs_remove_bad_delegation(state->inode);
                 case -NFS4ERR_OPENMODE:
                         if (state == NULL)
                                 break;
@@ -4402,7 +4427,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
 static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
 {
         struct nfs_server *server = NFS_SERVER(state->inode);
-        struct nfs4_exception exception = { };
+        struct nfs4_exception exception = {
+                .inode = state->inode,
+        };
         int err;
 
         do {
@@ -4420,7 +4447,9 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request
 static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
 {
         struct nfs_server *server = NFS_SERVER(state->inode);
-        struct nfs4_exception exception = { };
+        struct nfs4_exception exception = {
+                .inode = state->inode,
+        };
         int err;
 
         err = nfs4_set_lock_state(state, request);
@@ -4484,7 +4513,10 @@ out:
 
 static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
 {
-        struct nfs4_exception exception = { };
+        struct nfs4_exception exception = {
+                .state = state,
+                .inode = state->inode,
+        };
         int err;
 
         do {
@@ -4529,6 +4561,20 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
 
         if (state == NULL)
                 return -ENOLCK;
+        /*
+         * Don't rely on the VFS having checked the file open mode,
+         * since it won't do this for flock() locks.
+         */
+        switch (request->fl_type & (F_RDLCK|F_WRLCK|F_UNLCK)) {
+        case F_RDLCK:
+                if (!(filp->f_mode & FMODE_READ))
+                        return -EBADF;
+                break;
+        case F_WRLCK:
+                if (!(filp->f_mode & FMODE_WRITE))
+                        return -EBADF;
+        }
+
         do {
                 status = nfs4_proc_setlk(state, cmd, request);
                 if ((status != -EAGAIN) || IS_SETLK(cmd))
@@ -4577,6 +4623,7 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
                                  * The show must go on: exit, but mark the
                                  * stateid as needing recovery.
                                  */
+                        case -NFS4ERR_DELEG_REVOKED:
                         case -NFS4ERR_ADMIN_REVOKED:
                         case -NFS4ERR_BAD_STATEID:
                         case -NFS4ERR_OPENMODE:
@@ -5850,9 +5897,15 @@ nfs4_layoutcommit_done(struct rpc_task *task, void *calldata)
 static void nfs4_layoutcommit_release(void *calldata)
 {
         struct nfs4_layoutcommit_data *data = calldata;
+        struct pnfs_layout_segment *lseg, *tmp;
 
         /* Matched by references in pnfs_set_layoutcommit */
-        put_lseg(data->lseg);
+        list_for_each_entry_safe(lseg, tmp, &data->lseg_list, pls_lc_list) {
+                list_del_init(&lseg->pls_lc_list);
+                if (test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT,
+                                       &lseg->pls_flags))
+                        put_lseg(lseg);
+        }
         put_rpccred(data->cred);
         kfree(data);
 }
@@ -6002,6 +6055,7 @@ const struct nfs_rpc_ops nfs_v4_clientops = {
         .dentry_ops     = &nfs4_dentry_operations,
         .dir_inode_ops  = &nfs4_dir_inode_operations,
         .file_inode_ops = &nfs4_file_inode_operations,
+        .file_ops       = &nfs4_file_operations,
         .getroot        = nfs4_proc_get_root,
         .getattr        = nfs4_proc_getattr,
         .setattr        = nfs4_proc_setattr,
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index e97dd219f84..c6e2769f65b 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1069,6 +1069,33 @@ void nfs4_schedule_stateid_recovery(const struct nfs_server *server, struct nfs4
         nfs4_schedule_state_manager(clp);
 }
 
+void nfs_inode_find_state_and_recover(struct inode *inode,
+                const nfs4_stateid *stateid)
+{
+        struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
+        struct nfs_inode *nfsi = NFS_I(inode);
+        struct nfs_open_context *ctx;
+        struct nfs4_state *state;
+        bool found = false;
+
+        spin_lock(&inode->i_lock);
+        list_for_each_entry(ctx, &nfsi->open_files, list) {
+                state = ctx->state;
+                if (state == NULL)
+                        continue;
+                if (!test_bit(NFS_DELEGATED_STATE, &state->flags))
+                        continue;
+                if (memcmp(state->stateid.data, stateid->data, sizeof(state->stateid.data)) != 0)
+                        continue;
+                nfs4_state_mark_reclaim_nograce(clp, state);
+                found = true;
+        }
+        spin_unlock(&inode->i_lock);
+        if (found)
+                nfs4_schedule_state_manager(clp);
+}
+
+
 static int nfs4_reclaim_locks(struct nfs4_state *state, const struct nfs4_state_recovery_ops *ops)
 {
         struct inode *inode = state->inode;
@@ -1519,16 +1546,16 @@ void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags)
 {
         if (!flags)
                 return;
-        else if (flags & SEQ4_STATUS_RESTART_RECLAIM_NEEDED)
+        if (flags & SEQ4_STATUS_RESTART_RECLAIM_NEEDED)
                 nfs41_handle_server_reboot(clp);
-        else if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED |
+        if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED |
                             SEQ4_STATUS_EXPIRED_SOME_STATE_REVOKED |
                             SEQ4_STATUS_ADMIN_STATE_REVOKED |
                             SEQ4_STATUS_LEASE_MOVED))
                 nfs41_handle_state_revoked(clp);
-        else if (flags & SEQ4_STATUS_RECALLABLE_STATE_REVOKED)
+        if (flags & SEQ4_STATUS_RECALLABLE_STATE_REVOKED)
                 nfs41_handle_recallable_state_revoked(clp);
-        else if (flags & (SEQ4_STATUS_CB_PATH_DOWN |
+        if (flags & (SEQ4_STATUS_CB_PATH_DOWN |
                             SEQ4_STATUS_BACKCHANNEL_FAULT |
                             SEQ4_STATUS_CB_PATH_DOWN_SESSION))
                 nfs41_handle_cb_path_down(clp);
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index e6e8f3b9a1d..fc97fd5399a 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1888,7 +1888,7 @@ encode_layoutcommit(struct xdr_stream *xdr,
         *p++ = cpu_to_be32(OP_LAYOUTCOMMIT);
         /* Only whole file layouts */
         p = xdr_encode_hyper(p, 0); /* offset */
-        p = xdr_encode_hyper(p, NFS4_MAX_UINT64); /* length */
+        p = xdr_encode_hyper(p, args->lastbytewritten + 1);     /* length */
         *p++ = cpu_to_be32(0); /* reclaim */
         p = xdr_encode_opaque_fixed(p, args->stateid.data, NFS4_STATEID_SIZE);
         *p++ = cpu_to_be32(1); /* newoffset = TRUE */
diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
index 8ff2ea3f10e..75fe694d78d 100644
--- a/fs/nfs/objlayout/objio_osd.c
+++ b/fs/nfs/objlayout/objio_osd.c
@@ -479,7 +479,6 @@ static int _io_check(struct objio_state *ios, bool is_write)
         for (i = 0; i <  ios->numdevs; i++) {
                 struct osd_sense_info osi;
                 struct osd_request *or = ios->per_dev[i].or;
-                unsigned dev;
                 int ret;
 
                 if (!or)
@@ -500,9 +499,8 @@ static int _io_check(struct objio_state *ios, bool is_write)
 
                         continue; /* we recovered */
                 }
-                dev = ios->per_dev[i].dev;
-                objlayout_io_set_result(&ios->ol_state, dev,
-                                        &ios->layout->comps[dev].oc_object_id,
+                objlayout_io_set_result(&ios->ol_state, i,
+                                        &ios->layout->comps[i].oc_object_id,
                                         osd_pri_2_pnfs_err(osi.osd_err_pri),
                                         ios->per_dev[i].offset,
                                         ios->per_dev[i].length,
@@ -589,22 +587,19 @@ static void _calc_stripe_info(struct objio_state *ios, u64 file_offset,
 }
 
 static int _add_stripe_unit(struct objio_state *ios,  unsigned *cur_pg,
-                unsigned pgbase, struct _objio_per_comp *per_dev, int cur_len,
+                unsigned pgbase, struct _objio_per_comp *per_dev, int len,
                 gfp_t gfp_flags)
 {
         unsigned pg = *cur_pg;
+        int cur_len = len;
         struct request_queue *q =
                         osd_request_queue(_io_od(ios, per_dev->dev));
 
-        per_dev->length += cur_len;
-
         if (per_dev->bio == NULL) {
-                unsigned stripes = ios->layout->num_comps /
-                                                     ios->layout->mirrors_p1;
-                unsigned pages_in_stripe = stripes *
+                unsigned pages_in_stripe = ios->layout->group_width *
                                       (ios->layout->stripe_unit / PAGE_SIZE);
                 unsigned bio_size = (ios->ol_state.nr_pages + pages_in_stripe) /
-                                    stripes;
+                                    ios->layout->group_width;
 
                 if (BIO_MAX_PAGES_KMALLOC < bio_size)
                         bio_size = BIO_MAX_PAGES_KMALLOC;
@@ -632,6 +627,7 @@ static int _add_stripe_unit(struct objio_state *ios,  unsigned *cur_pg,
         }
         BUG_ON(cur_len);
 
+        per_dev->length += len;
         *cur_pg = pg;
         return 0;
 }
@@ -650,7 +646,7 @@ static int _prepare_one_group(struct objio_state *ios, u64 length,
         int ret = 0;
 
         while (length) {
-                struct _objio_per_comp *per_dev = &ios->per_dev[dev];
+                struct _objio_per_comp *per_dev = &ios->per_dev[dev - first_dev];
                 unsigned cur_len, page_off = 0;
 
                 if (!per_dev->length) {
@@ -670,8 +666,8 @@ static int _prepare_one_group(struct objio_state *ios, u64 length,
                                 cur_len = stripe_unit;
                         }
 
-                        if (max_comp < dev)
-                                max_comp = dev;
+                        if (max_comp < dev - first_dev)
+                                max_comp = dev - first_dev;
                 } else {
                         cur_len = stripe_unit;
                 }
@@ -806,7 +802,7 @@ static int _read_mirrors(struct objio_state *ios, unsigned cur_comp)
         struct _objio_per_comp *per_dev = &ios->per_dev[cur_comp];
         unsigned dev = per_dev->dev;
         struct pnfs_osd_object_cred *cred =
-                        &ios->layout->comps[dev];
+                        &ios->layout->comps[cur_comp];
         struct osd_obj_id obj = {
                 .partition = cred->oc_object_id.oid_partition_id,
                 .id = cred->oc_object_id.oid_object_id,
@@ -904,7 +900,7 @@ static int _write_mirrors(struct objio_state *ios, unsigned cur_comp)
         for (; cur_comp < last_comp; ++cur_comp, ++dev) {
                 struct osd_request *or = NULL;
                 struct pnfs_osd_object_cred *cred =
-                                        &ios->layout->comps[dev];
+                                        &ios->layout->comps[cur_comp];
                 struct osd_obj_id obj = {
                         .partition = cred->oc_object_id.oid_partition_id,
                         .id = cred->oc_object_id.oid_object_id,
@@ -1010,7 +1006,8 @@ static bool objio_pg_test(struct nfs_pageio_descriptor *pgio,
 static struct pnfs_layoutdriver_type objlayout_type = {
         .id = LAYOUT_OSD2_OBJECTS,
         .name = "LAYOUT_OSD2_OBJECTS",
-        .flags                   = PNFS_LAYOUTRET_ON_SETATTR,
+        .flags                   = PNFS_LAYOUTRET_ON_SETATTR |
+                                   PNFS_LAYOUTRET_ON_ERROR,
 
         .alloc_layout_hdr        = objlayout_alloc_layout_hdr,
         .free_layout_hdr         = objlayout_free_layout_hdr,
diff --git a/fs/nfs/objlayout/objlayout.c b/fs/nfs/objlayout/objlayout.c
index 1d06f8e2ade..fefa1224aff 100644
--- a/fs/nfs/objlayout/objlayout.c
+++ b/fs/nfs/objlayout/objlayout.c
@@ -294,9 +294,11 @@ objlayout_read_done(struct objlayout_io_state *state, ssize_t status, bool sync)
         dprintk("%s: Begin status=%zd eof=%d\n", __func__, status, eof);
         rdata = state->rpcdata;
         rdata->task.tk_status = status;
-        if (status >= 0) {
+        if (likely(status >= 0)) {
                 rdata->res.count = status;
                 rdata->res.eof = eof;
+        } else {
+                rdata->pnfs_error = status;
         }
         objlayout_iodone(state);
         /* must not use state after this point */
@@ -380,15 +382,17 @@ objlayout_write_done(struct objlayout_io_state *state, ssize_t status,
         wdata = state->rpcdata;
         state->status = status;
         wdata->task.tk_status = status;
-        if (status >= 0) {
+        if (likely(status >= 0)) {
                 wdata->res.count = status;
                 wdata->verf.committed = state->committed;
                 dprintk("%s: Return status %d committed %d\n",
                         __func__, wdata->task.tk_status,
                         wdata->verf.committed);
-        } else
+        } else {
+                wdata->pnfs_error = status;
                 dprintk("%s: Return status %d\n",
                         __func__, wdata->task.tk_status);
+        }
         objlayout_iodone(state);
         /* must not use state after this point */
 
diff --git a/fs/nfs/objlayout/pnfs_osd_xdr_cli.c b/fs/nfs/objlayout/pnfs_osd_xdr_cli.c
index 16fc758e912..b3918f7ac34 100644
--- a/fs/nfs/objlayout/pnfs_osd_xdr_cli.c
+++ b/fs/nfs/objlayout/pnfs_osd_xdr_cli.c
@@ -170,6 +170,9 @@ int pnfs_osd_xdr_decode_layout_map(struct pnfs_osd_layout *layout,
         p = _osd_xdr_decode_data_map(p, &layout->olo_map);
         layout->olo_comps_index = be32_to_cpup(p++);
         layout->olo_num_comps = be32_to_cpup(p++);
+        dprintk("%s: olo_comps_index=%d olo_num_comps=%d\n", __func__,
+                layout->olo_comps_index, layout->olo_num_comps);
+
         iter->total_comps = layout->olo_num_comps;
         return 0;
 }
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 29c0ca7fc34..99518872f42 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -189,6 +189,7 @@ static void
 pnfs_free_layout_hdr(struct pnfs_layout_hdr *lo)
 {
         struct pnfs_layoutdriver_type *ld = NFS_SERVER(lo->plh_inode)->pnfs_curr_ld;
+        put_rpccred(lo->plh_lc_cred);
         return ld->alloc_layout_hdr ? ld->free_layout_hdr(lo) : kfree(lo);
 }
 
@@ -223,6 +224,7 @@ static void
 init_lseg(struct pnfs_layout_hdr *lo, struct pnfs_layout_segment *lseg)
 {
         INIT_LIST_HEAD(&lseg->pls_list);
+        INIT_LIST_HEAD(&lseg->pls_lc_list);
         atomic_set(&lseg->pls_refcount, 1);
         smp_mb();
         set_bit(NFS_LSEG_VALID, &lseg->pls_flags);
@@ -805,7 +807,9 @@ out:
 }
 
 static struct pnfs_layout_hdr *
-alloc_init_layout_hdr(struct inode *ino, gfp_t gfp_flags)
+alloc_init_layout_hdr(struct inode *ino,
+                      struct nfs_open_context *ctx,
+                      gfp_t gfp_flags)
 {
         struct pnfs_layout_hdr *lo;
 
@@ -817,11 +821,14 @@ alloc_init_layout_hdr(struct inode *ino, gfp_t gfp_flags)
         INIT_LIST_HEAD(&lo->plh_segs);
         INIT_LIST_HEAD(&lo->plh_bulk_recall);
         lo->plh_inode = ino;
+        lo->plh_lc_cred = get_rpccred(ctx->state->owner->so_cred);
         return lo;
 }
 
 static struct pnfs_layout_hdr *
-pnfs_find_alloc_layout(struct inode *ino, gfp_t gfp_flags)
+pnfs_find_alloc_layout(struct inode *ino,
+                       struct nfs_open_context *ctx,
+                       gfp_t gfp_flags)
 {
         struct nfs_inode *nfsi = NFS_I(ino);
         struct pnfs_layout_hdr *new = NULL;
@@ -836,7 +843,7 @@ pnfs_find_alloc_layout(struct inode *ino, gfp_t gfp_flags)
                         return nfsi->layout;
         }
         spin_unlock(&ino->i_lock);
-        new = alloc_init_layout_hdr(ino, gfp_flags);
+        new = alloc_init_layout_hdr(ino, ctx, gfp_flags);
         spin_lock(&ino->i_lock);
 
         if (likely(nfsi->layout == NULL))       /* Won the race? */
@@ -928,7 +935,7 @@ pnfs_update_layout(struct inode *ino,
         if (!pnfs_enabled_sb(NFS_SERVER(ino)))
                 return NULL;
         spin_lock(&ino->i_lock);
-        lo = pnfs_find_alloc_layout(ino, gfp_flags);
+        lo = pnfs_find_alloc_layout(ino, ctx, gfp_flags);
         if (lo == NULL) {
                 dprintk("%s ERROR: can't get pnfs_layout_hdr\n", __func__);
                 goto out_unlock;
@@ -973,7 +980,8 @@ pnfs_update_layout(struct inode *ino,
                 arg.offset -= pg_offset;
                 arg.length += pg_offset;
         }
-        arg.length = PAGE_CACHE_ALIGN(arg.length);
+        if (arg.length != NFS4_MAX_UINT64)
+                arg.length = PAGE_CACHE_ALIGN(arg.length);
 
         lseg = send_layoutget(lo, ctx, &arg, gfp_flags);
         if (!lseg && first) {
@@ -1111,6 +1119,14 @@ pnfs_ld_write_done(struct nfs_write_data *data)
                 data->mds_ops->rpc_release(data);
                 return 0;
         }
+        if (NFS_SERVER(data->inode)->pnfs_curr_ld->flags &
+                                        PNFS_LAYOUTRET_ON_ERROR) {
+                /* Don't lo_commit on error, Server will needs to
+                 * preform a file recovery.
+                 */
+                clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(data->inode)->flags);
+                pnfs_return_layout(data->inode);
+        }
 
         dprintk("%s: pnfs_error=%d, retry via MDS\n", __func__,
                 data->pnfs_error);
@@ -1159,6 +1175,10 @@ pnfs_ld_read_done(struct nfs_read_data *data)
                 return 0;
         }
 
+        if (NFS_SERVER(data->inode)->pnfs_curr_ld->flags &
+                                                PNFS_LAYOUTRET_ON_ERROR)
+                pnfs_return_layout(data->inode);
+
         dprintk("%s: pnfs_error=%d, retry via MDS\n", __func__,
                 data->pnfs_error);
         status = nfs_initiate_read(data, NFS_CLIENT(data->inode),
@@ -1195,16 +1215,17 @@ pnfs_try_to_read_data(struct nfs_read_data *rdata,
 }
 
 /*
- * Currently there is only one (whole file) write lseg.
+ * There can be multiple RW segments.
  */
-static struct pnfs_layout_segment *pnfs_list_write_lseg(struct inode *inode)
+static void pnfs_list_write_lseg(struct inode *inode, struct list_head *listp)
 {
-        struct pnfs_layout_segment *lseg, *rv = NULL;
+        struct pnfs_layout_segment *lseg;
 
-        list_for_each_entry(lseg, &NFS_I(inode)->layout->plh_segs, pls_list)
-                if (lseg->pls_range.iomode == IOMODE_RW)
-                        rv = lseg;
-        return rv;
+        list_for_each_entry(lseg, &NFS_I(inode)->layout->plh_segs, pls_list) {
+                if (lseg->pls_range.iomode == IOMODE_RW &&
+                    test_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
+                        list_add(&lseg->pls_lc_list, listp);
+        }
 }
 
 void
@@ -1216,17 +1237,19 @@ pnfs_set_layoutcommit(struct nfs_write_data *wdata)
 
         spin_lock(&nfsi->vfs_inode.i_lock);
         if (!test_and_set_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) {
-                /* references matched in nfs4_layoutcommit_release */
-                get_lseg(wdata->lseg);
-                wdata->lseg->pls_lc_cred =
-                        get_rpccred(wdata->args.context->state->owner->so_cred);
                 mark_as_dirty = true;
                 dprintk("%s: Set layoutcommit for inode %lu ",
                         __func__, wdata->inode->i_ino);
         }
-        if (end_pos > wdata->lseg->pls_end_pos)
-                wdata->lseg->pls_end_pos = end_pos;
+        if (!test_and_set_bit(NFS_LSEG_LAYOUTCOMMIT, &wdata->lseg->pls_flags)) {
+                /* references matched in nfs4_layoutcommit_release */
+                get_lseg(wdata->lseg);
+        }
+        if (end_pos > nfsi->layout->plh_lwb)
+                nfsi->layout->plh_lwb = end_pos;
         spin_unlock(&nfsi->vfs_inode.i_lock);
+        dprintk("%s: lseg %p end_pos %llu\n",
+                __func__, wdata->lseg, nfsi->layout->plh_lwb);
 
         /* if pnfs_layoutcommit_inode() runs between inode locks, the next one
          * will be a noop because NFS_INO_LAYOUTCOMMIT will not be set */
@@ -1248,8 +1271,6 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync)
 {
         struct nfs4_layoutcommit_data *data;
         struct nfs_inode *nfsi = NFS_I(inode);
-        struct pnfs_layout_segment *lseg;
-        struct rpc_cred *cred;
         loff_t end_pos;
         int status = 0;
 
@@ -1266,30 +1287,25 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync)
                 goto out;
         }
 
+        INIT_LIST_HEAD(&data->lseg_list);
         spin_lock(&inode->i_lock);
         if (!test_and_clear_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) {
                 spin_unlock(&inode->i_lock);
                 kfree(data);
                 goto out;
         }
-        /*
-         * Currently only one (whole file) write lseg which is referenced
-         * in pnfs_set_layoutcommit and will be found.
-         */
-        lseg = pnfs_list_write_lseg(inode);
 
-        end_pos = lseg->pls_end_pos;
-        cred = lseg->pls_lc_cred;
-        lseg->pls_end_pos = 0;
-        lseg->pls_lc_cred = NULL;
+        pnfs_list_write_lseg(inode, &data->lseg_list);
+
+        end_pos = nfsi->layout->plh_lwb;
+        nfsi->layout->plh_lwb = 0;
 
         memcpy(&data->args.stateid.data, nfsi->layout->plh_stateid.data,
                 sizeof(nfsi->layout->plh_stateid.data));
         spin_unlock(&inode->i_lock);
 
         data->args.inode = inode;
-        data->lseg = lseg;
-        data->cred = cred;
+        data->cred = get_rpccred(nfsi->layout->plh_lc_cred);
         nfs_fattr_init(&data->fattr);
         data->args.bitmask = NFS_SERVER(inode)->cache_consistency_bitmask;
         data->res.fattr = &data->fattr;
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 96bf4e6f45b..bb8b3247f29 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -36,16 +36,16 @@
 enum {
         NFS_LSEG_VALID = 0,     /* cleared when lseg is recalled/returned */
         NFS_LSEG_ROC,           /* roc bit received from server */
+        NFS_LSEG_LAYOUTCOMMIT,  /* layoutcommit bit set for layoutcommit */
 };
 
 struct pnfs_layout_segment {
         struct list_head pls_list;
+        struct list_head pls_lc_list;
         struct pnfs_layout_range pls_range;
         atomic_t pls_refcount;
         unsigned long pls_flags;
         struct pnfs_layout_hdr *pls_layout;
-        struct rpc_cred *pls_lc_cred; /* LAYOUTCOMMIT credential */
-        loff_t pls_end_pos; /* LAYOUTCOMMIT write end */
 };
 
 enum pnfs_try_status {
@@ -68,6 +68,7 @@ enum {
 enum layoutdriver_policy_flags {
         /* Should the pNFS client commit and return the layout upon a setattr */
         PNFS_LAYOUTRET_ON_SETATTR       = 1 << 0,
+        PNFS_LAYOUTRET_ON_ERROR         = 1 << 1,
 };
 
 struct nfs4_deviceid_node;
@@ -124,6 +125,8 @@ struct pnfs_layout_hdr {
         unsigned long           plh_block_lgets; /* block LAYOUTGET if >0 */
         u32                     plh_barrier; /* ignore lower seqids */
         unsigned long           plh_flags;
+        loff_t                  plh_lwb; /* last write byte for layoutcommit */
+        struct rpc_cred         *plh_lc_cred; /* layoutcommit cred */
         struct inode            *plh_inode;
 };
 
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index ac40b8535d7..f48125da198 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -710,6 +710,7 @@ const struct nfs_rpc_ops nfs_v2_clientops = {
         .dentry_ops     = &nfs_dentry_operations,
         .dir_inode_ops  = &nfs_dir_inode_operations,
         .file_inode_ops = &nfs_file_inode_operations,
+        .file_ops       = &nfs_file_operations,
         .getroot        = nfs_proc_get_root,
         .getattr        = nfs_proc_getattr,
         .setattr        = nfs_proc_setattr,
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ce40e5c568b..8e7b61d5829 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -904,10 +904,24 @@ static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(unsigned int ve
                 data->auth_flavor_len   = 1;
                 data->version           = version;
                 data->minorversion      = 0;
+                security_init_mnt_opts(&data->lsm_opts);
         }
         return data;
 }
 
+static void nfs_free_parsed_mount_data(struct nfs_parsed_mount_data *data)
+{
+        if (data) {
+                kfree(data->client_address);
+                kfree(data->mount_server.hostname);
+                kfree(data->nfs_server.export_path);
+                kfree(data->nfs_server.hostname);
+                kfree(data->fscache_uniq);
+                security_free_mnt_opts(&data->lsm_opts);
+                kfree(data);
+        }
+}
+
 /*
  * Sanity-check a server address provided by the mount command.
  *
@@ -2218,9 +2232,7 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
         data = nfs_alloc_parsed_mount_data(NFS_DEFAULT_VERSION);
         mntfh = nfs_alloc_fhandle();
         if (data == NULL || mntfh == NULL)
-                goto out_free_fh;
-
-        security_init_mnt_opts(&data->lsm_opts);
+                goto out;
 
         /* Validate the mount data */
         error = nfs_validate_mount_data(raw_data, data, mntfh, dev_name);
@@ -2232,8 +2244,6 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
 #ifdef CONFIG_NFS_V4
         if (data->version == 4) {
                 mntroot = nfs4_try_mount(flags, dev_name, data);
-                kfree(data->client_address);
-                kfree(data->nfs_server.export_path);
                 goto out;
         }
 #endif  /* CONFIG_NFS_V4 */
@@ -2284,13 +2294,8 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
         s->s_flags |= MS_ACTIVE;
 
 out:
-        kfree(data->nfs_server.hostname);
-        kfree(data->mount_server.hostname);
-        kfree(data->fscache_uniq);
-        security_free_mnt_opts(&data->lsm_opts);
-out_free_fh:
+        nfs_free_parsed_mount_data(data);
         nfs_free_fhandle(mntfh);
-        kfree(data);
         return mntroot;
 
 out_err_nosb:
@@ -2613,9 +2618,7 @@ nfs4_remote_mount(struct file_system_type *fs_type, int flags,
 
         mntfh = nfs_alloc_fhandle();
         if (data == NULL || mntfh == NULL)
-                goto out_free_fh;
-
-        security_init_mnt_opts(&data->lsm_opts);
+                goto out;
 
         /* Get a volume representation */
         server = nfs4_create_server(data, mntfh);
@@ -2663,13 +2666,10 @@ nfs4_remote_mount(struct file_system_type *fs_type, int flags,
 
         s->s_flags |= MS_ACTIVE;
 
-        security_free_mnt_opts(&data->lsm_opts);
         nfs_free_fhandle(mntfh);
         return mntroot;
 
 out:
-        security_free_mnt_opts(&data->lsm_opts);
-out_free_fh:
         nfs_free_fhandle(mntfh);
         return ERR_PTR(error);
 
@@ -2694,11 +2694,15 @@ static struct vfsmount *nfs_do_root_mount(struct file_system_type *fs_type,
         char *root_devname;
         size_t len;
 
-        len = strlen(hostname) + 3;
+        len = strlen(hostname) + 5;
         root_devname = kmalloc(len, GFP_KERNEL);
         if (root_devname == NULL)
                 return ERR_PTR(-ENOMEM);
-        snprintf(root_devname, len, "%s:/", hostname);
+        /* Does hostname needs to be enclosed in brackets? */
+        if (strchr(hostname, ':'))
+                snprintf(root_devname, len, "[%s]:/", hostname);
+        else
+                snprintf(root_devname, len, "%s:/", hostname);
         root_mnt = vfs_kern_mount(fs_type, flags, root_devname, data);
         kfree(root_devname);
         return root_mnt;
@@ -2793,7 +2797,7 @@ static struct dentry *nfs_follow_remote_path(struct vfsmount *root_mnt,
                 goto out_put_mnt_ns;
 
         ret = vfs_path_lookup(root_mnt->mnt_root, root_mnt,
-                        export_path, LOOKUP_FOLLOW, nd);
+                        export_path, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, nd);
 
         nfs_referral_loop_unprotect();
         put_mnt_ns(ns_private);
@@ -2855,7 +2859,7 @@ static struct dentry *nfs4_mount(struct file_system_type *fs_type,
 
         data = nfs_alloc_parsed_mount_data(4);
         if (data == NULL)
-                goto out_free_data;
+                goto out;
 
         /* Validate the mount data */
         error = nfs4_validate_mount_data(raw_data, data, dev_name);
@@ -2869,12 +2873,7 @@ static struct dentry *nfs4_mount(struct file_system_type *fs_type,
                 error = PTR_ERR(res);
 
 out:
-        kfree(data->client_address);
-        kfree(data->nfs_server.export_path);
-        kfree(data->nfs_server.hostname);
-        kfree(data->fscache_uniq);
-out_free_data:
-        kfree(data);
+        nfs_free_parsed_mount_data(data);
         dprintk("<-- nfs4_mount() = %d%s\n", error,
                         error != 0 ? " [error]" : "");
         return res;
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 72716805968..d5ef7e933b7 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -428,7 +428,6 @@ static void
 nfs_mark_request_dirty(struct nfs_page *req)
 {
         __set_page_dirty_nobuffers(req->wb_page);
-        __mark_inode_dirty(req->wb_page->mapping->host, I_DIRTY_DATASYNC);
 }
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
@@ -762,6 +761,8 @@ int nfs_updatepage(struct file *file, struct page *page,
         status = nfs_writepage_setup(ctx, page, offset, count);
         if (status < 0)
                 nfs_set_pageerror(page);
+        else
+                __set_page_dirty_nobuffers(page);
 
         dprintk("NFS:       nfs_updatepage returns %d (isize %lld)\n",
                         status, (long long)i_size_read(inode));
@@ -1525,6 +1526,10 @@ static int nfs_commit_unstable_pages(struct inode *inode, struct writeback_contr
         int flags = FLUSH_SYNC;
         int ret = 0;
 
+        /* no commits means nothing needs to be done */
+        if (!nfsi->ncommit)
+                return ret;
+
         if (wbc->sync_mode == WB_SYNC_NONE) {
                 /* Don't commit yet if this is a non-blocking flush and there
                  * are a lot of outstanding writes for this mapping.
@@ -1566,8 +1571,7 @@ int nfs_write_inode(struct inode *inode, struct writeback_control *wbc)
                 int status;
                 bool sync = true;
 
-                if (wbc->sync_mode == WB_SYNC_NONE || wbc->nonblocking ||
-                    wbc->for_background)
+                if (wbc->sync_mode == WB_SYNC_NONE || wbc->for_background)
                         sync = false;
 
                 status = pnfs_layoutcommit_inode(inode, sync);
@@ -1657,36 +1661,22 @@ out_error:
 
 #ifdef CONFIG_MIGRATION
 int nfs_migrate_page(struct address_space *mapping, struct page *newpage,
-                struct page *page)
+                struct page *page, enum migrate_mode mode)
 {
-        struct nfs_page *req;
-        int ret;
+        /*
+         * If PagePrivate is set, then the page is currently associated with
+         * an in-progress read or write request. Don't try to migrate it.
+         *
+         * FIXME: we could do this in principle, but we'll need a way to ensure
+         *        that we can safely release the inode reference while holding
+         *        the page lock.
+         */
+        if (PagePrivate(page))
+                return -EBUSY;
 
         nfs_fscache_release_page(page, GFP_KERNEL);
 
-        req = nfs_find_and_lock_request(page, false);
-        ret = PTR_ERR(req);
-        if (IS_ERR(req))
-                goto out;
-
-        ret = migrate_page(mapping, newpage, page);
-        if (!req)
-                goto out;
-        if (ret)
-                goto out_unlock;
-        page_cache_get(newpage);
-        spin_lock(&mapping->host->i_lock);
-        req->wb_page = newpage;
-        SetPagePrivate(newpage);
-        set_page_private(newpage, (unsigned long)req);
-        ClearPagePrivate(page);
-        set_page_private(page, 0);
-        spin_unlock(&mapping->host->i_lock);
-        page_cache_release(page);
-out_unlock:
-        nfs_clear_page_tag_locked(req);
-out:
-        return ret;
+        return migrate_page(mapping, newpage, page, mode);
 }
 #endif
 
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index b9566e46219..4b470f6043e 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -88,7 +88,7 @@ static int expkey_parse(struct cache_detail *cd, char *mesg, int mlen)
         struct svc_expkey key;
         struct svc_expkey *ek = NULL;
 
-        if (mesg[mlen-1] != '\n')
+        if (mlen < 1 || mesg[mlen-1] != '\n')
                 return -EINVAL;
         mesg[mlen-1] = 0;
 
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 08c6e36ab2e..43f46cd9ede 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -803,13 +803,13 @@ encode_entry_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name,
         return p;
 }
 
-static int
+static __be32
 compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
                 const char *name, int namlen)
 {
         struct svc_export       *exp;
         struct dentry           *dparent, *dchild;
-        int rv = 0;
+        __be32 rv = nfserr_noent;
 
         dparent = cd->fh.fh_dentry;
         exp  = cd->fh.fh_export;
@@ -817,26 +817,20 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
         if (isdotent(name, namlen)) {
                 if (namlen == 2) {
                         dchild = dget_parent(dparent);
-                        if (dchild == dparent) {
-                                /* filesystem root - cannot return filehandle for ".." */
-                                dput(dchild);
-                                return -ENOENT;
-                        }
+                        /* filesystem root - cannot return filehandle for ".." */
+                        if (dchild == dparent)
+                                goto out;
                 } else
                         dchild = dget(dparent);
         } else
                 dchild = lookup_one_len(name, dparent, namlen);
         if (IS_ERR(dchild))
-                return -ENOENT;
-        rv = -ENOENT;
+                return rv;
         if (d_mountpoint(dchild))
                 goto out;
-        rv = fh_compose(fhp, exp, dchild, &cd->fh);
-        if (rv)
-                goto out;
         if (!dchild->d_inode)
                 goto out;
-        rv = 0;
+        rv = fh_compose(fhp, exp, dchild, &cd->fh);
 out:
         dput(dchild);
         return rv;
@@ -845,7 +839,7 @@ out:
 static __be32 *encode_entryplus_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name, int namlen)
 {
         struct svc_fh   fh;
-        int err;
+        __be32 err;
 
         fh_init(&fh, NFS3_FHSIZE);
         err = compose_entry_fh(cd, &fh, name, namlen);
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 3a6dbd70b34..d06a02c1b1a 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -156,6 +156,8 @@ do_open_permission(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfs
                 !(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
                 return nfserr_inval;
 
+        accmode |= NFSD_MAY_READ_IF_EXEC;
+
         if (open->op_share_access & NFS4_SHARE_ACCESS_READ)
                 accmode |= NFSD_MAY_READ;
         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
@@ -682,7 +684,7 @@ nfsd4_readdir(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         readdir->rd_bmval[1] &= nfsd_suppattrs1(cstate->minorversion);
         readdir->rd_bmval[2] &= nfsd_suppattrs2(cstate->minorversion);
 
-        if ((cookie > ~(u32)0) || (cookie == 1) || (cookie == 2) ||
+        if ((cookie == 1) || (cookie == 2) ||
             (cookie == 0 && memcmp(readdir->rd_verf.data, zeroverf.data, NFS4_VERIFIER_SIZE)))
                 return nfserr_bad_cookie;
 
@@ -810,6 +812,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
               struct nfsd4_setattr *setattr)
 {
         __be32 status = nfs_ok;
+        int err;
 
         if (setattr->sa_iattr.ia_valid & ATTR_SIZE) {
                 nfs4_lock_state();
@@ -821,9 +824,9 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                         return status;
                 }
         }
-        status = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
-        if (status)
-                return status;
+        err = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
+        if (err)
+                return nfserrno(err);
         status = nfs_ok;
 
         status = check_attr_support(rqstp, cstate, setattr->sa_bmval,
@@ -921,7 +924,7 @@ _nfsd4_verify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         count = 4 + (verify->ve_attrlen >> 2);
         buf = kmalloc(count << 2, GFP_KERNEL);
         if (!buf)
-                return nfserr_resource;
+                return nfserr_jukebox;
 
         status = nfsd4_encode_fattr(&cstate->current_fh,
                                     cstate->current_fh.fh_export,
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index ffb59ef6f82..be268148170 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -88,7 +88,7 @@ nfs4_make_rec_clidname(char *dname, struct xdr_netobj *clname)
         struct xdr_netobj cksum;
         struct hash_desc desc;
         struct scatterlist sg;
-        __be32 status = nfserr_resource;
+        __be32 status = nfserr_jukebox;
 
         dprintk("NFSD: nfs4_make_rec_clidname for %.*s\n",
                         clname->len, clname->data);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index e98f3c2e949..92f7eb7c586 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -188,8 +188,15 @@ static void nfs4_file_put_fd(struct nfs4_file *fp, int oflag)
 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 {
         if (atomic_dec_and_test(&fp->fi_access[oflag])) {
-                nfs4_file_put_fd(fp, O_RDWR);
                 nfs4_file_put_fd(fp, oflag);
+                /*
+                 * It's also safe to get rid of the RDWR open *if*
+                 * we no longer have need of the other kind of access
+                 * or if we already have the other kind of open:
+                 */
+                if (fp->fi_fds[1-oflag]
+                        || atomic_read(&fp->fi_access[1 - oflag]) == 0)
+                        nfs4_file_put_fd(fp, O_RDWR);
         }
 }
 
@@ -381,14 +388,6 @@ static int nfs4_access_to_omode(u32 access)
         BUG();
 }
 
-static int nfs4_access_bmap_to_omode(struct nfs4_stateid *stp)
-{
-        unsigned int access;
-
-        set_access(&access, stp->st_access_bmap);
-        return nfs4_access_to_omode(access);
-}
-
 static void unhash_generic_stateid(struct nfs4_stateid *stp)
 {
         list_del(&stp->st_hash);
@@ -398,11 +397,14 @@ static void unhash_generic_stateid(struct nfs4_stateid *stp)
 
 static void free_generic_stateid(struct nfs4_stateid *stp)
 {
-        int oflag;
+        int i;
 
         if (stp->st_access_bmap) {
-                oflag = nfs4_access_bmap_to_omode(stp);
-                nfs4_file_put_access(stp->st_file, oflag);
+                for (i = 1; i < 4; i++) {
+                        if (test_bit(i, &stp->st_access_bmap))
+                                nfs4_file_put_access(stp->st_file,
+                                                nfs4_access_to_omode(i));
+                }
         }
         put_nfs4_file(stp->st_file);
         kmem_cache_free(stateid_slab, stp);
@@ -1908,7 +1910,7 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
          * of 5 bullet points, labeled as CASE0 - CASE4 below.
          */
         unconf = find_unconfirmed_client_by_str(dname, strhashval);
-        status = nfserr_resource;
+        status = nfserr_jukebox;
         if (!conf) {
                 /*
                  * RFC 3530 14.2.33 CASE 4:
@@ -2337,15 +2339,6 @@ out:
         return ret;
 }
 
-static inline void
-nfs4_file_downgrade(struct nfs4_file *fp, unsigned int share_access)
-{
-        if (share_access & NFS4_SHARE_ACCESS_WRITE)
-                nfs4_file_put_access(fp, O_WRONLY);
-        if (share_access & NFS4_SHARE_ACCESS_READ)
-                nfs4_file_put_access(fp, O_RDONLY);
-}
-
 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
 {
         /* We're assuming the state code never drops its reference
@@ -2454,7 +2447,7 @@ renew:
         if (open->op_stateowner == NULL) {
                 sop = alloc_init_open_stateowner(strhashval, clp, open);
                 if (sop == NULL)
-                        return nfserr_resource;
+                        return nfserr_jukebox;
                 open->op_stateowner = sop;
         }
         list_del_init(&sop->so_close_lru);
@@ -2556,12 +2549,18 @@ static inline int nfs4_access_to_access(u32 nfs4_access)
         return flags;
 }
 
-static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file
-*fp, struct svc_fh *cur_fh, u32 nfs4_access)
+static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
+                struct svc_fh *cur_fh, struct nfsd4_open *open)
 {
         __be32 status;
-        int oflag = nfs4_access_to_omode(nfs4_access);
-        int access = nfs4_access_to_access(nfs4_access);
+        int oflag = nfs4_access_to_omode(open->op_share_access);
+        int access = nfs4_access_to_access(open->op_share_access);
+
+        /* CLAIM_DELEGATE_CUR is used in response to a broken lease;
+         * allowing it to break the lease and return EAGAIN leaves the
+         * client unable to make progress in returning the delegation */
+        if (open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR)
+                access |= NFSD_MAY_NOT_BREAK_LEASE;
 
         if (!fp->fi_fds[oflag]) {
                 status = nfsd_open(rqstp, cur_fh, S_IFREG, access,
@@ -2584,9 +2583,9 @@ nfs4_new_open(struct svc_rqst *rqstp, struct nfs4_stateid **stpp,
 
         stp = nfs4_alloc_stateid();
         if (stp == NULL)
-                return nfserr_resource;
+                return nfserr_jukebox;
 
-        status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open->op_share_access);
+        status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open);
         if (status) {
                 kmem_cache_free(stateid_slab, stp);
                 return status;
@@ -2619,14 +2618,14 @@ nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *c
 
         new_access = !test_bit(op_share_access, &stp->st_access_bmap);
         if (new_access) {
-                status = nfs4_get_vfs_file(rqstp, fp, cur_fh, op_share_access);
+                status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open);
                 if (status)
                         return status;
         }
         status = nfsd4_truncate(rqstp, cur_fh, open);
         if (status) {
                 if (new_access) {
-                        int oflag = nfs4_access_to_omode(new_access);
+                        int oflag = nfs4_access_to_omode(op_share_access);
                         nfs4_file_put_access(fp, oflag);
                 }
                 return status;
@@ -2815,7 +2814,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
                 status = nfserr_bad_stateid;
                 if (open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR)
                         goto out;
-                status = nfserr_resource;
+                status = nfserr_jukebox;
                 fp = alloc_init_file(ino);
                 if (fp == NULL)
                         goto out;
@@ -3384,18 +3383,16 @@ out:
         return status;
 }
 
-
-/*
- * unset all bits in union bitmap (bmap) that
- * do not exist in share (from successful OPEN_DOWNGRADE)
- */
-static void
-reset_union_bmap_access(unsigned long access, unsigned long *bmap)
+static inline void nfs4_file_downgrade(struct nfs4_stateid *stp, unsigned int to_access)
 {
         int i;
+
         for (i = 1; i < 4; i++) {
-                if ((i & access) != i)
-                        __clear_bit(i, bmap);
+                if (test_bit(i, &stp->st_access_bmap)
+                                        && ((i & to_access) != i)) {
+                        nfs4_file_put_access(stp->st_file, nfs4_access_to_omode(i));
+                        __clear_bit(i, &stp->st_access_bmap);
+                }
         }
 }
 
@@ -3416,7 +3413,6 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp,
 {
         __be32 status;
         struct nfs4_stateid *stp;
-        unsigned int share_access;
 
         dprintk("NFSD: nfsd4_open_downgrade on file %.*s\n", 
                         (int)cstate->current_fh.fh_dentry->d_name.len,
@@ -3425,6 +3421,8 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp,
         if (!access_valid(od->od_share_access, cstate->minorversion)
                         || !deny_valid(od->od_share_deny))
                 return nfserr_inval;
+        /* We don't yet support WANT bits: */
+        od->od_share_access &= NFS4_SHARE_ACCESS_MASK;
 
         nfs4_lock_state();
         if ((status = nfs4_preprocess_seqid_op(cstate,
@@ -3445,10 +3443,8 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp,
                         stp->st_deny_bmap, od->od_share_deny);
                 goto out;
         }
-        set_access(&share_access, stp->st_access_bmap);
-        nfs4_file_downgrade(stp->st_file, share_access & ~od->od_share_access);
+        nfs4_file_downgrade(stp, od->od_share_access);
 
-        reset_union_bmap_access(od->od_share_access, &stp->st_access_bmap);
         reset_union_bmap_deny(od->od_share_deny, &stp->st_deny_bmap);
 
         update_stateid(&stp->st_stateid);
@@ -3854,7 +3850,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 /* XXX: Do we need to check for duplicate stateowners on
                  * the same file, or should they just be allowed (and
                  * create new stateids)? */
-                status = nfserr_resource;
+                status = nfserr_jukebox;
                 lock_sop = alloc_init_lock_stateowner(strhashval,
                                 open_sop->so_client, open_stp, lock);
                 if (lock_sop == NULL)
@@ -3938,9 +3934,9 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         case (EDEADLK):
                 status = nfserr_deadlock;
                 break;
-        default:        
+        default:
                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
-                status = nfserr_resource;
+                status = nfserrno(err);
                 break;
         }
 out:
@@ -3960,16 +3956,14 @@ out:
  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
  * inode operation.)
  */
-static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
+static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
 {
         struct file *file;
-        int err;
-
-        err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
-        if (err)
-                return err;
-        err = vfs_test_lock(file, lock);
-        nfsd_close(file);
+        __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
+        if (!err) {
+                err = nfserrno(vfs_test_lock(file, lock));
+                nfsd_close(file);
+        }
         return err;
 }
 
@@ -3982,7 +3976,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 {
         struct inode *inode;
         struct file_lock file_lock;
-        int error;
         __be32 status;
 
         if (locks_in_grace())
@@ -4034,12 +4027,10 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 
         nfs4_transform_lock_offset(&file_lock);
 
-        status = nfs_ok;
-        error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
-        if (error) {
-                status = nfserrno(error);
+        status = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
+        if (status)
                 goto out;
-        }
+
         if (file_lock.fl_type != F_UNLCK) {
                 status = nfserr_denied;
                 nfs4_set_lock_denied(&file_lock, &lockt->lt_denied);
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 99018110321..f91d58990b6 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1548,6 +1548,18 @@ static void write_cinfo(__be32 **p, struct nfsd4_change_info *c)
                                                                 \
         save = resp->p;
 
+static bool seqid_mutating_err(__be32 err)
+{
+        /* rfc 3530 section 8.1.5: */
+        return  err != nfserr_stale_clientid &&
+                err != nfserr_stale_stateid &&
+                err != nfserr_bad_stateid &&
+                err != nfserr_bad_seqid &&
+                err != nfserr_bad_xdr &&
+                err != nfserr_resource &&
+                err != nfserr_nofilehandle;
+}
+
 /*
  * Routine for encoding the result of a "seqid-mutating" NFSv4 operation.  This
  * is where sequence id's are incremented, and the replay cache is filled.
@@ -1998,7 +2010,7 @@ out_acl:
         if (bmval0 & FATTR4_WORD0_CASE_INSENSITIVE) {
                 if ((buflen -= 4) < 0)
                         goto out_resource;
-                WRITE32(1);
+                WRITE32(0);
         }
         if (bmval0 & FATTR4_WORD0_CASE_PRESERVING) {
                 if ((buflen -= 4) < 0)
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index 6bd2f3c21f2..858c7baea2d 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -447,12 +447,6 @@ struct nfs4_stateid {
 #define WR_STATE                0x00000020
 #define CLOSE_STATE             0x00000040
 
-#define seqid_mutating_err(err)                       \
-        (((err) != nfserr_stale_clientid) &&    \
-        ((err) != nfserr_bad_seqid) &&          \
-        ((err) != nfserr_stale_stateid) &&      \
-        ((err) != nfserr_bad_stateid))
-
 struct nfsd4_compound_state;
 
 extern __be32 nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate,
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index fd0acca5370..acf88aea211 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -2114,7 +2114,8 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
 
         /* Allow read access to binaries even when mode 111 */
         if (err == -EACCES && S_ISREG(inode->i_mode) &&
-            acc == (NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE))
+             (acc == (NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE) ||
+              acc == (NFSD_MAY_READ | NFSD_MAY_READ_IF_EXEC)))
                 err = inode_permission(inode, MAY_EXEC);
 
         return err? nfserrno(err) : 0;
diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h
index e0bbac04d1d..a22e40e2786 100644
--- a/fs/nfsd/vfs.h
+++ b/fs/nfsd/vfs.h
@@ -25,6 +25,7 @@
 #define NFSD_MAY_BYPASS_GSS_ON_ROOT 256
 #define NFSD_MAY_NOT_BREAK_LEASE 512
 #define NFSD_MAY_BYPASS_GSS     1024
+#define NFSD_MAY_READ_IF_EXEC   2048
 
 #define NFSD_MAY_CREATE         (NFSD_MAY_EXEC|NFSD_MAY_WRITE)
 #define NFSD_MAY_REMOVE         (NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC)
diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c
index 08a07a218d2..57ceaf33d17 100644
--- a/fs/nilfs2/gcinode.c
+++ b/fs/nilfs2/gcinode.c
@@ -191,6 +191,8 @@ void nilfs_remove_all_gcinodes(struct the_nilfs *nilfs)
         while (!list_empty(head)) {
                 ii = list_first_entry(head, struct nilfs_inode_info, i_dirty);
                 list_del_init(&ii->i_dirty);
+                truncate_inode_pages(&ii->vfs_inode.i_data, 0);
+                nilfs_btnode_cache_clear(&ii->i_btnode_cache);
                 iput(&ii->vfs_inode);
         }
 }
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 41d6743d303..0d1c9bdbb79 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -182,7 +182,7 @@ static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
         if (copy_from_user(&cpmode, argp, sizeof(cpmode)))
                 goto out;
 
-        down_read(&inode->i_sb->s_umount);
+        mutex_lock(&nilfs->ns_snapshot_mount_mutex);
 
         nilfs_transaction_begin(inode->i_sb, &ti, 0);
         ret = nilfs_cpfile_change_cpmode(
@@ -192,7 +192,7 @@ static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
         else
                 nilfs_transaction_commit(inode->i_sb); /* never fails */
 
-        up_read(&inode->i_sb->s_umount);
+        mutex_unlock(&nilfs->ns_snapshot_mount_mutex);
 out:
         mnt_drop_write(filp->f_path.mnt);
         return ret;
@@ -842,6 +842,19 @@ long nilfs_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         case FS_IOC32_GETVERSION:
                 cmd = FS_IOC_GETVERSION;
                 break;
+        case NILFS_IOCTL_CHANGE_CPMODE:
+        case NILFS_IOCTL_DELETE_CHECKPOINT:
+        case NILFS_IOCTL_GET_CPINFO:
+        case NILFS_IOCTL_GET_CPSTAT:
+        case NILFS_IOCTL_GET_SUINFO:
+        case NILFS_IOCTL_GET_SUSTAT:
+        case NILFS_IOCTL_GET_VINFO:
+        case NILFS_IOCTL_GET_BDESCS:
+        case NILFS_IOCTL_CLEAN_SEGMENTS:
+        case NILFS_IOCTL_SYNC:
+        case NILFS_IOCTL_RESIZE:
+        case NILFS_IOCTL_SET_ALLOC_RANGE:
+                break;
         default:
                 return -ENOIOCTLCMD;
         }
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index bb24ab6c282..6f24e67162c 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2309,6 +2309,8 @@ nilfs_remove_written_gcinodes(struct the_nilfs *nilfs, struct list_head *head)
                 if (!test_bit(NILFS_I_UPDATED, &ii->i_state))
                         continue;
                 list_del_init(&ii->i_dirty);
+                truncate_inode_pages(&ii->vfs_inode.i_data, 0);
+                nilfs_btnode_cache_clear(&ii->i_btnode_cache);
                 iput(&ii->vfs_inode);
         }
 }
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 8351c44a732..97bfbddd9fc 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -951,6 +951,8 @@ static int nilfs_attach_snapshot(struct super_block *s, __u64 cno,
         struct nilfs_root *root;
         int ret;
 
+        mutex_lock(&nilfs->ns_snapshot_mount_mutex);
+
         down_read(&nilfs->ns_segctor_sem);
         ret = nilfs_cpfile_is_snapshot(nilfs->ns_cpfile, cno);
         up_read(&nilfs->ns_segctor_sem);
@@ -975,6 +977,7 @@ static int nilfs_attach_snapshot(struct super_block *s, __u64 cno,
         ret = nilfs_get_root_dentry(s, root, root_dentry);
         nilfs_put_root(root);
  out:
+        mutex_unlock(&nilfs->ns_snapshot_mount_mutex);
         return ret;
 }
 
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index d3271409437..1c98f5394de 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -76,6 +76,7 @@ struct the_nilfs *alloc_nilfs(struct block_device *bdev)
         nilfs->ns_bdev = bdev;
         atomic_set(&nilfs->ns_ndirtyblks, 0);
         init_rwsem(&nilfs->ns_sem);
+        mutex_init(&nilfs->ns_snapshot_mount_mutex);
         INIT_LIST_HEAD(&nilfs->ns_dirty_files);
         INIT_LIST_HEAD(&nilfs->ns_gc_inodes);
         spin_lock_init(&nilfs->ns_inode_lock);
@@ -515,6 +516,7 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs,
                 brelse(sbh[1]);
                 sbh[1] = NULL;
                 sbp[1] = NULL;
+                valid[1] = 0;
                 swp = 0;
         }
         if (!valid[swp]) {
diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h
index 9992b11312f..de7435f0ef5 100644
--- a/fs/nilfs2/the_nilfs.h
+++ b/fs/nilfs2/the_nilfs.h
@@ -47,6 +47,7 @@ enum {
  * @ns_flags: flags
  * @ns_bdev: block device
  * @ns_sem: semaphore for shared states
+ * @ns_snapshot_mount_mutex: mutex to protect snapshot mounts
  * @ns_sbh: buffer heads of on-disk super blocks
  * @ns_sbp: pointers to super block data
  * @ns_sbwtime: previous write time of super block
@@ -99,6 +100,7 @@ struct the_nilfs {
 
         struct block_device    *ns_bdev;
         struct rw_semaphore     ns_sem;
+        struct mutex            ns_snapshot_mount_mutex;
 
         /*
          * used for
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index 252ab1f6452..42ed195771f 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -135,9 +135,6 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
 
         mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
 
-        /* 1 from caller and 1 for being on i_list/g_list */
-        BUG_ON(atomic_read(&mark->refcnt) < 2);
-
         spin_lock(&group->mark_lock);
 
         if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) {
@@ -182,6 +179,11 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
                 iput(inode);
 
         /*
+         * We don't necessarily have a ref on mark from caller so the above iput
+         * may have already destroyed it.  Don't touch from now on.
+         */
+
+        /*
          * it's possible that this group tried to destroy itself, but this
          * this mark was simultaneously being freed by inode.  If that's the
          * case, we finish freeing the group here.
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index ed553c60de8..76c8165deed 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -1134,7 +1134,7 @@ static int ocfs2_adjust_rightmost_branch(handle_t *handle,
         }
 
         el = path_leaf_el(path);
-        rec = &el->l_recs[le32_to_cpu(el->l_next_free_rec) - 1];
+        rec = &el->l_recs[le16_to_cpu(el->l_next_free_rec) - 1];
 
         ocfs2_adjust_rightmost_records(handle, et, path, rec);
 
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index ebfd3825f12..15d29ccefd4 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -1036,14 +1036,14 @@ static int ocfs2_get_refcount_cpos_end(struct ocfs2_caching_info *ci,
 
         tmp_el = left_path->p_node[subtree_root].el;
         blkno = left_path->p_node[subtree_root+1].bh->b_blocknr;
-        for (i = 0; i < le32_to_cpu(tmp_el->l_next_free_rec); i++) {
+        for (i = 0; i < le16_to_cpu(tmp_el->l_next_free_rec); i++) {
                 if (le64_to_cpu(tmp_el->l_recs[i].e_blkno) == blkno) {
                         *cpos_end = le32_to_cpu(tmp_el->l_recs[i+1].e_cpos);
                         break;
                 }
         }
 
-        BUG_ON(i == le32_to_cpu(tmp_el->l_next_free_rec));
+        BUG_ON(i == le16_to_cpu(tmp_el->l_next_free_rec));
 
 out:
         ocfs2_free_path(left_path);
@@ -1468,7 +1468,7 @@ static int ocfs2_divide_leaf_refcount_block(struct buffer_head *ref_leaf_bh,
 
         trace_ocfs2_divide_leaf_refcount_block(
                 (unsigned long long)ref_leaf_bh->b_blocknr,
-                le32_to_cpu(rl->rl_count), le32_to_cpu(rl->rl_used));
+                le16_to_cpu(rl->rl_count), le16_to_cpu(rl->rl_used));
 
         /*
          * XXX: Improvement later.
@@ -2411,7 +2411,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
                                 rb = (struct ocfs2_refcount_block *)
                                                         prev_bh->b_data;
 
-                                if (le64_to_cpu(rb->rf_records.rl_used) +
+                                if (le16_to_cpu(rb->rf_records.rl_used) +
                                     recs_add >
                                     le16_to_cpu(rb->rf_records.rl_count))
                                         ref_blocks++;
@@ -2476,7 +2476,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
         if (prev_bh) {
                 rb = (struct ocfs2_refcount_block *)prev_bh->b_data;
 
-                if (le64_to_cpu(rb->rf_records.rl_used) + recs_add >
+                if (le16_to_cpu(rb->rf_records.rl_used) + recs_add >
                     le16_to_cpu(rb->rf_records.rl_count))
                         ref_blocks++;
 
@@ -3629,7 +3629,7 @@ int ocfs2_refcounted_xattr_delete_need(struct inode *inode,
                          * one will split a refcount rec, so totally we need
                          * clusters * 2 new refcount rec.
                          */
-                        if (le64_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
+                        if (le16_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
                             le16_to_cpu(rb->rf_records.rl_count))
                                 ref_blocks++;
 
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index ba5d97e4a73..f169da4624f 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -600,7 +600,7 @@ static void ocfs2_bg_alloc_cleanup(handle_t *handle,
                 ret = ocfs2_free_clusters(handle, cluster_ac->ac_inode,
                                           cluster_ac->ac_bh,
                                           le64_to_cpu(rec->e_blkno),
-                                          le32_to_cpu(rec->e_leaf_clusters));
+                                          le16_to_cpu(rec->e_leaf_clusters));
                 if (ret)
                         mlog_errno(ret);
                 /* Try all the clusters to free */
@@ -1628,7 +1628,7 @@ static int ocfs2_bg_discontig_fix_by_rec(struct ocfs2_suballoc_result *res,
 {
         unsigned int bpc = le16_to_cpu(cl->cl_bpc);
         unsigned int bitoff = le32_to_cpu(rec->e_cpos) * bpc;
-        unsigned int bitcount = le32_to_cpu(rec->e_leaf_clusters) * bpc;
+        unsigned int bitcount = le16_to_cpu(rec->e_leaf_clusters) * bpc;
 
         if (res->sr_bit_offset < bitoff)
                 return 0;
diff --git a/fs/open.c b/fs/open.c
index b52cf013ffa..7e18c4d6e1f 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -396,10 +396,10 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
 {
         struct file *file;
         struct inode *inode;
-        int error;
+        int error, fput_needed;
 
         error = -EBADF;
-        file = fget(fd);
+        file = fget_raw_light(fd, &fput_needed);
         if (!file)
                 goto out;
 
@@ -413,7 +413,7 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
         if (!error)
                 set_fs_pwd(current->fs, &file->f_path);
 out_putf:
-        fput(file);
+        fput_light(file, fput_needed);
 out:
         return error;
 }
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index d545e97d99c..811960a5ef6 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -366,10 +366,21 @@ static void part_release(struct device *dev)
         kfree(p);
 }
 
+static int part_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        struct hd_struct *part = dev_to_part(dev);
+
+        add_uevent_var(env, "PARTN=%u", part->partno);
+        if (part->info && part->info->volname[0])
+                add_uevent_var(env, "PARTNAME=%s", part->info->volname);
+        return 0;
+}
+
 struct device_type part_type = {
         .name           = "partition",
         .groups         = part_attr_groups,
         .release        = part_release,
+        .uevent         = part_uevent,
 };
 
 static void delete_partition_rcu_cb(struct rcu_head *head)
@@ -539,17 +550,11 @@ static bool disk_unlock_native_capacity(struct gendisk *disk)
         }
 }
 
-int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
+static int drop_partitions(struct gendisk *disk, struct block_device *bdev)
 {
-        struct parsed_partitions *state = NULL;
         struct disk_part_iter piter;
         struct hd_struct *part;
-        int p, highest, res;
-rescan:
-        if (state && !IS_ERR(state)) {
-                kfree(state);
-                state = NULL;
-        }
+        int res;
 
         if (bdev->bd_part_count)
                 return -EBUSY;
@@ -562,6 +567,24 @@ rescan:
                 delete_partition(disk, part->partno);
         disk_part_iter_exit(&piter);
 
+        return 0;
+}
+
+int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
+{
+        struct parsed_partitions *state = NULL;
+        struct hd_struct *part;
+        int p, highest, res;
+rescan:
+        if (state && !IS_ERR(state)) {
+                kfree(state);
+                state = NULL;
+        }
+
+        res = drop_partitions(disk, bdev);
+        if (res)
+                return res;
+
         if (disk->fops->revalidate_disk)
                 disk->fops->revalidate_disk(disk);
         check_disk_size_change(disk, bdev);
@@ -665,6 +688,26 @@ rescan:
         return 0;
 }
 
+int invalidate_partitions(struct gendisk *disk, struct block_device *bdev)
+{
+        int res;
+
+        if (!bdev->bd_invalidated)
+                return 0;
+
+        res = drop_partitions(disk, bdev);
+        if (res)
+                return res;
+
+        set_capacity(disk, 0);
+        check_disk_size_change(disk, bdev);
+        bdev->bd_invalidated = 0;
+        /* tell userspace that the media / partition table may have changed */
+        kobject_uevent(&disk_to_dev(disk)->kobj, KOBJ_CHANGE);
+
+        return 0;
+}
+
 unsigned char *read_dev_sector(struct block_device *bdev, sector_t n, Sector *p)
 {
         struct address_space *mapping = bdev->bd_inode->i_mapping;
diff --git a/fs/pipe.c b/fs/pipe.c
index da42f7db50d..0499a96287a 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -345,6 +345,16 @@ static const struct pipe_buf_operations anon_pipe_buf_ops = {
         .get = generic_pipe_buf_get,
 };
 
+static const struct pipe_buf_operations packet_pipe_buf_ops = {
+        .can_merge = 0,
+        .map = generic_pipe_buf_map,
+        .unmap = generic_pipe_buf_unmap,
+        .confirm = generic_pipe_buf_confirm,
+        .release = anon_pipe_buf_release,
+        .steal = generic_pipe_buf_steal,
+        .get = generic_pipe_buf_get,
+};
+
 static ssize_t
 pipe_read(struct kiocb *iocb, const struct iovec *_iov,
            unsigned long nr_segs, loff_t pos)
@@ -406,6 +416,13 @@ redo:
                         ret += chars;
                         buf->offset += chars;
                         buf->len -= chars;
+
+                        /* Was it a packet buffer? Clean up and exit */
+                        if (buf->flags & PIPE_BUF_FLAG_PACKET) {
+                                total_len = chars;
+                                buf->len = 0;
+                        }
+
                         if (!buf->len) {
                                 buf->ops = NULL;
                                 ops->release(pipe, buf);
@@ -458,6 +475,11 @@ redo:
         return ret;
 }
 
+static inline int is_packetized(struct file *file)
+{
+        return (file->f_flags & O_DIRECT) != 0;
+}
+
 static ssize_t
 pipe_write(struct kiocb *iocb, const struct iovec *_iov,
             unsigned long nr_segs, loff_t ppos)
@@ -592,6 +614,11 @@ redo2:
                         buf->ops = &anon_pipe_buf_ops;
                         buf->offset = 0;
                         buf->len = chars;
+                        buf->flags = 0;
+                        if (is_packetized(filp)) {
+                                buf->ops = &packet_pipe_buf_ops;
+                                buf->flags = PIPE_BUF_FLAG_PACKET;
+                        }
                         pipe->nrbufs = ++bufs;
                         pipe->tmp_page = NULL;
 
@@ -1012,7 +1039,7 @@ struct file *create_write_pipe(int flags)
                 goto err_dentry;
         f->f_mapping = inode->i_mapping;
 
-        f->f_flags = O_WRONLY | (flags & O_NONBLOCK);
+        f->f_flags = O_WRONLY | (flags & (O_NONBLOCK | O_DIRECT));
         f->f_version = 0;
 
         return f;
@@ -1056,7 +1083,7 @@ int do_pipe_flags(int *fd, int flags)
         int error;
         int fdw, fdr;
 
-        if (flags & ~(O_CLOEXEC | O_NONBLOCK))
+        if (flags & ~(O_CLOEXEC | O_NONBLOCK | O_DIRECT))
                 return -EINVAL;
 
         fw = create_write_pipe(flags);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index fc5bc276769..600faf5ba2f 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -133,6 +133,12 @@ struct pid_entry {
                 NULL, &proc_single_file_operations,     \
                 { .proc_show = show } )
 
+/* ANDROID is for special files in /proc. */
+#define ANDROID(NAME, MODE, OTYPE)                      \
+        NOD(NAME, (S_IFREG|(MODE)),                     \
+                &proc_##OTYPE##_inode_operations,       \
+                &proc_##OTYPE##_operations, {})
+
 /*
  * Count the number of hardlinks for the pid_entry table, excluding the .
  * and .. links.
@@ -194,65 +200,7 @@ static int proc_root_link(struct inode *inode, struct path *path)
         return result;
 }
 
-static struct mm_struct *__check_mem_permission(struct task_struct *task)
-{
-        struct mm_struct *mm;
-
-        mm = get_task_mm(task);
-        if (!mm)
-                return ERR_PTR(-EINVAL);
-
-        /*
-         * A task can always look at itself, in case it chooses
-         * to use system calls instead of load instructions.
-         */
-        if (task == current)
-                return mm;
-
-        /*
-         * If current is actively ptrace'ing, and would also be
-         * permitted to freshly attach with ptrace now, permit it.
-         */
-        if (task_is_stopped_or_traced(task)) {
-                int match;
-                rcu_read_lock();
-                match = (tracehook_tracer_task(task) == current);
-                rcu_read_unlock();
-                if (match && ptrace_may_access(task, PTRACE_MODE_ATTACH))
-                        return mm;
-        }
-
-        /*
-         * No one else is allowed.
-         */
-        mmput(mm);
-        return ERR_PTR(-EPERM);
-}
-
-/*
- * If current may access user memory in @task return a reference to the
- * corresponding mm, otherwise ERR_PTR.
- */
-static struct mm_struct *check_mem_permission(struct task_struct *task)
-{
-        struct mm_struct *mm;
-        int err;
-
-        /*
-         * Avoid racing if task exec's as we might get a new mm but validate
-         * against old credentials.
-         */
-        err = mutex_lock_killable(&task->signal->cred_guard_mutex);
-        if (err)
-                return ERR_PTR(err);
-
-        mm = __check_mem_permission(task);
-        mutex_unlock(&task->signal->cred_guard_mutex);
-
-        return mm;
-}
-
-struct mm_struct *mm_for_maps(struct task_struct *task)
+static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
 {
         struct mm_struct *mm;
         int err;
@@ -263,7 +211,8 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
 
         mm = get_task_mm(task);
         if (mm && mm != current->mm &&
-                        !ptrace_may_access(task, PTRACE_MODE_READ)) {
+                        !ptrace_may_access(task, PTRACE_MODE_READ) &&
+                        !capable(CAP_SYS_RESOURCE)) {
                 mmput(mm);
                 mm = ERR_PTR(-EACCES);
         }
@@ -272,6 +221,11 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
         return mm;
 }
 
+struct mm_struct *mm_for_maps(struct task_struct *task)
+{
+        return mm_access(task, PTRACE_MODE_READ);
+}
+
 static int proc_pid_cmdline(struct task_struct *task, char * buffer)
 {
         int res = 0;
@@ -816,38 +770,46 @@ static const struct file_operations proc_single_file_operations = {
 
 static int mem_open(struct inode* inode, struct file* file)
 {
-        file->private_data = (void*)((long)current->self_exec_id);
+        struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
+        struct mm_struct *mm;
+
+        if (!task)
+                return -ESRCH;
+
+        mm = mm_access(task, PTRACE_MODE_ATTACH);
+        put_task_struct(task);
+
+        if (IS_ERR(mm))
+                return PTR_ERR(mm);
+
+        if (mm) {
+                /* ensure this mm_struct can't be freed */
+                atomic_inc(&mm->mm_count);
+                /* but do not pin its memory */
+                mmput(mm);
+        }
+
         /* OK to pass negative loff_t, we can catch out-of-range */
         file->f_mode |= FMODE_UNSIGNED_OFFSET;
+        file->private_data = mm;
+
         return 0;
 }
 
 static ssize_t mem_read(struct file * file, char __user * buf,
                         size_t count, loff_t *ppos)
 {
-        struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
+        int ret;
         char *page;
         unsigned long src = *ppos;
-        int ret = -ESRCH;
-        struct mm_struct *mm;
+        struct mm_struct *mm = file->private_data;
 
-        if (!task)
-                goto out_no_task;
+        if (!mm)
+                return 0;
 
-        ret = -ENOMEM;
         page = (char *)__get_free_page(GFP_TEMPORARY);
         if (!page)
-                goto out;
-
-        mm = check_mem_permission(task);
-        ret = PTR_ERR(mm);
-        if (IS_ERR(mm))
-                goto out_free;
-
-        ret = -EIO;
- 
-        if (file->private_data != (void*)((long)current->self_exec_id))
-                goto out_put;
+                return -ENOMEM;
 
         ret = 0;
  
@@ -874,42 +836,28 @@ static ssize_t mem_read(struct file * file, char __user * buf,
         }
         *ppos = src;
 
-out_put:
-        mmput(mm);
-out_free:
         free_page((unsigned long) page);
-out:
-        put_task_struct(task);
-out_no_task:
         return ret;
 }
 
+#define mem_write NULL
+
+#ifndef mem_write
+/* This is a security hazard */
 static ssize_t mem_write(struct file * file, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
         int copied;
         char *page;
-        struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
         unsigned long dst = *ppos;
-        struct mm_struct *mm;
+        struct mm_struct *mm = file->private_data;
 
-        copied = -ESRCH;
-        if (!task)
-                goto out_no_task;
+        if (!mm)
+                return 0;
 
-        copied = -ENOMEM;
         page = (char *)__get_free_page(GFP_TEMPORARY);
         if (!page)
-                goto out_task;
-
-        mm = check_mem_permission(task);
-        copied = PTR_ERR(mm);
-        if (IS_ERR(mm))
-                goto out_free;
-
-        copied = -EIO;
-        if (file->private_data != (void *)((long)current->self_exec_id))
-                goto out_mm;
+                return -ENOMEM;
 
         copied = 0;
         while (count > 0) {
@@ -933,15 +881,10 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
         }
         *ppos = dst;
 
-out_mm:
-        mmput(mm);
-out_free:
         free_page((unsigned long) page);
-out_task:
-        put_task_struct(task);
-out_no_task:
         return copied;
 }
+#endif
 
 loff_t mem_lseek(struct file *file, loff_t offset, int orig)
 {
@@ -959,11 +902,20 @@ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
         return file->f_pos;
 }
 
+static int mem_release(struct inode *inode, struct file *file)
+{
+        struct mm_struct *mm = file->private_data;
+        if (mm)
+                mmdrop(mm);
+        return 0;
+}
+
 static const struct file_operations proc_mem_operations = {
         .llseek         = mem_lseek,
         .read           = mem_read,
         .write          = mem_write,
         .open           = mem_open,
+        .release        = mem_release,
 };
 
 static ssize_t environ_read(struct file *file, char __user *buf,
@@ -1141,6 +1093,39 @@ out:
         return err < 0 ? err : count;
 }
 
+static int oom_adjust_permission(struct inode *inode, int mask,
+                                 unsigned int flags)
+{
+        uid_t uid;
+        struct task_struct *p;
+
+        if (flags & IPERM_FLAG_RCU)
+                return -ECHILD;
+
+        p = get_proc_task(inode);
+        if(p) {
+                uid = task_uid(p);
+                put_task_struct(p);
+        }
+
+        /*
+         * System Server (uid == 1000) is granted access to oom_adj of all 
+         * android applications (uid > 10000) as and services (uid >= 1000)
+         */
+        if (p && (current_fsuid() == 1000) && (uid >= 1000)) {
+                if (inode->i_mode >> 6 & mask) {
+                        return 0;
+                }
+        }
+
+        /* Fall back to default. */
+        return generic_permission(inode, mask, flags, NULL);
+}
+
+static const struct inode_operations proc_oom_adjust_inode_operations = {
+        .permission     = oom_adjust_permission,
+};
+
 static const struct file_operations proc_oom_adjust_operations = {
         .read           = oom_adjust_read,
         .write          = oom_adjust_write,
@@ -1920,6 +1905,14 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
                 spin_lock(&files->file_lock);
                 file = fcheck_files(files, fd);
                 if (file) {
+                        unsigned int f_flags;
+                        struct fdtable *fdt;
+
+                        fdt = files_fdtable(files);
+                        f_flags = file->f_flags & ~O_CLOEXEC;
+                        if (FD_ISSET(fd, fdt->close_on_exec))
+                                f_flags |= O_CLOEXEC;
+
                         if (path) {
                                 *path = file->f_path;
                                 path_get(&file->f_path);
@@ -1929,7 +1922,7 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
                                          "pos:\t%lli\n"
                                          "flags:\t0%o\n",
                                          (long long) file->f_pos,
-                                         file->f_flags);
+                                         f_flags);
                         spin_unlock(&files->file_lock);
                         put_files_struct(files);
                         return 0;
@@ -2707,9 +2700,16 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
 {
         struct task_io_accounting acct = task->ioac;
         unsigned long flags;
+        int result;
 
-        if (!ptrace_may_access(task, PTRACE_MODE_READ))
-                return -EACCES;
+        result = mutex_lock_killable(&task->signal->cred_guard_mutex);
+        if (result)
+                return result;
+
+        if (!ptrace_may_access(task, PTRACE_MODE_READ)) {
+                result = -EACCES;
+                goto out_unlock;
+        }
 
         if (whole && lock_task_sighand(task, &flags)) {
                 struct task_struct *t = task;
@@ -2720,7 +2720,7 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
 
                 unlock_task_sighand(task, &flags);
         }
-        return sprintf(buffer,
+        result = sprintf(buffer,
                         "rchar: %llu\n"
                         "wchar: %llu\n"
                         "syscr: %llu\n"
@@ -2735,6 +2735,9 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
                         (unsigned long long)acct.read_bytes,
                         (unsigned long long)acct.write_bytes,
                         (unsigned long long)acct.cancelled_write_bytes);
+out_unlock:
+        mutex_unlock(&task->signal->cred_guard_mutex);
+        return result;
 }
 
 static int proc_tid_io_accounting(struct task_struct *task, char *buffer)
@@ -2829,7 +2832,7 @@ static const struct pid_entry tgid_base_stuff[] = {
         REG("cgroup",  S_IRUGO, proc_cgroup_operations),
 #endif
         INF("oom_score",  S_IRUGO, proc_oom_score),
-        REG("oom_adj",    S_IRUGO|S_IWUSR, proc_oom_adjust_operations),
+        ANDROID("oom_adj",S_IRUGO|S_IWUSR, oom_adjust),
         REG("oom_score_adj", S_IRUGO|S_IWUSR, proc_oom_score_adj_operations),
 #ifdef CONFIG_AUDITSYSCALL
         REG("loginuid",   S_IWUSR|S_IRUGO, proc_loginuid_operations),
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index ed257d14156..a96282781f9 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -131,12 +131,13 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
                 K(i.freeswap),
                 K(global_page_state(NR_FILE_DIRTY)),
                 K(global_page_state(NR_WRITEBACK)),
-                K(global_page_state(NR_ANON_PAGES)
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+                K(global_page_state(NR_ANON_PAGES)
                   + global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
-                  HPAGE_PMD_NR
+                  HPAGE_PMD_NR),
+#else
+                K(global_page_state(NR_ANON_PAGES)),
 #endif
-                  ),
                 K(global_page_state(NR_FILE_MAPPED)),
                 K(global_page_state(NR_SHMEM)),
                 K(global_page_state(NR_SLAB_RECLAIMABLE) +
diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c
index be177f702ac..d6c078ea148 100644
--- a/fs/proc/namespaces.c
+++ b/fs/proc/namespaces.c
@@ -54,7 +54,7 @@ static struct dentry *proc_ns_instantiate(struct inode *dir,
         ei->ns_ops    = ns_ops;
         ei->ns        = ns;
 
-        dentry->d_op = &pid_dentry_operations;
+        d_set_d_op(dentry, &pid_dentry_operations);
         d_add(dentry, inode);
         /* Close the race of the process dying before we return the dentry */
         if (pid_revalidate(dentry, NULL))
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 25b6a887adb..55a1f494711 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -407,6 +407,9 @@ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
         } else {
                 spin_unlock(&walk->mm->page_table_lock);
         }
+
+        if (pmd_trans_unstable(pmd))
+                return 0;
         /*
          * The mmap_sem held all the way back in m_start() is what
          * keeps khugepaged out of here and from collapsing things
@@ -505,6 +508,8 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
         struct page *page;
 
         split_huge_page_pmd(walk->mm, pmd);
+        if (pmd_trans_unstable(pmd))
+                return 0;
 
         pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
         for (; addr != end; pte++, addr += PAGE_SIZE) {
@@ -516,6 +521,9 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
                 if (!page)
                         continue;
 
+                if (PageReserved(page))
+                        continue;
+
                 /* Clear accessed and referenced bits. */
                 ptep_test_and_clear_young(vma, addr, pte);
                 ClearPageReferenced(page);
@@ -665,6 +673,8 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
         int err = 0;
 
         split_huge_page_pmd(walk->mm, pmd);
+        if (pmd_trans_unstable(pmd))
+                return 0;
 
         /* find the first VMA at or above 'addr' */
         vma = find_vma(walk->mm, addr);
@@ -877,30 +887,54 @@ struct numa_maps_private {
         struct numa_maps md;
 };
 
-static void gather_stats(struct page *page, struct numa_maps *md, int pte_dirty)
+static void gather_stats(struct page *page, struct numa_maps *md, int pte_dirty,
+                        unsigned long nr_pages)
 {
         int count = page_mapcount(page);
 
-        md->pages++;
+        md->pages += nr_pages;
         if (pte_dirty || PageDirty(page))
-                md->dirty++;
+                md->dirty += nr_pages;
 
         if (PageSwapCache(page))
-                md->swapcache++;
+                md->swapcache += nr_pages;
 
         if (PageActive(page) || PageUnevictable(page))
-                md->active++;
+                md->active += nr_pages;
 
         if (PageWriteback(page))
-                md->writeback++;
+                md->writeback += nr_pages;
 
         if (PageAnon(page))
-                md->anon++;
+                md->anon += nr_pages;
 
         if (count > md->mapcount_max)
                 md->mapcount_max = count;
 
-        md->node[page_to_nid(page)]++;
+        md->node[page_to_nid(page)] += nr_pages;
+}
+
+static struct page *can_gather_numa_stats(pte_t pte, struct vm_area_struct *vma,
+                unsigned long addr)
+{
+        struct page *page;
+        int nid;
+
+        if (!pte_present(pte))
+                return NULL;
+
+        page = vm_normal_page(vma, addr, pte);
+        if (!page)
+                return NULL;
+
+        if (PageReserved(page))
+                return NULL;
+
+        nid = page_to_nid(page);
+        if (!node_isset(nid, node_states[N_HIGH_MEMORY]))
+                return NULL;
+
+        return page;
 }
 
 static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
@@ -912,26 +946,34 @@ static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
         pte_t *pte;
 
         md = walk->private;
-        orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
-        do {
-                struct page *page;
-                int nid;
+        spin_lock(&walk->mm->page_table_lock);
+        if (pmd_trans_huge(*pmd)) {
+                if (pmd_trans_splitting(*pmd)) {
+                        spin_unlock(&walk->mm->page_table_lock);
+                        wait_split_huge_page(md->vma->anon_vma, pmd);
+                } else {
+                        pte_t huge_pte = *(pte_t *)pmd;
+                        struct page *page;
 
-                if (!pte_present(*pte))
-                        continue;
+                        page = can_gather_numa_stats(huge_pte, md->vma, addr);
+                        if (page)
+                                gather_stats(page, md, pte_dirty(huge_pte),
+                                                HPAGE_PMD_SIZE/PAGE_SIZE);
+                        spin_unlock(&walk->mm->page_table_lock);
+                        return 0;
+                }
+        } else {
+                spin_unlock(&walk->mm->page_table_lock);
+        }
 
-                page = vm_normal_page(md->vma, addr, *pte);
+        if (pmd_trans_unstable(pmd))
+                return 0;
+        orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+        do {
+                struct page *page = can_gather_numa_stats(*pte, md->vma, addr);
                 if (!page)
                         continue;
-
-                if (PageReserved(page))
-                        continue;
-
-                nid = page_to_nid(page);
-                if (!node_isset(nid, node_states[N_HIGH_MEMORY]))
-                        continue;
-
-                gather_stats(page, md, pte_dirty(*pte));
+                gather_stats(page, md, pte_dirty(*pte), 1);
 
         } while (pte++, addr += PAGE_SIZE, addr != end);
         pte_unmap_unlock(orig_pte, ptl);
@@ -952,7 +994,7 @@ static int gather_hugetbl_stats(pte_t *pte, unsigned long hmask,
                 return 0;
 
         md = walk->private;
-        gather_stats(page, md, pte_dirty(*pte));
+        gather_stats(page, md, pte_dirty(*pte), 1);
         return 0;
 }
 
@@ -1009,6 +1051,9 @@ static int show_numa_map(struct seq_file *m, void *v)
                 seq_printf(m, " stack");
         }
 
+        if (is_vm_hugetlb_page(vma))
+                seq_printf(m, " huge");
+
         walk_page_range(vma->vm_start, vma->vm_end, &walk);
 
         if (!md->pages)
diff --git a/fs/proc/uptime.c b/fs/proc/uptime.c
index 766b1d45605..29166ecd03a 100644
--- a/fs/proc/uptime.c
+++ b/fs/proc/uptime.c
@@ -11,15 +11,20 @@ static int uptime_proc_show(struct seq_file *m, void *v)
 {
         struct timespec uptime;
         struct timespec idle;
+        cputime64_t idletime;
+        u64 nsec;
+        u32 rem;
         int i;
-        cputime_t idletime = cputime_zero;
 
+        idletime = 0;
         for_each_possible_cpu(i)
                 idletime = cputime64_add(idletime, kstat_cpu(i).cpustat.idle);
 
         do_posix_clock_monotonic_gettime(&uptime);
         monotonic_to_bootbased(&uptime);
-        cputime_to_timespec(idletime, &idle);
+        nsec = cputime64_to_jiffies64(idletime) * TICK_NSEC;
+        idle.tv_sec = div_u64_rem(nsec, NSEC_PER_SEC, &rem);
+        idle.tv_nsec = rem;
         seq_printf(m, "%lu.%02lu %lu.%02lu\n",
                         (unsigned long) uptime.tv_sec,
                         (uptime.tv_nsec / (NSEC_PER_SEC / 100)),
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index b34bdb25490..4bae57fc603 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -286,7 +286,7 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
                 /* caller already holds s_umount */
                 if (sb->s_flags & MS_RDONLY)
                         return -EROFS;
-                writeback_inodes_sb(sb);
+                writeback_inodes_sb(sb, WB_REASON_SYNC);
                 return 0;
         default:
                 return -EINVAL;
@@ -355,7 +355,7 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
          * resolution (think about autofs) and thus deadlocks could arise.
          */
         if (cmds == Q_QUOTAON) {
-                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW, &path);
+                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
                 if (ret)
                         pathp = ERR_PTR(ret);
                 else
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index fbb0b478a34..d5378d02858 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -110,6 +110,7 @@ int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
 
                 /* prevent the page from being discarded on memory pressure */
                 SetPageDirty(page);
+                SetPageUptodate(page);
 
                 unlock_page(page);
                 put_page(page);
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index aa91089162c..f19dfbf6000 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -453,16 +453,20 @@ int remove_save_link(struct inode *inode, int truncate)
 static void reiserfs_kill_sb(struct super_block *s)
 {
         if (REISERFS_SB(s)) {
-                if (REISERFS_SB(s)->xattr_root) {
-                        d_invalidate(REISERFS_SB(s)->xattr_root);
-                        dput(REISERFS_SB(s)->xattr_root);
-                        REISERFS_SB(s)->xattr_root = NULL;
-                }
-                if (REISERFS_SB(s)->priv_root) {
-                        d_invalidate(REISERFS_SB(s)->priv_root);
-                        dput(REISERFS_SB(s)->priv_root);
-                        REISERFS_SB(s)->priv_root = NULL;
-                }
+                /*
+                 * Force any pending inode evictions to occur now. Any
+                 * inodes to be removed that have extended attributes
+                 * associated with them need to clean them up before
+                 * we can release the extended attribute root dentries.
+                 * shrink_dcache_for_umount will BUG if we don't release
+                 * those before it's called so ->put_super is too late.
+                 */
+                shrink_dcache_sb(s);
+
+                dput(REISERFS_SB(s)->xattr_root);
+                REISERFS_SB(s)->xattr_root = NULL;
+                dput(REISERFS_SB(s)->priv_root);
+                REISERFS_SB(s)->priv_root = NULL;
         }
 
         kill_block_super(s);
@@ -1164,7 +1168,8 @@ static void handle_quota_files(struct super_block *s, char **qf_names,
                         kfree(REISERFS_SB(s)->s_qf_names[i]);
                 REISERFS_SB(s)->s_qf_names[i] = qf_names[i];
         }
-        REISERFS_SB(s)->s_jquota_fmt = *qfmt;
+        if (*qfmt)
+                REISERFS_SB(s)->s_jquota_fmt = *qfmt;
 }
 #endif
 
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 05d6b0e78c9..dba43c3ea3a 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -449,8 +449,6 @@ EXPORT_SYMBOL(seq_path);
 
 /*
  * Same as seq_path, but relative to supplied root.
- *
- * root may be changed, see __d_path().
  */
 int seq_path_root(struct seq_file *m, struct path *path, struct path *root,
                   char *esc)
@@ -463,6 +461,8 @@ int seq_path_root(struct seq_file *m, struct path *path, struct path *root,
                 char *p;
 
                 p = __d_path(path, root, buf, size);
+                if (!p)
+                        return SEQ_SKIP;
                 res = PTR_ERR(p);
                 if (!IS_ERR(p)) {
                         char *end = mangle_path(buf, p, esc);
@@ -474,7 +474,7 @@ int seq_path_root(struct seq_file *m, struct path *path, struct path *root,
         }
         seq_commit(m, res);
 
-        return res < 0 ? res : 0;
+        return res < 0 && res != -ENAMETOOLONG ? res : 0;
 }
 
 /*
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 492465b451d..7ae2a574cb2 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -30,6 +30,21 @@
 #include <linux/signalfd.h>
 #include <linux/syscalls.h>
 
+void signalfd_cleanup(struct sighand_struct *sighand)
+{
+        wait_queue_head_t *wqh = &sighand->signalfd_wqh;
+        /*
+         * The lockless check can race with remove_wait_queue() in progress,
+         * but in this case its caller should run under rcu_read_lock() and
+         * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return.
+         */
+        if (likely(!waitqueue_active(wqh)))
+                return;
+
+        /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */
+        wake_up_poll(wqh, POLLHUP | POLLFREE);
+}
+
 struct signalfd_ctx {
         sigset_t sigmask;
 };
diff --git a/fs/splice.c b/fs/splice.c
index aa866d30969..6d0dfb89c75 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -31,6 +31,7 @@
 #include <linux/uio.h>
 #include <linux/security.h>
 #include <linux/gfp.h>
+#include <linux/socket.h>
 
 /*
  * Attempt to steal a page from a pipe buffer. This should perhaps go into
@@ -132,7 +133,7 @@ error:
         return err;
 }
 
-static const struct pipe_buf_operations page_cache_pipe_buf_ops = {
+const struct pipe_buf_operations page_cache_pipe_buf_ops = {
         .can_merge = 0,
         .map = generic_pipe_buf_map,
         .unmap = generic_pipe_buf_unmap,
@@ -264,7 +265,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
         return ret;
 }
 
-static void spd_release_page(struct splice_pipe_desc *spd, unsigned int i)
+void spd_release_page(struct splice_pipe_desc *spd, unsigned int i)
 {
         page_cache_release(spd->pages[i]);
 }
@@ -691,7 +692,9 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
         if (!likely(file->f_op && file->f_op->sendpage))
                 return -EINVAL;
 
-        more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
+        more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0;
+        if (sd->len < sd->total_len)
+                more |= MSG_SENDPAGE_NOTLAST;
         return file->f_op->sendpage(file, buf->page, buf->offset,
                                     sd->len, &pos, more);
 }
diff --git a/fs/stat.c b/fs/stat.c
index 961039121cb..02a606141b8 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -296,15 +296,16 @@ SYSCALL_DEFINE4(readlinkat, int, dfd, const char __user *, pathname,
 {
         struct path path;
         int error;
+        int empty = 0;
 
         if (bufsiz <= 0)
                 return -EINVAL;
 
-        error = user_path_at(dfd, pathname, LOOKUP_EMPTY, &path);
+        error = user_path_at_empty(dfd, pathname, LOOKUP_EMPTY, &path, &empty);
         if (!error) {
                 struct inode *inode = path.dentry->d_inode;
 
-                error = -EINVAL;
+                error = empty ? -ENOENT : -EINVAL;
                 if (inode->i_op->readlink) {
                         error = security_inode_readlink(path.dentry);
                         if (!error) {
diff --git a/fs/statfs.c b/fs/statfs.c
index 8244924dec5..9cf04a11896 100644
--- a/fs/statfs.c
+++ b/fs/statfs.c
@@ -76,7 +76,7 @@ EXPORT_SYMBOL(vfs_statfs);
 int user_statfs(const char __user *pathname, struct kstatfs *st)
 {
         struct path path;
-        int error = user_path(pathname, &path);
+        int error = user_path_at(AT_FDCWD, pathname, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
         if (!error) {
                 error = vfs_statfs(&path, st);
                 path_put(&path);
diff --git a/fs/super.c b/fs/super.c
index ab3d672db0d..e2cf58cad6a 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -241,17 +241,48 @@ static int grab_super(struct super_block *s) __releases(sb_lock)
 }
 
 /*
+ *      grab_super_passive - acquire a passive reference
+ *      @s: reference we are trying to grab
+ *
+ *      Tries to acquire a passive reference. This is used in places where we
+ *      cannot take an active reference but we need to ensure that the
+ *      superblock does not go away while we are working on it. It returns
+ *      false if a reference was not gained, and returns true with the s_umount
+ *      lock held in read mode if a reference is gained. On successful return,
+ *      the caller must drop the s_umount lock and the passive reference when
+ *      done.
+ */
+bool grab_super_passive(struct super_block *sb)
+{
+        spin_lock(&sb_lock);
+        if (list_empty(&sb->s_instances)) {
+                spin_unlock(&sb_lock);
+                return false;
+        }
+
+        sb->s_count++;
+        spin_unlock(&sb_lock);
+
+        if (down_read_trylock(&sb->s_umount)) {
+                if (sb->s_root)
+                        return true;
+                up_read(&sb->s_umount);
+        }
+
+        put_super(sb);
+        return false;
+}
+
+/*
  * Superblock locking.  We really ought to get rid of these two.
  */
 void lock_super(struct super_block * sb)
 {
-        get_fs_excl();
         mutex_lock(&sb->s_lock);
 }
 
 void unlock_super(struct super_block * sb)
 {
-        put_fs_excl();
         mutex_unlock(&sb->s_lock);
 }
 
@@ -822,7 +853,7 @@ struct dentry *mount_bdev(struct file_system_type *fs_type,
         } else {
                 char b[BDEVNAME_SIZE];
 
-                s->s_flags = flags | MS_NOSEC;
+                s->s_flags = flags;
                 s->s_mode = mode;
                 strlcpy(s->s_id, bdevname(bdev, b), sizeof(s->s_id));
                 sb_set_blocksize(s, block_size(bdev));
@@ -1009,6 +1040,8 @@ int freeze_super(struct super_block *sb)
                         printk(KERN_ERR
                                 "VFS:Filesystem freeze failed\n");
                         sb->s_frozen = SB_UNFROZEN;
+                        smp_wmb();
+                        wake_up(&sb->s_wait_unfrozen);
                         deactivate_locked_super(sb);
                         return ret;
                 }
diff --git a/fs/sync.c b/fs/sync.c
index c38ec163da6..2385e128a35 100644
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -18,6 +18,9 @@
 #include <linux/backing-dev.h>
 #include "internal.h"
 
+bool fsync_enabled = true;
+module_param(fsync_enabled, bool, 0755);
+
 #define VALID_FLAGS (SYNC_FILE_RANGE_WAIT_BEFORE|SYNC_FILE_RANGE_WRITE| \
                         SYNC_FILE_RANGE_WAIT_AFTER)
 
@@ -43,7 +46,7 @@ static int __sync_filesystem(struct super_block *sb, int wait)
         if (wait)
                 sync_inodes_sb(sb);
         else
-                writeback_inodes_sb(sb);
+                writeback_inodes_sb(sb, WB_REASON_SYNC);
 
         if (sb->s_op->sync_fs)
                 sb->s_op->sync_fs(sb, wait);
@@ -98,7 +101,7 @@ static void sync_filesystems(int wait)
  */
 SYSCALL_DEFINE0(sync)
 {
-        wakeup_flusher_threads(0);
+        wakeup_flusher_threads(0, WB_REASON_SYNC);
         sync_filesystems(0);
         sync_filesystems(1);
         if (unlikely(laptop_mode))
@@ -139,6 +142,9 @@ SYSCALL_DEFINE1(syncfs, int, fd)
         int ret;
         int fput_needed;
 
+        if (!fsync_enabled)
+                return 0;
+
         file = fget_light(fd, &fput_needed);
         if (!file)
                 return -EBADF;
@@ -168,6 +174,9 @@ int vfs_fsync_range(struct file *file, loff_t start, loff_t end, int datasync)
         struct address_space *mapping = file->f_mapping;
         int err, ret;
 
+        if (!fsync_enabled)
+                return 0;
+
         if (!file->f_op || !file->f_op->fsync) {
                 ret = -EINVAL;
                 goto out;
@@ -200,6 +209,9 @@ EXPORT_SYMBOL(vfs_fsync_range);
  */
 int vfs_fsync(struct file *file, int datasync)
 {
+        if (!fsync_enabled)
+                return 0;
+                
         return vfs_fsync_range(file, 0, LLONG_MAX, datasync);
 }
 EXPORT_SYMBOL(vfs_fsync);
@@ -209,6 +221,9 @@ static int do_fsync(unsigned int fd, int datasync)
         struct file *file;
         int ret = -EBADF;
 
+        if (!fsync_enabled)
+                return 0;
+
         file = fget(fd);
         if (file) {
                 ret = vfs_fsync(file, datasync);
@@ -219,11 +234,17 @@ static int do_fsync(unsigned int fd, int datasync)
 
 SYSCALL_DEFINE1(fsync, unsigned int, fd)
 {
+        if (!fsync_enabled)
+                return 0;
+                
         return do_fsync(fd, 0);
 }
 
 SYSCALL_DEFINE1(fdatasync, unsigned int, fd)
 {
+        if (!fsync_enabled)
+                return 0;
+                
         return do_fsync(fd, 1);
 }
 
@@ -237,6 +258,9 @@ SYSCALL_DEFINE1(fdatasync, unsigned int, fd)
  */
 int generic_write_sync(struct file *file, loff_t pos, loff_t count)
 {
+        if (!fsync_enabled)
+                return 0;
+                
         if (!(file->f_flags & O_DSYNC) && !IS_SYNC(file->f_mapping->host))
                 return 0;
         return vfs_fsync_range(file, pos, pos + count - 1,
@@ -301,6 +325,9 @@ SYSCALL_DEFINE(sync_file_range)(int fd, loff_t offset, loff_t nbytes,
         int fput_needed;
         umode_t i_mode;
 
+        if (!fsync_enabled)
+                return 0;
+
         ret = -EINVAL;
         if (flags & ~VALID_FLAGS)
                 goto out;
diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
index 0a12eb89cd3..a494413e486 100644
--- a/fs/sysfs/inode.c
+++ b/fs/sysfs/inode.c
@@ -136,12 +136,13 @@ static int sysfs_sd_setsecdata(struct sysfs_dirent *sd, void **secdata, u32 *sec
         void *old_secdata;
         size_t old_secdata_len;
 
-        iattrs = sd->s_iattr;
-        if (!iattrs)
-                iattrs = sysfs_init_inode_attrs(sd);
-        if (!iattrs)
-                return -ENOMEM;
+        if (!sd->s_iattr) {
+                sd->s_iattr = sysfs_init_inode_attrs(sd);
+                if (!sd->s_iattr)
+                        return -ENOMEM;
+        }
 
+        iattrs = sd->s_iattr;
         old_secdata = iattrs->ia_secdata;
         old_secdata_len = iattrs->ia_secdata_len;
 
diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c
index 315de66e52b..bc4f94b2870 100644
--- a/fs/ubifs/budget.c
+++ b/fs/ubifs/budget.c
@@ -63,7 +63,7 @@
 static void shrink_liability(struct ubifs_info *c, int nr_to_write)
 {
         down_read(&c->vfs_sb->s_umount);
-        writeback_inodes_sb(c->vfs_sb);
+        writeback_inodes_sb(c->vfs_sb, WB_REASON_FS_FREE_SPACE);
         up_read(&c->vfs_sb->s_umount);
 }
 
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index a811ac4a26b..fd75b635dae 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -121,20 +121,21 @@ const char *dbg_key_str1(const struct ubifs_info *c,
                          const union ubifs_key *key);
 
 /*
- * DBGKEY macros require @dbg_lock to be held, which it is in the dbg message
- * macros.
+ * TODO: these macros are now broken because there is no locking around them
+ * and we use a global buffer for the key string. This means that in case of
+ * concurrent execution we will end up with incorrect and messy key strings.
  */
 #define DBGKEY(key) dbg_key_str0(c, (key))
 #define DBGKEY1(key) dbg_key_str1(c, (key))
 
-#define ubifs_dbg_msg(type, fmt, ...) do {                        \
-        spin_lock(&dbg_lock);                                     \
-        pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__); \
-        spin_unlock(&dbg_lock);                                   \
-} while (0)
+#define ubifs_dbg_msg(type, fmt, ...) \
+        pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__)
 
 /* Just a debugging messages not related to any specific UBIFS subsystem */
-#define dbg_msg(fmt, ...)   ubifs_dbg_msg("msg", fmt, ##__VA_ARGS__)
+#define dbg_msg(fmt, ...)                                                     \
+        printk(KERN_DEBUG "UBIFS DBG (pid %d): %s: " fmt "\n", current->pid,  \
+               __func__, ##__VA_ARGS__)
+
 /* General messages */
 #define dbg_gen(fmt, ...)   ubifs_dbg_msg("gen", fmt, ##__VA_ARGS__)
 /* Additional journal messages */
diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c
index c606f010e8d..1250016bfb9 100644
--- a/fs/ubifs/sb.c
+++ b/fs/ubifs/sb.c
@@ -715,8 +715,12 @@ static int fixup_free_space(struct ubifs_info *c)
                 lnum = ubifs_next_log_lnum(c, lnum);
         }
 
-        /* Fixup the current log head */
-        err = fixup_leb(c, c->lhead_lnum, c->lhead_offs);
+        /*
+         * Fixup the log head which contains the only a CS node at the
+         * beginning.
+         */
+        err = fixup_leb(c, c->lhead_lnum,
+                        ALIGN(UBIFS_CS_NODE_SZ, c->min_io_size));
         if (err)
                 goto out;
 
diff --git a/fs/udf/file.c b/fs/udf/file.c
index 2a346bb1d9f..3438b000041 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -125,7 +125,6 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
                         err = udf_expand_file_adinicb(inode);
                         if (err) {
                                 udf_debug("udf_expand_adinicb: err=%d\n", err);
-                                up_write(&iinfo->i_data_sem);
                                 return err;
                         }
                 } else {
@@ -133,9 +132,10 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
                                 iinfo->i_lenAlloc = pos + count;
                         else
                                 iinfo->i_lenAlloc = inode->i_size;
+                        up_write(&iinfo->i_data_sem);
                 }
-        }
-        up_write(&iinfo->i_data_sem);
+        } else
+                up_write(&iinfo->i_data_sem);
 
         retval = generic_file_aio_write(iocb, iov, nr_segs, ppos);
         if (retval > 0)
@@ -201,12 +201,10 @@ out:
 static int udf_release_file(struct inode *inode, struct file *filp)
 {
         if (filp->f_mode & FMODE_WRITE) {
-                mutex_lock(&inode->i_mutex);
                 down_write(&UDF_I(inode)->i_data_sem);
                 udf_discard_prealloc(inode);
                 udf_truncate_tail_extent(inode);
                 up_write(&UDF_I(inode)->i_data_sem);
-                mutex_unlock(&inode->i_mutex);
         }
         return 0;
 }
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 1d1358ed80c..262050f2eb6 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -145,6 +145,12 @@ const struct address_space_operations udf_aops = {
         .bmap           = udf_bmap,
 };
 
+/*
+ * Expand file stored in ICB to a normal one-block-file
+ *
+ * This function requires i_data_sem for writing and releases it.
+ * This function requires i_mutex held
+ */
 int udf_expand_file_adinicb(struct inode *inode)
 {
         struct page *page;
@@ -163,9 +169,15 @@ int udf_expand_file_adinicb(struct inode *inode)
                         iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
                 /* from now on we have normal address_space methods */
                 inode->i_data.a_ops = &udf_aops;
+                up_write(&iinfo->i_data_sem);
                 mark_inode_dirty(inode);
                 return 0;
         }
+        /*
+         * Release i_data_sem so that we can lock a page - page lock ranks
+         * above i_data_sem. i_mutex still protects us against file changes.
+         */
+        up_write(&iinfo->i_data_sem);
 
         page = find_or_create_page(inode->i_mapping, 0, GFP_NOFS);
         if (!page)
@@ -181,6 +193,7 @@ int udf_expand_file_adinicb(struct inode *inode)
                 SetPageUptodate(page);
                 kunmap(page);
         }
+        down_write(&iinfo->i_data_sem);
         memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0x00,
                iinfo->i_lenAlloc);
         iinfo->i_lenAlloc = 0;
@@ -190,17 +203,20 @@ int udf_expand_file_adinicb(struct inode *inode)
                 iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
         /* from now on we have normal address_space methods */
         inode->i_data.a_ops = &udf_aops;
+        up_write(&iinfo->i_data_sem);
         err = inode->i_data.a_ops->writepage(page, &udf_wbc);
         if (err) {
                 /* Restore everything back so that we don't lose data... */
                 lock_page(page);
                 kaddr = kmap(page);
+                down_write(&iinfo->i_data_sem);
                 memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr,
                        inode->i_size);
                 kunmap(page);
                 unlock_page(page);
                 iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB;
                 inode->i_data.a_ops = &udf_adinicb_aops;
+                up_write(&iinfo->i_data_sem);
         }
         page_cache_release(page);
         mark_inode_dirty(inode);
@@ -1105,10 +1121,9 @@ int udf_setsize(struct inode *inode, loff_t newsize)
                         if (bsize <
                             (udf_file_entry_alloc_offset(inode) + newsize)) {
                                 err = udf_expand_file_adinicb(inode);
-                                if (err) {
-                                        up_write(&iinfo->i_data_sem);
+                                if (err)
                                         return err;
-                                }
+                                down_write(&iinfo->i_data_sem);
                         } else
                                 iinfo->i_lenAlloc = newsize;
                 }
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 7b27b063ff6..a8e867ae11c 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -56,6 +56,7 @@
 #include <linux/seq_file.h>
 #include <linux/bitmap.h>
 #include <linux/crc-itu-t.h>
+#include <linux/log2.h>
 #include <asm/byteorder.h>
 
 #include "udf_sb.h"
@@ -1244,16 +1245,65 @@ out_bh:
         return ret;
 }
 
+static int udf_load_sparable_map(struct super_block *sb,
+                                 struct udf_part_map *map,
+                                 struct sparablePartitionMap *spm)
+{
+        uint32_t loc;
+        uint16_t ident;
+        struct sparingTable *st;
+        struct udf_sparing_data *sdata = &map->s_type_specific.s_sparing;
+        int i;
+        struct buffer_head *bh;
+
+        map->s_partition_type = UDF_SPARABLE_MAP15;
+        sdata->s_packet_len = le16_to_cpu(spm->packetLength);
+        if (!is_power_of_2(sdata->s_packet_len)) {
+                udf_error(sb, __func__, "error loading logical volume descriptor: "
+                        "Invalid packet length %u\n",
+                        (unsigned)sdata->s_packet_len);
+                return -EIO;
+        }
+        if (spm->numSparingTables > 4) {
+                udf_error(sb, __func__, "error loading logical volume descriptor: "
+                        "Too many sparing tables (%d)\n",
+                        (int)spm->numSparingTables);
+                return -EIO;
+        }
+
+        for (i = 0; i < spm->numSparingTables; i++) {
+                loc = le32_to_cpu(spm->locSparingTable[i]);
+                bh = udf_read_tagged(sb, loc, loc, &ident);
+                if (!bh)
+                        continue;
+
+                st = (struct sparingTable *)bh->b_data;
+                if (ident != 0 ||
+                    strncmp(st->sparingIdent.ident, UDF_ID_SPARING,
+                            strlen(UDF_ID_SPARING)) ||
+                    sizeof(*st) + le16_to_cpu(st->reallocationTableLen) >
+                                                        sb->s_blocksize) {
+                        brelse(bh);
+                        continue;
+                }
+
+                sdata->s_spar_map[i] = bh;
+        }
+        map->s_partition_func = udf_get_pblock_spar15;
+        return 0;
+}
+
 static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                                struct kernel_lb_addr *fileset)
 {
         struct logicalVolDesc *lvd;
-        int i, j, offset;
+        int i, offset;
         uint8_t type;
         struct udf_sb_info *sbi = UDF_SB(sb);
         struct genericPartitionMap *gpm;
         uint16_t ident;
         struct buffer_head *bh;
+        unsigned int table_len;
         int ret = 0;
 
         bh = udf_read_tagged(sb, block, block, &ident);
@@ -1261,15 +1311,20 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                 return 1;
         BUG_ON(ident != TAG_IDENT_LVD);
         lvd = (struct logicalVolDesc *)bh->b_data;
-
-        i = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
-        if (i != 0) {
-                ret = i;
+        table_len = le32_to_cpu(lvd->mapTableLength);
+        if (sizeof(*lvd) + table_len > sb->s_blocksize) {
+                udf_error(sb, __func__, "error loading logical volume descriptor: "
+                        "Partition table too long (%u > %lu)\n", table_len,
+                        sb->s_blocksize - sizeof(*lvd));
                 goto out_bh;
         }
 
+        ret = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
+        if (ret)
+                goto out_bh;
+
         for (i = 0, offset = 0;
-             i < sbi->s_partitions && offset < le32_to_cpu(lvd->mapTableLength);
+             i < sbi->s_partitions && offset < table_len;
              i++, offset += gpm->partitionMapLength) {
                 struct udf_part_map *map = &sbi->s_partmaps[i];
                 gpm = (struct genericPartitionMap *)
@@ -1304,38 +1359,9 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                         } else if (!strncmp(upm2->partIdent.ident,
                                                 UDF_ID_SPARABLE,
                                                 strlen(UDF_ID_SPARABLE))) {
-                                uint32_t loc;
-                                struct sparingTable *st;
-                                struct sparablePartitionMap *spm =
-                                        (struct sparablePartitionMap *)gpm;
-
-                                map->s_partition_type = UDF_SPARABLE_MAP15;
-                                map->s_type_specific.s_sparing.s_packet_len =
-                                                le16_to_cpu(spm->packetLength);
-                                for (j = 0; j < spm->numSparingTables; j++) {
-                                        struct buffer_head *bh2;
-
-                                        loc = le32_to_cpu(
-                                                spm->locSparingTable[j]);
-                                        bh2 = udf_read_tagged(sb, loc, loc,
-                                                             &ident);
-                                        map->s_type_specific.s_sparing.
-                                                        s_spar_map[j] = bh2;
-
-                                        if (bh2 == NULL)
-                                                continue;
-
-                                        st = (struct sparingTable *)bh2->b_data;
-                                        if (ident != 0 || strncmp(
-                                                st->sparingIdent.ident,
-                                                UDF_ID_SPARING,
-                                                strlen(UDF_ID_SPARING))) {
-                                                brelse(bh2);
-                                                map->s_type_specific.s_sparing.
-                                                        s_spar_map[j] = NULL;
-                                        }
-                                }
-                                map->s_partition_func = udf_get_pblock_spar15;
+                                if (udf_load_sparable_map(sb, map,
+                                    (struct sparablePartitionMap *)gpm) < 0)
+                                        goto out_bh;
                         } else if (!strncmp(upm2->partIdent.ident,
                                                 UDF_ID_METADATA,
                                                 strlen(UDF_ID_METADATA))) {
@@ -1830,6 +1856,12 @@ static void udf_close_lvid(struct super_block *sb)
                                 le16_to_cpu(lvid->descTag.descCRCLength)));
 
         lvid->descTag.tagChecksum = udf_tag_checksum(&lvid->descTag);
+        /*
+         * We set buffer uptodate unconditionally here to avoid spurious
+         * warnings from mark_buffer_dirty() when previous EIO has marked
+         * the buffer as !uptodate
+         */
+        set_buffer_uptodate(bh);
         mark_buffer_dirty(bh);
         sbi->s_lvid_dirty = 0;
         mutex_unlock(&sbi->s_alloc_mutex);
diff --git a/fs/xfs/linux-2.6/xfs_acl.c b/fs/xfs/linux-2.6/xfs_acl.c
index 39f4f809bb6..f86e0348786 100644
--- a/fs/xfs/linux-2.6/xfs_acl.c
+++ b/fs/xfs/linux-2.6/xfs_acl.c
@@ -39,9 +39,11 @@ xfs_acl_from_disk(struct xfs_acl *aclp)
         struct posix_acl_entry *acl_e;
         struct posix_acl *acl;
         struct xfs_acl_entry *ace;
-        int count, i;
+        unsigned int count, i;
 
         count = be32_to_cpu(aclp->acl_cnt);
+        if (count > XFS_ACL_MAX_ENTRIES)
+                return ERR_PTR(-EFSCORRUPTED);
 
         acl = posix_acl_alloc(count, GFP_KERNEL);
         if (!acl)
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index 50a7d5fb3b7..36d6ee44386 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -346,7 +346,6 @@ extern struct list_head *xfs_get_buftarg_list(void);
 #define xfs_getsize_buftarg(buftarg)    block_size((buftarg)->bt_bdev)
 #define xfs_readonly_buftarg(buftarg)   bdev_read_only((buftarg)->bt_bdev)
 
-#define xfs_binval(buftarg)             xfs_flush_buftarg(buftarg, 1)
 #define XFS_bflush(buftarg)             xfs_flush_buftarg(buftarg, 1)
 
 #endif  /* __XFS_BUF_H__ */
diff --git a/fs/xfs/linux-2.6/xfs_discard.c b/fs/xfs/linux-2.6/xfs_discard.c
index 244e797dae3..572494faf26 100644
--- a/fs/xfs/linux-2.6/xfs_discard.c
+++ b/fs/xfs/linux-2.6/xfs_discard.c
@@ -68,7 +68,7 @@ xfs_trim_extents(
          * Look up the longest btree in the AGF and start with it.
          */
         error = xfs_alloc_lookup_le(cur, 0,
-                                    XFS_BUF_TO_AGF(agbp)->agf_longest, &i);
+                            be32_to_cpu(XFS_BUF_TO_AGF(agbp)->agf_longest), &i);
         if (error)
                 goto out_del_cursor;
 
@@ -84,7 +84,7 @@ xfs_trim_extents(
                 if (error)
                         goto out_del_cursor;
                 XFS_WANT_CORRUPTED_GOTO(i == 1, out_del_cursor);
-                ASSERT(flen <= XFS_BUF_TO_AGF(agbp)->agf_longest);
+                ASSERT(flen <= be32_to_cpu(XFS_BUF_TO_AGF(agbp)->agf_longest));
 
                 /*
                  * Too small?  Give up.
diff --git a/fs/xfs/linux-2.6/xfs_export.c b/fs/xfs/linux-2.6/xfs_export.c
index f4f878fc008..fed3f3c878c 100644
--- a/fs/xfs/linux-2.6/xfs_export.c
+++ b/fs/xfs/linux-2.6/xfs_export.c
@@ -98,22 +98,22 @@ xfs_fs_encode_fh(
         switch (fileid_type) {
         case FILEID_INO32_GEN_PARENT:
                 spin_lock(&dentry->d_lock);
-                fid->i32.parent_ino = dentry->d_parent->d_inode->i_ino;
+                fid->i32.parent_ino = XFS_I(dentry->d_parent->d_inode)->i_ino;
                 fid->i32.parent_gen = dentry->d_parent->d_inode->i_generation;
                 spin_unlock(&dentry->d_lock);
                 /*FALLTHRU*/
         case FILEID_INO32_GEN:
-                fid->i32.ino = inode->i_ino;
+                fid->i32.ino = XFS_I(inode)->i_ino;
                 fid->i32.gen = inode->i_generation;
                 break;
         case FILEID_INO32_GEN_PARENT | XFS_FILEID_TYPE_64FLAG:
                 spin_lock(&dentry->d_lock);
-                fid64->parent_ino = dentry->d_parent->d_inode->i_ino;
+                fid64->parent_ino = XFS_I(dentry->d_parent->d_inode)->i_ino;
                 fid64->parent_gen = dentry->d_parent->d_inode->i_generation;
                 spin_unlock(&dentry->d_lock);
                 /*FALLTHRU*/
         case FILEID_INO32_GEN | XFS_FILEID_TYPE_64FLAG:
-                fid64->ino = inode->i_ino;
+                fid64->ino = XFS_I(inode)->i_ino;
                 fid64->gen = inode->i_generation;
                 break;
         }
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index 7f782af286b..b679198dcc0 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -309,7 +309,19 @@ xfs_file_aio_read(
         if (XFS_FORCED_SHUTDOWN(mp))
                 return -EIO;
 
-        if (unlikely(ioflags & IO_ISDIRECT)) {
+        /*
+         * Locking is a bit tricky here. If we take an exclusive lock
+         * for direct IO, we effectively serialise all new concurrent
+         * read IO to this file and block it behind IO that is currently in
+         * progress because IO in progress holds the IO lock shared. We only
+         * need to hold the lock exclusive to blow away the page cache, so
+         * only take lock exclusively if the page cache needs invalidation.
+         * This allows the normal direct IO case of no page cache pages to
+         * proceeed concurrently without serialisation.
+         */
+        xfs_rw_ilock(ip, XFS_IOLOCK_SHARED);
+        if ((ioflags & IO_ISDIRECT) && inode->i_mapping->nrpages) {
+                xfs_rw_iunlock(ip, XFS_IOLOCK_SHARED);
                 xfs_rw_ilock(ip, XFS_IOLOCK_EXCL);
 
                 if (inode->i_mapping->nrpages) {
@@ -322,8 +334,7 @@ xfs_file_aio_read(
                         }
                 }
                 xfs_rw_ilock_demote(ip, XFS_IOLOCK_EXCL);
-        } else
-                xfs_rw_ilock(ip, XFS_IOLOCK_SHARED);
+        }
 
         trace_xfs_file_read(ip, size, iocb->ki_pos, ioflags);
 
@@ -658,6 +669,7 @@ xfs_file_aio_write_checks(
         xfs_fsize_t             new_size;
         int                     error = 0;
 
+        xfs_rw_ilock(ip, XFS_ILOCK_EXCL);
         error = generic_write_checks(file, pos, count, S_ISBLK(inode->i_mode));
         if (error) {
                 xfs_rw_iunlock(ip, XFS_ILOCK_EXCL | *iolock);
@@ -749,14 +761,24 @@ xfs_file_dio_aio_write(
                 *iolock = XFS_IOLOCK_EXCL;
         else
                 *iolock = XFS_IOLOCK_SHARED;
-        xfs_rw_ilock(ip, XFS_ILOCK_EXCL | *iolock);
+        xfs_rw_ilock(ip, *iolock);
 
         ret = xfs_file_aio_write_checks(file, &pos, &count, iolock);
         if (ret)
                 return ret;
 
+        /*
+         * Recheck if there are cached pages that need invalidate after we got
+         * the iolock to protect against other threads adding new pages while
+         * we were waiting for the iolock.
+         */
+        if (mapping->nrpages && *iolock == XFS_IOLOCK_SHARED) {
+                xfs_rw_iunlock(ip, *iolock);
+                *iolock = XFS_IOLOCK_EXCL;
+                xfs_rw_ilock(ip, *iolock);
+        }
+
         if (mapping->nrpages) {
-                WARN_ON(*iolock != XFS_IOLOCK_EXCL);
                 ret = -xfs_flushinval_pages(ip, (pos & PAGE_CACHE_MASK), -1,
                                                         FI_REMAPF_LOCKED);
                 if (ret)
@@ -801,7 +823,7 @@ xfs_file_buffered_aio_write(
         size_t                  count = ocount;
 
         *iolock = XFS_IOLOCK_EXCL;
-        xfs_rw_ilock(ip, XFS_ILOCK_EXCL | *iolock);
+        xfs_rw_ilock(ip, *iolock);
 
         ret = xfs_file_aio_write_checks(file, &pos, &count, iolock);
         if (ret)
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index d44d92cd12b..f5b697bf39f 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -69,9 +69,8 @@ xfs_synchronize_times(
 }
 
 /*
- * If the linux inode is valid, mark it dirty.
- * Used when committing a dirty inode into a transaction so that
- * the inode will get written back by the linux code
+ * If the linux inode is valid, mark it dirty, else mark the dirty state
+ * in the XFS inode to make sure we pick it up when reclaiming the inode.
  */
 void
 xfs_mark_inode_dirty_sync(
@@ -81,6 +80,10 @@ xfs_mark_inode_dirty_sync(
 
         if (!(inode->i_state & (I_WILL_FREE|I_FREEING)))
                 mark_inode_dirty_sync(inode);
+        else {
+                barrier();
+                ip->i_update_core = 1;
+        }
 }
 
 void
@@ -91,6 +94,11 @@ xfs_mark_inode_dirty(
 
         if (!(inode->i_state & (I_WILL_FREE|I_FREEING)))
                 mark_inode_dirty(inode);
+        else {
+                barrier();
+                ip->i_update_core = 1;
+        }
+
 }
 
 /*
@@ -456,7 +464,7 @@ xfs_vn_getattr(
         trace_xfs_getattr(ip);
 
         if (XFS_FORCED_SHUTDOWN(mp))
-                return XFS_ERROR(EIO);
+                return -XFS_ERROR(EIO);
 
         stat->size = XFS_ISIZE(ip);
         stat->dev = inode->i_sb->s_dev;
diff --git a/fs/xfs/linux-2.6/xfs_linux.h b/fs/xfs/linux-2.6/xfs_linux.h
index 8633521b3b2..87315168538 100644
--- a/fs/xfs/linux-2.6/xfs_linux.h
+++ b/fs/xfs/linux-2.6/xfs_linux.h
@@ -70,6 +70,8 @@
 #include <linux/ctype.h>
 #include <linux/writeback.h>
 #include <linux/capability.h>
+#include <linux/kthread.h>
+#include <linux/freezer.h>
 #include <linux/list_sort.h>
 
 #include <asm/page.h>
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index a1a881e68a9..e6ac98c112e 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -871,43 +871,6 @@ xfs_fs_dirty_inode(
 }
 
 STATIC int
-xfs_log_inode(
-        struct xfs_inode        *ip)
-{
-        struct xfs_mount        *mp = ip->i_mount;
-        struct xfs_trans        *tp;
-        int                     error;
-
-        xfs_iunlock(ip, XFS_ILOCK_SHARED);
-        tp = xfs_trans_alloc(mp, XFS_TRANS_FSYNC_TS);
-        error = xfs_trans_reserve(tp, 0, XFS_FSYNC_TS_LOG_RES(mp), 0, 0, 0);
-
-        if (error) {
-                xfs_trans_cancel(tp, 0);
-                /* we need to return with the lock hold shared */
-                xfs_ilock(ip, XFS_ILOCK_SHARED);
-                return error;
-        }
-
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
-
-        /*
-         * Note - it's possible that we might have pushed ourselves out of the
-         * way during trans_reserve which would flush the inode.  But there's
-         * no guarantee that the inode buffer has actually gone out yet (it's
-         * delwri).  Plus the buffer could be pinned anyway if it's part of
-         * an inode in another recent transaction.  So we play it safe and
-         * fire off the transaction anyway.
-         */
-        xfs_trans_ijoin(tp, ip);
-        xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-        error = xfs_trans_commit(tp, 0);
-        xfs_ilock_demote(ip, XFS_ILOCK_EXCL);
-
-        return error;
-}
-
-STATIC int
 xfs_fs_write_inode(
         struct inode            *inode,
         struct writeback_control *wbc)
@@ -919,9 +882,9 @@ xfs_fs_write_inode(
         trace_xfs_write_inode(ip);
 
         if (XFS_FORCED_SHUTDOWN(mp))
-                return XFS_ERROR(EIO);
+                return -XFS_ERROR(EIO);
 
-        if (wbc->sync_mode == WB_SYNC_ALL) {
+        if (wbc->sync_mode == WB_SYNC_ALL || wbc->for_kupdate) {
                 /*
                  * Make sure the inode has made it it into the log.  Instead
                  * of forcing it all the way to stable storage using a
@@ -930,13 +893,14 @@ xfs_fs_write_inode(
                  * of synchronous log foces dramatically.
                  */
                 xfs_ioend_wait(ip);
-                xfs_ilock(ip, XFS_ILOCK_SHARED);
-                if (ip->i_update_core) {
-                        error = xfs_log_inode(ip);
-                        if (error)
-                                goto out_unlock;
-                }
+                error = xfs_log_dirty_inode(ip, NULL, 0);
+                if (error)
+                        goto out;
+                return 0;
         } else {
+                if (!ip->i_update_core)
+                        return 0;
+
                 /*
                  * We make this non-blocking if the inode is contended, return
                  * EAGAIN to indicate to the caller that they did not succeed.
@@ -1412,37 +1376,35 @@ xfs_fs_fill_super(
         sb->s_time_gran = 1;
         set_posix_acl_flag(sb);
 
-        error = xfs_syncd_init(mp);
-        if (error)
-                goto out_filestream_unmount;
-
         xfs_inode_shrinker_register(mp);
 
         error = xfs_mountfs(mp);
         if (error)
-                goto out_syncd_stop;
+                goto out_filestream_unmount;
+
+        error = xfs_syncd_init(mp);
+        if (error)
+                goto out_unmount;
 
         root = igrab(VFS_I(mp->m_rootip));
         if (!root) {
                 error = ENOENT;
-                goto fail_unmount;
+                goto out_syncd_stop;
         }
         if (is_bad_inode(root)) {
                 error = EINVAL;
-                goto fail_vnrele;
+                goto out_syncd_stop;
         }
         sb->s_root = d_alloc_root(root);
         if (!sb->s_root) {
                 error = ENOMEM;
-                goto fail_vnrele;
+                goto out_iput;
         }
 
         return 0;
 
- out_syncd_stop:
-        xfs_inode_shrinker_unregister(mp);
-        xfs_syncd_stop(mp);
  out_filestream_unmount:
+        xfs_inode_shrinker_unregister(mp);
         xfs_filestream_unmount(mp);
  out_free_sb:
         xfs_freesb(mp);
@@ -1456,17 +1418,12 @@ xfs_fs_fill_super(
  out:
         return -error;
 
- fail_vnrele:
-        if (sb->s_root) {
-                dput(sb->s_root);
-                sb->s_root = NULL;
-        } else {
-                iput(root);
-        }
-
- fail_unmount:
-        xfs_inode_shrinker_unregister(mp);
+ out_iput:
+        iput(root);
+ out_syncd_stop:
         xfs_syncd_stop(mp);
+ out_unmount:
+        xfs_inode_shrinker_unregister(mp);
 
         /*
          * Blow away any referenced inode in the filestreams cache.
@@ -1667,24 +1624,13 @@ xfs_init_workqueues(void)
          */
         xfs_syncd_wq = alloc_workqueue("xfssyncd", WQ_CPU_INTENSIVE, 8);
         if (!xfs_syncd_wq)
-                goto out;
-
-        xfs_ail_wq = alloc_workqueue("xfsail", WQ_CPU_INTENSIVE, 8);
-        if (!xfs_ail_wq)
-                goto out_destroy_syncd;
-
+                return -ENOMEM;
         return 0;
-
-out_destroy_syncd:
-        destroy_workqueue(xfs_syncd_wq);
-out:
-        return -ENOMEM;
 }
 
 STATIC void
 xfs_destroy_workqueues(void)
 {
-        destroy_workqueue(xfs_ail_wq);
         destroy_workqueue(xfs_syncd_wq);
 }
 
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 8ecad5ff9f9..2f277a04d67 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -336,6 +336,32 @@ xfs_sync_fsdata(
         return xfs_bwrite(mp, bp);
 }
 
+int
+xfs_log_dirty_inode(
+        struct xfs_inode        *ip,
+        struct xfs_perag        *pag,
+        int                     flags)
+{
+        struct xfs_mount        *mp = ip->i_mount;
+        struct xfs_trans        *tp;
+        int                     error;
+
+        if (!ip->i_update_core)
+                return 0;
+
+        tp = xfs_trans_alloc(mp, XFS_TRANS_FSYNC_TS);
+        error = xfs_trans_reserve(tp, 0, XFS_FSYNC_TS_LOG_RES(mp), 0, 0, 0);
+        if (error) {
+                xfs_trans_cancel(tp, 0);
+                return error;
+        }
+
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        xfs_trans_ijoin_ref(tp, ip, XFS_ILOCK_EXCL);
+        xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+        return xfs_trans_commit(tp, 0);
+}
+
 /*
  * When remounting a filesystem read-only or freezing the filesystem, we have
  * two phases to execute. This first phase is syncing the data before we
@@ -365,6 +391,17 @@ xfs_quiesce_data(
 
         /* push and block till complete */
         xfs_sync_data(mp, SYNC_WAIT);
+
+        /*
+         * Log all pending size and timestamp updates.  The vfs writeback
+         * code is supposed to do this, but due to its overagressive
+         * livelock detection it will skip inodes where appending writes
+         * were written out in the first non-blocking sync phase if their
+         * completion took long enough that it happened after taking the
+         * timestamp for the cut-off in the blocking phase.
+         */
+        xfs_inode_ag_iterator(mp, xfs_log_dirty_inode, 0);
+
         xfs_qm_sync(mp, SYNC_WAIT);
 
         /* write superblock and hoover up shutdown errors */
@@ -772,6 +809,17 @@ restart:
         if (!xfs_iflock_nowait(ip)) {
                 if (!(sync_mode & SYNC_WAIT))
                         goto out;
+
+                /*
+                 * If we only have a single dirty inode in a cluster there is
+                 * a fair chance that the AIL push may have pushed it into
+                 * the buffer, but xfsbufd won't touch it until 30 seconds
+                 * from now, and thus we will lock up here.
+                 *
+                 * Promote the inode buffer to the front of the delwri list
+                 * and wake up xfsbufd now.
+                 */
+                xfs_promote_inode(ip);
                 xfs_iflock(ip);
         }
 
diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h
index e3a6ad27415..ef5b2ce4298 100644
--- a/fs/xfs/linux-2.6/xfs_sync.h
+++ b/fs/xfs/linux-2.6/xfs_sync.h
@@ -42,6 +42,8 @@ void xfs_quiesce_attr(struct xfs_mount *mp);
 
 void xfs_flush_inodes(struct xfs_inode *ip);
 
+int xfs_log_dirty_inode(struct xfs_inode *ip, struct xfs_perag *pag, int flags);
+
 int xfs_reclaim_inodes(struct xfs_mount *mp, int mode);
 
 void xfs_inode_set_reclaim_tag(struct xfs_inode *ip);
diff --git a/fs/xfs/quota/xfs_dquot_item.c b/fs/xfs/quota/xfs_dquot_item.c
index 9e0e2fa3f2c..8126fc2ea63 100644
--- a/fs/xfs/quota/xfs_dquot_item.c
+++ b/fs/xfs/quota/xfs_dquot_item.c
@@ -183,13 +183,14 @@ xfs_qm_dqunpin_wait(
  * search the buffer cache can be a time consuming thing, and AIL lock is a
  * spinlock.
  */
-STATIC void
+STATIC bool
 xfs_qm_dquot_logitem_pushbuf(
         struct xfs_log_item     *lip)
 {
         struct xfs_dq_logitem   *qlip = DQUOT_ITEM(lip);
         struct xfs_dquot        *dqp = qlip->qli_dquot;
         struct xfs_buf          *bp;
+        bool                    ret = true;
 
         ASSERT(XFS_DQ_IS_LOCKED(dqp));
 
@@ -201,17 +202,20 @@ xfs_qm_dquot_logitem_pushbuf(
         if (completion_done(&dqp->q_flush) ||
             !(lip->li_flags & XFS_LI_IN_AIL)) {
                 xfs_dqunlock(dqp);
-                return;
+                return true;
         }
 
         bp = xfs_incore(dqp->q_mount->m_ddev_targp, qlip->qli_format.qlf_blkno,
                         dqp->q_mount->m_quotainfo->qi_dqchunklen, XBF_TRYLOCK);
         xfs_dqunlock(dqp);
         if (!bp)
-                return;
+                return true;
         if (XFS_BUF_ISDELAYWRITE(bp))
                 xfs_buf_delwri_promote(bp);
+        if (XFS_BUF_ISPINNED(bp))
+                ret = false;
         xfs_buf_relse(bp);
+        return ret;
 }
 
 /*
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index b94dace4e78..e70c7fc95e2 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -714,7 +714,8 @@ xfs_qm_dqattach_one(
          * disk and we didn't ask it to allocate;
          * ESRCH if quotas got turned off suddenly.
          */
-        error = xfs_qm_dqget(ip->i_mount, ip, id, type, XFS_QMOPT_DOWARN, &dqp);
+        error = xfs_qm_dqget(ip->i_mount, ip, id, type,
+                             doalloc | XFS_QMOPT_DOWARN, &dqp);
         if (error)
                 return error;
 
diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c
index 01d2072fb6d..99d4011602e 100644
--- a/fs/xfs/xfs_attr.c
+++ b/fs/xfs/xfs_attr.c
@@ -822,17 +822,9 @@ xfs_attr_inactive(xfs_inode_t *dp)
         error = xfs_attr_root_inactive(&trans, dp);
         if (error)
                 goto out;
-        /*
-         * signal synchronous inactive transactions unless this
-         * is a synchronous mount filesystem in which case we
-         * know that we're here because we've been called out of
-         * xfs_inactive which means that the last reference is gone
-         * and the unlink transaction has already hit the disk so
-         * async inactive transactions are safe.
-         */
-        if ((error = xfs_itruncate_finish(&trans, dp, 0LL, XFS_ATTR_FORK,
-                                (!(mp->m_flags & XFS_MOUNT_WSYNC)
-                                 ? 1 : 0))))
+
+        error = xfs_itruncate_finish(&trans, dp, 0LL, XFS_ATTR_FORK, 0);
+        if (error)
                 goto out;
 
         /*
diff --git a/fs/xfs/xfs_attr_leaf.c b/fs/xfs/xfs_attr_leaf.c
index 71e90dc2aeb..f49ecf2e7d3 100644
--- a/fs/xfs/xfs_attr_leaf.c
+++ b/fs/xfs/xfs_attr_leaf.c
@@ -110,6 +110,7 @@ xfs_attr_namesp_match(int arg_flags, int ondisk_flags)
 /*
  * Query whether the requested number of additional bytes of extended
  * attribute space will be able to fit inline.
+ *
  * Returns zero if not, else the di_forkoff fork offset to be used in the
  * literal area for attribute data once the new bytes have been added.
  *
@@ -122,7 +123,7 @@ xfs_attr_shortform_bytesfit(xfs_inode_t *dp, int bytes)
         int offset;
         int minforkoff; /* lower limit on valid forkoff locations */
         int maxforkoff; /* upper limit on valid forkoff locations */
-        int dsize;      
+        int dsize;
         xfs_mount_t *mp = dp->i_mount;
 
         offset = (XFS_LITINO(mp) - bytes) >> 3; /* rounded down */
@@ -136,47 +137,60 @@ xfs_attr_shortform_bytesfit(xfs_inode_t *dp, int bytes)
                 return (offset >= minforkoff) ? minforkoff : 0;
         }
 
-        if (!(mp->m_flags & XFS_MOUNT_ATTR2)) {
-                if (bytes <= XFS_IFORK_ASIZE(dp))
-                        return dp->i_d.di_forkoff;
+        /*
+         * If the requested numbers of bytes is smaller or equal to the
+         * current attribute fork size we can always proceed.
+         *
+         * Note that if_bytes in the data fork might actually be larger than
+         * the current data fork size is due to delalloc extents. In that
+         * case either the extent count will go down when they are converted
+         * to real extents, or the delalloc conversion will take care of the
+         * literal area rebalancing.
+         */
+        if (bytes <= XFS_IFORK_ASIZE(dp))
+                return dp->i_d.di_forkoff;
+
+        /*
+         * For attr2 we can try to move the forkoff if there is space in the
+         * literal area, but for the old format we are done if there is no
+         * space in the fixed attribute fork.
+         */
+        if (!(mp->m_flags & XFS_MOUNT_ATTR2))
                 return 0;
-        }
 
         dsize = dp->i_df.if_bytes;
-        
+
         switch (dp->i_d.di_format) {
         case XFS_DINODE_FMT_EXTENTS:
-                /* 
+                /*
                  * If there is no attr fork and the data fork is extents, 
-                 * determine if creating the default attr fork will result 
-                 * in the extents form migrating to btree. If so, the 
-                 * minimum offset only needs to be the space required for 
+                 * determine if creating the default attr fork will result
+                 * in the extents form migrating to btree. If so, the
+                 * minimum offset only needs to be the space required for
                  * the btree root.
-                 */ 
+                 */
                 if (!dp->i_d.di_forkoff && dp->i_df.if_bytes >
                     xfs_default_attroffset(dp))
                         dsize = XFS_BMDR_SPACE_CALC(MINDBTPTRS);
                 break;
-                
         case XFS_DINODE_FMT_BTREE:
                 /*
-                 * If have data btree then keep forkoff if we have one,
-                 * otherwise we are adding a new attr, so then we set 
-                 * minforkoff to where the btree root can finish so we have 
+                 * If we have a data btree then keep forkoff if we have one,
+                 * otherwise we are adding a new attr, so then we set
+                 * minforkoff to where the btree root can finish so we have
                  * plenty of room for attrs
                  */
                 if (dp->i_d.di_forkoff) {
-                        if (offset < dp->i_d.di_forkoff) 
+                        if (offset < dp->i_d.di_forkoff)
                                 return 0;
-                        else 
-                                return dp->i_d.di_forkoff;
-                } else
-                        dsize = XFS_BMAP_BROOT_SPACE(dp->i_df.if_broot);
+                        return dp->i_d.di_forkoff;
+                }
+                dsize = XFS_BMAP_BROOT_SPACE(dp->i_df.if_broot);
                 break;
         }
-        
-        /* 
-         * A data fork btree root must have space for at least 
+
+        /*
+         * A data fork btree root must have space for at least
          * MINDBTPTRS key/ptr pairs if the data fork is small or empty.
          */
         minforkoff = MAX(dsize, XFS_BMDR_SPACE_CALC(MINDBTPTRS));
@@ -186,10 +200,10 @@ xfs_attr_shortform_bytesfit(xfs_inode_t *dp, int bytes)
         maxforkoff = XFS_LITINO(mp) - XFS_BMDR_SPACE_CALC(MINABTPTRS);
         maxforkoff = maxforkoff >> 3;   /* rounded down */
 
-        if (offset >= minforkoff && offset < maxforkoff)
-                return offset;
         if (offset >= maxforkoff)
                 return maxforkoff;
+        if (offset >= minforkoff)
+                return offset;
         return 0;
 }
 
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index e546a33214c..a175933a7f4 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -3785,19 +3785,11 @@ xfs_bmap_compute_maxlevels(
  * Routine to be called at transaction's end by xfs_bmapi, xfs_bunmapi
  * caller.  Frees all the extents that need freeing, which must be done
  * last due to locking considerations.  We never free any extents in
- * the first transaction.  This is to allow the caller to make the first
- * transaction a synchronous one so that the pointers to the data being
- * broken in this transaction will be permanent before the data is actually
- * freed.  This is necessary to prevent blocks from being reallocated
- * and written to before the free and reallocation are actually permanent.
- * We do not just make the first transaction synchronous here, because
- * there are more efficient ways to gain the same protection in some cases
- * (see the file truncation code).
+ * the first transaction.
  *
  * Return 1 if the given transaction was committed and a new one
  * started, and 0 otherwise in the committed parameter.
  */
-/*ARGSUSED*/
 int                                             /* error */
 xfs_bmap_finish(
         xfs_trans_t             **tp,           /* transaction pointer addr */
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 7b7e005e3dc..7888a756307 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -632,7 +632,7 @@ xfs_buf_item_push(
  * the xfsbufd to get this buffer written. We have to unlock the buffer
  * to allow the xfsbufd to write it, too.
  */
-STATIC void
+STATIC bool
 xfs_buf_item_pushbuf(
         struct xfs_log_item     *lip)
 {
@@ -646,6 +646,7 @@ xfs_buf_item_pushbuf(
 
         xfs_buf_delwri_promote(bp);
         xfs_buf_relse(bp);
+        return true;
 }
 
 STATIC void
@@ -1022,7 +1023,6 @@ xfs_buf_iodone_callbacks(
         XFS_BUF_UNDELAYWRITE(bp);
 
         trace_xfs_buf_error_relse(bp, _RET_IP_);
-        xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
 
 do_callbacks:
         xfs_buf_do_callbacks(bp);
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index 3631783b2b5..ca752f05c31 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -356,9 +356,20 @@ xfs_iget_cache_miss(
                         BUG();
         }
 
-        spin_lock(&pag->pag_ici_lock);
+        /*
+         * These values must be set before inserting the inode into the radix
+         * tree as the moment it is inserted a concurrent lookup (allowed by the
+         * RCU locking mechanism) can find it and that lookup must see that this
+         * is an inode currently under construction (i.e. that XFS_INEW is set).
+         * The ip->i_flags_lock that protects the XFS_INEW flag forms the
+         * memory barrier that ensures this detection works correctly at lookup
+         * time.
+         */
+        ip->i_udquot = ip->i_gdquot = NULL;
+        xfs_iflags_set(ip, XFS_INEW);
 
         /* insert the new inode */
+        spin_lock(&pag->pag_ici_lock);
         error = radix_tree_insert(&pag->pag_ici_root, agino, ip);
         if (unlikely(error)) {
                 WARN_ON(error != -EEXIST);
@@ -366,11 +377,6 @@ xfs_iget_cache_miss(
                 error = EAGAIN;
                 goto out_preload_end;
         }
-
-        /* These values _must_ be set before releasing the radix tree lock! */
-        ip->i_udquot = ip->i_gdquot = NULL;
-        xfs_iflags_set(ip, XFS_INEW);
-
         spin_unlock(&pag->pag_ici_lock);
         radix_tree_preload_end();
 
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index a098a20ca63..5715279975c 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1528,15 +1528,7 @@ xfs_itruncate_finish(
                                 xfs_trans_log_inode(ntp, ip, XFS_ILOG_CORE);
                         }
                 }
-        } else if (sync) {
-                ASSERT(!(mp->m_flags & XFS_MOUNT_WSYNC));
-                if (ip->i_d.di_anextents > 0)
-                        xfs_trans_set_sync(ntp);
         }
-        ASSERT(fork == XFS_DATA_FORK ||
-                (fork == XFS_ATTR_FORK &&
-                        ((sync && !(mp->m_flags & XFS_MOUNT_WSYNC)) ||
-                         (sync == 0 && (mp->m_flags & XFS_MOUNT_WSYNC)))));
 
         /*
          * Since it is possible for space to become allocated beyond
@@ -3099,6 +3091,27 @@ corrupt_out:
         return XFS_ERROR(EFSCORRUPTED);
 }
 
+void
+xfs_promote_inode(
+        struct xfs_inode        *ip)
+{
+        struct xfs_buf          *bp;
+
+        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_ILOCK_SHARED));
+
+        bp = xfs_incore(ip->i_mount->m_ddev_targp, ip->i_imap.im_blkno,
+                        ip->i_imap.im_len, XBF_TRYLOCK);
+        if (!bp)
+                return;
+
+        if (XFS_BUF_ISDELAYWRITE(bp)) {
+                xfs_buf_delwri_promote(bp);
+                wake_up_process(ip->i_mount->m_ddev_targp->bt_task);
+        }
+
+        xfs_buf_relse(bp);
+}
+
 /*
  * Return a pointer to the extent record at file index idx.
  */
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 964cfea7768..28b3596453e 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -509,6 +509,7 @@ int		xfs_iunlink(struct xfs_trans *, xfs_inode_t *);
 void            xfs_iext_realloc(xfs_inode_t *, int, int);
 void            xfs_iunpin_wait(xfs_inode_t *);
 int             xfs_iflush(xfs_inode_t *, uint);
+void            xfs_promote_inode(struct xfs_inode *);
 void            xfs_lock_inodes(xfs_inode_t **, int, uint);
 void            xfs_lock_two_inodes(xfs_inode_t *, xfs_inode_t *, uint);
 
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index b1e88d56069..391044c62d5 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -713,13 +713,14 @@ xfs_inode_item_committed(
  * marked delayed write. If that's the case, we'll promote it and that will
  * allow the caller to write the buffer by triggering the xfsbufd to run.
  */
-STATIC void
+STATIC bool
 xfs_inode_item_pushbuf(
         struct xfs_log_item     *lip)
 {
         struct xfs_inode_log_item *iip = INODE_ITEM(lip);
         struct xfs_inode        *ip = iip->ili_inode;
         struct xfs_buf          *bp;
+        bool                    ret = true;
 
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_SHARED));
 
@@ -730,7 +731,7 @@ xfs_inode_item_pushbuf(
         if (completion_done(&ip->i_flush) ||
             !(lip->li_flags & XFS_LI_IN_AIL)) {
                 xfs_iunlock(ip, XFS_ILOCK_SHARED);
-                return;
+                return true;
         }
 
         bp = xfs_incore(ip->i_mount->m_ddev_targp, iip->ili_format.ilf_blkno,
@@ -738,10 +739,13 @@ xfs_inode_item_pushbuf(
 
         xfs_iunlock(ip, XFS_ILOCK_SHARED);
         if (!bp)
-                return;
+                return true;
         if (XFS_BUF_ISDELAYWRITE(bp))
                 xfs_buf_delwri_promote(bp);
+        if (XFS_BUF_ISPINNED(bp))
+                ret = false;
         xfs_buf_relse(bp);
+        return ret;
 }
 
 /*
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 04142caedb2..b75fd67ca37 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -3159,37 +3159,26 @@ xlog_recover_process_iunlinks(
                          */
                         continue;
                 }
+                /*
+                 * Unlock the buffer so that it can be acquired in the normal
+                 * course of the transaction to truncate and free each inode.
+                 * Because we are not racing with anyone else here for the AGI
+                 * buffer, we don't even need to hold it locked to read the
+                 * initial unlinked bucket entries out of the buffer. We keep
+                 * buffer reference though, so that it stays pinned in memory
+                 * while we need the buffer.
+                 */
                 agi = XFS_BUF_TO_AGI(agibp);
+                xfs_buf_unlock(agibp);
 
                 for (bucket = 0; bucket < XFS_AGI_UNLINKED_BUCKETS; bucket++) {
                         agino = be32_to_cpu(agi->agi_unlinked[bucket]);
                         while (agino != NULLAGINO) {
-                                /*
-                                 * Release the agi buffer so that it can
-                                 * be acquired in the normal course of the
-                                 * transaction to truncate and free the inode.
-                                 */
-                                xfs_buf_relse(agibp);
-
                                 agino = xlog_recover_process_one_iunlink(mp,
                                                         agno, agino, bucket);
-
-                                /*
-                                 * Reacquire the agibuffer and continue around
-                                 * the loop. This should never fail as we know
-                                 * the buffer was good earlier on.
-                                 */
-                                error = xfs_read_agi(mp, NULL, agno, &agibp);
-                                ASSERT(error == 0);
-                                agi = XFS_BUF_TO_AGI(agibp);
                         }
                 }
-
-                /*
-                 * Release the buffer for the current agi so we can
-                 * go on to the next one.
-                 */
-                xfs_buf_relse(agibp);
+                xfs_buf_rele(agibp);
         }
 
         mp->m_dmevmask = mp_dmevmask;
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index b49b82363d2..9afdd497369 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -44,9 +44,6 @@
 #include "xfs_trace.h"
 
 
-STATIC void     xfs_unmountfs_wait(xfs_mount_t *);
-
-
 #ifdef HAVE_PERCPU_SB
 STATIC void     xfs_icsb_balance_counter(xfs_mount_t *, xfs_sb_field_t,
                                                 int);
@@ -1507,11 +1504,6 @@ xfs_unmountfs(
          */
         xfs_log_force(mp, XFS_LOG_SYNC);
 
-        xfs_binval(mp->m_ddev_targp);
-        if (mp->m_rtdev_targp) {
-                xfs_binval(mp->m_rtdev_targp);
-        }
-
         /*
          * Unreserve any blocks we have so that when we unmount we don't account
          * the reserved free space as used. This is really only necessary for
@@ -1537,7 +1529,16 @@ xfs_unmountfs(
                 xfs_warn(mp, "Unable to update superblock counters. "
                                 "Freespace may not be correct on next mount.");
         xfs_unmountfs_writesb(mp);
-        xfs_unmountfs_wait(mp);                 /* wait for async bufs */
+
+        /*
+         * Make sure all buffers have been flushed and completed before
+         * unmounting the log.
+         */
+        error = xfs_flush_buftarg(mp->m_ddev_targp, 1);
+        if (error)
+                xfs_warn(mp, "%d busy buffers during unmount.", error);
+        xfs_wait_buftarg(mp->m_ddev_targp);
+
         xfs_log_unmount_write(mp);
         xfs_log_unmount(mp);
         xfs_uuid_unmount(mp);
@@ -1548,16 +1549,6 @@ xfs_unmountfs(
         xfs_free_perag(mp);
 }
 
-STATIC void
-xfs_unmountfs_wait(xfs_mount_t *mp)
-{
-        if (mp->m_logdev_targp != mp->m_ddev_targp)
-                xfs_wait_buftarg(mp->m_logdev_targp);
-        if (mp->m_rtdev_targp)
-                xfs_wait_buftarg(mp->m_rtdev_targp);
-        xfs_wait_buftarg(mp->m_ddev_targp);
-}
-
 int
 xfs_fs_writable(xfs_mount_t *mp)
 {
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index c83f63b33aa..efc147f0e9b 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -1426,6 +1426,7 @@ xfs_trans_committed(
 static inline void
 xfs_log_item_batch_insert(
         struct xfs_ail          *ailp,
+        struct xfs_ail_cursor   *cur,
         struct xfs_log_item     **log_items,
         int                     nr_items,
         xfs_lsn_t               commit_lsn)
@@ -1434,7 +1435,7 @@ xfs_log_item_batch_insert(
 
         spin_lock(&ailp->xa_lock);
         /* xfs_trans_ail_update_bulk drops ailp->xa_lock */
-        xfs_trans_ail_update_bulk(ailp, log_items, nr_items, commit_lsn);
+        xfs_trans_ail_update_bulk(ailp, cur, log_items, nr_items, commit_lsn);
 
         for (i = 0; i < nr_items; i++)
                 IOP_UNPIN(log_items[i], 0);
@@ -1452,6 +1453,13 @@ xfs_log_item_batch_insert(
  * as an iclog write error even though we haven't started any IO yet. Hence in
  * this case all we need to do is IOP_COMMITTED processing, followed by an
  * IOP_UNPIN(aborted) call.
+ *
+ * The AIL cursor is used to optimise the insert process. If commit_lsn is not
+ * at the end of the AIL, the insert cursor avoids the need to walk
+ * the AIL to find the insertion point on every xfs_log_item_batch_insert()
+ * call. This saves a lot of needless list walking and is a net win, even
+ * though it slightly increases that amount of AIL lock traffic to set it up
+ * and tear it down.
  */
 void
 xfs_trans_committed_bulk(
@@ -1463,8 +1471,13 @@ xfs_trans_committed_bulk(
 #define LOG_ITEM_BATCH_SIZE     32
         struct xfs_log_item     *log_items[LOG_ITEM_BATCH_SIZE];
         struct xfs_log_vec      *lv;
+        struct xfs_ail_cursor   cur;
         int                     i = 0;
 
+        spin_lock(&ailp->xa_lock);
+        xfs_trans_ail_cursor_last(ailp, &cur, commit_lsn);
+        spin_unlock(&ailp->xa_lock);
+
         /* unpin all the log items */
         for (lv = log_vector; lv; lv = lv->lv_next ) {
                 struct xfs_log_item     *lip = lv->lv_item;
@@ -1493,7 +1506,9 @@ xfs_trans_committed_bulk(
                         /*
                          * Not a bulk update option due to unusual item_lsn.
                          * Push into AIL immediately, rechecking the lsn once
-                         * we have the ail lock. Then unpin the item.
+                         * we have the ail lock. Then unpin the item. This does
+                         * not affect the AIL cursor the bulk insert path is
+                         * using.
                          */
                         spin_lock(&ailp->xa_lock);
                         if (XFS_LSN_CMP(item_lsn, lip->li_lsn) > 0)
@@ -1507,7 +1522,7 @@ xfs_trans_committed_bulk(
                 /* Item is a candidate for bulk AIL insert.  */
                 log_items[i++] = lv->lv_item;
                 if (i >= LOG_ITEM_BATCH_SIZE) {
-                        xfs_log_item_batch_insert(ailp, log_items,
+                        xfs_log_item_batch_insert(ailp, &cur, log_items,
                                         LOG_ITEM_BATCH_SIZE, commit_lsn);
                         i = 0;
                 }
@@ -1515,7 +1530,11 @@ xfs_trans_committed_bulk(
 
         /* make sure we insert the remainder! */
         if (i)
-                xfs_log_item_batch_insert(ailp, log_items, i, commit_lsn);
+                xfs_log_item_batch_insert(ailp, &cur, log_items, i, commit_lsn);
+
+        spin_lock(&ailp->xa_lock);
+        xfs_trans_ail_cursor_done(ailp, &cur);
+        spin_unlock(&ailp->xa_lock);
 }
 
 /*
diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h
index 06a9759b635..53597f4db9b 100644
--- a/fs/xfs/xfs_trans.h
+++ b/fs/xfs/xfs_trans.h
@@ -350,7 +350,7 @@ typedef struct xfs_item_ops {
         void (*iop_unlock)(xfs_log_item_t *);
         xfs_lsn_t (*iop_committed)(xfs_log_item_t *, xfs_lsn_t);
         void (*iop_push)(xfs_log_item_t *);
-        void (*iop_pushbuf)(xfs_log_item_t *);
+        bool (*iop_pushbuf)(xfs_log_item_t *);
         void (*iop_committing)(xfs_log_item_t *, xfs_lsn_t);
 } xfs_item_ops_t;
 
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index 5fc2380092c..a4c281bf7a9 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -28,8 +28,6 @@
 #include "xfs_trans_priv.h"
 #include "xfs_error.h"
 
-struct workqueue_struct *xfs_ail_wq;    /* AIL workqueue */
-
 #ifdef DEBUG
 /*
  * Check that the list is sorted as it should be.
@@ -272,9 +270,9 @@ xfs_trans_ail_cursor_clear(
 }
 
 /*
- * Return the item in the AIL with the current lsn.
- * Return the current tree generation number for use
- * in calls to xfs_trans_next_ail().
+ * Initialise the cursor to the first item in the AIL with the given @lsn.
+ * This searches the list from lowest LSN to highest. Pass a @lsn of zero
+ * to initialise the cursor to the first item in the AIL.
  */
 xfs_log_item_t *
 xfs_trans_ail_cursor_first(
@@ -300,31 +298,97 @@ out:
 }
 
 /*
- * splice the log item list into the AIL at the given LSN.
+ * Initialise the cursor to the last item in the AIL with the given @lsn.
+ * This searches the list from highest LSN to lowest. If there is no item with
+ * the value of @lsn, then it sets the cursor to the last item with an LSN lower
+ * than @lsn.
+ */
+static struct xfs_log_item *
+__xfs_trans_ail_cursor_last(
+        struct xfs_ail          *ailp,
+        xfs_lsn_t               lsn)
+{
+        xfs_log_item_t          *lip;
+
+        list_for_each_entry_reverse(lip, &ailp->xa_ail, li_ail) {
+                if (XFS_LSN_CMP(lip->li_lsn, lsn) <= 0)
+                        return lip;
+        }
+        return NULL;
+}
+
+/*
+ * Initialise the cursor to the last item in the AIL with the given @lsn.
+ * This searches the list from highest LSN to lowest.
+ */
+struct xfs_log_item *
+xfs_trans_ail_cursor_last(
+        struct xfs_ail          *ailp,
+        struct xfs_ail_cursor   *cur,
+        xfs_lsn_t               lsn)
+{
+        xfs_trans_ail_cursor_init(ailp, cur);
+        cur->item = __xfs_trans_ail_cursor_last(ailp, lsn);
+        return cur->item;
+}
+
+/*
+ * splice the log item list into the AIL at the given LSN. We splice to the
+ * tail of the given LSN to maintain insert order for push traversals. The
+ * cursor is optional, allowing repeated updates to the same LSN to avoid
+ * repeated traversals.
  */
 static void
 xfs_ail_splice(
-        struct xfs_ail  *ailp,
-        struct list_head *list,
-        xfs_lsn_t       lsn)
+        struct xfs_ail          *ailp,
+        struct xfs_ail_cursor   *cur,
+        struct list_head        *list,
+        xfs_lsn_t               lsn)
 {
-        xfs_log_item_t  *next_lip;
+        struct xfs_log_item     *lip = cur ? cur->item : NULL;
+        struct xfs_log_item     *next_lip;
 
-        /* If the list is empty, just insert the item.  */
-        if (list_empty(&ailp->xa_ail)) {
-                list_splice(list, &ailp->xa_ail);
-                return;
+        /*
+         * Get a new cursor if we don't have a placeholder or the existing one
+         * has been invalidated.
+         */
+        if (!lip || (__psint_t)lip & 1) {
+                lip = __xfs_trans_ail_cursor_last(ailp, lsn);
+
+                if (!lip) {
+                        /* The list is empty, so just splice and return.  */
+                        if (cur)
+                                cur->item = NULL;
+                        list_splice(list, &ailp->xa_ail);
+                        return;
+                }
         }
 
-        list_for_each_entry_reverse(next_lip, &ailp->xa_ail, li_ail) {
-                if (XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0)
-                        break;
+        /*
+         * Our cursor points to the item we want to insert _after_, so we have
+         * to update the cursor to point to the end of the list we are splicing
+         * in so that it points to the correct location for the next splice.
+         * i.e. before the splice
+         *
+         *  lsn -> lsn -> lsn + x -> lsn + x ...
+         *          ^
+         *          | cursor points here
+         *
+         * After the splice we have:
+         *
+         *  lsn -> lsn -> lsn -> lsn -> .... -> lsn -> lsn + x -> lsn + x ...
+         *          ^                            ^
+         *          | cursor points here         | needs to move here
+         *
+         * So we set the cursor to the last item in the list to be spliced
+         * before we execute the splice, resulting in the cursor pointing to
+         * the correct item after the splice occurs.
+         */
+        if (cur) {
+                next_lip = list_entry(list->prev, struct xfs_log_item, li_ail);
+                cur->item = next_lip;
         }
-
-        ASSERT(&next_lip->li_ail == &ailp->xa_ail ||
-               XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0);
-
-        list_splice_init(list, &next_lip->li_ail);
+        list_splice(list, &lip->li_ail);
 }
 
 /*
@@ -340,16 +404,10 @@ xfs_ail_delete(
         xfs_trans_ail_cursor_clear(ailp, lip);
 }
 
-/*
- * xfs_ail_worker does the work of pushing on the AIL. It will requeue itself
- * to run at a later time if there is more work to do to complete the push.
- */
-STATIC void
-xfs_ail_worker(
-        struct work_struct      *work)
+static long
+xfsaild_push(
+        struct xfs_ail          *ailp)
 {
-        struct xfs_ail          *ailp = container_of(to_delayed_work(work),
-                                        struct xfs_ail, xa_work);
         xfs_mount_t             *mp = ailp->xa_mount;
         struct xfs_ail_cursor   *cur = &ailp->xa_cursors;
         xfs_log_item_t          *lip;
@@ -412,8 +470,13 @@ xfs_ail_worker(
 
                 case XFS_ITEM_PUSHBUF:
                         XFS_STATS_INC(xs_push_ail_pushbuf);
-                        IOP_PUSHBUF(lip);
-                        ailp->xa_last_pushed_lsn = lsn;
+
+                        if (!IOP_PUSHBUF(lip)) {
+                                stuck++;
+                                flush_log = 1;
+                        } else {
+                                ailp->xa_last_pushed_lsn = lsn;
+                        }
                         push_xfsbufd = 1;
                         break;
 
@@ -425,7 +488,6 @@ xfs_ail_worker(
 
                 case XFS_ITEM_LOCKED:
                         XFS_STATS_INC(xs_push_ail_locked);
-                        ailp->xa_last_pushed_lsn = lsn;
                         stuck++;
                         break;
 
@@ -486,20 +548,6 @@ out_done:
                 /* We're past our target or empty, so idle */
                 ailp->xa_last_pushed_lsn = 0;
 
-                /*
-                 * We clear the XFS_AIL_PUSHING_BIT first before checking
-                 * whether the target has changed. If the target has changed,
-                 * this pushes the requeue race directly onto the result of the
-                 * atomic test/set bit, so we are guaranteed that either the
-                 * the pusher that changed the target or ourselves will requeue
-                 * the work (but not both).
-                 */
-                clear_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags);
-                smp_rmb();
-                if (XFS_LSN_CMP(ailp->xa_target, target) == 0 ||
-                    test_and_set_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags))
-                        return;
-
                 tout = 50;
         } else if (XFS_LSN_CMP(lsn, target) >= 0) {
                 /*
@@ -522,9 +570,30 @@ out_done:
                 tout = 20;
         }
 
-        /* There is more to do, requeue us.  */
-        queue_delayed_work(xfs_syncd_wq, &ailp->xa_work,
-                                        msecs_to_jiffies(tout));
+        return tout;
+}
+
+static int
+xfsaild(
+        void            *data)
+{
+        struct xfs_ail  *ailp = data;
+        long            tout = 0;       /* milliseconds */
+
+        while (!kthread_should_stop()) {
+                if (tout && tout <= 20)
+                        __set_current_state(TASK_KILLABLE);
+                else
+                        __set_current_state(TASK_INTERRUPTIBLE);
+                schedule_timeout(tout ?
+                                 msecs_to_jiffies(tout) : MAX_SCHEDULE_TIMEOUT);
+
+                try_to_freeze();
+
+                tout = xfsaild_push(ailp);
+        }
+
+        return 0;
 }
 
 /*
@@ -559,8 +628,9 @@ xfs_ail_push(
          */
         smp_wmb();
         xfs_trans_ail_copy_lsn(ailp, &ailp->xa_target, &threshold_lsn);
-        if (!test_and_set_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags))
-                queue_delayed_work(xfs_syncd_wq, &ailp->xa_work, 0);
+        smp_wmb();
+
+        wake_up_process(ailp->xa_task);
 }
 
 /*
@@ -645,6 +715,7 @@ xfs_trans_unlocked_item(
 void
 xfs_trans_ail_update_bulk(
         struct xfs_ail          *ailp,
+        struct xfs_ail_cursor   *cur,
         struct xfs_log_item     **log_items,
         int                     nr_items,
         xfs_lsn_t               lsn) __releases(ailp->xa_lock)
@@ -674,7 +745,7 @@ xfs_trans_ail_update_bulk(
                 list_add(&lip->li_ail, &tmp);
         }
 
-        xfs_ail_splice(ailp, &tmp, lsn);
+        xfs_ail_splice(ailp, cur, &tmp, lsn);
 
         if (!mlip_changed) {
                 spin_unlock(&ailp->xa_lock);
@@ -794,9 +865,18 @@ xfs_trans_ail_init(
         ailp->xa_mount = mp;
         INIT_LIST_HEAD(&ailp->xa_ail);
         spin_lock_init(&ailp->xa_lock);
-        INIT_DELAYED_WORK(&ailp->xa_work, xfs_ail_worker);
+
+        ailp->xa_task = kthread_run(xfsaild, ailp, "xfsaild/%s",
+                        ailp->xa_mount->m_fsname);
+        if (IS_ERR(ailp->xa_task))
+                goto out_free_ailp;
+
         mp->m_ail = ailp;
         return 0;
+
+out_free_ailp:
+        kmem_free(ailp);
+        return ENOMEM;
 }
 
 void
@@ -805,6 +885,6 @@ xfs_trans_ail_destroy(
 {
         struct xfs_ail  *ailp = mp->m_ail;
 
-        cancel_delayed_work_sync(&ailp->xa_work);
+        kthread_stop(ailp->xa_task);
         kmem_free(ailp);
 }
diff --git a/fs/xfs/xfs_trans_priv.h b/fs/xfs/xfs_trans_priv.h
index 6b164e9e9a1..fe2e3cbc2f9 100644
--- a/fs/xfs/xfs_trans_priv.h
+++ b/fs/xfs/xfs_trans_priv.h
@@ -64,24 +64,19 @@ struct xfs_ail_cursor {
  */
 struct xfs_ail {
         struct xfs_mount        *xa_mount;
+        struct task_struct      *xa_task;
         struct list_head        xa_ail;
         xfs_lsn_t               xa_target;
         struct xfs_ail_cursor   xa_cursors;
         spinlock_t              xa_lock;
-        struct delayed_work     xa_work;
         xfs_lsn_t               xa_last_pushed_lsn;
-        unsigned long           xa_flags;
 };
 
-#define XFS_AIL_PUSHING_BIT     0
-
 /*
  * From xfs_trans_ail.c
  */
-
-extern struct workqueue_struct  *xfs_ail_wq;    /* AIL workqueue */
-
 void    xfs_trans_ail_update_bulk(struct xfs_ail *ailp,
+                                struct xfs_ail_cursor *cur,
                                 struct xfs_log_item **log_items, int nr_items,
                                 xfs_lsn_t lsn) __releases(ailp->xa_lock);
 static inline void
@@ -90,7 +85,7 @@ xfs_trans_ail_update(
         struct xfs_log_item     *lip,
         xfs_lsn_t               lsn) __releases(ailp->xa_lock)
 {
-        xfs_trans_ail_update_bulk(ailp, &lip, 1, lsn);
+        xfs_trans_ail_update_bulk(ailp, NULL, &lip, 1, lsn);
 }
 
 void    xfs_trans_ail_delete_bulk(struct xfs_ail *ailp,
@@ -111,10 +106,13 @@ xfs_lsn_t		xfs_ail_min_lsn(struct xfs_ail *ailp);
 void                    xfs_trans_unlocked_item(struct xfs_ail *,
                                         xfs_log_item_t *);
 
-struct xfs_log_item     *xfs_trans_ail_cursor_first(struct xfs_ail *ailp,
+struct xfs_log_item *   xfs_trans_ail_cursor_first(struct xfs_ail *ailp,
+                                        struct xfs_ail_cursor *cur,
+                                        xfs_lsn_t lsn);
+struct xfs_log_item *   xfs_trans_ail_cursor_last(struct xfs_ail *ailp,
                                         struct xfs_ail_cursor *cur,
                                         xfs_lsn_t lsn);
-struct xfs_log_item     *xfs_trans_ail_cursor_next(struct xfs_ail *ailp,
+struct xfs_log_item *   xfs_trans_ail_cursor_next(struct xfs_ail *ailp,
                                         struct xfs_ail_cursor *cur);
 void                    xfs_trans_ail_cursor_done(struct xfs_ail *ailp,
                                         struct xfs_ail_cursor *cur);
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 619720705bc..59509ae0b27 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -535,7 +535,7 @@ xfs_readlink(
         char            *link)
 {
         xfs_mount_t     *mp = ip->i_mount;
-        int             pathlen;
+        xfs_fsize_t     pathlen;
         int             error = 0;
 
         trace_xfs_readlink(ip);
@@ -545,13 +545,20 @@ xfs_readlink(
 
         xfs_ilock(ip, XFS_ILOCK_SHARED);
 
-        ASSERT((ip->i_d.di_mode & S_IFMT) == S_IFLNK);
-        ASSERT(ip->i_d.di_size <= MAXPATHLEN);
-
         pathlen = ip->i_d.di_size;
         if (!pathlen)
                 goto out;
 
+        if (pathlen < 0 || pathlen > MAXPATHLEN) {
+                xfs_alert(mp, "%s: inode (%llu) bad symlink length (%lld)",
+                         __func__, (unsigned long long) ip->i_ino,
+                         (long long) pathlen);
+                ASSERT(0);
+                error = XFS_ERROR(EFSCORRUPTED);
+                goto out;
+        }
+
+
         if (ip->i_df.if_flags & XFS_IFINLINE) {
                 memcpy(link, ip->i_df.if_u1.if_data, pathlen);
                 link[pathlen] = '\0';
diff --git a/fs/yaffs2/Kconfig b/fs/yaffs2/Kconfig
new file mode 100644
index 00000000000..63541405999
--- /dev/null
+++ b/fs/yaffs2/Kconfig
@@ -0,0 +1,161 @@
+#
+# YAFFS file system configurations
+#
+
+config YAFFS_FS
+        tristate "YAFFS2 file system support"
+        default n
+        depends on MTD_BLOCK
+        select YAFFS_YAFFS1
+        select YAFFS_YAFFS2
+        help
+          YAFFS2, or Yet Another Flash Filing System, is a filing system
+          optimised for NAND Flash chips.
+
+          To compile the YAFFS2 file system support as a module, choose M
+          here: the module will be called yaffs2.
+
+          If unsure, say N.
+
+          Further information on YAFFS2 is available at
+          <http://www.aleph1.co.uk/yaffs/>.
+
+config YAFFS_YAFFS1
+        bool "512 byte / page devices"
+        depends on YAFFS_FS
+        default y
+        help
+          Enable YAFFS1 support -- yaffs for 512 byte / page devices
+
+          Not needed for 2K-page devices.
+
+          If unsure, say Y.
+
+config YAFFS_9BYTE_TAGS
+        bool "Use older-style on-NAND data format with pageStatus byte"
+        depends on YAFFS_YAFFS1
+        default n
+        help
+
+          Older-style on-NAND data format has a "pageStatus" byte to record
+          chunk/page state.  This byte is zero when the page is discarded.
+          Choose this option if you have existing on-NAND data using this
+          format that you need to continue to support.  New data written
+          also uses the older-style format.  Note: Use of this option
+          generally requires that MTD's oob layout be adjusted to use the
+          older-style format.  See notes on tags formats and MTD versions
+          in yaffs_mtdif1.c.
+
+          If unsure, say N.
+
+config YAFFS_DOES_ECC
+        bool "Lets Yaffs do its own ECC"
+        depends on YAFFS_FS && YAFFS_YAFFS1 && !YAFFS_9BYTE_TAGS
+        default n
+        help
+          This enables Yaffs to use its own ECC functions instead of using
+          the ones from the generic MTD-NAND driver.
+
+          If unsure, say N.
+
+config YAFFS_ECC_WRONG_ORDER
+        bool "Use the same ecc byte order as Steven Hill's nand_ecc.c"
+        depends on YAFFS_FS && YAFFS_DOES_ECC && !YAFFS_9BYTE_TAGS
+        default n
+        help
+          This makes yaffs_ecc.c use the same ecc byte order as Steven
+          Hill's nand_ecc.c. If not set, then you get the same ecc byte
+          order as SmartMedia.
+
+          If unsure, say N.
+
+config YAFFS_YAFFS2
+        bool "2048 byte (or larger) / page devices"
+        depends on YAFFS_FS
+        default y
+        help
+          Enable YAFFS2 support -- yaffs for >= 2K bytes per page devices
+
+          If unsure, say Y.
+
+config YAFFS_AUTO_YAFFS2
+        bool "Autoselect yaffs2 format"
+        depends on YAFFS_YAFFS2
+        default y
+        help
+          Without this, you need to explicitely use yaffs2 as the file
+          system type. With this, you can say "yaffs" and yaffs or yaffs2
+          will be used depending on the device page size (yaffs on
+          512-byte page devices, yaffs2 on 2K page devices).
+
+          If unsure, say Y.
+
+config YAFFS_DISABLE_TAGS_ECC
+        bool "Disable YAFFS from doing ECC on tags by default"
+        depends on YAFFS_FS && YAFFS_YAFFS2
+        default n
+        help
+          This defaults Yaffs to using its own ECC calculations on tags instead of
+          just relying on the MTD.
+          This behavior can also be overridden with tags_ecc_on and
+          tags_ecc_off mount options.
+
+          If unsure, say N.
+
+config YAFFS_ALWAYS_CHECK_CHUNK_ERASED
+        bool "Force chunk erase check"
+        depends on YAFFS_FS
+        default n
+        help
+          Normally YAFFS only checks chunks before writing until an erased
+          chunk is found. This helps to detect any partially written
+          chunks that might have happened due to power loss.
+
+          Enabling this forces on the test that chunks are erased in flash
+          before writing to them. This takes more time but is potentially
+          a bit more secure.
+
+          Suggest setting Y during development and ironing out driver
+          issues etc. Suggest setting to N if you want faster writing.
+
+          If unsure, say Y.
+
+config YAFFS_EMPTY_LOST_AND_FOUND
+        bool "Empty lost and found on boot"
+        depends on YAFFS_FS
+        default n
+        help
+          If this is enabled then the contents of lost and found is
+          automatically dumped at mount.
+
+          If unsure, say N.
+
+config YAFFS_DISABLE_BLOCK_REFRESHING
+        bool "Disable yaffs2 block refreshing"
+        depends on YAFFS_FS
+        default n
+        help
+         If this is set, then block refreshing is disabled.
+         Block refreshing infrequently refreshes the oldest block in
+         a yaffs2 file system. This mechanism helps to refresh flash to
+         mitigate against data loss. This is particularly useful for MLC.
+
+          If unsure, say N.
+
+config YAFFS_DISABLE_BACKGROUND
+        bool "Disable yaffs2 background processing"
+        depends on YAFFS_FS
+        default n
+        help
+         If this is set, then background processing is disabled.
+         Background processing makes many foreground activities faster.
+
+         If unsure, say N.
+
+config YAFFS_XATTR
+        bool "Enable yaffs2 xattr support"
+        depends on YAFFS_FS
+        default y
+        help
+         If this is set then yaffs2 will provide xattr support.
+         If unsure, say Y.
diff --git a/fs/yaffs2/Makefile b/fs/yaffs2/Makefile
new file mode 100644
index 00000000000..e63a28aa3ed
--- /dev/null
+++ b/fs/yaffs2/Makefile
@@ -0,0 +1,17 @@
+#
+# Makefile for the linux YAFFS filesystem routines.
+#
+
+obj-$(CONFIG_YAFFS_FS) += yaffs.o
+
+yaffs-y := yaffs_ecc.o yaffs_vfs.o yaffs_guts.o yaffs_checkptrw.o
+yaffs-y += yaffs_packedtags1.o yaffs_packedtags2.o yaffs_nand.o
+yaffs-y += yaffs_tagscompat.o yaffs_tagsvalidity.o
+yaffs-y += yaffs_mtdif.o yaffs_mtdif1.o yaffs_mtdif2.o
+yaffs-y += yaffs_nameval.o yaffs_attribs.o
+yaffs-y += yaffs_allocator.o
+yaffs-y += yaffs_yaffs1.o
+yaffs-y += yaffs_yaffs2.o
+yaffs-y += yaffs_bitmap.o
+yaffs-y += yaffs_verify.o
+
diff --git a/fs/yaffs2/yaffs_allocator.c b/fs/yaffs2/yaffs_allocator.c
new file mode 100644
index 00000000000..f9cd5becd8f
--- /dev/null
+++ b/fs/yaffs2/yaffs_allocator.c
@@ -0,0 +1,396 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_allocator.h"
+#include "yaffs_guts.h"
+#include "yaffs_trace.h"
+#include "yportenv.h"
+
+#ifdef CONFIG_YAFFS_KMALLOC_ALLOCATOR
+
+void yaffs_deinit_raw_tnodes_and_objs(struct yaffs_dev *dev)
+{
+        dev = dev;
+}
+
+void yaffs_init_raw_tnodes_and_objs(struct yaffs_dev *dev)
+{
+        dev = dev;
+}
+
+struct yaffs_tnode *yaffs_alloc_raw_tnode(struct yaffs_dev *dev)
+{
+        return (struct yaffs_tnode *)kmalloc(dev->tnode_size, GFP_NOFS);
+}
+
+void yaffs_free_raw_tnode(struct yaffs_dev *dev, struct yaffs_tnode *tn)
+{
+        dev = dev;
+        kfree(tn);
+}
+
+void yaffs_init_raw_objs(struct yaffs_dev *dev)
+{
+        dev = dev;
+}
+
+void yaffs_deinit_raw_objs(struct yaffs_dev *dev)
+{
+        dev = dev;
+}
+
+struct yaffs_obj *yaffs_alloc_raw_obj(struct yaffs_dev *dev)
+{
+        dev = dev;
+        return (struct yaffs_obj *)kmalloc(sizeof(struct yaffs_obj));
+}
+
+void yaffs_free_raw_obj(struct yaffs_dev *dev, struct yaffs_obj *obj)
+{
+
+        dev = dev;
+        kfree(obj);
+}
+
+#else
+
+struct yaffs_tnode_list {
+        struct yaffs_tnode_list *next;
+        struct yaffs_tnode *tnodes;
+};
+
+struct yaffs_obj_list {
+        struct yaffs_obj_list *next;
+        struct yaffs_obj *objects;
+};
+
+struct yaffs_allocator {
+        int n_tnodes_created;
+        struct yaffs_tnode *free_tnodes;
+        int n_free_tnodes;
+        struct yaffs_tnode_list *alloc_tnode_list;
+
+        int n_obj_created;
+        struct yaffs_obj *free_objs;
+        int n_free_objects;
+
+        struct yaffs_obj_list *allocated_obj_list;
+};
+
+static void yaffs_deinit_raw_tnodes(struct yaffs_dev *dev)
+{
+
+        struct yaffs_allocator *allocator =
+            (struct yaffs_allocator *)dev->allocator;
+
+        struct yaffs_tnode_list *tmp;
+
+        if (!allocator) {
+                YBUG();
+                return;
+        }
+
+        while (allocator->alloc_tnode_list) {
+                tmp = allocator->alloc_tnode_list->next;
+
+                kfree(allocator->alloc_tnode_list->tnodes);
+                kfree(allocator->alloc_tnode_list);
+                allocator->alloc_tnode_list = tmp;
+
+        }
+
+        allocator->free_tnodes = NULL;
+        allocator->n_free_tnodes = 0;
+        allocator->n_tnodes_created = 0;
+}
+
+static void yaffs_init_raw_tnodes(struct yaffs_dev *dev)
+{
+        struct yaffs_allocator *allocator = dev->allocator;
+
+        if (allocator) {
+                allocator->alloc_tnode_list = NULL;
+                allocator->free_tnodes = NULL;
+                allocator->n_free_tnodes = 0;
+                allocator->n_tnodes_created = 0;
+        } else {
+                YBUG();
+        }
+}
+
+static int yaffs_create_tnodes(struct yaffs_dev *dev, int n_tnodes)
+{
+        struct yaffs_allocator *allocator =
+            (struct yaffs_allocator *)dev->allocator;
+        int i;
+        struct yaffs_tnode *new_tnodes;
+        u8 *mem;
+        struct yaffs_tnode *curr;
+        struct yaffs_tnode *next;
+        struct yaffs_tnode_list *tnl;
+
+        if (!allocator) {
+                YBUG();
+                return YAFFS_FAIL;
+        }
+
+        if (n_tnodes < 1)
+                return YAFFS_OK;
+
+        /* make these things */
+
+        new_tnodes = kmalloc(n_tnodes * dev->tnode_size, GFP_NOFS);
+        mem = (u8 *) new_tnodes;
+
+        if (!new_tnodes) {
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                        "yaffs: Could not allocate Tnodes");
+                return YAFFS_FAIL;
+        }
+
+        /* New hookup for wide tnodes */
+        for (i = 0; i < n_tnodes - 1; i++) {
+                curr = (struct yaffs_tnode *)&mem[i * dev->tnode_size];
+                next = (struct yaffs_tnode *)&mem[(i + 1) * dev->tnode_size];
+                curr->internal[0] = next;
+        }
+
+        curr = (struct yaffs_tnode *)&mem[(n_tnodes - 1) * dev->tnode_size];
+        curr->internal[0] = allocator->free_tnodes;
+        allocator->free_tnodes = (struct yaffs_tnode *)mem;
+
+        allocator->n_free_tnodes += n_tnodes;
+        allocator->n_tnodes_created += n_tnodes;
+
+        /* Now add this bunch of tnodes to a list for freeing up.
+         * NB If we can't add this to the management list it isn't fatal
+         * but it just means we can't free this bunch of tnodes later.
+         */
+
+        tnl = kmalloc(sizeof(struct yaffs_tnode_list), GFP_NOFS);
+        if (!tnl) {
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                        "Could not add tnodes to management list");
+                return YAFFS_FAIL;
+        } else {
+                tnl->tnodes = new_tnodes;
+                tnl->next = allocator->alloc_tnode_list;
+                allocator->alloc_tnode_list = tnl;
+        }
+
+        yaffs_trace(YAFFS_TRACE_ALLOCATE,"Tnodes added");
+
+        return YAFFS_OK;
+}
+
+struct yaffs_tnode *yaffs_alloc_raw_tnode(struct yaffs_dev *dev)
+{
+        struct yaffs_allocator *allocator =
+            (struct yaffs_allocator *)dev->allocator;
+        struct yaffs_tnode *tn = NULL;
+
+        if (!allocator) {
+                YBUG();
+                return NULL;
+        }
+
+        /* If there are none left make more */
+        if (!allocator->free_tnodes)
+                yaffs_create_tnodes(dev, YAFFS_ALLOCATION_NTNODES);
+
+        if (allocator->free_tnodes) {
+                tn = allocator->free_tnodes;
+                allocator->free_tnodes = allocator->free_tnodes->internal[0];
+                allocator->n_free_tnodes--;
+        }
+
+        return tn;
+}
+
+/* FreeTnode frees up a tnode and puts it back on the free list */
+void yaffs_free_raw_tnode(struct yaffs_dev *dev, struct yaffs_tnode *tn)
+{
+        struct yaffs_allocator *allocator = dev->allocator;
+
+        if (!allocator) {
+                YBUG();
+                return;
+        }
+
+        if (tn) {
+                tn->internal[0] = allocator->free_tnodes;
+                allocator->free_tnodes = tn;
+                allocator->n_free_tnodes++;
+        }
+        dev->checkpoint_blocks_required = 0;    /* force recalculation */
+}
+
+static void yaffs_init_raw_objs(struct yaffs_dev *dev)
+{
+        struct yaffs_allocator *allocator = dev->allocator;
+
+        if (allocator) {
+                allocator->allocated_obj_list = NULL;
+                allocator->free_objs = NULL;
+                allocator->n_free_objects = 0;
+        } else {
+                YBUG();
+        }
+}
+
+static void yaffs_deinit_raw_objs(struct yaffs_dev *dev)
+{
+        struct yaffs_allocator *allocator = dev->allocator;
+        struct yaffs_obj_list *tmp;
+
+        if (!allocator) {
+                YBUG();
+                return;
+        }
+
+        while (allocator->allocated_obj_list) {
+                tmp = allocator->allocated_obj_list->next;
+                kfree(allocator->allocated_obj_list->objects);
+                kfree(allocator->allocated_obj_list);
+
+                allocator->allocated_obj_list = tmp;
+        }
+
+        allocator->free_objs = NULL;
+        allocator->n_free_objects = 0;
+        allocator->n_obj_created = 0;
+}
+
+static int yaffs_create_free_objs(struct yaffs_dev *dev, int n_obj)
+{
+        struct yaffs_allocator *allocator = dev->allocator;
+
+        int i;
+        struct yaffs_obj *new_objs;
+        struct yaffs_obj_list *list;
+
+        if (!allocator) {
+                YBUG();
+                return YAFFS_FAIL;
+        }
+
+        if (n_obj < 1)
+                return YAFFS_OK;
+
+        /* make these things */
+        new_objs = kmalloc(n_obj * sizeof(struct yaffs_obj), GFP_NOFS);
+        list = kmalloc(sizeof(struct yaffs_obj_list), GFP_NOFS);
+
+        if (!new_objs || !list) {
+                if (new_objs) {
+                        kfree(new_objs);
+                        new_objs = NULL;
+                }
+                if (list) {
+                        kfree(list);
+                        list = NULL;
+                }
+                yaffs_trace(YAFFS_TRACE_ALLOCATE,
+                        "Could not allocate more objects");
+                return YAFFS_FAIL;
+        }
+
+        /* Hook them into the free list */
+        for (i = 0; i < n_obj - 1; i++) {
+                new_objs[i].siblings.next =
+                    (struct list_head *)(&new_objs[i + 1]);
+        }
+
+        new_objs[n_obj - 1].siblings.next = (void *)allocator->free_objs;
+        allocator->free_objs = new_objs;
+        allocator->n_free_objects += n_obj;
+        allocator->n_obj_created += n_obj;
+
+        /* Now add this bunch of Objects to a list for freeing up. */
+
+        list->objects = new_objs;
+        list->next = allocator->allocated_obj_list;
+        allocator->allocated_obj_list = list;
+
+        return YAFFS_OK;
+}
+
+struct yaffs_obj *yaffs_alloc_raw_obj(struct yaffs_dev *dev)
+{
+        struct yaffs_obj *obj = NULL;
+        struct yaffs_allocator *allocator = dev->allocator;
+
+        if (!allocator) {
+                YBUG();
+                return obj;
+        }
+
+        /* If there are none left make more */
+        if (!allocator->free_objs)
+                yaffs_create_free_objs(dev, YAFFS_ALLOCATION_NOBJECTS);
+
+        if (allocator->free_objs) {
+                obj = allocator->free_objs;
+                allocator->free_objs =
+                    (struct yaffs_obj *)(allocator->free_objs->siblings.next);
+                allocator->n_free_objects--;
+        }
+
+        return obj;
+}
+
+void yaffs_free_raw_obj(struct yaffs_dev *dev, struct yaffs_obj *obj)
+{
+
+        struct yaffs_allocator *allocator = dev->allocator;
+
+        if (!allocator)
+                YBUG();
+        else {
+                /* Link into the free list. */
+                obj->siblings.next = (struct list_head *)(allocator->free_objs);
+                allocator->free_objs = obj;
+                allocator->n_free_objects++;
+        }
+}
+
+void yaffs_deinit_raw_tnodes_and_objs(struct yaffs_dev *dev)
+{
+        if (dev->allocator) {
+                yaffs_deinit_raw_tnodes(dev);
+                yaffs_deinit_raw_objs(dev);
+
+                kfree(dev->allocator);
+                dev->allocator = NULL;
+        } else {
+                YBUG();
+        }
+}
+
+void yaffs_init_raw_tnodes_and_objs(struct yaffs_dev *dev)
+{
+        struct yaffs_allocator *allocator;
+
+        if (!dev->allocator) {
+                allocator = kmalloc(sizeof(struct yaffs_allocator), GFP_NOFS);
+                if (allocator) {
+                        dev->allocator = allocator;
+                        yaffs_init_raw_tnodes(dev);
+                        yaffs_init_raw_objs(dev);
+                }
+        } else {
+                YBUG();
+        }
+}
+
+#endif
diff --git a/fs/yaffs2/yaffs_allocator.h b/fs/yaffs2/yaffs_allocator.h
new file mode 100644
index 00000000000..4d5f2aec89f
--- /dev/null
+++ b/fs/yaffs2/yaffs_allocator.h
@@ -0,0 +1,30 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_ALLOCATOR_H__
+#define __YAFFS_ALLOCATOR_H__
+
+#include "yaffs_guts.h"
+
+void yaffs_init_raw_tnodes_and_objs(struct yaffs_dev *dev);
+void yaffs_deinit_raw_tnodes_and_objs(struct yaffs_dev *dev);
+
+struct yaffs_tnode *yaffs_alloc_raw_tnode(struct yaffs_dev *dev);
+void yaffs_free_raw_tnode(struct yaffs_dev *dev, struct yaffs_tnode *tn);
+
+struct yaffs_obj *yaffs_alloc_raw_obj(struct yaffs_dev *dev);
+void yaffs_free_raw_obj(struct yaffs_dev *dev, struct yaffs_obj *obj);
+
+#endif
diff --git a/fs/yaffs2/yaffs_attribs.c b/fs/yaffs2/yaffs_attribs.c
new file mode 100644
index 00000000000..9b47d376310
--- /dev/null
+++ b/fs/yaffs2/yaffs_attribs.c
@@ -0,0 +1,124 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_guts.h"
+#include "yaffs_attribs.h"
+
+void yaffs_load_attribs(struct yaffs_obj *obj, struct yaffs_obj_hdr *oh)
+{
+        obj->yst_uid = oh->yst_uid;
+        obj->yst_gid = oh->yst_gid;
+        obj->yst_atime = oh->yst_atime;
+        obj->yst_mtime = oh->yst_mtime;
+        obj->yst_ctime = oh->yst_ctime;
+        obj->yst_rdev = oh->yst_rdev;
+}
+
+void yaffs_load_attribs_oh(struct yaffs_obj_hdr *oh, struct yaffs_obj *obj)
+{
+        oh->yst_uid = obj->yst_uid;
+        oh->yst_gid = obj->yst_gid;
+        oh->yst_atime = obj->yst_atime;
+        oh->yst_mtime = obj->yst_mtime;
+        oh->yst_ctime = obj->yst_ctime;
+        oh->yst_rdev = obj->yst_rdev;
+
+}
+
+void yaffs_load_current_time(struct yaffs_obj *obj, int do_a, int do_c)
+{
+        obj->yst_mtime = Y_CURRENT_TIME;
+        if (do_a)
+                obj->yst_atime = obj->yst_mtime;
+        if (do_c)
+                obj->yst_ctime = obj->yst_mtime;
+}
+
+void yaffs_attribs_init(struct yaffs_obj *obj, u32 gid, u32 uid, u32 rdev)
+{
+        yaffs_load_current_time(obj, 1, 1);
+        obj->yst_rdev = rdev;
+        obj->yst_uid = uid;
+        obj->yst_gid = gid;
+}
+
+loff_t yaffs_get_file_size(struct yaffs_obj *obj)
+{
+        YCHAR *alias = NULL;
+        obj = yaffs_get_equivalent_obj(obj);
+
+        switch (obj->variant_type) {
+        case YAFFS_OBJECT_TYPE_FILE:
+                return obj->variant.file_variant.file_size;
+        case YAFFS_OBJECT_TYPE_SYMLINK:
+                alias = obj->variant.symlink_variant.alias;
+                if (!alias)
+                        return 0;
+                return strnlen(alias, YAFFS_MAX_ALIAS_LENGTH);
+        default:
+                return 0;
+        }
+}
+
+int yaffs_set_attribs(struct yaffs_obj *obj, struct iattr *attr)
+{
+        unsigned int valid = attr->ia_valid;
+
+        if (valid & ATTR_MODE)
+                obj->yst_mode = attr->ia_mode;
+        if (valid & ATTR_UID)
+                obj->yst_uid = attr->ia_uid;
+        if (valid & ATTR_GID)
+                obj->yst_gid = attr->ia_gid;
+
+        if (valid & ATTR_ATIME)
+                obj->yst_atime = Y_TIME_CONVERT(attr->ia_atime);
+        if (valid & ATTR_CTIME)
+                obj->yst_ctime = Y_TIME_CONVERT(attr->ia_ctime);
+        if (valid & ATTR_MTIME)
+                obj->yst_mtime = Y_TIME_CONVERT(attr->ia_mtime);
+
+        if (valid & ATTR_SIZE)
+                yaffs_resize_file(obj, attr->ia_size);
+
+        yaffs_update_oh(obj, NULL, 1, 0, 0, NULL);
+
+        return YAFFS_OK;
+
+}
+
+int yaffs_get_attribs(struct yaffs_obj *obj, struct iattr *attr)
+{
+        unsigned int valid = 0;
+
+        attr->ia_mode = obj->yst_mode;
+        valid |= ATTR_MODE;
+        attr->ia_uid = obj->yst_uid;
+        valid |= ATTR_UID;
+        attr->ia_gid = obj->yst_gid;
+        valid |= ATTR_GID;
+
+        Y_TIME_CONVERT(attr->ia_atime) = obj->yst_atime;
+        valid |= ATTR_ATIME;
+        Y_TIME_CONVERT(attr->ia_ctime) = obj->yst_ctime;
+        valid |= ATTR_CTIME;
+        Y_TIME_CONVERT(attr->ia_mtime) = obj->yst_mtime;
+        valid |= ATTR_MTIME;
+
+        attr->ia_size = yaffs_get_file_size(obj);
+        valid |= ATTR_SIZE;
+
+        attr->ia_valid = valid;
+
+        return YAFFS_OK;
+}
diff --git a/fs/yaffs2/yaffs_attribs.h b/fs/yaffs2/yaffs_attribs.h
new file mode 100644
index 00000000000..33d541d6944
--- /dev/null
+++ b/fs/yaffs2/yaffs_attribs.h
@@ -0,0 +1,28 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_ATTRIBS_H__
+#define __YAFFS_ATTRIBS_H__
+
+#include "yaffs_guts.h"
+
+void yaffs_load_attribs(struct yaffs_obj *obj, struct yaffs_obj_hdr *oh);
+void yaffs_load_attribs_oh(struct yaffs_obj_hdr *oh, struct yaffs_obj *obj);
+void yaffs_attribs_init(struct yaffs_obj *obj, u32 gid, u32 uid, u32 rdev);
+void yaffs_load_current_time(struct yaffs_obj *obj, int do_a, int do_c);
+int yaffs_set_attribs(struct yaffs_obj *obj, struct iattr *attr);
+int yaffs_get_attribs(struct yaffs_obj *obj, struct iattr *attr);
+
+#endif
diff --git a/fs/yaffs2/yaffs_bitmap.c b/fs/yaffs2/yaffs_bitmap.c
new file mode 100644
index 00000000000..7df42cd0066
--- /dev/null
+++ b/fs/yaffs2/yaffs_bitmap.c
@@ -0,0 +1,98 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_bitmap.h"
+#include "yaffs_trace.h"
+/*
+ * Chunk bitmap manipulations
+ */
+
+static inline u8 *yaffs_block_bits(struct yaffs_dev *dev, int blk)
+{
+        if (blk < dev->internal_start_block || blk > dev->internal_end_block) {
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                        "BlockBits block %d is not valid",
+                        blk);
+                YBUG();
+        }
+        return dev->chunk_bits +
+            (dev->chunk_bit_stride * (blk - dev->internal_start_block));
+}
+
+void yaffs_verify_chunk_bit_id(struct yaffs_dev *dev, int blk, int chunk)
+{
+        if (blk < dev->internal_start_block || blk > dev->internal_end_block ||
+            chunk < 0 || chunk >= dev->param.chunks_per_block) {
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                        "Chunk Id (%d:%d) invalid",
+                        blk, chunk);
+                YBUG();
+        }
+}
+
+void yaffs_clear_chunk_bits(struct yaffs_dev *dev, int blk)
+{
+        u8 *blk_bits = yaffs_block_bits(dev, blk);
+
+        memset(blk_bits, 0, dev->chunk_bit_stride);
+}
+
+void yaffs_clear_chunk_bit(struct yaffs_dev *dev, int blk, int chunk)
+{
+        u8 *blk_bits = yaffs_block_bits(dev, blk);
+
+        yaffs_verify_chunk_bit_id(dev, blk, chunk);
+
+        blk_bits[chunk / 8] &= ~(1 << (chunk & 7));
+}
+
+void yaffs_set_chunk_bit(struct yaffs_dev *dev, int blk, int chunk)
+{
+        u8 *blk_bits = yaffs_block_bits(dev, blk);
+
+        yaffs_verify_chunk_bit_id(dev, blk, chunk);
+
+        blk_bits[chunk / 8] |= (1 << (chunk & 7));
+}
+
+int yaffs_check_chunk_bit(struct yaffs_dev *dev, int blk, int chunk)
+{
+        u8 *blk_bits = yaffs_block_bits(dev, blk);
+        yaffs_verify_chunk_bit_id(dev, blk, chunk);
+
+        return (blk_bits[chunk / 8] & (1 << (chunk & 7))) ? 1 : 0;
+}
+
+int yaffs_still_some_chunks(struct yaffs_dev *dev, int blk)
+{
+        u8 *blk_bits = yaffs_block_bits(dev, blk);
+        int i;
+        for (i = 0; i < dev->chunk_bit_stride; i++) {
+                if (*blk_bits)
+                        return 1;
+                blk_bits++;
+        }
+        return 0;
+}
+
+int yaffs_count_chunk_bits(struct yaffs_dev *dev, int blk)
+{
+        u8 *blk_bits = yaffs_block_bits(dev, blk);
+        int i;
+        int n = 0;
+
+        for (i = 0; i < dev->chunk_bit_stride; i++, blk_bits++)
+                n += hweight8(*blk_bits);
+
+        return n;
+}
diff --git a/fs/yaffs2/yaffs_bitmap.h b/fs/yaffs2/yaffs_bitmap.h
new file mode 100644
index 00000000000..cf9ea58da0d
--- /dev/null
+++ b/fs/yaffs2/yaffs_bitmap.h
@@ -0,0 +1,33 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+/*
+ * Chunk bitmap manipulations
+ */
+
+#ifndef __YAFFS_BITMAP_H__
+#define __YAFFS_BITMAP_H__
+
+#include "yaffs_guts.h"
+
+void yaffs_verify_chunk_bit_id(struct yaffs_dev *dev, int blk, int chunk);
+void yaffs_clear_chunk_bits(struct yaffs_dev *dev, int blk);
+void yaffs_clear_chunk_bit(struct yaffs_dev *dev, int blk, int chunk);
+void yaffs_set_chunk_bit(struct yaffs_dev *dev, int blk, int chunk);
+int yaffs_check_chunk_bit(struct yaffs_dev *dev, int blk, int chunk);
+int yaffs_still_some_chunks(struct yaffs_dev *dev, int blk);
+int yaffs_count_chunk_bits(struct yaffs_dev *dev, int blk);
+
+#endif
diff --git a/fs/yaffs2/yaffs_checkptrw.c b/fs/yaffs2/yaffs_checkptrw.c
new file mode 100644
index 00000000000..4e40f437e65
--- /dev/null
+++ b/fs/yaffs2/yaffs_checkptrw.c
@@ -0,0 +1,415 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_checkptrw.h"
+#include "yaffs_getblockinfo.h"
+
+static int yaffs2_checkpt_space_ok(struct yaffs_dev *dev)
+{
+        int blocks_avail = dev->n_erased_blocks - dev->param.n_reserved_blocks;
+
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                "checkpt blocks_avail = %d", blocks_avail);
+
+        return (blocks_avail <= 0) ? 0 : 1;
+}
+
+static int yaffs_checkpt_erase(struct yaffs_dev *dev)
+{
+        int i;
+
+        if (!dev->param.erase_fn)
+                return 0;
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                "checking blocks %d to %d",
+                dev->internal_start_block, dev->internal_end_block);
+
+        for (i = dev->internal_start_block; i <= dev->internal_end_block; i++) {
+                struct yaffs_block_info *bi = yaffs_get_block_info(dev, i);
+                if (bi->block_state == YAFFS_BLOCK_STATE_CHECKPOINT) {
+                        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "erasing checkpt block %d", i);
+
+                        dev->n_erasures++;
+
+                        if (dev->param.
+                            erase_fn(dev,
+                                     i - dev->block_offset /* realign */ )) {
+                                bi->block_state = YAFFS_BLOCK_STATE_EMPTY;
+                                dev->n_erased_blocks++;
+                                dev->n_free_chunks +=
+                                    dev->param.chunks_per_block;
+                        } else {
+                                dev->param.bad_block_fn(dev, i);
+                                bi->block_state = YAFFS_BLOCK_STATE_DEAD;
+                        }
+                }
+        }
+
+        dev->blocks_in_checkpt = 0;
+
+        return 1;
+}
+
+static void yaffs2_checkpt_find_erased_block(struct yaffs_dev *dev)
+{
+        int i;
+        int blocks_avail = dev->n_erased_blocks - dev->param.n_reserved_blocks;
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                "allocating checkpt block: erased %d reserved %d avail %d next %d ",
+                dev->n_erased_blocks, dev->param.n_reserved_blocks,
+                blocks_avail, dev->checkpt_next_block);
+
+        if (dev->checkpt_next_block >= 0 &&
+            dev->checkpt_next_block <= dev->internal_end_block &&
+            blocks_avail > 0) {
+
+                for (i = dev->checkpt_next_block; i <= dev->internal_end_block;
+                     i++) {
+                        struct yaffs_block_info *bi =
+                            yaffs_get_block_info(dev, i);
+                        if (bi->block_state == YAFFS_BLOCK_STATE_EMPTY) {
+                                dev->checkpt_next_block = i + 1;
+                                dev->checkpt_cur_block = i;
+                                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                                        "allocating checkpt block %d", i);
+                                return;
+                        }
+                }
+        }
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT, "out of checkpt blocks");
+
+        dev->checkpt_next_block = -1;
+        dev->checkpt_cur_block = -1;
+}
+
+static void yaffs2_checkpt_find_block(struct yaffs_dev *dev)
+{
+        int i;
+        struct yaffs_ext_tags tags;
+
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                "find next checkpt block: start:  blocks %d next %d",
+                dev->blocks_in_checkpt, dev->checkpt_next_block);
+
+        if (dev->blocks_in_checkpt < dev->checkpt_max_blocks)
+                for (i = dev->checkpt_next_block; i <= dev->internal_end_block;
+                     i++) {
+                        int chunk = i * dev->param.chunks_per_block;
+                        int realigned_chunk = chunk - dev->chunk_offset;
+
+                        dev->param.read_chunk_tags_fn(dev, realigned_chunk,
+                                                      NULL, &tags);
+                        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                                "find next checkpt block: search: block %d oid %d seq %d eccr %d",
+                                i, tags.obj_id, tags.seq_number,
+                                tags.ecc_result);
+
+                        if (tags.seq_number == YAFFS_SEQUENCE_CHECKPOINT_DATA) {
+                                /* Right kind of block */
+                                dev->checkpt_next_block = tags.obj_id;
+                                dev->checkpt_cur_block = i;
+                                dev->checkpt_block_list[dev->
+                                                        blocks_in_checkpt] = i;
+                                dev->blocks_in_checkpt++;
+                                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                                        "found checkpt block %d", i);
+                                return;
+                        }
+                }
+
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT, "found no more checkpt blocks");
+
+        dev->checkpt_next_block = -1;
+        dev->checkpt_cur_block = -1;
+}
+
+int yaffs2_checkpt_open(struct yaffs_dev *dev, int writing)
+{
+
+        dev->checkpt_open_write = writing;
+
+        /* Got the functions we need? */
+        if (!dev->param.write_chunk_tags_fn ||
+            !dev->param.read_chunk_tags_fn ||
+            !dev->param.erase_fn || !dev->param.bad_block_fn)
+                return 0;
+
+        if (writing && !yaffs2_checkpt_space_ok(dev))
+                return 0;
+
+        if (!dev->checkpt_buffer)
+                dev->checkpt_buffer =
+                    kmalloc(dev->param.total_bytes_per_chunk, GFP_NOFS);
+        if (!dev->checkpt_buffer)
+                return 0;
+
+        dev->checkpt_page_seq = 0;
+        dev->checkpt_byte_count = 0;
+        dev->checkpt_sum = 0;
+        dev->checkpt_xor = 0;
+        dev->checkpt_cur_block = -1;
+        dev->checkpt_cur_chunk = -1;
+        dev->checkpt_next_block = dev->internal_start_block;
+
+        /* Erase all the blocks in the checkpoint area */
+        if (writing) {
+                memset(dev->checkpt_buffer, 0, dev->data_bytes_per_chunk);
+                dev->checkpt_byte_offs = 0;
+                return yaffs_checkpt_erase(dev);
+        } else {
+                int i;
+                /* Set to a value that will kick off a read */
+                dev->checkpt_byte_offs = dev->data_bytes_per_chunk;
+                /* A checkpoint block list of 1 checkpoint block per 16 block is (hopefully)
+                 * going to be way more than we need */
+                dev->blocks_in_checkpt = 0;
+                dev->checkpt_max_blocks =
+                    (dev->internal_end_block - dev->internal_start_block) / 16 +
+                    2;
+                dev->checkpt_block_list =
+                    kmalloc(sizeof(int) * dev->checkpt_max_blocks, GFP_NOFS);
+                if (!dev->checkpt_block_list)
+                        return 0;
+
+                for (i = 0; i < dev->checkpt_max_blocks; i++)
+                        dev->checkpt_block_list[i] = -1;
+        }
+
+        return 1;
+}
+
+int yaffs2_get_checkpt_sum(struct yaffs_dev *dev, u32 * sum)
+{
+        u32 composite_sum;
+        composite_sum = (dev->checkpt_sum << 8) | (dev->checkpt_xor & 0xFF);
+        *sum = composite_sum;
+        return 1;
+}
+
+static int yaffs2_checkpt_flush_buffer(struct yaffs_dev *dev)
+{
+        int chunk;
+        int realigned_chunk;
+
+        struct yaffs_ext_tags tags;
+
+        if (dev->checkpt_cur_block < 0) {
+                yaffs2_checkpt_find_erased_block(dev);
+                dev->checkpt_cur_chunk = 0;
+        }
+
+        if (dev->checkpt_cur_block < 0)
+                return 0;
+
+        tags.is_deleted = 0;
+        tags.obj_id = dev->checkpt_next_block;  /* Hint to next place to look */
+        tags.chunk_id = dev->checkpt_page_seq + 1;
+        tags.seq_number = YAFFS_SEQUENCE_CHECKPOINT_DATA;
+        tags.n_bytes = dev->data_bytes_per_chunk;
+        if (dev->checkpt_cur_chunk == 0) {
+                /* First chunk we write for the block? Set block state to
+                   checkpoint */
+                struct yaffs_block_info *bi =
+                    yaffs_get_block_info(dev, dev->checkpt_cur_block);
+                bi->block_state = YAFFS_BLOCK_STATE_CHECKPOINT;
+                dev->blocks_in_checkpt++;
+        }
+
+        chunk =
+            dev->checkpt_cur_block * dev->param.chunks_per_block +
+            dev->checkpt_cur_chunk;
+
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                "checkpoint wite buffer nand %d(%d:%d) objid %d chId %d",
+                chunk, dev->checkpt_cur_block, dev->checkpt_cur_chunk,
+                tags.obj_id, tags.chunk_id);
+
+        realigned_chunk = chunk - dev->chunk_offset;
+
+        dev->n_page_writes++;
+
+        dev->param.write_chunk_tags_fn(dev, realigned_chunk,
+                                       dev->checkpt_buffer, &tags);
+        dev->checkpt_byte_offs = 0;
+        dev->checkpt_page_seq++;
+        dev->checkpt_cur_chunk++;
+        if (dev->checkpt_cur_chunk >= dev->param.chunks_per_block) {
+                dev->checkpt_cur_chunk = 0;
+                dev->checkpt_cur_block = -1;
+        }
+        memset(dev->checkpt_buffer, 0, dev->data_bytes_per_chunk);
+
+        return 1;
+}
+
+int yaffs2_checkpt_wr(struct yaffs_dev *dev, const void *data, int n_bytes)
+{
+        int i = 0;
+        int ok = 1;
+
+        u8 *data_bytes = (u8 *) data;
+
+        if (!dev->checkpt_buffer)
+                return 0;
+
+        if (!dev->checkpt_open_write)
+                return -1;
+
+        while (i < n_bytes && ok) {
+                dev->checkpt_buffer[dev->checkpt_byte_offs] = *data_bytes;
+                dev->checkpt_sum += *data_bytes;
+                dev->checkpt_xor ^= *data_bytes;
+
+                dev->checkpt_byte_offs++;
+                i++;
+                data_bytes++;
+                dev->checkpt_byte_count++;
+
+                if (dev->checkpt_byte_offs < 0 ||
+                    dev->checkpt_byte_offs >= dev->data_bytes_per_chunk)
+                        ok = yaffs2_checkpt_flush_buffer(dev);
+        }
+
+        return i;
+}
+
+int yaffs2_checkpt_rd(struct yaffs_dev *dev, void *data, int n_bytes)
+{
+        int i = 0;
+        int ok = 1;
+        struct yaffs_ext_tags tags;
+
+        int chunk;
+        int realigned_chunk;
+
+        u8 *data_bytes = (u8 *) data;
+
+        if (!dev->checkpt_buffer)
+                return 0;
+
+        if (dev->checkpt_open_write)
+                return -1;
+
+        while (i < n_bytes && ok) {
+
+                if (dev->checkpt_byte_offs < 0 ||
+                    dev->checkpt_byte_offs >= dev->data_bytes_per_chunk) {
+
+                        if (dev->checkpt_cur_block < 0) {
+                                yaffs2_checkpt_find_block(dev);
+                                dev->checkpt_cur_chunk = 0;
+                        }
+
+                        if (dev->checkpt_cur_block < 0)
+                                ok = 0;
+                        else {
+                                chunk = dev->checkpt_cur_block *
+                                    dev->param.chunks_per_block +
+                                    dev->checkpt_cur_chunk;
+
+                                realigned_chunk = chunk - dev->chunk_offset;
+
+                                dev->n_page_reads++;
+
+                                /* read in the next chunk */
+                                dev->param.read_chunk_tags_fn(dev,
+                                                              realigned_chunk,
+                                                              dev->
+                                                              checkpt_buffer,
+                                                              &tags);
+
+                                if (tags.chunk_id != (dev->checkpt_page_seq + 1)
+                                    || tags.ecc_result > YAFFS_ECC_RESULT_FIXED
+                                    || tags.seq_number !=
+                                    YAFFS_SEQUENCE_CHECKPOINT_DATA)
+                                        ok = 0;
+
+                                dev->checkpt_byte_offs = 0;
+                                dev->checkpt_page_seq++;
+                                dev->checkpt_cur_chunk++;
+
+                                if (dev->checkpt_cur_chunk >=
+                                    dev->param.chunks_per_block)
+                                        dev->checkpt_cur_block = -1;
+                        }
+                }
+
+                if (ok) {
+                        *data_bytes =
+                            dev->checkpt_buffer[dev->checkpt_byte_offs];
+                        dev->checkpt_sum += *data_bytes;
+                        dev->checkpt_xor ^= *data_bytes;
+                        dev->checkpt_byte_offs++;
+                        i++;
+                        data_bytes++;
+                        dev->checkpt_byte_count++;
+                }
+        }
+
+        return i;
+}
+
+int yaffs_checkpt_close(struct yaffs_dev *dev)
+{
+
+        if (dev->checkpt_open_write) {
+                if (dev->checkpt_byte_offs != 0)
+                        yaffs2_checkpt_flush_buffer(dev);
+        } else if (dev->checkpt_block_list) {
+                int i;
+                for (i = 0;
+                     i < dev->blocks_in_checkpt
+                     && dev->checkpt_block_list[i] >= 0; i++) {
+                        int blk = dev->checkpt_block_list[i];
+                        struct yaffs_block_info *bi = NULL;
+                        if (dev->internal_start_block <= blk
+                            && blk <= dev->internal_end_block)
+                                bi = yaffs_get_block_info(dev, blk);
+                        if (bi && bi->block_state == YAFFS_BLOCK_STATE_EMPTY)
+                                bi->block_state = YAFFS_BLOCK_STATE_CHECKPOINT;
+                        else {
+                                /* Todo this looks odd... */
+                        }
+                }
+                kfree(dev->checkpt_block_list);
+                dev->checkpt_block_list = NULL;
+        }
+
+        dev->n_free_chunks -=
+            dev->blocks_in_checkpt * dev->param.chunks_per_block;
+        dev->n_erased_blocks -= dev->blocks_in_checkpt;
+
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT,"checkpoint byte count %d",
+                dev->checkpt_byte_count);
+
+        if (dev->checkpt_buffer) {
+                /* free the buffer */
+                kfree(dev->checkpt_buffer);
+                dev->checkpt_buffer = NULL;
+                return 1;
+        } else {
+                return 0;
+        }
+}
+
+int yaffs2_checkpt_invalidate_stream(struct yaffs_dev *dev)
+{
+        /* Erase the checkpoint data */
+
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                "checkpoint invalidate of %d blocks",
+                dev->blocks_in_checkpt);
+
+        return yaffs_checkpt_erase(dev);
+}
diff --git a/fs/yaffs2/yaffs_checkptrw.h b/fs/yaffs2/yaffs_checkptrw.h
new file mode 100644
index 00000000000..361c6067717
--- /dev/null
+++ b/fs/yaffs2/yaffs_checkptrw.h
@@ -0,0 +1,33 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_CHECKPTRW_H__
+#define __YAFFS_CHECKPTRW_H__
+
+#include "yaffs_guts.h"
+
+int yaffs2_checkpt_open(struct yaffs_dev *dev, int writing);
+
+int yaffs2_checkpt_wr(struct yaffs_dev *dev, const void *data, int n_bytes);
+
+int yaffs2_checkpt_rd(struct yaffs_dev *dev, void *data, int n_bytes);
+
+int yaffs2_get_checkpt_sum(struct yaffs_dev *dev, u32 * sum);
+
+int yaffs_checkpt_close(struct yaffs_dev *dev);
+
+int yaffs2_checkpt_invalidate_stream(struct yaffs_dev *dev);
+
+#endif
diff --git a/fs/yaffs2/yaffs_ecc.c b/fs/yaffs2/yaffs_ecc.c
new file mode 100644
index 00000000000..e95a8069a8c
--- /dev/null
+++ b/fs/yaffs2/yaffs_ecc.c
@@ -0,0 +1,298 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * This code implements the ECC algorithm used in SmartMedia.
+ *
+ * The ECC comprises 22 bits of parity information and is stuffed into 3 bytes.
+ * The two unused bit are set to 1.
+ * The ECC can correct single bit errors in a 256-byte page of data. Thus, two such ECC
+ * blocks are used on a 512-byte NAND page.
+ *
+ */
+
+/* Table generated by gen-ecc.c
+ * Using a table means we do not have to calculate p1..p4 and p1'..p4'
+ * for each byte of data. These are instead provided in a table in bits7..2.
+ * Bit 0 of each entry indicates whether the entry has an odd or even parity, and therefore
+ * this bytes influence on the line parity.
+ */
+
+#include "yportenv.h"
+
+#include "yaffs_ecc.h"
+
+static const unsigned char column_parity_table[] = {
+        0x00, 0x55, 0x59, 0x0c, 0x65, 0x30, 0x3c, 0x69,
+        0x69, 0x3c, 0x30, 0x65, 0x0c, 0x59, 0x55, 0x00,
+        0x95, 0xc0, 0xcc, 0x99, 0xf0, 0xa5, 0xa9, 0xfc,
+        0xfc, 0xa9, 0xa5, 0xf0, 0x99, 0xcc, 0xc0, 0x95,
+        0x99, 0xcc, 0xc0, 0x95, 0xfc, 0xa9, 0xa5, 0xf0,
+        0xf0, 0xa5, 0xa9, 0xfc, 0x95, 0xc0, 0xcc, 0x99,
+        0x0c, 0x59, 0x55, 0x00, 0x69, 0x3c, 0x30, 0x65,
+        0x65, 0x30, 0x3c, 0x69, 0x00, 0x55, 0x59, 0x0c,
+        0xa5, 0xf0, 0xfc, 0xa9, 0xc0, 0x95, 0x99, 0xcc,
+        0xcc, 0x99, 0x95, 0xc0, 0xa9, 0xfc, 0xf0, 0xa5,
+        0x30, 0x65, 0x69, 0x3c, 0x55, 0x00, 0x0c, 0x59,
+        0x59, 0x0c, 0x00, 0x55, 0x3c, 0x69, 0x65, 0x30,
+        0x3c, 0x69, 0x65, 0x30, 0x59, 0x0c, 0x00, 0x55,
+        0x55, 0x00, 0x0c, 0x59, 0x30, 0x65, 0x69, 0x3c,
+        0xa9, 0xfc, 0xf0, 0xa5, 0xcc, 0x99, 0x95, 0xc0,
+        0xc0, 0x95, 0x99, 0xcc, 0xa5, 0xf0, 0xfc, 0xa9,
+        0xa9, 0xfc, 0xf0, 0xa5, 0xcc, 0x99, 0x95, 0xc0,
+        0xc0, 0x95, 0x99, 0xcc, 0xa5, 0xf0, 0xfc, 0xa9,
+        0x3c, 0x69, 0x65, 0x30, 0x59, 0x0c, 0x00, 0x55,
+        0x55, 0x00, 0x0c, 0x59, 0x30, 0x65, 0x69, 0x3c,
+        0x30, 0x65, 0x69, 0x3c, 0x55, 0x00, 0x0c, 0x59,
+        0x59, 0x0c, 0x00, 0x55, 0x3c, 0x69, 0x65, 0x30,
+        0xa5, 0xf0, 0xfc, 0xa9, 0xc0, 0x95, 0x99, 0xcc,
+        0xcc, 0x99, 0x95, 0xc0, 0xa9, 0xfc, 0xf0, 0xa5,
+        0x0c, 0x59, 0x55, 0x00, 0x69, 0x3c, 0x30, 0x65,
+        0x65, 0x30, 0x3c, 0x69, 0x00, 0x55, 0x59, 0x0c,
+        0x99, 0xcc, 0xc0, 0x95, 0xfc, 0xa9, 0xa5, 0xf0,
+        0xf0, 0xa5, 0xa9, 0xfc, 0x95, 0xc0, 0xcc, 0x99,
+        0x95, 0xc0, 0xcc, 0x99, 0xf0, 0xa5, 0xa9, 0xfc,
+        0xfc, 0xa9, 0xa5, 0xf0, 0x99, 0xcc, 0xc0, 0x95,
+        0x00, 0x55, 0x59, 0x0c, 0x65, 0x30, 0x3c, 0x69,
+        0x69, 0x3c, 0x30, 0x65, 0x0c, 0x59, 0x55, 0x00,
+};
+
+
+/* Calculate the ECC for a 256-byte block of data */
+void yaffs_ecc_cacl(const unsigned char *data, unsigned char *ecc)
+{
+        unsigned int i;
+
+        unsigned char col_parity = 0;
+        unsigned char line_parity = 0;
+        unsigned char line_parity_prime = 0;
+        unsigned char t;
+        unsigned char b;
+
+        for (i = 0; i < 256; i++) {
+                b = column_parity_table[*data++];
+                col_parity ^= b;
+
+                if (b & 0x01) { /* odd number of bits in the byte */
+                        line_parity ^= i;
+                        line_parity_prime ^= ~i;
+                }
+        }
+
+        ecc[2] = (~col_parity) | 0x03;
+
+        t = 0;
+        if (line_parity & 0x80)
+                t |= 0x80;
+        if (line_parity_prime & 0x80)
+                t |= 0x40;
+        if (line_parity & 0x40)
+                t |= 0x20;
+        if (line_parity_prime & 0x40)
+                t |= 0x10;
+        if (line_parity & 0x20)
+                t |= 0x08;
+        if (line_parity_prime & 0x20)
+                t |= 0x04;
+        if (line_parity & 0x10)
+                t |= 0x02;
+        if (line_parity_prime & 0x10)
+                t |= 0x01;
+        ecc[1] = ~t;
+
+        t = 0;
+        if (line_parity & 0x08)
+                t |= 0x80;
+        if (line_parity_prime & 0x08)
+                t |= 0x40;
+        if (line_parity & 0x04)
+                t |= 0x20;
+        if (line_parity_prime & 0x04)
+                t |= 0x10;
+        if (line_parity & 0x02)
+                t |= 0x08;
+        if (line_parity_prime & 0x02)
+                t |= 0x04;
+        if (line_parity & 0x01)
+                t |= 0x02;
+        if (line_parity_prime & 0x01)
+                t |= 0x01;
+        ecc[0] = ~t;
+
+#ifdef CONFIG_YAFFS_ECC_WRONG_ORDER
+        /* Swap the bytes into the wrong order */
+        t = ecc[0];
+        ecc[0] = ecc[1];
+        ecc[1] = t;
+#endif
+}
+
+/* Correct the ECC on a 256 byte block of data */
+
+int yaffs_ecc_correct(unsigned char *data, unsigned char *read_ecc,
+                      const unsigned char *test_ecc)
+{
+        unsigned char d0, d1, d2;       /* deltas */
+
+        d0 = read_ecc[0] ^ test_ecc[0];
+        d1 = read_ecc[1] ^ test_ecc[1];
+        d2 = read_ecc[2] ^ test_ecc[2];
+
+        if ((d0 | d1 | d2) == 0)
+                return 0;       /* no error */
+
+        if (((d0 ^ (d0 >> 1)) & 0x55) == 0x55 &&
+            ((d1 ^ (d1 >> 1)) & 0x55) == 0x55 &&
+            ((d2 ^ (d2 >> 1)) & 0x54) == 0x54) {
+                /* Single bit (recoverable) error in data */
+
+                unsigned byte;
+                unsigned bit;
+
+#ifdef CONFIG_YAFFS_ECC_WRONG_ORDER
+                /* swap the bytes to correct for the wrong order */
+                unsigned char t;
+
+                t = d0;
+                d0 = d1;
+                d1 = t;
+#endif
+
+                bit = byte = 0;
+
+                if (d1 & 0x80)
+                        byte |= 0x80;
+                if (d1 & 0x20)
+                        byte |= 0x40;
+                if (d1 & 0x08)
+                        byte |= 0x20;
+                if (d1 & 0x02)
+                        byte |= 0x10;
+                if (d0 & 0x80)
+                        byte |= 0x08;
+                if (d0 & 0x20)
+                        byte |= 0x04;
+                if (d0 & 0x08)
+                        byte |= 0x02;
+                if (d0 & 0x02)
+                        byte |= 0x01;
+
+                if (d2 & 0x80)
+                        bit |= 0x04;
+                if (d2 & 0x20)
+                        bit |= 0x02;
+                if (d2 & 0x08)
+                        bit |= 0x01;
+
+                data[byte] ^= (1 << bit);
+
+                return 1;       /* Corrected the error */
+        }
+
+        if ((hweight8(d0) + hweight8(d1) + hweight8(d2)) == 1) {
+                /* Reccoverable error in ecc */
+
+                read_ecc[0] = test_ecc[0];
+                read_ecc[1] = test_ecc[1];
+                read_ecc[2] = test_ecc[2];
+
+                return 1;       /* Corrected the error */
+        }
+
+        /* Unrecoverable error */
+
+        return -1;
+
+}
+
+/*
+ * ECCxxxOther does ECC calcs on arbitrary n bytes of data
+ */
+void yaffs_ecc_calc_other(const unsigned char *data, unsigned n_bytes,
+                          struct yaffs_ecc_other *ecc_other)
+{
+        unsigned int i;
+
+        unsigned char col_parity = 0;
+        unsigned line_parity = 0;
+        unsigned line_parity_prime = 0;
+        unsigned char b;
+
+        for (i = 0; i < n_bytes; i++) {
+                b = column_parity_table[*data++];
+                col_parity ^= b;
+
+                if (b & 0x01) {
+                        /* odd number of bits in the byte */
+                        line_parity ^= i;
+                        line_parity_prime ^= ~i;
+                }
+
+        }
+
+        ecc_other->col_parity = (col_parity >> 2) & 0x3f;
+        ecc_other->line_parity = line_parity;
+        ecc_other->line_parity_prime = line_parity_prime;
+}
+
+int yaffs_ecc_correct_other(unsigned char *data, unsigned n_bytes,
+                            struct yaffs_ecc_other *read_ecc,
+                            const struct yaffs_ecc_other *test_ecc)
+{
+        unsigned char delta_col;        /* column parity delta */
+        unsigned delta_line;    /* line parity delta */
+        unsigned delta_line_prime;      /* line parity delta */
+        unsigned bit;
+
+        delta_col = read_ecc->col_parity ^ test_ecc->col_parity;
+        delta_line = read_ecc->line_parity ^ test_ecc->line_parity;
+        delta_line_prime =
+            read_ecc->line_parity_prime ^ test_ecc->line_parity_prime;
+
+        if ((delta_col | delta_line | delta_line_prime) == 0)
+                return 0;       /* no error */
+
+        if (delta_line == ~delta_line_prime &&
+            (((delta_col ^ (delta_col >> 1)) & 0x15) == 0x15)) {
+                /* Single bit (recoverable) error in data */
+
+                bit = 0;
+
+                if (delta_col & 0x20)
+                        bit |= 0x04;
+                if (delta_col & 0x08)
+                        bit |= 0x02;
+                if (delta_col & 0x02)
+                        bit |= 0x01;
+
+                if (delta_line >= n_bytes)
+                        return -1;
+
+                data[delta_line] ^= (1 << bit);
+
+                return 1;       /* corrected */
+        }
+
+        if ((hweight32(delta_line) +
+             hweight32(delta_line_prime) +
+             hweight8(delta_col)) == 1) {
+                /* Reccoverable error in ecc */
+
+                *read_ecc = *test_ecc;
+                return 1;       /* corrected */
+        }
+
+        /* Unrecoverable error */
+
+        return -1;
+}
diff --git a/fs/yaffs2/yaffs_ecc.h b/fs/yaffs2/yaffs_ecc.h
new file mode 100644
index 00000000000..b0c461d699e
--- /dev/null
+++ b/fs/yaffs2/yaffs_ecc.h
@@ -0,0 +1,44 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+/*
+ * This code implements the ECC algorithm used in SmartMedia.
+ *
+ * The ECC comprises 22 bits of parity information and is stuffed into 3 bytes.
+ * The two unused bit are set to 1.
+ * The ECC can correct single bit errors in a 256-byte page of data. Thus, two such ECC
+ * blocks are used on a 512-byte NAND page.
+ *
+ */
+
+#ifndef __YAFFS_ECC_H__
+#define __YAFFS_ECC_H__
+
+struct yaffs_ecc_other {
+        unsigned char col_parity;
+        unsigned line_parity;
+        unsigned line_parity_prime;
+};
+
+void yaffs_ecc_cacl(const unsigned char *data, unsigned char *ecc);
+int yaffs_ecc_correct(unsigned char *data, unsigned char *read_ecc,
+                      const unsigned char *test_ecc);
+
+void yaffs_ecc_calc_other(const unsigned char *data, unsigned n_bytes,
+                          struct yaffs_ecc_other *ecc);
+int yaffs_ecc_correct_other(unsigned char *data, unsigned n_bytes,
+                            struct yaffs_ecc_other *read_ecc,
+                            const struct yaffs_ecc_other *test_ecc);
+#endif
diff --git a/fs/yaffs2/yaffs_getblockinfo.h b/fs/yaffs2/yaffs_getblockinfo.h
new file mode 100644
index 00000000000..d87acbde997
--- /dev/null
+++ b/fs/yaffs2/yaffs_getblockinfo.h
@@ -0,0 +1,35 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_GETBLOCKINFO_H__
+#define __YAFFS_GETBLOCKINFO_H__
+
+#include "yaffs_guts.h"
+#include "yaffs_trace.h"
+
+/* Function to manipulate block info */
+static inline struct yaffs_block_info *yaffs_get_block_info(struct yaffs_dev
+                                                              *dev, int blk)
+{
+        if (blk < dev->internal_start_block || blk > dev->internal_end_block) {
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                        "**>> yaffs: get_block_info block %d is not valid",
+                        blk);
+                YBUG();
+        }
+        return &dev->block_info[blk - dev->internal_start_block];
+}
+
+#endif
diff --git a/fs/yaffs2/yaffs_guts.c b/fs/yaffs2/yaffs_guts.c
new file mode 100644
index 00000000000..f4ae9deed72
--- /dev/null
+++ b/fs/yaffs2/yaffs_guts.c
@@ -0,0 +1,5164 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yportenv.h"
+#include "yaffs_trace.h"
+
+#include "yaffs_guts.h"
+#include "yaffs_tagsvalidity.h"
+#include "yaffs_getblockinfo.h"
+
+#include "yaffs_tagscompat.h"
+
+#include "yaffs_nand.h"
+
+#include "yaffs_yaffs1.h"
+#include "yaffs_yaffs2.h"
+#include "yaffs_bitmap.h"
+#include "yaffs_verify.h"
+
+#include "yaffs_nand.h"
+#include "yaffs_packedtags2.h"
+
+#include "yaffs_nameval.h"
+#include "yaffs_allocator.h"
+
+#include "yaffs_attribs.h"
+
+/* Note YAFFS_GC_GOOD_ENOUGH must be <= YAFFS_GC_PASSIVE_THRESHOLD */
+#define YAFFS_GC_GOOD_ENOUGH 2
+#define YAFFS_GC_PASSIVE_THRESHOLD 4
+
+#include "yaffs_ecc.h"
+
+/* Forward declarations */
+
+static int yaffs_wr_data_obj(struct yaffs_obj *in, int inode_chunk,
+                             const u8 * buffer, int n_bytes, int use_reserve);
+
+
+
+/* Function to calculate chunk and offset */
+
+static void yaffs_addr_to_chunk(struct yaffs_dev *dev, loff_t addr,
+                                int *chunk_out, u32 * offset_out)
+{
+        int chunk;
+        u32 offset;
+
+        chunk = (u32) (addr >> dev->chunk_shift);
+
+        if (dev->chunk_div == 1) {
+                /* easy power of 2 case */
+                offset = (u32) (addr & dev->chunk_mask);
+        } else {
+                /* Non power-of-2 case */
+
+                loff_t chunk_base;
+
+                chunk /= dev->chunk_div;
+
+                chunk_base = ((loff_t) chunk) * dev->data_bytes_per_chunk;
+                offset = (u32) (addr - chunk_base);
+        }
+
+        *chunk_out = chunk;
+        *offset_out = offset;
+}
+
+/* Function to return the number of shifts for a power of 2 greater than or
+ * equal to the given number
+ * Note we don't try to cater for all possible numbers and this does not have to
+ * be hellishly efficient.
+ */
+
+static u32 calc_shifts_ceiling(u32 x)
+{
+        int extra_bits;
+        int shifts;
+
+        shifts = extra_bits = 0;
+
+        while (x > 1) {
+                if (x & 1)
+                        extra_bits++;
+                x >>= 1;
+                shifts++;
+        }
+
+        if (extra_bits)
+                shifts++;
+
+        return shifts;
+}
+
+/* Function to return the number of shifts to get a 1 in bit 0
+ */
+
+static u32 calc_shifts(u32 x)
+{
+        u32 shifts;
+
+        shifts = 0;
+
+        if (!x)
+                return 0;
+
+        while (!(x & 1)) {
+                x >>= 1;
+                shifts++;
+        }
+
+        return shifts;
+}
+
+/*
+ * Temporary buffer manipulations.
+ */
+
+static int yaffs_init_tmp_buffers(struct yaffs_dev *dev)
+{
+        int i;
+        u8 *buf = (u8 *) 1;
+
+        memset(dev->temp_buffer, 0, sizeof(dev->temp_buffer));
+
+        for (i = 0; buf && i < YAFFS_N_TEMP_BUFFERS; i++) {
+                dev->temp_buffer[i].line = 0;   /* not in use */
+                dev->temp_buffer[i].buffer = buf =
+                    kmalloc(dev->param.total_bytes_per_chunk, GFP_NOFS);
+        }
+
+        return buf ? YAFFS_OK : YAFFS_FAIL;
+}
+
+u8 *yaffs_get_temp_buffer(struct yaffs_dev * dev, int line_no)
+{
+        int i, j;
+
+        dev->temp_in_use++;
+        if (dev->temp_in_use > dev->max_temp)
+                dev->max_temp = dev->temp_in_use;
+
+        for (i = 0; i < YAFFS_N_TEMP_BUFFERS; i++) {
+                if (dev->temp_buffer[i].line == 0) {
+                        dev->temp_buffer[i].line = line_no;
+                        if ((i + 1) > dev->max_temp) {
+                                dev->max_temp = i + 1;
+                                for (j = 0; j <= i; j++)
+                                        dev->temp_buffer[j].max_line =
+                                            dev->temp_buffer[j].line;
+                        }
+
+                        return dev->temp_buffer[i].buffer;
+                }
+        }
+
+        yaffs_trace(YAFFS_TRACE_BUFFERS,
+                "Out of temp buffers at line %d, other held by lines:",
+                line_no);
+        for (i = 0; i < YAFFS_N_TEMP_BUFFERS; i++)
+                yaffs_trace(YAFFS_TRACE_BUFFERS," %d", dev->temp_buffer[i].line);
+
+        /*
+         * If we got here then we have to allocate an unmanaged one
+         * This is not good.
+         */
+
+        dev->unmanaged_buffer_allocs++;
+        return kmalloc(dev->data_bytes_per_chunk, GFP_NOFS);
+
+}
+
+void yaffs_release_temp_buffer(struct yaffs_dev *dev, u8 * buffer, int line_no)
+{
+        int i;
+
+        dev->temp_in_use--;
+
+        for (i = 0; i < YAFFS_N_TEMP_BUFFERS; i++) {
+                if (dev->temp_buffer[i].buffer == buffer) {
+                        dev->temp_buffer[i].line = 0;
+                        return;
+                }
+        }
+
+        if (buffer) {
+                /* assume it is an unmanaged one. */
+                yaffs_trace(YAFFS_TRACE_BUFFERS,
+                  "Releasing unmanaged temp buffer in line %d",
+                   line_no);
+                kfree(buffer);
+                dev->unmanaged_buffer_deallocs++;
+        }
+
+}
+
+/*
+ * Determine if we have a managed buffer.
+ */
+int yaffs_is_managed_tmp_buffer(struct yaffs_dev *dev, const u8 * buffer)
+{
+        int i;
+
+        for (i = 0; i < YAFFS_N_TEMP_BUFFERS; i++) {
+                if (dev->temp_buffer[i].buffer == buffer)
+                        return 1;
+        }
+
+        for (i = 0; i < dev->param.n_caches; i++) {
+                if (dev->cache[i].data == buffer)
+                        return 1;
+        }
+
+        if (buffer == dev->checkpt_buffer)
+                return 1;
+
+        yaffs_trace(YAFFS_TRACE_ALWAYS,
+          "yaffs: unmaged buffer detected.");
+        return 0;
+}
+
+/*
+ * Functions for robustisizing TODO
+ *
+ */
+
+static void yaffs_handle_chunk_wr_ok(struct yaffs_dev *dev, int nand_chunk,
+                                     const u8 * data,
+                                     const struct yaffs_ext_tags *tags)
+{
+        dev = dev;
+        nand_chunk = nand_chunk;
+        data = data;
+        tags = tags;
+}
+
+static void yaffs_handle_chunk_update(struct yaffs_dev *dev, int nand_chunk,
+                                      const struct yaffs_ext_tags *tags)
+{
+        dev = dev;
+        nand_chunk = nand_chunk;
+        tags = tags;
+}
+
+void yaffs_handle_chunk_error(struct yaffs_dev *dev,
+                              struct yaffs_block_info *bi)
+{
+        if (!bi->gc_prioritise) {
+                bi->gc_prioritise = 1;
+                dev->has_pending_prioritised_gc = 1;
+                bi->chunk_error_strikes++;
+
+                if (bi->chunk_error_strikes > 3) {
+                        bi->needs_retiring = 1; /* Too many stikes, so retire this */
+                        yaffs_trace(YAFFS_TRACE_ALWAYS, "yaffs: Block struck out");
+
+                }
+        }
+}
+
+static void yaffs_handle_chunk_wr_error(struct yaffs_dev *dev, int nand_chunk,
+                                        int erased_ok)
+{
+        int flash_block = nand_chunk / dev->param.chunks_per_block;
+        struct yaffs_block_info *bi = yaffs_get_block_info(dev, flash_block);
+
+        yaffs_handle_chunk_error(dev, bi);
+
+        if (erased_ok) {
+                /* Was an actual write failure, so mark the block for retirement  */
+                bi->needs_retiring = 1;
+                yaffs_trace(YAFFS_TRACE_ERROR | YAFFS_TRACE_BAD_BLOCKS,
+                  "**>> Block %d needs retiring", flash_block);
+        }
+
+        /* Delete the chunk */
+        yaffs_chunk_del(dev, nand_chunk, 1, __LINE__);
+        yaffs_skip_rest_of_block(dev);
+}
+
+/*
+ * Verification code
+ */
+
+/*
+ *  Simple hash function. Needs to have a reasonable spread
+ */
+
+static inline int yaffs_hash_fn(int n)
+{
+        n = abs(n);
+        return n % YAFFS_NOBJECT_BUCKETS;
+}
+
+/*
+ * Access functions to useful fake objects.
+ * Note that root might have a presence in NAND if permissions are set.
+ */
+
+struct yaffs_obj *yaffs_root(struct yaffs_dev *dev)
+{
+        return dev->root_dir;
+}
+
+struct yaffs_obj *yaffs_lost_n_found(struct yaffs_dev *dev)
+{
+        return dev->lost_n_found;
+}
+
+/*
+ *  Erased NAND checking functions
+ */
+
+int yaffs_check_ff(u8 * buffer, int n_bytes)
+{
+        /* Horrible, slow implementation */
+        while (n_bytes--) {
+                if (*buffer != 0xFF)
+                        return 0;
+                buffer++;
+        }
+        return 1;
+}
+
+static int yaffs_check_chunk_erased(struct yaffs_dev *dev, int nand_chunk)
+{
+        int retval = YAFFS_OK;
+        u8 *data = yaffs_get_temp_buffer(dev, __LINE__);
+        struct yaffs_ext_tags tags;
+        int result;
+
+        result = yaffs_rd_chunk_tags_nand(dev, nand_chunk, data, &tags);
+
+        if (tags.ecc_result > YAFFS_ECC_RESULT_NO_ERROR)
+                retval = YAFFS_FAIL;
+
+        if (!yaffs_check_ff(data, dev->data_bytes_per_chunk) ||
+                tags.chunk_used) {
+                yaffs_trace(YAFFS_TRACE_NANDACCESS, "Chunk %d not erased", nand_chunk);
+                retval = YAFFS_FAIL;
+        }
+
+        yaffs_release_temp_buffer(dev, data, __LINE__);
+
+        return retval;
+
+}
+
+static int yaffs_verify_chunk_written(struct yaffs_dev *dev,
+                                      int nand_chunk,
+                                      const u8 * data,
+                                      struct yaffs_ext_tags *tags)
+{
+        int retval = YAFFS_OK;
+        struct yaffs_ext_tags temp_tags;
+        u8 *buffer = yaffs_get_temp_buffer(dev, __LINE__);
+        int result;
+
+        result = yaffs_rd_chunk_tags_nand(dev, nand_chunk, buffer, &temp_tags);
+        if (memcmp(buffer, data, dev->data_bytes_per_chunk) ||
+            temp_tags.obj_id != tags->obj_id ||
+            temp_tags.chunk_id != tags->chunk_id ||
+            temp_tags.n_bytes != tags->n_bytes)
+                retval = YAFFS_FAIL;
+
+        yaffs_release_temp_buffer(dev, buffer, __LINE__);
+
+        return retval;
+}
+
+
+int yaffs_check_alloc_available(struct yaffs_dev *dev, int n_chunks)
+{
+        int reserved_chunks;
+        int reserved_blocks = dev->param.n_reserved_blocks;
+        int checkpt_blocks;
+
+        checkpt_blocks = yaffs_calc_checkpt_blocks_required(dev);
+
+        reserved_chunks =
+            ((reserved_blocks + checkpt_blocks) * dev->param.chunks_per_block);
+
+        return (dev->n_free_chunks > (reserved_chunks + n_chunks));
+}
+
+static int yaffs_find_alloc_block(struct yaffs_dev *dev)
+{
+        int i;
+
+        struct yaffs_block_info *bi;
+
+        if (dev->n_erased_blocks < 1) {
+                /* Hoosterman we've got a problem.
+                 * Can't get space to gc
+                 */
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                  "yaffs tragedy: no more erased blocks" );
+
+                return -1;
+        }
+
+        /* Find an empty block. */
+
+        for (i = dev->internal_start_block; i <= dev->internal_end_block; i++) {
+                dev->alloc_block_finder++;
+                if (dev->alloc_block_finder < dev->internal_start_block
+                    || dev->alloc_block_finder > dev->internal_end_block) {
+                        dev->alloc_block_finder = dev->internal_start_block;
+                }
+
+                bi = yaffs_get_block_info(dev, dev->alloc_block_finder);
+
+                if (bi->block_state == YAFFS_BLOCK_STATE_EMPTY) {
+                        bi->block_state = YAFFS_BLOCK_STATE_ALLOCATING;
+                        dev->seq_number++;
+                        bi->seq_number = dev->seq_number;
+                        dev->n_erased_blocks--;
+                        yaffs_trace(YAFFS_TRACE_ALLOCATE,
+                          "Allocated block %d, seq  %d, %d left" ,
+                           dev->alloc_block_finder, dev->seq_number,
+                           dev->n_erased_blocks);
+                        return dev->alloc_block_finder;
+                }
+        }
+
+        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                "yaffs tragedy: no more erased blocks, but there should have been %d",
+                dev->n_erased_blocks);
+
+        return -1;
+}
+
+static int yaffs_alloc_chunk(struct yaffs_dev *dev, int use_reserver,
+                             struct yaffs_block_info **block_ptr)
+{
+        int ret_val;
+        struct yaffs_block_info *bi;
+
+        if (dev->alloc_block < 0) {
+                /* Get next block to allocate off */
+                dev->alloc_block = yaffs_find_alloc_block(dev);
+                dev->alloc_page = 0;
+        }
+
+        if (!use_reserver && !yaffs_check_alloc_available(dev, 1)) {
+                /* Not enough space to allocate unless we're allowed to use the reserve. */
+                return -1;
+        }
+
+        if (dev->n_erased_blocks < dev->param.n_reserved_blocks
+            && dev->alloc_page == 0)
+                yaffs_trace(YAFFS_TRACE_ALLOCATE, "Allocating reserve");
+
+        /* Next page please.... */
+        if (dev->alloc_block >= 0) {
+                bi = yaffs_get_block_info(dev, dev->alloc_block);
+
+                ret_val = (dev->alloc_block * dev->param.chunks_per_block) +
+                    dev->alloc_page;
+                bi->pages_in_use++;
+                yaffs_set_chunk_bit(dev, dev->alloc_block, dev->alloc_page);
+
+                dev->alloc_page++;
+
+                dev->n_free_chunks--;
+
+                /* If the block is full set the state to full */
+                if (dev->alloc_page >= dev->param.chunks_per_block) {
+                        bi->block_state = YAFFS_BLOCK_STATE_FULL;
+                        dev->alloc_block = -1;
+                }
+
+                if (block_ptr)
+                        *block_ptr = bi;
+
+                return ret_val;
+        }
+
+        yaffs_trace(YAFFS_TRACE_ERROR, "!!!!!!!!! Allocator out !!!!!!!!!!!!!!!!!" );
+
+        return -1;
+}
+
+static int yaffs_get_erased_chunks(struct yaffs_dev *dev)
+{
+        int n;
+
+        n = dev->n_erased_blocks * dev->param.chunks_per_block;
+
+        if (dev->alloc_block > 0)
+                n += (dev->param.chunks_per_block - dev->alloc_page);
+
+        return n;
+
+}
+
+/*
+ * yaffs_skip_rest_of_block() skips over the rest of the allocation block
+ * if we don't want to write to it.
+ */
+void yaffs_skip_rest_of_block(struct yaffs_dev *dev)
+{
+        if (dev->alloc_block > 0) {
+                struct yaffs_block_info *bi =
+                    yaffs_get_block_info(dev, dev->alloc_block);
+                if (bi->block_state == YAFFS_BLOCK_STATE_ALLOCATING) {
+                        bi->block_state = YAFFS_BLOCK_STATE_FULL;
+                        dev->alloc_block = -1;
+                }
+        }
+}
+
+static int yaffs_write_new_chunk(struct yaffs_dev *dev,
+                                 const u8 * data,
+                                 struct yaffs_ext_tags *tags, int use_reserver)
+{
+        int attempts = 0;
+        int write_ok = 0;
+        int chunk;
+
+        yaffs2_checkpt_invalidate(dev);
+
+        do {
+                struct yaffs_block_info *bi = 0;
+                int erased_ok = 0;
+
+                chunk = yaffs_alloc_chunk(dev, use_reserver, &bi);
+                if (chunk < 0) {
+                        /* no space */
+                        break;
+                }
+
+                /* First check this chunk is erased, if it needs
+                 * checking.  The checking policy (unless forced
+                 * always on) is as follows:
+                 *
+                 * Check the first page we try to write in a block.
+                 * If the check passes then we don't need to check any
+                 * more.        If the check fails, we check again...
+                 * If the block has been erased, we don't need to check.
+                 *
+                 * However, if the block has been prioritised for gc,
+                 * then we think there might be something odd about
+                 * this block and stop using it.
+                 *
+                 * Rationale: We should only ever see chunks that have
+                 * not been erased if there was a partially written
+                 * chunk due to power loss.  This checking policy should
+                 * catch that case with very few checks and thus save a
+                 * lot of checks that are most likely not needed.
+                 *
+                 * Mods to the above
+                 * If an erase check fails or the write fails we skip the 
+                 * rest of the block.
+                 */
+
+                /* let's give it a try */
+                attempts++;
+
+                if (dev->param.always_check_erased)
+                        bi->skip_erased_check = 0;
+
+                if (!bi->skip_erased_check) {
+                        erased_ok = yaffs_check_chunk_erased(dev, chunk);
+                        if (erased_ok != YAFFS_OK) {
+                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                  "**>> yaffs chunk %d was not erased",
+                                  chunk);
+
+                                /* If not erased, delete this one,
+                                 * skip rest of block and
+                                 * try another chunk */
+                                yaffs_chunk_del(dev, chunk, 1, __LINE__);
+                                yaffs_skip_rest_of_block(dev);
+                                continue;
+                        }
+                }
+
+                write_ok = yaffs_wr_chunk_tags_nand(dev, chunk, data, tags);
+
+                if (!bi->skip_erased_check)
+                        write_ok =
+                            yaffs_verify_chunk_written(dev, chunk, data, tags);
+
+                if (write_ok != YAFFS_OK) {
+                        /* Clean up aborted write, skip to next block and
+                         * try another chunk */
+                        yaffs_handle_chunk_wr_error(dev, chunk, erased_ok);
+                        continue;
+                }
+
+                bi->skip_erased_check = 1;
+
+                /* Copy the data into the robustification buffer */
+                yaffs_handle_chunk_wr_ok(dev, chunk, data, tags);
+
+        } while (write_ok != YAFFS_OK &&
+                 (yaffs_wr_attempts <= 0 || attempts <= yaffs_wr_attempts));
+
+        if (!write_ok)
+                chunk = -1;
+
+        if (attempts > 1) {
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                        "**>> yaffs write required %d attempts",
+                        attempts);
+                dev->n_retired_writes += (attempts - 1);
+        }
+
+        return chunk;
+}
+
+/*
+ * Block retiring for handling a broken block.
+ */
+
+static void yaffs_retire_block(struct yaffs_dev *dev, int flash_block)
+{
+        struct yaffs_block_info *bi = yaffs_get_block_info(dev, flash_block);
+
+        yaffs2_checkpt_invalidate(dev);
+
+        yaffs2_clear_oldest_dirty_seq(dev, bi);
+
+        if (yaffs_mark_bad(dev, flash_block) != YAFFS_OK) {
+                if (yaffs_erase_block(dev, flash_block) != YAFFS_OK) {
+                        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                                "yaffs: Failed to mark bad and erase block %d",
+                                flash_block);
+                } else {
+                        struct yaffs_ext_tags tags;
+                        int chunk_id =
+                            flash_block * dev->param.chunks_per_block;
+
+                        u8 *buffer = yaffs_get_temp_buffer(dev, __LINE__);
+
+                        memset(buffer, 0xff, dev->data_bytes_per_chunk);
+                        yaffs_init_tags(&tags);
+                        tags.seq_number = YAFFS_SEQUENCE_BAD_BLOCK;
+                        if (dev->param.write_chunk_tags_fn(dev, chunk_id -
+                                                           dev->chunk_offset,
+                                                           buffer,
+                                                           &tags) != YAFFS_OK)
+                                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                                        "yaffs: Failed to write bad block marker to block %d",
+                                        flash_block);
+
+                        yaffs_release_temp_buffer(dev, buffer, __LINE__);
+                }
+        }
+
+        bi->block_state = YAFFS_BLOCK_STATE_DEAD;
+        bi->gc_prioritise = 0;
+        bi->needs_retiring = 0;
+
+        dev->n_retired_blocks++;
+}
+
+/*---------------- Name handling functions ------------*/
+
+static u16 yaffs_calc_name_sum(const YCHAR * name)
+{
+        u16 sum = 0;
+        u16 i = 1;
+
+        const YUCHAR *bname = (const YUCHAR *)name;
+        if (bname) {
+                while ((*bname) && (i < (YAFFS_MAX_NAME_LENGTH / 2))) {
+
+                        /* 0x1f mask is case insensitive */
+                        sum += ((*bname) & 0x1f) * i;
+                        i++;
+                        bname++;
+                }
+        }
+        return sum;
+}
+
+void yaffs_set_obj_name(struct yaffs_obj *obj, const YCHAR * name)
+{
+#ifndef CONFIG_YAFFS_NO_SHORT_NAMES
+        memset(obj->short_name, 0, sizeof(obj->short_name));
+        if (name && 
+                strnlen(name, YAFFS_SHORT_NAME_LENGTH + 1) <=
+            YAFFS_SHORT_NAME_LENGTH)
+                strcpy(obj->short_name, name);
+        else
+                obj->short_name[0] = _Y('\0');
+#endif
+        obj->sum = yaffs_calc_name_sum(name);
+}
+
+void yaffs_set_obj_name_from_oh(struct yaffs_obj *obj,
+                                const struct yaffs_obj_hdr *oh)
+{
+#ifdef CONFIG_YAFFS_AUTO_UNICODE
+        YCHAR tmp_name[YAFFS_MAX_NAME_LENGTH + 1];
+        memset(tmp_name, 0, sizeof(tmp_name));
+        yaffs_load_name_from_oh(obj->my_dev, tmp_name, oh->name,
+                                YAFFS_MAX_NAME_LENGTH + 1);
+        yaffs_set_obj_name(obj, tmp_name);
+#else
+        yaffs_set_obj_name(obj, oh->name);
+#endif
+}
+
+/*-------------------- TNODES -------------------
+
+ * List of spare tnodes
+ * The list is hooked together using the first pointer
+ * in the tnode.
+ */
+
+struct yaffs_tnode *yaffs_get_tnode(struct yaffs_dev *dev)
+{
+        struct yaffs_tnode *tn = yaffs_alloc_raw_tnode(dev);
+        if (tn) {
+                memset(tn, 0, dev->tnode_size);
+                dev->n_tnodes++;
+        }
+
+        dev->checkpoint_blocks_required = 0;    /* force recalculation */
+
+        return tn;
+}
+
+/* FreeTnode frees up a tnode and puts it back on the free list */
+static void yaffs_free_tnode(struct yaffs_dev *dev, struct yaffs_tnode *tn)
+{
+        yaffs_free_raw_tnode(dev, tn);
+        dev->n_tnodes--;
+        dev->checkpoint_blocks_required = 0;    /* force recalculation */
+}
+
+static void yaffs_deinit_tnodes_and_objs(struct yaffs_dev *dev)
+{
+        yaffs_deinit_raw_tnodes_and_objs(dev);
+        dev->n_obj = 0;
+        dev->n_tnodes = 0;
+}
+
+void yaffs_load_tnode_0(struct yaffs_dev *dev, struct yaffs_tnode *tn,
+                        unsigned pos, unsigned val)
+{
+        u32 *map = (u32 *) tn;
+        u32 bit_in_map;
+        u32 bit_in_word;
+        u32 word_in_map;
+        u32 mask;
+
+        pos &= YAFFS_TNODES_LEVEL0_MASK;
+        val >>= dev->chunk_grp_bits;
+
+        bit_in_map = pos * dev->tnode_width;
+        word_in_map = bit_in_map / 32;
+        bit_in_word = bit_in_map & (32 - 1);
+
+        mask = dev->tnode_mask << bit_in_word;
+
+        map[word_in_map] &= ~mask;
+        map[word_in_map] |= (mask & (val << bit_in_word));
+
+        if (dev->tnode_width > (32 - bit_in_word)) {
+                bit_in_word = (32 - bit_in_word);
+                word_in_map++;;
+                mask =
+                    dev->tnode_mask >> ( /*dev->tnode_width - */ bit_in_word);
+                map[word_in_map] &= ~mask;
+                map[word_in_map] |= (mask & (val >> bit_in_word));
+        }
+}
+
+u32 yaffs_get_group_base(struct yaffs_dev *dev, struct yaffs_tnode *tn,
+                         unsigned pos)
+{
+        u32 *map = (u32 *) tn;
+        u32 bit_in_map;
+        u32 bit_in_word;
+        u32 word_in_map;
+        u32 val;
+
+        pos &= YAFFS_TNODES_LEVEL0_MASK;
+
+        bit_in_map = pos * dev->tnode_width;
+        word_in_map = bit_in_map / 32;
+        bit_in_word = bit_in_map & (32 - 1);
+
+        val = map[word_in_map] >> bit_in_word;
+
+        if (dev->tnode_width > (32 - bit_in_word)) {
+                bit_in_word = (32 - bit_in_word);
+                word_in_map++;;
+                val |= (map[word_in_map] << bit_in_word);
+        }
+
+        val &= dev->tnode_mask;
+        val <<= dev->chunk_grp_bits;
+
+        return val;
+}
+
+/* ------------------- End of individual tnode manipulation -----------------*/
+
+/* ---------Functions to manipulate the look-up tree (made up of tnodes) ------
+ * The look up tree is represented by the top tnode and the number of top_level
+ * in the tree. 0 means only the level 0 tnode is in the tree.
+ */
+
+/* FindLevel0Tnode finds the level 0 tnode, if one exists. */
+struct yaffs_tnode *yaffs_find_tnode_0(struct yaffs_dev *dev,
+                                       struct yaffs_file_var *file_struct,
+                                       u32 chunk_id)
+{
+        struct yaffs_tnode *tn = file_struct->top;
+        u32 i;
+        int required_depth;
+        int level = file_struct->top_level;
+
+        dev = dev;
+
+        /* Check sane level and chunk Id */
+        if (level < 0 || level > YAFFS_TNODES_MAX_LEVEL)
+                return NULL;
+
+        if (chunk_id > YAFFS_MAX_CHUNK_ID)
+                return NULL;
+
+        /* First check we're tall enough (ie enough top_level) */
+
+        i = chunk_id >> YAFFS_TNODES_LEVEL0_BITS;
+        required_depth = 0;
+        while (i) {
+                i >>= YAFFS_TNODES_INTERNAL_BITS;
+                required_depth++;
+        }
+
+        if (required_depth > file_struct->top_level)
+                return NULL;    /* Not tall enough, so we can't find it */
+
+        /* Traverse down to level 0 */
+        while (level > 0 && tn) {
+                tn = tn->internal[(chunk_id >>
+                                   (YAFFS_TNODES_LEVEL0_BITS +
+                                    (level - 1) *
+                                    YAFFS_TNODES_INTERNAL_BITS)) &
+                                  YAFFS_TNODES_INTERNAL_MASK];
+                level--;
+        }
+
+        return tn;
+}
+
+/* AddOrFindLevel0Tnode finds the level 0 tnode if it exists, otherwise first expands the tree.
+ * This happens in two steps:
+ *  1. If the tree isn't tall enough, then make it taller.
+ *  2. Scan down the tree towards the level 0 tnode adding tnodes if required.
+ *
+ * Used when modifying the tree.
+ *
+ *  If the tn argument is NULL, then a fresh tnode will be added otherwise the specified tn will
+ *  be plugged into the ttree.
+ */
+
+struct yaffs_tnode *yaffs_add_find_tnode_0(struct yaffs_dev *dev,
+                                           struct yaffs_file_var *file_struct,
+                                           u32 chunk_id,
+                                           struct yaffs_tnode *passed_tn)
+{
+        int required_depth;
+        int i;
+        int l;
+        struct yaffs_tnode *tn;
+
+        u32 x;
+
+        /* Check sane level and page Id */
+        if (file_struct->top_level < 0
+            || file_struct->top_level > YAFFS_TNODES_MAX_LEVEL)
+                return NULL;
+
+        if (chunk_id > YAFFS_MAX_CHUNK_ID)
+                return NULL;
+
+        /* First check we're tall enough (ie enough top_level) */
+
+        x = chunk_id >> YAFFS_TNODES_LEVEL0_BITS;
+        required_depth = 0;
+        while (x) {
+                x >>= YAFFS_TNODES_INTERNAL_BITS;
+                required_depth++;
+        }
+
+        if (required_depth > file_struct->top_level) {
+                /* Not tall enough, gotta make the tree taller */
+                for (i = file_struct->top_level; i < required_depth; i++) {
+
+                        tn = yaffs_get_tnode(dev);
+
+                        if (tn) {
+                                tn->internal[0] = file_struct->top;
+                                file_struct->top = tn;
+                                file_struct->top_level++;
+                        } else {
+                                yaffs_trace(YAFFS_TRACE_ERROR, "yaffs: no more tnodes");
+                                return NULL;
+                        }
+                }
+        }
+
+        /* Traverse down to level 0, adding anything we need */
+
+        l = file_struct->top_level;
+        tn = file_struct->top;
+
+        if (l > 0) {
+                while (l > 0 && tn) {
+                        x = (chunk_id >>
+                             (YAFFS_TNODES_LEVEL0_BITS +
+                              (l - 1) * YAFFS_TNODES_INTERNAL_BITS)) &
+                            YAFFS_TNODES_INTERNAL_MASK;
+
+                        if ((l > 1) && !tn->internal[x]) {
+                                /* Add missing non-level-zero tnode */
+                                tn->internal[x] = yaffs_get_tnode(dev);
+                                if (!tn->internal[x])
+                                        return NULL;
+                        } else if (l == 1) {
+                                /* Looking from level 1 at level 0 */
+                                if (passed_tn) {
+                                        /* If we already have one, then release it. */
+                                        if (tn->internal[x])
+                                                yaffs_free_tnode(dev,
+                                                                 tn->
+                                                                 internal[x]);
+                                        tn->internal[x] = passed_tn;
+
+                                } else if (!tn->internal[x]) {
+                                        /* Don't have one, none passed in */
+                                        tn->internal[x] = yaffs_get_tnode(dev);
+                                        if (!tn->internal[x])
+                                                return NULL;
+                                }
+                        }
+
+                        tn = tn->internal[x];
+                        l--;
+                }
+        } else {
+                /* top is level 0 */
+                if (passed_tn) {
+                        memcpy(tn, passed_tn,
+                               (dev->tnode_width * YAFFS_NTNODES_LEVEL0) / 8);
+                        yaffs_free_tnode(dev, passed_tn);
+                }
+        }
+
+        return tn;
+}
+
+static int yaffs_tags_match(const struct yaffs_ext_tags *tags, int obj_id,
+                            int chunk_obj)
+{
+        return (tags->chunk_id == chunk_obj &&
+                tags->obj_id == obj_id && !tags->is_deleted) ? 1 : 0;
+
+}
+
+static int yaffs_find_chunk_in_group(struct yaffs_dev *dev, int the_chunk,
+                                     struct yaffs_ext_tags *tags, int obj_id,
+                                     int inode_chunk)
+{
+        int j;
+
+        for (j = 0; the_chunk && j < dev->chunk_grp_size; j++) {
+                if (yaffs_check_chunk_bit
+                    (dev, the_chunk / dev->param.chunks_per_block,
+                     the_chunk % dev->param.chunks_per_block)) {
+
+                        if (dev->chunk_grp_size == 1)
+                                return the_chunk;
+                        else {
+                                yaffs_rd_chunk_tags_nand(dev, the_chunk, NULL,
+                                                         tags);
+                                if (yaffs_tags_match(tags, obj_id, inode_chunk)) {
+                                        /* found it; */
+                                        return the_chunk;
+                                }
+                        }
+                }
+                the_chunk++;
+        }
+        return -1;
+}
+
+static int yaffs_find_chunk_in_file(struct yaffs_obj *in, int inode_chunk,
+                                    struct yaffs_ext_tags *tags)
+{
+        /*Get the Tnode, then get the level 0 offset chunk offset */
+        struct yaffs_tnode *tn;
+        int the_chunk = -1;
+        struct yaffs_ext_tags local_tags;
+        int ret_val = -1;
+
+        struct yaffs_dev *dev = in->my_dev;
+
+        if (!tags) {
+                /* Passed a NULL, so use our own tags space */
+                tags = &local_tags;
+        }
+
+        tn = yaffs_find_tnode_0(dev, &in->variant.file_variant, inode_chunk);
+
+        if (tn) {
+                the_chunk = yaffs_get_group_base(dev, tn, inode_chunk);
+
+                ret_val =
+                    yaffs_find_chunk_in_group(dev, the_chunk, tags, in->obj_id,
+                                              inode_chunk);
+        }
+        return ret_val;
+}
+
+static int yaffs_find_del_file_chunk(struct yaffs_obj *in, int inode_chunk,
+                                     struct yaffs_ext_tags *tags)
+{
+        /* Get the Tnode, then get the level 0 offset chunk offset */
+        struct yaffs_tnode *tn;
+        int the_chunk = -1;
+        struct yaffs_ext_tags local_tags;
+
+        struct yaffs_dev *dev = in->my_dev;
+        int ret_val = -1;
+
+        if (!tags) {
+                /* Passed a NULL, so use our own tags space */
+                tags = &local_tags;
+        }
+
+        tn = yaffs_find_tnode_0(dev, &in->variant.file_variant, inode_chunk);
+
+        if (tn) {
+
+                the_chunk = yaffs_get_group_base(dev, tn, inode_chunk);
+
+                ret_val =
+                    yaffs_find_chunk_in_group(dev, the_chunk, tags, in->obj_id,
+                                              inode_chunk);
+
+                /* Delete the entry in the filestructure (if found) */
+                if (ret_val != -1)
+                        yaffs_load_tnode_0(dev, tn, inode_chunk, 0);
+        }
+
+        return ret_val;
+}
+
+int yaffs_put_chunk_in_file(struct yaffs_obj *in, int inode_chunk,
+                            int nand_chunk, int in_scan)
+{
+        /* NB in_scan is zero unless scanning.
+         * For forward scanning, in_scan is > 0;
+         * for backward scanning in_scan is < 0
+         *
+         * nand_chunk = 0 is a dummy insert to make sure the tnodes are there.
+         */
+
+        struct yaffs_tnode *tn;
+        struct yaffs_dev *dev = in->my_dev;
+        int existing_cunk;
+        struct yaffs_ext_tags existing_tags;
+        struct yaffs_ext_tags new_tags;
+        unsigned existing_serial, new_serial;
+
+        if (in->variant_type != YAFFS_OBJECT_TYPE_FILE) {
+                /* Just ignore an attempt at putting a chunk into a non-file during scanning
+                 * If it is not during Scanning then something went wrong!
+                 */
+                if (!in_scan) {
+                        yaffs_trace(YAFFS_TRACE_ERROR,
+                                "yaffs tragedy:attempt to put data chunk into a non-file"
+                                );
+                        YBUG();
+                }
+
+                yaffs_chunk_del(dev, nand_chunk, 1, __LINE__);
+                return YAFFS_OK;
+        }
+
+        tn = yaffs_add_find_tnode_0(dev,
+                                    &in->variant.file_variant,
+                                    inode_chunk, NULL);
+        if (!tn)
+                return YAFFS_FAIL;
+
+        if (!nand_chunk)
+                /* Dummy insert, bail now */
+                return YAFFS_OK;
+
+        existing_cunk = yaffs_get_group_base(dev, tn, inode_chunk);
+
+        if (in_scan != 0) {
+                /* If we're scanning then we need to test for duplicates
+                 * NB This does not need to be efficient since it should only ever
+                 * happen when the power fails during a write, then only one
+                 * chunk should ever be affected.
+                 *
+                 * Correction for YAFFS2: This could happen quite a lot and we need to think about efficiency! TODO
+                 * Update: For backward scanning we don't need to re-read tags so this is quite cheap.
+                 */
+
+                if (existing_cunk > 0) {
+                        /* NB Right now existing chunk will not be real chunk_id if the chunk group size > 1
+                         *    thus we have to do a FindChunkInFile to get the real chunk id.
+                         *
+                         * We have a duplicate now we need to decide which one to use:
+                         *
+                         * Backwards scanning YAFFS2: The old one is what we use, dump the new one.
+                         * Forward scanning YAFFS2: The new one is what we use, dump the old one.
+                         * YAFFS1: Get both sets of tags and compare serial numbers.
+                         */
+
+                        if (in_scan > 0) {
+                                /* Only do this for forward scanning */
+                                yaffs_rd_chunk_tags_nand(dev,
+                                                         nand_chunk,
+                                                         NULL, &new_tags);
+
+                                /* Do a proper find */
+                                existing_cunk =
+                                    yaffs_find_chunk_in_file(in, inode_chunk,
+                                                             &existing_tags);
+                        }
+
+                        if (existing_cunk <= 0) {
+                                /*Hoosterman - how did this happen? */
+
+                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                        "yaffs tragedy: existing chunk < 0 in scan"
+                                        );
+
+                        }
+
+                        /* NB The deleted flags should be false, otherwise the chunks will
+                         * not be loaded during a scan
+                         */
+
+                        if (in_scan > 0) {
+                                new_serial = new_tags.serial_number;
+                                existing_serial = existing_tags.serial_number;
+                        }
+
+                        if ((in_scan > 0) &&
+                            (existing_cunk <= 0 ||
+                             ((existing_serial + 1) & 3) == new_serial)) {
+                                /* Forward scanning.
+                                 * Use new
+                                 * Delete the old one and drop through to update the tnode
+                                 */
+                                yaffs_chunk_del(dev, existing_cunk, 1,
+                                                __LINE__);
+                        } else {
+                                /* Backward scanning or we want to use the existing one
+                                 * Use existing.
+                                 * Delete the new one and return early so that the tnode isn't changed
+                                 */
+                                yaffs_chunk_del(dev, nand_chunk, 1, __LINE__);
+                                return YAFFS_OK;
+                        }
+                }
+
+        }
+
+        if (existing_cunk == 0)
+                in->n_data_chunks++;
+
+        yaffs_load_tnode_0(dev, tn, inode_chunk, nand_chunk);
+
+        return YAFFS_OK;
+}
+
+static void yaffs_soft_del_chunk(struct yaffs_dev *dev, int chunk)
+{
+        struct yaffs_block_info *the_block;
+        unsigned block_no;
+
+        yaffs_trace(YAFFS_TRACE_DELETION, "soft delete chunk %d", chunk);
+
+        block_no = chunk / dev->param.chunks_per_block;
+        the_block = yaffs_get_block_info(dev, block_no);
+        if (the_block) {
+                the_block->soft_del_pages++;
+                dev->n_free_chunks++;
+                yaffs2_update_oldest_dirty_seq(dev, block_no, the_block);
+        }
+}
+
+/* SoftDeleteWorker scans backwards through the tnode tree and soft deletes all the chunks in the file.
+ * All soft deleting does is increment the block's softdelete count and pulls the chunk out
+ * of the tnode.
+ * Thus, essentially this is the same as DeleteWorker except that the chunks are soft deleted.
+ */
+
+static int yaffs_soft_del_worker(struct yaffs_obj *in, struct yaffs_tnode *tn,
+                                 u32 level, int chunk_offset)
+{
+        int i;
+        int the_chunk;
+        int all_done = 1;
+        struct yaffs_dev *dev = in->my_dev;
+
+        if (tn) {
+                if (level > 0) {
+
+                        for (i = YAFFS_NTNODES_INTERNAL - 1; all_done && i >= 0;
+                             i--) {
+                                if (tn->internal[i]) {
+                                        all_done =
+                                            yaffs_soft_del_worker(in,
+                                                                  tn->internal
+                                                                  [i],
+                                                                  level - 1,
+                                                                  (chunk_offset
+                                                                   <<
+                                                                   YAFFS_TNODES_INTERNAL_BITS)
+                                                                  + i);
+                                        if (all_done) {
+                                                yaffs_free_tnode(dev,
+                                                                 tn->internal
+                                                                 [i]);
+                                                tn->internal[i] = NULL;
+                                        } else {
+                                                /* Hoosterman... how could this happen? */
+                                        }
+                                }
+                        }
+                        return (all_done) ? 1 : 0;
+                } else if (level == 0) {
+
+                        for (i = YAFFS_NTNODES_LEVEL0 - 1; i >= 0; i--) {
+                                the_chunk = yaffs_get_group_base(dev, tn, i);
+                                if (the_chunk) {
+                                        /* Note this does not find the real chunk, only the chunk group.
+                                         * We make an assumption that a chunk group is not larger than
+                                         * a block.
+                                         */
+                                        yaffs_soft_del_chunk(dev, the_chunk);
+                                        yaffs_load_tnode_0(dev, tn, i, 0);
+                                }
+
+                        }
+                        return 1;
+
+                }
+
+        }
+
+        return 1;
+
+}
+
+static void yaffs_remove_obj_from_dir(struct yaffs_obj *obj)
+{
+        struct yaffs_dev *dev = obj->my_dev;
+        struct yaffs_obj *parent;
+
+        yaffs_verify_obj_in_dir(obj);
+        parent = obj->parent;
+
+        yaffs_verify_dir(parent);
+
+        if (dev && dev->param.remove_obj_fn)
+                dev->param.remove_obj_fn(obj);
+
+        list_del_init(&obj->siblings);
+        obj->parent = NULL;
+
+        yaffs_verify_dir(parent);
+}
+
+void yaffs_add_obj_to_dir(struct yaffs_obj *directory, struct yaffs_obj *obj)
+{
+        if (!directory) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "tragedy: Trying to add an object to a null pointer directory"
+                        );
+                YBUG();
+                return;
+        }
+        if (directory->variant_type != YAFFS_OBJECT_TYPE_DIRECTORY) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "tragedy: Trying to add an object to a non-directory"
+                        );
+                YBUG();
+        }
+
+        if (obj->siblings.prev == NULL) {
+                /* Not initialised */
+                YBUG();
+        }
+
+        yaffs_verify_dir(directory);
+
+        yaffs_remove_obj_from_dir(obj);
+
+        /* Now add it */
+        list_add(&obj->siblings, &directory->variant.dir_variant.children);
+        obj->parent = directory;
+
+        if (directory == obj->my_dev->unlinked_dir
+            || directory == obj->my_dev->del_dir) {
+                obj->unlinked = 1;
+                obj->my_dev->n_unlinked_files++;
+                obj->rename_allowed = 0;
+        }
+
+        yaffs_verify_dir(directory);
+        yaffs_verify_obj_in_dir(obj);
+}
+
+static int yaffs_change_obj_name(struct yaffs_obj *obj,
+                                 struct yaffs_obj *new_dir,
+                                 const YCHAR * new_name, int force, int shadows)
+{
+        int unlink_op;
+        int del_op;
+
+        struct yaffs_obj *existing_target;
+
+        if (new_dir == NULL)
+                new_dir = obj->parent;  /* use the old directory */
+
+        if (new_dir->variant_type != YAFFS_OBJECT_TYPE_DIRECTORY) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "tragedy: yaffs_change_obj_name: new_dir is not a directory"
+                        );
+                YBUG();
+        }
+
+        /* TODO: Do we need this different handling for YAFFS2 and YAFFS1?? */
+        if (obj->my_dev->param.is_yaffs2)
+                unlink_op = (new_dir == obj->my_dev->unlinked_dir);
+        else
+                unlink_op = (new_dir == obj->my_dev->unlinked_dir
+                             && obj->variant_type == YAFFS_OBJECT_TYPE_FILE);
+
+        del_op = (new_dir == obj->my_dev->del_dir);
+
+        existing_target = yaffs_find_by_name(new_dir, new_name);
+
+        /* If the object is a file going into the unlinked directory,
+         *   then it is OK to just stuff it in since duplicate names are allowed.
+         *   else only proceed if the new name does not exist and if we're putting
+         *   it into a directory.
+         */
+        if ((unlink_op ||
+             del_op ||
+             force ||
+             (shadows > 0) ||
+             !existing_target) &&
+            new_dir->variant_type == YAFFS_OBJECT_TYPE_DIRECTORY) {
+                yaffs_set_obj_name(obj, new_name);
+                obj->dirty = 1;
+
+                yaffs_add_obj_to_dir(new_dir, obj);
+
+                if (unlink_op)
+                        obj->unlinked = 1;
+
+                /* If it is a deletion then we mark it as a shrink for gc purposes. */
+                if (yaffs_update_oh(obj, new_name, 0, del_op, shadows, NULL) >=
+                    0)
+                        return YAFFS_OK;
+        }
+
+        return YAFFS_FAIL;
+}
+
+/*------------------------ Short Operations Cache ----------------------------------------
+ *   In many situations where there is no high level buffering  a lot of
+ *   reads might be short sequential reads, and a lot of writes may be short
+ *   sequential writes. eg. scanning/writing a jpeg file.
+ *   In these cases, a short read/write cache can provide a huge perfomance
+ *   benefit with dumb-as-a-rock code.
+ *   In Linux, the page cache provides read buffering and the short op cache 
+ *   provides write buffering.
+ *
+ *   There are a limited number (~10) of cache chunks per device so that we don't
+ *   need a very intelligent search.
+ */
+
+static int yaffs_obj_cache_dirty(struct yaffs_obj *obj)
+{
+        struct yaffs_dev *dev = obj->my_dev;
+        int i;
+        struct yaffs_cache *cache;
+        int n_caches = obj->my_dev->param.n_caches;
+
+        for (i = 0; i < n_caches; i++) {
+                cache = &dev->cache[i];
+                if (cache->object == obj && cache->dirty)
+                        return 1;
+        }
+
+        return 0;
+}
+
+static void yaffs_flush_file_cache(struct yaffs_obj *obj)
+{
+        struct yaffs_dev *dev = obj->my_dev;
+        int lowest = -99;       /* Stop compiler whining. */
+        int i;
+        struct yaffs_cache *cache;
+        int chunk_written = 0;
+        int n_caches = obj->my_dev->param.n_caches;
+
+        if (n_caches > 0) {
+                do {
+                        cache = NULL;
+
+                        /* Find the dirty cache for this object with the lowest chunk id. */
+                        for (i = 0; i < n_caches; i++) {
+                                if (dev->cache[i].object == obj &&
+                                    dev->cache[i].dirty) {
+                                        if (!cache
+                                            || dev->cache[i].chunk_id <
+                                            lowest) {
+                                                cache = &dev->cache[i];
+                                                lowest = cache->chunk_id;
+                                        }
+                                }
+                        }
+
+                        if (cache && !cache->locked) {
+                                /* Write it out and free it up */
+
+                                chunk_written =
+                                    yaffs_wr_data_obj(cache->object,
+                                                      cache->chunk_id,
+                                                      cache->data,
+                                                      cache->n_bytes, 1);
+                                cache->dirty = 0;
+                                cache->object = NULL;
+                        }
+
+                } while (cache && chunk_written > 0);
+
+                if (cache)
+                        /* Hoosterman, disk full while writing cache out. */
+                        yaffs_trace(YAFFS_TRACE_ERROR,
+                                "yaffs tragedy: no space during cache write");
+
+        }
+
+}
+
+/*yaffs_flush_whole_cache(dev)
+ *
+ *
+ */
+
+void yaffs_flush_whole_cache(struct yaffs_dev *dev)
+{
+        struct yaffs_obj *obj;
+        int n_caches = dev->param.n_caches;
+        int i;
+
+        /* Find a dirty object in the cache and flush it...
+         * until there are no further dirty objects.
+         */
+        do {
+                obj = NULL;
+                for (i = 0; i < n_caches && !obj; i++) {
+                        if (dev->cache[i].object && dev->cache[i].dirty)
+                                obj = dev->cache[i].object;
+
+                }
+                if (obj)
+                        yaffs_flush_file_cache(obj);
+
+        } while (obj);
+
+}
+
+/* Grab us a cache chunk for use.
+ * First look for an empty one.
+ * Then look for the least recently used non-dirty one.
+ * Then look for the least recently used dirty one...., flush and look again.
+ */
+static struct yaffs_cache *yaffs_grab_chunk_worker(struct yaffs_dev *dev)
+{
+        int i;
+
+        if (dev->param.n_caches > 0) {
+                for (i = 0; i < dev->param.n_caches; i++) {
+                        if (!dev->cache[i].object)
+                                return &dev->cache[i];
+                }
+        }
+
+        return NULL;
+}
+
+static struct yaffs_cache *yaffs_grab_chunk_cache(struct yaffs_dev *dev)
+{
+        struct yaffs_cache *cache;
+        struct yaffs_obj *the_obj;
+        int usage;
+        int i;
+        int pushout;
+
+        if (dev->param.n_caches > 0) {
+                /* Try find a non-dirty one... */
+
+                cache = yaffs_grab_chunk_worker(dev);
+
+                if (!cache) {
+                        /* They were all dirty, find the last recently used object and flush
+                         * its cache, then  find again.
+                         * NB what's here is not very accurate, we actually flush the object
+                         * the last recently used page.
+                         */
+
+                        /* With locking we can't assume we can use entry zero */
+
+                        the_obj = NULL;
+                        usage = -1;
+                        cache = NULL;
+                        pushout = -1;
+
+                        for (i = 0; i < dev->param.n_caches; i++) {
+                                if (dev->cache[i].object &&
+                                    !dev->cache[i].locked &&
+                                    (dev->cache[i].last_use < usage
+                                     || !cache)) {
+                                        usage = dev->cache[i].last_use;
+                                        the_obj = dev->cache[i].object;
+                                        cache = &dev->cache[i];
+                                        pushout = i;
+                                }
+                        }
+
+                        if (!cache || cache->dirty) {
+                                /* Flush and try again */
+                                yaffs_flush_file_cache(the_obj);
+                                cache = yaffs_grab_chunk_worker(dev);
+                        }
+
+                }
+                return cache;
+        } else {
+                return NULL;
+        }
+}
+
+/* Find a cached chunk */
+static struct yaffs_cache *yaffs_find_chunk_cache(const struct yaffs_obj *obj,
+                                                  int chunk_id)
+{
+        struct yaffs_dev *dev = obj->my_dev;
+        int i;
+        if (dev->param.n_caches > 0) {
+                for (i = 0; i < dev->param.n_caches; i++) {
+                        if (dev->cache[i].object == obj &&
+                            dev->cache[i].chunk_id == chunk_id) {
+                                dev->cache_hits++;
+
+                                return &dev->cache[i];
+                        }
+                }
+        }
+        return NULL;
+}
+
+/* Mark the chunk for the least recently used algorithym */
+static void yaffs_use_cache(struct yaffs_dev *dev, struct yaffs_cache *cache,
+                            int is_write)
+{
+
+        if (dev->param.n_caches > 0) {
+                if (dev->cache_last_use < 0 || dev->cache_last_use > 100000000) {
+                        /* Reset the cache usages */
+                        int i;
+                        for (i = 1; i < dev->param.n_caches; i++)
+                                dev->cache[i].last_use = 0;
+
+                        dev->cache_last_use = 0;
+                }
+
+                dev->cache_last_use++;
+
+                cache->last_use = dev->cache_last_use;
+
+                if (is_write)
+                        cache->dirty = 1;
+        }
+}
+
+/* Invalidate a single cache page.
+ * Do this when a whole page gets written,
+ * ie the short cache for this page is no longer valid.
+ */
+static void yaffs_invalidate_chunk_cache(struct yaffs_obj *object, int chunk_id)
+{
+        if (object->my_dev->param.n_caches > 0) {
+                struct yaffs_cache *cache =
+                    yaffs_find_chunk_cache(object, chunk_id);
+
+                if (cache)
+                        cache->object = NULL;
+        }
+}
+
+/* Invalidate all the cache pages associated with this object
+ * Do this whenever ther file is deleted or resized.
+ */
+static void yaffs_invalidate_whole_cache(struct yaffs_obj *in)
+{
+        int i;
+        struct yaffs_dev *dev = in->my_dev;
+
+        if (dev->param.n_caches > 0) {
+                /* Invalidate it. */
+                for (i = 0; i < dev->param.n_caches; i++) {
+                        if (dev->cache[i].object == in)
+                                dev->cache[i].object = NULL;
+                }
+        }
+}
+
+static void yaffs_unhash_obj(struct yaffs_obj *obj)
+{
+        int bucket;
+        struct yaffs_dev *dev = obj->my_dev;
+
+        /* If it is still linked into the bucket list, free from the list */
+        if (!list_empty(&obj->hash_link)) {
+                list_del_init(&obj->hash_link);
+                bucket = yaffs_hash_fn(obj->obj_id);
+                dev->obj_bucket[bucket].count--;
+        }
+}
+
+/*  FreeObject frees up a Object and puts it back on the free list */
+static void yaffs_free_obj(struct yaffs_obj *obj)
+{
+        struct yaffs_dev *dev = obj->my_dev;
+
+        yaffs_trace(YAFFS_TRACE_OS, "FreeObject %p inode %p",
+                obj, obj->my_inode);
+
+        if (!obj)
+                YBUG();
+        if (obj->parent)
+                YBUG();
+        if (!list_empty(&obj->siblings))
+                YBUG();
+
+        if (obj->my_inode) {
+                /* We're still hooked up to a cached inode.
+                 * Don't delete now, but mark for later deletion
+                 */
+                obj->defered_free = 1;
+                return;
+        }
+
+        yaffs_unhash_obj(obj);
+
+        yaffs_free_raw_obj(dev, obj);
+        dev->n_obj--;
+        dev->checkpoint_blocks_required = 0;    /* force recalculation */
+}
+
+void yaffs_handle_defered_free(struct yaffs_obj *obj)
+{
+        if (obj->defered_free)
+                yaffs_free_obj(obj);
+}
+
+static int yaffs_generic_obj_del(struct yaffs_obj *in)
+{
+
+        /* First off, invalidate the file's data in the cache, without flushing. */
+        yaffs_invalidate_whole_cache(in);
+
+        if (in->my_dev->param.is_yaffs2 && (in->parent != in->my_dev->del_dir)) {
+                /* Move to the unlinked directory so we have a record that it was deleted. */
+                yaffs_change_obj_name(in, in->my_dev->del_dir, _Y("deleted"), 0,
+                                      0);
+
+        }
+
+        yaffs_remove_obj_from_dir(in);
+        yaffs_chunk_del(in->my_dev, in->hdr_chunk, 1, __LINE__);
+        in->hdr_chunk = 0;
+
+        yaffs_free_obj(in);
+        return YAFFS_OK;
+
+}
+
+static void yaffs_soft_del_file(struct yaffs_obj *obj)
+{
+        if (obj->deleted &&
+            obj->variant_type == YAFFS_OBJECT_TYPE_FILE && !obj->soft_del) {
+                if (obj->n_data_chunks <= 0) {
+                        /* Empty file with no duplicate object headers,
+                         * just delete it immediately */
+                        yaffs_free_tnode(obj->my_dev,
+                                         obj->variant.file_variant.top);
+                        obj->variant.file_variant.top = NULL;
+                        yaffs_trace(YAFFS_TRACE_TRACING,
+                                "yaffs: Deleting empty file %d",
+                                obj->obj_id);
+                        yaffs_generic_obj_del(obj);
+                } else {
+                        yaffs_soft_del_worker(obj,
+                                              obj->variant.file_variant.top,
+                                              obj->variant.
+                                              file_variant.top_level, 0);
+                        obj->soft_del = 1;
+                }
+        }
+}
+
+/* Pruning removes any part of the file structure tree that is beyond the
+ * bounds of the file (ie that does not point to chunks).
+ *
+ * A file should only get pruned when its size is reduced.
+ *
+ * Before pruning, the chunks must be pulled from the tree and the
+ * level 0 tnode entries must be zeroed out.
+ * Could also use this for file deletion, but that's probably better handled
+ * by a special case.
+ *
+ * This function is recursive. For levels > 0 the function is called again on
+ * any sub-tree. For level == 0 we just check if the sub-tree has data.
+ * If there is no data in a subtree then it is pruned.
+ */
+
+static struct yaffs_tnode *yaffs_prune_worker(struct yaffs_dev *dev,
+                                              struct yaffs_tnode *tn, u32 level,
+                                              int del0)
+{
+        int i;
+        int has_data;
+
+        if (tn) {
+                has_data = 0;
+
+                if (level > 0) {
+                        for (i = 0; i < YAFFS_NTNODES_INTERNAL; i++) {
+                                if (tn->internal[i]) {
+                                        tn->internal[i] =
+                                            yaffs_prune_worker(dev,
+                                                               tn->internal[i],
+                                                               level - 1,
+                                                               (i ==
+                                                                0) ? del0 : 1);
+                                }
+
+                                if (tn->internal[i])
+                                        has_data++;
+                        }
+                } else {
+                        int tnode_size_u32 = dev->tnode_size / sizeof(u32);
+                        u32 *map = (u32 *) tn;
+
+                        for (i = 0; !has_data && i < tnode_size_u32; i++) {
+                                if (map[i])
+                                        has_data++;
+                        }
+                }
+
+                if (has_data == 0 && del0) {
+                        /* Free and return NULL */
+
+                        yaffs_free_tnode(dev, tn);
+                        tn = NULL;
+                }
+
+        }
+
+        return tn;
+
+}
+
+static int yaffs_prune_tree(struct yaffs_dev *dev,
+                            struct yaffs_file_var *file_struct)
+{
+        int i;
+        int has_data;
+        int done = 0;
+        struct yaffs_tnode *tn;
+
+        if (file_struct->top_level > 0) {
+                file_struct->top =
+                    yaffs_prune_worker(dev, file_struct->top,
+                                       file_struct->top_level, 0);
+
+                /* Now we have a tree with all the non-zero branches NULL but the height
+                 * is the same as it was.
+                 * Let's see if we can trim internal tnodes to shorten the tree.
+                 * We can do this if only the 0th element in the tnode is in use
+                 * (ie all the non-zero are NULL)
+                 */
+
+                while (file_struct->top_level && !done) {
+                        tn = file_struct->top;
+
+                        has_data = 0;
+                        for (i = 1; i < YAFFS_NTNODES_INTERNAL; i++) {
+                                if (tn->internal[i])
+                                        has_data++;
+                        }
+
+                        if (!has_data) {
+                                file_struct->top = tn->internal[0];
+                                file_struct->top_level--;
+                                yaffs_free_tnode(dev, tn);
+                        } else {
+                                done = 1;
+                        }
+                }
+        }
+
+        return YAFFS_OK;
+}
+
+/*-------------------- End of File Structure functions.-------------------*/
+
+/* AllocateEmptyObject gets us a clean Object. Tries to make allocate more if we run out */
+static struct yaffs_obj *yaffs_alloc_empty_obj(struct yaffs_dev *dev)
+{
+        struct yaffs_obj *obj = yaffs_alloc_raw_obj(dev);
+
+        if (obj) {
+                dev->n_obj++;
+
+                /* Now sweeten it up... */
+
+                memset(obj, 0, sizeof(struct yaffs_obj));
+                obj->being_created = 1;
+
+                obj->my_dev = dev;
+                obj->hdr_chunk = 0;
+                obj->variant_type = YAFFS_OBJECT_TYPE_UNKNOWN;
+                INIT_LIST_HEAD(&(obj->hard_links));
+                INIT_LIST_HEAD(&(obj->hash_link));
+                INIT_LIST_HEAD(&obj->siblings);
+
+                /* Now make the directory sane */
+                if (dev->root_dir) {
+                        obj->parent = dev->root_dir;
+                        list_add(&(obj->siblings),
+                                 &dev->root_dir->variant.dir_variant.children);
+                }
+
+                /* Add it to the lost and found directory.
+                 * NB Can't put root or lost-n-found in lost-n-found so
+                 * check if lost-n-found exists first
+                 */
+                if (dev->lost_n_found)
+                        yaffs_add_obj_to_dir(dev->lost_n_found, obj);
+
+                obj->being_created = 0;
+        }
+
+        dev->checkpoint_blocks_required = 0;    /* force recalculation */
+
+        return obj;
+}
+
+static int yaffs_find_nice_bucket(struct yaffs_dev *dev)
+{
+        int i;
+        int l = 999;
+        int lowest = 999999;
+
+        /* Search for the shortest list or one that
+         * isn't too long.
+         */
+
+        for (i = 0; i < 10 && lowest > 4; i++) {
+                dev->bucket_finder++;
+                dev->bucket_finder %= YAFFS_NOBJECT_BUCKETS;
+                if (dev->obj_bucket[dev->bucket_finder].count < lowest) {
+                        lowest = dev->obj_bucket[dev->bucket_finder].count;
+                        l = dev->bucket_finder;
+                }
+
+        }
+
+        return l;
+}
+
+static int yaffs_new_obj_id(struct yaffs_dev *dev)
+{
+        int bucket = yaffs_find_nice_bucket(dev);
+
+        /* Now find an object value that has not already been taken
+         * by scanning the list.
+         */
+
+        int found = 0;
+        struct list_head *i;
+
+        u32 n = (u32) bucket;
+
+        /* yaffs_check_obj_hash_sane();  */
+
+        while (!found) {
+                found = 1;
+                n += YAFFS_NOBJECT_BUCKETS;
+                if (1 || dev->obj_bucket[bucket].count > 0) {
+                        list_for_each(i, &dev->obj_bucket[bucket].list) {
+                                /* If there is already one in the list */
+                                if (i && list_entry(i, struct yaffs_obj,
+                                                    hash_link)->obj_id == n) {
+                                        found = 0;
+                                }
+                        }
+                }
+        }
+
+        return n;
+}
+
+static void yaffs_hash_obj(struct yaffs_obj *in)
+{
+        int bucket = yaffs_hash_fn(in->obj_id);
+        struct yaffs_dev *dev = in->my_dev;
+
+        list_add(&in->hash_link, &dev->obj_bucket[bucket].list);
+        dev->obj_bucket[bucket].count++;
+}
+
+struct yaffs_obj *yaffs_find_by_number(struct yaffs_dev *dev, u32 number)
+{
+        int bucket = yaffs_hash_fn(number);
+        struct list_head *i;
+        struct yaffs_obj *in;
+
+        list_for_each(i, &dev->obj_bucket[bucket].list) {
+                /* Look if it is in the list */
+                if (i) {
+                        in = list_entry(i, struct yaffs_obj, hash_link);
+                        if (in->obj_id == number) {
+
+                                /* Don't tell the VFS about this one if it is defered free */
+                                if (in->defered_free)
+                                        return NULL;
+
+                                return in;
+                        }
+                }
+        }
+
+        return NULL;
+}
+
+struct yaffs_obj *yaffs_new_obj(struct yaffs_dev *dev, int number,
+                                enum yaffs_obj_type type)
+{
+        struct yaffs_obj *the_obj = NULL;
+        struct yaffs_tnode *tn = NULL;
+
+        if (number < 0)
+                number = yaffs_new_obj_id(dev);
+
+        if (type == YAFFS_OBJECT_TYPE_FILE) {
+                tn = yaffs_get_tnode(dev);
+                if (!tn)
+                        return NULL;
+        }
+
+        the_obj = yaffs_alloc_empty_obj(dev);
+        if (!the_obj) {
+                if (tn)
+                        yaffs_free_tnode(dev, tn);
+                return NULL;
+        }
+
+        if (the_obj) {
+                the_obj->fake = 0;
+                the_obj->rename_allowed = 1;
+                the_obj->unlink_allowed = 1;
+                the_obj->obj_id = number;
+                yaffs_hash_obj(the_obj);
+                the_obj->variant_type = type;
+                yaffs_load_current_time(the_obj, 1, 1);
+
+                switch (type) {
+                case YAFFS_OBJECT_TYPE_FILE:
+                        the_obj->variant.file_variant.file_size = 0;
+                        the_obj->variant.file_variant.scanned_size = 0;
+                        the_obj->variant.file_variant.shrink_size = ~0; /* max */
+                        the_obj->variant.file_variant.top_level = 0;
+                        the_obj->variant.file_variant.top = tn;
+                        break;
+                case YAFFS_OBJECT_TYPE_DIRECTORY:
+                        INIT_LIST_HEAD(&the_obj->variant.dir_variant.children);
+                        INIT_LIST_HEAD(&the_obj->variant.dir_variant.dirty);
+                        break;
+                case YAFFS_OBJECT_TYPE_SYMLINK:
+                case YAFFS_OBJECT_TYPE_HARDLINK:
+                case YAFFS_OBJECT_TYPE_SPECIAL:
+                        /* No action required */
+                        break;
+                case YAFFS_OBJECT_TYPE_UNKNOWN:
+                        /* todo this should not happen */
+                        break;
+                }
+        }
+
+        return the_obj;
+}
+
+static struct yaffs_obj *yaffs_create_fake_dir(struct yaffs_dev *dev,
+                                               int number, u32 mode)
+{
+
+        struct yaffs_obj *obj =
+            yaffs_new_obj(dev, number, YAFFS_OBJECT_TYPE_DIRECTORY);
+        if (obj) {
+                obj->fake = 1;  /* it is fake so it might have no NAND presence... */
+                obj->rename_allowed = 0;        /* ... and we're not allowed to rename it... */
+                obj->unlink_allowed = 0;        /* ... or unlink it */
+                obj->deleted = 0;
+                obj->unlinked = 0;
+                obj->yst_mode = mode;
+                obj->my_dev = dev;
+                obj->hdr_chunk = 0;     /* Not a valid chunk. */
+        }
+
+        return obj;
+
+}
+
+
+static void yaffs_init_tnodes_and_objs(struct yaffs_dev *dev)
+{
+        int i;
+
+        dev->n_obj = 0;
+        dev->n_tnodes = 0;
+
+        yaffs_init_raw_tnodes_and_objs(dev);
+
+        for (i = 0; i < YAFFS_NOBJECT_BUCKETS; i++) {
+                INIT_LIST_HEAD(&dev->obj_bucket[i].list);
+                dev->obj_bucket[i].count = 0;
+        }
+}
+
+struct yaffs_obj *yaffs_find_or_create_by_number(struct yaffs_dev *dev,
+                                                 int number,
+                                                 enum yaffs_obj_type type)
+{
+        struct yaffs_obj *the_obj = NULL;
+
+        if (number > 0)
+                the_obj = yaffs_find_by_number(dev, number);
+
+        if (!the_obj)
+                the_obj = yaffs_new_obj(dev, number, type);
+
+        return the_obj;
+
+}
+
+YCHAR *yaffs_clone_str(const YCHAR * str)
+{
+        YCHAR *new_str = NULL;
+        int len;
+
+        if (!str)
+                str = _Y("");
+
+        len = strnlen(str, YAFFS_MAX_ALIAS_LENGTH);
+        new_str = kmalloc((len + 1) * sizeof(YCHAR), GFP_NOFS);
+        if (new_str) {
+                strncpy(new_str, str, len);
+                new_str[len] = 0;
+        }
+        return new_str;
+
+}
+/*
+ *yaffs_update_parent() handles fixing a directories mtime and ctime when a new
+ * link (ie. name) is created or deleted in the directory.
+ *
+ * ie.
+ *   create dir/a : update dir's mtime/ctime
+ *   rm dir/a:   update dir's mtime/ctime
+ *   modify dir/a: don't update dir's mtimme/ctime
+ *
+ * This can be handled immediately or defered. Defering helps reduce the number
+ * of updates when many files in a directory are changed within a brief period.
+ *
+ * If the directory updating is defered then yaffs_update_dirty_dirs must be
+ * called periodically.
+ */
+
+static void yaffs_update_parent(struct yaffs_obj *obj)
+{
+        struct yaffs_dev *dev;
+        if (!obj)
+                return;
+        dev = obj->my_dev;
+        obj->dirty = 1;
+        yaffs_load_current_time(obj, 0, 1);
+        if (dev->param.defered_dir_update) {
+                struct list_head *link = &obj->variant.dir_variant.dirty;
+
+                if (list_empty(link)) {
+                        list_add(link, &dev->dirty_dirs);
+                        yaffs_trace(YAFFS_TRACE_BACKGROUND,
+                          "Added object %d to dirty directories",
+                           obj->obj_id);
+                }
+
+        } else {
+                yaffs_update_oh(obj, NULL, 0, 0, 0, NULL);
+        }
+}
+
+void yaffs_update_dirty_dirs(struct yaffs_dev *dev)
+{
+        struct list_head *link;
+        struct yaffs_obj *obj;
+        struct yaffs_dir_var *d_s;
+        union yaffs_obj_var *o_v;
+
+        yaffs_trace(YAFFS_TRACE_BACKGROUND, "Update dirty directories");
+
+        while (!list_empty(&dev->dirty_dirs)) {
+                link = dev->dirty_dirs.next;
+                list_del_init(link);
+
+                d_s = list_entry(link, struct yaffs_dir_var, dirty);
+                o_v = list_entry(d_s, union yaffs_obj_var, dir_variant);
+                obj = list_entry(o_v, struct yaffs_obj, variant);
+
+                yaffs_trace(YAFFS_TRACE_BACKGROUND, "Update directory %d",
+                        obj->obj_id);
+
+                if (obj->dirty)
+                        yaffs_update_oh(obj, NULL, 0, 0, 0, NULL);
+        }
+}
+
+/*
+ * Mknod (create) a new object.
+ * equiv_obj only has meaning for a hard link;
+ * alias_str only has meaning for a symlink.
+ * rdev only has meaning for devices (a subset of special objects)
+ */
+
+static struct yaffs_obj *yaffs_create_obj(enum yaffs_obj_type type,
+                                          struct yaffs_obj *parent,
+                                          const YCHAR * name,
+                                          u32 mode,
+                                          u32 uid,
+                                          u32 gid,
+                                          struct yaffs_obj *equiv_obj,
+                                          const YCHAR * alias_str, u32 rdev)
+{
+        struct yaffs_obj *in;
+        YCHAR *str = NULL;
+
+        struct yaffs_dev *dev = parent->my_dev;
+
+        /* Check if the entry exists. If it does then fail the call since we don't want a dup. */
+        if (yaffs_find_by_name(parent, name))
+                return NULL;
+
+        if (type == YAFFS_OBJECT_TYPE_SYMLINK) {
+                str = yaffs_clone_str(alias_str);
+                if (!str)
+                        return NULL;
+        }
+
+        in = yaffs_new_obj(dev, -1, type);
+
+        if (!in) {
+                if (str)
+                        kfree(str);
+                return NULL;
+        }
+
+        if (in) {
+                in->hdr_chunk = 0;
+                in->valid = 1;
+                in->variant_type = type;
+
+                in->yst_mode = mode;
+
+                yaffs_attribs_init(in, gid, uid, rdev);
+
+                in->n_data_chunks = 0;
+
+                yaffs_set_obj_name(in, name);
+                in->dirty = 1;
+
+                yaffs_add_obj_to_dir(parent, in);
+
+                in->my_dev = parent->my_dev;
+
+                switch (type) {
+                case YAFFS_OBJECT_TYPE_SYMLINK:
+                        in->variant.symlink_variant.alias = str;
+                        break;
+                case YAFFS_OBJECT_TYPE_HARDLINK:
+                        in->variant.hardlink_variant.equiv_obj = equiv_obj;
+                        in->variant.hardlink_variant.equiv_id =
+                            equiv_obj->obj_id;
+                        list_add(&in->hard_links, &equiv_obj->hard_links);
+                        break;
+                case YAFFS_OBJECT_TYPE_FILE:
+                case YAFFS_OBJECT_TYPE_DIRECTORY:
+                case YAFFS_OBJECT_TYPE_SPECIAL:
+                case YAFFS_OBJECT_TYPE_UNKNOWN:
+                        /* do nothing */
+                        break;
+                }
+
+                if (yaffs_update_oh(in, name, 0, 0, 0, NULL) < 0) {
+                        /* Could not create the object header, fail the creation */
+                        yaffs_del_obj(in);
+                        in = NULL;
+                }
+
+                yaffs_update_parent(parent);
+        }
+
+        return in;
+}
+
+struct yaffs_obj *yaffs_create_file(struct yaffs_obj *parent,
+                                    const YCHAR * name, u32 mode, u32 uid,
+                                    u32 gid)
+{
+        return yaffs_create_obj(YAFFS_OBJECT_TYPE_FILE, parent, name, mode,
+                                uid, gid, NULL, NULL, 0);
+}
+
+struct yaffs_obj *yaffs_create_dir(struct yaffs_obj *parent, const YCHAR * name,
+                                   u32 mode, u32 uid, u32 gid)
+{
+        return yaffs_create_obj(YAFFS_OBJECT_TYPE_DIRECTORY, parent, name,
+                                mode, uid, gid, NULL, NULL, 0);
+}
+
+struct yaffs_obj *yaffs_create_special(struct yaffs_obj *parent,
+                                       const YCHAR * name, u32 mode, u32 uid,
+                                       u32 gid, u32 rdev)
+{
+        return yaffs_create_obj(YAFFS_OBJECT_TYPE_SPECIAL, parent, name, mode,
+                                uid, gid, NULL, NULL, rdev);
+}
+
+struct yaffs_obj *yaffs_create_symlink(struct yaffs_obj *parent,
+                                       const YCHAR * name, u32 mode, u32 uid,
+                                       u32 gid, const YCHAR * alias)
+{
+        return yaffs_create_obj(YAFFS_OBJECT_TYPE_SYMLINK, parent, name, mode,
+                                uid, gid, NULL, alias, 0);
+}
+
+/* yaffs_link_obj returns the object id of the equivalent object.*/
+struct yaffs_obj *yaffs_link_obj(struct yaffs_obj *parent, const YCHAR * name,
+                                 struct yaffs_obj *equiv_obj)
+{
+        /* Get the real object in case we were fed a hard link as an equivalent object */
+        equiv_obj = yaffs_get_equivalent_obj(equiv_obj);
+
+        if (yaffs_create_obj
+            (YAFFS_OBJECT_TYPE_HARDLINK, parent, name, 0, 0, 0,
+             equiv_obj, NULL, 0)) {
+                return equiv_obj;
+        } else {
+                return NULL;
+        }
+
+}
+
+
+
+/*------------------------- Block Management and Page Allocation ----------------*/
+
+static int yaffs_init_blocks(struct yaffs_dev *dev)
+{
+        int n_blocks = dev->internal_end_block - dev->internal_start_block + 1;
+
+        dev->block_info = NULL;
+        dev->chunk_bits = NULL;
+
+        dev->alloc_block = -1;  /* force it to get a new one */
+
+        /* If the first allocation strategy fails, thry the alternate one */
+        dev->block_info =
+                kmalloc(n_blocks * sizeof(struct yaffs_block_info), GFP_NOFS);
+        if (!dev->block_info) {
+                dev->block_info =
+                    vmalloc(n_blocks * sizeof(struct yaffs_block_info));
+                dev->block_info_alt = 1;
+        } else {
+                dev->block_info_alt = 0;
+        }
+
+        if (dev->block_info) {
+                /* Set up dynamic blockinfo stuff. Round up bytes. */
+                dev->chunk_bit_stride = (dev->param.chunks_per_block + 7) / 8;
+                dev->chunk_bits =
+                        kmalloc(dev->chunk_bit_stride * n_blocks, GFP_NOFS);
+                if (!dev->chunk_bits) {
+                        dev->chunk_bits =
+                            vmalloc(dev->chunk_bit_stride * n_blocks);
+                        dev->chunk_bits_alt = 1;
+                } else {
+                        dev->chunk_bits_alt = 0;
+                }
+        }
+
+        if (dev->block_info && dev->chunk_bits) {
+                memset(dev->block_info, 0,
+                       n_blocks * sizeof(struct yaffs_block_info));
+                memset(dev->chunk_bits, 0, dev->chunk_bit_stride * n_blocks);
+                return YAFFS_OK;
+        }
+
+        return YAFFS_FAIL;
+}
+
+static void yaffs_deinit_blocks(struct yaffs_dev *dev)
+{
+        if (dev->block_info_alt && dev->block_info)
+                vfree(dev->block_info);
+        else if (dev->block_info)
+                kfree(dev->block_info);
+
+        dev->block_info_alt = 0;
+
+        dev->block_info = NULL;
+
+        if (dev->chunk_bits_alt && dev->chunk_bits)
+                vfree(dev->chunk_bits);
+        else if (dev->chunk_bits)
+                kfree(dev->chunk_bits);
+        dev->chunk_bits_alt = 0;
+        dev->chunk_bits = NULL;
+}
+
+void yaffs_block_became_dirty(struct yaffs_dev *dev, int block_no)
+{
+        struct yaffs_block_info *bi = yaffs_get_block_info(dev, block_no);
+
+        int erased_ok = 0;
+
+        /* If the block is still healthy erase it and mark as clean.
+         * If the block has had a data failure, then retire it.
+         */
+
+        yaffs_trace(YAFFS_TRACE_GC | YAFFS_TRACE_ERASE,
+                "yaffs_block_became_dirty block %d state %d %s",
+                block_no, bi->block_state,
+                (bi->needs_retiring) ? "needs retiring" : "");
+
+        yaffs2_clear_oldest_dirty_seq(dev, bi);
+
+        bi->block_state = YAFFS_BLOCK_STATE_DIRTY;
+
+        /* If this is the block being garbage collected then stop gc'ing this block */
+        if (block_no == dev->gc_block)
+                dev->gc_block = 0;
+
+        /* If this block is currently the best candidate for gc then drop as a candidate */
+        if (block_no == dev->gc_dirtiest) {
+                dev->gc_dirtiest = 0;
+                dev->gc_pages_in_use = 0;
+        }
+
+        if (!bi->needs_retiring) {
+                yaffs2_checkpt_invalidate(dev);
+                erased_ok = yaffs_erase_block(dev, block_no);
+                if (!erased_ok) {
+                        dev->n_erase_failures++;
+                        yaffs_trace(YAFFS_TRACE_ERROR | YAFFS_TRACE_BAD_BLOCKS,
+                          "**>> Erasure failed %d", block_no);
+                }
+        }
+
+        if (erased_ok &&
+            ((yaffs_trace_mask & YAFFS_TRACE_ERASE)
+             || !yaffs_skip_verification(dev))) {
+                int i;
+                for (i = 0; i < dev->param.chunks_per_block; i++) {
+                        if (!yaffs_check_chunk_erased
+                            (dev, block_no * dev->param.chunks_per_block + i)) {
+                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                        ">>Block %d erasure supposedly OK, but chunk %d not erased",
+                                        block_no, i);
+                        }
+                }
+        }
+
+        if (erased_ok) {
+                /* Clean it up... */
+                bi->block_state = YAFFS_BLOCK_STATE_EMPTY;
+                bi->seq_number = 0;
+                dev->n_erased_blocks++;
+                bi->pages_in_use = 0;
+                bi->soft_del_pages = 0;
+                bi->has_shrink_hdr = 0;
+                bi->skip_erased_check = 1;      /* Clean, so no need to check */
+                bi->gc_prioritise = 0;
+                yaffs_clear_chunk_bits(dev, block_no);
+
+                yaffs_trace(YAFFS_TRACE_ERASE,
+                        "Erased block %d", block_no);
+        } else {
+                /* We lost a block of free space */
+                dev->n_free_chunks -= dev->param.chunks_per_block;
+                yaffs_retire_block(dev, block_no);
+                yaffs_trace(YAFFS_TRACE_ERROR | YAFFS_TRACE_BAD_BLOCKS,
+                        "**>> Block %d retired", block_no);
+        }
+}
+
+
+
+static int yaffs_gc_block(struct yaffs_dev *dev, int block, int whole_block)
+{
+        int old_chunk;
+        int new_chunk;
+        int mark_flash;
+        int ret_val = YAFFS_OK;
+        int i;
+        int is_checkpt_block;
+        int matching_chunk;
+        int max_copies;
+
+        int chunks_before = yaffs_get_erased_chunks(dev);
+        int chunks_after;
+
+        struct yaffs_ext_tags tags;
+
+        struct yaffs_block_info *bi = yaffs_get_block_info(dev, block);
+
+        struct yaffs_obj *object;
+
+        is_checkpt_block = (bi->block_state == YAFFS_BLOCK_STATE_CHECKPOINT);
+
+        yaffs_trace(YAFFS_TRACE_TRACING,
+                "Collecting block %d, in use %d, shrink %d, whole_block %d",
+                block, bi->pages_in_use, bi->has_shrink_hdr,
+                whole_block);
+
+        /*yaffs_verify_free_chunks(dev); */
+
+        if (bi->block_state == YAFFS_BLOCK_STATE_FULL)
+                bi->block_state = YAFFS_BLOCK_STATE_COLLECTING;
+
+        bi->has_shrink_hdr = 0; /* clear the flag so that the block can erase */
+
+        dev->gc_disable = 1;
+
+        if (is_checkpt_block || !yaffs_still_some_chunks(dev, block)) {
+                yaffs_trace(YAFFS_TRACE_TRACING,
+                        "Collecting block %d that has no chunks in use",
+                        block);
+                yaffs_block_became_dirty(dev, block);
+        } else {
+
+                u8 *buffer = yaffs_get_temp_buffer(dev, __LINE__);
+
+                yaffs_verify_blk(dev, bi, block);
+
+                max_copies = (whole_block) ? dev->param.chunks_per_block : 5;
+                old_chunk = block * dev->param.chunks_per_block + dev->gc_chunk;
+
+                for ( /* init already done */ ;
+                     ret_val == YAFFS_OK &&
+                     dev->gc_chunk < dev->param.chunks_per_block &&
+                     (bi->block_state == YAFFS_BLOCK_STATE_COLLECTING) &&
+                     max_copies > 0; dev->gc_chunk++, old_chunk++) {
+                        if (yaffs_check_chunk_bit(dev, block, dev->gc_chunk)) {
+
+                                /* This page is in use and might need to be copied off */
+
+                                max_copies--;
+
+                                mark_flash = 1;
+
+                                yaffs_init_tags(&tags);
+
+                                yaffs_rd_chunk_tags_nand(dev, old_chunk,
+                                                         buffer, &tags);
+
+                                object = yaffs_find_by_number(dev, tags.obj_id);
+
+                                yaffs_trace(YAFFS_TRACE_GC_DETAIL,
+                                        "Collecting chunk in block %d, %d %d %d ",
+                                        dev->gc_chunk, tags.obj_id,
+                                        tags.chunk_id, tags.n_bytes);
+
+                                if (object && !yaffs_skip_verification(dev)) {
+                                        if (tags.chunk_id == 0)
+                                                matching_chunk =
+                                                    object->hdr_chunk;
+                                        else if (object->soft_del)
+                                                matching_chunk = old_chunk;     /* Defeat the test */
+                                        else
+                                                matching_chunk =
+                                                    yaffs_find_chunk_in_file
+                                                    (object, tags.chunk_id,
+                                                     NULL);
+
+                                        if (old_chunk != matching_chunk)
+                                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                                        "gc: page in gc mismatch: %d %d %d %d",
+                                                        old_chunk,
+                                                        matching_chunk,
+                                                        tags.obj_id,
+                                                        tags.chunk_id);
+
+                                }
+
+                                if (!object) {
+                                        yaffs_trace(YAFFS_TRACE_ERROR,
+                                                "page %d in gc has no object: %d %d %d ",
+                                                old_chunk,
+                                                tags.obj_id, tags.chunk_id,
+                                                tags.n_bytes);
+                                }
+
+                                if (object &&
+                                    object->deleted &&
+                                    object->soft_del && tags.chunk_id != 0) {
+                                        /* Data chunk in a soft deleted file, throw it away
+                                         * It's a soft deleted data chunk,
+                                         * No need to copy this, just forget about it and
+                                         * fix up the object.
+                                         */
+
+                                        /* Free chunks already includes softdeleted chunks.
+                                         * How ever this chunk is going to soon be really deleted
+                                         * which will increment free chunks.
+                                         * We have to decrement free chunks so this works out properly.
+                                         */
+                                        dev->n_free_chunks--;
+                                        bi->soft_del_pages--;
+
+                                        object->n_data_chunks--;
+
+                                        if (object->n_data_chunks <= 0) {
+                                                /* remeber to clean up the object */
+                                                dev->gc_cleanup_list[dev->
+                                                                     n_clean_ups]
+                                                    = tags.obj_id;
+                                                dev->n_clean_ups++;
+                                        }
+                                        mark_flash = 0;
+                                } else if (0) {
+                                        /* Todo object && object->deleted && object->n_data_chunks == 0 */
+                                        /* Deleted object header with no data chunks.
+                                         * Can be discarded and the file deleted.
+                                         */
+                                        object->hdr_chunk = 0;
+                                        yaffs_free_tnode(object->my_dev,
+                                                         object->
+                                                         variant.file_variant.
+                                                         top);
+                                        object->variant.file_variant.top = NULL;
+                                        yaffs_generic_obj_del(object);
+
+                                } else if (object) {
+                                        /* It's either a data chunk in a live file or
+                                         * an ObjectHeader, so we're interested in it.
+                                         * NB Need to keep the ObjectHeaders of deleted files
+                                         * until the whole file has been deleted off
+                                         */
+                                        tags.serial_number++;
+
+                                        dev->n_gc_copies++;
+
+                                        if (tags.chunk_id == 0) {
+                                                /* It is an object Id,
+                                                 * We need to nuke the shrinkheader flags first
+                                                 * Also need to clean up shadowing.
+                                                 * We no longer want the shrink_header flag since its work is done
+                                                 * and if it is left in place it will mess up scanning.
+                                                 */
+
+                                                struct yaffs_obj_hdr *oh;
+                                                oh = (struct yaffs_obj_hdr *)
+                                                    buffer;
+
+                                                oh->is_shrink = 0;
+                                                tags.extra_is_shrink = 0;
+
+                                                oh->shadows_obj = 0;
+                                                oh->inband_shadowed_obj_id = 0;
+                                                tags.extra_shadows = 0;
+
+                                                /* Update file size */
+                                                if (object->variant_type ==
+                                                    YAFFS_OBJECT_TYPE_FILE) {
+                                                        oh->file_size =
+                                                            object->variant.
+                                                            file_variant.
+                                                            file_size;
+                                                        tags.extra_length =
+                                                            oh->file_size;
+                                                }
+
+                                                yaffs_verify_oh(object, oh,
+                                                                &tags, 1);
+                                                new_chunk =
+                                                    yaffs_write_new_chunk(dev,
+                                                                          (u8 *)
+                                                                          oh,
+                                                                          &tags,
+                                                                          1);
+                                        } else {
+                                                new_chunk =
+                                                    yaffs_write_new_chunk(dev,
+                                                                          buffer,
+                                                                          &tags,
+                                                                          1);
+                                        }
+
+                                        if (new_chunk < 0) {
+                                                ret_val = YAFFS_FAIL;
+                                        } else {
+
+                                                /* Ok, now fix up the Tnodes etc. */
+
+                                                if (tags.chunk_id == 0) {
+                                                        /* It's a header */
+                                                        object->hdr_chunk =
+                                                            new_chunk;
+                                                        object->serial =
+                                                            tags.serial_number;
+                                                } else {
+                                                        /* It's a data chunk */
+                                                        int ok;
+                                                        ok = yaffs_put_chunk_in_file(object, tags.chunk_id, new_chunk, 0);
+                                                }
+                                        }
+                                }
+
+                                if (ret_val == YAFFS_OK)
+                                        yaffs_chunk_del(dev, old_chunk,
+                                                        mark_flash, __LINE__);
+
+                        }
+                }
+
+                yaffs_release_temp_buffer(dev, buffer, __LINE__);
+
+        }
+
+        yaffs_verify_collected_blk(dev, bi, block);
+
+        if (bi->block_state == YAFFS_BLOCK_STATE_COLLECTING) {
+                /*
+                 * The gc did not complete. Set block state back to FULL
+                 * because checkpointing does not restore gc.
+                 */
+                bi->block_state = YAFFS_BLOCK_STATE_FULL;
+        } else {
+                /* The gc completed. */
+                /* Do any required cleanups */
+                for (i = 0; i < dev->n_clean_ups; i++) {
+                        /* Time to delete the file too */
+                        object =
+                            yaffs_find_by_number(dev, dev->gc_cleanup_list[i]);
+                        if (object) {
+                                yaffs_free_tnode(dev,
+                                                 object->variant.
+                                                 file_variant.top);
+                                object->variant.file_variant.top = NULL;
+                                yaffs_trace(YAFFS_TRACE_GC,
+                                        "yaffs: About to finally delete object %d",
+                                        object->obj_id);
+                                yaffs_generic_obj_del(object);
+                                object->my_dev->n_deleted_files--;
+                        }
+
+                }
+
+                chunks_after = yaffs_get_erased_chunks(dev);
+                if (chunks_before >= chunks_after)
+                        yaffs_trace(YAFFS_TRACE_GC,
+                                "gc did not increase free chunks before %d after %d",
+                                chunks_before, chunks_after);
+                dev->gc_block = 0;
+                dev->gc_chunk = 0;
+                dev->n_clean_ups = 0;
+        }
+
+        dev->gc_disable = 0;
+
+        return ret_val;
+}
+
+/*
+ * FindBlockForgarbageCollection is used to select the dirtiest block (or close enough)
+ * for garbage collection.
+ */
+
+static unsigned yaffs_find_gc_block(struct yaffs_dev *dev,
+                                    int aggressive, int background)
+{
+        int i;
+        int iterations;
+        unsigned selected = 0;
+        int prioritised = 0;
+        int prioritised_exist = 0;
+        struct yaffs_block_info *bi;
+        int threshold;
+
+        /* First let's see if we need to grab a prioritised block */
+        if (dev->has_pending_prioritised_gc && !aggressive) {
+                dev->gc_dirtiest = 0;
+                bi = dev->block_info;
+                for (i = dev->internal_start_block;
+                     i <= dev->internal_end_block && !selected; i++) {
+
+                        if (bi->gc_prioritise) {
+                                prioritised_exist = 1;
+                                if (bi->block_state == YAFFS_BLOCK_STATE_FULL &&
+                                    yaffs_block_ok_for_gc(dev, bi)) {
+                                        selected = i;
+                                        prioritised = 1;
+                                }
+                        }
+                        bi++;
+                }
+
+                /*
+                 * If there is a prioritised block and none was selected then
+                 * this happened because there is at least one old dirty block gumming
+                 * up the works. Let's gc the oldest dirty block.
+                 */
+
+                if (prioritised_exist &&
+                    !selected && dev->oldest_dirty_block > 0)
+                        selected = dev->oldest_dirty_block;
+
+                if (!prioritised_exist) /* None found, so we can clear this */
+                        dev->has_pending_prioritised_gc = 0;
+        }
+
+        /* If we're doing aggressive GC then we are happy to take a less-dirty block, and
+         * search harder.
+         * else (we're doing a leasurely gc), then we only bother to do this if the
+         * block has only a few pages in use.
+         */
+
+        if (!selected) {
+                int pages_used;
+                int n_blocks =
+                    dev->internal_end_block - dev->internal_start_block + 1;
+                if (aggressive) {
+                        threshold = dev->param.chunks_per_block;
+                        iterations = n_blocks;
+                } else {
+                        int max_threshold;
+
+                        if (background)
+                                max_threshold = dev->param.chunks_per_block / 2;
+                        else
+                                max_threshold = dev->param.chunks_per_block / 8;
+
+                        if (max_threshold < YAFFS_GC_PASSIVE_THRESHOLD)
+                                max_threshold = YAFFS_GC_PASSIVE_THRESHOLD;
+
+                        threshold = background ? (dev->gc_not_done + 2) * 2 : 0;
+                        if (threshold < YAFFS_GC_PASSIVE_THRESHOLD)
+                                threshold = YAFFS_GC_PASSIVE_THRESHOLD;
+                        if (threshold > max_threshold)
+                                threshold = max_threshold;
+
+                        iterations = n_blocks / 16 + 1;
+                        if (iterations > 100)
+                                iterations = 100;
+                }
+
+                for (i = 0;
+                     i < iterations &&
+                     (dev->gc_dirtiest < 1 ||
+                      dev->gc_pages_in_use > YAFFS_GC_GOOD_ENOUGH); i++) {
+                        dev->gc_block_finder++;
+                        if (dev->gc_block_finder < dev->internal_start_block ||
+                            dev->gc_block_finder > dev->internal_end_block)
+                                dev->gc_block_finder =
+                                    dev->internal_start_block;
+
+                        bi = yaffs_get_block_info(dev, dev->gc_block_finder);
+
+                        pages_used = bi->pages_in_use - bi->soft_del_pages;
+
+                        if (bi->block_state == YAFFS_BLOCK_STATE_FULL &&
+                            pages_used < dev->param.chunks_per_block &&
+                            (dev->gc_dirtiest < 1
+                             || pages_used < dev->gc_pages_in_use)
+                            && yaffs_block_ok_for_gc(dev, bi)) {
+                                dev->gc_dirtiest = dev->gc_block_finder;
+                                dev->gc_pages_in_use = pages_used;
+                        }
+                }
+
+                if (dev->gc_dirtiest > 0 && dev->gc_pages_in_use <= threshold)
+                        selected = dev->gc_dirtiest;
+        }
+
+        /*
+         * If nothing has been selected for a while, try selecting the oldest dirty
+         * because that's gumming up the works.
+         */
+
+        if (!selected && dev->param.is_yaffs2 &&
+            dev->gc_not_done >= (background ? 10 : 20)) {
+                yaffs2_find_oldest_dirty_seq(dev);
+                if (dev->oldest_dirty_block > 0) {
+                        selected = dev->oldest_dirty_block;
+                        dev->gc_dirtiest = selected;
+                        dev->oldest_dirty_gc_count++;
+                        bi = yaffs_get_block_info(dev, selected);
+                        dev->gc_pages_in_use =
+                            bi->pages_in_use - bi->soft_del_pages;
+                } else {
+                        dev->gc_not_done = 0;
+                }
+        }
+
+        if (selected) {
+                yaffs_trace(YAFFS_TRACE_GC,
+                        "GC Selected block %d with %d free, prioritised:%d",
+                        selected,
+                        dev->param.chunks_per_block - dev->gc_pages_in_use,
+                        prioritised);
+
+                dev->n_gc_blocks++;
+                if (background)
+                        dev->bg_gcs++;
+
+                dev->gc_dirtiest = 0;
+                dev->gc_pages_in_use = 0;
+                dev->gc_not_done = 0;
+                if (dev->refresh_skip > 0)
+                        dev->refresh_skip--;
+        } else {
+                dev->gc_not_done++;
+                yaffs_trace(YAFFS_TRACE_GC,
+                        "GC none: finder %d skip %d threshold %d dirtiest %d using %d oldest %d%s",
+                        dev->gc_block_finder, dev->gc_not_done, threshold,
+                        dev->gc_dirtiest, dev->gc_pages_in_use,
+                        dev->oldest_dirty_block, background ? " bg" : "");
+        }
+
+        return selected;
+}
+
+/* New garbage collector
+ * If we're very low on erased blocks then we do aggressive garbage collection
+ * otherwise we do "leasurely" garbage collection.
+ * Aggressive gc looks further (whole array) and will accept less dirty blocks.
+ * Passive gc only inspects smaller areas and will only accept more dirty blocks.
+ *
+ * The idea is to help clear out space in a more spread-out manner.
+ * Dunno if it really does anything useful.
+ */
+static int yaffs_check_gc(struct yaffs_dev *dev, int background)
+{
+        int aggressive = 0;
+        int gc_ok = YAFFS_OK;
+        int max_tries = 0;
+        int min_erased;
+        int erased_chunks;
+        int checkpt_block_adjust;
+
+        if (dev->param.gc_control && (dev->param.gc_control(dev) & 1) == 0)
+                return YAFFS_OK;
+
+        if (dev->gc_disable) {
+                /* Bail out so we don't get recursive gc */
+                return YAFFS_OK;
+        }
+
+        /* This loop should pass the first time.
+         * We'll only see looping here if the collection does not increase space.
+         */
+
+        do {
+                max_tries++;
+
+                checkpt_block_adjust = yaffs_calc_checkpt_blocks_required(dev);
+
+                min_erased =
+                    dev->param.n_reserved_blocks + checkpt_block_adjust + 1;
+                erased_chunks =
+                    dev->n_erased_blocks * dev->param.chunks_per_block;
+
+                /* If we need a block soon then do aggressive gc. */
+                if (dev->n_erased_blocks < min_erased)
+                        aggressive = 1;
+                else {
+                        if (!background
+                            && erased_chunks > (dev->n_free_chunks / 4))
+                                break;
+
+                        if (dev->gc_skip > 20)
+                                dev->gc_skip = 20;
+                        if (erased_chunks < dev->n_free_chunks / 2 ||
+                            dev->gc_skip < 1 || background)
+                                aggressive = 0;
+                        else {
+                                dev->gc_skip--;
+                                break;
+                        }
+                }
+
+                dev->gc_skip = 5;
+
+                /* If we don't already have a block being gc'd then see if we should start another */
+
+                if (dev->gc_block < 1 && !aggressive) {
+                        dev->gc_block = yaffs2_find_refresh_block(dev);
+                        dev->gc_chunk = 0;
+                        dev->n_clean_ups = 0;
+                }
+                if (dev->gc_block < 1) {
+                        dev->gc_block =
+                            yaffs_find_gc_block(dev, aggressive, background);
+                        dev->gc_chunk = 0;
+                        dev->n_clean_ups = 0;
+                }
+
+                if (dev->gc_block > 0) {
+                        dev->all_gcs++;
+                        if (!aggressive)
+                                dev->passive_gc_count++;
+
+                        yaffs_trace(YAFFS_TRACE_GC,
+                                "yaffs: GC n_erased_blocks %d aggressive %d",
+                                dev->n_erased_blocks, aggressive);
+
+                        gc_ok = yaffs_gc_block(dev, dev->gc_block, aggressive);
+                }
+
+                if (dev->n_erased_blocks < (dev->param.n_reserved_blocks)
+                    && dev->gc_block > 0) {
+                        yaffs_trace(YAFFS_TRACE_GC,
+                                "yaffs: GC !!!no reclaim!!! n_erased_blocks %d after try %d block %d",
+                                dev->n_erased_blocks, max_tries,
+                                dev->gc_block);
+                }
+        } while ((dev->n_erased_blocks < dev->param.n_reserved_blocks) &&
+                 (dev->gc_block > 0) && (max_tries < 2));
+
+        return aggressive ? gc_ok : YAFFS_OK;
+}
+
+/*
+ * yaffs_bg_gc()
+ * Garbage collects. Intended to be called from a background thread.
+ * Returns non-zero if at least half the free chunks are erased.
+ */
+int yaffs_bg_gc(struct yaffs_dev *dev, unsigned urgency)
+{
+        int erased_chunks = dev->n_erased_blocks * dev->param.chunks_per_block;
+
+        yaffs_trace(YAFFS_TRACE_BACKGROUND, "Background gc %u", urgency);
+
+        yaffs_check_gc(dev, 1);
+        return erased_chunks > dev->n_free_chunks / 2;
+}
+
+/*-------------------- Data file manipulation -----------------*/
+
+static int yaffs_rd_data_obj(struct yaffs_obj *in, int inode_chunk, u8 * buffer)
+{
+        int nand_chunk = yaffs_find_chunk_in_file(in, inode_chunk, NULL);
+
+        if (nand_chunk >= 0)
+                return yaffs_rd_chunk_tags_nand(in->my_dev, nand_chunk,
+                                                buffer, NULL);
+        else {
+                yaffs_trace(YAFFS_TRACE_NANDACCESS,
+                        "Chunk %d not found zero instead",
+                        nand_chunk);
+                /* get sane (zero) data if you read a hole */
+                memset(buffer, 0, in->my_dev->data_bytes_per_chunk);
+                return 0;
+        }
+
+}
+
+void yaffs_chunk_del(struct yaffs_dev *dev, int chunk_id, int mark_flash,
+                     int lyn)
+{
+        int block;
+        int page;
+        struct yaffs_ext_tags tags;
+        struct yaffs_block_info *bi;
+
+        if (chunk_id <= 0)
+                return;
+
+        dev->n_deletions++;
+        block = chunk_id / dev->param.chunks_per_block;
+        page = chunk_id % dev->param.chunks_per_block;
+
+        if (!yaffs_check_chunk_bit(dev, block, page))
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Deleting invalid chunk %d", chunk_id);
+
+        bi = yaffs_get_block_info(dev, block);
+
+        yaffs2_update_oldest_dirty_seq(dev, block, bi);
+
+        yaffs_trace(YAFFS_TRACE_DELETION,
+                "line %d delete of chunk %d",
+                lyn, chunk_id);
+
+        if (!dev->param.is_yaffs2 && mark_flash &&
+            bi->block_state != YAFFS_BLOCK_STATE_COLLECTING) {
+
+                yaffs_init_tags(&tags);
+
+                tags.is_deleted = 1;
+
+                yaffs_wr_chunk_tags_nand(dev, chunk_id, NULL, &tags);
+                yaffs_handle_chunk_update(dev, chunk_id, &tags);
+        } else {
+                dev->n_unmarked_deletions++;
+        }
+
+        /* Pull out of the management area.
+         * If the whole block became dirty, this will kick off an erasure.
+         */
+        if (bi->block_state == YAFFS_BLOCK_STATE_ALLOCATING ||
+            bi->block_state == YAFFS_BLOCK_STATE_FULL ||
+            bi->block_state == YAFFS_BLOCK_STATE_NEEDS_SCANNING ||
+            bi->block_state == YAFFS_BLOCK_STATE_COLLECTING) {
+                dev->n_free_chunks++;
+
+                yaffs_clear_chunk_bit(dev, block, page);
+
+                bi->pages_in_use--;
+
+                if (bi->pages_in_use == 0 &&
+                    !bi->has_shrink_hdr &&
+                    bi->block_state != YAFFS_BLOCK_STATE_ALLOCATING &&
+                    bi->block_state != YAFFS_BLOCK_STATE_NEEDS_SCANNING) {
+                        yaffs_block_became_dirty(dev, block);
+                }
+
+        }
+
+}
+
+static int yaffs_wr_data_obj(struct yaffs_obj *in, int inode_chunk,
+                             const u8 * buffer, int n_bytes, int use_reserve)
+{
+        /* Find old chunk Need to do this to get serial number
+         * Write new one and patch into tree.
+         * Invalidate old tags.
+         */
+
+        int prev_chunk_id;
+        struct yaffs_ext_tags prev_tags;
+
+        int new_chunk_id;
+        struct yaffs_ext_tags new_tags;
+
+        struct yaffs_dev *dev = in->my_dev;
+
+        yaffs_check_gc(dev, 0);
+
+        /* Get the previous chunk at this location in the file if it exists.
+         * If it does not exist then put a zero into the tree. This creates
+         * the tnode now, rather than later when it is harder to clean up.
+         */
+        prev_chunk_id = yaffs_find_chunk_in_file(in, inode_chunk, &prev_tags);
+        if (prev_chunk_id < 1 &&
+            !yaffs_put_chunk_in_file(in, inode_chunk, 0, 0))
+                return 0;
+
+        /* Set up new tags */
+        yaffs_init_tags(&new_tags);
+
+        new_tags.chunk_id = inode_chunk;
+        new_tags.obj_id = in->obj_id;
+        new_tags.serial_number =
+            (prev_chunk_id > 0) ? prev_tags.serial_number + 1 : 1;
+        new_tags.n_bytes = n_bytes;
+
+        if (n_bytes < 1 || n_bytes > dev->param.total_bytes_per_chunk) {
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                  "Writing %d bytes to chunk!!!!!!!!!",
+                   n_bytes);
+                YBUG();
+        }
+
+        new_chunk_id =
+            yaffs_write_new_chunk(dev, buffer, &new_tags, use_reserve);
+
+        if (new_chunk_id > 0) {
+                yaffs_put_chunk_in_file(in, inode_chunk, new_chunk_id, 0);
+
+                if (prev_chunk_id > 0)
+                        yaffs_chunk_del(dev, prev_chunk_id, 1, __LINE__);
+
+                yaffs_verify_file_sane(in);
+        }
+        return new_chunk_id;
+
+}
+
+
+
+static int yaffs_do_xattrib_mod(struct yaffs_obj *obj, int set,
+                                const YCHAR * name, const void *value, int size,
+                                int flags)
+{
+        struct yaffs_xattr_mod xmod;
+
+        int result;
+
+        xmod.set = set;
+        xmod.name = name;
+        xmod.data = value;
+        xmod.size = size;
+        xmod.flags = flags;
+        xmod.result = -ENOSPC;
+
+        result = yaffs_update_oh(obj, NULL, 0, 0, 0, &xmod);
+
+        if (result > 0)
+                return xmod.result;
+        else
+                return -ENOSPC;
+}
+
+static int yaffs_apply_xattrib_mod(struct yaffs_obj *obj, char *buffer,
+                                   struct yaffs_xattr_mod *xmod)
+{
+        int retval = 0;
+        int x_offs = sizeof(struct yaffs_obj_hdr);
+        struct yaffs_dev *dev = obj->my_dev;
+        int x_size = dev->data_bytes_per_chunk - sizeof(struct yaffs_obj_hdr);
+
+        char *x_buffer = buffer + x_offs;
+
+        if (xmod->set)
+                retval =
+                    nval_set(x_buffer, x_size, xmod->name, xmod->data,
+                             xmod->size, xmod->flags);
+        else
+                retval = nval_del(x_buffer, x_size, xmod->name);
+
+        obj->has_xattr = nval_hasvalues(x_buffer, x_size);
+        obj->xattr_known = 1;
+
+        xmod->result = retval;
+
+        return retval;
+}
+
+static int yaffs_do_xattrib_fetch(struct yaffs_obj *obj, const YCHAR * name,
+                                  void *value, int size)
+{
+        char *buffer = NULL;
+        int result;
+        struct yaffs_ext_tags tags;
+        struct yaffs_dev *dev = obj->my_dev;
+        int x_offs = sizeof(struct yaffs_obj_hdr);
+        int x_size = dev->data_bytes_per_chunk - sizeof(struct yaffs_obj_hdr);
+
+        char *x_buffer;
+
+        int retval = 0;
+
+        if (obj->hdr_chunk < 1)
+                return -ENODATA;
+
+        /* If we know that the object has no xattribs then don't do all the
+         * reading and parsing.
+         */
+        if (obj->xattr_known && !obj->has_xattr) {
+                if (name)
+                        return -ENODATA;
+                else
+                        return 0;
+        }
+
+        buffer = (char *)yaffs_get_temp_buffer(dev, __LINE__);
+        if (!buffer)
+                return -ENOMEM;
+
+        result =
+            yaffs_rd_chunk_tags_nand(dev, obj->hdr_chunk, (u8 *) buffer, &tags);
+
+        if (result != YAFFS_OK)
+                retval = -ENOENT;
+        else {
+                x_buffer = buffer + x_offs;
+
+                if (!obj->xattr_known) {
+                        obj->has_xattr = nval_hasvalues(x_buffer, x_size);
+                        obj->xattr_known = 1;
+                }
+
+                if (name)
+                        retval = nval_get(x_buffer, x_size, name, value, size);
+                else
+                        retval = nval_list(x_buffer, x_size, value, size);
+        }
+        yaffs_release_temp_buffer(dev, (u8 *) buffer, __LINE__);
+        return retval;
+}
+
+int yaffs_set_xattrib(struct yaffs_obj *obj, const YCHAR * name,
+                      const void *value, int size, int flags)
+{
+        return yaffs_do_xattrib_mod(obj, 1, name, value, size, flags);
+}
+
+int yaffs_remove_xattrib(struct yaffs_obj *obj, const YCHAR * name)
+{
+        return yaffs_do_xattrib_mod(obj, 0, name, NULL, 0, 0);
+}
+
+int yaffs_get_xattrib(struct yaffs_obj *obj, const YCHAR * name, void *value,
+                      int size)
+{
+        return yaffs_do_xattrib_fetch(obj, name, value, size);
+}
+
+int yaffs_list_xattrib(struct yaffs_obj *obj, char *buffer, int size)
+{
+        return yaffs_do_xattrib_fetch(obj, NULL, buffer, size);
+}
+
+static void yaffs_check_obj_details_loaded(struct yaffs_obj *in)
+{
+        u8 *chunk_data;
+        struct yaffs_obj_hdr *oh;
+        struct yaffs_dev *dev;
+        struct yaffs_ext_tags tags;
+        int result;
+        int alloc_failed = 0;
+
+        if (!in)
+                return;
+
+        dev = in->my_dev;
+
+        if (in->lazy_loaded && in->hdr_chunk > 0) {
+                in->lazy_loaded = 0;
+                chunk_data = yaffs_get_temp_buffer(dev, __LINE__);
+
+                result =
+                    yaffs_rd_chunk_tags_nand(dev, in->hdr_chunk, chunk_data,
+                                             &tags);
+                oh = (struct yaffs_obj_hdr *)chunk_data;
+
+                in->yst_mode = oh->yst_mode;
+                yaffs_load_attribs(in, oh);
+                yaffs_set_obj_name_from_oh(in, oh);
+
+                if (in->variant_type == YAFFS_OBJECT_TYPE_SYMLINK) {
+                        in->variant.symlink_variant.alias =
+                            yaffs_clone_str(oh->alias);
+                        if (!in->variant.symlink_variant.alias)
+                                alloc_failed = 1;       /* Not returned to caller */
+                }
+
+                yaffs_release_temp_buffer(dev, chunk_data, __LINE__);
+        }
+}
+
+static void yaffs_load_name_from_oh(struct yaffs_dev *dev, YCHAR * name,
+                                    const YCHAR * oh_name, int buff_size)
+{
+#ifdef CONFIG_YAFFS_AUTO_UNICODE
+        if (dev->param.auto_unicode) {
+                if (*oh_name) {
+                        /* It is an ASCII name, do an ASCII to
+                         * unicode conversion */
+                        const char *ascii_oh_name = (const char *)oh_name;
+                        int n = buff_size - 1;
+                        while (n > 0 && *ascii_oh_name) {
+                                *name = *ascii_oh_name;
+                                name++;
+                                ascii_oh_name++;
+                                n--;
+                        }
+                } else {
+                        strncpy(name, oh_name + 1, buff_size - 1);
+                }
+        } else {
+#else
+        {
+#endif
+                strncpy(name, oh_name, buff_size - 1);
+        }
+}
+
+static void yaffs_load_oh_from_name(struct yaffs_dev *dev, YCHAR * oh_name,
+                                    const YCHAR * name)
+{
+#ifdef CONFIG_YAFFS_AUTO_UNICODE
+
+        int is_ascii;
+        YCHAR *w;
+
+        if (dev->param.auto_unicode) {
+
+                is_ascii = 1;
+                w = name;
+
+                /* Figure out if the name will fit in ascii character set */
+                while (is_ascii && *w) {
+                        if ((*w) & 0xff00)
+                                is_ascii = 0;
+                        w++;
+                }
+
+                if (is_ascii) {
+                        /* It is an ASCII name, so do a unicode to ascii conversion */
+                        char *ascii_oh_name = (char *)oh_name;
+                        int n = YAFFS_MAX_NAME_LENGTH - 1;
+                        while (n > 0 && *name) {
+                                *ascii_oh_name = *name;
+                                name++;
+                                ascii_oh_name++;
+                                n--;
+                        }
+                } else {
+                        /* It is a unicode name, so save starting at the second YCHAR */
+                        *oh_name = 0;
+                        strncpy(oh_name + 1, name,
+                                      YAFFS_MAX_NAME_LENGTH - 2);
+                }
+        } else {
+#else
+        {
+#endif
+                strncpy(oh_name, name, YAFFS_MAX_NAME_LENGTH - 1);
+        }
+
+}
+
+/* UpdateObjectHeader updates the header on NAND for an object.
+ * If name is not NULL, then that new name is used.
+ */
+int yaffs_update_oh(struct yaffs_obj *in, const YCHAR * name, int force,
+                    int is_shrink, int shadows, struct yaffs_xattr_mod *xmod)
+{
+
+        struct yaffs_block_info *bi;
+
+        struct yaffs_dev *dev = in->my_dev;
+
+        int prev_chunk_id;
+        int ret_val = 0;
+        int result = 0;
+
+        int new_chunk_id;
+        struct yaffs_ext_tags new_tags;
+        struct yaffs_ext_tags old_tags;
+        const YCHAR *alias = NULL;
+
+        u8 *buffer = NULL;
+        YCHAR old_name[YAFFS_MAX_NAME_LENGTH + 1];
+
+        struct yaffs_obj_hdr *oh = NULL;
+
+        strcpy(old_name, _Y("silly old name"));
+
+        if (!in->fake || in == dev->root_dir ||
+            force || xmod) {
+
+                yaffs_check_gc(dev, 0);
+                yaffs_check_obj_details_loaded(in);
+
+                buffer = yaffs_get_temp_buffer(in->my_dev, __LINE__);
+                oh = (struct yaffs_obj_hdr *)buffer;
+
+                prev_chunk_id = in->hdr_chunk;
+
+                if (prev_chunk_id > 0) {
+                        result = yaffs_rd_chunk_tags_nand(dev, prev_chunk_id,
+                                                          buffer, &old_tags);
+
+                        yaffs_verify_oh(in, oh, &old_tags, 0);
+
+                        memcpy(old_name, oh->name, sizeof(oh->name));
+                        memset(buffer, 0xFF, sizeof(struct yaffs_obj_hdr));
+                } else {
+                        memset(buffer, 0xFF, dev->data_bytes_per_chunk);
+                }
+
+                oh->type = in->variant_type;
+                oh->yst_mode = in->yst_mode;
+                oh->shadows_obj = oh->inband_shadowed_obj_id = shadows;
+
+                yaffs_load_attribs_oh(oh, in);
+
+                if (in->parent)
+                        oh->parent_obj_id = in->parent->obj_id;
+                else
+                        oh->parent_obj_id = 0;
+
+                if (name && *name) {
+                        memset(oh->name, 0, sizeof(oh->name));
+                        yaffs_load_oh_from_name(dev, oh->name, name);
+                } else if (prev_chunk_id > 0) {
+                        memcpy(oh->name, old_name, sizeof(oh->name));
+                } else {
+                        memset(oh->name, 0, sizeof(oh->name));
+                }
+
+                oh->is_shrink = is_shrink;
+
+                switch (in->variant_type) {
+                case YAFFS_OBJECT_TYPE_UNKNOWN:
+                        /* Should not happen */
+                        break;
+                case YAFFS_OBJECT_TYPE_FILE:
+                        oh->file_size =
+                            (oh->parent_obj_id == YAFFS_OBJECTID_DELETED
+                             || oh->parent_obj_id ==
+                             YAFFS_OBJECTID_UNLINKED) ? 0 : in->
+                            variant.file_variant.file_size;
+                        break;
+                case YAFFS_OBJECT_TYPE_HARDLINK:
+                        oh->equiv_id = in->variant.hardlink_variant.equiv_id;
+                        break;
+                case YAFFS_OBJECT_TYPE_SPECIAL:
+                        /* Do nothing */
+                        break;
+                case YAFFS_OBJECT_TYPE_DIRECTORY:
+                        /* Do nothing */
+                        break;
+                case YAFFS_OBJECT_TYPE_SYMLINK:
+                        alias = in->variant.symlink_variant.alias;
+                        if (!alias)
+                                alias = _Y("no alias");
+                        strncpy(oh->alias, alias, YAFFS_MAX_ALIAS_LENGTH);
+                        oh->alias[YAFFS_MAX_ALIAS_LENGTH] = 0;
+                        break;
+                }
+
+                /* process any xattrib modifications */
+                if (xmod)
+                        yaffs_apply_xattrib_mod(in, (char *)buffer, xmod);
+
+                /* Tags */
+                yaffs_init_tags(&new_tags);
+                in->serial++;
+                new_tags.chunk_id = 0;
+                new_tags.obj_id = in->obj_id;
+                new_tags.serial_number = in->serial;
+
+                /* Add extra info for file header */
+
+                new_tags.extra_available = 1;
+                new_tags.extra_parent_id = oh->parent_obj_id;
+                new_tags.extra_length = oh->file_size;
+                new_tags.extra_is_shrink = oh->is_shrink;
+                new_tags.extra_equiv_id = oh->equiv_id;
+                new_tags.extra_shadows = (oh->shadows_obj > 0) ? 1 : 0;
+                new_tags.extra_obj_type = in->variant_type;
+
+                yaffs_verify_oh(in, oh, &new_tags, 1);
+
+                /* Create new chunk in NAND */
+                new_chunk_id =
+                    yaffs_write_new_chunk(dev, buffer, &new_tags,
+                                          (prev_chunk_id > 0) ? 1 : 0);
+
+                if (new_chunk_id >= 0) {
+
+                        in->hdr_chunk = new_chunk_id;
+
+                        if (prev_chunk_id > 0) {
+                                yaffs_chunk_del(dev, prev_chunk_id, 1,
+                                                __LINE__);
+                        }
+
+                        if (!yaffs_obj_cache_dirty(in))
+                                in->dirty = 0;
+
+                        /* If this was a shrink, then mark the block that the chunk lives on */
+                        if (is_shrink) {
+                                bi = yaffs_get_block_info(in->my_dev,
+                                                          new_chunk_id /
+                                                          in->my_dev->param.
+                                                          chunks_per_block);
+                                bi->has_shrink_hdr = 1;
+                        }
+
+                }
+
+                ret_val = new_chunk_id;
+
+        }
+
+        if (buffer)
+                yaffs_release_temp_buffer(dev, buffer, __LINE__);
+
+        return ret_val;
+}
+
+/*--------------------- File read/write ------------------------
+ * Read and write have very similar structures.
+ * In general the read/write has three parts to it
+ * An incomplete chunk to start with (if the read/write is not chunk-aligned)
+ * Some complete chunks
+ * An incomplete chunk to end off with
+ *
+ * Curve-balls: the first chunk might also be the last chunk.
+ */
+
+int yaffs_file_rd(struct yaffs_obj *in, u8 * buffer, loff_t offset, int n_bytes)
+{
+
+        int chunk;
+        u32 start;
+        int n_copy;
+        int n = n_bytes;
+        int n_done = 0;
+        struct yaffs_cache *cache;
+
+        struct yaffs_dev *dev;
+
+        dev = in->my_dev;
+
+        while (n > 0) {
+                /* chunk = offset / dev->data_bytes_per_chunk + 1; */
+                /* start = offset % dev->data_bytes_per_chunk; */
+                yaffs_addr_to_chunk(dev, offset, &chunk, &start);
+                chunk++;
+
+                /* OK now check for the curveball where the start and end are in
+                 * the same chunk.
+                 */
+                if ((start + n) < dev->data_bytes_per_chunk)
+                        n_copy = n;
+                else
+                        n_copy = dev->data_bytes_per_chunk - start;
+
+                cache = yaffs_find_chunk_cache(in, chunk);
+
+                /* If the chunk is already in the cache or it is less than a whole chunk
+                 * or we're using inband tags then use the cache (if there is caching)
+                 * else bypass the cache.
+                 */
+                if (cache || n_copy != dev->data_bytes_per_chunk
+                    || dev->param.inband_tags) {
+                        if (dev->param.n_caches > 0) {
+
+                                /* If we can't find the data in the cache, then load it up. */
+
+                                if (!cache) {
+                                        cache =
+                                            yaffs_grab_chunk_cache(in->my_dev);
+                                        cache->object = in;
+                                        cache->chunk_id = chunk;
+                                        cache->dirty = 0;
+                                        cache->locked = 0;
+                                        yaffs_rd_data_obj(in, chunk,
+                                                          cache->data);
+                                        cache->n_bytes = 0;
+                                }
+
+                                yaffs_use_cache(dev, cache, 0);
+
+                                cache->locked = 1;
+
+                                memcpy(buffer, &cache->data[start], n_copy);
+
+                                cache->locked = 0;
+                        } else {
+                                /* Read into the local buffer then copy.. */
+
+                                u8 *local_buffer =
+                                    yaffs_get_temp_buffer(dev, __LINE__);
+                                yaffs_rd_data_obj(in, chunk, local_buffer);
+
+                                memcpy(buffer, &local_buffer[start], n_copy);
+
+                                yaffs_release_temp_buffer(dev, local_buffer,
+                                                          __LINE__);
+                        }
+
+                } else {
+
+                        /* A full chunk. Read directly into the supplied buffer. */
+                        yaffs_rd_data_obj(in, chunk, buffer);
+
+                }
+
+                n -= n_copy;
+                offset += n_copy;
+                buffer += n_copy;
+                n_done += n_copy;
+
+        }
+
+        return n_done;
+}
+
+int yaffs_do_file_wr(struct yaffs_obj *in, const u8 * buffer, loff_t offset,
+                     int n_bytes, int write_trhrough)
+{
+
+        int chunk;
+        u32 start;
+        int n_copy;
+        int n = n_bytes;
+        int n_done = 0;
+        int n_writeback;
+        int start_write = offset;
+        int chunk_written = 0;
+        u32 n_bytes_read;
+        u32 chunk_start;
+
+        struct yaffs_dev *dev;
+
+        dev = in->my_dev;
+
+        while (n > 0 && chunk_written >= 0) {
+                yaffs_addr_to_chunk(dev, offset, &chunk, &start);
+
+                if (chunk * dev->data_bytes_per_chunk + start != offset ||
+                    start >= dev->data_bytes_per_chunk) {
+                        yaffs_trace(YAFFS_TRACE_ERROR,
+                                "AddrToChunk of offset %d gives chunk %d start %d",
+                                (int)offset, chunk, start);
+                }
+                chunk++;        /* File pos to chunk in file offset */
+
+                /* OK now check for the curveball where the start and end are in
+                 * the same chunk.
+                 */
+
+                if ((start + n) < dev->data_bytes_per_chunk) {
+                        n_copy = n;
+
+                        /* Now folks, to calculate how many bytes to write back....
+                         * If we're overwriting and not writing to then end of file then
+                         * we need to write back as much as was there before.
+                         */
+
+                        chunk_start = ((chunk - 1) * dev->data_bytes_per_chunk);
+
+                        if (chunk_start > in->variant.file_variant.file_size)
+                                n_bytes_read = 0;       /* Past end of file */
+                        else
+                                n_bytes_read =
+                                    in->variant.file_variant.file_size -
+                                    chunk_start;
+
+                        if (n_bytes_read > dev->data_bytes_per_chunk)
+                                n_bytes_read = dev->data_bytes_per_chunk;
+
+                        n_writeback =
+                            (n_bytes_read >
+                             (start + n)) ? n_bytes_read : (start + n);
+
+                        if (n_writeback < 0
+                            || n_writeback > dev->data_bytes_per_chunk)
+                                YBUG();
+
+                } else {
+                        n_copy = dev->data_bytes_per_chunk - start;
+                        n_writeback = dev->data_bytes_per_chunk;
+                }
+
+                if (n_copy != dev->data_bytes_per_chunk
+                    || dev->param.inband_tags) {
+                        /* An incomplete start or end chunk (or maybe both start and end chunk),
+                         * or we're using inband tags, so we want to use the cache buffers.
+                         */
+                        if (dev->param.n_caches > 0) {
+                                struct yaffs_cache *cache;
+                                /* If we can't find the data in the cache, then load the cache */
+                                cache = yaffs_find_chunk_cache(in, chunk);
+
+                                if (!cache
+                                    && yaffs_check_alloc_available(dev, 1)) {
+                                        cache = yaffs_grab_chunk_cache(dev);
+                                        cache->object = in;
+                                        cache->chunk_id = chunk;
+                                        cache->dirty = 0;
+                                        cache->locked = 0;
+                                        yaffs_rd_data_obj(in, chunk,
+                                                          cache->data);
+                                } else if (cache &&
+                                           !cache->dirty &&
+                                           !yaffs_check_alloc_available(dev,
+                                                                        1)) {
+                                        /* Drop the cache if it was a read cache item and
+                                         * no space check has been made for it.
+                                         */
+                                        cache = NULL;
+                                }
+
+                                if (cache) {
+                                        yaffs_use_cache(dev, cache, 1);
+                                        cache->locked = 1;
+
+                                        memcpy(&cache->data[start], buffer,
+                                               n_copy);
+
+                                        cache->locked = 0;
+                                        cache->n_bytes = n_writeback;
+
+                                        if (write_trhrough) {
+                                                chunk_written =
+                                                    yaffs_wr_data_obj
+                                                    (cache->object,
+                                                     cache->chunk_id,
+                                                     cache->data,
+                                                     cache->n_bytes, 1);
+                                                cache->dirty = 0;
+                                        }
+
+                                } else {
+                                        chunk_written = -1;     /* fail the write */
+                                }
+                        } else {
+                                /* An incomplete start or end chunk (or maybe both start and end chunk)
+                                 * Read into the local buffer then copy, then copy over and write back.
+                                 */
+
+                                u8 *local_buffer =
+                                    yaffs_get_temp_buffer(dev, __LINE__);
+
+                                yaffs_rd_data_obj(in, chunk, local_buffer);
+
+                                memcpy(&local_buffer[start], buffer, n_copy);
+
+                                chunk_written =
+                                    yaffs_wr_data_obj(in, chunk,
+                                                      local_buffer,
+                                                      n_writeback, 0);
+
+                                yaffs_release_temp_buffer(dev, local_buffer,
+                                                          __LINE__);
+
+                        }
+
+                } else {
+                        /* A full chunk. Write directly from the supplied buffer. */
+
+                        chunk_written =
+                            yaffs_wr_data_obj(in, chunk, buffer,
+                                              dev->data_bytes_per_chunk, 0);
+
+                        /* Since we've overwritten the cached data, we better invalidate it. */
+                        yaffs_invalidate_chunk_cache(in, chunk);
+                }
+
+                if (chunk_written >= 0) {
+                        n -= n_copy;
+                        offset += n_copy;
+                        buffer += n_copy;
+                        n_done += n_copy;
+                }
+
+        }
+
+        /* Update file object */
+
+        if ((start_write + n_done) > in->variant.file_variant.file_size)
+                in->variant.file_variant.file_size = (start_write + n_done);
+
+        in->dirty = 1;
+
+        return n_done;
+}
+
+int yaffs_wr_file(struct yaffs_obj *in, const u8 * buffer, loff_t offset,
+                  int n_bytes, int write_trhrough)
+{
+        yaffs2_handle_hole(in, offset);
+        return yaffs_do_file_wr(in, buffer, offset, n_bytes, write_trhrough);
+}
+
+/* ---------------------- File resizing stuff ------------------ */
+
+static void yaffs_prune_chunks(struct yaffs_obj *in, int new_size)
+{
+
+        struct yaffs_dev *dev = in->my_dev;
+        int old_size = in->variant.file_variant.file_size;
+
+        int last_del = 1 + (old_size - 1) / dev->data_bytes_per_chunk;
+
+        int start_del = 1 + (new_size + dev->data_bytes_per_chunk - 1) /
+            dev->data_bytes_per_chunk;
+        int i;
+        int chunk_id;
+
+        /* Delete backwards so that we don't end up with holes if
+         * power is lost part-way through the operation.
+         */
+        for (i = last_del; i >= start_del; i--) {
+                /* NB this could be optimised somewhat,
+                 * eg. could retrieve the tags and write them without
+                 * using yaffs_chunk_del
+                 */
+
+                chunk_id = yaffs_find_del_file_chunk(in, i, NULL);
+                if (chunk_id > 0) {
+                        if (chunk_id <
+                            (dev->internal_start_block *
+                             dev->param.chunks_per_block)
+                            || chunk_id >=
+                            ((dev->internal_end_block +
+                              1) * dev->param.chunks_per_block)) {
+                                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                                        "Found daft chunk_id %d for %d",
+                                        chunk_id, i);
+                        } else {
+                                in->n_data_chunks--;
+                                yaffs_chunk_del(dev, chunk_id, 1, __LINE__);
+                        }
+                }
+        }
+
+}
+
+void yaffs_resize_file_down(struct yaffs_obj *obj, loff_t new_size)
+{
+        int new_full;
+        u32 new_partial;
+        struct yaffs_dev *dev = obj->my_dev;
+
+        yaffs_addr_to_chunk(dev, new_size, &new_full, &new_partial);
+
+        yaffs_prune_chunks(obj, new_size);
+
+        if (new_partial != 0) {
+                int last_chunk = 1 + new_full;
+                u8 *local_buffer = yaffs_get_temp_buffer(dev, __LINE__);
+
+                /* Rewrite the last chunk with its new size and zero pad */
+                yaffs_rd_data_obj(obj, last_chunk, local_buffer);
+                memset(local_buffer + new_partial, 0,
+                       dev->data_bytes_per_chunk - new_partial);
+
+                yaffs_wr_data_obj(obj, last_chunk, local_buffer,
+                                  new_partial, 1);
+
+                yaffs_release_temp_buffer(dev, local_buffer, __LINE__);
+        }
+
+        obj->variant.file_variant.file_size = new_size;
+
+        yaffs_prune_tree(dev, &obj->variant.file_variant);
+}
+
+int yaffs_resize_file(struct yaffs_obj *in, loff_t new_size)
+{
+        struct yaffs_dev *dev = in->my_dev;
+        int old_size = in->variant.file_variant.file_size;
+
+        yaffs_flush_file_cache(in);
+        yaffs_invalidate_whole_cache(in);
+
+        yaffs_check_gc(dev, 0);
+
+        if (in->variant_type != YAFFS_OBJECT_TYPE_FILE)
+                return YAFFS_FAIL;
+
+        if (new_size == old_size)
+                return YAFFS_OK;
+
+        if (new_size > old_size) {
+                yaffs2_handle_hole(in, new_size);
+                in->variant.file_variant.file_size = new_size;
+        } else {
+                /* new_size < old_size */
+                yaffs_resize_file_down(in, new_size);
+        }
+
+        /* Write a new object header to reflect the resize.
+         * show we've shrunk the file, if need be
+         * Do this only if the file is not in the deleted directories
+         * and is not shadowed.
+         */
+        if (in->parent &&
+            !in->is_shadowed &&
+            in->parent->obj_id != YAFFS_OBJECTID_UNLINKED &&
+            in->parent->obj_id != YAFFS_OBJECTID_DELETED)
+                yaffs_update_oh(in, NULL, 0, 0, 0, NULL);
+
+        return YAFFS_OK;
+}
+
+int yaffs_flush_file(struct yaffs_obj *in, int update_time, int data_sync)
+{
+        int ret_val;
+        if (in->dirty) {
+                yaffs_flush_file_cache(in);
+                if (data_sync)  /* Only sync data */
+                        ret_val = YAFFS_OK;
+                else {
+                        if (update_time)
+                                yaffs_load_current_time(in, 0, 0);
+
+                        ret_val = (yaffs_update_oh(in, NULL, 0, 0, 0, NULL) >=
+                                   0) ? YAFFS_OK : YAFFS_FAIL;
+                }
+        } else {
+                ret_val = YAFFS_OK;
+        }
+
+        return ret_val;
+
+}
+
+
+/* yaffs_del_file deletes the whole file data
+ * and the inode associated with the file.
+ * It does not delete the links associated with the file.
+ */
+static int yaffs_unlink_file_if_needed(struct yaffs_obj *in)
+{
+
+        int ret_val;
+        int del_now = 0;
+        struct yaffs_dev *dev = in->my_dev;
+
+        if (!in->my_inode)
+                del_now = 1;
+
+        if (del_now) {
+                ret_val =
+                    yaffs_change_obj_name(in, in->my_dev->del_dir,
+                                          _Y("deleted"), 0, 0);
+                yaffs_trace(YAFFS_TRACE_TRACING,
+                        "yaffs: immediate deletion of file %d",
+                        in->obj_id);
+                in->deleted = 1;
+                in->my_dev->n_deleted_files++;
+                if (dev->param.disable_soft_del || dev->param.is_yaffs2)
+                        yaffs_resize_file(in, 0);
+                yaffs_soft_del_file(in);
+        } else {
+                ret_val =
+                    yaffs_change_obj_name(in, in->my_dev->unlinked_dir,
+                                          _Y("unlinked"), 0, 0);
+        }
+
+        return ret_val;
+}
+
+int yaffs_del_file(struct yaffs_obj *in)
+{
+        int ret_val = YAFFS_OK;
+        int deleted;            /* Need to cache value on stack if in is freed */
+        struct yaffs_dev *dev = in->my_dev;
+
+        if (dev->param.disable_soft_del || dev->param.is_yaffs2)
+                yaffs_resize_file(in, 0);
+
+        if (in->n_data_chunks > 0) {
+                /* Use soft deletion if there is data in the file.
+                 * That won't be the case if it has been resized to zero.
+                 */
+                if (!in->unlinked)
+                        ret_val = yaffs_unlink_file_if_needed(in);
+
+                deleted = in->deleted;
+
+                if (ret_val == YAFFS_OK && in->unlinked && !in->deleted) {
+                        in->deleted = 1;
+                        deleted = 1;
+                        in->my_dev->n_deleted_files++;
+                        yaffs_soft_del_file(in);
+                }
+                return deleted ? YAFFS_OK : YAFFS_FAIL;
+        } else {
+                /* The file has no data chunks so we toss it immediately */
+                yaffs_free_tnode(in->my_dev, in->variant.file_variant.top);
+                in->variant.file_variant.top = NULL;
+                yaffs_generic_obj_del(in);
+
+                return YAFFS_OK;
+        }
+}
+
+int yaffs_is_non_empty_dir(struct yaffs_obj *obj)
+{
+        return (obj &&
+                obj->variant_type == YAFFS_OBJECT_TYPE_DIRECTORY) &&
+                !(list_empty(&obj->variant.dir_variant.children));
+}
+
+static int yaffs_del_dir(struct yaffs_obj *obj)
+{
+        /* First check that the directory is empty. */
+        if (yaffs_is_non_empty_dir(obj))
+                return YAFFS_FAIL;
+
+        return yaffs_generic_obj_del(obj);
+}
+
+static int yaffs_del_symlink(struct yaffs_obj *in)
+{
+        if (in->variant.symlink_variant.alias)
+                kfree(in->variant.symlink_variant.alias);
+        in->variant.symlink_variant.alias = NULL;
+
+        return yaffs_generic_obj_del(in);
+}
+
+static int yaffs_del_link(struct yaffs_obj *in)
+{
+        /* remove this hardlink from the list assocaited with the equivalent
+         * object
+         */
+        list_del_init(&in->hard_links);
+        return yaffs_generic_obj_del(in);
+}
+
+int yaffs_del_obj(struct yaffs_obj *obj)
+{
+        int ret_val = -1;
+        switch (obj->variant_type) {
+        case YAFFS_OBJECT_TYPE_FILE:
+                ret_val = yaffs_del_file(obj);
+                break;
+        case YAFFS_OBJECT_TYPE_DIRECTORY:
+                if (!list_empty(&obj->variant.dir_variant.dirty)) {
+                        yaffs_trace(YAFFS_TRACE_BACKGROUND,
+                                "Remove object %d from dirty directories",
+                                obj->obj_id);
+                        list_del_init(&obj->variant.dir_variant.dirty);
+                }
+                return yaffs_del_dir(obj);
+                break;
+        case YAFFS_OBJECT_TYPE_SYMLINK:
+                ret_val = yaffs_del_symlink(obj);
+                break;
+        case YAFFS_OBJECT_TYPE_HARDLINK:
+                ret_val = yaffs_del_link(obj);
+                break;
+        case YAFFS_OBJECT_TYPE_SPECIAL:
+                ret_val = yaffs_generic_obj_del(obj);
+                break;
+        case YAFFS_OBJECT_TYPE_UNKNOWN:
+                ret_val = 0;
+                break;          /* should not happen. */
+        }
+
+        return ret_val;
+}
+
+static int yaffs_unlink_worker(struct yaffs_obj *obj)
+{
+
+        int del_now = 0;
+
+        if (!obj->my_inode)
+                del_now = 1;
+
+        if (obj)
+                yaffs_update_parent(obj->parent);
+
+        if (obj->variant_type == YAFFS_OBJECT_TYPE_HARDLINK) {
+                return yaffs_del_link(obj);
+        } else if (!list_empty(&obj->hard_links)) {
+                /* Curve ball: We're unlinking an object that has a hardlink.
+                 *
+                 * This problem arises because we are not strictly following
+                 * The Linux link/inode model.
+                 *
+                 * We can't really delete the object.
+                 * Instead, we do the following:
+                 * - Select a hardlink.
+                 * - Unhook it from the hard links
+                 * - Move it from its parent directory (so that the rename can work)
+                 * - Rename the object to the hardlink's name.
+                 * - Delete the hardlink
+                 */
+
+                struct yaffs_obj *hl;
+                struct yaffs_obj *parent;
+                int ret_val;
+                YCHAR name[YAFFS_MAX_NAME_LENGTH + 1];
+
+                hl = list_entry(obj->hard_links.next, struct yaffs_obj,
+                                hard_links);
+
+                yaffs_get_obj_name(hl, name, YAFFS_MAX_NAME_LENGTH + 1);
+                parent = hl->parent;
+
+                list_del_init(&hl->hard_links);
+
+                yaffs_add_obj_to_dir(obj->my_dev->unlinked_dir, hl);
+
+                ret_val = yaffs_change_obj_name(obj, parent, name, 0, 0);
+
+                if (ret_val == YAFFS_OK)
+                        ret_val = yaffs_generic_obj_del(hl);
+
+                return ret_val;
+
+        } else if (del_now) {
+                switch (obj->variant_type) {
+                case YAFFS_OBJECT_TYPE_FILE:
+                        return yaffs_del_file(obj);
+                        break;
+                case YAFFS_OBJECT_TYPE_DIRECTORY:
+                        list_del_init(&obj->variant.dir_variant.dirty);
+                        return yaffs_del_dir(obj);
+                        break;
+                case YAFFS_OBJECT_TYPE_SYMLINK:
+                        return yaffs_del_symlink(obj);
+                        break;
+                case YAFFS_OBJECT_TYPE_SPECIAL:
+                        return yaffs_generic_obj_del(obj);
+                        break;
+                case YAFFS_OBJECT_TYPE_HARDLINK:
+                case YAFFS_OBJECT_TYPE_UNKNOWN:
+                default:
+                        return YAFFS_FAIL;
+                }
+        } else if (yaffs_is_non_empty_dir(obj)) {
+                return YAFFS_FAIL;
+        } else {
+                return yaffs_change_obj_name(obj, obj->my_dev->unlinked_dir,
+                                             _Y("unlinked"), 0, 0);
+        }
+}
+
+static int yaffs_unlink_obj(struct yaffs_obj *obj)
+{
+
+        if (obj && obj->unlink_allowed)
+                return yaffs_unlink_worker(obj);
+
+        return YAFFS_FAIL;
+
+}
+
+int yaffs_unlinker(struct yaffs_obj *dir, const YCHAR * name)
+{
+        struct yaffs_obj *obj;
+
+        obj = yaffs_find_by_name(dir, name);
+        return yaffs_unlink_obj(obj);
+}
+
+/* Note:
+ * If old_name is NULL then we take old_dir as the object to be renamed.
+ */
+int yaffs_rename_obj(struct yaffs_obj *old_dir, const YCHAR * old_name,
+                     struct yaffs_obj *new_dir, const YCHAR * new_name)
+{
+        struct yaffs_obj *obj = NULL;
+        struct yaffs_obj *existing_target = NULL;
+        int force = 0;
+        int result;
+        struct yaffs_dev *dev;
+
+        if (!old_dir || old_dir->variant_type != YAFFS_OBJECT_TYPE_DIRECTORY)
+                YBUG();
+        if (!new_dir || new_dir->variant_type != YAFFS_OBJECT_TYPE_DIRECTORY)
+                YBUG();
+
+        dev = old_dir->my_dev;
+
+#ifdef CONFIG_YAFFS_CASE_INSENSITIVE
+        /* Special case for case insemsitive systems.
+         * While look-up is case insensitive, the name isn't.
+         * Therefore we might want to change x.txt to X.txt
+         */
+        if (old_dir == new_dir && 
+                old_name && new_name && 
+                strcmp(old_name, new_name) == 0)
+                force = 1;
+#endif
+
+        if (strnlen(new_name, YAFFS_MAX_NAME_LENGTH + 1) >
+            YAFFS_MAX_NAME_LENGTH)
+                /* ENAMETOOLONG */
+                return YAFFS_FAIL;
+
+        if(old_name)
+                obj = yaffs_find_by_name(old_dir, old_name);
+        else{
+                obj = old_dir;
+                old_dir = obj->parent;
+        }
+
+
+        if (obj && obj->rename_allowed) {
+
+                /* Now do the handling for an existing target, if there is one */
+
+                existing_target = yaffs_find_by_name(new_dir, new_name);
+                if (yaffs_is_non_empty_dir(existing_target)){
+                        return YAFFS_FAIL;      /* ENOTEMPTY */
+                } else if (existing_target && existing_target != obj) {
+                        /* Nuke the target first, using shadowing,
+                         * but only if it isn't the same object.
+                         *
+                         * Note we must disable gc otherwise it can mess up the shadowing.
+                         *
+                         */
+                        dev->gc_disable = 1;
+                        yaffs_change_obj_name(obj, new_dir, new_name, force,
+                                              existing_target->obj_id);
+                        existing_target->is_shadowed = 1;
+                        yaffs_unlink_obj(existing_target);
+                        dev->gc_disable = 0;
+                }
+
+                result = yaffs_change_obj_name(obj, new_dir, new_name, 1, 0);
+
+                yaffs_update_parent(old_dir);
+                if (new_dir != old_dir)
+                        yaffs_update_parent(new_dir);
+
+                return result;
+        }
+        return YAFFS_FAIL;
+}
+
+/*----------------------- Initialisation Scanning ---------------------- */
+
+void yaffs_handle_shadowed_obj(struct yaffs_dev *dev, int obj_id,
+                               int backward_scanning)
+{
+        struct yaffs_obj *obj;
+
+        if (!backward_scanning) {
+                /* Handle YAFFS1 forward scanning case
+                 * For YAFFS1 we always do the deletion
+                 */
+
+        } else {
+                /* Handle YAFFS2 case (backward scanning)
+                 * If the shadowed object exists then ignore.
+                 */
+                obj = yaffs_find_by_number(dev, obj_id);
+                if (obj)
+                        return;
+        }
+
+        /* Let's create it (if it does not exist) assuming it is a file so that it can do shrinking etc.
+         * We put it in unlinked dir to be cleaned up after the scanning
+         */
+        obj =
+            yaffs_find_or_create_by_number(dev, obj_id, YAFFS_OBJECT_TYPE_FILE);
+        if (!obj)
+                return;
+        obj->is_shadowed = 1;
+        yaffs_add_obj_to_dir(dev->unlinked_dir, obj);
+        obj->variant.file_variant.shrink_size = 0;
+        obj->valid = 1;         /* So that we don't read any other info for this file */
+
+}
+
+void yaffs_link_fixup(struct yaffs_dev *dev, struct yaffs_obj *hard_list)
+{
+        struct yaffs_obj *hl;
+        struct yaffs_obj *in;
+
+        while (hard_list) {
+                hl = hard_list;
+                hard_list = (struct yaffs_obj *)(hard_list->hard_links.next);
+
+                in = yaffs_find_by_number(dev,
+                                          hl->variant.
+                                          hardlink_variant.equiv_id);
+
+                if (in) {
+                        /* Add the hardlink pointers */
+                        hl->variant.hardlink_variant.equiv_obj = in;
+                        list_add(&hl->hard_links, &in->hard_links);
+                } else {
+                        /* Todo Need to report/handle this better.
+                         * Got a problem... hardlink to a non-existant object
+                         */
+                        hl->variant.hardlink_variant.equiv_obj = NULL;
+                        INIT_LIST_HEAD(&hl->hard_links);
+
+                }
+        }
+}
+
+static void yaffs_strip_deleted_objs(struct yaffs_dev *dev)
+{
+        /*
+         *  Sort out state of unlinked and deleted objects after scanning.
+         */
+        struct list_head *i;
+        struct list_head *n;
+        struct yaffs_obj *l;
+
+        if (dev->read_only)
+                return;
+
+        /* Soft delete all the unlinked files */
+        list_for_each_safe(i, n,
+                           &dev->unlinked_dir->variant.dir_variant.children) {
+                if (i) {
+                        l = list_entry(i, struct yaffs_obj, siblings);
+                        yaffs_del_obj(l);
+                }
+        }
+
+        list_for_each_safe(i, n, &dev->del_dir->variant.dir_variant.children) {
+                if (i) {
+                        l = list_entry(i, struct yaffs_obj, siblings);
+                        yaffs_del_obj(l);
+                }
+        }
+
+}
+
+/*
+ * This code iterates through all the objects making sure that they are rooted.
+ * Any unrooted objects are re-rooted in lost+found.
+ * An object needs to be in one of:
+ * - Directly under deleted, unlinked
+ * - Directly or indirectly under root.
+ *
+ * Note:
+ *  This code assumes that we don't ever change the current relationships between
+ *  directories:
+ *   root_dir->parent == unlinked_dir->parent == del_dir->parent == NULL
+ *   lost-n-found->parent == root_dir
+ *
+ * This fixes the problem where directories might have inadvertently been deleted
+ * leaving the object "hanging" without being rooted in the directory tree.
+ */
+
+static int yaffs_has_null_parent(struct yaffs_dev *dev, struct yaffs_obj *obj)
+{
+        return (obj == dev->del_dir ||
+                obj == dev->unlinked_dir || obj == dev->root_dir);
+}
+
+static void yaffs_fix_hanging_objs(struct yaffs_dev *dev)
+{
+        struct yaffs_obj *obj;
+        struct yaffs_obj *parent;
+        int i;
+        struct list_head *lh;
+        struct list_head *n;
+        int depth_limit;
+        int hanging;
+
+        if (dev->read_only)
+                return;
+
+        /* Iterate through the objects in each hash entry,
+         * looking at each object.
+         * Make sure it is rooted.
+         */
+
+        for (i = 0; i < YAFFS_NOBJECT_BUCKETS; i++) {
+                list_for_each_safe(lh, n, &dev->obj_bucket[i].list) {
+                        if (lh) {
+                                obj =
+                                    list_entry(lh, struct yaffs_obj, hash_link);
+                                parent = obj->parent;
+
+                                if (yaffs_has_null_parent(dev, obj)) {
+                                        /* These directories are not hanging */
+                                        hanging = 0;
+                                } else if (!parent
+                                           || parent->variant_type !=
+                                           YAFFS_OBJECT_TYPE_DIRECTORY) {
+                                        hanging = 1;
+                                } else if (yaffs_has_null_parent(dev, parent)) {
+                                        hanging = 0;
+                                } else {
+                                        /*
+                                         * Need to follow the parent chain to see if it is hanging.
+                                         */
+                                        hanging = 0;
+                                        depth_limit = 100;
+
+                                        while (parent != dev->root_dir &&
+                                               parent->parent &&
+                                               parent->parent->variant_type ==
+                                               YAFFS_OBJECT_TYPE_DIRECTORY
+                                               && depth_limit > 0) {
+                                                parent = parent->parent;
+                                                depth_limit--;
+                                        }
+                                        if (parent != dev->root_dir)
+                                                hanging = 1;
+                                }
+                                if (hanging) {
+                                        yaffs_trace(YAFFS_TRACE_SCAN,
+                                                "Hanging object %d moved to lost and found",
+                                                obj->obj_id);
+                                        yaffs_add_obj_to_dir(dev->lost_n_found,
+                                                             obj);
+                                }
+                        }
+                }
+        }
+}
+
+/*
+ * Delete directory contents for cleaning up lost and found.
+ */
+static void yaffs_del_dir_contents(struct yaffs_obj *dir)
+{
+        struct yaffs_obj *obj;
+        struct list_head *lh;
+        struct list_head *n;
+
+        if (dir->variant_type != YAFFS_OBJECT_TYPE_DIRECTORY)
+                YBUG();
+
+        list_for_each_safe(lh, n, &dir->variant.dir_variant.children) {
+                if (lh) {
+                        obj = list_entry(lh, struct yaffs_obj, siblings);
+                        if (obj->variant_type == YAFFS_OBJECT_TYPE_DIRECTORY)
+                                yaffs_del_dir_contents(obj);
+
+                        yaffs_trace(YAFFS_TRACE_SCAN,
+                                "Deleting lost_found object %d",
+                                obj->obj_id);
+
+                        /* Need to use UnlinkObject since Delete would not handle
+                         * hardlinked objects correctly.
+                         */
+                        yaffs_unlink_obj(obj);
+                }
+        }
+
+}
+
+static void yaffs_empty_l_n_f(struct yaffs_dev *dev)
+{
+        yaffs_del_dir_contents(dev->lost_n_found);
+}
+
+
+struct yaffs_obj *yaffs_find_by_name(struct yaffs_obj *directory,
+                                     const YCHAR * name)
+{
+        int sum;
+
+        struct list_head *i;
+        YCHAR buffer[YAFFS_MAX_NAME_LENGTH + 1];
+
+        struct yaffs_obj *l;
+
+        if (!name)
+                return NULL;
+
+        if (!directory) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "tragedy: yaffs_find_by_name: null pointer directory"
+                        );
+                YBUG();
+                return NULL;
+        }
+        if (directory->variant_type != YAFFS_OBJECT_TYPE_DIRECTORY) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "tragedy: yaffs_find_by_name: non-directory"
+                        );
+                YBUG();
+        }
+
+        sum = yaffs_calc_name_sum(name);
+
+        list_for_each(i, &directory->variant.dir_variant.children) {
+                if (i) {
+                        l = list_entry(i, struct yaffs_obj, siblings);
+
+                        if (l->parent != directory)
+                                YBUG();
+
+                        yaffs_check_obj_details_loaded(l);
+
+                        /* Special case for lost-n-found */
+                        if (l->obj_id == YAFFS_OBJECTID_LOSTNFOUND) {
+                                if (!strcmp(name, YAFFS_LOSTNFOUND_NAME))
+                                        return l;
+                        } else if (l->sum == sum
+                                   || l->hdr_chunk <= 0) {
+                                /* LostnFound chunk called Objxxx
+                                 * Do a real check
+                                 */
+                                yaffs_get_obj_name(l, buffer,
+                                                   YAFFS_MAX_NAME_LENGTH + 1);
+                                if (strncmp
+                                    (name, buffer, YAFFS_MAX_NAME_LENGTH) == 0)
+                                        return l;
+                        }
+                }
+        }
+
+        return NULL;
+}
+
+/* GetEquivalentObject dereferences any hard links to get to the
+ * actual object.
+ */
+
+struct yaffs_obj *yaffs_get_equivalent_obj(struct yaffs_obj *obj)
+{
+        if (obj && obj->variant_type == YAFFS_OBJECT_TYPE_HARDLINK) {
+                /* We want the object id of the equivalent object, not this one */
+                obj = obj->variant.hardlink_variant.equiv_obj;
+                yaffs_check_obj_details_loaded(obj);
+        }
+        return obj;
+}
+
+/*
+ *  A note or two on object names.
+ *  * If the object name is missing, we then make one up in the form objnnn
+ *
+ *  * ASCII names are stored in the object header's name field from byte zero
+ *  * Unicode names are historically stored starting from byte zero.
+ *
+ * Then there are automatic Unicode names...
+ * The purpose of these is to save names in a way that can be read as
+ * ASCII or Unicode names as appropriate, thus allowing a Unicode and ASCII
+ * system to share files.
+ *
+ * These automatic unicode are stored slightly differently...
+ *  - If the name can fit in the ASCII character space then they are saved as 
+ *    ascii names as per above.
+ *  - If the name needs Unicode then the name is saved in Unicode
+ *    starting at oh->name[1].
+
+ */
+static void yaffs_fix_null_name(struct yaffs_obj *obj, YCHAR * name,
+                                int buffer_size)
+{
+        /* Create an object name if we could not find one. */
+        if (strnlen(name, YAFFS_MAX_NAME_LENGTH) == 0) {
+                YCHAR local_name[20];
+                YCHAR num_string[20];
+                YCHAR *x = &num_string[19];
+                unsigned v = obj->obj_id;
+                num_string[19] = 0;
+                while (v > 0) {
+                        x--;
+                        *x = '0' + (v % 10);
+                        v /= 10;
+                }
+                /* make up a name */
+                strcpy(local_name, YAFFS_LOSTNFOUND_PREFIX);
+                strcat(local_name, x);
+                strncpy(name, local_name, buffer_size - 1);
+        }
+}
+
+int yaffs_get_obj_name(struct yaffs_obj *obj, YCHAR * name, int buffer_size)
+{
+        memset(name, 0, buffer_size * sizeof(YCHAR));
+
+        yaffs_check_obj_details_loaded(obj);
+
+        if (obj->obj_id == YAFFS_OBJECTID_LOSTNFOUND) {
+                strncpy(name, YAFFS_LOSTNFOUND_NAME, buffer_size - 1);
+        }
+#ifndef CONFIG_YAFFS_NO_SHORT_NAMES
+        else if (obj->short_name[0]) {
+                strcpy(name, obj->short_name);
+        }
+#endif
+        else if (obj->hdr_chunk > 0) {
+                int result;
+                u8 *buffer = yaffs_get_temp_buffer(obj->my_dev, __LINE__);
+
+                struct yaffs_obj_hdr *oh = (struct yaffs_obj_hdr *)buffer;
+
+                memset(buffer, 0, obj->my_dev->data_bytes_per_chunk);
+
+                if (obj->hdr_chunk > 0) {
+                        result = yaffs_rd_chunk_tags_nand(obj->my_dev,
+                                                          obj->hdr_chunk,
+                                                          buffer, NULL);
+                }
+                yaffs_load_name_from_oh(obj->my_dev, name, oh->name,
+                                        buffer_size);
+
+                yaffs_release_temp_buffer(obj->my_dev, buffer, __LINE__);
+        }
+
+        yaffs_fix_null_name(obj, name, buffer_size);
+
+        return strnlen(name, YAFFS_MAX_NAME_LENGTH);
+}
+
+int yaffs_get_obj_length(struct yaffs_obj *obj)
+{
+        /* Dereference any hard linking */
+        obj = yaffs_get_equivalent_obj(obj);
+
+        if (obj->variant_type == YAFFS_OBJECT_TYPE_FILE)
+                return obj->variant.file_variant.file_size;
+        if (obj->variant_type == YAFFS_OBJECT_TYPE_SYMLINK) {
+                if (!obj->variant.symlink_variant.alias)
+                        return 0;
+                return strnlen(obj->variant.symlink_variant.alias,
+                                     YAFFS_MAX_ALIAS_LENGTH);
+        } else {
+                /* Only a directory should drop through to here */
+                return obj->my_dev->data_bytes_per_chunk;
+        }
+}
+
+int yaffs_get_obj_link_count(struct yaffs_obj *obj)
+{
+        int count = 0;
+        struct list_head *i;
+
+        if (!obj->unlinked)
+                count++;        /* the object itself */
+
+        list_for_each(i, &obj->hard_links)
+            count++;            /* add the hard links; */
+
+        return count;
+}
+
+int yaffs_get_obj_inode(struct yaffs_obj *obj)
+{
+        obj = yaffs_get_equivalent_obj(obj);
+
+        return obj->obj_id;
+}
+
+unsigned yaffs_get_obj_type(struct yaffs_obj *obj)
+{
+        obj = yaffs_get_equivalent_obj(obj);
+
+        switch (obj->variant_type) {
+        case YAFFS_OBJECT_TYPE_FILE:
+                return DT_REG;
+                break;
+        case YAFFS_OBJECT_TYPE_DIRECTORY:
+                return DT_DIR;
+                break;
+        case YAFFS_OBJECT_TYPE_SYMLINK:
+                return DT_LNK;
+                break;
+        case YAFFS_OBJECT_TYPE_HARDLINK:
+                return DT_REG;
+                break;
+        case YAFFS_OBJECT_TYPE_SPECIAL:
+                if (S_ISFIFO(obj->yst_mode))
+                        return DT_FIFO;
+                if (S_ISCHR(obj->yst_mode))
+                        return DT_CHR;
+                if (S_ISBLK(obj->yst_mode))
+                        return DT_BLK;
+                if (S_ISSOCK(obj->yst_mode))
+                        return DT_SOCK;
+        default:
+                return DT_REG;
+                break;
+        }
+}
+
+YCHAR *yaffs_get_symlink_alias(struct yaffs_obj *obj)
+{
+        obj = yaffs_get_equivalent_obj(obj);
+        if (obj->variant_type == YAFFS_OBJECT_TYPE_SYMLINK)
+                return yaffs_clone_str(obj->variant.symlink_variant.alias);
+        else
+                return yaffs_clone_str(_Y(""));
+}
+
+/*--------------------------- Initialisation code -------------------------- */
+
+static int yaffs_check_dev_fns(const struct yaffs_dev *dev)
+{
+
+        /* Common functions, gotta have */
+        if (!dev->param.erase_fn || !dev->param.initialise_flash_fn)
+                return 0;
+
+#ifdef CONFIG_YAFFS_YAFFS2
+
+        /* Can use the "with tags" style interface for yaffs1 or yaffs2 */
+        if (dev->param.write_chunk_tags_fn &&
+            dev->param.read_chunk_tags_fn &&
+            !dev->param.write_chunk_fn &&
+            !dev->param.read_chunk_fn &&
+            dev->param.bad_block_fn && dev->param.query_block_fn)
+                return 1;
+#endif
+
+        /* Can use the "spare" style interface for yaffs1 */
+        if (!dev->param.is_yaffs2 &&
+            !dev->param.write_chunk_tags_fn &&
+            !dev->param.read_chunk_tags_fn &&
+            dev->param.write_chunk_fn &&
+            dev->param.read_chunk_fn &&
+            !dev->param.bad_block_fn && !dev->param.query_block_fn)
+                return 1;
+
+        return 0;               /* bad */
+}
+
+static int yaffs_create_initial_dir(struct yaffs_dev *dev)
+{
+        /* Initialise the unlinked, deleted, root and lost and found directories */
+
+        dev->lost_n_found = dev->root_dir = NULL;
+        dev->unlinked_dir = dev->del_dir = NULL;
+
+        dev->unlinked_dir =
+            yaffs_create_fake_dir(dev, YAFFS_OBJECTID_UNLINKED, S_IFDIR);
+
+        dev->del_dir =
+            yaffs_create_fake_dir(dev, YAFFS_OBJECTID_DELETED, S_IFDIR);
+
+        dev->root_dir =
+            yaffs_create_fake_dir(dev, YAFFS_OBJECTID_ROOT,
+                                  YAFFS_ROOT_MODE | S_IFDIR);
+        dev->lost_n_found =
+            yaffs_create_fake_dir(dev, YAFFS_OBJECTID_LOSTNFOUND,
+                                  YAFFS_LOSTNFOUND_MODE | S_IFDIR);
+
+        if (dev->lost_n_found && dev->root_dir && dev->unlinked_dir
+            && dev->del_dir) {
+                yaffs_add_obj_to_dir(dev->root_dir, dev->lost_n_found);
+                return YAFFS_OK;
+        }
+
+        return YAFFS_FAIL;
+}
+
+int yaffs_guts_initialise(struct yaffs_dev *dev)
+{
+        int init_failed = 0;
+        unsigned x;
+        int bits;
+
+        yaffs_trace(YAFFS_TRACE_TRACING, "yaffs: yaffs_guts_initialise()" );
+
+        /* Check stuff that must be set */
+
+        if (!dev) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "yaffs: Need a device"
+                        );
+                return YAFFS_FAIL;
+        }
+
+        dev->internal_start_block = dev->param.start_block;
+        dev->internal_end_block = dev->param.end_block;
+        dev->block_offset = 0;
+        dev->chunk_offset = 0;
+        dev->n_free_chunks = 0;
+
+        dev->gc_block = 0;
+
+        if (dev->param.start_block == 0) {
+                dev->internal_start_block = dev->param.start_block + 1;
+                dev->internal_end_block = dev->param.end_block + 1;
+                dev->block_offset = 1;
+                dev->chunk_offset = dev->param.chunks_per_block;
+        }
+
+        /* Check geometry parameters. */
+
+        if ((!dev->param.inband_tags && dev->param.is_yaffs2 &&
+                dev->param.total_bytes_per_chunk < 1024) ||
+                (!dev->param.is_yaffs2 &&
+                        dev->param.total_bytes_per_chunk < 512) ||
+                (dev->param.inband_tags && !dev->param.is_yaffs2) ||
+                 dev->param.chunks_per_block < 2 ||
+                 dev->param.n_reserved_blocks < 2 ||
+                dev->internal_start_block <= 0 || 
+                dev->internal_end_block <= 0 || 
+                dev->internal_end_block <= 
+                (dev->internal_start_block + dev->param.n_reserved_blocks + 2)
+                ) {
+                /* otherwise it is too small */
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "NAND geometry problems: chunk size %d, type is yaffs%s, inband_tags %d ",
+                        dev->param.total_bytes_per_chunk,
+                        dev->param.is_yaffs2 ? "2" : "",
+                        dev->param.inband_tags);
+                return YAFFS_FAIL;
+        }
+
+        if (yaffs_init_nand(dev) != YAFFS_OK) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS, "InitialiseNAND failed");
+                return YAFFS_FAIL;
+        }
+
+        /* Sort out space for inband tags, if required */
+        if (dev->param.inband_tags)
+                dev->data_bytes_per_chunk =
+                    dev->param.total_bytes_per_chunk -
+                    sizeof(struct yaffs_packed_tags2_tags_only);
+        else
+                dev->data_bytes_per_chunk = dev->param.total_bytes_per_chunk;
+
+        /* Got the right mix of functions? */
+        if (!yaffs_check_dev_fns(dev)) {
+                /* Function missing */
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "device function(s) missing or wrong");
+
+                return YAFFS_FAIL;
+        }
+
+        if (dev->is_mounted) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS, "device already mounted");
+                return YAFFS_FAIL;
+        }
+
+        /* Finished with most checks. One or two more checks happen later on too. */
+
+        dev->is_mounted = 1;
+
+        /* OK now calculate a few things for the device */
+
+        /*
+         *  Calculate all the chunk size manipulation numbers:
+         */
+        x = dev->data_bytes_per_chunk;
+        /* We always use dev->chunk_shift and dev->chunk_div */
+        dev->chunk_shift = calc_shifts(x);
+        x >>= dev->chunk_shift;
+        dev->chunk_div = x;
+        /* We only use chunk mask if chunk_div is 1 */
+        dev->chunk_mask = (1 << dev->chunk_shift) - 1;
+
+        /*
+         * Calculate chunk_grp_bits.
+         * We need to find the next power of 2 > than internal_end_block
+         */
+
+        x = dev->param.chunks_per_block * (dev->internal_end_block + 1);
+
+        bits = calc_shifts_ceiling(x);
+
+        /* Set up tnode width if wide tnodes are enabled. */
+        if (!dev->param.wide_tnodes_disabled) {
+                /* bits must be even so that we end up with 32-bit words */
+                if (bits & 1)
+                        bits++;
+                if (bits < 16)
+                        dev->tnode_width = 16;
+                else
+                        dev->tnode_width = bits;
+        } else {
+                dev->tnode_width = 16;
+        }
+
+        dev->tnode_mask = (1 << dev->tnode_width) - 1;
+
+        /* Level0 Tnodes are 16 bits or wider (if wide tnodes are enabled),
+         * so if the bitwidth of the
+         * chunk range we're using is greater than 16 we need
+         * to figure out chunk shift and chunk_grp_size
+         */
+
+        if (bits <= dev->tnode_width)
+                dev->chunk_grp_bits = 0;
+        else
+                dev->chunk_grp_bits = bits - dev->tnode_width;
+
+        dev->tnode_size = (dev->tnode_width * YAFFS_NTNODES_LEVEL0) / 8;
+        if (dev->tnode_size < sizeof(struct yaffs_tnode))
+                dev->tnode_size = sizeof(struct yaffs_tnode);
+
+        dev->chunk_grp_size = 1 << dev->chunk_grp_bits;
+
+        if (dev->param.chunks_per_block < dev->chunk_grp_size) {
+                /* We have a problem because the soft delete won't work if
+                 * the chunk group size > chunks per block.
+                 * This can be remedied by using larger "virtual blocks".
+                 */
+                yaffs_trace(YAFFS_TRACE_ALWAYS, "chunk group too large");
+
+                return YAFFS_FAIL;
+        }
+
+        /* OK, we've finished verifying the device, lets continue with initialisation */
+
+        /* More device initialisation */
+        dev->all_gcs = 0;
+        dev->passive_gc_count = 0;
+        dev->oldest_dirty_gc_count = 0;
+        dev->bg_gcs = 0;
+        dev->gc_block_finder = 0;
+        dev->buffered_block = -1;
+        dev->doing_buffered_block_rewrite = 0;
+        dev->n_deleted_files = 0;
+        dev->n_bg_deletions = 0;
+        dev->n_unlinked_files = 0;
+        dev->n_ecc_fixed = 0;
+        dev->n_ecc_unfixed = 0;
+        dev->n_tags_ecc_fixed = 0;
+        dev->n_tags_ecc_unfixed = 0;
+        dev->n_erase_failures = 0;
+        dev->n_erased_blocks = 0;
+        dev->gc_disable = 0;
+        dev->has_pending_prioritised_gc = 1;    /* Assume the worst for now, will get fixed on first GC */
+        INIT_LIST_HEAD(&dev->dirty_dirs);
+        dev->oldest_dirty_seq = 0;
+        dev->oldest_dirty_block = 0;
+
+        /* Initialise temporary buffers and caches. */
+        if (!yaffs_init_tmp_buffers(dev))
+                init_failed = 1;
+
+        dev->cache = NULL;
+        dev->gc_cleanup_list = NULL;
+
+        if (!init_failed && dev->param.n_caches > 0) {
+                int i;
+                void *buf;
+                int cache_bytes =
+                    dev->param.n_caches * sizeof(struct yaffs_cache);
+
+                if (dev->param.n_caches > YAFFS_MAX_SHORT_OP_CACHES)
+                        dev->param.n_caches = YAFFS_MAX_SHORT_OP_CACHES;
+
+                dev->cache = kmalloc(cache_bytes, GFP_NOFS);
+
+                buf = (u8 *) dev->cache;
+
+                if (dev->cache)
+                        memset(dev->cache, 0, cache_bytes);
+
+                for (i = 0; i < dev->param.n_caches && buf; i++) {
+                        dev->cache[i].object = NULL;
+                        dev->cache[i].last_use = 0;
+                        dev->cache[i].dirty = 0;
+                        dev->cache[i].data = buf =
+                            kmalloc(dev->param.total_bytes_per_chunk, GFP_NOFS);
+                }
+                if (!buf)
+                        init_failed = 1;
+
+                dev->cache_last_use = 0;
+        }
+
+        dev->cache_hits = 0;
+
+        if (!init_failed) {
+                dev->gc_cleanup_list =
+                    kmalloc(dev->param.chunks_per_block * sizeof(u32),
+                                        GFP_NOFS);
+                if (!dev->gc_cleanup_list)
+                        init_failed = 1;
+        }
+
+        if (dev->param.is_yaffs2)
+                dev->param.use_header_file_size = 1;
+
+        if (!init_failed && !yaffs_init_blocks(dev))
+                init_failed = 1;
+
+        yaffs_init_tnodes_and_objs(dev);
+
+        if (!init_failed && !yaffs_create_initial_dir(dev))
+                init_failed = 1;
+
+        if (!init_failed) {
+                /* Now scan the flash. */
+                if (dev->param.is_yaffs2) {
+                        if (yaffs2_checkpt_restore(dev)) {
+                                yaffs_check_obj_details_loaded(dev->root_dir);
+                                yaffs_trace(YAFFS_TRACE_CHECKPOINT | YAFFS_TRACE_MOUNT,
+                                        "yaffs: restored from checkpoint"
+                                        );
+                        } else {
+
+                                /* Clean up the mess caused by an aborted checkpoint load
+                                 * and scan backwards.
+                                 */
+                                yaffs_deinit_blocks(dev);
+
+                                yaffs_deinit_tnodes_and_objs(dev);
+
+                                dev->n_erased_blocks = 0;
+                                dev->n_free_chunks = 0;
+                                dev->alloc_block = -1;
+                                dev->alloc_page = -1;
+                                dev->n_deleted_files = 0;
+                                dev->n_unlinked_files = 0;
+                                dev->n_bg_deletions = 0;
+
+                                if (!init_failed && !yaffs_init_blocks(dev))
+                                        init_failed = 1;
+
+                                yaffs_init_tnodes_and_objs(dev);
+
+                                if (!init_failed
+                                    && !yaffs_create_initial_dir(dev))
+                                        init_failed = 1;
+
+                                if (!init_failed && !yaffs2_scan_backwards(dev))
+                                        init_failed = 1;
+                        }
+                } else if (!yaffs1_scan(dev)) {
+                        init_failed = 1;
+                }
+
+                yaffs_strip_deleted_objs(dev);
+                yaffs_fix_hanging_objs(dev);
+                if (dev->param.empty_lost_n_found)
+                        yaffs_empty_l_n_f(dev);
+        }
+
+        if (init_failed) {
+                /* Clean up the mess */
+                yaffs_trace(YAFFS_TRACE_TRACING,
+                  "yaffs: yaffs_guts_initialise() aborted.");
+
+                yaffs_deinitialise(dev);
+                return YAFFS_FAIL;
+        }
+
+        /* Zero out stats */
+        dev->n_page_reads = 0;
+        dev->n_page_writes = 0;
+        dev->n_erasures = 0;
+        dev->n_gc_copies = 0;
+        dev->n_retired_writes = 0;
+
+        dev->n_retired_blocks = 0;
+
+        yaffs_verify_free_chunks(dev);
+        yaffs_verify_blocks(dev);
+
+        /* Clean up any aborted checkpoint data */
+        if (!dev->is_checkpointed && dev->blocks_in_checkpt > 0)
+                yaffs2_checkpt_invalidate(dev);
+
+        yaffs_trace(YAFFS_TRACE_TRACING,
+          "yaffs: yaffs_guts_initialise() done.");
+        return YAFFS_OK;
+
+}
+
+void yaffs_deinitialise(struct yaffs_dev *dev)
+{
+        if (dev->is_mounted) {
+                int i;
+
+                yaffs_deinit_blocks(dev);
+                yaffs_deinit_tnodes_and_objs(dev);
+                if (dev->param.n_caches > 0 && dev->cache) {
+
+                        for (i = 0; i < dev->param.n_caches; i++) {
+                                if (dev->cache[i].data)
+                                        kfree(dev->cache[i].data);
+                                dev->cache[i].data = NULL;
+                        }
+
+                        kfree(dev->cache);
+                        dev->cache = NULL;
+                }
+
+                kfree(dev->gc_cleanup_list);
+
+                for (i = 0; i < YAFFS_N_TEMP_BUFFERS; i++)
+                        kfree(dev->temp_buffer[i].buffer);
+
+                dev->is_mounted = 0;
+
+                if (dev->param.deinitialise_flash_fn)
+                        dev->param.deinitialise_flash_fn(dev);
+        }
+}
+
+int yaffs_count_free_chunks(struct yaffs_dev *dev)
+{
+        int n_free = 0;
+        int b;
+
+        struct yaffs_block_info *blk;
+
+        blk = dev->block_info;
+        for (b = dev->internal_start_block; b <= dev->internal_end_block; b++) {
+                switch (blk->block_state) {
+                case YAFFS_BLOCK_STATE_EMPTY:
+                case YAFFS_BLOCK_STATE_ALLOCATING:
+                case YAFFS_BLOCK_STATE_COLLECTING:
+                case YAFFS_BLOCK_STATE_FULL:
+                        n_free +=
+                            (dev->param.chunks_per_block - blk->pages_in_use +
+                             blk->soft_del_pages);
+                        break;
+                default:
+                        break;
+                }
+                blk++;
+        }
+
+        return n_free;
+}
+
+int yaffs_get_n_free_chunks(struct yaffs_dev *dev)
+{
+        /* This is what we report to the outside world */
+
+        int n_free;
+        int n_dirty_caches;
+        int blocks_for_checkpt;
+        int i;
+
+        n_free = dev->n_free_chunks;
+        n_free += dev->n_deleted_files;
+
+        /* Now count the number of dirty chunks in the cache and subtract those */
+
+        for (n_dirty_caches = 0, i = 0; i < dev->param.n_caches; i++) {
+                if (dev->cache[i].dirty)
+                        n_dirty_caches++;
+        }
+
+        n_free -= n_dirty_caches;
+
+        n_free -=
+            ((dev->param.n_reserved_blocks + 1) * dev->param.chunks_per_block);
+
+        /* Now we figure out how much to reserve for the checkpoint and report that... */
+        blocks_for_checkpt = yaffs_calc_checkpt_blocks_required(dev);
+
+        n_free -= (blocks_for_checkpt * dev->param.chunks_per_block);
+
+        if (n_free < 0)
+                n_free = 0;
+
+        return n_free;
+
+}
diff --git a/fs/yaffs2/yaffs_guts.h b/fs/yaffs2/yaffs_guts.h
new file mode 100644
index 00000000000..307eba28676
--- /dev/null
+++ b/fs/yaffs2/yaffs_guts.h
@@ -0,0 +1,915 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_GUTS_H__
+#define __YAFFS_GUTS_H__
+
+#include "yportenv.h"
+
+#define YAFFS_OK        1
+#define YAFFS_FAIL  0
+
+/* Give us a  Y=0x59,
+ * Give us an A=0x41,
+ * Give us an FF=0xFF
+ * Give us an S=0x53
+ * And what have we got...
+ */
+#define YAFFS_MAGIC                     0x5941FF53
+
+#define YAFFS_NTNODES_LEVEL0            16
+#define YAFFS_TNODES_LEVEL0_BITS        4
+#define YAFFS_TNODES_LEVEL0_MASK        0xf
+
+#define YAFFS_NTNODES_INTERNAL          (YAFFS_NTNODES_LEVEL0 / 2)
+#define YAFFS_TNODES_INTERNAL_BITS      (YAFFS_TNODES_LEVEL0_BITS - 1)
+#define YAFFS_TNODES_INTERNAL_MASK      0x7
+#define YAFFS_TNODES_MAX_LEVEL          6
+
+#ifndef CONFIG_YAFFS_NO_YAFFS1
+#define YAFFS_BYTES_PER_SPARE           16
+#define YAFFS_BYTES_PER_CHUNK           512
+#define YAFFS_CHUNK_SIZE_SHIFT          9
+#define YAFFS_CHUNKS_PER_BLOCK          32
+#define YAFFS_BYTES_PER_BLOCK           (YAFFS_CHUNKS_PER_BLOCK*YAFFS_BYTES_PER_CHUNK)
+#endif
+
+#define YAFFS_MIN_YAFFS2_CHUNK_SIZE     1024
+#define YAFFS_MIN_YAFFS2_SPARE_SIZE     32
+
+#define YAFFS_MAX_CHUNK_ID              0x000FFFFF
+
+#define YAFFS_ALLOCATION_NOBJECTS       100
+#define YAFFS_ALLOCATION_NTNODES        100
+#define YAFFS_ALLOCATION_NLINKS         100
+
+#define YAFFS_NOBJECT_BUCKETS           256
+
+#define YAFFS_OBJECT_SPACE              0x40000
+#define YAFFS_MAX_OBJECT_ID             (YAFFS_OBJECT_SPACE -1)
+
+#define YAFFS_CHECKPOINT_VERSION        4
+
+#ifdef CONFIG_YAFFS_UNICODE
+#define YAFFS_MAX_NAME_LENGTH           127
+#define YAFFS_MAX_ALIAS_LENGTH          79
+#else
+#define YAFFS_MAX_NAME_LENGTH           255
+#define YAFFS_MAX_ALIAS_LENGTH          159
+#endif
+
+#define YAFFS_SHORT_NAME_LENGTH         15
+
+/* Some special object ids for pseudo objects */
+#define YAFFS_OBJECTID_ROOT             1
+#define YAFFS_OBJECTID_LOSTNFOUND       2
+#define YAFFS_OBJECTID_UNLINKED         3
+#define YAFFS_OBJECTID_DELETED          4
+
+/* Pseudo object ids for checkpointing */
+#define YAFFS_OBJECTID_SB_HEADER        0x10
+#define YAFFS_OBJECTID_CHECKPOINT_DATA  0x20
+#define YAFFS_SEQUENCE_CHECKPOINT_DATA  0x21
+
+#define YAFFS_MAX_SHORT_OP_CACHES       20
+
+#define YAFFS_N_TEMP_BUFFERS            6
+
+/* We limit the number attempts at sucessfully saving a chunk of data.
+ * Small-page devices have 32 pages per block; large-page devices have 64.
+ * Default to something in the order of 5 to 10 blocks worth of chunks.
+ */
+#define YAFFS_WR_ATTEMPTS               (5*64)
+
+/* Sequence numbers are used in YAFFS2 to determine block allocation order.
+ * The range is limited slightly to help distinguish bad numbers from good.
+ * This also allows us to perhaps in the future use special numbers for
+ * special purposes.
+ * EFFFFF00 allows the allocation of 8 blocks per second (~1Mbytes) for 15 years,
+ * and is a larger number than the lifetime of a 2GB device.
+ */
+#define YAFFS_LOWEST_SEQUENCE_NUMBER    0x00001000
+#define YAFFS_HIGHEST_SEQUENCE_NUMBER   0xEFFFFF00
+
+/* Special sequence number for bad block that failed to be marked bad */
+#define YAFFS_SEQUENCE_BAD_BLOCK        0xFFFF0000
+
+/* ChunkCache is used for short read/write operations.*/
+struct yaffs_cache {
+        struct yaffs_obj *object;
+        int chunk_id;
+        int last_use;
+        int dirty;
+        int n_bytes;            /* Only valid if the cache is dirty */
+        int locked;             /* Can't push out or flush while locked. */
+        u8 *data;
+};
+
+/* Tags structures in RAM
+ * NB This uses bitfield. Bitfields should not straddle a u32 boundary otherwise
+ * the structure size will get blown out.
+ */
+
+#ifndef CONFIG_YAFFS_NO_YAFFS1
+struct yaffs_tags {
+        unsigned chunk_id:20;
+        unsigned serial_number:2;
+        unsigned n_bytes_lsb:10;
+        unsigned obj_id:18;
+        unsigned ecc:12;
+        unsigned n_bytes_msb:2;
+};
+
+union yaffs_tags_union {
+        struct yaffs_tags as_tags;
+        u8 as_bytes[8];
+};
+
+#endif
+
+/* Stuff used for extended tags in YAFFS2 */
+
+enum yaffs_ecc_result {
+        YAFFS_ECC_RESULT_UNKNOWN,
+        YAFFS_ECC_RESULT_NO_ERROR,
+        YAFFS_ECC_RESULT_FIXED,
+        YAFFS_ECC_RESULT_UNFIXED
+};
+
+enum yaffs_obj_type {
+        YAFFS_OBJECT_TYPE_UNKNOWN,
+        YAFFS_OBJECT_TYPE_FILE,
+        YAFFS_OBJECT_TYPE_SYMLINK,
+        YAFFS_OBJECT_TYPE_DIRECTORY,
+        YAFFS_OBJECT_TYPE_HARDLINK,
+        YAFFS_OBJECT_TYPE_SPECIAL
+};
+
+#define YAFFS_OBJECT_TYPE_MAX YAFFS_OBJECT_TYPE_SPECIAL
+
+struct yaffs_ext_tags {
+
+        unsigned validity0;
+        unsigned chunk_used;    /*  Status of the chunk: used or unused */
+        unsigned obj_id;        /* If 0 then this is not part of an object (unused) */
+        unsigned chunk_id;      /* If 0 then this is a header, else a data chunk */
+        unsigned n_bytes;       /* Only valid for data chunks */
+
+        /* The following stuff only has meaning when we read */
+        enum yaffs_ecc_result ecc_result;
+        unsigned block_bad;
+
+        /* YAFFS 1 stuff */
+        unsigned is_deleted;    /* The chunk is marked deleted */
+        unsigned serial_number; /* Yaffs1 2-bit serial number */
+
+        /* YAFFS2 stuff */
+        unsigned seq_number;    /* The sequence number of this block */
+
+        /* Extra info if this is an object header (YAFFS2 only) */
+
+        unsigned extra_available;       /* There is extra info available if this is not zero */
+        unsigned extra_parent_id;       /* The parent object */
+        unsigned extra_is_shrink;       /* Is it a shrink header? */
+        unsigned extra_shadows; /* Does this shadow another object? */
+
+        enum yaffs_obj_type extra_obj_type;     /* What object type? */
+
+        unsigned extra_length;  /* Length if it is a file */
+        unsigned extra_equiv_id;        /* Equivalent object Id if it is a hard link */
+
+        unsigned validity1;
+
+};
+
+/* Spare structure for YAFFS1 */
+struct yaffs_spare {
+        u8 tb0;
+        u8 tb1;
+        u8 tb2;
+        u8 tb3;
+        u8 page_status;         /* set to 0 to delete the chunk */
+        u8 block_status;
+        u8 tb4;
+        u8 tb5;
+        u8 ecc1[3];
+        u8 tb6;
+        u8 tb7;
+        u8 ecc2[3];
+};
+
+/*Special structure for passing through to mtd */
+struct yaffs_nand_spare {
+        struct yaffs_spare spare;
+        int eccres1;
+        int eccres2;
+};
+
+/* Block data in RAM */
+
+enum yaffs_block_state {
+        YAFFS_BLOCK_STATE_UNKNOWN = 0,
+
+        YAFFS_BLOCK_STATE_SCANNING,
+        /* Being scanned */
+
+        YAFFS_BLOCK_STATE_NEEDS_SCANNING,
+        /* The block might have something on it (ie it is allocating or full, perhaps empty)
+         * but it needs to be scanned to determine its true state.
+         * This state is only valid during scanning.
+         * NB We tolerate empty because the pre-scanner might be incapable of deciding
+         * However, if this state is returned on a YAFFS2 device, then we expect a sequence number
+         */
+
+        YAFFS_BLOCK_STATE_EMPTY,
+        /* This block is empty */
+
+        YAFFS_BLOCK_STATE_ALLOCATING,
+        /* This block is partially allocated.
+         * At least one page holds valid data.
+         * This is the one currently being used for page
+         * allocation. Should never be more than one of these.
+         * If a block is only partially allocated at mount it is treated as full.
+         */
+
+        YAFFS_BLOCK_STATE_FULL,
+        /* All the pages in this block have been allocated.
+         * If a block was only partially allocated when mounted we treat
+         * it as fully allocated.
+         */
+
+        YAFFS_BLOCK_STATE_DIRTY,
+        /* The block was full and now all chunks have been deleted.
+         * Erase me, reuse me.
+         */
+
+        YAFFS_BLOCK_STATE_CHECKPOINT,
+        /* This block is assigned to holding checkpoint data. */
+
+        YAFFS_BLOCK_STATE_COLLECTING,
+        /* This block is being garbage collected */
+
+        YAFFS_BLOCK_STATE_DEAD
+            /* This block has failed and is not in use */
+};
+
+#define YAFFS_NUMBER_OF_BLOCK_STATES (YAFFS_BLOCK_STATE_DEAD + 1)
+
+struct yaffs_block_info {
+
+        int soft_del_pages:10;  /* number of soft deleted pages */
+        int pages_in_use:10;    /* number of pages in use */
+        unsigned block_state:4; /* One of the above block states. NB use unsigned because enum is sometimes an int */
+        u32 needs_retiring:1;   /* Data has failed on this block, need to get valid data off */
+        /* and retire the block. */
+        u32 skip_erased_check:1;        /* If this is set we can skip the erased check on this block */
+        u32 gc_prioritise:1;    /* An ECC check or blank check has failed on this block.
+                                   It should be prioritised for GC */
+        u32 chunk_error_strikes:3;      /* How many times we've had ecc etc failures on this block and tried to reuse it */
+
+#ifdef CONFIG_YAFFS_YAFFS2
+        u32 has_shrink_hdr:1;   /* This block has at least one shrink object header */
+        u32 seq_number;         /* block sequence number for yaffs2 */
+#endif
+
+};
+
+/* -------------------------- Object structure -------------------------------*/
+/* This is the object structure as stored on NAND */
+
+struct yaffs_obj_hdr {
+        enum yaffs_obj_type type;
+
+        /* Apply to everything  */
+        int parent_obj_id;
+        u16 sum_no_longer_used; /* checksum of name. No longer used */
+        YCHAR name[YAFFS_MAX_NAME_LENGTH + 1];
+
+        /* The following apply to directories, files, symlinks - not hard links */
+        u32 yst_mode;           /* protection */
+
+        u32 yst_uid;
+        u32 yst_gid;
+        u32 yst_atime;
+        u32 yst_mtime;
+        u32 yst_ctime;
+
+        /* File size  applies to files only */
+        int file_size;
+
+        /* Equivalent object id applies to hard links only. */
+        int equiv_id;
+
+        /* Alias is for symlinks only. */
+        YCHAR alias[YAFFS_MAX_ALIAS_LENGTH + 1];
+
+        u32 yst_rdev;           /* device stuff for block and char devices (major/min) */
+
+        u32 win_ctime[2];
+        u32 win_atime[2];
+        u32 win_mtime[2];
+
+        u32 inband_shadowed_obj_id;
+        u32 inband_is_shrink;
+
+        u32 reserved[2];
+        int shadows_obj;        /* This object header shadows the specified object if > 0 */
+
+        /* is_shrink applies to object headers written when we shrink the file (ie resize) */
+        u32 is_shrink;
+
+};
+
+/*--------------------------- Tnode -------------------------- */
+
+struct yaffs_tnode {
+        struct yaffs_tnode *internal[YAFFS_NTNODES_INTERNAL];
+};
+
+/*------------------------  Object -----------------------------*/
+/* An object can be one of:
+ * - a directory (no data, has children links
+ * - a regular file (data.... not prunes :->).
+ * - a symlink [symbolic link] (the alias).
+ * - a hard link
+ */
+
+struct yaffs_file_var {
+        u32 file_size;
+        u32 scanned_size;
+        u32 shrink_size;
+        int top_level;
+        struct yaffs_tnode *top;
+};
+
+struct yaffs_dir_var {
+        struct list_head children;      /* list of child links */
+        struct list_head dirty; /* Entry for list of dirty directories */
+};
+
+struct yaffs_symlink_var {
+        YCHAR *alias;
+};
+
+struct yaffs_hardlink_var {
+        struct yaffs_obj *equiv_obj;
+        u32 equiv_id;
+};
+
+union yaffs_obj_var {
+        struct yaffs_file_var file_variant;
+        struct yaffs_dir_var dir_variant;
+        struct yaffs_symlink_var symlink_variant;
+        struct yaffs_hardlink_var hardlink_variant;
+};
+
+struct yaffs_obj {
+        u8 deleted:1;           /* This should only apply to unlinked files. */
+        u8 soft_del:1;          /* it has also been soft deleted */
+        u8 unlinked:1;          /* An unlinked file. The file should be in the unlinked directory. */
+        u8 fake:1;              /* A fake object has no presence on NAND. */
+        u8 rename_allowed:1;    /* Some objects are not allowed to be renamed. */
+        u8 unlink_allowed:1;
+        u8 dirty:1;             /* the object needs to be written to flash */
+        u8 valid:1;             /* When the file system is being loaded up, this
+                                 * object might be created before the data
+                                 * is available (ie. file data records appear before the header).
+                                 */
+        u8 lazy_loaded:1;       /* This object has been lazy loaded and is missing some detail */
+
+        u8 defered_free:1;      /* For Linux kernel. Object is removed from NAND, but is
+                                 * still in the inode cache. Free of object is defered.
+                                 * until the inode is released.
+                                 */
+        u8 being_created:1;     /* This object is still being created so skip some checks. */
+        u8 is_shadowed:1;       /* This object is shadowed on the way to being renamed. */
+
+        u8 xattr_known:1;       /* We know if this has object has xattribs or not. */
+        u8 has_xattr:1;         /* This object has xattribs. Valid if xattr_known. */
+
+        u8 serial;              /* serial number of chunk in NAND. Cached here */
+        u16 sum;                /* sum of the name to speed searching */
+
+        struct yaffs_dev *my_dev;       /* The device I'm on */
+
+        struct list_head hash_link;     /* list of objects in this hash bucket */
+
+        struct list_head hard_links;    /* all the equivalent hard linked objects */
+
+        /* directory structure stuff */
+        /* also used for linking up the free list */
+        struct yaffs_obj *parent;
+        struct list_head siblings;
+
+        /* Where's my object header in NAND? */
+        int hdr_chunk;
+
+        int n_data_chunks;      /* Number of data chunks attached to the file. */
+
+        u32 obj_id;             /* the object id value */
+
+        u32 yst_mode;
+
+#ifndef CONFIG_YAFFS_NO_SHORT_NAMES
+        YCHAR short_name[YAFFS_SHORT_NAME_LENGTH + 1];
+#endif
+
+#ifdef CONFIG_YAFFS_WINCE
+        u32 win_ctime[2];
+        u32 win_mtime[2];
+        u32 win_atime[2];
+#else
+        u32 yst_uid;
+        u32 yst_gid;
+        u32 yst_atime;
+        u32 yst_mtime;
+        u32 yst_ctime;
+#endif
+
+        u32 yst_rdev;
+
+        void *my_inode;
+
+        enum yaffs_obj_type variant_type;
+
+        union yaffs_obj_var variant;
+
+};
+
+struct yaffs_obj_bucket {
+        struct list_head list;
+        int count;
+};
+
+/* yaffs_checkpt_obj holds the definition of an object as dumped
+ * by checkpointing.
+ */
+
+struct yaffs_checkpt_obj {
+        int struct_type;
+        u32 obj_id;
+        u32 parent_id;
+        int hdr_chunk;
+        enum yaffs_obj_type variant_type:3;
+        u8 deleted:1;
+        u8 soft_del:1;
+        u8 unlinked:1;
+        u8 fake:1;
+        u8 rename_allowed:1;
+        u8 unlink_allowed:1;
+        u8 serial;
+        int n_data_chunks;
+        u32 size_or_equiv_obj;
+};
+
+/*--------------------- Temporary buffers ----------------
+ *
+ * These are chunk-sized working buffers. Each device has a few
+ */
+
+struct yaffs_buffer {
+        u8 *buffer;
+        int line;               /* track from whence this buffer was allocated */
+        int max_line;
+};
+
+/*----------------- Device ---------------------------------*/
+
+struct yaffs_param {
+        const YCHAR *name;
+
+        /*
+         * Entry parameters set up way early. Yaffs sets up the rest.
+         * The structure should be zeroed out before use so that unused
+         * and defualt values are zero.
+         */
+
+        int inband_tags;        /* Use unband tags */
+        u32 total_bytes_per_chunk;      /* Should be >= 512, does not need to be a power of 2 */
+        int chunks_per_block;   /* does not need to be a power of 2 */
+        int spare_bytes_per_chunk;      /* spare area size */
+        int start_block;        /* Start block we're allowed to use */
+        int end_block;          /* End block we're allowed to use */
+        int n_reserved_blocks;  /* We want this tuneable so that we can reduce */
+        /* reserved blocks on NOR and RAM. */
+
+        int n_caches;           /* If <= 0, then short op caching is disabled, else
+                                 * the number of short op caches (don't use too many).
+                                 * 10 to 20 is a good bet.
+                                 */
+        int use_nand_ecc;       /* Flag to decide whether or not to use NANDECC on data (yaffs1) */
+        int no_tags_ecc;        /* Flag to decide whether or not to do ECC on packed tags (yaffs2) */
+
+        int is_yaffs2;          /* Use yaffs2 mode on this device */
+
+        int empty_lost_n_found; /* Auto-empty lost+found directory on mount */
+
+        int refresh_period;     /* How often we should check to do a block refresh */
+
+        /* Checkpoint control. Can be set before or after initialisation */
+        u8 skip_checkpt_rd;
+        u8 skip_checkpt_wr;
+
+        int enable_xattr;       /* Enable xattribs */
+
+        /* NAND access functions (Must be set before calling YAFFS) */
+
+        int (*write_chunk_fn) (struct yaffs_dev * dev,
+                               int nand_chunk, const u8 * data,
+                               const struct yaffs_spare * spare);
+        int (*read_chunk_fn) (struct yaffs_dev * dev,
+                              int nand_chunk, u8 * data,
+                              struct yaffs_spare * spare);
+        int (*erase_fn) (struct yaffs_dev * dev, int flash_block);
+        int (*initialise_flash_fn) (struct yaffs_dev * dev);
+        int (*deinitialise_flash_fn) (struct yaffs_dev * dev);
+
+#ifdef CONFIG_YAFFS_YAFFS2
+        int (*write_chunk_tags_fn) (struct yaffs_dev * dev,
+                                    int nand_chunk, const u8 * data,
+                                    const struct yaffs_ext_tags * tags);
+        int (*read_chunk_tags_fn) (struct yaffs_dev * dev,
+                                   int nand_chunk, u8 * data,
+                                   struct yaffs_ext_tags * tags);
+        int (*bad_block_fn) (struct yaffs_dev * dev, int block_no);
+        int (*query_block_fn) (struct yaffs_dev * dev, int block_no,
+                               enum yaffs_block_state * state,
+                               u32 * seq_number);
+#endif
+
+        /* The remove_obj_fn function must be supplied by OS flavours that
+         * need it.
+         * yaffs direct uses it to implement the faster readdir.
+         * Linux uses it to protect the directory during unlocking.
+         */
+        void (*remove_obj_fn) (struct yaffs_obj * obj);
+
+        /* Callback to mark the superblock dirty */
+        void (*sb_dirty_fn) (struct yaffs_dev * dev);
+
+        /*  Callback to control garbage collection. */
+        unsigned (*gc_control) (struct yaffs_dev * dev);
+
+        /* Debug control flags. Don't use unless you know what you're doing */
+        int use_header_file_size;       /* Flag to determine if we should use file sizes from the header */
+        int disable_lazy_load;  /* Disable lazy loading on this device */
+        int wide_tnodes_disabled;       /* Set to disable wide tnodes */
+        int disable_soft_del;   /* yaffs 1 only: Set to disable the use of softdeletion. */
+
+        int defered_dir_update; /* Set to defer directory updates */
+
+#ifdef CONFIG_YAFFS_AUTO_UNICODE
+        int auto_unicode;
+#endif
+        int always_check_erased;        /* Force chunk erased check always on */
+};
+
+struct yaffs_dev {
+        struct yaffs_param param;
+
+        /* Context storage. Holds extra OS specific data for this device */
+
+        void *os_context;
+        void *driver_context;
+
+        struct list_head dev_list;
+
+        /* Runtime parameters. Set up by YAFFS. */
+        int data_bytes_per_chunk;
+
+        /* Non-wide tnode stuff */
+        u16 chunk_grp_bits;     /* Number of bits that need to be resolved if
+                                 * the tnodes are not wide enough.
+                                 */
+        u16 chunk_grp_size;     /* == 2^^chunk_grp_bits */
+
+        /* Stuff to support wide tnodes */
+        u32 tnode_width;
+        u32 tnode_mask;
+        u32 tnode_size;
+
+        /* Stuff for figuring out file offset to chunk conversions */
+        u32 chunk_shift;        /* Shift value */
+        u32 chunk_div;          /* Divisor after shifting: 1 for power-of-2 sizes */
+        u32 chunk_mask;         /* Mask to use for power-of-2 case */
+
+        int is_mounted;
+        int read_only;
+        int is_checkpointed;
+
+        /* Stuff to support block offsetting to support start block zero */
+        int internal_start_block;
+        int internal_end_block;
+        int block_offset;
+        int chunk_offset;
+
+        /* Runtime checkpointing stuff */
+        int checkpt_page_seq;   /* running sequence number of checkpoint pages */
+        int checkpt_byte_count;
+        int checkpt_byte_offs;
+        u8 *checkpt_buffer;
+        int checkpt_open_write;
+        int blocks_in_checkpt;
+        int checkpt_cur_chunk;
+        int checkpt_cur_block;
+        int checkpt_next_block;
+        int *checkpt_block_list;
+        int checkpt_max_blocks;
+        u32 checkpt_sum;
+        u32 checkpt_xor;
+
+        int checkpoint_blocks_required; /* Number of blocks needed to store current checkpoint set */
+
+        /* Block Info */
+        struct yaffs_block_info *block_info;
+        u8 *chunk_bits;         /* bitmap of chunks in use */
+        unsigned block_info_alt:1;      /* was allocated using alternative strategy */
+        unsigned chunk_bits_alt:1;      /* was allocated using alternative strategy */
+        int chunk_bit_stride;   /* Number of bytes of chunk_bits per block.
+                                 * Must be consistent with chunks_per_block.
+                                 */
+
+        int n_erased_blocks;
+        int alloc_block;        /* Current block being allocated off */
+        u32 alloc_page;
+        int alloc_block_finder; /* Used to search for next allocation block */
+
+        /* Object and Tnode memory management */
+        void *allocator;
+        int n_obj;
+        int n_tnodes;
+
+        int n_hardlinks;
+
+        struct yaffs_obj_bucket obj_bucket[YAFFS_NOBJECT_BUCKETS];
+        u32 bucket_finder;
+
+        int n_free_chunks;
+
+        /* Garbage collection control */
+        u32 *gc_cleanup_list;   /* objects to delete at the end of a GC. */
+        u32 n_clean_ups;
+
+        unsigned has_pending_prioritised_gc;    /* We think this device might have pending prioritised gcs */
+        unsigned gc_disable;
+        unsigned gc_block_finder;
+        unsigned gc_dirtiest;
+        unsigned gc_pages_in_use;
+        unsigned gc_not_done;
+        unsigned gc_block;
+        unsigned gc_chunk;
+        unsigned gc_skip;
+
+        /* Special directories */
+        struct yaffs_obj *root_dir;
+        struct yaffs_obj *lost_n_found;
+
+        /* Buffer areas for storing data to recover from write failures TODO
+         *      u8            buffered_data[YAFFS_CHUNKS_PER_BLOCK][YAFFS_BYTES_PER_CHUNK];
+         *      struct yaffs_spare buffered_spare[YAFFS_CHUNKS_PER_BLOCK];
+         */
+
+        int buffered_block;     /* Which block is buffered here? */
+        int doing_buffered_block_rewrite;
+
+        struct yaffs_cache *cache;
+        int cache_last_use;
+
+        /* Stuff for background deletion and unlinked files. */
+        struct yaffs_obj *unlinked_dir; /* Directory where unlinked and deleted files live. */
+        struct yaffs_obj *del_dir;      /* Directory where deleted objects are sent to disappear. */
+        struct yaffs_obj *unlinked_deletion;    /* Current file being background deleted. */
+        int n_deleted_files;    /* Count of files awaiting deletion; */
+        int n_unlinked_files;   /* Count of unlinked files. */
+        int n_bg_deletions;     /* Count of background deletions. */
+
+        /* Temporary buffer management */
+        struct yaffs_buffer temp_buffer[YAFFS_N_TEMP_BUFFERS];
+        int max_temp;
+        int temp_in_use;
+        int unmanaged_buffer_allocs;
+        int unmanaged_buffer_deallocs;
+
+        /* yaffs2 runtime stuff */
+        unsigned seq_number;    /* Sequence number of currently allocating block */
+        unsigned oldest_dirty_seq;
+        unsigned oldest_dirty_block;
+
+        /* Block refreshing */
+        int refresh_skip;       /* A skip down counter. Refresh happens when this gets to zero. */
+
+        /* Dirty directory handling */
+        struct list_head dirty_dirs;    /* List of dirty directories */
+
+        /* Statistcs */
+        u32 n_page_writes;
+        u32 n_page_reads;
+        u32 n_erasures;
+        u32 n_erase_failures;
+        u32 n_gc_copies;
+        u32 all_gcs;
+        u32 passive_gc_count;
+        u32 oldest_dirty_gc_count;
+        u32 n_gc_blocks;
+        u32 bg_gcs;
+        u32 n_retired_writes;
+        u32 n_retired_blocks;
+        u32 n_ecc_fixed;
+        u32 n_ecc_unfixed;
+        u32 n_tags_ecc_fixed;
+        u32 n_tags_ecc_unfixed;
+        u32 n_deletions;
+        u32 n_unmarked_deletions;
+        u32 refresh_count;
+        u32 cache_hits;
+
+};
+
+/* The CheckpointDevice structure holds the device information that changes at runtime and
+ * must be preserved over unmount/mount cycles.
+ */
+struct yaffs_checkpt_dev {
+        int struct_type;
+        int n_erased_blocks;
+        int alloc_block;        /* Current block being allocated off */
+        u32 alloc_page;
+        int n_free_chunks;
+
+        int n_deleted_files;    /* Count of files awaiting deletion; */
+        int n_unlinked_files;   /* Count of unlinked files. */
+        int n_bg_deletions;     /* Count of background deletions. */
+
+        /* yaffs2 runtime stuff */
+        unsigned seq_number;    /* Sequence number of currently allocating block */
+
+};
+
+struct yaffs_checkpt_validity {
+        int struct_type;
+        u32 magic;
+        u32 version;
+        u32 head;
+};
+
+struct yaffs_shadow_fixer {
+        int obj_id;
+        int shadowed_id;
+        struct yaffs_shadow_fixer *next;
+};
+
+/* Structure for doing xattr modifications */
+struct yaffs_xattr_mod {
+        int set;                /* If 0 then this is a deletion */
+        const YCHAR *name;
+        const void *data;
+        int size;
+        int flags;
+        int result;
+};
+
+/*----------------------- YAFFS Functions -----------------------*/
+
+int yaffs_guts_initialise(struct yaffs_dev *dev);
+void yaffs_deinitialise(struct yaffs_dev *dev);
+
+int yaffs_get_n_free_chunks(struct yaffs_dev *dev);
+
+int yaffs_rename_obj(struct yaffs_obj *old_dir, const YCHAR * old_name,
+                     struct yaffs_obj *new_dir, const YCHAR * new_name);
+
+int yaffs_unlinker(struct yaffs_obj *dir, const YCHAR * name);
+int yaffs_del_obj(struct yaffs_obj *obj);
+
+int yaffs_get_obj_name(struct yaffs_obj *obj, YCHAR * name, int buffer_size);
+int yaffs_get_obj_length(struct yaffs_obj *obj);
+int yaffs_get_obj_inode(struct yaffs_obj *obj);
+unsigned yaffs_get_obj_type(struct yaffs_obj *obj);
+int yaffs_get_obj_link_count(struct yaffs_obj *obj);
+
+/* File operations */
+int yaffs_file_rd(struct yaffs_obj *obj, u8 * buffer, loff_t offset,
+                  int n_bytes);
+int yaffs_wr_file(struct yaffs_obj *obj, const u8 * buffer, loff_t offset,
+                  int n_bytes, int write_trhrough);
+int yaffs_resize_file(struct yaffs_obj *obj, loff_t new_size);
+
+struct yaffs_obj *yaffs_create_file(struct yaffs_obj *parent,
+                                    const YCHAR * name, u32 mode, u32 uid,
+                                    u32 gid);
+
+int yaffs_flush_file(struct yaffs_obj *obj, int update_time, int data_sync);
+
+/* Flushing and checkpointing */
+void yaffs_flush_whole_cache(struct yaffs_dev *dev);
+
+int yaffs_checkpoint_save(struct yaffs_dev *dev);
+int yaffs_checkpoint_restore(struct yaffs_dev *dev);
+
+/* Directory operations */
+struct yaffs_obj *yaffs_create_dir(struct yaffs_obj *parent, const YCHAR * name,
+                                   u32 mode, u32 uid, u32 gid);
+struct yaffs_obj *yaffs_find_by_name(struct yaffs_obj *the_dir,
+                                     const YCHAR * name);
+struct yaffs_obj *yaffs_find_by_number(struct yaffs_dev *dev, u32 number);
+
+/* Link operations */
+struct yaffs_obj *yaffs_link_obj(struct yaffs_obj *parent, const YCHAR * name,
+                                 struct yaffs_obj *equiv_obj);
+
+struct yaffs_obj *yaffs_get_equivalent_obj(struct yaffs_obj *obj);
+
+/* Symlink operations */
+struct yaffs_obj *yaffs_create_symlink(struct yaffs_obj *parent,
+                                       const YCHAR * name, u32 mode, u32 uid,
+                                       u32 gid, const YCHAR * alias);
+YCHAR *yaffs_get_symlink_alias(struct yaffs_obj *obj);
+
+/* Special inodes (fifos, sockets and devices) */
+struct yaffs_obj *yaffs_create_special(struct yaffs_obj *parent,
+                                       const YCHAR * name, u32 mode, u32 uid,
+                                       u32 gid, u32 rdev);
+
+int yaffs_set_xattrib(struct yaffs_obj *obj, const YCHAR * name,
+                      const void *value, int size, int flags);
+int yaffs_get_xattrib(struct yaffs_obj *obj, const YCHAR * name, void *value,
+                      int size);
+int yaffs_list_xattrib(struct yaffs_obj *obj, char *buffer, int size);
+int yaffs_remove_xattrib(struct yaffs_obj *obj, const YCHAR * name);
+
+/* Special directories */
+struct yaffs_obj *yaffs_root(struct yaffs_dev *dev);
+struct yaffs_obj *yaffs_lost_n_found(struct yaffs_dev *dev);
+
+void yaffs_handle_defered_free(struct yaffs_obj *obj);
+
+void yaffs_update_dirty_dirs(struct yaffs_dev *dev);
+
+int yaffs_bg_gc(struct yaffs_dev *dev, unsigned urgency);
+
+/* Debug dump  */
+int yaffs_dump_obj(struct yaffs_obj *obj);
+
+void yaffs_guts_test(struct yaffs_dev *dev);
+
+/* A few useful functions to be used within the core files*/
+void yaffs_chunk_del(struct yaffs_dev *dev, int chunk_id, int mark_flash,
+                     int lyn);
+int yaffs_check_ff(u8 * buffer, int n_bytes);
+void yaffs_handle_chunk_error(struct yaffs_dev *dev,
+                              struct yaffs_block_info *bi);
+
+u8 *yaffs_get_temp_buffer(struct yaffs_dev *dev, int line_no);
+void yaffs_release_temp_buffer(struct yaffs_dev *dev, u8 * buffer, int line_no);
+
+struct yaffs_obj *yaffs_find_or_create_by_number(struct yaffs_dev *dev,
+                                                 int number,
+                                                 enum yaffs_obj_type type);
+int yaffs_put_chunk_in_file(struct yaffs_obj *in, int inode_chunk,
+                            int nand_chunk, int in_scan);
+void yaffs_set_obj_name(struct yaffs_obj *obj, const YCHAR * name);
+void yaffs_set_obj_name_from_oh(struct yaffs_obj *obj,
+                                const struct yaffs_obj_hdr *oh);
+void yaffs_add_obj_to_dir(struct yaffs_obj *directory, struct yaffs_obj *obj);
+YCHAR *yaffs_clone_str(const YCHAR * str);
+void yaffs_link_fixup(struct yaffs_dev *dev, struct yaffs_obj *hard_list);
+void yaffs_block_became_dirty(struct yaffs_dev *dev, int block_no);
+int yaffs_update_oh(struct yaffs_obj *in, const YCHAR * name,
+                    int force, int is_shrink, int shadows,
+                    struct yaffs_xattr_mod *xop);
+void yaffs_handle_shadowed_obj(struct yaffs_dev *dev, int obj_id,
+                               int backward_scanning);
+int yaffs_check_alloc_available(struct yaffs_dev *dev, int n_chunks);
+struct yaffs_tnode *yaffs_get_tnode(struct yaffs_dev *dev);
+struct yaffs_tnode *yaffs_add_find_tnode_0(struct yaffs_dev *dev,
+                                           struct yaffs_file_var *file_struct,
+                                           u32 chunk_id,
+                                           struct yaffs_tnode *passed_tn);
+
+int yaffs_do_file_wr(struct yaffs_obj *in, const u8 * buffer, loff_t offset,
+                     int n_bytes, int write_trhrough);
+void yaffs_resize_file_down(struct yaffs_obj *obj, loff_t new_size);
+void yaffs_skip_rest_of_block(struct yaffs_dev *dev);
+
+int yaffs_count_free_chunks(struct yaffs_dev *dev);
+
+struct yaffs_tnode *yaffs_find_tnode_0(struct yaffs_dev *dev,
+                                       struct yaffs_file_var *file_struct,
+                                       u32 chunk_id);
+
+u32 yaffs_get_group_base(struct yaffs_dev *dev, struct yaffs_tnode *tn,
+                         unsigned pos);
+
+int yaffs_is_non_empty_dir(struct yaffs_obj *obj);
+#endif
diff --git a/fs/yaffs2/yaffs_linux.h b/fs/yaffs2/yaffs_linux.h
new file mode 100644
index 00000000000..3b508cbc4e8
--- /dev/null
+++ b/fs/yaffs2/yaffs_linux.h
@@ -0,0 +1,41 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_LINUX_H__
+#define __YAFFS_LINUX_H__
+
+#include "yportenv.h"
+
+struct yaffs_linux_context {
+        struct list_head context_list;  /* List of these we have mounted */
+        struct yaffs_dev *dev;
+        struct super_block *super;
+        struct task_struct *bg_thread;  /* Background thread for this device */
+        int bg_running;
+        struct mutex gross_lock;        /* Gross locking mutex*/
+        u8 *spare_buffer;       /* For mtdif2 use. Don't know the size of the buffer
+                                 * at compile time so we have to allocate it.
+                                 */
+        struct list_head search_contexts;
+        void (*put_super_fn) (struct super_block * sb);
+
+        struct task_struct *readdir_process;
+        unsigned mount_id;
+};
+
+#define yaffs_dev_to_lc(dev) ((struct yaffs_linux_context *)((dev)->os_context))
+#define yaffs_dev_to_mtd(dev) ((struct mtd_info *)((dev)->driver_context))
+
+#endif
diff --git a/fs/yaffs2/yaffs_mtdif.c b/fs/yaffs2/yaffs_mtdif.c
new file mode 100644
index 00000000000..7cf53b3d91b
--- /dev/null
+++ b/fs/yaffs2/yaffs_mtdif.c
@@ -0,0 +1,54 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yportenv.h"
+
+#include "yaffs_mtdif.h"
+
+#include "linux/mtd/mtd.h"
+#include "linux/types.h"
+#include "linux/time.h"
+#include "linux/mtd/nand.h"
+
+#include "yaffs_linux.h"
+
+int nandmtd_erase_block(struct yaffs_dev *dev, int block_no)
+{
+        struct mtd_info *mtd = yaffs_dev_to_mtd(dev);
+        u32 addr =
+            ((loff_t) block_no) * dev->param.total_bytes_per_chunk
+            * dev->param.chunks_per_block;
+        struct erase_info ei;
+
+        int retval = 0;
+
+        ei.mtd = mtd;
+        ei.addr = addr;
+        ei.len = dev->param.total_bytes_per_chunk * dev->param.chunks_per_block;
+        ei.time = 1000;
+        ei.retries = 2;
+        ei.callback = NULL;
+        ei.priv = (u_long) dev;
+
+        retval = mtd->erase(mtd, &ei);
+
+        if (retval == 0)
+                return YAFFS_OK;
+        else
+                return YAFFS_FAIL;
+}
+
+int nandmtd_initialise(struct yaffs_dev *dev)
+{
+        return YAFFS_OK;
+}
diff --git a/fs/yaffs2/yaffs_mtdif.h b/fs/yaffs2/yaffs_mtdif.h
new file mode 100644
index 00000000000..666507417fe
--- /dev/null
+++ b/fs/yaffs2/yaffs_mtdif.h
@@ -0,0 +1,23 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_MTDIF_H__
+#define __YAFFS_MTDIF_H__
+
+#include "yaffs_guts.h"
+
+int nandmtd_erase_block(struct yaffs_dev *dev, int block_no);
+int nandmtd_initialise(struct yaffs_dev *dev);
+#endif
diff --git a/fs/yaffs2/yaffs_mtdif1.c b/fs/yaffs2/yaffs_mtdif1.c
new file mode 100644
index 00000000000..51083695eb3
--- /dev/null
+++ b/fs/yaffs2/yaffs_mtdif1.c
@@ -0,0 +1,330 @@
+/*
+ * YAFFS: Yet another FFS. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * This module provides the interface between yaffs_nand.c and the
+ * MTD API.  This version is used when the MTD interface supports the
+ * 'mtd_oob_ops' style calls to read_oob and write_oob, circa 2.6.17,
+ * and we have small-page NAND device.
+ *
+ * These functions are invoked via function pointers in yaffs_nand.c.
+ * This replaces functionality provided by functions in yaffs_mtdif.c
+ * and the yaffs_tags compatability functions in yaffs_tagscompat.c that are
+ * called in yaffs_mtdif.c when the function pointers are NULL.
+ * We assume the MTD layer is performing ECC (use_nand_ecc is true).
+ */
+
+#include "yportenv.h"
+#include "yaffs_trace.h"
+#include "yaffs_guts.h"
+#include "yaffs_packedtags1.h"
+#include "yaffs_tagscompat.h"   /* for yaffs_calc_tags_ecc */
+#include "yaffs_linux.h"
+
+#include "linux/kernel.h"
+#include "linux/version.h"
+#include "linux/types.h"
+#include "linux/mtd/mtd.h"
+
+#ifndef CONFIG_YAFFS_9BYTE_TAGS
+# define YTAG1_SIZE 8
+#else
+# define YTAG1_SIZE 9
+#endif
+
+/* Write a chunk (page) of data to NAND.
+ *
+ * Caller always provides ExtendedTags data which are converted to a more
+ * compact (packed) form for storage in NAND.  A mini-ECC runs over the
+ * contents of the tags meta-data; used to valid the tags when read.
+ *
+ *  - Pack ExtendedTags to packed_tags1 form
+ *  - Compute mini-ECC for packed_tags1
+ *  - Write data and packed tags to NAND.
+ *
+ * Note: Due to the use of the packed_tags1 meta-data which does not include
+ * a full sequence number (as found in the larger packed_tags2 form) it is
+ * necessary for Yaffs to re-write a chunk/page (just once) to mark it as
+ * discarded and dirty.  This is not ideal: newer NAND parts are supposed
+ * to be written just once.  When Yaffs performs this operation, this
+ * function is called with a NULL data pointer -- calling MTD write_oob
+ * without data is valid usage (2.6.17).
+ *
+ * Any underlying MTD error results in YAFFS_FAIL.
+ * Returns YAFFS_OK or YAFFS_FAIL.
+ */
+int nandmtd1_write_chunk_tags(struct yaffs_dev *dev,
+                              int nand_chunk, const u8 * data,
+                              const struct yaffs_ext_tags *etags)
+{
+        struct mtd_info *mtd = yaffs_dev_to_mtd(dev);
+        int chunk_bytes = dev->data_bytes_per_chunk;
+        loff_t addr = ((loff_t) nand_chunk) * chunk_bytes;
+        struct mtd_oob_ops ops;
+        struct yaffs_packed_tags1 pt1;
+        int retval;
+
+        /* we assume that packed_tags1 and struct yaffs_tags are compatible */
+        compile_time_assertion(sizeof(struct yaffs_packed_tags1) == 12);
+        compile_time_assertion(sizeof(struct yaffs_tags) == 8);
+
+        yaffs_pack_tags1(&pt1, etags);
+        yaffs_calc_tags_ecc((struct yaffs_tags *)&pt1);
+
+        /* When deleting a chunk, the upper layer provides only skeletal
+         * etags, one with is_deleted set.  However, we need to update the
+         * tags, not erase them completely.  So we use the NAND write property
+         * that only zeroed-bits stick and set tag bytes to all-ones and
+         * zero just the (not) deleted bit.
+         */
+#ifndef CONFIG_YAFFS_9BYTE_TAGS
+        if (etags->is_deleted) {
+                memset(&pt1, 0xff, 8);
+                /* clear delete status bit to indicate deleted */
+                pt1.deleted = 0;
+        }
+#else
+        ((u8 *) & pt1)[8] = 0xff;
+        if (etags->is_deleted) {
+                memset(&pt1, 0xff, 8);
+                /* zero page_status byte to indicate deleted */
+                ((u8 *) & pt1)[8] = 0;
+        }
+#endif
+
+        memset(&ops, 0, sizeof(ops));
+        ops.mode = MTD_OOB_AUTO;
+        ops.len = (data) ? chunk_bytes : 0;
+        ops.ooblen = YTAG1_SIZE;
+        ops.datbuf = (u8 *) data;
+        ops.oobbuf = (u8 *) & pt1;
+
+        retval = mtd->write_oob(mtd, addr, &ops);
+        if (retval) {
+                yaffs_trace(YAFFS_TRACE_MTD,
+                        "write_oob failed, chunk %d, mtd error %d",
+                        nand_chunk, retval);
+        }
+        return retval ? YAFFS_FAIL : YAFFS_OK;
+}
+
+/* Return with empty ExtendedTags but add ecc_result.
+ */
+static int rettags(struct yaffs_ext_tags *etags, int ecc_result, int retval)
+{
+        if (etags) {
+                memset(etags, 0, sizeof(*etags));
+                etags->ecc_result = ecc_result;
+        }
+        return retval;
+}
+
+/* Read a chunk (page) from NAND.
+ *
+ * Caller expects ExtendedTags data to be usable even on error; that is,
+ * all members except ecc_result and block_bad are zeroed.
+ *
+ *  - Check ECC results for data (if applicable)
+ *  - Check for blank/erased block (return empty ExtendedTags if blank)
+ *  - Check the packed_tags1 mini-ECC (correct if necessary/possible)
+ *  - Convert packed_tags1 to ExtendedTags
+ *  - Update ecc_result and block_bad members to refect state.
+ *
+ * Returns YAFFS_OK or YAFFS_FAIL.
+ */
+int nandmtd1_read_chunk_tags(struct yaffs_dev *dev,
+                             int nand_chunk, u8 * data,
+                             struct yaffs_ext_tags *etags)
+{
+        struct mtd_info *mtd = yaffs_dev_to_mtd(dev);
+        int chunk_bytes = dev->data_bytes_per_chunk;
+        loff_t addr = ((loff_t) nand_chunk) * chunk_bytes;
+        int eccres = YAFFS_ECC_RESULT_NO_ERROR;
+        struct mtd_oob_ops ops;
+        struct yaffs_packed_tags1 pt1;
+        int retval;
+        int deleted;
+
+        memset(&ops, 0, sizeof(ops));
+        ops.mode = MTD_OOB_AUTO;
+        ops.len = (data) ? chunk_bytes : 0;
+        ops.ooblen = YTAG1_SIZE;
+        ops.datbuf = data;
+        ops.oobbuf = (u8 *) & pt1;
+
+        /* Read page and oob using MTD.
+         * Check status and determine ECC result.
+         */
+        retval = mtd->read_oob(mtd, addr, &ops);
+        if (retval) {
+                yaffs_trace(YAFFS_TRACE_MTD,
+                        "read_oob failed, chunk %d, mtd error %d",
+                        nand_chunk, retval);
+        }
+
+        switch (retval) {
+        case 0:
+                /* no error */
+                break;
+
+        case -EUCLEAN:
+                /* MTD's ECC fixed the data */
+                eccres = YAFFS_ECC_RESULT_FIXED;
+                dev->n_ecc_fixed++;
+                break;
+
+        case -EBADMSG:
+                /* MTD's ECC could not fix the data */
+                dev->n_ecc_unfixed++;
+                /* fall into... */
+        default:
+                rettags(etags, YAFFS_ECC_RESULT_UNFIXED, 0);
+                etags->block_bad = (mtd->block_isbad) (mtd, addr);
+                return YAFFS_FAIL;
+        }
+
+        /* Check for a blank/erased chunk.
+         */
+        if (yaffs_check_ff((u8 *) & pt1, 8)) {
+                /* when blank, upper layers want ecc_result to be <= NO_ERROR */
+                return rettags(etags, YAFFS_ECC_RESULT_NO_ERROR, YAFFS_OK);
+        }
+#ifndef CONFIG_YAFFS_9BYTE_TAGS
+        /* Read deleted status (bit) then return it to it's non-deleted
+         * state before performing tags mini-ECC check. pt1.deleted is
+         * inverted.
+         */
+        deleted = !pt1.deleted;
+        pt1.deleted = 1;
+#else
+        deleted = (yaffs_count_bits(((u8 *) & pt1)[8]) < 7);
+#endif
+
+        /* Check the packed tags mini-ECC and correct if necessary/possible.
+         */
+        retval = yaffs_check_tags_ecc((struct yaffs_tags *)&pt1);
+        switch (retval) {
+        case 0:
+                /* no tags error, use MTD result */
+                break;
+        case 1:
+                /* recovered tags-ECC error */
+                dev->n_tags_ecc_fixed++;
+                if (eccres == YAFFS_ECC_RESULT_NO_ERROR)
+                        eccres = YAFFS_ECC_RESULT_FIXED;
+                break;
+        default:
+                /* unrecovered tags-ECC error */
+                dev->n_tags_ecc_unfixed++;
+                return rettags(etags, YAFFS_ECC_RESULT_UNFIXED, YAFFS_FAIL);
+        }
+
+        /* Unpack the tags to extended form and set ECC result.
+         * [set should_be_ff just to keep yaffs_unpack_tags1 happy]
+         */
+        pt1.should_be_ff = 0xFFFFFFFF;
+        yaffs_unpack_tags1(etags, &pt1);
+        etags->ecc_result = eccres;
+
+        /* Set deleted state */
+        etags->is_deleted = deleted;
+        return YAFFS_OK;
+}
+
+/* Mark a block bad.
+ *
+ * This is a persistant state.
+ * Use of this function should be rare.
+ *
+ * Returns YAFFS_OK or YAFFS_FAIL.
+ */
+int nandmtd1_mark_block_bad(struct yaffs_dev *dev, int block_no)
+{
+        struct mtd_info *mtd = yaffs_dev_to_mtd(dev);
+        int blocksize = dev->param.chunks_per_block * dev->data_bytes_per_chunk;
+        int retval;
+
+        yaffs_trace(YAFFS_TRACE_BAD_BLOCKS,
+                "marking block %d bad", block_no);
+
+        retval = mtd->block_markbad(mtd, (loff_t) blocksize * block_no);
+        return (retval) ? YAFFS_FAIL : YAFFS_OK;
+}
+
+/* Check any MTD prerequists.
+ *
+ * Returns YAFFS_OK or YAFFS_FAIL.
+ */
+static int nandmtd1_test_prerequists(struct mtd_info *mtd)
+{
+        /* 2.6.18 has mtd->ecclayout->oobavail */
+        /* 2.6.21 has mtd->ecclayout->oobavail and mtd->oobavail */
+        int oobavail = mtd->ecclayout->oobavail;
+
+        if (oobavail < YTAG1_SIZE) {
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                        "mtd device has only %d bytes for tags, need %d",
+                        oobavail, YTAG1_SIZE);
+                return YAFFS_FAIL;
+        }
+        return YAFFS_OK;
+}
+
+/* Query for the current state of a specific block.
+ *
+ * Examine the tags of the first chunk of the block and return the state:
+ *  - YAFFS_BLOCK_STATE_DEAD, the block is marked bad
+ *  - YAFFS_BLOCK_STATE_NEEDS_SCANNING, the block is in use
+ *  - YAFFS_BLOCK_STATE_EMPTY, the block is clean
+ *
+ * Always returns YAFFS_OK.
+ */
+int nandmtd1_query_block(struct yaffs_dev *dev, int block_no,
+                         enum yaffs_block_state *state_ptr, u32 * seq_ptr)
+{
+        struct mtd_info *mtd = yaffs_dev_to_mtd(dev);
+        int chunk_num = block_no * dev->param.chunks_per_block;
+        loff_t addr = (loff_t) chunk_num * dev->data_bytes_per_chunk;
+        struct yaffs_ext_tags etags;
+        int state = YAFFS_BLOCK_STATE_DEAD;
+        int seqnum = 0;
+        int retval;
+
+        /* We don't yet have a good place to test for MTD config prerequists.
+         * Do it here as we are called during the initial scan.
+         */
+        if (nandmtd1_test_prerequists(mtd) != YAFFS_OK)
+                return YAFFS_FAIL;
+
+        retval = nandmtd1_read_chunk_tags(dev, chunk_num, NULL, &etags);
+        etags.block_bad = (mtd->block_isbad) (mtd, addr);
+        if (etags.block_bad) {
+                yaffs_trace(YAFFS_TRACE_BAD_BLOCKS,
+                        "block %d is marked bad", block_no);
+                state = YAFFS_BLOCK_STATE_DEAD;
+        } else if (etags.ecc_result != YAFFS_ECC_RESULT_NO_ERROR) {
+                /* bad tags, need to look more closely */
+                state = YAFFS_BLOCK_STATE_NEEDS_SCANNING;
+        } else if (etags.chunk_used) {
+                state = YAFFS_BLOCK_STATE_NEEDS_SCANNING;
+                seqnum = etags.seq_number;
+        } else {
+                state = YAFFS_BLOCK_STATE_EMPTY;
+        }
+
+        *state_ptr = state;
+        *seq_ptr = seqnum;
+
+        /* query always succeeds */
+        return YAFFS_OK;
+}
diff --git a/fs/yaffs2/yaffs_mtdif1.h b/fs/yaffs2/yaffs_mtdif1.h
new file mode 100644
index 00000000000..07ce4524f0f
--- /dev/null
+++ b/fs/yaffs2/yaffs_mtdif1.h
@@ -0,0 +1,29 @@
+/*
+ * YAFFS: Yet another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_MTDIF1_H__
+#define __YAFFS_MTDIF1_H__
+
+int nandmtd1_write_chunk_tags(struct yaffs_dev *dev, int nand_chunk,
+                              const u8 * data,
+                              const struct yaffs_ext_tags *tags);
+
+int nandmtd1_read_chunk_tags(struct yaffs_dev *dev, int nand_chunk,
+                             u8 * data, struct yaffs_ext_tags *tags);
+
+int nandmtd1_mark_block_bad(struct yaffs_dev *dev, int block_no);
+
+int nandmtd1_query_block(struct yaffs_dev *dev, int block_no,
+                         enum yaffs_block_state *state, u32 * seq_number);
+
+#endif
diff --git a/fs/yaffs2/yaffs_mtdif2.c b/fs/yaffs2/yaffs_mtdif2.c
new file mode 100644
index 00000000000..d1643df2c38
--- /dev/null
+++ b/fs/yaffs2/yaffs_mtdif2.c
@@ -0,0 +1,225 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/* mtd interface for YAFFS2 */
+
+#include "yportenv.h"
+#include "yaffs_trace.h"
+
+#include "yaffs_mtdif2.h"
+
+#include "linux/mtd/mtd.h"
+#include "linux/types.h"
+#include "linux/time.h"
+
+#include "yaffs_packedtags2.h"
+
+#include "yaffs_linux.h"
+
+/* NB For use with inband tags....
+ * We assume that the data buffer is of size total_bytes_per_chunk so that we can also
+ * use it to load the tags.
+ */
+int nandmtd2_write_chunk_tags(struct yaffs_dev *dev, int nand_chunk,
+                              const u8 * data,
+                              const struct yaffs_ext_tags *tags)
+{
+        struct mtd_info *mtd = yaffs_dev_to_mtd(dev);
+        struct mtd_oob_ops ops;
+        int retval = 0;
+
+        loff_t addr;
+
+        struct yaffs_packed_tags2 pt;
+
+        int packed_tags_size =
+            dev->param.no_tags_ecc ? sizeof(pt.t) : sizeof(pt);
+        void *packed_tags_ptr =
+            dev->param.no_tags_ecc ? (void *)&pt.t : (void *)&pt;
+
+        yaffs_trace(YAFFS_TRACE_MTD,
+                "nandmtd2_write_chunk_tags chunk %d data %p tags %p",
+                nand_chunk, data, tags);
+
+        addr = ((loff_t) nand_chunk) * dev->param.total_bytes_per_chunk;
+
+        /* For yaffs2 writing there must be both data and tags.
+         * If we're using inband tags, then the tags are stuffed into
+         * the end of the data buffer.
+         */
+        if (!data || !tags)
+                BUG();
+        else if (dev->param.inband_tags) {
+                struct yaffs_packed_tags2_tags_only *pt2tp;
+                pt2tp =
+                    (struct yaffs_packed_tags2_tags_only *)(data +
+                                                            dev->
+                                                            data_bytes_per_chunk);
+                yaffs_pack_tags2_tags_only(pt2tp, tags);
+        } else {
+                yaffs_pack_tags2(&pt, tags, !dev->param.no_tags_ecc);
+        }
+
+        ops.mode = MTD_OOB_AUTO;
+        ops.ooblen = (dev->param.inband_tags) ? 0 : packed_tags_size;
+        ops.len = dev->param.total_bytes_per_chunk;
+        ops.ooboffs = 0;
+        ops.datbuf = (u8 *) data;
+        ops.oobbuf = (dev->param.inband_tags) ? NULL : packed_tags_ptr;
+        retval = mtd->write_oob(mtd, addr, &ops);
+
+        if (retval == 0)
+                return YAFFS_OK;
+        else
+                return YAFFS_FAIL;
+}
+
+int nandmtd2_read_chunk_tags(struct yaffs_dev *dev, int nand_chunk,
+                             u8 * data, struct yaffs_ext_tags *tags)
+{
+        struct mtd_info *mtd = yaffs_dev_to_mtd(dev);
+        struct mtd_oob_ops ops;
+
+        size_t dummy;
+        int retval = 0;
+        int local_data = 0;
+
+        loff_t addr = ((loff_t) nand_chunk) * dev->param.total_bytes_per_chunk;
+
+        struct yaffs_packed_tags2 pt;
+
+        int packed_tags_size =
+            dev->param.no_tags_ecc ? sizeof(pt.t) : sizeof(pt);
+        void *packed_tags_ptr =
+            dev->param.no_tags_ecc ? (void *)&pt.t : (void *)&pt;
+
+        yaffs_trace(YAFFS_TRACE_MTD,
+                "nandmtd2_read_chunk_tags chunk %d data %p tags %p",
+                nand_chunk, data, tags);
+
+        if (dev->param.inband_tags) {
+
+                if (!data) {
+                        local_data = 1;
+                        data = yaffs_get_temp_buffer(dev, __LINE__);
+                }
+
+        }
+
+        if (dev->param.inband_tags || (data && !tags))
+                retval = mtd->read(mtd, addr, dev->param.total_bytes_per_chunk,
+                                   &dummy, data);
+        else if (tags) {
+                ops.mode = MTD_OOB_AUTO;
+                ops.ooblen = packed_tags_size;
+                ops.len = data ? dev->data_bytes_per_chunk : packed_tags_size;
+                ops.ooboffs = 0;
+                ops.datbuf = data;
+                ops.oobbuf = yaffs_dev_to_lc(dev)->spare_buffer;
+                retval = mtd->read_oob(mtd, addr, &ops);
+        }
+
+        if (dev->param.inband_tags) {
+                if (tags) {
+                        struct yaffs_packed_tags2_tags_only *pt2tp;
+                        pt2tp =
+                            (struct yaffs_packed_tags2_tags_only *)&data[dev->
+                                                                         data_bytes_per_chunk];
+                        yaffs_unpack_tags2_tags_only(tags, pt2tp);
+                }
+        } else {
+                if (tags) {
+                        memcpy(packed_tags_ptr,
+                               yaffs_dev_to_lc(dev)->spare_buffer,
+                               packed_tags_size);
+                        yaffs_unpack_tags2(tags, &pt, !dev->param.no_tags_ecc);
+                }
+        }
+
+        if (local_data)
+                yaffs_release_temp_buffer(dev, data, __LINE__);
+
+        if (tags && retval == -EBADMSG
+            && tags->ecc_result == YAFFS_ECC_RESULT_NO_ERROR) {
+                tags->ecc_result = YAFFS_ECC_RESULT_UNFIXED;
+                dev->n_ecc_unfixed++;
+        }
+        if (tags && retval == -EUCLEAN
+            && tags->ecc_result == YAFFS_ECC_RESULT_NO_ERROR) {
+                tags->ecc_result = YAFFS_ECC_RESULT_FIXED;
+                dev->n_ecc_fixed++;
+        }
+        if (retval == 0)
+                return YAFFS_OK;
+        else
+                return YAFFS_FAIL;
+}
+
+int nandmtd2_mark_block_bad(struct yaffs_dev *dev, int block_no)
+{
+        struct mtd_info *mtd = yaffs_dev_to_mtd(dev);
+        int retval;
+        yaffs_trace(YAFFS_TRACE_MTD,
+                "nandmtd2_mark_block_bad %d", block_no);
+
+        retval =
+            mtd->block_markbad(mtd,
+                               block_no * dev->param.chunks_per_block *
+                               dev->param.total_bytes_per_chunk);
+
+        if (retval == 0)
+                return YAFFS_OK;
+        else
+                return YAFFS_FAIL;
+
+}
+
+int nandmtd2_query_block(struct yaffs_dev *dev, int block_no,
+                         enum yaffs_block_state *state, u32 * seq_number)
+{
+        struct mtd_info *mtd = yaffs_dev_to_mtd(dev);
+        int retval;
+
+        yaffs_trace(YAFFS_TRACE_MTD, "nandmtd2_query_block %d", block_no);
+        retval =
+            mtd->block_isbad(mtd,
+                             block_no * dev->param.chunks_per_block *
+                             dev->param.total_bytes_per_chunk);
+
+        if (retval) {
+                yaffs_trace(YAFFS_TRACE_MTD, "block is bad");
+
+                *state = YAFFS_BLOCK_STATE_DEAD;
+                *seq_number = 0;
+        } else {
+                struct yaffs_ext_tags t;
+                nandmtd2_read_chunk_tags(dev, block_no *
+                                         dev->param.chunks_per_block, NULL, &t);
+
+                if (t.chunk_used) {
+                        *seq_number = t.seq_number;
+                        *state = YAFFS_BLOCK_STATE_NEEDS_SCANNING;
+                } else {
+                        *seq_number = 0;
+                        *state = YAFFS_BLOCK_STATE_EMPTY;
+                }
+        }
+        yaffs_trace(YAFFS_TRACE_MTD,
+                "block is bad seq %d state %d", *seq_number, *state);
+
+        if (retval == 0)
+                return YAFFS_OK;
+        else
+                return YAFFS_FAIL;
+}
+
diff --git a/fs/yaffs2/yaffs_mtdif2.h b/fs/yaffs2/yaffs_mtdif2.h
new file mode 100644
index 00000000000..d82112610d0
--- /dev/null
+++ b/fs/yaffs2/yaffs_mtdif2.h
@@ -0,0 +1,29 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_MTDIF2_H__
+#define __YAFFS_MTDIF2_H__
+
+#include "yaffs_guts.h"
+int nandmtd2_write_chunk_tags(struct yaffs_dev *dev, int nand_chunk,
+                              const u8 * data,
+                              const struct yaffs_ext_tags *tags);
+int nandmtd2_read_chunk_tags(struct yaffs_dev *dev, int nand_chunk,
+                             u8 * data, struct yaffs_ext_tags *tags);
+int nandmtd2_mark_block_bad(struct yaffs_dev *dev, int block_no);
+int nandmtd2_query_block(struct yaffs_dev *dev, int block_no,
+                         enum yaffs_block_state *state, u32 * seq_number);
+
+#endif
diff --git a/fs/yaffs2/yaffs_nameval.c b/fs/yaffs2/yaffs_nameval.c
new file mode 100644
index 00000000000..daa36f989d3
--- /dev/null
+++ b/fs/yaffs2/yaffs_nameval.c
@@ -0,0 +1,201 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * This simple implementation of a name-value store assumes a small number of values and fits
+ * into a small finite buffer.
+ *
+ * Each attribute is stored as a record:
+ *  sizeof(int) bytes   record size.
+ *  strnlen+1 bytes name null terminated.
+ *  nbytes    value.
+ *  ----------
+ *  total size  stored in record size 
+ *
+ * This code has not been tested with unicode yet.
+ */
+
+#include "yaffs_nameval.h"
+
+#include "yportenv.h"
+
+static int nval_find(const char *xb, int xb_size, const YCHAR * name,
+                     int *exist_size)
+{
+        int pos = 0;
+        int size;
+
+        memcpy(&size, xb, sizeof(int));
+        while (size > 0 && (size < xb_size) && (pos + size < xb_size)) {
+                if (strncmp
+                    ((YCHAR *) (xb + pos + sizeof(int)), name, size) == 0) {
+                        if (exist_size)
+                                *exist_size = size;
+                        return pos;
+                }
+                pos += size;
+                if (pos < xb_size - sizeof(int))
+                        memcpy(&size, xb + pos, sizeof(int));
+                else
+                        size = 0;
+        }
+        if (exist_size)
+                *exist_size = 0;
+        return -1;
+}
+
+static int nval_used(const char *xb, int xb_size)
+{
+        int pos = 0;
+        int size;
+
+        memcpy(&size, xb + pos, sizeof(int));
+        while (size > 0 && (size < xb_size) && (pos + size < xb_size)) {
+                pos += size;
+                if (pos < xb_size - sizeof(int))
+                        memcpy(&size, xb + pos, sizeof(int));
+                else
+                        size = 0;
+        }
+        return pos;
+}
+
+int nval_del(char *xb, int xb_size, const YCHAR * name)
+{
+        int pos = nval_find(xb, xb_size, name, NULL);
+        int size;
+
+        if (pos >= 0 && pos < xb_size) {
+                /* Find size, shift rest over this record, then zero out the rest of buffer */
+                memcpy(&size, xb + pos, sizeof(int));
+                memcpy(xb + pos, xb + pos + size, xb_size - (pos + size));
+                memset(xb + (xb_size - size), 0, size);
+                return 0;
+        } else {
+                return -ENODATA;
+        }
+}
+
+int nval_set(char *xb, int xb_size, const YCHAR * name, const char *buf,
+             int bsize, int flags)
+{
+        int pos;
+        int namelen = strnlen(name, xb_size);
+        int reclen;
+        int size_exist = 0;
+        int space;
+        int start;
+
+        pos = nval_find(xb, xb_size, name, &size_exist);
+
+        if (flags & XATTR_CREATE && pos >= 0)
+                return -EEXIST;
+        if (flags & XATTR_REPLACE && pos < 0)
+                return -ENODATA;
+
+        start = nval_used(xb, xb_size);
+        space = xb_size - start + size_exist;
+
+        reclen = (sizeof(int) + namelen + 1 + bsize);
+
+        if (reclen > space)
+                return -ENOSPC;
+
+        if (pos >= 0) {
+                nval_del(xb, xb_size, name);
+                start = nval_used(xb, xb_size);
+        }
+
+        pos = start;
+
+        memcpy(xb + pos, &reclen, sizeof(int));
+        pos += sizeof(int);
+        strncpy((YCHAR *) (xb + pos), name, reclen);
+        pos += (namelen + 1);
+        memcpy(xb + pos, buf, bsize);
+        return 0;
+}
+
+int nval_get(const char *xb, int xb_size, const YCHAR * name, char *buf,
+             int bsize)
+{
+        int pos = nval_find(xb, xb_size, name, NULL);
+        int size;
+
+        if (pos >= 0 && pos < xb_size) {
+
+                memcpy(&size, xb + pos, sizeof(int));
+                pos += sizeof(int);     /* advance past record length */
+                size -= sizeof(int);
+
+                /* Advance over name string */
+                while (xb[pos] && size > 0 && pos < xb_size) {
+                        pos++;
+                        size--;
+                }
+                /*Advance over NUL */
+                pos++;
+                size--;
+
+                if (size <= bsize) {
+                        memcpy(buf, xb + pos, size);
+                        return size;
+                }
+
+        }
+        if (pos >= 0)
+                return -ERANGE;
+        else
+                return -ENODATA;
+}
+
+int nval_list(const char *xb, int xb_size, char *buf, int bsize)
+{
+        int pos = 0;
+        int size;
+        int name_len;
+        int ncopied = 0;
+        int filled = 0;
+
+        memcpy(&size, xb + pos, sizeof(int));
+        while (size > sizeof(int) && size <= xb_size && (pos + size) < xb_size
+               && !filled) {
+                pos += sizeof(int);
+                size -= sizeof(int);
+                name_len = strnlen((YCHAR *) (xb + pos), size);
+                if (ncopied + name_len + 1 < bsize) {
+                        memcpy(buf, xb + pos, name_len * sizeof(YCHAR));
+                        buf += name_len;
+                        *buf = '\0';
+                        buf++;
+                        if (sizeof(YCHAR) > 1) {
+                                *buf = '\0';
+                                buf++;
+                        }
+                        ncopied += (name_len + 1);
+                } else {
+                        filled = 1;
+                }
+                pos += size;
+                if (pos < xb_size - sizeof(int))
+                        memcpy(&size, xb + pos, sizeof(int));
+                else
+                        size = 0;
+        }
+        return ncopied;
+}
+
+int nval_hasvalues(const char *xb, int xb_size)
+{
+        return nval_used(xb, xb_size) > 0;
+}
diff --git a/fs/yaffs2/yaffs_nameval.h b/fs/yaffs2/yaffs_nameval.h
new file mode 100644
index 00000000000..2bb02b62762
--- /dev/null
+++ b/fs/yaffs2/yaffs_nameval.h
@@ -0,0 +1,28 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __NAMEVAL_H__
+#define __NAMEVAL_H__
+
+#include "yportenv.h"
+
+int nval_del(char *xb, int xb_size, const YCHAR * name);
+int nval_set(char *xb, int xb_size, const YCHAR * name, const char *buf,
+             int bsize, int flags);
+int nval_get(const char *xb, int xb_size, const YCHAR * name, char *buf,
+             int bsize);
+int nval_list(const char *xb, int xb_size, char *buf, int bsize);
+int nval_hasvalues(const char *xb, int xb_size);
+#endif
diff --git a/fs/yaffs2/yaffs_nand.c b/fs/yaffs2/yaffs_nand.c
new file mode 100644
index 00000000000..e816cabf43f
--- /dev/null
+++ b/fs/yaffs2/yaffs_nand.c
@@ -0,0 +1,127 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_nand.h"
+#include "yaffs_tagscompat.h"
+#include "yaffs_tagsvalidity.h"
+
+#include "yaffs_getblockinfo.h"
+
+int yaffs_rd_chunk_tags_nand(struct yaffs_dev *dev, int nand_chunk,
+                             u8 * buffer, struct yaffs_ext_tags *tags)
+{
+        int result;
+        struct yaffs_ext_tags local_tags;
+
+        int realigned_chunk = nand_chunk - dev->chunk_offset;
+
+        dev->n_page_reads++;
+
+        /* If there are no tags provided, use local tags to get prioritised gc working */
+        if (!tags)
+                tags = &local_tags;
+
+        if (dev->param.read_chunk_tags_fn)
+                result =
+                    dev->param.read_chunk_tags_fn(dev, realigned_chunk, buffer,
+                                                  tags);
+        else
+                result = yaffs_tags_compat_rd(dev,
+                                              realigned_chunk, buffer, tags);
+        if (tags && tags->ecc_result > YAFFS_ECC_RESULT_NO_ERROR) {
+
+                struct yaffs_block_info *bi;
+                bi = yaffs_get_block_info(dev,
+                                          nand_chunk /
+                                          dev->param.chunks_per_block);
+                yaffs_handle_chunk_error(dev, bi);
+        }
+
+        return result;
+}
+
+int yaffs_wr_chunk_tags_nand(struct yaffs_dev *dev,
+                             int nand_chunk,
+                             const u8 * buffer, struct yaffs_ext_tags *tags)
+{
+
+        dev->n_page_writes++;
+
+        nand_chunk -= dev->chunk_offset;
+
+        if (tags) {
+                tags->seq_number = dev->seq_number;
+                tags->chunk_used = 1;
+                if (!yaffs_validate_tags(tags)) {
+                        yaffs_trace(YAFFS_TRACE_ERROR, "Writing uninitialised tags");
+                        YBUG();
+                }
+                yaffs_trace(YAFFS_TRACE_WRITE,
+                        "Writing chunk %d tags %d %d",
+                        nand_chunk, tags->obj_id, tags->chunk_id);
+        } else {
+                yaffs_trace(YAFFS_TRACE_ERROR, "Writing with no tags");
+                YBUG();
+        }
+
+        if (dev->param.write_chunk_tags_fn)
+                return dev->param.write_chunk_tags_fn(dev, nand_chunk, buffer,
+                                                      tags);
+        else
+                return yaffs_tags_compat_wr(dev, nand_chunk, buffer, tags);
+}
+
+int yaffs_mark_bad(struct yaffs_dev *dev, int block_no)
+{
+        block_no -= dev->block_offset;
+
+        if (dev->param.bad_block_fn)
+                return dev->param.bad_block_fn(dev, block_no);
+        else
+                return yaffs_tags_compat_mark_bad(dev, block_no);
+}
+
+int yaffs_query_init_block_state(struct yaffs_dev *dev,
+                                 int block_no,
+                                 enum yaffs_block_state *state,
+                                 u32 * seq_number)
+{
+        block_no -= dev->block_offset;
+
+        if (dev->param.query_block_fn)
+                return dev->param.query_block_fn(dev, block_no, state,
+                                                 seq_number);
+        else
+                return yaffs_tags_compat_query_block(dev, block_no,
+                                                     state, seq_number);
+}
+
+int yaffs_erase_block(struct yaffs_dev *dev, int flash_block)
+{
+        int result;
+
+        flash_block -= dev->block_offset;
+
+        dev->n_erasures++;
+
+        result = dev->param.erase_fn(dev, flash_block);
+
+        return result;
+}
+
+int yaffs_init_nand(struct yaffs_dev *dev)
+{
+        if (dev->param.initialise_flash_fn)
+                return dev->param.initialise_flash_fn(dev);
+        return YAFFS_OK;
+}
diff --git a/fs/yaffs2/yaffs_nand.h b/fs/yaffs2/yaffs_nand.h
new file mode 100644
index 00000000000..543f1987124
--- /dev/null
+++ b/fs/yaffs2/yaffs_nand.h
@@ -0,0 +1,38 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_NAND_H__
+#define __YAFFS_NAND_H__
+#include "yaffs_guts.h"
+
+int yaffs_rd_chunk_tags_nand(struct yaffs_dev *dev, int nand_chunk,
+                             u8 * buffer, struct yaffs_ext_tags *tags);
+
+int yaffs_wr_chunk_tags_nand(struct yaffs_dev *dev,
+                             int nand_chunk,
+                             const u8 * buffer, struct yaffs_ext_tags *tags);
+
+int yaffs_mark_bad(struct yaffs_dev *dev, int block_no);
+
+int yaffs_query_init_block_state(struct yaffs_dev *dev,
+                                 int block_no,
+                                 enum yaffs_block_state *state,
+                                 unsigned *seq_number);
+
+int yaffs_erase_block(struct yaffs_dev *dev, int flash_block);
+
+int yaffs_init_nand(struct yaffs_dev *dev);
+
+#endif
diff --git a/fs/yaffs2/yaffs_packedtags1.c b/fs/yaffs2/yaffs_packedtags1.c
new file mode 100644
index 00000000000..a77f0954fc1
--- /dev/null
+++ b/fs/yaffs2/yaffs_packedtags1.c
@@ -0,0 +1,53 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_packedtags1.h"
+#include "yportenv.h"
+
+void yaffs_pack_tags1(struct yaffs_packed_tags1 *pt,
+                      const struct yaffs_ext_tags *t)
+{
+        pt->chunk_id = t->chunk_id;
+        pt->serial_number = t->serial_number;
+        pt->n_bytes = t->n_bytes;
+        pt->obj_id = t->obj_id;
+        pt->ecc = 0;
+        pt->deleted = (t->is_deleted) ? 0 : 1;
+        pt->unused_stuff = 0;
+        pt->should_be_ff = 0xFFFFFFFF;
+
+}
+
+void yaffs_unpack_tags1(struct yaffs_ext_tags *t,
+                        const struct yaffs_packed_tags1 *pt)
+{
+        static const u8 all_ff[] =
+            { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0xff
+        };
+
+        if (memcmp(all_ff, pt, sizeof(struct yaffs_packed_tags1))) {
+                t->block_bad = 0;
+                if (pt->should_be_ff != 0xFFFFFFFF)
+                        t->block_bad = 1;
+                t->chunk_used = 1;
+                t->obj_id = pt->obj_id;
+                t->chunk_id = pt->chunk_id;
+                t->n_bytes = pt->n_bytes;
+                t->ecc_result = YAFFS_ECC_RESULT_NO_ERROR;
+                t->is_deleted = (pt->deleted) ? 0 : 1;
+                t->serial_number = pt->serial_number;
+        } else {
+                memset(t, 0, sizeof(struct yaffs_ext_tags));
+        }
+}
diff --git a/fs/yaffs2/yaffs_packedtags1.h b/fs/yaffs2/yaffs_packedtags1.h
new file mode 100644
index 00000000000..d6861ff505e
--- /dev/null
+++ b/fs/yaffs2/yaffs_packedtags1.h
@@ -0,0 +1,39 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+/* This is used to pack YAFFS1 tags, not YAFFS2 tags. */
+
+#ifndef __YAFFS_PACKEDTAGS1_H__
+#define __YAFFS_PACKEDTAGS1_H__
+
+#include "yaffs_guts.h"
+
+struct yaffs_packed_tags1 {
+        unsigned chunk_id:20;
+        unsigned serial_number:2;
+        unsigned n_bytes:10;
+        unsigned obj_id:18;
+        unsigned ecc:12;
+        unsigned deleted:1;
+        unsigned unused_stuff:1;
+        unsigned should_be_ff;
+
+};
+
+void yaffs_pack_tags1(struct yaffs_packed_tags1 *pt,
+                      const struct yaffs_ext_tags *t);
+void yaffs_unpack_tags1(struct yaffs_ext_tags *t,
+                        const struct yaffs_packed_tags1 *pt);
+#endif
diff --git a/fs/yaffs2/yaffs_packedtags2.c b/fs/yaffs2/yaffs_packedtags2.c
new file mode 100644
index 00000000000..8e7fea3d286
--- /dev/null
+++ b/fs/yaffs2/yaffs_packedtags2.c
@@ -0,0 +1,196 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_packedtags2.h"
+#include "yportenv.h"
+#include "yaffs_trace.h"
+#include "yaffs_tagsvalidity.h"
+
+/* This code packs a set of extended tags into a binary structure for
+ * NAND storage
+ */
+
+/* Some of the information is "extra" struff which can be packed in to
+ * speed scanning
+ * This is defined by having the EXTRA_HEADER_INFO_FLAG set.
+ */
+
+/* Extra flags applied to chunk_id */
+
+#define EXTRA_HEADER_INFO_FLAG  0x80000000
+#define EXTRA_SHRINK_FLAG       0x40000000
+#define EXTRA_SHADOWS_FLAG      0x20000000
+#define EXTRA_SPARE_FLAGS       0x10000000
+
+#define ALL_EXTRA_FLAGS         0xF0000000
+
+/* Also, the top 4 bits of the object Id are set to the object type. */
+#define EXTRA_OBJECT_TYPE_SHIFT (28)
+#define EXTRA_OBJECT_TYPE_MASK  ((0x0F) << EXTRA_OBJECT_TYPE_SHIFT)
+
+static void yaffs_dump_packed_tags2_tags_only(const struct
+                                              yaffs_packed_tags2_tags_only *ptt)
+{
+        yaffs_trace(YAFFS_TRACE_MTD,
+                "packed tags obj %d chunk %d byte %d seq %d",
+                ptt->obj_id, ptt->chunk_id, ptt->n_bytes, ptt->seq_number);
+}
+
+static void yaffs_dump_packed_tags2(const struct yaffs_packed_tags2 *pt)
+{
+        yaffs_dump_packed_tags2_tags_only(&pt->t);
+}
+
+static void yaffs_dump_tags2(const struct yaffs_ext_tags *t)
+{
+        yaffs_trace(YAFFS_TRACE_MTD,
+                "ext.tags eccres %d blkbad %d chused %d obj %d chunk%d byte %d del %d ser %d seq %d",
+                t->ecc_result, t->block_bad, t->chunk_used, t->obj_id,
+                t->chunk_id, t->n_bytes, t->is_deleted, t->serial_number,
+                t->seq_number);
+
+}
+
+void yaffs_pack_tags2_tags_only(struct yaffs_packed_tags2_tags_only *ptt,
+                                const struct yaffs_ext_tags *t)
+{
+        ptt->chunk_id = t->chunk_id;
+        ptt->seq_number = t->seq_number;
+        ptt->n_bytes = t->n_bytes;
+        ptt->obj_id = t->obj_id;
+
+        if (t->chunk_id == 0 && t->extra_available) {
+                /* Store the extra header info instead */
+                /* We save the parent object in the chunk_id */
+                ptt->chunk_id = EXTRA_HEADER_INFO_FLAG | t->extra_parent_id;
+                if (t->extra_is_shrink)
+                        ptt->chunk_id |= EXTRA_SHRINK_FLAG;
+                if (t->extra_shadows)
+                        ptt->chunk_id |= EXTRA_SHADOWS_FLAG;
+
+                ptt->obj_id &= ~EXTRA_OBJECT_TYPE_MASK;
+                ptt->obj_id |= (t->extra_obj_type << EXTRA_OBJECT_TYPE_SHIFT);
+
+                if (t->extra_obj_type == YAFFS_OBJECT_TYPE_HARDLINK)
+                        ptt->n_bytes = t->extra_equiv_id;
+                else if (t->extra_obj_type == YAFFS_OBJECT_TYPE_FILE)
+                        ptt->n_bytes = t->extra_length;
+                else
+                        ptt->n_bytes = 0;
+        }
+
+        yaffs_dump_packed_tags2_tags_only(ptt);
+        yaffs_dump_tags2(t);
+}
+
+void yaffs_pack_tags2(struct yaffs_packed_tags2 *pt,
+                      const struct yaffs_ext_tags *t, int tags_ecc)
+{
+        yaffs_pack_tags2_tags_only(&pt->t, t);
+
+        if (tags_ecc)
+                yaffs_ecc_calc_other((unsigned char *)&pt->t,
+                                     sizeof(struct
+                                            yaffs_packed_tags2_tags_only),
+                                     &pt->ecc);
+}
+
+void yaffs_unpack_tags2_tags_only(struct yaffs_ext_tags *t,
+                                  struct yaffs_packed_tags2_tags_only *ptt)
+{
+
+        memset(t, 0, sizeof(struct yaffs_ext_tags));
+
+        yaffs_init_tags(t);
+
+        if (ptt->seq_number != 0xFFFFFFFF) {
+                t->block_bad = 0;
+                t->chunk_used = 1;
+                t->obj_id = ptt->obj_id;
+                t->chunk_id = ptt->chunk_id;
+                t->n_bytes = ptt->n_bytes;
+                t->is_deleted = 0;
+                t->serial_number = 0;
+                t->seq_number = ptt->seq_number;
+
+                /* Do extra header info stuff */
+
+                if (ptt->chunk_id & EXTRA_HEADER_INFO_FLAG) {
+                        t->chunk_id = 0;
+                        t->n_bytes = 0;
+
+                        t->extra_available = 1;
+                        t->extra_parent_id =
+                            ptt->chunk_id & (~(ALL_EXTRA_FLAGS));
+                        t->extra_is_shrink =
+                            (ptt->chunk_id & EXTRA_SHRINK_FLAG) ? 1 : 0;
+                        t->extra_shadows =
+                            (ptt->chunk_id & EXTRA_SHADOWS_FLAG) ? 1 : 0;
+                        t->extra_obj_type =
+                            ptt->obj_id >> EXTRA_OBJECT_TYPE_SHIFT;
+                        t->obj_id &= ~EXTRA_OBJECT_TYPE_MASK;
+
+                        if (t->extra_obj_type == YAFFS_OBJECT_TYPE_HARDLINK)
+                                t->extra_equiv_id = ptt->n_bytes;
+                        else
+                                t->extra_length = ptt->n_bytes;
+                }
+        }
+
+        yaffs_dump_packed_tags2_tags_only(ptt);
+        yaffs_dump_tags2(t);
+
+}
+
+void yaffs_unpack_tags2(struct yaffs_ext_tags *t, struct yaffs_packed_tags2 *pt,
+                        int tags_ecc)
+{
+
+        enum yaffs_ecc_result ecc_result = YAFFS_ECC_RESULT_NO_ERROR;
+
+        if (pt->t.seq_number != 0xFFFFFFFF && tags_ecc) {
+                /* Chunk is in use and we need to do ECC */
+
+                struct yaffs_ecc_other ecc;
+                int result;
+                yaffs_ecc_calc_other((unsigned char *)&pt->t,
+                                     sizeof(struct
+                                            yaffs_packed_tags2_tags_only),
+                                     &ecc);
+                result =
+                    yaffs_ecc_correct_other((unsigned char *)&pt->t,
+                                            sizeof(struct
+                                                   yaffs_packed_tags2_tags_only),
+                                            &pt->ecc, &ecc);
+                switch (result) {
+                case 0:
+                        ecc_result = YAFFS_ECC_RESULT_NO_ERROR;
+                        break;
+                case 1:
+                        ecc_result = YAFFS_ECC_RESULT_FIXED;
+                        break;
+                case -1:
+                        ecc_result = YAFFS_ECC_RESULT_UNFIXED;
+                        break;
+                default:
+                        ecc_result = YAFFS_ECC_RESULT_UNKNOWN;
+                }
+        }
+
+        yaffs_unpack_tags2_tags_only(t, &pt->t);
+
+        t->ecc_result = ecc_result;
+
+        yaffs_dump_packed_tags2(pt);
+        yaffs_dump_tags2(t);
+}
diff --git a/fs/yaffs2/yaffs_packedtags2.h b/fs/yaffs2/yaffs_packedtags2.h
new file mode 100644
index 00000000000..f3296697bc0
--- /dev/null
+++ b/fs/yaffs2/yaffs_packedtags2.h
@@ -0,0 +1,47 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+/* This is used to pack YAFFS2 tags, not YAFFS1tags. */
+
+#ifndef __YAFFS_PACKEDTAGS2_H__
+#define __YAFFS_PACKEDTAGS2_H__
+
+#include "yaffs_guts.h"
+#include "yaffs_ecc.h"
+
+struct yaffs_packed_tags2_tags_only {
+        unsigned seq_number;
+        unsigned obj_id;
+        unsigned chunk_id;
+        unsigned n_bytes;
+};
+
+struct yaffs_packed_tags2 {
+        struct yaffs_packed_tags2_tags_only t;
+        struct yaffs_ecc_other ecc;
+};
+
+/* Full packed tags with ECC, used for oob tags */
+void yaffs_pack_tags2(struct yaffs_packed_tags2 *pt,
+                      const struct yaffs_ext_tags *t, int tags_ecc);
+void yaffs_unpack_tags2(struct yaffs_ext_tags *t, struct yaffs_packed_tags2 *pt,
+                        int tags_ecc);
+
+/* Only the tags part (no ECC for use with inband tags */
+void yaffs_pack_tags2_tags_only(struct yaffs_packed_tags2_tags_only *pt,
+                                const struct yaffs_ext_tags *t);
+void yaffs_unpack_tags2_tags_only(struct yaffs_ext_tags *t,
+                                  struct yaffs_packed_tags2_tags_only *pt);
+#endif
diff --git a/fs/yaffs2/yaffs_tagscompat.c b/fs/yaffs2/yaffs_tagscompat.c
new file mode 100644
index 00000000000..7578075d9ac
--- /dev/null
+++ b/fs/yaffs2/yaffs_tagscompat.c
@@ -0,0 +1,422 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_guts.h"
+#include "yaffs_tagscompat.h"
+#include "yaffs_ecc.h"
+#include "yaffs_getblockinfo.h"
+#include "yaffs_trace.h"
+
+static void yaffs_handle_rd_data_error(struct yaffs_dev *dev, int nand_chunk);
+
+
+/********** Tags ECC calculations  *********/
+
+void yaffs_calc_ecc(const u8 * data, struct yaffs_spare *spare)
+{
+        yaffs_ecc_cacl(data, spare->ecc1);
+        yaffs_ecc_cacl(&data[256], spare->ecc2);
+}
+
+void yaffs_calc_tags_ecc(struct yaffs_tags *tags)
+{
+        /* Calculate an ecc */
+
+        unsigned char *b = ((union yaffs_tags_union *)tags)->as_bytes;
+        unsigned i, j;
+        unsigned ecc = 0;
+        unsigned bit = 0;
+
+        tags->ecc = 0;
+
+        for (i = 0; i < 8; i++) {
+                for (j = 1; j & 0xff; j <<= 1) {
+                        bit++;
+                        if (b[i] & j)
+                                ecc ^= bit;
+                }
+        }
+
+        tags->ecc = ecc;
+
+}
+
+int yaffs_check_tags_ecc(struct yaffs_tags *tags)
+{
+        unsigned ecc = tags->ecc;
+
+        yaffs_calc_tags_ecc(tags);
+
+        ecc ^= tags->ecc;
+
+        if (ecc && ecc <= 64) {
+                /* TODO: Handle the failure better. Retire? */
+                unsigned char *b = ((union yaffs_tags_union *)tags)->as_bytes;
+
+                ecc--;
+
+                b[ecc / 8] ^= (1 << (ecc & 7));
+
+                /* Now recvalc the ecc */
+                yaffs_calc_tags_ecc(tags);
+
+                return 1;       /* recovered error */
+        } else if (ecc) {
+                /* Wierd ecc failure value */
+                /* TODO Need to do somethiong here */
+                return -1;      /* unrecovered error */
+        }
+
+        return 0;
+}
+
+/********** Tags **********/
+
+static void yaffs_load_tags_to_spare(struct yaffs_spare *spare_ptr,
+                                     struct yaffs_tags *tags_ptr)
+{
+        union yaffs_tags_union *tu = (union yaffs_tags_union *)tags_ptr;
+
+        yaffs_calc_tags_ecc(tags_ptr);
+
+        spare_ptr->tb0 = tu->as_bytes[0];
+        spare_ptr->tb1 = tu->as_bytes[1];
+        spare_ptr->tb2 = tu->as_bytes[2];
+        spare_ptr->tb3 = tu->as_bytes[3];
+        spare_ptr->tb4 = tu->as_bytes[4];
+        spare_ptr->tb5 = tu->as_bytes[5];
+        spare_ptr->tb6 = tu->as_bytes[6];
+        spare_ptr->tb7 = tu->as_bytes[7];
+}
+
+static void yaffs_get_tags_from_spare(struct yaffs_dev *dev,
+                                      struct yaffs_spare *spare_ptr,
+                                      struct yaffs_tags *tags_ptr)
+{
+        union yaffs_tags_union *tu = (union yaffs_tags_union *)tags_ptr;
+        int result;
+
+        tu->as_bytes[0] = spare_ptr->tb0;
+        tu->as_bytes[1] = spare_ptr->tb1;
+        tu->as_bytes[2] = spare_ptr->tb2;
+        tu->as_bytes[3] = spare_ptr->tb3;
+        tu->as_bytes[4] = spare_ptr->tb4;
+        tu->as_bytes[5] = spare_ptr->tb5;
+        tu->as_bytes[6] = spare_ptr->tb6;
+        tu->as_bytes[7] = spare_ptr->tb7;
+
+        result = yaffs_check_tags_ecc(tags_ptr);
+        if (result > 0)
+                dev->n_tags_ecc_fixed++;
+        else if (result < 0)
+                dev->n_tags_ecc_unfixed++;
+}
+
+static void yaffs_spare_init(struct yaffs_spare *spare)
+{
+        memset(spare, 0xFF, sizeof(struct yaffs_spare));
+}
+
+static int yaffs_wr_nand(struct yaffs_dev *dev,
+                         int nand_chunk, const u8 * data,
+                         struct yaffs_spare *spare)
+{
+        if (nand_chunk < dev->param.start_block * dev->param.chunks_per_block) {
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                        "**>> yaffs chunk %d is not valid",
+                        nand_chunk);
+                return YAFFS_FAIL;
+        }
+
+        return dev->param.write_chunk_fn(dev, nand_chunk, data, spare);
+}
+
+static int yaffs_rd_chunk_nand(struct yaffs_dev *dev,
+                               int nand_chunk,
+                               u8 * data,
+                               struct yaffs_spare *spare,
+                               enum yaffs_ecc_result *ecc_result,
+                               int correct_errors)
+{
+        int ret_val;
+        struct yaffs_spare local_spare;
+
+        if (!spare && data) {
+                /* If we don't have a real spare, then we use a local one. */
+                /* Need this for the calculation of the ecc */
+                spare = &local_spare;
+        }
+
+        if (!dev->param.use_nand_ecc) {
+                ret_val =
+                    dev->param.read_chunk_fn(dev, nand_chunk, data, spare);
+                if (data && correct_errors) {
+                        /* Do ECC correction */
+                        /* Todo handle any errors */
+                        int ecc_result1, ecc_result2;
+                        u8 calc_ecc[3];
+
+                        yaffs_ecc_cacl(data, calc_ecc);
+                        ecc_result1 =
+                            yaffs_ecc_correct(data, spare->ecc1, calc_ecc);
+                        yaffs_ecc_cacl(&data[256], calc_ecc);
+                        ecc_result2 =
+                            yaffs_ecc_correct(&data[256], spare->ecc2,
+                                              calc_ecc);
+
+                        if (ecc_result1 > 0) {
+                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                        "**>>yaffs ecc error fix performed on chunk %d:0",
+                                        nand_chunk);
+                                dev->n_ecc_fixed++;
+                        } else if (ecc_result1 < 0) {
+                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                        "**>>yaffs ecc error unfixed on chunk %d:0",
+                                        nand_chunk);
+                                dev->n_ecc_unfixed++;
+                        }
+
+                        if (ecc_result2 > 0) {
+                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                        "**>>yaffs ecc error fix performed on chunk %d:1",
+                                        nand_chunk);
+                                dev->n_ecc_fixed++;
+                        } else if (ecc_result2 < 0) {
+                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                        "**>>yaffs ecc error unfixed on chunk %d:1",
+                                        nand_chunk);
+                                dev->n_ecc_unfixed++;
+                        }
+
+                        if (ecc_result1 || ecc_result2) {
+                                /* We had a data problem on this page */
+                                yaffs_handle_rd_data_error(dev, nand_chunk);
+                        }
+
+                        if (ecc_result1 < 0 || ecc_result2 < 0)
+                                *ecc_result = YAFFS_ECC_RESULT_UNFIXED;
+                        else if (ecc_result1 > 0 || ecc_result2 > 0)
+                                *ecc_result = YAFFS_ECC_RESULT_FIXED;
+                        else
+                                *ecc_result = YAFFS_ECC_RESULT_NO_ERROR;
+                }
+        } else {
+                /* Must allocate enough memory for spare+2*sizeof(int) */
+                /* for ecc results from device. */
+                struct yaffs_nand_spare nspare;
+
+                memset(&nspare, 0, sizeof(nspare));
+
+                ret_val = dev->param.read_chunk_fn(dev, nand_chunk, data,
+                                                   (struct yaffs_spare *)
+                                                   &nspare);
+                memcpy(spare, &nspare, sizeof(struct yaffs_spare));
+                if (data && correct_errors) {
+                        if (nspare.eccres1 > 0) {
+                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                        "**>>mtd ecc error fix performed on chunk %d:0",
+                                        nand_chunk);
+                        } else if (nspare.eccres1 < 0) {
+                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                        "**>>mtd ecc error unfixed on chunk %d:0",
+                                        nand_chunk);
+                        }
+
+                        if (nspare.eccres2 > 0) {
+                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                        "**>>mtd ecc error fix performed on chunk %d:1",
+                                        nand_chunk);
+                        } else if (nspare.eccres2 < 0) {
+                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                        "**>>mtd ecc error unfixed on chunk %d:1",
+                                        nand_chunk);
+                        }
+
+                        if (nspare.eccres1 || nspare.eccres2) {
+                                /* We had a data problem on this page */
+                                yaffs_handle_rd_data_error(dev, nand_chunk);
+                        }
+
+                        if (nspare.eccres1 < 0 || nspare.eccres2 < 0)
+                                *ecc_result = YAFFS_ECC_RESULT_UNFIXED;
+                        else if (nspare.eccres1 > 0 || nspare.eccres2 > 0)
+                                *ecc_result = YAFFS_ECC_RESULT_FIXED;
+                        else
+                                *ecc_result = YAFFS_ECC_RESULT_NO_ERROR;
+
+                }
+        }
+        return ret_val;
+}
+
+/*
+ * Functions for robustisizing
+ */
+
+static void yaffs_handle_rd_data_error(struct yaffs_dev *dev, int nand_chunk)
+{
+        int flash_block = nand_chunk / dev->param.chunks_per_block;
+
+        /* Mark the block for retirement */
+        yaffs_get_block_info(dev,
+                             flash_block + dev->block_offset)->needs_retiring =
+            1;
+        yaffs_trace(YAFFS_TRACE_ERROR | YAFFS_TRACE_BAD_BLOCKS,
+                "**>>Block %d marked for retirement",
+                flash_block);
+
+        /* TODO:
+         * Just do a garbage collection on the affected block
+         * then retire the block
+         * NB recursion
+         */
+}
+
+int yaffs_tags_compat_wr(struct yaffs_dev *dev,
+                         int nand_chunk,
+                         const u8 * data, const struct yaffs_ext_tags *ext_tags)
+{
+        struct yaffs_spare spare;
+        struct yaffs_tags tags;
+
+        yaffs_spare_init(&spare);
+
+        if (ext_tags->is_deleted)
+                spare.page_status = 0;
+        else {
+                tags.obj_id = ext_tags->obj_id;
+                tags.chunk_id = ext_tags->chunk_id;
+
+                tags.n_bytes_lsb = ext_tags->n_bytes & 0x3ff;
+
+                if (dev->data_bytes_per_chunk >= 1024)
+                        tags.n_bytes_msb = (ext_tags->n_bytes >> 10) & 3;
+                else
+                        tags.n_bytes_msb = 3;
+
+                tags.serial_number = ext_tags->serial_number;
+
+                if (!dev->param.use_nand_ecc && data)
+                        yaffs_calc_ecc(data, &spare);
+
+                yaffs_load_tags_to_spare(&spare, &tags);
+
+        }
+
+        return yaffs_wr_nand(dev, nand_chunk, data, &spare);
+}
+
+int yaffs_tags_compat_rd(struct yaffs_dev *dev,
+                         int nand_chunk,
+                         u8 * data, struct yaffs_ext_tags *ext_tags)
+{
+
+        struct yaffs_spare spare;
+        struct yaffs_tags tags;
+        enum yaffs_ecc_result ecc_result = YAFFS_ECC_RESULT_UNKNOWN;
+
+        static struct yaffs_spare spare_ff;
+        static int init;
+
+        if (!init) {
+                memset(&spare_ff, 0xFF, sizeof(spare_ff));
+                init = 1;
+        }
+
+        if (yaffs_rd_chunk_nand(dev, nand_chunk, data, &spare, &ecc_result, 1)) {
+                /* ext_tags may be NULL */
+                if (ext_tags) {
+
+                        int deleted =
+                            (hweight8(spare.page_status) < 7) ? 1 : 0;
+
+                        ext_tags->is_deleted = deleted;
+                        ext_tags->ecc_result = ecc_result;
+                        ext_tags->block_bad = 0;        /* We're reading it */
+                        /* therefore it is not a bad block */
+                        ext_tags->chunk_used =
+                            (memcmp(&spare_ff, &spare, sizeof(spare_ff)) !=
+                             0) ? 1 : 0;
+
+                        if (ext_tags->chunk_used) {
+                                yaffs_get_tags_from_spare(dev, &spare, &tags);
+
+                                ext_tags->obj_id = tags.obj_id;
+                                ext_tags->chunk_id = tags.chunk_id;
+                                ext_tags->n_bytes = tags.n_bytes_lsb;
+
+                                if (dev->data_bytes_per_chunk >= 1024)
+                                        ext_tags->n_bytes |=
+                                            (((unsigned)tags.
+                                              n_bytes_msb) << 10);
+
+                                ext_tags->serial_number = tags.serial_number;
+                        }
+                }
+
+                return YAFFS_OK;
+        } else {
+                return YAFFS_FAIL;
+        }
+}
+
+int yaffs_tags_compat_mark_bad(struct yaffs_dev *dev, int flash_block)
+{
+
+        struct yaffs_spare spare;
+
+        memset(&spare, 0xff, sizeof(struct yaffs_spare));
+
+        spare.block_status = 'Y';
+
+        yaffs_wr_nand(dev, flash_block * dev->param.chunks_per_block, NULL,
+                      &spare);
+        yaffs_wr_nand(dev, flash_block * dev->param.chunks_per_block + 1,
+                      NULL, &spare);
+
+        return YAFFS_OK;
+
+}
+
+int yaffs_tags_compat_query_block(struct yaffs_dev *dev,
+                                  int block_no,
+                                  enum yaffs_block_state *state,
+                                  u32 * seq_number)
+{
+
+        struct yaffs_spare spare0, spare1;
+        static struct yaffs_spare spare_ff;
+        static int init;
+        enum yaffs_ecc_result dummy;
+
+        if (!init) {
+                memset(&spare_ff, 0xFF, sizeof(spare_ff));
+                init = 1;
+        }
+
+        *seq_number = 0;
+
+        yaffs_rd_chunk_nand(dev, block_no * dev->param.chunks_per_block, NULL,
+                            &spare0, &dummy, 1);
+        yaffs_rd_chunk_nand(dev, block_no * dev->param.chunks_per_block + 1,
+                            NULL, &spare1, &dummy, 1);
+
+        if (hweight8(spare0.block_status & spare1.block_status) < 7)
+                *state = YAFFS_BLOCK_STATE_DEAD;
+        else if (memcmp(&spare_ff, &spare0, sizeof(spare_ff)) == 0)
+                *state = YAFFS_BLOCK_STATE_EMPTY;
+        else
+                *state = YAFFS_BLOCK_STATE_NEEDS_SCANNING;
+
+        return YAFFS_OK;
+}
diff --git a/fs/yaffs2/yaffs_tagscompat.h b/fs/yaffs2/yaffs_tagscompat.h
new file mode 100644
index 00000000000..8cd35dcd3ca
--- /dev/null
+++ b/fs/yaffs2/yaffs_tagscompat.h
@@ -0,0 +1,36 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_TAGSCOMPAT_H__
+#define __YAFFS_TAGSCOMPAT_H__
+
+#include "yaffs_guts.h"
+int yaffs_tags_compat_wr(struct yaffs_dev *dev,
+                         int nand_chunk,
+                         const u8 * data, const struct yaffs_ext_tags *tags);
+int yaffs_tags_compat_rd(struct yaffs_dev *dev,
+                         int nand_chunk,
+                         u8 * data, struct yaffs_ext_tags *tags);
+int yaffs_tags_compat_mark_bad(struct yaffs_dev *dev, int block_no);
+int yaffs_tags_compat_query_block(struct yaffs_dev *dev,
+                                  int block_no,
+                                  enum yaffs_block_state *state,
+                                  u32 * seq_number);
+
+void yaffs_calc_tags_ecc(struct yaffs_tags *tags);
+int yaffs_check_tags_ecc(struct yaffs_tags *tags);
+int yaffs_count_bits(u8 byte);
+
+#endif
diff --git a/fs/yaffs2/yaffs_tagsvalidity.c b/fs/yaffs2/yaffs_tagsvalidity.c
new file mode 100644
index 00000000000..4358d79d4be
--- /dev/null
+++ b/fs/yaffs2/yaffs_tagsvalidity.c
@@ -0,0 +1,27 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_tagsvalidity.h"
+
+void yaffs_init_tags(struct yaffs_ext_tags *tags)
+{
+        memset(tags, 0, sizeof(struct yaffs_ext_tags));
+        tags->validity0 = 0xAAAAAAAA;
+        tags->validity1 = 0x55555555;
+}
+
+int yaffs_validate_tags(struct yaffs_ext_tags *tags)
+{
+        return (tags->validity0 == 0xAAAAAAAA && tags->validity1 == 0x55555555);
+
+}
diff --git a/fs/yaffs2/yaffs_tagsvalidity.h b/fs/yaffs2/yaffs_tagsvalidity.h
new file mode 100644
index 00000000000..36a021fc8fa
--- /dev/null
+++ b/fs/yaffs2/yaffs_tagsvalidity.h
@@ -0,0 +1,23 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_TAGS_VALIDITY_H__
+#define __YAFFS_TAGS_VALIDITY_H__
+
+#include "yaffs_guts.h"
+
+void yaffs_init_tags(struct yaffs_ext_tags *tags);
+int yaffs_validate_tags(struct yaffs_ext_tags *tags);
+#endif
diff --git a/fs/yaffs2/yaffs_trace.h b/fs/yaffs2/yaffs_trace.h
new file mode 100644
index 00000000000..6273dbf9f63
--- /dev/null
+++ b/fs/yaffs2/yaffs_trace.h
@@ -0,0 +1,57 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YTRACE_H__
+#define __YTRACE_H__
+
+extern unsigned int yaffs_trace_mask;
+extern unsigned int yaffs_wr_attempts;
+
+/*
+ * Tracing flags.
+ * The flags masked in YAFFS_TRACE_ALWAYS are always traced.
+ */
+
+#define YAFFS_TRACE_OS                  0x00000002
+#define YAFFS_TRACE_ALLOCATE            0x00000004
+#define YAFFS_TRACE_SCAN                0x00000008
+#define YAFFS_TRACE_BAD_BLOCKS          0x00000010
+#define YAFFS_TRACE_ERASE               0x00000020
+#define YAFFS_TRACE_GC                  0x00000040
+#define YAFFS_TRACE_WRITE               0x00000080
+#define YAFFS_TRACE_TRACING             0x00000100
+#define YAFFS_TRACE_DELETION            0x00000200
+#define YAFFS_TRACE_BUFFERS             0x00000400
+#define YAFFS_TRACE_NANDACCESS          0x00000800
+#define YAFFS_TRACE_GC_DETAIL           0x00001000
+#define YAFFS_TRACE_SCAN_DEBUG          0x00002000
+#define YAFFS_TRACE_MTD                 0x00004000
+#define YAFFS_TRACE_CHECKPOINT          0x00008000
+
+#define YAFFS_TRACE_VERIFY              0x00010000
+#define YAFFS_TRACE_VERIFY_NAND         0x00020000
+#define YAFFS_TRACE_VERIFY_FULL         0x00040000
+#define YAFFS_TRACE_VERIFY_ALL          0x000F0000
+
+#define YAFFS_TRACE_SYNC                0x00100000
+#define YAFFS_TRACE_BACKGROUND          0x00200000
+#define YAFFS_TRACE_LOCK                0x00400000
+#define YAFFS_TRACE_MOUNT               0x00800000
+
+#define YAFFS_TRACE_ERROR               0x40000000
+#define YAFFS_TRACE_BUG                 0x80000000
+#define YAFFS_TRACE_ALWAYS              0xF0000000
+
+#endif
diff --git a/fs/yaffs2/yaffs_verify.c b/fs/yaffs2/yaffs_verify.c
new file mode 100644
index 00000000000..738c7f69a5e
--- /dev/null
+++ b/fs/yaffs2/yaffs_verify.c
@@ -0,0 +1,535 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_verify.h"
+#include "yaffs_trace.h"
+#include "yaffs_bitmap.h"
+#include "yaffs_getblockinfo.h"
+#include "yaffs_nand.h"
+
+int yaffs_skip_verification(struct yaffs_dev *dev)
+{
+        dev = dev;
+        return !(yaffs_trace_mask &
+                 (YAFFS_TRACE_VERIFY | YAFFS_TRACE_VERIFY_FULL));
+}
+
+static int yaffs_skip_full_verification(struct yaffs_dev *dev)
+{
+        dev = dev;
+        return !(yaffs_trace_mask & (YAFFS_TRACE_VERIFY_FULL));
+}
+
+static int yaffs_skip_nand_verification(struct yaffs_dev *dev)
+{
+        dev = dev;
+        return !(yaffs_trace_mask & (YAFFS_TRACE_VERIFY_NAND));
+}
+
+static const char *block_state_name[] = {
+        "Unknown",
+        "Needs scanning",
+        "Scanning",
+        "Empty",
+        "Allocating",
+        "Full",
+        "Dirty",
+        "Checkpoint",
+        "Collecting",
+        "Dead"
+};
+
+void yaffs_verify_blk(struct yaffs_dev *dev, struct yaffs_block_info *bi, int n)
+{
+        int actually_used;
+        int in_use;
+
+        if (yaffs_skip_verification(dev))
+                return;
+
+        /* Report illegal runtime states */
+        if (bi->block_state >= YAFFS_NUMBER_OF_BLOCK_STATES)
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Block %d has undefined state %d",
+                        n, bi->block_state);
+
+        switch (bi->block_state) {
+        case YAFFS_BLOCK_STATE_UNKNOWN:
+        case YAFFS_BLOCK_STATE_SCANNING:
+        case YAFFS_BLOCK_STATE_NEEDS_SCANNING:
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Block %d has bad run-state %s",
+                        n, block_state_name[bi->block_state]);
+        }
+
+        /* Check pages in use and soft deletions are legal */
+
+        actually_used = bi->pages_in_use - bi->soft_del_pages;
+
+        if (bi->pages_in_use < 0
+            || bi->pages_in_use > dev->param.chunks_per_block
+            || bi->soft_del_pages < 0
+            || bi->soft_del_pages > dev->param.chunks_per_block
+            || actually_used < 0 || actually_used > dev->param.chunks_per_block)
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Block %d has illegal values pages_in_used %d soft_del_pages %d",
+                        n, bi->pages_in_use, bi->soft_del_pages);
+
+        /* Check chunk bitmap legal */
+        in_use = yaffs_count_chunk_bits(dev, n);
+        if (in_use != bi->pages_in_use)
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Block %d has inconsistent values pages_in_use %d counted chunk bits %d",
+                        n, bi->pages_in_use, in_use);
+
+}
+
+void yaffs_verify_collected_blk(struct yaffs_dev *dev,
+                                struct yaffs_block_info *bi, int n)
+{
+        yaffs_verify_blk(dev, bi, n);
+
+        /* After collection the block should be in the erased state */
+
+        if (bi->block_state != YAFFS_BLOCK_STATE_COLLECTING &&
+            bi->block_state != YAFFS_BLOCK_STATE_EMPTY) {
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                        "Block %d is in state %d after gc, should be erased",
+                        n, bi->block_state);
+        }
+}
+
+void yaffs_verify_blocks(struct yaffs_dev *dev)
+{
+        int i;
+        int state_count[YAFFS_NUMBER_OF_BLOCK_STATES];
+        int illegal_states = 0;
+
+        if (yaffs_skip_verification(dev))
+                return;
+
+        memset(state_count, 0, sizeof(state_count));
+
+        for (i = dev->internal_start_block; i <= dev->internal_end_block; i++) {
+                struct yaffs_block_info *bi = yaffs_get_block_info(dev, i);
+                yaffs_verify_blk(dev, bi, i);
+
+                if (bi->block_state < YAFFS_NUMBER_OF_BLOCK_STATES)
+                        state_count[bi->block_state]++;
+                else
+                        illegal_states++;
+        }
+
+        yaffs_trace(YAFFS_TRACE_VERIFY, "Block summary");
+
+        yaffs_trace(YAFFS_TRACE_VERIFY,
+                "%d blocks have illegal states",
+                illegal_states);
+        if (state_count[YAFFS_BLOCK_STATE_ALLOCATING] > 1)
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Too many allocating blocks");
+
+        for (i = 0; i < YAFFS_NUMBER_OF_BLOCK_STATES; i++)
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "%s %d blocks",
+                        block_state_name[i], state_count[i]);
+
+        if (dev->blocks_in_checkpt != state_count[YAFFS_BLOCK_STATE_CHECKPOINT])
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Checkpoint block count wrong dev %d count %d",
+                        dev->blocks_in_checkpt,
+                        state_count[YAFFS_BLOCK_STATE_CHECKPOINT]);
+
+        if (dev->n_erased_blocks != state_count[YAFFS_BLOCK_STATE_EMPTY])
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Erased block count wrong dev %d count %d",
+                        dev->n_erased_blocks,
+                        state_count[YAFFS_BLOCK_STATE_EMPTY]);
+
+        if (state_count[YAFFS_BLOCK_STATE_COLLECTING] > 1)
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Too many collecting blocks %d (max is 1)",
+                        state_count[YAFFS_BLOCK_STATE_COLLECTING]);
+}
+
+/*
+ * Verify the object header. oh must be valid, but obj and tags may be NULL in which
+ * case those tests will not be performed.
+ */
+void yaffs_verify_oh(struct yaffs_obj *obj, struct yaffs_obj_hdr *oh,
+                     struct yaffs_ext_tags *tags, int parent_check)
+{
+        if (obj && yaffs_skip_verification(obj->my_dev))
+                return;
+
+        if (!(tags && obj && oh)) {
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Verifying object header tags %p obj %p oh %p",
+                        tags, obj, oh);
+                return;
+        }
+
+        if (oh->type <= YAFFS_OBJECT_TYPE_UNKNOWN ||
+            oh->type > YAFFS_OBJECT_TYPE_MAX)
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Obj %d header type is illegal value 0x%x",
+                        tags->obj_id, oh->type);
+
+        if (tags->obj_id != obj->obj_id)
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Obj %d header mismatch obj_id %d",
+                        tags->obj_id, obj->obj_id);
+
+        /*
+         * Check that the object's parent ids match if parent_check requested.
+         *
+         * Tests do not apply to the root object.
+         */
+
+        if (parent_check && tags->obj_id > 1 && !obj->parent)
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Obj %d header mismatch parent_id %d obj->parent is NULL",
+                        tags->obj_id, oh->parent_obj_id);
+
+        if (parent_check && obj->parent &&
+            oh->parent_obj_id != obj->parent->obj_id &&
+            (oh->parent_obj_id != YAFFS_OBJECTID_UNLINKED ||
+             obj->parent->obj_id != YAFFS_OBJECTID_DELETED))
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Obj %d header mismatch parent_id %d parent_obj_id %d",
+                        tags->obj_id, oh->parent_obj_id,
+                        obj->parent->obj_id);
+
+        if (tags->obj_id > 1 && oh->name[0] == 0)       /* Null name */
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Obj %d header name is NULL",
+                        obj->obj_id);
+
+        if (tags->obj_id > 1 && ((u8) (oh->name[0])) == 0xff)   /* Trashed name */
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Obj %d header name is 0xFF",
+                        obj->obj_id);
+}
+
+void yaffs_verify_file(struct yaffs_obj *obj)
+{
+        int required_depth;
+        int actual_depth;
+        u32 last_chunk;
+        u32 x;
+        u32 i;
+        struct yaffs_dev *dev;
+        struct yaffs_ext_tags tags;
+        struct yaffs_tnode *tn;
+        u32 obj_id;
+
+        if (!obj)
+                return;
+
+        if (yaffs_skip_verification(obj->my_dev))
+                return;
+
+        dev = obj->my_dev;
+        obj_id = obj->obj_id;
+
+        /* Check file size is consistent with tnode depth */
+        last_chunk =
+            obj->variant.file_variant.file_size / dev->data_bytes_per_chunk + 1;
+        x = last_chunk >> YAFFS_TNODES_LEVEL0_BITS;
+        required_depth = 0;
+        while (x > 0) {
+                x >>= YAFFS_TNODES_INTERNAL_BITS;
+                required_depth++;
+        }
+
+        actual_depth = obj->variant.file_variant.top_level;
+
+        /* Check that the chunks in the tnode tree are all correct.
+         * We do this by scanning through the tnode tree and
+         * checking the tags for every chunk match.
+         */
+
+        if (yaffs_skip_nand_verification(dev))
+                return;
+
+        for (i = 1; i <= last_chunk; i++) {
+                tn = yaffs_find_tnode_0(dev, &obj->variant.file_variant, i);
+
+                if (tn) {
+                        u32 the_chunk = yaffs_get_group_base(dev, tn, i);
+                        if (the_chunk > 0) {
+                                yaffs_rd_chunk_tags_nand(dev, the_chunk, NULL,
+                                                         &tags);
+                                if (tags.obj_id != obj_id || tags.chunk_id != i)
+                                yaffs_trace(YAFFS_TRACE_VERIFY,
+                                        "Object %d chunk_id %d NAND mismatch chunk %d tags (%d:%d)",
+                                         obj_id, i, the_chunk,
+                                         tags.obj_id, tags.chunk_id);
+                        }
+                }
+        }
+}
+
+void yaffs_verify_link(struct yaffs_obj *obj)
+{
+        if (obj && yaffs_skip_verification(obj->my_dev))
+                return;
+
+        /* Verify sane equivalent object */
+}
+
+void yaffs_verify_symlink(struct yaffs_obj *obj)
+{
+        if (obj && yaffs_skip_verification(obj->my_dev))
+                return;
+
+        /* Verify symlink string */
+}
+
+void yaffs_verify_special(struct yaffs_obj *obj)
+{
+        if (obj && yaffs_skip_verification(obj->my_dev))
+                return;
+}
+
+void yaffs_verify_obj(struct yaffs_obj *obj)
+{
+        struct yaffs_dev *dev;
+
+        u32 chunk_min;
+        u32 chunk_max;
+
+        u32 chunk_id_ok;
+        u32 chunk_in_range;
+        u32 chunk_wrongly_deleted;
+        u32 chunk_valid;
+
+        if (!obj)
+                return;
+
+        if (obj->being_created)
+                return;
+
+        dev = obj->my_dev;
+
+        if (yaffs_skip_verification(dev))
+                return;
+
+        /* Check sane object header chunk */
+
+        chunk_min = dev->internal_start_block * dev->param.chunks_per_block;
+        chunk_max =
+            (dev->internal_end_block + 1) * dev->param.chunks_per_block - 1;
+
+        chunk_in_range = (((unsigned)(obj->hdr_chunk)) >= chunk_min &&
+                          ((unsigned)(obj->hdr_chunk)) <= chunk_max);
+        chunk_id_ok = chunk_in_range || (obj->hdr_chunk == 0);
+        chunk_valid = chunk_in_range &&
+            yaffs_check_chunk_bit(dev,
+                                  obj->hdr_chunk / dev->param.chunks_per_block,
+                                  obj->hdr_chunk % dev->param.chunks_per_block);
+        chunk_wrongly_deleted = chunk_in_range && !chunk_valid;
+
+        if (!obj->fake && (!chunk_id_ok || chunk_wrongly_deleted))
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Obj %d has chunk_id %d %s %s",
+                        obj->obj_id, obj->hdr_chunk,
+                        chunk_id_ok ? "" : ",out of range",
+                        chunk_wrongly_deleted ? ",marked as deleted" : "");
+
+        if (chunk_valid && !yaffs_skip_nand_verification(dev)) {
+                struct yaffs_ext_tags tags;
+                struct yaffs_obj_hdr *oh;
+                u8 *buffer = yaffs_get_temp_buffer(dev, __LINE__);
+
+                oh = (struct yaffs_obj_hdr *)buffer;
+
+                yaffs_rd_chunk_tags_nand(dev, obj->hdr_chunk, buffer, &tags);
+
+                yaffs_verify_oh(obj, oh, &tags, 1);
+
+                yaffs_release_temp_buffer(dev, buffer, __LINE__);
+        }
+
+        /* Verify it has a parent */
+        if (obj && !obj->fake && (!obj->parent || obj->parent->my_dev != dev)) {
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Obj %d has parent pointer %p which does not look like an object",
+                        obj->obj_id, obj->parent);
+        }
+
+        /* Verify parent is a directory */
+        if (obj->parent
+            && obj->parent->variant_type != YAFFS_OBJECT_TYPE_DIRECTORY) {
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Obj %d's parent is not a directory (type %d)",
+                        obj->obj_id, obj->parent->variant_type);
+        }
+
+        switch (obj->variant_type) {
+        case YAFFS_OBJECT_TYPE_FILE:
+                yaffs_verify_file(obj);
+                break;
+        case YAFFS_OBJECT_TYPE_SYMLINK:
+                yaffs_verify_symlink(obj);
+                break;
+        case YAFFS_OBJECT_TYPE_DIRECTORY:
+                yaffs_verify_dir(obj);
+                break;
+        case YAFFS_OBJECT_TYPE_HARDLINK:
+                yaffs_verify_link(obj);
+                break;
+        case YAFFS_OBJECT_TYPE_SPECIAL:
+                yaffs_verify_special(obj);
+                break;
+        case YAFFS_OBJECT_TYPE_UNKNOWN:
+        default:
+                yaffs_trace(YAFFS_TRACE_VERIFY,
+                        "Obj %d has illegaltype %d",
+                   obj->obj_id, obj->variant_type);
+                break;
+        }
+}
+
+void yaffs_verify_objects(struct yaffs_dev *dev)
+{
+        struct yaffs_obj *obj;
+        int i;
+        struct list_head *lh;
+
+        if (yaffs_skip_verification(dev))
+                return;
+
+        /* Iterate through the objects in each hash entry */
+
+        for (i = 0; i < YAFFS_NOBJECT_BUCKETS; i++) {
+                list_for_each(lh, &dev->obj_bucket[i].list) {
+                        if (lh) {
+                                obj =
+                                    list_entry(lh, struct yaffs_obj, hash_link);
+                                yaffs_verify_obj(obj);
+                        }
+                }
+        }
+}
+
+void yaffs_verify_obj_in_dir(struct yaffs_obj *obj)
+{
+        struct list_head *lh;
+        struct yaffs_obj *list_obj;
+
+        int count = 0;
+
+        if (!obj) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS, "No object to verify");
+                YBUG();
+                return;
+        }
+
+        if (yaffs_skip_verification(obj->my_dev))
+                return;
+
+        if (!obj->parent) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS, "Object does not have parent" );
+                YBUG();
+                return;
+        }
+
+        if (obj->parent->variant_type != YAFFS_OBJECT_TYPE_DIRECTORY) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS, "Parent is not directory");
+                YBUG();
+        }
+
+        /* Iterate through the objects in each hash entry */
+
+        list_for_each(lh, &obj->parent->variant.dir_variant.children) {
+                if (lh) {
+                        list_obj = list_entry(lh, struct yaffs_obj, siblings);
+                        yaffs_verify_obj(list_obj);
+                        if (obj == list_obj)
+                                count++;
+                }
+        }
+
+        if (count != 1) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "Object in directory %d times",
+                        count);
+                YBUG();
+        }
+}
+
+void yaffs_verify_dir(struct yaffs_obj *directory)
+{
+        struct list_head *lh;
+        struct yaffs_obj *list_obj;
+
+        if (!directory) {
+                YBUG();
+                return;
+        }
+
+        if (yaffs_skip_full_verification(directory->my_dev))
+                return;
+
+        if (directory->variant_type != YAFFS_OBJECT_TYPE_DIRECTORY) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "Directory has wrong type: %d",
+                        directory->variant_type);
+                YBUG();
+        }
+
+        /* Iterate through the objects in each hash entry */
+
+        list_for_each(lh, &directory->variant.dir_variant.children) {
+                if (lh) {
+                        list_obj = list_entry(lh, struct yaffs_obj, siblings);
+                        if (list_obj->parent != directory) {
+                                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                                        "Object in directory list has wrong parent %p",
+                                        list_obj->parent);
+                                YBUG();
+                        }
+                        yaffs_verify_obj_in_dir(list_obj);
+                }
+        }
+}
+
+static int yaffs_free_verification_failures;
+
+void yaffs_verify_free_chunks(struct yaffs_dev *dev)
+{
+        int counted;
+        int difference;
+
+        if (yaffs_skip_verification(dev))
+                return;
+
+        counted = yaffs_count_free_chunks(dev);
+
+        difference = dev->n_free_chunks - counted;
+
+        if (difference) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "Freechunks verification failure %d %d %d",
+                        dev->n_free_chunks, counted, difference);
+                yaffs_free_verification_failures++;
+        }
+}
+
+int yaffs_verify_file_sane(struct yaffs_obj *in)
+{
+        in = in;
+        return YAFFS_OK;
+}
+
diff --git a/fs/yaffs2/yaffs_verify.h b/fs/yaffs2/yaffs_verify.h
new file mode 100644
index 00000000000..cc6f8899930
--- /dev/null
+++ b/fs/yaffs2/yaffs_verify.h
@@ -0,0 +1,43 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_VERIFY_H__
+#define __YAFFS_VERIFY_H__
+
+#include "yaffs_guts.h"
+
+void yaffs_verify_blk(struct yaffs_dev *dev, struct yaffs_block_info *bi,
+                      int n);
+void yaffs_verify_collected_blk(struct yaffs_dev *dev,
+                                struct yaffs_block_info *bi, int n);
+void yaffs_verify_blocks(struct yaffs_dev *dev);
+
+void yaffs_verify_oh(struct yaffs_obj *obj, struct yaffs_obj_hdr *oh,
+                     struct yaffs_ext_tags *tags, int parent_check);
+void yaffs_verify_file(struct yaffs_obj *obj);
+void yaffs_verify_link(struct yaffs_obj *obj);
+void yaffs_verify_symlink(struct yaffs_obj *obj);
+void yaffs_verify_special(struct yaffs_obj *obj);
+void yaffs_verify_obj(struct yaffs_obj *obj);
+void yaffs_verify_objects(struct yaffs_dev *dev);
+void yaffs_verify_obj_in_dir(struct yaffs_obj *obj);
+void yaffs_verify_dir(struct yaffs_obj *directory);
+void yaffs_verify_free_chunks(struct yaffs_dev *dev);
+
+int yaffs_verify_file_sane(struct yaffs_obj *obj);
+
+int yaffs_skip_verification(struct yaffs_dev *dev);
+
+#endif
diff --git a/fs/yaffs2/yaffs_vfs.c b/fs/yaffs2/yaffs_vfs.c
new file mode 100644
index 00000000000..d5b87531400
--- /dev/null
+++ b/fs/yaffs2/yaffs_vfs.c
@@ -0,0 +1,2792 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ * Acknowledgements:
+ * Luc van OostenRyck for numerous patches.
+ * Nick Bane for numerous patches.
+ * Nick Bane for 2.5/2.6 integration.
+ * Andras Toth for mknod rdev issue.
+ * Michael Fischer for finding the problem with inode inconsistency.
+ * Some code bodily lifted from JFFS
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ *
+ * This is the file system front-end to YAFFS that hooks it up to
+ * the VFS.
+ *
+ * Special notes:
+ * >> 2.4: sb->u.generic_sbp points to the struct yaffs_dev associated with
+ *         this superblock
+ * >> 2.6: sb->s_fs_info  points to the struct yaffs_dev associated with this
+ *         superblock
+ * >> inode->u.generic_ip points to the associated struct yaffs_obj.
+ */
+
+/*
+ * NB There are two variants of Linux VFS glue code. This variant supports
+ * a single version and should not include any multi-version code.
+ */
+#include <linux/version.h>
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/fs.h>
+#include <linux/proc_fs.h>
+#include <linux/smp_lock.h>
+#include <linux/pagemap.h>
+#include <linux/mtd/mtd.h>
+#include <linux/interrupt.h>
+#include <linux/string.h>
+#include <linux/ctype.h>
+#include <linux/namei.h>
+#include <linux/exportfs.h>
+#include <linux/kthread.h>
+#include <linux/delay.h>
+#include <linux/freezer.h>
+
+#include <asm/div64.h>
+
+#include <linux/statfs.h>
+
+#define UnlockPage(p) unlock_page(p)
+#define Page_Uptodate(page)     test_bit(PG_uptodate, &(page)->flags)
+
+#define yaffs_devname(sb, buf)  bdevname(sb->s_bdev, buf)
+
+#define YPROC_ROOT  NULL
+
+#define Y_INIT_TIMER(a) init_timer_on_stack(a)
+
+#define WRITE_SIZE_STR "writesize"
+#define WRITE_SIZE(mtd) ((mtd)->writesize)
+
+static uint32_t YCALCBLOCKS(uint64_t partition_size, uint32_t block_size)
+{
+        uint64_t result = partition_size;
+        do_div(result, block_size);
+        return (uint32_t) result;
+}
+
+#include <linux/uaccess.h>
+#include <linux/mtd/mtd.h>
+
+#include "yportenv.h"
+#include "yaffs_trace.h"
+#include "yaffs_guts.h"
+#include "yaffs_attribs.h"
+
+#include "yaffs_linux.h"
+
+#include "yaffs_mtdif.h"
+#include "yaffs_mtdif1.h"
+#include "yaffs_mtdif2.h"
+
+unsigned int yaffs_trace_mask = YAFFS_TRACE_BAD_BLOCKS | YAFFS_TRACE_ALWAYS;
+unsigned int yaffs_wr_attempts = YAFFS_WR_ATTEMPTS;
+unsigned int yaffs_auto_checkpoint = 1;
+unsigned int yaffs_gc_control = 1;
+unsigned int yaffs_bg_enable = 1;
+
+/* Module Parameters */
+module_param(yaffs_trace_mask, uint, 0644);
+module_param(yaffs_wr_attempts, uint, 0644);
+module_param(yaffs_auto_checkpoint, uint, 0644);
+module_param(yaffs_gc_control, uint, 0644);
+module_param(yaffs_bg_enable, uint, 0644);
+
+
+#define yaffs_inode_to_obj_lv(iptr) ((iptr)->i_private)
+#define yaffs_inode_to_obj(iptr) ((struct yaffs_obj *)(yaffs_inode_to_obj_lv(iptr)))
+#define yaffs_dentry_to_obj(dptr) yaffs_inode_to_obj((dptr)->d_inode)
+#define yaffs_super_to_dev(sb)  ((struct yaffs_dev *)sb->s_fs_info)
+
+#define update_dir_time(dir) do {\
+                        (dir)->i_ctime = (dir)->i_mtime = CURRENT_TIME; \
+                } while(0)
+
+
+static unsigned yaffs_gc_control_callback(struct yaffs_dev *dev)
+{
+        return yaffs_gc_control;
+}
+
+static void yaffs_gross_lock(struct yaffs_dev *dev)
+{
+        yaffs_trace(YAFFS_TRACE_LOCK, "yaffs locking %p", current);
+        mutex_lock(&(yaffs_dev_to_lc(dev)->gross_lock));
+        yaffs_trace(YAFFS_TRACE_LOCK, "yaffs locked %p", current);
+}
+
+static void yaffs_gross_unlock(struct yaffs_dev *dev)
+{
+        yaffs_trace(YAFFS_TRACE_LOCK, "yaffs unlocking %p", current);
+        mutex_unlock(&(yaffs_dev_to_lc(dev)->gross_lock));
+}
+
+static void yaffs_fill_inode_from_obj(struct inode *inode,
+                                      struct yaffs_obj *obj);
+
+static struct inode *yaffs_iget(struct super_block *sb, unsigned long ino)
+{
+        struct inode *inode;
+        struct yaffs_obj *obj;
+        struct yaffs_dev *dev = yaffs_super_to_dev(sb);
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_iget for %lu", ino);
+
+        inode = iget_locked(sb, ino);
+        if (!inode)
+                return ERR_PTR(-ENOMEM);
+        if (!(inode->i_state & I_NEW))
+                return inode;
+
+        /* NB This is called as a side effect of other functions, but
+         * we had to release the lock to prevent deadlocks, so
+         * need to lock again.
+         */
+
+        yaffs_gross_lock(dev);
+
+        obj = yaffs_find_by_number(dev, inode->i_ino);
+
+        yaffs_fill_inode_from_obj(inode, obj);
+
+        yaffs_gross_unlock(dev);
+
+        unlock_new_inode(inode);
+        return inode;
+}
+
+struct inode *yaffs_get_inode(struct super_block *sb, int mode, int dev,
+                              struct yaffs_obj *obj)
+{
+        struct inode *inode;
+
+        if (!sb) {
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_get_inode for NULL super_block!!");
+                return NULL;
+
+        }
+
+        if (!obj) {
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_get_inode for NULL object!!");
+                return NULL;
+
+        }
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_get_inode for object %d",
+                obj->obj_id);
+
+        inode = yaffs_iget(sb, obj->obj_id);
+        if (IS_ERR(inode))
+                return NULL;
+
+        /* NB Side effect: iget calls back to yaffs_read_inode(). */
+        /* iget also increments the inode's i_count */
+        /* NB You can't be holding gross_lock or deadlock will happen! */
+
+        return inode;
+}
+
+static int yaffs_mknod(struct inode *dir, struct dentry *dentry, int mode,
+                       dev_t rdev)
+{
+        struct inode *inode;
+
+        struct yaffs_obj *obj = NULL;
+        struct yaffs_dev *dev;
+
+        struct yaffs_obj *parent = yaffs_inode_to_obj(dir);
+
+        int error = -ENOSPC;
+        uid_t uid = current->cred->fsuid;
+        gid_t gid =
+            (dir->i_mode & S_ISGID) ? dir->i_gid : current->cred->fsgid;
+
+        if ((dir->i_mode & S_ISGID) && S_ISDIR(mode))
+                mode |= S_ISGID;
+
+        if (parent) {
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_mknod: parent object %d type %d",
+                        parent->obj_id, parent->variant_type);
+        } else {
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_mknod: could not get parent object");
+                return -EPERM;
+        }
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_mknod: making oject for %s, mode %x dev %x",
+                dentry->d_name.name, mode, rdev);
+
+        dev = parent->my_dev;
+
+        yaffs_gross_lock(dev);
+
+        switch (mode & S_IFMT) {
+        default:
+                /* Special (socket, fifo, device...) */
+                yaffs_trace(YAFFS_TRACE_OS, "yaffs_mknod: making special");
+                obj =
+                    yaffs_create_special(parent, dentry->d_name.name, mode, uid,
+                                         gid, old_encode_dev(rdev));
+                break;
+        case S_IFREG:           /* file          */
+                yaffs_trace(YAFFS_TRACE_OS, "yaffs_mknod: making file");
+                obj = yaffs_create_file(parent, dentry->d_name.name, mode, uid,
+                                        gid);
+                break;
+        case S_IFDIR:           /* directory */
+                yaffs_trace(YAFFS_TRACE_OS, "yaffs_mknod: making directory");
+                obj = yaffs_create_dir(parent, dentry->d_name.name, mode,
+                                       uid, gid);
+                break;
+        case S_IFLNK:           /* symlink */
+                yaffs_trace(YAFFS_TRACE_OS, "yaffs_mknod: making symlink");
+                obj = NULL;     /* Do we ever get here? */
+                break;
+        }
+
+        /* Can not call yaffs_get_inode() with gross lock held */
+        yaffs_gross_unlock(dev);
+
+        if (obj) {
+                inode = yaffs_get_inode(dir->i_sb, mode, rdev, obj);
+                d_instantiate(dentry, inode);
+                update_dir_time(dir);
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_mknod created object %d count = %d",
+                        obj->obj_id, atomic_read(&inode->i_count));
+                error = 0;
+                yaffs_fill_inode_from_obj(dir, parent);
+        } else {
+                yaffs_trace(YAFFS_TRACE_OS, "yaffs_mknod failed making object");
+                error = -ENOMEM;
+        }
+
+        return error;
+}
+
+static int yaffs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+{
+        return yaffs_mknod(dir, dentry, mode | S_IFDIR, 0);
+}
+
+static int yaffs_create(struct inode *dir, struct dentry *dentry, int mode,
+                        struct nameidata *n)
+{
+        return yaffs_mknod(dir, dentry, mode | S_IFREG, 0);
+}
+
+static int yaffs_link(struct dentry *old_dentry, struct inode *dir,
+                      struct dentry *dentry)
+{
+        struct inode *inode = old_dentry->d_inode;
+        struct yaffs_obj *obj = NULL;
+        struct yaffs_obj *link = NULL;
+        struct yaffs_dev *dev;
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_link");
+
+        obj = yaffs_inode_to_obj(inode);
+        dev = obj->my_dev;
+
+        yaffs_gross_lock(dev);
+
+        if (!S_ISDIR(inode->i_mode))    /* Don't link directories */
+                link =
+                    yaffs_link_obj(yaffs_inode_to_obj(dir), dentry->d_name.name,
+                                   obj);
+
+        if (link) {
+                old_dentry->d_inode->i_nlink = yaffs_get_obj_link_count(obj);
+                d_instantiate(dentry, old_dentry->d_inode);
+                atomic_inc(&old_dentry->d_inode->i_count);
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_link link count %d i_count %d",
+                        old_dentry->d_inode->i_nlink,
+                        atomic_read(&old_dentry->d_inode->i_count));
+        }
+
+        yaffs_gross_unlock(dev);
+
+        if (link) {
+                update_dir_time(dir);
+                return 0;
+        }
+
+        return -EPERM;
+}
+
+static int yaffs_symlink(struct inode *dir, struct dentry *dentry,
+                         const char *symname)
+{
+        struct yaffs_obj *obj;
+        struct yaffs_dev *dev;
+        uid_t uid = current->cred->fsuid;
+        gid_t gid =
+            (dir->i_mode & S_ISGID) ? dir->i_gid : current->cred->fsgid;
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_symlink");
+
+        dev = yaffs_inode_to_obj(dir)->my_dev;
+        yaffs_gross_lock(dev);
+        obj = yaffs_create_symlink(yaffs_inode_to_obj(dir), dentry->d_name.name,
+                                   S_IFLNK | S_IRWXUGO, uid, gid, symname);
+        yaffs_gross_unlock(dev);
+
+        if (obj) {
+                struct inode *inode;
+
+                inode = yaffs_get_inode(dir->i_sb, obj->yst_mode, 0, obj);
+                d_instantiate(dentry, inode);
+                update_dir_time(dir);
+                yaffs_trace(YAFFS_TRACE_OS, "symlink created OK");
+                return 0;
+        } else {
+                yaffs_trace(YAFFS_TRACE_OS, "symlink not created");
+        }
+
+        return -ENOMEM;
+}
+
+static struct dentry *yaffs_lookup(struct inode *dir, struct dentry *dentry,
+                                   struct nameidata *n)
+{
+        struct yaffs_obj *obj;
+        struct inode *inode = NULL;
+
+        struct yaffs_dev *dev = yaffs_inode_to_obj(dir)->my_dev;
+
+        if (current != yaffs_dev_to_lc(dev)->readdir_process)
+                yaffs_gross_lock(dev);
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_lookup for %d:%s",
+                yaffs_inode_to_obj(dir)->obj_id, dentry->d_name.name);
+
+        obj = yaffs_find_by_name(yaffs_inode_to_obj(dir), dentry->d_name.name);
+
+        obj = yaffs_get_equivalent_obj(obj);    /* in case it was a hardlink */
+
+        /* Can't hold gross lock when calling yaffs_get_inode() */
+        if (current != yaffs_dev_to_lc(dev)->readdir_process)
+                yaffs_gross_unlock(dev);
+
+        if (obj) {
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_lookup found %d", obj->obj_id);
+
+                inode = yaffs_get_inode(dir->i_sb, obj->yst_mode, 0, obj);
+
+                if (inode) {
+                        yaffs_trace(YAFFS_TRACE_OS, "yaffs_loookup dentry");
+                        d_add(dentry, inode);
+                        /* return dentry; */
+                        return NULL;
+                }
+
+        } else {
+                yaffs_trace(YAFFS_TRACE_OS, "yaffs_lookup not found");
+
+        }
+
+        d_add(dentry, inode);
+
+        return NULL;
+}
+
+static int yaffs_unlink(struct inode *dir, struct dentry *dentry)
+{
+        int ret_val;
+
+        struct yaffs_dev *dev;
+        struct yaffs_obj *obj;
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_unlink %d:%s",
+                (int)(dir->i_ino), dentry->d_name.name);
+        obj = yaffs_inode_to_obj(dir);
+        dev = obj->my_dev;
+
+        yaffs_gross_lock(dev);
+
+        ret_val = yaffs_unlinker(obj, dentry->d_name.name);
+
+        if (ret_val == YAFFS_OK) {
+                dentry->d_inode->i_nlink--;
+                dir->i_version++;
+                yaffs_gross_unlock(dev);
+                mark_inode_dirty(dentry->d_inode);
+                update_dir_time(dir);
+                return 0;
+        }
+        yaffs_gross_unlock(dev);
+        return -ENOTEMPTY;
+}
+
+static int yaffs_sync_object(struct file *file, int datasync)
+{
+
+        struct yaffs_obj *obj;
+        struct yaffs_dev *dev;
+        struct dentry *dentry = file->f_path.dentry;
+
+        obj = yaffs_dentry_to_obj(dentry);
+
+        dev = obj->my_dev;
+
+        yaffs_trace(YAFFS_TRACE_OS | YAFFS_TRACE_SYNC, "yaffs_sync_object");
+        yaffs_gross_lock(dev);
+        yaffs_flush_file(obj, 1, datasync);
+        yaffs_gross_unlock(dev);
+        return 0;
+}
+/*
+ * The VFS layer already does all the dentry stuff for rename.
+ *
+ * NB: POSIX says you can rename an object over an old object of the same name
+ */
+static int yaffs_rename(struct inode *old_dir, struct dentry *old_dentry,
+                        struct inode *new_dir, struct dentry *new_dentry)
+{
+        struct yaffs_dev *dev;
+        int ret_val = YAFFS_FAIL;
+        struct yaffs_obj *target;
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_rename");
+        dev = yaffs_inode_to_obj(old_dir)->my_dev;
+
+        yaffs_gross_lock(dev);
+
+        /* Check if the target is an existing directory that is not empty. */
+        target = yaffs_find_by_name(yaffs_inode_to_obj(new_dir),
+                                    new_dentry->d_name.name);
+
+        if (target && target->variant_type == YAFFS_OBJECT_TYPE_DIRECTORY &&
+            !list_empty(&target->variant.dir_variant.children)) {
+
+                yaffs_trace(YAFFS_TRACE_OS, "target is non-empty dir");
+
+                ret_val = YAFFS_FAIL;
+        } else {
+                /* Now does unlinking internally using shadowing mechanism */
+                yaffs_trace(YAFFS_TRACE_OS, "calling yaffs_rename_obj");
+
+                ret_val = yaffs_rename_obj(yaffs_inode_to_obj(old_dir),
+                                           old_dentry->d_name.name,
+                                           yaffs_inode_to_obj(new_dir),
+                                           new_dentry->d_name.name);
+        }
+        yaffs_gross_unlock(dev);
+
+        if (ret_val == YAFFS_OK) {
+                if (target) {
+                        new_dentry->d_inode->i_nlink--;
+                        mark_inode_dirty(new_dentry->d_inode);
+                }
+
+                update_dir_time(old_dir);
+                if (old_dir != new_dir)
+                        update_dir_time(new_dir);
+                return 0;
+        } else {
+                return -ENOTEMPTY;
+        }
+}
+
+static int yaffs_setattr(struct dentry *dentry, struct iattr *attr)
+{
+        struct inode *inode = dentry->d_inode;
+        int error = 0;
+        struct yaffs_dev *dev;
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_setattr of object %d",
+                yaffs_inode_to_obj(inode)->obj_id);
+
+        /* Fail if a requested resize >= 2GB */
+        if (attr->ia_valid & ATTR_SIZE && (attr->ia_size >> 31))
+                error = -EINVAL;
+
+        if (error == 0)
+                error = inode_change_ok(inode, attr);
+        if (error == 0) {
+                int result;
+                if (!error) {
+                        setattr_copy(inode, attr);
+                        yaffs_trace(YAFFS_TRACE_OS, "inode_setattr called");
+                        if (attr->ia_valid & ATTR_SIZE) {
+                                truncate_setsize(inode, attr->ia_size);
+                                inode->i_blocks = (inode->i_size + 511) >> 9;
+                        }
+                }
+                dev = yaffs_inode_to_obj(inode)->my_dev;
+                if (attr->ia_valid & ATTR_SIZE) {
+                        yaffs_trace(YAFFS_TRACE_OS, "resize to %d(%x)",
+                                           (int)(attr->ia_size),
+                                           (int)(attr->ia_size));
+                }
+                yaffs_gross_lock(dev);
+                result = yaffs_set_attribs(yaffs_inode_to_obj(inode), attr);
+                if (result == YAFFS_OK) {
+                        error = 0;
+                } else {
+                        error = -EPERM;
+                }
+                yaffs_gross_unlock(dev);
+
+        }
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_setattr done returning %d", error);
+
+        return error;
+}
+
+#ifdef CONFIG_YAFFS_XATTR
+static int yaffs_setxattr(struct dentry *dentry, const char *name,
+                   const void *value, size_t size, int flags)
+{
+        struct inode *inode = dentry->d_inode;
+        int error = 0;
+        struct yaffs_dev *dev;
+        struct yaffs_obj *obj = yaffs_inode_to_obj(inode);
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_setxattr of object %d", obj->obj_id);
+
+        if (error == 0) {
+                int result;
+                dev = obj->my_dev;
+                yaffs_gross_lock(dev);
+                result = yaffs_set_xattrib(obj, name, value, size, flags);
+                if (result == YAFFS_OK)
+                        error = 0;
+                else if (result < 0)
+                        error = result;
+                yaffs_gross_unlock(dev);
+
+        }
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_setxattr done returning %d", error);
+
+        return error;
+}
+
+static ssize_t yaffs_getxattr(struct dentry * dentry, const char *name, void *buff,
+                       size_t size)
+{
+        struct inode *inode = dentry->d_inode;
+        int error = 0;
+        struct yaffs_dev *dev;
+        struct yaffs_obj *obj = yaffs_inode_to_obj(inode);
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_getxattr \"%s\" from object %d",
+                name, obj->obj_id);
+
+        if (error == 0) {
+                dev = obj->my_dev;
+                yaffs_gross_lock(dev);
+                error = yaffs_get_xattrib(obj, name, buff, size);
+                yaffs_gross_unlock(dev);
+
+        }
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_getxattr done returning %d", error);
+
+        return error;
+}
+
+static int yaffs_removexattr(struct dentry *dentry, const char *name)
+{
+        struct inode *inode = dentry->d_inode;
+        int error = 0;
+        struct yaffs_dev *dev;
+        struct yaffs_obj *obj = yaffs_inode_to_obj(inode);
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_removexattr of object %d", obj->obj_id);
+
+        if (error == 0) {
+                int result;
+                dev = obj->my_dev;
+                yaffs_gross_lock(dev);
+                result = yaffs_remove_xattrib(obj, name);
+                if (result == YAFFS_OK)
+                        error = 0;
+                else if (result < 0)
+                        error = result;
+                yaffs_gross_unlock(dev);
+
+        }
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_removexattr done returning %d", error);
+
+        return error;
+}
+
+static ssize_t yaffs_listxattr(struct dentry * dentry, char *buff, size_t size)
+{
+        struct inode *inode = dentry->d_inode;
+        int error = 0;
+        struct yaffs_dev *dev;
+        struct yaffs_obj *obj = yaffs_inode_to_obj(inode);
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_listxattr of object %d", obj->obj_id);
+
+        if (error == 0) {
+                dev = obj->my_dev;
+                yaffs_gross_lock(dev);
+                error = yaffs_list_xattrib(obj, buff, size);
+                yaffs_gross_unlock(dev);
+
+        }
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_listxattr done returning %d", error);
+
+        return error;
+}
+
+#endif
+
+static const struct inode_operations yaffs_dir_inode_operations = {
+        .create = yaffs_create,
+        .lookup = yaffs_lookup,
+        .link = yaffs_link,
+        .unlink = yaffs_unlink,
+        .symlink = yaffs_symlink,
+        .mkdir = yaffs_mkdir,
+        .rmdir = yaffs_unlink,
+        .mknod = yaffs_mknod,
+        .rename = yaffs_rename,
+        .setattr = yaffs_setattr,
+#ifdef CONFIG_YAFFS_XATTR
+        .setxattr = yaffs_setxattr,
+        .getxattr = yaffs_getxattr,
+        .listxattr = yaffs_listxattr,
+        .removexattr = yaffs_removexattr,
+#endif
+};
+/*-----------------------------------------------------------------*/
+/* Directory search context allows us to unlock access to yaffs during
+ * filldir without causing problems with the directory being modified.
+ * This is similar to the tried and tested mechanism used in yaffs direct.
+ *
+ * A search context iterates along a doubly linked list of siblings in the
+ * directory. If the iterating object is deleted then this would corrupt
+ * the list iteration, likely causing a crash. The search context avoids
+ * this by using the remove_obj_fn to move the search context to the
+ * next object before the object is deleted.
+ *
+ * Many readdirs (and thus seach conexts) may be alive simulateously so
+ * each struct yaffs_dev has a list of these.
+ *
+ * A seach context lives for the duration of a readdir.
+ *
+ * All these functions must be called while yaffs is locked.
+ */
+
+struct yaffs_search_context {
+        struct yaffs_dev *dev;
+        struct yaffs_obj *dir_obj;
+        struct yaffs_obj *next_return;
+        struct list_head others;
+};
+
+/*
+ * yaffs_new_search() creates a new search context, initialises it and
+ * adds it to the device's search context list.
+ *
+ * Called at start of readdir.
+ */
+static struct yaffs_search_context *yaffs_new_search(struct yaffs_obj *dir)
+{
+        struct yaffs_dev *dev = dir->my_dev;
+        struct yaffs_search_context *sc =
+            kmalloc(sizeof(struct yaffs_search_context), GFP_NOFS);
+        if (sc) {
+                sc->dir_obj = dir;
+                sc->dev = dev;
+                if (list_empty(&sc->dir_obj->variant.dir_variant.children))
+                        sc->next_return = NULL;
+                else
+                        sc->next_return =
+                            list_entry(dir->variant.dir_variant.children.next,
+                                       struct yaffs_obj, siblings);
+                INIT_LIST_HEAD(&sc->others);
+                list_add(&sc->others, &(yaffs_dev_to_lc(dev)->search_contexts));
+        }
+        return sc;
+}
+
+/*
+ * yaffs_search_end() disposes of a search context and cleans up.
+ */
+static void yaffs_search_end(struct yaffs_search_context *sc)
+{
+        if (sc) {
+                list_del(&sc->others);
+                kfree(sc);
+        }
+}
+
+/*
+ * yaffs_search_advance() moves a search context to the next object.
+ * Called when the search iterates or when an object removal causes
+ * the search context to be moved to the next object.
+ */
+static void yaffs_search_advance(struct yaffs_search_context *sc)
+{
+        if (!sc)
+                return;
+
+        if (sc->next_return == NULL ||
+            list_empty(&sc->dir_obj->variant.dir_variant.children))
+                sc->next_return = NULL;
+        else {
+                struct list_head *next = sc->next_return->siblings.next;
+
+                if (next == &sc->dir_obj->variant.dir_variant.children)
+                        sc->next_return = NULL; /* end of list */
+                else
+                        sc->next_return =
+                            list_entry(next, struct yaffs_obj, siblings);
+        }
+}
+
+/*
+ * yaffs_remove_obj_callback() is called when an object is unlinked.
+ * We check open search contexts and advance any which are currently
+ * on the object being iterated.
+ */
+static void yaffs_remove_obj_callback(struct yaffs_obj *obj)
+{
+
+        struct list_head *i;
+        struct yaffs_search_context *sc;
+        struct list_head *search_contexts =
+            &(yaffs_dev_to_lc(obj->my_dev)->search_contexts);
+
+        /* Iterate through the directory search contexts.
+         * If any are currently on the object being removed, then advance
+         * the search context to the next object to prevent a hanging pointer.
+         */
+        list_for_each(i, search_contexts) {
+                if (i) {
+                        sc = list_entry(i, struct yaffs_search_context, others);
+                        if (sc->next_return == obj)
+                                yaffs_search_advance(sc);
+                }
+        }
+
+}
+
+static int yaffs_readdir(struct file *f, void *dirent, filldir_t filldir)
+{
+        struct yaffs_obj *obj;
+        struct yaffs_dev *dev;
+        struct yaffs_search_context *sc;
+        struct inode *inode = f->f_dentry->d_inode;
+        unsigned long offset, curoffs;
+        struct yaffs_obj *l;
+        int ret_val = 0;
+
+        char name[YAFFS_MAX_NAME_LENGTH + 1];
+
+        obj = yaffs_dentry_to_obj(f->f_dentry);
+        dev = obj->my_dev;
+
+        yaffs_gross_lock(dev);
+
+        yaffs_dev_to_lc(dev)->readdir_process = current;
+
+        offset = f->f_pos;
+
+        sc = yaffs_new_search(obj);
+        if (!sc) {
+                ret_val = -ENOMEM;
+                goto out;
+        }
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_readdir: starting at %d", (int)offset);
+
+        if (offset == 0) {
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_readdir: entry . ino %d",
+                        (int)inode->i_ino);
+                yaffs_gross_unlock(dev);
+                if (filldir(dirent, ".", 1, offset, inode->i_ino, DT_DIR) < 0) {
+                        yaffs_gross_lock(dev);
+                        goto out;
+                }
+                yaffs_gross_lock(dev);
+                offset++;
+                f->f_pos++;
+        }
+        if (offset == 1) {
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_readdir: entry .. ino %d",
+                        (int)f->f_dentry->d_parent->d_inode->i_ino);
+                yaffs_gross_unlock(dev);
+                if (filldir(dirent, "..", 2, offset,
+                            f->f_dentry->d_parent->d_inode->i_ino,
+                            DT_DIR) < 0) {
+                        yaffs_gross_lock(dev);
+                        goto out;
+                }
+                yaffs_gross_lock(dev);
+                offset++;
+                f->f_pos++;
+        }
+
+        curoffs = 1;
+
+        /* If the directory has changed since the open or last call to
+           readdir, rewind to after the 2 canned entries. */
+        if (f->f_version != inode->i_version) {
+                offset = 2;
+                f->f_pos = offset;
+                f->f_version = inode->i_version;
+        }
+
+        while (sc->next_return) {
+                curoffs++;
+                l = sc->next_return;
+                if (curoffs >= offset) {
+                        int this_inode = yaffs_get_obj_inode(l);
+                        int this_type = yaffs_get_obj_type(l);
+
+                        yaffs_get_obj_name(l, name, YAFFS_MAX_NAME_LENGTH + 1);
+                        yaffs_trace(YAFFS_TRACE_OS,
+                                "yaffs_readdir: %s inode %d",
+                                name, yaffs_get_obj_inode(l));
+
+                        yaffs_gross_unlock(dev);
+
+                        if (filldir(dirent,
+                                    name,
+                                    strlen(name),
+                                    offset, this_inode, this_type) < 0) {
+                                yaffs_gross_lock(dev);
+                                goto out;
+                        }
+
+                        yaffs_gross_lock(dev);
+
+                        offset++;
+                        f->f_pos++;
+                }
+                yaffs_search_advance(sc);
+        }
+
+out:
+        yaffs_search_end(sc);
+        yaffs_dev_to_lc(dev)->readdir_process = NULL;
+        yaffs_gross_unlock(dev);
+
+        return ret_val;
+}
+
+static const struct file_operations yaffs_dir_operations = {
+        .read = generic_read_dir,
+        .readdir = yaffs_readdir,
+        .fsync = yaffs_sync_object,
+        .llseek = generic_file_llseek,
+};
+
+
+
+static int yaffs_file_flush(struct file *file, fl_owner_t id)
+{
+        struct yaffs_obj *obj = yaffs_dentry_to_obj(file->f_dentry);
+
+        struct yaffs_dev *dev = obj->my_dev;
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_file_flush object %d (%s)",
+                obj->obj_id, obj->dirty ? "dirty" : "clean");
+
+        yaffs_gross_lock(dev);
+
+        yaffs_flush_file(obj, 1, 0);
+
+        yaffs_gross_unlock(dev);
+
+        return 0;
+}
+
+static const struct file_operations yaffs_file_operations = {
+        .read = do_sync_read,
+        .write = do_sync_write,
+        .aio_read = generic_file_aio_read,
+        .aio_write = generic_file_aio_write,
+        .mmap = generic_file_mmap,
+        .flush = yaffs_file_flush,
+        .fsync = yaffs_sync_object,
+        .splice_read = generic_file_splice_read,
+        .splice_write = generic_file_splice_write,
+        .llseek = generic_file_llseek,
+};
+
+
+/* ExportFS support */
+static struct inode *yaffs2_nfs_get_inode(struct super_block *sb, uint64_t ino,
+                                          uint32_t generation)
+{
+        return yaffs_iget(sb, ino);
+}
+
+static struct dentry *yaffs2_fh_to_dentry(struct super_block *sb,
+                                          struct fid *fid, int fh_len,
+                                          int fh_type)
+{
+        return generic_fh_to_dentry(sb, fid, fh_len, fh_type,
+                                    yaffs2_nfs_get_inode);
+}
+
+static struct dentry *yaffs2_fh_to_parent(struct super_block *sb,
+                                          struct fid *fid, int fh_len,
+                                          int fh_type)
+{
+        return generic_fh_to_parent(sb, fid, fh_len, fh_type,
+                                    yaffs2_nfs_get_inode);
+}
+
+struct dentry *yaffs2_get_parent(struct dentry *dentry)
+{
+
+        struct super_block *sb = dentry->d_inode->i_sb;
+        struct dentry *parent = ERR_PTR(-ENOENT);
+        struct inode *inode;
+        unsigned long parent_ino;
+        struct yaffs_obj *d_obj;
+        struct yaffs_obj *parent_obj;
+
+        d_obj = yaffs_inode_to_obj(dentry->d_inode);
+
+        if (d_obj) {
+                parent_obj = d_obj->parent;
+                if (parent_obj) {
+                        parent_ino = yaffs_get_obj_inode(parent_obj);
+                        inode = yaffs_iget(sb, parent_ino);
+
+                        if (IS_ERR(inode)) {
+                                parent = ERR_CAST(inode);
+                        } else {
+                                parent = d_obtain_alias(inode);
+                                if (!IS_ERR(parent)) {
+                                        parent = ERR_PTR(-ENOMEM);
+                                        iput(inode);
+                                }
+                        }
+                }
+        }
+
+        return parent;
+}
+
+/* Just declare a zero structure as a NULL value implies
+ * using the default functions of exportfs.
+ */
+
+static struct export_operations yaffs_export_ops = {
+        .fh_to_dentry = yaffs2_fh_to_dentry,
+        .fh_to_parent = yaffs2_fh_to_parent,
+        .get_parent = yaffs2_get_parent,
+};
+
+
+/*-----------------------------------------------------------------*/
+
+static int yaffs_readlink(struct dentry *dentry, char __user * buffer,
+                          int buflen)
+{
+        unsigned char *alias;
+        int ret;
+
+        struct yaffs_dev *dev = yaffs_dentry_to_obj(dentry)->my_dev;
+
+        yaffs_gross_lock(dev);
+
+        alias = yaffs_get_symlink_alias(yaffs_dentry_to_obj(dentry));
+
+        yaffs_gross_unlock(dev);
+
+        if (!alias)
+                return -ENOMEM;
+
+        ret = vfs_readlink(dentry, buffer, buflen, alias);
+        kfree(alias);
+        return ret;
+}
+
+static void *yaffs_follow_link(struct dentry *dentry, struct nameidata *nd)
+{
+        unsigned char *alias;
+        void *ret;
+        struct yaffs_dev *dev = yaffs_dentry_to_obj(dentry)->my_dev;
+
+        yaffs_gross_lock(dev);
+
+        alias = yaffs_get_symlink_alias(yaffs_dentry_to_obj(dentry));
+        yaffs_gross_unlock(dev);
+
+        if (!alias) {
+                ret = ERR_PTR(-ENOMEM);
+                goto out;
+        }
+
+        nd_set_link(nd, alias);
+        ret = (void *)alias;
+out:
+        return ret;
+}
+
+void yaffs_put_link(struct dentry *dentry, struct nameidata *nd, void *alias)
+{
+        kfree(alias);
+}
+
+
+static void yaffs_unstitch_obj(struct inode *inode, struct yaffs_obj *obj)
+{
+        /* Clear the association between the inode and
+         * the struct yaffs_obj.
+         */
+        obj->my_inode = NULL;
+        yaffs_inode_to_obj_lv(inode) = NULL;
+
+        /* If the object freeing was deferred, then the real
+         * free happens now.
+         * This should fix the inode inconsistency problem.
+         */
+        yaffs_handle_defered_free(obj);
+}
+
+/* yaffs_evict_inode combines into one operation what was previously done in
+ * yaffs_clear_inode() and yaffs_delete_inode()
+ *
+ */
+static void yaffs_evict_inode(struct inode *inode)
+{
+        struct yaffs_obj *obj;
+        struct yaffs_dev *dev;
+        int deleteme = 0;
+
+        obj = yaffs_inode_to_obj(inode);
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_evict_inode: ino %d, count %d %s",
+                (int)inode->i_ino,
+                atomic_read(&inode->i_count),
+                obj ? "object exists" : "null object");
+
+        if (!inode->i_nlink && !is_bad_inode(inode))
+                deleteme = 1;
+        truncate_inode_pages(&inode->i_data, 0);
+        end_writeback(inode);
+
+        if (deleteme && obj) {
+                dev = obj->my_dev;
+                yaffs_gross_lock(dev);
+                yaffs_del_obj(obj);
+                yaffs_gross_unlock(dev);
+        }
+        if (obj) {
+                dev = obj->my_dev;
+                yaffs_gross_lock(dev);
+                yaffs_unstitch_obj(inode, obj);
+                yaffs_gross_unlock(dev);
+        }
+
+}
+
+static void yaffs_touch_super(struct yaffs_dev *dev)
+{
+        struct super_block *sb = yaffs_dev_to_lc(dev)->super;
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_touch_super() sb = %p", sb);
+        if (sb)
+                sb->s_dirt = 1;
+}
+
+static int yaffs_readpage_nolock(struct file *f, struct page *pg)
+{
+        /* Lifted from jffs2 */
+
+        struct yaffs_obj *obj;
+        unsigned char *pg_buf;
+        int ret;
+
+        struct yaffs_dev *dev;
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_readpage_nolock at %08x, size %08x",
+                (unsigned)(pg->index << PAGE_CACHE_SHIFT),
+                (unsigned)PAGE_CACHE_SIZE);
+
+        obj = yaffs_dentry_to_obj(f->f_dentry);
+
+        dev = obj->my_dev;
+
+        BUG_ON(!PageLocked(pg));
+
+        pg_buf = kmap(pg);
+        /* FIXME: Can kmap fail? */
+
+        yaffs_gross_lock(dev);
+
+        ret = yaffs_file_rd(obj, pg_buf,
+                            pg->index << PAGE_CACHE_SHIFT, PAGE_CACHE_SIZE);
+
+        yaffs_gross_unlock(dev);
+
+        if (ret >= 0)
+                ret = 0;
+
+        if (ret) {
+                ClearPageUptodate(pg);
+                SetPageError(pg);
+        } else {
+                SetPageUptodate(pg);
+                ClearPageError(pg);
+        }
+
+        flush_dcache_page(pg);
+        kunmap(pg);
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_readpage_nolock done");
+        return ret;
+}
+
+static int yaffs_readpage_unlock(struct file *f, struct page *pg)
+{
+        int ret = yaffs_readpage_nolock(f, pg);
+        UnlockPage(pg);
+        return ret;
+}
+
+static int yaffs_readpage(struct file *f, struct page *pg)
+{
+        int ret;
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_readpage");
+        ret = yaffs_readpage_unlock(f, pg);
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_readpage done");
+        return ret;
+}
+
+/* writepage inspired by/stolen from smbfs */
+
+static int yaffs_writepage(struct page *page, struct writeback_control *wbc)
+{
+        struct yaffs_dev *dev;
+        struct address_space *mapping = page->mapping;
+        struct inode *inode;
+        unsigned long end_index;
+        char *buffer;
+        struct yaffs_obj *obj;
+        int n_written = 0;
+        unsigned n_bytes;
+        loff_t i_size;
+
+        if (!mapping)
+                BUG();
+        inode = mapping->host;
+        if (!inode)
+                BUG();
+        i_size = i_size_read(inode);
+
+        end_index = i_size >> PAGE_CACHE_SHIFT;
+
+        if (page->index < end_index)
+                n_bytes = PAGE_CACHE_SIZE;
+        else {
+                n_bytes = i_size & (PAGE_CACHE_SIZE - 1);
+
+                if (page->index > end_index || !n_bytes) {
+                        yaffs_trace(YAFFS_TRACE_OS,
+                                "yaffs_writepage at %08x, inode size = %08x!!!",
+                                (unsigned)(page->index << PAGE_CACHE_SHIFT),
+                                (unsigned)inode->i_size);
+                        yaffs_trace(YAFFS_TRACE_OS,
+                          "                -> don't care!!");
+
+                        zero_user_segment(page, 0, PAGE_CACHE_SIZE);
+                        set_page_writeback(page);
+                        unlock_page(page);
+                        end_page_writeback(page);
+                        return 0;
+                }
+        }
+
+        if (n_bytes != PAGE_CACHE_SIZE)
+                zero_user_segment(page, n_bytes, PAGE_CACHE_SIZE);
+
+        get_page(page);
+
+        buffer = kmap(page);
+
+        obj = yaffs_inode_to_obj(inode);
+        dev = obj->my_dev;
+        yaffs_gross_lock(dev);
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_writepage at %08x, size %08x",
+                (unsigned)(page->index << PAGE_CACHE_SHIFT), n_bytes);
+        yaffs_trace(YAFFS_TRACE_OS,
+                "writepag0: obj = %05x, ino = %05x",
+                (int)obj->variant.file_variant.file_size, (int)inode->i_size);
+
+        n_written = yaffs_wr_file(obj, buffer,
+                                  page->index << PAGE_CACHE_SHIFT, n_bytes, 0);
+
+        yaffs_touch_super(dev);
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "writepag1: obj = %05x, ino = %05x",
+                (int)obj->variant.file_variant.file_size, (int)inode->i_size);
+
+        yaffs_gross_unlock(dev);
+
+        kunmap(page);
+        set_page_writeback(page);
+        unlock_page(page);
+        end_page_writeback(page);
+        put_page(page);
+
+        return (n_written == n_bytes) ? 0 : -ENOSPC;
+}
+
+/* Space holding and freeing is done to ensure we have space available for 
+ * write_begin/end.
+ * For now we just assume few parallel writes and check against a small
+ * number.
+ * Todo: need to do this with a counter to handle parallel reads better.
+ */
+
+static ssize_t yaffs_hold_space(struct file *f)
+{
+        struct yaffs_obj *obj;
+        struct yaffs_dev *dev;
+
+        int n_free_chunks;
+
+        obj = yaffs_dentry_to_obj(f->f_dentry);
+
+        dev = obj->my_dev;
+
+        yaffs_gross_lock(dev);
+
+        n_free_chunks = yaffs_get_n_free_chunks(dev);
+
+        yaffs_gross_unlock(dev);
+
+        return (n_free_chunks > 20) ? 1 : 0;
+}
+
+static void yaffs_release_space(struct file *f)
+{
+        struct yaffs_obj *obj;
+        struct yaffs_dev *dev;
+
+        obj = yaffs_dentry_to_obj(f->f_dentry);
+
+        dev = obj->my_dev;
+
+        yaffs_gross_lock(dev);
+
+        yaffs_gross_unlock(dev);
+}
+
+static int yaffs_write_begin(struct file *filp, struct address_space *mapping,
+                             loff_t pos, unsigned len, unsigned flags,
+                             struct page **pagep, void **fsdata)
+{
+        struct page *pg = NULL;
+        pgoff_t index = pos >> PAGE_CACHE_SHIFT;
+
+        int ret = 0;
+        int space_held = 0;
+
+        /* Get a page */
+        pg = grab_cache_page_write_begin(mapping, index, flags);
+
+        *pagep = pg;
+        if (!pg) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        yaffs_trace(YAFFS_TRACE_OS,
+                "start yaffs_write_begin index %d(%x) uptodate %d",
+                (int)index, (int)index, Page_Uptodate(pg) ? 1 : 0);
+
+        /* Get fs space */
+        space_held = yaffs_hold_space(filp);
+
+        if (!space_held) {
+                ret = -ENOSPC;
+                goto out;
+        }
+
+        /* Update page if required */
+
+        if (!Page_Uptodate(pg))
+                ret = yaffs_readpage_nolock(filp, pg);
+
+        if (ret)
+                goto out;
+
+        /* Happy path return */
+        yaffs_trace(YAFFS_TRACE_OS, "end yaffs_write_begin - ok");
+
+        return 0;
+
+out:
+        yaffs_trace(YAFFS_TRACE_OS,
+                "end yaffs_write_begin fail returning %d", ret);
+        if (space_held)
+                yaffs_release_space(filp);
+        if (pg) {
+                unlock_page(pg);
+                page_cache_release(pg);
+        }
+        return ret;
+}
+
+static ssize_t yaffs_file_write(struct file *f, const char *buf, size_t n,
+                                loff_t * pos)
+{
+        struct yaffs_obj *obj;
+        int n_written, ipos;
+        struct inode *inode;
+        struct yaffs_dev *dev;
+
+        obj = yaffs_dentry_to_obj(f->f_dentry);
+
+        dev = obj->my_dev;
+
+        yaffs_gross_lock(dev);
+
+        inode = f->f_dentry->d_inode;
+
+        if (!S_ISBLK(inode->i_mode) && f->f_flags & O_APPEND)
+                ipos = inode->i_size;
+        else
+                ipos = *pos;
+
+        if (!obj)
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_file_write: hey obj is null!");
+        else
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_file_write about to write writing %u(%x) bytes to object %d at %d(%x)",
+                        (unsigned)n, (unsigned)n, obj->obj_id, ipos, ipos);
+
+        n_written = yaffs_wr_file(obj, buf, ipos, n, 0);
+
+        yaffs_touch_super(dev);
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_file_write: %d(%x) bytes written",
+                (unsigned)n, (unsigned)n);
+
+        if (n_written > 0) {
+                ipos += n_written;
+                *pos = ipos;
+                if (ipos > inode->i_size) {
+                        inode->i_size = ipos;
+                        inode->i_blocks = (ipos + 511) >> 9;
+
+                        yaffs_trace(YAFFS_TRACE_OS,
+                                "yaffs_file_write size updated to %d bytes, %d blocks",
+                                ipos, (int)(inode->i_blocks));
+                }
+
+        }
+        yaffs_gross_unlock(dev);
+        return (n_written == 0) && (n > 0) ? -ENOSPC : n_written;
+}
+
+static int yaffs_write_end(struct file *filp, struct address_space *mapping,
+                           loff_t pos, unsigned len, unsigned copied,
+                           struct page *pg, void *fsdadata)
+{
+        int ret = 0;
+        void *addr, *kva;
+        uint32_t offset_into_page = pos & (PAGE_CACHE_SIZE - 1);
+
+        kva = kmap(pg);
+        addr = kva + offset_into_page;
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_write_end addr %p pos %x n_bytes %d",
+                addr, (unsigned)pos, copied);
+
+        ret = yaffs_file_write(filp, addr, copied, &pos);
+
+        if (ret != copied) {
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_write_end not same size ret %d  copied %d",
+                        ret, copied);
+                SetPageError(pg);
+        }
+
+        kunmap(pg);
+
+        yaffs_release_space(filp);
+        unlock_page(pg);
+        page_cache_release(pg);
+        return ret;
+}
+
+static int yaffs_statfs(struct dentry *dentry, struct kstatfs *buf)
+{
+        struct yaffs_dev *dev = yaffs_dentry_to_obj(dentry)->my_dev;
+        struct super_block *sb = dentry->d_sb;
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_statfs");
+
+        yaffs_gross_lock(dev);
+
+        buf->f_type = YAFFS_MAGIC;
+        buf->f_bsize = sb->s_blocksize;
+        buf->f_namelen = 255;
+
+        if (dev->data_bytes_per_chunk & (dev->data_bytes_per_chunk - 1)) {
+                /* Do this if chunk size is not a power of 2 */
+
+                uint64_t bytes_in_dev;
+                uint64_t bytes_free;
+
+                bytes_in_dev =
+                    ((uint64_t)
+                     ((dev->param.end_block - dev->param.start_block +
+                       1))) * ((uint64_t) (dev->param.chunks_per_block *
+                                           dev->data_bytes_per_chunk));
+
+                do_div(bytes_in_dev, sb->s_blocksize);  /* bytes_in_dev becomes the number of blocks */
+                buf->f_blocks = bytes_in_dev;
+
+                bytes_free = ((uint64_t) (yaffs_get_n_free_chunks(dev))) *
+                    ((uint64_t) (dev->data_bytes_per_chunk));
+
+                do_div(bytes_free, sb->s_blocksize);
+
+                buf->f_bfree = bytes_free;
+
+        } else if (sb->s_blocksize > dev->data_bytes_per_chunk) {
+
+                buf->f_blocks =
+                    (dev->param.end_block - dev->param.start_block + 1) *
+                    dev->param.chunks_per_block /
+                    (sb->s_blocksize / dev->data_bytes_per_chunk);
+                buf->f_bfree =
+                    yaffs_get_n_free_chunks(dev) /
+                    (sb->s_blocksize / dev->data_bytes_per_chunk);
+        } else {
+                buf->f_blocks =
+                    (dev->param.end_block - dev->param.start_block + 1) *
+                    dev->param.chunks_per_block *
+                    (dev->data_bytes_per_chunk / sb->s_blocksize);
+
+                buf->f_bfree =
+                    yaffs_get_n_free_chunks(dev) *
+                    (dev->data_bytes_per_chunk / sb->s_blocksize);
+        }
+
+        buf->f_files = 0;
+        buf->f_ffree = 0;
+        buf->f_bavail = buf->f_bfree;
+
+        yaffs_gross_unlock(dev);
+        return 0;
+}
+
+static void yaffs_flush_inodes(struct super_block *sb)
+{
+        struct inode *iptr;
+        struct yaffs_obj *obj;
+
+        list_for_each_entry(iptr, &sb->s_inodes, i_sb_list) {
+                obj = yaffs_inode_to_obj(iptr);
+                if (obj) {
+                        yaffs_trace(YAFFS_TRACE_OS,
+                                "flushing obj %d", obj->obj_id);
+                        yaffs_flush_file(obj, 1, 0);
+                }
+        }
+}
+
+static void yaffs_flush_super(struct super_block *sb, int do_checkpoint)
+{
+        struct yaffs_dev *dev = yaffs_super_to_dev(sb);
+        if (!dev)
+                return;
+
+        yaffs_flush_inodes(sb);
+        yaffs_update_dirty_dirs(dev);
+        yaffs_flush_whole_cache(dev);
+        if (do_checkpoint)
+                yaffs_checkpoint_save(dev);
+}
+
+static unsigned yaffs_bg_gc_urgency(struct yaffs_dev *dev)
+{
+        unsigned erased_chunks =
+            dev->n_erased_blocks * dev->param.chunks_per_block;
+        struct yaffs_linux_context *context = yaffs_dev_to_lc(dev);
+        unsigned scattered = 0; /* Free chunks not in an erased block */
+
+        if (erased_chunks < dev->n_free_chunks)
+                scattered = (dev->n_free_chunks - erased_chunks);
+
+        if (!context->bg_running)
+                return 0;
+        else if (scattered < (dev->param.chunks_per_block * 2))
+                return 0;
+        else if (erased_chunks > dev->n_free_chunks / 2)
+                return 0;
+        else if (erased_chunks > dev->n_free_chunks / 4)
+                return 1;
+        else
+                return 2;
+}
+
+static int yaffs_do_sync_fs(struct super_block *sb, int request_checkpoint)
+{
+
+        struct yaffs_dev *dev = yaffs_super_to_dev(sb);
+        unsigned int oneshot_checkpoint = (yaffs_auto_checkpoint & 4);
+        unsigned gc_urgent = yaffs_bg_gc_urgency(dev);
+        int do_checkpoint;
+
+        yaffs_trace(YAFFS_TRACE_OS | YAFFS_TRACE_SYNC | YAFFS_TRACE_BACKGROUND,
+                "yaffs_do_sync_fs: gc-urgency %d %s %s%s",
+                gc_urgent,
+                sb->s_dirt ? "dirty" : "clean",
+                request_checkpoint ? "checkpoint requested" : "no checkpoint",
+                oneshot_checkpoint ? " one-shot" : "");
+
+        yaffs_gross_lock(dev);
+        do_checkpoint = ((request_checkpoint && !gc_urgent) ||
+                         oneshot_checkpoint) && !dev->is_checkpointed;
+
+        if (sb->s_dirt || do_checkpoint) {
+                yaffs_flush_super(sb, !dev->is_checkpointed && do_checkpoint);
+                sb->s_dirt = 0;
+                if (oneshot_checkpoint)
+                        yaffs_auto_checkpoint &= ~4;
+        }
+        yaffs_gross_unlock(dev);
+
+        return 0;
+}
+
+/*
+ * yaffs background thread functions .
+ * yaffs_bg_thread_fn() the thread function
+ * yaffs_bg_start() launches the background thread.
+ * yaffs_bg_stop() cleans up the background thread.
+ *
+ * NB: 
+ * The thread should only run after the yaffs is initialised
+ * The thread should be stopped before yaffs is unmounted.
+ * The thread should not do any writing while the fs is in read only.
+ */
+
+void yaffs_background_waker(unsigned long data)
+{
+        wake_up_process((struct task_struct *)data);
+}
+
+static int yaffs_bg_thread_fn(void *data)
+{
+        struct yaffs_dev *dev = (struct yaffs_dev *)data;
+        struct yaffs_linux_context *context = yaffs_dev_to_lc(dev);
+        unsigned long now = jiffies;
+        unsigned long next_dir_update = now;
+        unsigned long next_gc = now;
+        unsigned long expires;
+        unsigned int urgency;
+
+        int gc_result;
+        struct timer_list timer;
+
+        yaffs_trace(YAFFS_TRACE_BACKGROUND,
+                "yaffs_background starting for dev %p", (void *)dev);
+
+        set_freezable();
+        while (context->bg_running) {
+                yaffs_trace(YAFFS_TRACE_BACKGROUND, "yaffs_background");
+
+                if (kthread_should_stop())
+                        break;
+
+                if (try_to_freeze())
+                        continue;
+
+                yaffs_gross_lock(dev);
+
+                now = jiffies;
+
+                if (time_after(now, next_dir_update) && yaffs_bg_enable) {
+                        yaffs_update_dirty_dirs(dev);
+                        next_dir_update = now + HZ;
+                }
+
+                if (time_after(now, next_gc) && yaffs_bg_enable) {
+                        if (!dev->is_checkpointed) {
+                                urgency = yaffs_bg_gc_urgency(dev);
+                                gc_result = yaffs_bg_gc(dev, urgency);
+                                if (urgency > 1)
+                                        next_gc = now + HZ / 20 + 1;
+                                else if (urgency > 0)
+                                        next_gc = now + HZ / 10 + 1;
+                                else
+                                        next_gc = now + HZ * 2;
+                        } else  {
+                                /*
+                                 * gc not running so set to next_dir_update
+                                 * to cut down on wake ups
+                                 */
+                                next_gc = next_dir_update;
+                        }
+                }
+                yaffs_gross_unlock(dev);
+                expires = next_dir_update;
+                if (time_before(next_gc, expires))
+                        expires = next_gc;
+                if (time_before(expires, now))
+                        expires = now + HZ;
+
+                Y_INIT_TIMER(&timer);
+                timer.expires = expires + 1;
+                timer.data = (unsigned long)current;
+                timer.function = yaffs_background_waker;
+
+                set_current_state(TASK_INTERRUPTIBLE);
+                add_timer(&timer);
+                schedule();
+                del_timer_sync(&timer);
+        }
+
+        return 0;
+}
+
+static int yaffs_bg_start(struct yaffs_dev *dev)
+{
+        int retval = 0;
+        struct yaffs_linux_context *context = yaffs_dev_to_lc(dev);
+
+        if (dev->read_only)
+                return -1;
+
+        context->bg_running = 1;
+
+        context->bg_thread = kthread_run(yaffs_bg_thread_fn,
+                                         (void *)dev, "yaffs-bg-%d",
+                                         context->mount_id);
+
+        if (IS_ERR(context->bg_thread)) {
+                retval = PTR_ERR(context->bg_thread);
+                context->bg_thread = NULL;
+                context->bg_running = 0;
+        }
+        return retval;
+}
+
+static void yaffs_bg_stop(struct yaffs_dev *dev)
+{
+        struct yaffs_linux_context *ctxt = yaffs_dev_to_lc(dev);
+
+        ctxt->bg_running = 0;
+
+        if (ctxt->bg_thread) {
+                kthread_stop(ctxt->bg_thread);
+                ctxt->bg_thread = NULL;
+        }
+}
+
+static void yaffs_write_super(struct super_block *sb)
+{
+        unsigned request_checkpoint = (yaffs_auto_checkpoint >= 2);
+
+        yaffs_trace(YAFFS_TRACE_OS | YAFFS_TRACE_SYNC | YAFFS_TRACE_BACKGROUND,
+                "yaffs_write_super%s",
+                request_checkpoint ? " checkpt" : "");
+
+        yaffs_do_sync_fs(sb, request_checkpoint);
+
+}
+
+static int yaffs_sync_fs(struct super_block *sb, int wait)
+{
+        unsigned request_checkpoint = (yaffs_auto_checkpoint >= 1);
+
+        yaffs_trace(YAFFS_TRACE_OS | YAFFS_TRACE_SYNC,
+                "yaffs_sync_fs%s", request_checkpoint ? " checkpt" : "");
+
+        yaffs_do_sync_fs(sb, request_checkpoint);
+
+        return 0;
+}
+
+
+static LIST_HEAD(yaffs_context_list);
+struct mutex yaffs_context_lock;
+
+
+
+struct yaffs_options {
+        int inband_tags;
+        int skip_checkpoint_read;
+        int skip_checkpoint_write;
+        int no_cache;
+        int tags_ecc_on;
+        int tags_ecc_overridden;
+        int lazy_loading_enabled;
+        int lazy_loading_overridden;
+        int empty_lost_and_found;
+        int empty_lost_and_found_overridden;
+};
+
+#define MAX_OPT_LEN 30
+static int yaffs_parse_options(struct yaffs_options *options,
+                               const char *options_str)
+{
+        char cur_opt[MAX_OPT_LEN + 1];
+        int p;
+        int error = 0;
+
+        /* Parse through the options which is a comma seperated list */
+
+        while (options_str && *options_str && !error) {
+                memset(cur_opt, 0, MAX_OPT_LEN + 1);
+                p = 0;
+
+                while (*options_str == ',')
+                        options_str++;
+
+                while (*options_str && *options_str != ',') {
+                        if (p < MAX_OPT_LEN) {
+                                cur_opt[p] = *options_str;
+                                p++;
+                        }
+                        options_str++;
+                }
+
+                if (!strcmp(cur_opt, "inband-tags")) {
+                        options->inband_tags = 1;
+                } else if (!strcmp(cur_opt, "tags-ecc-off")) {
+                        options->tags_ecc_on = 0;
+                        options->tags_ecc_overridden = 1;
+                } else if (!strcmp(cur_opt, "tags-ecc-on")) {
+                        options->tags_ecc_on = 1;
+                        options->tags_ecc_overridden = 1;
+                } else if (!strcmp(cur_opt, "lazy-loading-off")) {
+                        options->lazy_loading_enabled = 0;
+                        options->lazy_loading_overridden = 1;
+                } else if (!strcmp(cur_opt, "lazy-loading-on")) {
+                        options->lazy_loading_enabled = 1;
+                        options->lazy_loading_overridden = 1;
+                } else if (!strcmp(cur_opt, "empty-lost-and-found-off")) {
+                        options->empty_lost_and_found = 0;
+                        options->empty_lost_and_found_overridden = 1;
+                } else if (!strcmp(cur_opt, "empty-lost-and-found-on")) {
+                        options->empty_lost_and_found = 1;
+                        options->empty_lost_and_found_overridden = 1;
+                } else if (!strcmp(cur_opt, "no-cache")) {
+                        options->no_cache = 1;
+                } else if (!strcmp(cur_opt, "no-checkpoint-read")) {
+                        options->skip_checkpoint_read = 1;
+                } else if (!strcmp(cur_opt, "no-checkpoint-write")) {
+                        options->skip_checkpoint_write = 1;
+                } else if (!strcmp(cur_opt, "no-checkpoint")) {
+                        options->skip_checkpoint_read = 1;
+                        options->skip_checkpoint_write = 1;
+                } else {
+                        printk(KERN_INFO "yaffs: Bad mount option \"%s\"\n",
+                               cur_opt);
+                        error = 1;
+                }
+        }
+
+        return error;
+}
+
+static struct address_space_operations yaffs_file_address_operations = {
+        .readpage = yaffs_readpage,
+        .writepage = yaffs_writepage,
+        .write_begin = yaffs_write_begin,
+        .write_end = yaffs_write_end,
+};
+
+
+
+static const struct inode_operations yaffs_file_inode_operations = {
+        .setattr = yaffs_setattr,
+#ifdef CONFIG_YAFFS_XATTR
+        .setxattr = yaffs_setxattr,
+        .getxattr = yaffs_getxattr,
+        .listxattr = yaffs_listxattr,
+        .removexattr = yaffs_removexattr,
+#endif
+};
+
+static const struct inode_operations yaffs_symlink_inode_operations = {
+        .readlink = yaffs_readlink,
+        .follow_link = yaffs_follow_link,
+        .put_link = yaffs_put_link,
+        .setattr = yaffs_setattr,
+#ifdef CONFIG_YAFFS_XATTR
+        .setxattr = yaffs_setxattr,
+        .getxattr = yaffs_getxattr,
+        .listxattr = yaffs_listxattr,
+        .removexattr = yaffs_removexattr,
+#endif
+};
+
+static void yaffs_fill_inode_from_obj(struct inode *inode,
+                                      struct yaffs_obj *obj)
+{
+        if (inode && obj) {
+
+                /* Check mode against the variant type and attempt to repair if broken. */
+                u32 mode = obj->yst_mode;
+                switch (obj->variant_type) {
+                case YAFFS_OBJECT_TYPE_FILE:
+                        if (!S_ISREG(mode)) {
+                                obj->yst_mode &= ~S_IFMT;
+                                obj->yst_mode |= S_IFREG;
+                        }
+
+                        break;
+                case YAFFS_OBJECT_TYPE_SYMLINK:
+                        if (!S_ISLNK(mode)) {
+                                obj->yst_mode &= ~S_IFMT;
+                                obj->yst_mode |= S_IFLNK;
+                        }
+
+                        break;
+                case YAFFS_OBJECT_TYPE_DIRECTORY:
+                        if (!S_ISDIR(mode)) {
+                                obj->yst_mode &= ~S_IFMT;
+                                obj->yst_mode |= S_IFDIR;
+                        }
+
+                        break;
+                case YAFFS_OBJECT_TYPE_UNKNOWN:
+                case YAFFS_OBJECT_TYPE_HARDLINK:
+                case YAFFS_OBJECT_TYPE_SPECIAL:
+                default:
+                        /* TODO? */
+                        break;
+                }
+
+                inode->i_flags |= S_NOATIME;
+
+                inode->i_ino = obj->obj_id;
+                inode->i_mode = obj->yst_mode;
+                inode->i_uid = obj->yst_uid;
+                inode->i_gid = obj->yst_gid;
+
+                inode->i_rdev = old_decode_dev(obj->yst_rdev);
+
+                inode->i_atime.tv_sec = (time_t) (obj->yst_atime);
+                inode->i_atime.tv_nsec = 0;
+                inode->i_mtime.tv_sec = (time_t) obj->yst_mtime;
+                inode->i_mtime.tv_nsec = 0;
+                inode->i_ctime.tv_sec = (time_t) obj->yst_ctime;
+                inode->i_ctime.tv_nsec = 0;
+                inode->i_size = yaffs_get_obj_length(obj);
+                inode->i_blocks = (inode->i_size + 511) >> 9;
+
+                inode->i_nlink = yaffs_get_obj_link_count(obj);
+
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_fill_inode mode %x uid %d gid %d size %d count %d",
+                        inode->i_mode, inode->i_uid, inode->i_gid,
+                        (int)inode->i_size, atomic_read(&inode->i_count));
+
+                switch (obj->yst_mode & S_IFMT) {
+                default:        /* fifo, device or socket */
+                        init_special_inode(inode, obj->yst_mode,
+                                           old_decode_dev(obj->yst_rdev));
+                        break;
+                case S_IFREG:   /* file */
+                        inode->i_op = &yaffs_file_inode_operations;
+                        inode->i_fop = &yaffs_file_operations;
+                        inode->i_mapping->a_ops =
+                            &yaffs_file_address_operations;
+                        break;
+                case S_IFDIR:   /* directory */
+                        inode->i_op = &yaffs_dir_inode_operations;
+                        inode->i_fop = &yaffs_dir_operations;
+                        break;
+                case S_IFLNK:   /* symlink */
+                        inode->i_op = &yaffs_symlink_inode_operations;
+                        break;
+                }
+
+                yaffs_inode_to_obj_lv(inode) = obj;
+
+                obj->my_inode = inode;
+
+        } else {
+                yaffs_trace(YAFFS_TRACE_OS,
+                        "yaffs_fill_inode invalid parameters");
+        }
+}
+
+static void yaffs_put_super(struct super_block *sb)
+{
+        struct yaffs_dev *dev = yaffs_super_to_dev(sb);
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_put_super");
+
+        yaffs_trace(YAFFS_TRACE_OS | YAFFS_TRACE_BACKGROUND,
+                "Shutting down yaffs background thread");
+        yaffs_bg_stop(dev);
+        yaffs_trace(YAFFS_TRACE_OS | YAFFS_TRACE_BACKGROUND,
+                "yaffs background thread shut down");
+
+        yaffs_gross_lock(dev);
+
+        yaffs_flush_super(sb, 1);
+
+        if (yaffs_dev_to_lc(dev)->put_super_fn)
+                yaffs_dev_to_lc(dev)->put_super_fn(sb);
+
+        yaffs_deinitialise(dev);
+
+        yaffs_gross_unlock(dev);
+        mutex_lock(&yaffs_context_lock);
+        list_del_init(&(yaffs_dev_to_lc(dev)->context_list));
+        mutex_unlock(&yaffs_context_lock);
+
+        if (yaffs_dev_to_lc(dev)->spare_buffer) {
+                kfree(yaffs_dev_to_lc(dev)->spare_buffer);
+                yaffs_dev_to_lc(dev)->spare_buffer = NULL;
+        }
+
+        kfree(dev);
+}
+
+static void yaffs_mtd_put_super(struct super_block *sb)
+{
+        struct mtd_info *mtd = yaffs_dev_to_mtd(yaffs_super_to_dev(sb));
+
+        if (mtd->sync)
+                mtd->sync(mtd);
+
+        put_mtd_device(mtd);
+}
+
+static const struct super_operations yaffs_super_ops = {
+        .statfs = yaffs_statfs,
+        .put_super = yaffs_put_super,
+        .evict_inode = yaffs_evict_inode,
+        .sync_fs = yaffs_sync_fs,
+        .write_super = yaffs_write_super,
+};
+
+static struct super_block *yaffs_internal_read_super(int yaffs_version,
+                                                     struct super_block *sb,
+                                                     void *data, int silent)
+{
+        int n_blocks;
+        struct inode *inode = NULL;
+        struct dentry *root;
+        struct yaffs_dev *dev = 0;
+        char devname_buf[BDEVNAME_SIZE + 1];
+        struct mtd_info *mtd;
+        int err;
+        char *data_str = (char *)data;
+        struct yaffs_linux_context *context = NULL;
+        struct yaffs_param *param;
+
+        int read_only = 0;
+
+        struct yaffs_options options;
+
+        unsigned mount_id;
+        int found;
+        struct yaffs_linux_context *context_iterator;
+        struct list_head *l;
+
+        sb->s_magic = YAFFS_MAGIC;
+        sb->s_op = &yaffs_super_ops;
+        sb->s_flags |= MS_NOATIME;
+
+        read_only = ((sb->s_flags & MS_RDONLY) != 0);
+
+        sb->s_export_op = &yaffs_export_ops;
+
+        if (!sb)
+                printk(KERN_INFO "yaffs: sb is NULL\n");
+        else if (!sb->s_dev)
+                printk(KERN_INFO "yaffs: sb->s_dev is NULL\n");
+        else if (!yaffs_devname(sb, devname_buf))
+                printk(KERN_INFO "yaffs: devname is NULL\n");
+        else
+                printk(KERN_INFO "yaffs: dev is %d name is \"%s\" %s\n",
+                       sb->s_dev,
+                       yaffs_devname(sb, devname_buf), read_only ? "ro" : "rw");
+
+        if (!data_str)
+                data_str = "";
+
+        printk(KERN_INFO "yaffs: passed flags \"%s\"\n", data_str);
+
+        memset(&options, 0, sizeof(options));
+
+        if (yaffs_parse_options(&options, data_str)) {
+                /* Option parsing failed */
+                return NULL;
+        }
+
+        sb->s_blocksize = PAGE_CACHE_SIZE;
+        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_read_super: Using yaffs%d", yaffs_version);
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_read_super: block size %d", (int)(sb->s_blocksize));
+
+        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                "Attempting MTD mount of %u.%u,\"%s\"",
+                MAJOR(sb->s_dev), MINOR(sb->s_dev),
+                yaffs_devname(sb, devname_buf));
+
+        /* Check it's an mtd device..... */
+        if (MAJOR(sb->s_dev) != MTD_BLOCK_MAJOR)
+                return NULL;    /* This isn't an mtd device */
+
+        /* Get the device */
+        mtd = get_mtd_device(NULL, MINOR(sb->s_dev));
+        if (!mtd) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "MTD device #%u doesn't appear to exist",
+                        MINOR(sb->s_dev));
+                return NULL;
+        }
+        /* Check it's NAND */
+        if (mtd->type != MTD_NANDFLASH) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "MTD device is not NAND it's type %d",
+                        mtd->type);
+                return NULL;
+        }
+
+        yaffs_trace(YAFFS_TRACE_OS, " erase %p", mtd->erase);
+        yaffs_trace(YAFFS_TRACE_OS, " read %p", mtd->read);
+        yaffs_trace(YAFFS_TRACE_OS, " write %p", mtd->write);
+        yaffs_trace(YAFFS_TRACE_OS, " readoob %p", mtd->read_oob);
+        yaffs_trace(YAFFS_TRACE_OS, " writeoob %p", mtd->write_oob);
+        yaffs_trace(YAFFS_TRACE_OS, " block_isbad %p", mtd->block_isbad);
+        yaffs_trace(YAFFS_TRACE_OS, " block_markbad %p", mtd->block_markbad);
+        yaffs_trace(YAFFS_TRACE_OS, " %s %d", WRITE_SIZE_STR, WRITE_SIZE(mtd));
+        yaffs_trace(YAFFS_TRACE_OS, " oobsize %d", mtd->oobsize);
+        yaffs_trace(YAFFS_TRACE_OS, " erasesize %d", mtd->erasesize);
+        yaffs_trace(YAFFS_TRACE_OS, " size %lld", mtd->size);
+
+#ifdef CONFIG_YAFFS_AUTO_YAFFS2
+
+        if (yaffs_version == 1 && WRITE_SIZE(mtd) >= 2048) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS, "auto selecting yaffs2");
+                yaffs_version = 2;
+        }
+
+        /* Added NCB 26/5/2006 for completeness */
+        if (yaffs_version == 2 && !options.inband_tags
+            && WRITE_SIZE(mtd) == 512) {
+                yaffs_trace(YAFFS_TRACE_ALWAYS, "auto selecting yaffs1");
+                yaffs_version = 1;
+        }
+#endif
+
+        if (yaffs_version == 2) {
+                /* Check for version 2 style functions */
+                if (!mtd->erase ||
+                    !mtd->block_isbad ||
+                    !mtd->block_markbad ||
+                    !mtd->read ||
+                    !mtd->write || !mtd->read_oob || !mtd->write_oob) {
+                        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                                "MTD device does not support required functions");
+                        return NULL;
+                }
+
+                if ((WRITE_SIZE(mtd) < YAFFS_MIN_YAFFS2_CHUNK_SIZE ||
+                     mtd->oobsize < YAFFS_MIN_YAFFS2_SPARE_SIZE) &&
+                    !options.inband_tags) {
+                        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                                "MTD device does not have the right page sizes");
+                        return NULL;
+                }
+        } else {
+                /* Check for V1 style functions */
+                if (!mtd->erase ||
+                    !mtd->read ||
+                    !mtd->write || !mtd->read_oob || !mtd->write_oob) {
+                        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                                "MTD device does not support required functions");
+                        return NULL;
+                }
+
+                if (WRITE_SIZE(mtd) < YAFFS_BYTES_PER_CHUNK ||
+                    mtd->oobsize != YAFFS_BYTES_PER_SPARE) {
+                        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                                "MTD device does not support have the right page sizes");
+                        return NULL;
+                }
+        }
+
+        /* OK, so if we got here, we have an MTD that's NAND and looks
+         * like it has the right capabilities
+         * Set the struct yaffs_dev up for mtd
+         */
+
+        if (!read_only && !(mtd->flags & MTD_WRITEABLE)) {
+                read_only = 1;
+                printk(KERN_INFO
+                       "yaffs: mtd is read only, setting superblock read only");
+                sb->s_flags |= MS_RDONLY;
+        }
+
+        dev = kmalloc(sizeof(struct yaffs_dev), GFP_KERNEL);
+        context = kmalloc(sizeof(struct yaffs_linux_context), GFP_KERNEL);
+
+        if (!dev || !context) {
+                if (dev)
+                        kfree(dev);
+                if (context)
+                        kfree(context);
+                dev = NULL;
+                context = NULL;
+        }
+
+        if (!dev) {
+                /* Deep shit could not allocate device structure */
+                yaffs_trace(YAFFS_TRACE_ALWAYS,
+                        "yaffs_read_super failed trying to allocate yaffs_dev");
+                return NULL;
+        }
+        memset(dev, 0, sizeof(struct yaffs_dev));
+        param = &(dev->param);
+
+        memset(context, 0, sizeof(struct yaffs_linux_context));
+        dev->os_context = context;
+        INIT_LIST_HEAD(&(context->context_list));
+        context->dev = dev;
+        context->super = sb;
+
+        dev->read_only = read_only;
+
+        sb->s_fs_info = dev;
+
+        dev->driver_context = mtd;
+        param->name = mtd->name;
+
+        /* Set up the memory size parameters.... */
+
+        n_blocks =
+            YCALCBLOCKS(mtd->size,
+                        (YAFFS_CHUNKS_PER_BLOCK * YAFFS_BYTES_PER_CHUNK));
+
+        param->start_block = 0;
+        param->end_block = n_blocks - 1;
+        param->chunks_per_block = YAFFS_CHUNKS_PER_BLOCK;
+        param->total_bytes_per_chunk = YAFFS_BYTES_PER_CHUNK;
+        param->n_reserved_blocks = 5;
+        param->n_caches = (options.no_cache) ? 0 : 10;
+        param->inband_tags = options.inband_tags;
+
+#ifdef CONFIG_YAFFS_DISABLE_LAZY_LOAD
+        param->disable_lazy_load = 1;
+#endif
+#ifdef CONFIG_YAFFS_XATTR
+        param->enable_xattr = 1;
+#endif
+        if (options.lazy_loading_overridden)
+                param->disable_lazy_load = !options.lazy_loading_enabled;
+
+#ifdef CONFIG_YAFFS_DISABLE_TAGS_ECC
+        param->no_tags_ecc = 1;
+#endif
+
+#ifdef CONFIG_YAFFS_DISABLE_BACKGROUND
+#else
+        param->defered_dir_update = 1;
+#endif
+
+        if (options.tags_ecc_overridden)
+                param->no_tags_ecc = !options.tags_ecc_on;
+
+#ifdef CONFIG_YAFFS_EMPTY_LOST_AND_FOUND
+        param->empty_lost_n_found = 1;
+#endif
+
+#ifdef CONFIG_YAFFS_DISABLE_BLOCK_REFRESHING
+        param->refresh_period = 0;
+#else
+        param->refresh_period = 500;
+#endif
+
+#ifdef CONFIG_YAFFS_ALWAYS_CHECK_CHUNK_ERASED
+        param->always_check_erased = 1;
+#endif
+
+        if (options.empty_lost_and_found_overridden)
+                param->empty_lost_n_found = options.empty_lost_and_found;
+
+        /* ... and the functions. */
+        if (yaffs_version == 2) {
+                param->write_chunk_tags_fn = nandmtd2_write_chunk_tags;
+                param->read_chunk_tags_fn = nandmtd2_read_chunk_tags;
+                param->bad_block_fn = nandmtd2_mark_block_bad;
+                param->query_block_fn = nandmtd2_query_block;
+                yaffs_dev_to_lc(dev)->spare_buffer = 
+                                kmalloc(mtd->oobsize, GFP_NOFS);
+                param->is_yaffs2 = 1;
+                param->total_bytes_per_chunk = mtd->writesize;
+                param->chunks_per_block = mtd->erasesize / mtd->writesize;
+                n_blocks = YCALCBLOCKS(mtd->size, mtd->erasesize);
+
+                param->start_block = 0;
+                param->end_block = n_blocks - 1;
+        } else {
+                /* use the MTD interface in yaffs_mtdif1.c */
+                param->write_chunk_tags_fn = nandmtd1_write_chunk_tags;
+                param->read_chunk_tags_fn = nandmtd1_read_chunk_tags;
+                param->bad_block_fn = nandmtd1_mark_block_bad;
+                param->query_block_fn = nandmtd1_query_block;
+                param->is_yaffs2 = 0;
+        }
+        /* ... and common functions */
+        param->erase_fn = nandmtd_erase_block;
+        param->initialise_flash_fn = nandmtd_initialise;
+
+        yaffs_dev_to_lc(dev)->put_super_fn = yaffs_mtd_put_super;
+
+        param->sb_dirty_fn = yaffs_touch_super;
+        param->gc_control = yaffs_gc_control_callback;
+
+        yaffs_dev_to_lc(dev)->super = sb;
+
+#ifndef CONFIG_YAFFS_DOES_ECC
+        param->use_nand_ecc = 1;
+#endif
+
+        param->skip_checkpt_rd = options.skip_checkpoint_read;
+        param->skip_checkpt_wr = options.skip_checkpoint_write;
+
+        mutex_lock(&yaffs_context_lock);
+        /* Get a mount id */
+        found = 0;
+        for (mount_id = 0; !found; mount_id++) {
+                found = 1;
+                list_for_each(l, &yaffs_context_list) {
+                        context_iterator =
+                            list_entry(l, struct yaffs_linux_context,
+                                       context_list);
+                        if (context_iterator->mount_id == mount_id)
+                                found = 0;
+                }
+        }
+        context->mount_id = mount_id;
+
+        list_add_tail(&(yaffs_dev_to_lc(dev)->context_list),
+                      &yaffs_context_list);
+        mutex_unlock(&yaffs_context_lock);
+
+        /* Directory search handling... */
+        INIT_LIST_HEAD(&(yaffs_dev_to_lc(dev)->search_contexts));
+        param->remove_obj_fn = yaffs_remove_obj_callback;
+
+        mutex_init(&(yaffs_dev_to_lc(dev)->gross_lock));
+
+        yaffs_gross_lock(dev);
+
+        err = yaffs_guts_initialise(dev);
+
+        yaffs_trace(YAFFS_TRACE_OS,
+                "yaffs_read_super: guts initialised %s",
+                (err == YAFFS_OK) ? "OK" : "FAILED");
+
+        if (err == YAFFS_OK)
+                yaffs_bg_start(dev);
+
+        if (!context->bg_thread)
+                param->defered_dir_update = 0;
+
+        /* Release lock before yaffs_get_inode() */
+        yaffs_gross_unlock(dev);
+
+        /* Create root inode */
+        if (err == YAFFS_OK)
+                inode = yaffs_get_inode(sb, S_IFDIR | 0755, 0, yaffs_root(dev));
+
+        if (!inode)
+                return NULL;
+
+        inode->i_op = &yaffs_dir_inode_operations;
+        inode->i_fop = &yaffs_dir_operations;
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_read_super: got root inode");
+
+        root = d_alloc_root(inode);
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_read_super: d_alloc_root done");
+
+        if (!root) {
+                iput(inode);
+                return NULL;
+        }
+        sb->s_root = root;
+        sb->s_dirt = !dev->is_checkpointed;
+        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                "yaffs_read_super: is_checkpointed %d",
+                dev->is_checkpointed);
+
+        yaffs_trace(YAFFS_TRACE_OS, "yaffs_read_super: done");
+        return sb;
+}
+
+static int yaffs_internal_read_super_mtd(struct super_block *sb, void *data,
+                                         int silent)
+{
+        return yaffs_internal_read_super(1, sb, data, silent) ? 0 : -EINVAL;
+}
+
+static int yaffs_read_super(struct file_system_type *fs,
+                            int flags, const char *dev_name,
+                            void *data, struct vfsmount *mnt)
+{
+
+        return get_sb_bdev(fs, flags, dev_name, data,
+                           yaffs_internal_read_super_mtd, mnt);
+}
+
+static struct file_system_type yaffs_fs_type = {
+        .owner = THIS_MODULE,
+        .name = "yaffs",
+        .get_sb = yaffs_read_super,
+        .kill_sb = kill_block_super,
+        .fs_flags = FS_REQUIRES_DEV,
+};
+
+#ifdef CONFIG_YAFFS_YAFFS2
+
+static int yaffs2_internal_read_super_mtd(struct super_block *sb, void *data,
+                                          int silent)
+{
+        return yaffs_internal_read_super(2, sb, data, silent) ? 0 : -EINVAL;
+}
+
+static int yaffs2_read_super(struct file_system_type *fs,
+                             int flags, const char *dev_name, void *data,
+                             struct vfsmount *mnt)
+{
+        return get_sb_bdev(fs, flags, dev_name, data,
+                           yaffs2_internal_read_super_mtd, mnt);
+}
+
+static struct file_system_type yaffs2_fs_type = {
+        .owner = THIS_MODULE,
+        .name = "yaffs2",
+        .get_sb = yaffs2_read_super,
+        .kill_sb = kill_block_super,
+        .fs_flags = FS_REQUIRES_DEV,
+};
+#endif /* CONFIG_YAFFS_YAFFS2 */
+
+static struct proc_dir_entry *my_proc_entry;
+
+static char *yaffs_dump_dev_part0(char *buf, struct yaffs_dev *dev)
+{
+        struct yaffs_param *param = &dev->param;
+        buf += sprintf(buf, "start_block........... %d\n", param->start_block);
+        buf += sprintf(buf, "end_block............. %d\n", param->end_block);
+        buf += sprintf(buf, "total_bytes_per_chunk. %d\n",
+                        param->total_bytes_per_chunk);
+        buf += sprintf(buf, "use_nand_ecc.......... %d\n",
+                        param->use_nand_ecc);
+        buf += sprintf(buf, "no_tags_ecc........... %d\n", param->no_tags_ecc);
+        buf += sprintf(buf, "is_yaffs2............. %d\n", param->is_yaffs2);
+        buf += sprintf(buf, "inband_tags........... %d\n", param->inband_tags);
+        buf += sprintf(buf, "empty_lost_n_found.... %d\n",
+                        param->empty_lost_n_found);
+        buf += sprintf(buf, "disable_lazy_load..... %d\n",
+                        param->disable_lazy_load);
+        buf += sprintf(buf, "refresh_period........ %d\n",
+                        param->refresh_period);
+        buf += sprintf(buf, "n_caches.............. %d\n", param->n_caches);
+        buf += sprintf(buf, "n_reserved_blocks..... %d\n",
+                        param->n_reserved_blocks);
+        buf += sprintf(buf, "always_check_erased... %d\n",
+                        param->always_check_erased);
+
+        return buf;
+}
+
+static char *yaffs_dump_dev_part1(char *buf, struct yaffs_dev *dev)
+{
+        buf +=
+            sprintf(buf, "data_bytes_per_chunk.. %d\n",
+                    dev->data_bytes_per_chunk);
+        buf += sprintf(buf, "chunk_grp_bits........ %d\n", dev->chunk_grp_bits);
+        buf += sprintf(buf, "chunk_grp_size........ %d\n", dev->chunk_grp_size);
+        buf +=
+            sprintf(buf, "n_erased_blocks....... %d\n", dev->n_erased_blocks);
+        buf +=
+            sprintf(buf, "blocks_in_checkpt..... %d\n", dev->blocks_in_checkpt);
+        buf += sprintf(buf, "\n");
+        buf += sprintf(buf, "n_tnodes.............. %d\n", dev->n_tnodes);
+        buf += sprintf(buf, "n_obj................. %d\n", dev->n_obj);
+        buf += sprintf(buf, "n_free_chunks......... %d\n", dev->n_free_chunks);
+        buf += sprintf(buf, "\n");
+        buf += sprintf(buf, "n_page_writes......... %u\n", dev->n_page_writes);
+        buf += sprintf(buf, "n_page_reads.......... %u\n", dev->n_page_reads);
+        buf += sprintf(buf, "n_erasures............ %u\n", dev->n_erasures);
+        buf += sprintf(buf, "n_gc_copies........... %u\n", dev->n_gc_copies);
+        buf += sprintf(buf, "all_gcs............... %u\n", dev->all_gcs);
+        buf +=
+            sprintf(buf, "passive_gc_count...... %u\n", dev->passive_gc_count);
+        buf +=
+            sprintf(buf, "oldest_dirty_gc_count. %u\n",
+                    dev->oldest_dirty_gc_count);
+        buf += sprintf(buf, "n_gc_blocks........... %u\n", dev->n_gc_blocks);
+        buf += sprintf(buf, "bg_gcs................ %u\n", dev->bg_gcs);
+        buf +=
+            sprintf(buf, "n_retired_writes...... %u\n", dev->n_retired_writes);
+        buf +=
+            sprintf(buf, "n_retired_blocks...... %u\n", dev->n_retired_blocks);
+        buf += sprintf(buf, "n_ecc_fixed........... %u\n", dev->n_ecc_fixed);
+        buf += sprintf(buf, "n_ecc_unfixed......... %u\n", dev->n_ecc_unfixed);
+        buf +=
+            sprintf(buf, "n_tags_ecc_fixed...... %u\n", dev->n_tags_ecc_fixed);
+        buf +=
+            sprintf(buf, "n_tags_ecc_unfixed.... %u\n",
+                    dev->n_tags_ecc_unfixed);
+        buf += sprintf(buf, "cache_hits............ %u\n", dev->cache_hits);
+        buf +=
+            sprintf(buf, "n_deleted_files....... %u\n", dev->n_deleted_files);
+        buf +=
+            sprintf(buf, "n_unlinked_files...... %u\n", dev->n_unlinked_files);
+        buf += sprintf(buf, "refresh_count......... %u\n", dev->refresh_count);
+        buf += sprintf(buf, "n_bg_deletions........ %u\n", dev->n_bg_deletions);
+
+        return buf;
+}
+
+static int yaffs_proc_read(char *page,
+                           char **start,
+                           off_t offset, int count, int *eof, void *data)
+{
+        struct list_head *item;
+        char *buf = page;
+        int step = offset;
+        int n = 0;
+
+        /* Get proc_file_read() to step 'offset' by one on each sucessive call.
+         * We use 'offset' (*ppos) to indicate where we are in dev_list.
+         * This also assumes the user has posted a read buffer large
+         * enough to hold the complete output; but that's life in /proc.
+         */
+
+        *(int *)start = 1;
+
+        /* Print header first */
+        if (step == 0)
+                buf += sprintf(buf, "YAFFS built:" __DATE__ " " __TIME__ "\n");
+        else if (step == 1)
+                buf += sprintf(buf, "\n");
+        else {
+                step -= 2;
+
+                mutex_lock(&yaffs_context_lock);
+
+                /* Locate and print the Nth entry.  Order N-squared but N is small. */
+                list_for_each(item, &yaffs_context_list) {
+                        struct yaffs_linux_context *dc =
+                            list_entry(item, struct yaffs_linux_context,
+                                       context_list);
+                        struct yaffs_dev *dev = dc->dev;
+
+                        if (n < (step & ~1)) {
+                                n += 2;
+                                continue;
+                        }
+                        if ((step & 1) == 0) {
+                                buf +=
+                                    sprintf(buf, "\nDevice %d \"%s\"\n", n,
+                                            dev->param.name);
+                                buf = yaffs_dump_dev_part0(buf, dev);
+                        } else {
+                                buf = yaffs_dump_dev_part1(buf, dev);
+                        }
+
+                        break;
+                }
+                mutex_unlock(&yaffs_context_lock);
+        }
+
+        return buf - page < count ? buf - page : count;
+}
+
+
+/**
+ * Set the verbosity of the warnings and error messages.
+ *
+ * Note that the names can only be a..z or _ with the current code.
+ */
+
+static struct {
+        char *mask_name;
+        unsigned mask_bitfield;
+} mask_flags[] = {
+        {"allocate", YAFFS_TRACE_ALLOCATE}, 
+        {"always", YAFFS_TRACE_ALWAYS},
+        {"background", YAFFS_TRACE_BACKGROUND},
+        {"bad_blocks", YAFFS_TRACE_BAD_BLOCKS},
+        {"buffers", YAFFS_TRACE_BUFFERS},
+        {"bug", YAFFS_TRACE_BUG},
+        {"checkpt", YAFFS_TRACE_CHECKPOINT},
+        {"deletion", YAFFS_TRACE_DELETION},
+        {"erase", YAFFS_TRACE_ERASE},
+        {"error", YAFFS_TRACE_ERROR},
+        {"gc_detail", YAFFS_TRACE_GC_DETAIL},
+        {"gc", YAFFS_TRACE_GC},
+        {"lock", YAFFS_TRACE_LOCK},
+        {"mtd", YAFFS_TRACE_MTD},
+        {"nandaccess", YAFFS_TRACE_NANDACCESS},
+        {"os", YAFFS_TRACE_OS},
+        {"scan_debug", YAFFS_TRACE_SCAN_DEBUG},
+        {"scan", YAFFS_TRACE_SCAN},
+        {"mount", YAFFS_TRACE_MOUNT},
+        {"tracing", YAFFS_TRACE_TRACING},
+        {"sync", YAFFS_TRACE_SYNC},
+        {"write", YAFFS_TRACE_WRITE},
+        {"verify", YAFFS_TRACE_VERIFY},
+        {"verify_nand", YAFFS_TRACE_VERIFY_NAND},
+        {"verify_full", YAFFS_TRACE_VERIFY_FULL},
+        {"verify_all", YAFFS_TRACE_VERIFY_ALL},
+        {"all", 0xffffffff},
+        {"none", 0},
+        {NULL, 0},
+};
+
+#define MAX_MASK_NAME_LENGTH 40
+static int yaffs_proc_write_trace_options(struct file *file, const char *buf,
+                                          unsigned long count, void *data)
+{
+        unsigned rg = 0, mask_bitfield;
+        char *end;
+        char *mask_name;
+        const char *x;
+        char substring[MAX_MASK_NAME_LENGTH + 1];
+        int i;
+        int done = 0;
+        int add, len = 0;
+        int pos = 0;
+
+        rg = yaffs_trace_mask;
+
+        while (!done && (pos < count)) {
+                done = 1;
+                while ((pos < count) && isspace(buf[pos]))
+                        pos++;
+
+                switch (buf[pos]) {
+                case '+':
+                case '-':
+                case '=':
+                        add = buf[pos];
+                        pos++;
+                        break;
+
+                default:
+                        add = ' ';
+                        break;
+                }
+                mask_name = NULL;
+
+                mask_bitfield = simple_strtoul(buf + pos, &end, 0);
+
+                if (end > buf + pos) {
+                        mask_name = "numeral";
+                        len = end - (buf + pos);
+                        pos += len;
+                        done = 0;
+                } else {
+                        for (x = buf + pos, i = 0;
+                             (*x == '_' || (*x >= 'a' && *x <= 'z')) &&
+                             i < MAX_MASK_NAME_LENGTH; x++, i++, pos++)
+                                substring[i] = *x;
+                        substring[i] = '\0';
+
+                        for (i = 0; mask_flags[i].mask_name != NULL; i++) {
+                                if (strcmp(substring, mask_flags[i].mask_name)
+                                    == 0) {
+                                        mask_name = mask_flags[i].mask_name;
+                                        mask_bitfield =
+                                            mask_flags[i].mask_bitfield;
+                                        done = 0;
+                                        break;
+                                }
+                        }
+                }
+
+                if (mask_name != NULL) {
+                        done = 0;
+                        switch (add) {
+                        case '-':
+                                rg &= ~mask_bitfield;
+                                break;
+                        case '+':
+                                rg |= mask_bitfield;
+                                break;
+                        case '=':
+                                rg = mask_bitfield;
+                                break;
+                        default:
+                                rg |= mask_bitfield;
+                                break;
+                        }
+                }
+        }
+
+        yaffs_trace_mask = rg | YAFFS_TRACE_ALWAYS;
+
+        printk(KERN_DEBUG "new trace = 0x%08X\n", yaffs_trace_mask);
+
+        if (rg & YAFFS_TRACE_ALWAYS) {
+                for (i = 0; mask_flags[i].mask_name != NULL; i++) {
+                        char flag;
+                        flag = ((rg & mask_flags[i].mask_bitfield) ==
+                                mask_flags[i].mask_bitfield) ? '+' : '-';
+                        printk(KERN_DEBUG "%c%s\n", flag,
+                               mask_flags[i].mask_name);
+                }
+        }
+
+        return count;
+}
+
+static int yaffs_proc_write(struct file *file, const char *buf,
+                            unsigned long count, void *data)
+{
+        return yaffs_proc_write_trace_options(file, buf, count, data);
+}
+
+/* Stuff to handle installation of file systems */
+struct file_system_to_install {
+        struct file_system_type *fst;
+        int installed;
+};
+
+static struct file_system_to_install fs_to_install[] = {
+        {&yaffs_fs_type, 0},
+        {&yaffs2_fs_type, 0},
+        {NULL, 0}
+};
+
+static int __init init_yaffs_fs(void)
+{
+        int error = 0;
+        struct file_system_to_install *fsinst;
+
+        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                "yaffs built " __DATE__ " " __TIME__ " Installing.");
+
+#ifdef CONFIG_YAFFS_ALWAYS_CHECK_CHUNK_ERASED
+        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                "\n\nYAFFS-WARNING CONFIG_YAFFS_ALWAYS_CHECK_CHUNK_ERASED selected.\n\n\n");
+#endif
+
+        mutex_init(&yaffs_context_lock);
+
+        /* Install the proc_fs entries */
+        my_proc_entry = create_proc_entry("yaffs",
+                                          S_IRUGO | S_IFREG, YPROC_ROOT);
+
+        if (my_proc_entry) {
+                my_proc_entry->write_proc = yaffs_proc_write;
+                my_proc_entry->read_proc = yaffs_proc_read;
+                my_proc_entry->data = NULL;
+        } else {
+                return -ENOMEM;
+        }
+
+
+        /* Now add the file system entries */
+
+        fsinst = fs_to_install;
+
+        while (fsinst->fst && !error) {
+                error = register_filesystem(fsinst->fst);
+                if (!error)
+                        fsinst->installed = 1;
+                fsinst++;
+        }
+
+        /* Any errors? uninstall  */
+        if (error) {
+                fsinst = fs_to_install;
+
+                while (fsinst->fst) {
+                        if (fsinst->installed) {
+                                unregister_filesystem(fsinst->fst);
+                                fsinst->installed = 0;
+                        }
+                        fsinst++;
+                }
+        }
+
+        return error;
+}
+
+static void __exit exit_yaffs_fs(void)
+{
+
+        struct file_system_to_install *fsinst;
+
+        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                "yaffs built " __DATE__ " " __TIME__ " removing.");
+
+        remove_proc_entry("yaffs", YPROC_ROOT);
+
+        fsinst = fs_to_install;
+
+        while (fsinst->fst) {
+                if (fsinst->installed) {
+                        unregister_filesystem(fsinst->fst);
+                        fsinst->installed = 0;
+                }
+                fsinst++;
+        }
+}
+
+module_init(init_yaffs_fs)
+    module_exit(exit_yaffs_fs)
+
+    MODULE_DESCRIPTION("YAFFS2 - a NAND specific flash file system");
+MODULE_AUTHOR("Charles Manning, Aleph One Ltd., 2002-2010");
+MODULE_LICENSE("GPL");
diff --git a/fs/yaffs2/yaffs_yaffs1.c b/fs/yaffs2/yaffs_yaffs1.c
new file mode 100644
index 00000000000..9eb60308254
--- /dev/null
+++ b/fs/yaffs2/yaffs_yaffs1.c
@@ -0,0 +1,433 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_yaffs1.h"
+#include "yportenv.h"
+#include "yaffs_trace.h"
+#include "yaffs_bitmap.h"
+#include "yaffs_getblockinfo.h"
+#include "yaffs_nand.h"
+#include "yaffs_attribs.h"
+
+int yaffs1_scan(struct yaffs_dev *dev)
+{
+        struct yaffs_ext_tags tags;
+        int blk;
+        int result;
+
+        int chunk;
+        int c;
+        int deleted;
+        enum yaffs_block_state state;
+        struct yaffs_obj *hard_list = NULL;
+        struct yaffs_block_info *bi;
+        u32 seq_number;
+        struct yaffs_obj_hdr *oh;
+        struct yaffs_obj *in;
+        struct yaffs_obj *parent;
+
+        int alloc_failed = 0;
+
+        struct yaffs_shadow_fixer *shadow_fixers = NULL;
+
+        u8 *chunk_data;
+
+        yaffs_trace(YAFFS_TRACE_SCAN,
+                "yaffs1_scan starts  intstartblk %d intendblk %d...",
+                dev->internal_start_block, dev->internal_end_block);
+
+        chunk_data = yaffs_get_temp_buffer(dev, __LINE__);
+
+        dev->seq_number = YAFFS_LOWEST_SEQUENCE_NUMBER;
+
+        /* Scan all the blocks to determine their state */
+        bi = dev->block_info;
+        for (blk = dev->internal_start_block; blk <= dev->internal_end_block;
+             blk++) {
+                yaffs_clear_chunk_bits(dev, blk);
+                bi->pages_in_use = 0;
+                bi->soft_del_pages = 0;
+
+                yaffs_query_init_block_state(dev, blk, &state, &seq_number);
+
+                bi->block_state = state;
+                bi->seq_number = seq_number;
+
+                if (bi->seq_number == YAFFS_SEQUENCE_BAD_BLOCK)
+                        bi->block_state = state = YAFFS_BLOCK_STATE_DEAD;
+
+                yaffs_trace(YAFFS_TRACE_SCAN_DEBUG,
+                        "Block scanning block %d state %d seq %d",
+                        blk, state, seq_number);
+
+                if (state == YAFFS_BLOCK_STATE_DEAD) {
+                        yaffs_trace(YAFFS_TRACE_BAD_BLOCKS,
+                                "block %d is bad", blk);
+                } else if (state == YAFFS_BLOCK_STATE_EMPTY) {
+                        yaffs_trace(YAFFS_TRACE_SCAN_DEBUG, "Block empty ");
+                        dev->n_erased_blocks++;
+                        dev->n_free_chunks += dev->param.chunks_per_block;
+                }
+                bi++;
+        }
+
+        /* For each block.... */
+        for (blk = dev->internal_start_block;
+             !alloc_failed && blk <= dev->internal_end_block; blk++) {
+
+                cond_resched();
+
+                bi = yaffs_get_block_info(dev, blk);
+                state = bi->block_state;
+
+                deleted = 0;
+
+                /* For each chunk in each block that needs scanning.... */
+                for (c = 0; !alloc_failed && c < dev->param.chunks_per_block &&
+                     state == YAFFS_BLOCK_STATE_NEEDS_SCANNING; c++) {
+                        /* Read the tags and decide what to do */
+                        chunk = blk * dev->param.chunks_per_block + c;
+
+                        result = yaffs_rd_chunk_tags_nand(dev, chunk, NULL,
+                                                          &tags);
+
+                        /* Let's have a good look at this chunk... */
+
+                        if (tags.ecc_result == YAFFS_ECC_RESULT_UNFIXED
+                            || tags.is_deleted) {
+                                /* YAFFS1 only...
+                                 * A deleted chunk
+                                 */
+                                deleted++;
+                                dev->n_free_chunks++;
+                                /*T((" %d %d deleted\n",blk,c)); */
+                        } else if (!tags.chunk_used) {
+                                /* An unassigned chunk in the block
+                                 * This means that either the block is empty or
+                                 * this is the one being allocated from
+                                 */
+
+                                if (c == 0) {
+                                        /* We're looking at the first chunk in the block so the block is unused */
+                                        state = YAFFS_BLOCK_STATE_EMPTY;
+                                        dev->n_erased_blocks++;
+                                } else {
+                                        /* this is the block being allocated from */
+                                        yaffs_trace(YAFFS_TRACE_SCAN,
+                                                " Allocating from %d %d",
+                                                blk, c);
+                                        state = YAFFS_BLOCK_STATE_ALLOCATING;
+                                        dev->alloc_block = blk;
+                                        dev->alloc_page = c;
+                                        dev->alloc_block_finder = blk;
+                                        /* Set block finder here to encourage the allocator to go forth from here. */
+
+                                }
+
+                                dev->n_free_chunks +=
+                                    (dev->param.chunks_per_block - c);
+                        } else if (tags.chunk_id > 0) {
+                                /* chunk_id > 0 so it is a data chunk... */
+                                unsigned int endpos;
+
+                                yaffs_set_chunk_bit(dev, blk, c);
+                                bi->pages_in_use++;
+
+                                in = yaffs_find_or_create_by_number(dev,
+                                                                    tags.obj_id,
+                                                                    YAFFS_OBJECT_TYPE_FILE);
+                                /* PutChunkIntoFile checks for a clash (two data chunks with
+                                 * the same chunk_id).
+                                 */
+
+                                if (!in)
+                                        alloc_failed = 1;
+
+                                if (in) {
+                                        if (!yaffs_put_chunk_in_file
+                                            (in, tags.chunk_id, chunk, 1))
+                                                alloc_failed = 1;
+                                }
+
+                                endpos =
+                                    (tags.chunk_id -
+                                     1) * dev->data_bytes_per_chunk +
+                                    tags.n_bytes;
+                                if (in
+                                    && in->variant_type ==
+                                    YAFFS_OBJECT_TYPE_FILE
+                                    && in->variant.file_variant.scanned_size <
+                                    endpos) {
+                                        in->variant.file_variant.scanned_size =
+                                            endpos;
+                                        if (!dev->param.use_header_file_size) {
+                                                in->variant.
+                                                    file_variant.file_size =
+                                                    in->variant.
+                                                    file_variant.scanned_size;
+                                        }
+
+                                }
+                                /* T((" %d %d data %d %d\n",blk,c,tags.obj_id,tags.chunk_id));   */
+                        } else {
+                                /* chunk_id == 0, so it is an ObjectHeader.
+                                 * Thus, we read in the object header and make the object
+                                 */
+                                yaffs_set_chunk_bit(dev, blk, c);
+                                bi->pages_in_use++;
+
+                                result = yaffs_rd_chunk_tags_nand(dev, chunk,
+                                                                  chunk_data,
+                                                                  NULL);
+
+                                oh = (struct yaffs_obj_hdr *)chunk_data;
+
+                                in = yaffs_find_by_number(dev, tags.obj_id);
+                                if (in && in->variant_type != oh->type) {
+                                        /* This should not happen, but somehow
+                                         * Wev'e ended up with an obj_id that has been reused but not yet
+                                         * deleted, and worse still it has changed type. Delete the old object.
+                                         */
+
+                                        yaffs_del_obj(in);
+
+                                        in = 0;
+                                }
+
+                                in = yaffs_find_or_create_by_number(dev,
+                                                                    tags.obj_id,
+                                                                    oh->type);
+
+                                if (!in)
+                                        alloc_failed = 1;
+
+                                if (in && oh->shadows_obj > 0) {
+
+                                        struct yaffs_shadow_fixer *fixer;
+                                        fixer =
+                                                kmalloc(sizeof
+                                                (struct yaffs_shadow_fixer),
+                                                GFP_NOFS);
+                                        if (fixer) {
+                                                fixer->next = shadow_fixers;
+                                                shadow_fixers = fixer;
+                                                fixer->obj_id = tags.obj_id;
+                                                fixer->shadowed_id =
+                                                    oh->shadows_obj;
+                                                yaffs_trace(YAFFS_TRACE_SCAN,
+                                                        " Shadow fixer: %d shadows %d",
+                                                        fixer->obj_id,
+                                                        fixer->shadowed_id);
+
+                                        }
+
+                                }
+
+                                if (in && in->valid) {
+                                        /* We have already filled this one. We have a duplicate and need to resolve it. */
+
+                                        unsigned existing_serial = in->serial;
+                                        unsigned new_serial =
+                                            tags.serial_number;
+
+                                        if (((existing_serial + 1) & 3) ==
+                                            new_serial) {
+                                                /* Use new one - destroy the exisiting one */
+                                                yaffs_chunk_del(dev,
+                                                                in->hdr_chunk,
+                                                                1, __LINE__);
+                                                in->valid = 0;
+                                        } else {
+                                                /* Use existing - destroy this one. */
+                                                yaffs_chunk_del(dev, chunk, 1,
+                                                                __LINE__);
+                                        }
+                                }
+
+                                if (in && !in->valid &&
+                                    (tags.obj_id == YAFFS_OBJECTID_ROOT ||
+                                     tags.obj_id ==
+                                     YAFFS_OBJECTID_LOSTNFOUND)) {
+                                        /* We only load some info, don't fiddle with directory structure */
+                                        in->valid = 1;
+                                        in->variant_type = oh->type;
+
+                                        in->yst_mode = oh->yst_mode;
+                                        yaffs_load_attribs(in, oh);
+                                        in->hdr_chunk = chunk;
+                                        in->serial = tags.serial_number;
+
+                                } else if (in && !in->valid) {
+                                        /* we need to load this info */
+
+                                        in->valid = 1;
+                                        in->variant_type = oh->type;
+
+                                        in->yst_mode = oh->yst_mode;
+                                        yaffs_load_attribs(in, oh);
+                                        in->hdr_chunk = chunk;
+                                        in->serial = tags.serial_number;
+
+                                        yaffs_set_obj_name_from_oh(in, oh);
+                                        in->dirty = 0;
+
+                                        /* directory stuff...
+                                         * hook up to parent
+                                         */
+
+                                        parent =
+                                            yaffs_find_or_create_by_number
+                                            (dev, oh->parent_obj_id,
+                                             YAFFS_OBJECT_TYPE_DIRECTORY);
+                                        if (!parent)
+                                                alloc_failed = 1;
+                                        if (parent && parent->variant_type ==
+                                            YAFFS_OBJECT_TYPE_UNKNOWN) {
+                                                /* Set up as a directory */
+                                                parent->variant_type =
+                                                    YAFFS_OBJECT_TYPE_DIRECTORY;
+                                                INIT_LIST_HEAD(&parent->
+                                                               variant.dir_variant.children);
+                                        } else if (!parent
+                                                   || parent->variant_type !=
+                                                   YAFFS_OBJECT_TYPE_DIRECTORY) {
+                                                /* Hoosterman, another problem....
+                                                 * We're trying to use a non-directory as a directory
+                                                 */
+
+                                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                                        "yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found."
+                                                        );
+                                                parent = dev->lost_n_found;
+                                        }
+
+                                        yaffs_add_obj_to_dir(parent, in);
+
+                                        if (0 && (parent == dev->del_dir ||
+                                                  parent ==
+                                                  dev->unlinked_dir)) {
+                                                in->deleted = 1;        /* If it is unlinked at start up then it wants deleting */
+                                                dev->n_deleted_files++;
+                                        }
+                                        /* Note re hardlinks.
+                                         * Since we might scan a hardlink before its equivalent object is scanned
+                                         * we put them all in a list.
+                                         * After scanning is complete, we should have all the objects, so we run through this
+                                         * list and fix up all the chains.
+                                         */
+
+                                        switch (in->variant_type) {
+                                        case YAFFS_OBJECT_TYPE_UNKNOWN:
+                                                /* Todo got a problem */
+                                                break;
+                                        case YAFFS_OBJECT_TYPE_FILE:
+                                                if (dev->param.
+                                                    use_header_file_size)
+
+                                                        in->variant.
+                                                            file_variant.file_size
+                                                            = oh->file_size;
+
+                                                break;
+                                        case YAFFS_OBJECT_TYPE_HARDLINK:
+                                                in->variant.
+                                                    hardlink_variant.equiv_id =
+                                                    oh->equiv_id;
+                                                in->hard_links.next =
+                                                    (struct list_head *)
+                                                    hard_list;
+                                                hard_list = in;
+                                                break;
+                                        case YAFFS_OBJECT_TYPE_DIRECTORY:
+                                                /* Do nothing */
+                                                break;
+                                        case YAFFS_OBJECT_TYPE_SPECIAL:
+                                                /* Do nothing */
+                                                break;
+                                        case YAFFS_OBJECT_TYPE_SYMLINK:
+                                                in->variant.symlink_variant.
+                                                    alias =
+                                                    yaffs_clone_str(oh->alias);
+                                                if (!in->variant.
+                                                    symlink_variant.alias)
+                                                        alloc_failed = 1;
+                                                break;
+                                        }
+
+                                }
+                        }
+                }
+
+                if (state == YAFFS_BLOCK_STATE_NEEDS_SCANNING) {
+                        /* If we got this far while scanning, then the block is fully allocated. */
+                        state = YAFFS_BLOCK_STATE_FULL;
+                }
+
+                if (state == YAFFS_BLOCK_STATE_ALLOCATING) {
+                        /* If the block was partially allocated then treat it as fully allocated. */
+                        state = YAFFS_BLOCK_STATE_FULL;
+                        dev->alloc_block = -1;
+                }
+
+                bi->block_state = state;
+
+                /* Now let's see if it was dirty */
+                if (bi->pages_in_use == 0 &&
+                    !bi->has_shrink_hdr &&
+                    bi->block_state == YAFFS_BLOCK_STATE_FULL) {
+                        yaffs_block_became_dirty(dev, blk);
+                }
+
+        }
+
+        /* Ok, we've done all the scanning.
+         * Fix up the hard link chains.
+         * We should now have scanned all the objects, now it's time to add these
+         * hardlinks.
+         */
+
+        yaffs_link_fixup(dev, hard_list);
+
+        /* Fix up any shadowed objects */
+        {
+                struct yaffs_shadow_fixer *fixer;
+                struct yaffs_obj *obj;
+
+                while (shadow_fixers) {
+                        fixer = shadow_fixers;
+                        shadow_fixers = fixer->next;
+                        /* Complete the rename transaction by deleting the shadowed object
+                         * then setting the object header to unshadowed.
+                         */
+                        obj = yaffs_find_by_number(dev, fixer->shadowed_id);
+                        if (obj)
+                                yaffs_del_obj(obj);
+
+                        obj = yaffs_find_by_number(dev, fixer->obj_id);
+
+                        if (obj)
+                                yaffs_update_oh(obj, NULL, 1, 0, 0, NULL);
+
+                        kfree(fixer);
+                }
+        }
+
+        yaffs_release_temp_buffer(dev, chunk_data, __LINE__);
+
+        if (alloc_failed)
+                return YAFFS_FAIL;
+
+        yaffs_trace(YAFFS_TRACE_SCAN, "yaffs1_scan ends");
+
+        return YAFFS_OK;
+}
diff --git a/fs/yaffs2/yaffs_yaffs1.h b/fs/yaffs2/yaffs_yaffs1.h
new file mode 100644
index 00000000000..db23e04973b
--- /dev/null
+++ b/fs/yaffs2/yaffs_yaffs1.h
@@ -0,0 +1,22 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_YAFFS1_H__
+#define __YAFFS_YAFFS1_H__
+
+#include "yaffs_guts.h"
+int yaffs1_scan(struct yaffs_dev *dev);
+
+#endif
diff --git a/fs/yaffs2/yaffs_yaffs2.c b/fs/yaffs2/yaffs_yaffs2.c
new file mode 100644
index 00000000000..33397af7003
--- /dev/null
+++ b/fs/yaffs2/yaffs_yaffs2.c
@@ -0,0 +1,1598 @@
+/*
+ * YAFFS: Yet Another Flash File System. A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "yaffs_guts.h"
+#include "yaffs_trace.h"
+#include "yaffs_yaffs2.h"
+#include "yaffs_checkptrw.h"
+#include "yaffs_bitmap.h"
+#include "yaffs_nand.h"
+#include "yaffs_getblockinfo.h"
+#include "yaffs_verify.h"
+#include "yaffs_attribs.h"
+
+/*
+ * Checkpoints are really no benefit on very small partitions.
+ *
+ * To save space on small partitions don't bother with checkpoints unless
+ * the partition is at least this big.
+ */
+#define YAFFS_CHECKPOINT_MIN_BLOCKS 60
+
+#define YAFFS_SMALL_HOLE_THRESHOLD 4
+
+/*
+ * Oldest Dirty Sequence Number handling.
+ */
+
+/* yaffs_calc_oldest_dirty_seq()
+ * yaffs2_find_oldest_dirty_seq()
+ * Calculate the oldest dirty sequence number if we don't know it.
+ */
+void yaffs_calc_oldest_dirty_seq(struct yaffs_dev *dev)
+{
+        int i;
+        unsigned seq;
+        unsigned block_no = 0;
+        struct yaffs_block_info *b;
+
+        if (!dev->param.is_yaffs2)
+                return;
+
+        /* Find the oldest dirty sequence number. */
+        seq = dev->seq_number + 1;
+        b = dev->block_info;
+        for (i = dev->internal_start_block; i <= dev->internal_end_block; i++) {
+                if (b->block_state == YAFFS_BLOCK_STATE_FULL &&
+                    (b->pages_in_use - b->soft_del_pages) <
+                    dev->param.chunks_per_block && b->seq_number < seq) {
+                        seq = b->seq_number;
+                        block_no = i;
+                }
+                b++;
+        }
+
+        if (block_no) {
+                dev->oldest_dirty_seq = seq;
+                dev->oldest_dirty_block = block_no;
+        }
+
+}
+
+void yaffs2_find_oldest_dirty_seq(struct yaffs_dev *dev)
+{
+        if (!dev->param.is_yaffs2)
+                return;
+
+        if (!dev->oldest_dirty_seq)
+                yaffs_calc_oldest_dirty_seq(dev);
+}
+
+/*
+ * yaffs_clear_oldest_dirty_seq()
+ * Called when a block is erased or marked bad. (ie. when its seq_number
+ * becomes invalid). If the value matches the oldest then we clear 
+ * dev->oldest_dirty_seq to force its recomputation.
+ */
+void yaffs2_clear_oldest_dirty_seq(struct yaffs_dev *dev,
+                                   struct yaffs_block_info *bi)
+{
+
+        if (!dev->param.is_yaffs2)
+                return;
+
+        if (!bi || bi->seq_number == dev->oldest_dirty_seq) {
+                dev->oldest_dirty_seq = 0;
+                dev->oldest_dirty_block = 0;
+        }
+}
+
+/*
+ * yaffs2_update_oldest_dirty_seq()
+ * Update the oldest dirty sequence number whenever we dirty a block.
+ * Only do this if the oldest_dirty_seq is actually being tracked.
+ */
+void yaffs2_update_oldest_dirty_seq(struct yaffs_dev *dev, unsigned block_no,
+                                    struct yaffs_block_info *bi)
+{
+        if (!dev->param.is_yaffs2)
+                return;
+
+        if (dev->oldest_dirty_seq) {
+                if (dev->oldest_dirty_seq > bi->seq_number) {
+                        dev->oldest_dirty_seq = bi->seq_number;
+                        dev->oldest_dirty_block = block_no;
+                }
+        }
+}
+
+int yaffs_block_ok_for_gc(struct yaffs_dev *dev, struct yaffs_block_info *bi)
+{
+
+        if (!dev->param.is_yaffs2)
+                return 1;       /* disqualification only applies to yaffs2. */
+
+        if (!bi->has_shrink_hdr)
+                return 1;       /* can gc */
+
+        yaffs2_find_oldest_dirty_seq(dev);
+
+        /* Can't do gc of this block if there are any blocks older than this one that have
+         * discarded pages.
+         */
+        return (bi->seq_number <= dev->oldest_dirty_seq);
+}
+
+/*
+ * yaffs2_find_refresh_block()
+ * periodically finds the oldest full block by sequence number for refreshing.
+ * Only for yaffs2.
+ */
+u32 yaffs2_find_refresh_block(struct yaffs_dev * dev)
+{
+        u32 b;
+
+        u32 oldest = 0;
+        u32 oldest_seq = 0;
+
+        struct yaffs_block_info *bi;
+
+        if (!dev->param.is_yaffs2)
+                return oldest;
+
+        /*
+         * If refresh period < 10 then refreshing is disabled.
+         */
+        if (dev->param.refresh_period < 10)
+                return oldest;
+
+        /*
+         * Fix broken values.
+         */
+        if (dev->refresh_skip > dev->param.refresh_period)
+                dev->refresh_skip = dev->param.refresh_period;
+
+        if (dev->refresh_skip > 0)
+                return oldest;
+
+        /*
+         * Refresh skip is now zero.
+         * We'll do a refresh this time around....
+         * Update the refresh skip and find the oldest block.
+         */
+        dev->refresh_skip = dev->param.refresh_period;
+        dev->refresh_count++;
+        bi = dev->block_info;
+        for (b = dev->internal_start_block; b <= dev->internal_end_block; b++) {
+
+                if (bi->block_state == YAFFS_BLOCK_STATE_FULL) {
+
+                        if (oldest < 1 || bi->seq_number < oldest_seq) {
+                                oldest = b;
+                                oldest_seq = bi->seq_number;
+                        }
+                }
+                bi++;
+        }
+
+        if (oldest > 0) {
+                yaffs_trace(YAFFS_TRACE_GC,
+                        "GC refresh count %d selected block %d with seq_number %d",
+                        dev->refresh_count, oldest, oldest_seq);
+        }
+
+        return oldest;
+}
+
+int yaffs2_checkpt_required(struct yaffs_dev *dev)
+{
+        int nblocks;
+
+        if (!dev->param.is_yaffs2)
+                return 0;
+
+        nblocks = dev->internal_end_block - dev->internal_start_block + 1;
+
+        return !dev->param.skip_checkpt_wr &&
+            !dev->read_only && (nblocks >= YAFFS_CHECKPOINT_MIN_BLOCKS);
+}
+
+int yaffs_calc_checkpt_blocks_required(struct yaffs_dev *dev)
+{
+        int retval;
+
+        if (!dev->param.is_yaffs2)
+                return 0;
+
+        if (!dev->checkpoint_blocks_required && yaffs2_checkpt_required(dev)) {
+                /* Not a valid value so recalculate */
+                int n_bytes = 0;
+                int n_blocks;
+                int dev_blocks =
+                    (dev->param.end_block - dev->param.start_block + 1);
+
+                n_bytes += sizeof(struct yaffs_checkpt_validity);
+                n_bytes += sizeof(struct yaffs_checkpt_dev);
+                n_bytes += dev_blocks * sizeof(struct yaffs_block_info);
+                n_bytes += dev_blocks * dev->chunk_bit_stride;
+                n_bytes +=
+                    (sizeof(struct yaffs_checkpt_obj) +
+                     sizeof(u32)) * (dev->n_obj);
+                n_bytes += (dev->tnode_size + sizeof(u32)) * (dev->n_tnodes);
+                n_bytes += sizeof(struct yaffs_checkpt_validity);
+                n_bytes += sizeof(u32); /* checksum */
+
+                /* Round up and add 2 blocks to allow for some bad blocks, so add 3 */
+
+                n_blocks =
+                    (n_bytes /
+                     (dev->data_bytes_per_chunk *
+                      dev->param.chunks_per_block)) + 3;
+
+                dev->checkpoint_blocks_required = n_blocks;
+        }
+
+        retval = dev->checkpoint_blocks_required - dev->blocks_in_checkpt;
+        if (retval < 0)
+                retval = 0;
+        return retval;
+}
+
+/*--------------------- Checkpointing --------------------*/
+
+static int yaffs2_wr_checkpt_validity_marker(struct yaffs_dev *dev, int head)
+{
+        struct yaffs_checkpt_validity cp;
+
+        memset(&cp, 0, sizeof(cp));
+
+        cp.struct_type = sizeof(cp);
+        cp.magic = YAFFS_MAGIC;
+        cp.version = YAFFS_CHECKPOINT_VERSION;
+        cp.head = (head) ? 1 : 0;
+
+        return (yaffs2_checkpt_wr(dev, &cp, sizeof(cp)) == sizeof(cp)) ? 1 : 0;
+}
+
+static int yaffs2_rd_checkpt_validity_marker(struct yaffs_dev *dev, int head)
+{
+        struct yaffs_checkpt_validity cp;
+        int ok;
+
+        ok = (yaffs2_checkpt_rd(dev, &cp, sizeof(cp)) == sizeof(cp));
+
+        if (ok)
+                ok = (cp.struct_type == sizeof(cp)) &&
+                    (cp.magic == YAFFS_MAGIC) &&
+                    (cp.version == YAFFS_CHECKPOINT_VERSION) &&
+                    (cp.head == ((head) ? 1 : 0));
+        return ok ? 1 : 0;
+}
+
+static void yaffs2_dev_to_checkpt_dev(struct yaffs_checkpt_dev *cp,
+                                      struct yaffs_dev *dev)
+{
+        cp->n_erased_blocks = dev->n_erased_blocks;
+        cp->alloc_block = dev->alloc_block;
+        cp->alloc_page = dev->alloc_page;
+        cp->n_free_chunks = dev->n_free_chunks;
+
+        cp->n_deleted_files = dev->n_deleted_files;
+        cp->n_unlinked_files = dev->n_unlinked_files;
+        cp->n_bg_deletions = dev->n_bg_deletions;
+        cp->seq_number = dev->seq_number;
+
+}
+
+static void yaffs_checkpt_dev_to_dev(struct yaffs_dev *dev,
+                                     struct yaffs_checkpt_dev *cp)
+{
+        dev->n_erased_blocks = cp->n_erased_blocks;
+        dev->alloc_block = cp->alloc_block;
+        dev->alloc_page = cp->alloc_page;
+        dev->n_free_chunks = cp->n_free_chunks;
+
+        dev->n_deleted_files = cp->n_deleted_files;
+        dev->n_unlinked_files = cp->n_unlinked_files;
+        dev->n_bg_deletions = cp->n_bg_deletions;
+        dev->seq_number = cp->seq_number;
+}
+
+static int yaffs2_wr_checkpt_dev(struct yaffs_dev *dev)
+{
+        struct yaffs_checkpt_dev cp;
+        u32 n_bytes;
+        u32 n_blocks =
+            (dev->internal_end_block - dev->internal_start_block + 1);
+
+        int ok;
+
+        /* Write device runtime values */
+        yaffs2_dev_to_checkpt_dev(&cp, dev);
+        cp.struct_type = sizeof(cp);
+
+        ok = (yaffs2_checkpt_wr(dev, &cp, sizeof(cp)) == sizeof(cp));
+
+        /* Write block info */
+        if (ok) {
+                n_bytes = n_blocks * sizeof(struct yaffs_block_info);
+                ok = (yaffs2_checkpt_wr(dev, dev->block_info, n_bytes) ==
+                      n_bytes);
+        }
+
+        /* Write chunk bits */
+        if (ok) {
+                n_bytes = n_blocks * dev->chunk_bit_stride;
+                ok = (yaffs2_checkpt_wr(dev, dev->chunk_bits, n_bytes) ==
+                      n_bytes);
+        }
+        return ok ? 1 : 0;
+
+}
+
+static int yaffs2_rd_checkpt_dev(struct yaffs_dev *dev)
+{
+        struct yaffs_checkpt_dev cp;
+        u32 n_bytes;
+        u32 n_blocks =
+            (dev->internal_end_block - dev->internal_start_block + 1);
+
+        int ok;
+
+        ok = (yaffs2_checkpt_rd(dev, &cp, sizeof(cp)) == sizeof(cp));
+        if (!ok)
+                return 0;
+
+        if (cp.struct_type != sizeof(cp))
+                return 0;
+
+        yaffs_checkpt_dev_to_dev(dev, &cp);
+
+        n_bytes = n_blocks * sizeof(struct yaffs_block_info);
+
+        ok = (yaffs2_checkpt_rd(dev, dev->block_info, n_bytes) == n_bytes);
+
+        if (!ok)
+                return 0;
+        n_bytes = n_blocks * dev->chunk_bit_stride;
+
+        ok = (yaffs2_checkpt_rd(dev, dev->chunk_bits, n_bytes) == n_bytes);
+
+        return ok ? 1 : 0;
+}
+
+static void yaffs2_obj_checkpt_obj(struct yaffs_checkpt_obj *cp,
+                                   struct yaffs_obj *obj)
+{
+
+        cp->obj_id = obj->obj_id;
+        cp->parent_id = (obj->parent) ? obj->parent->obj_id : 0;
+        cp->hdr_chunk = obj->hdr_chunk;
+        cp->variant_type = obj->variant_type;
+        cp->deleted = obj->deleted;
+        cp->soft_del = obj->soft_del;
+        cp->unlinked = obj->unlinked;
+        cp->fake = obj->fake;
+        cp->rename_allowed = obj->rename_allowed;
+        cp->unlink_allowed = obj->unlink_allowed;
+        cp->serial = obj->serial;
+        cp->n_data_chunks = obj->n_data_chunks;
+
+        if (obj->variant_type == YAFFS_OBJECT_TYPE_FILE)
+                cp->size_or_equiv_obj = obj->variant.file_variant.file_size;
+        else if (obj->variant_type == YAFFS_OBJECT_TYPE_HARDLINK)
+                cp->size_or_equiv_obj = obj->variant.hardlink_variant.equiv_id;
+}
+
+static int taffs2_checkpt_obj_to_obj(struct yaffs_obj *obj,
+                                     struct yaffs_checkpt_obj *cp)
+{
+
+        struct yaffs_obj *parent;
+
+        if (obj->variant_type != cp->variant_type) {
+                yaffs_trace(YAFFS_TRACE_ERROR,
+                        "Checkpoint read object %d type %d chunk %d does not match existing object type %d",
+                        cp->obj_id, cp->variant_type, cp->hdr_chunk,
+                        obj->variant_type);
+                return 0;
+        }
+
+        obj->obj_id = cp->obj_id;
+
+        if (cp->parent_id)
+                parent = yaffs_find_or_create_by_number(obj->my_dev,
+                                                        cp->parent_id,
+                                                        YAFFS_OBJECT_TYPE_DIRECTORY);
+        else
+                parent = NULL;
+
+        if (parent) {
+                if (parent->variant_type != YAFFS_OBJECT_TYPE_DIRECTORY) {
+                        yaffs_trace(YAFFS_TRACE_ALWAYS,
+                                "Checkpoint read object %d parent %d type %d chunk %d Parent type, %d, not directory",
+                                cp->obj_id, cp->parent_id,
+                                cp->variant_type, cp->hdr_chunk,
+                                parent->variant_type);
+                        return 0;
+                }
+                yaffs_add_obj_to_dir(parent, obj);
+        }
+
+        obj->hdr_chunk = cp->hdr_chunk;
+        obj->variant_type = cp->variant_type;
+        obj->deleted = cp->deleted;
+        obj->soft_del = cp->soft_del;
+        obj->unlinked = cp->unlinked;
+        obj->fake = cp->fake;
+        obj->rename_allowed = cp->rename_allowed;
+        obj->unlink_allowed = cp->unlink_allowed;
+        obj->serial = cp->serial;
+        obj->n_data_chunks = cp->n_data_chunks;
+
+        if (obj->variant_type == YAFFS_OBJECT_TYPE_FILE)
+                obj->variant.file_variant.file_size = cp->size_or_equiv_obj;
+        else if (obj->variant_type == YAFFS_OBJECT_TYPE_HARDLINK)
+                obj->variant.hardlink_variant.equiv_id = cp->size_or_equiv_obj;
+
+        if (obj->hdr_chunk > 0)
+                obj->lazy_loaded = 1;
+        return 1;
+}
+
+static int yaffs2_checkpt_tnode_worker(struct yaffs_obj *in,
+                                       struct yaffs_tnode *tn, u32 level,
+                                       int chunk_offset)
+{
+        int i;
+        struct yaffs_dev *dev = in->my_dev;
+        int ok = 1;
+
+        if (tn) {
+                if (level > 0) {
+
+                        for (i = 0; i < YAFFS_NTNODES_INTERNAL && ok; i++) {
+                                if (tn->internal[i]) {
+                                        ok = yaffs2_checkpt_tnode_worker(in,
+                                                                         tn->
+                                                                         internal
+                                                                         [i],
+                                                                         level -
+                                                                         1,
+                                                                         (chunk_offset
+                                                                          <<
+                                                                          YAFFS_TNODES_INTERNAL_BITS)
+                                                                         + i);
+                                }
+                        }
+                } else if (level == 0) {
+                        u32 base_offset =
+                            chunk_offset << YAFFS_TNODES_LEVEL0_BITS;
+                        ok = (yaffs2_checkpt_wr
+                              (dev, &base_offset,
+                               sizeof(base_offset)) == sizeof(base_offset));
+                        if (ok)
+                                ok = (yaffs2_checkpt_wr
+                                      (dev, tn,
+                                       dev->tnode_size) == dev->tnode_size);
+                }
+        }
+
+        return ok;
+
+}
+
+static int yaffs2_wr_checkpt_tnodes(struct yaffs_obj *obj)
+{
+        u32 end_marker = ~0;
+        int ok = 1;
+
+        if (obj->variant_type == YAFFS_OBJECT_TYPE_FILE) {
+                ok = yaffs2_checkpt_tnode_worker(obj,
+                                                 obj->variant.file_variant.top,
+                                                 obj->variant.file_variant.
+                                                 top_level, 0);
+                if (ok)
+                        ok = (yaffs2_checkpt_wr
+                              (obj->my_dev, &end_marker,
+                               sizeof(end_marker)) == sizeof(end_marker));
+        }
+
+        return ok ? 1 : 0;
+}
+
+static int yaffs2_rd_checkpt_tnodes(struct yaffs_obj *obj)
+{
+        u32 base_chunk;
+        int ok = 1;
+        struct yaffs_dev *dev = obj->my_dev;
+        struct yaffs_file_var *file_stuct_ptr = &obj->variant.file_variant;
+        struct yaffs_tnode *tn;
+        int nread = 0;
+
+        ok = (yaffs2_checkpt_rd(dev, &base_chunk, sizeof(base_chunk)) ==
+              sizeof(base_chunk));
+
+        while (ok && (~base_chunk)) {
+                nread++;
+                /* Read level 0 tnode */
+
+                tn = yaffs_get_tnode(dev);
+                if (tn) {
+                        ok = (yaffs2_checkpt_rd(dev, tn, dev->tnode_size) ==
+                              dev->tnode_size);
+                } else {
+                        ok = 0;
+                }
+
+                if (tn && ok)
+                        ok = yaffs_add_find_tnode_0(dev,
+                                                    file_stuct_ptr,
+                                                    base_chunk, tn) ? 1 : 0;
+
+                if (ok)
+                        ok = (yaffs2_checkpt_rd
+                              (dev, &base_chunk,
+                               sizeof(base_chunk)) == sizeof(base_chunk));
+
+        }
+
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                "Checkpoint read tnodes %d records, last %d. ok %d",
+                nread, base_chunk, ok);
+
+        return ok ? 1 : 0;
+}
+
+static int yaffs2_wr_checkpt_objs(struct yaffs_dev *dev)
+{
+        struct yaffs_obj *obj;
+        struct yaffs_checkpt_obj cp;
+        int i;
+        int ok = 1;
+        struct list_head *lh;
+
+        /* Iterate through the objects in each hash entry,
+         * dumping them to the checkpointing stream.
+         */
+
+        for (i = 0; ok && i < YAFFS_NOBJECT_BUCKETS; i++) {
+                list_for_each(lh, &dev->obj_bucket[i].list) {
+                        if (lh) {
+                                obj =
+                                    list_entry(lh, struct yaffs_obj, hash_link);
+                                if (!obj->defered_free) {
+                                        yaffs2_obj_checkpt_obj(&cp, obj);
+                                        cp.struct_type = sizeof(cp);
+
+                                        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                                                "Checkpoint write object %d parent %d type %d chunk %d obj addr %p",
+                                                cp.obj_id, cp.parent_id,
+                                                cp.variant_type, cp.hdr_chunk, obj);
+
+                                        ok = (yaffs2_checkpt_wr
+                                              (dev, &cp,
+                                               sizeof(cp)) == sizeof(cp));
+
+                                        if (ok
+                                            && obj->variant_type ==
+                                            YAFFS_OBJECT_TYPE_FILE)
+                                                ok = yaffs2_wr_checkpt_tnodes
+                                                    (obj);
+                                }
+                        }
+                }
+        }
+
+        /* Dump end of list */
+        memset(&cp, 0xFF, sizeof(struct yaffs_checkpt_obj));
+        cp.struct_type = sizeof(cp);
+
+        if (ok)
+                ok = (yaffs2_checkpt_wr(dev, &cp, sizeof(cp)) == sizeof(cp));
+
+        return ok ? 1 : 0;
+}
+
+static int yaffs2_rd_checkpt_objs(struct yaffs_dev *dev)
+{
+        struct yaffs_obj *obj;
+        struct yaffs_checkpt_obj cp;
+        int ok = 1;
+        int done = 0;
+        struct yaffs_obj *hard_list = NULL;
+
+        while (ok && !done) {
+                ok = (yaffs2_checkpt_rd(dev, &cp, sizeof(cp)) == sizeof(cp));
+                if (cp.struct_type != sizeof(cp)) {
+                        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                                "struct size %d instead of %d ok %d",
+                                cp.struct_type, (int)sizeof(cp), ok);
+                        ok = 0;
+                }
+
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "Checkpoint read object %d parent %d type %d chunk %d ",
+                        cp.obj_id, cp.parent_id, cp.variant_type,
+                        cp.hdr_chunk);
+
+                if (ok && cp.obj_id == ~0) {
+                        done = 1;
+                } else if (ok) {
+                        obj =
+                            yaffs_find_or_create_by_number(dev, cp.obj_id,
+                                                           cp.variant_type);
+                        if (obj) {
+                                ok = taffs2_checkpt_obj_to_obj(obj, &cp);
+                                if (!ok)
+                                        break;
+                                if (obj->variant_type == YAFFS_OBJECT_TYPE_FILE) {
+                                        ok = yaffs2_rd_checkpt_tnodes(obj);
+                                } else if (obj->variant_type ==
+                                           YAFFS_OBJECT_TYPE_HARDLINK) {
+                                        obj->hard_links.next =
+                                            (struct list_head *)hard_list;
+                                        hard_list = obj;
+                                }
+                        } else {
+                                ok = 0;
+                        }
+                }
+        }
+
+        if (ok)
+                yaffs_link_fixup(dev, hard_list);
+
+        return ok ? 1 : 0;
+}
+
+static int yaffs2_wr_checkpt_sum(struct yaffs_dev *dev)
+{
+        u32 checkpt_sum;
+        int ok;
+
+        yaffs2_get_checkpt_sum(dev, &checkpt_sum);
+
+        ok = (yaffs2_checkpt_wr(dev, &checkpt_sum, sizeof(checkpt_sum)) ==
+              sizeof(checkpt_sum));
+
+        if (!ok)
+                return 0;
+
+        return 1;
+}
+
+static int yaffs2_rd_checkpt_sum(struct yaffs_dev *dev)
+{
+        u32 checkpt_sum0;
+        u32 checkpt_sum1;
+        int ok;
+
+        yaffs2_get_checkpt_sum(dev, &checkpt_sum0);
+
+        ok = (yaffs2_checkpt_rd(dev, &checkpt_sum1, sizeof(checkpt_sum1)) ==
+              sizeof(checkpt_sum1));
+
+        if (!ok)
+                return 0;
+
+        if (checkpt_sum0 != checkpt_sum1)
+                return 0;
+
+        return 1;
+}
+
+static int yaffs2_wr_checkpt_data(struct yaffs_dev *dev)
+{
+        int ok = 1;
+
+        if (!yaffs2_checkpt_required(dev)) {
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "skipping checkpoint write");
+                ok = 0;
+        }
+
+        if (ok)
+                ok = yaffs2_checkpt_open(dev, 1);
+
+        if (ok) {
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "write checkpoint validity");
+                ok = yaffs2_wr_checkpt_validity_marker(dev, 1);
+        }
+        if (ok) {
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "write checkpoint device");
+                ok = yaffs2_wr_checkpt_dev(dev);
+        }
+        if (ok) {
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "write checkpoint objects");
+                ok = yaffs2_wr_checkpt_objs(dev);
+        }
+        if (ok) {
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "write checkpoint validity");
+                ok = yaffs2_wr_checkpt_validity_marker(dev, 0);
+        }
+
+        if (ok)
+                ok = yaffs2_wr_checkpt_sum(dev);
+
+        if (!yaffs_checkpt_close(dev))
+                ok = 0;
+
+        if (ok)
+                dev->is_checkpointed = 1;
+        else
+                dev->is_checkpointed = 0;
+
+        return dev->is_checkpointed;
+}
+
+static int yaffs2_rd_checkpt_data(struct yaffs_dev *dev)
+{
+        int ok = 1;
+
+        if (!dev->param.is_yaffs2)
+                ok = 0;
+
+        if (ok && dev->param.skip_checkpt_rd) {
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "skipping checkpoint read");
+                ok = 0;
+        }
+
+        if (ok)
+                ok = yaffs2_checkpt_open(dev, 0); /* open for read */
+
+        if (ok) {
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "read checkpoint validity");
+                ok = yaffs2_rd_checkpt_validity_marker(dev, 1);
+        }
+        if (ok) {
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "read checkpoint device");
+                ok = yaffs2_rd_checkpt_dev(dev);
+        }
+        if (ok) {
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "read checkpoint objects");
+                ok = yaffs2_rd_checkpt_objs(dev);
+        }
+        if (ok) {
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "read checkpoint validity");
+                ok = yaffs2_rd_checkpt_validity_marker(dev, 0);
+        }
+
+        if (ok) {
+                ok = yaffs2_rd_checkpt_sum(dev);
+                yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                        "read checkpoint checksum %d", ok);
+        }
+
+        if (!yaffs_checkpt_close(dev))
+                ok = 0;
+
+        if (ok)
+                dev->is_checkpointed = 1;
+        else
+                dev->is_checkpointed = 0;
+
+        return ok ? 1 : 0;
+
+}
+
+void yaffs2_checkpt_invalidate(struct yaffs_dev *dev)
+{
+        if (dev->is_checkpointed || dev->blocks_in_checkpt > 0) {
+                dev->is_checkpointed = 0;
+                yaffs2_checkpt_invalidate_stream(dev);
+        }
+        if (dev->param.sb_dirty_fn)
+                dev->param.sb_dirty_fn(dev);
+}
+
+int yaffs_checkpoint_save(struct yaffs_dev *dev)
+{
+
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                "save entry: is_checkpointed %d",
+                dev->is_checkpointed);
+
+        yaffs_verify_objects(dev);
+        yaffs_verify_blocks(dev);
+        yaffs_verify_free_chunks(dev);
+
+        if (!dev->is_checkpointed) {
+                yaffs2_checkpt_invalidate(dev);
+                yaffs2_wr_checkpt_data(dev);
+        }
+
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT | YAFFS_TRACE_MOUNT,
+                "save exit: is_checkpointed %d",
+                dev->is_checkpointed);
+
+        return dev->is_checkpointed;
+}
+
+int yaffs2_checkpt_restore(struct yaffs_dev *dev)
+{
+        int retval;
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                "restore entry: is_checkpointed %d",
+                dev->is_checkpointed);
+
+        retval = yaffs2_rd_checkpt_data(dev);
+
+        if (dev->is_checkpointed) {
+                yaffs_verify_objects(dev);
+                yaffs_verify_blocks(dev);
+                yaffs_verify_free_chunks(dev);
+        }
+
+        yaffs_trace(YAFFS_TRACE_CHECKPOINT,
+                "restore exit: is_checkpointed %d",
+                dev->is_checkpointed);
+
+        return retval;
+}
+
+int yaffs2_handle_hole(struct yaffs_obj *obj, loff_t new_size)
+{
+        /* if new_size > old_file_size.
+         * We're going to be writing a hole.
+         * If the hole is small then write zeros otherwise write a start of hole marker.
+         */
+
+        loff_t old_file_size;
+        int increase;
+        int small_hole;
+        int result = YAFFS_OK;
+        struct yaffs_dev *dev = NULL;
+
+        u8 *local_buffer = NULL;
+
+        int small_increase_ok = 0;
+
+        if (!obj)
+                return YAFFS_FAIL;
+
+        if (obj->variant_type != YAFFS_OBJECT_TYPE_FILE)
+                return YAFFS_FAIL;
+
+        dev = obj->my_dev;
+
+        /* Bail out if not yaffs2 mode */
+        if (!dev->param.is_yaffs2)
+                return YAFFS_OK;
+
+        old_file_size = obj->variant.file_variant.file_size;
+
+        if (new_size <= old_file_size)
+                return YAFFS_OK;
+
+        increase = new_size - old_file_size;
+
+        if (increase < YAFFS_SMALL_HOLE_THRESHOLD * dev->data_bytes_per_chunk &&
+            yaffs_check_alloc_available(dev, YAFFS_SMALL_HOLE_THRESHOLD + 1))
+                small_hole = 1;
+        else
+                small_hole = 0;
+
+        if (small_hole)
+                local_buffer = yaffs_get_temp_buffer(dev, __LINE__);
+
+        if (local_buffer) {
+                /* fill hole with zero bytes */
+                int pos = old_file_size;
+                int this_write;
+                int written;
+                memset(local_buffer, 0, dev->data_bytes_per_chunk);
+                small_increase_ok = 1;
+
+                while (increase > 0 && small_increase_ok) {
+                        this_write = increase;
+                        if (this_write > dev->data_bytes_per_chunk)
+                                this_write = dev->data_bytes_per_chunk;
+                        written =
+                            yaffs_do_file_wr(obj, local_buffer, pos, this_write,
+                                             0);
+                        if (written == this_write) {
+                                pos += this_write;
+                                increase -= this_write;
+                        } else {
+                                small_increase_ok = 0;
+                        }
+                }
+
+                yaffs_release_temp_buffer(dev, local_buffer, __LINE__);
+
+                /* If we were out of space then reverse any chunks we've added */
+                if (!small_increase_ok)
+                        yaffs_resize_file_down(obj, old_file_size);
+        }
+
+        if (!small_increase_ok &&
+            obj->parent &&
+            obj->parent->obj_id != YAFFS_OBJECTID_UNLINKED &&
+            obj->parent->obj_id != YAFFS_OBJECTID_DELETED) {
+                /* Write a hole start header with the old file size */
+                yaffs_update_oh(obj, NULL, 0, 1, 0, NULL);
+        }
+
+        return result;
+
+}
+
+struct yaffs_block_index {
+        int seq;
+        int block;
+};
+
+static int yaffs2_ybicmp(const void *a, const void *b)
+{
+        int aseq = ((struct yaffs_block_index *)a)->seq;
+        int bseq = ((struct yaffs_block_index *)b)->seq;
+        int ablock = ((struct yaffs_block_index *)a)->block;
+        int bblock = ((struct yaffs_block_index *)b)->block;
+        if (aseq == bseq)
+                return ablock - bblock;
+        else
+                return aseq - bseq;
+}
+
+int yaffs2_scan_backwards(struct yaffs_dev *dev)
+{
+        struct yaffs_ext_tags tags;
+        int blk;
+        int block_iter;
+        int start_iter;
+        int end_iter;
+        int n_to_scan = 0;
+
+        int chunk;
+        int result;
+        int c;
+        int deleted;
+        enum yaffs_block_state state;
+        struct yaffs_obj *hard_list = NULL;
+        struct yaffs_block_info *bi;
+        u32 seq_number;
+        struct yaffs_obj_hdr *oh;
+        struct yaffs_obj *in;
+        struct yaffs_obj *parent;
+        int n_blocks = dev->internal_end_block - dev->internal_start_block + 1;
+        int is_unlinked;
+        u8 *chunk_data;
+
+        int file_size;
+        int is_shrink;
+        int found_chunks;
+        int equiv_id;
+        int alloc_failed = 0;
+
+        struct yaffs_block_index *block_index = NULL;
+        int alt_block_index = 0;
+
+        yaffs_trace(YAFFS_TRACE_SCAN,
+                "yaffs2_scan_backwards starts  intstartblk %d intendblk %d...",
+                dev->internal_start_block, dev->internal_end_block);
+
+        dev->seq_number = YAFFS_LOWEST_SEQUENCE_NUMBER;
+
+        block_index = kmalloc(n_blocks * sizeof(struct yaffs_block_index),
+                        GFP_NOFS);
+
+        if (!block_index) {
+                block_index =
+                    vmalloc(n_blocks * sizeof(struct yaffs_block_index));
+                alt_block_index = 1;
+        }
+
+        if (!block_index) {
+                yaffs_trace(YAFFS_TRACE_SCAN,
+                        "yaffs2_scan_backwards() could not allocate block index!"
+                        );
+                return YAFFS_FAIL;
+        }
+
+        dev->blocks_in_checkpt = 0;
+
+        chunk_data = yaffs_get_temp_buffer(dev, __LINE__);
+
+        /* Scan all the blocks to determine their state */
+        bi = dev->block_info;
+        for (blk = dev->internal_start_block; blk <= dev->internal_end_block;
+             blk++) {
+                yaffs_clear_chunk_bits(dev, blk);
+                bi->pages_in_use = 0;
+                bi->soft_del_pages = 0;
+
+                yaffs_query_init_block_state(dev, blk, &state, &seq_number);
+
+                bi->block_state = state;
+                bi->seq_number = seq_number;
+
+                if (bi->seq_number == YAFFS_SEQUENCE_CHECKPOINT_DATA)
+                        bi->block_state = state = YAFFS_BLOCK_STATE_CHECKPOINT;
+                if (bi->seq_number == YAFFS_SEQUENCE_BAD_BLOCK)
+                        bi->block_state = state = YAFFS_BLOCK_STATE_DEAD;
+
+                yaffs_trace(YAFFS_TRACE_SCAN_DEBUG,
+                        "Block scanning block %d state %d seq %d",
+                        blk, state, seq_number);
+
+                if (state == YAFFS_BLOCK_STATE_CHECKPOINT) {
+                        dev->blocks_in_checkpt++;
+
+                } else if (state == YAFFS_BLOCK_STATE_DEAD) {
+                        yaffs_trace(YAFFS_TRACE_BAD_BLOCKS,
+                                "block %d is bad", blk);
+                } else if (state == YAFFS_BLOCK_STATE_EMPTY) {
+                        yaffs_trace(YAFFS_TRACE_SCAN_DEBUG, "Block empty ");
+                        dev->n_erased_blocks++;
+                        dev->n_free_chunks += dev->param.chunks_per_block;
+                } else if (state == YAFFS_BLOCK_STATE_NEEDS_SCANNING) {
+
+                        /* Determine the highest sequence number */
+                        if (seq_number >= YAFFS_LOWEST_SEQUENCE_NUMBER &&
+                            seq_number < YAFFS_HIGHEST_SEQUENCE_NUMBER) {
+
+                                block_index[n_to_scan].seq = seq_number;
+                                block_index[n_to_scan].block = blk;
+
+                                n_to_scan++;
+
+                                if (seq_number >= dev->seq_number)
+                                        dev->seq_number = seq_number;
+                        } else {
+                                /* TODO: Nasty sequence number! */
+                                yaffs_trace(YAFFS_TRACE_SCAN,
+                                        "Block scanning block %d has bad sequence number %d",
+                                        blk, seq_number);
+
+                        }
+                }
+                bi++;
+        }
+
+        yaffs_trace(YAFFS_TRACE_SCAN, "%d blocks to be sorted...", n_to_scan);
+
+        cond_resched();
+
+        /* Sort the blocks by sequence number */
+        sort(block_index, n_to_scan, sizeof(struct yaffs_block_index),
+                   yaffs2_ybicmp, NULL);
+
+        cond_resched();
+
+        yaffs_trace(YAFFS_TRACE_SCAN, "...done");
+
+        /* Now scan the blocks looking at the data. */
+        start_iter = 0;
+        end_iter = n_to_scan - 1;
+        yaffs_trace(YAFFS_TRACE_SCAN_DEBUG, "%d blocks to scan", n_to_scan);
+
+        /* For each block.... backwards */
+        for (block_iter = end_iter; !alloc_failed && block_iter >= start_iter;
+             block_iter--) {
+                /* Cooperative multitasking! This loop can run for so
+                   long that watchdog timers expire. */
+                cond_resched();
+
+                /* get the block to scan in the correct order */
+                blk = block_index[block_iter].block;
+
+                bi = yaffs_get_block_info(dev, blk);
+
+                state = bi->block_state;
+
+                deleted = 0;
+
+                /* For each chunk in each block that needs scanning.... */
+                found_chunks = 0;
+                for (c = dev->param.chunks_per_block - 1;
+                     !alloc_failed && c >= 0 &&
+                     (state == YAFFS_BLOCK_STATE_NEEDS_SCANNING ||
+                      state == YAFFS_BLOCK_STATE_ALLOCATING); c--) {
+                        /* Scan backwards...
+                         * Read the tags and decide what to do
+                         */
+
+                        chunk = blk * dev->param.chunks_per_block + c;
+
+                        result = yaffs_rd_chunk_tags_nand(dev, chunk, NULL,
+                                                          &tags);
+
+                        /* Let's have a good look at this chunk... */
+
+                        if (!tags.chunk_used) {
+                                /* An unassigned chunk in the block.
+                                 * If there are used chunks after this one, then
+                                 * it is a chunk that was skipped due to failing the erased
+                                 * check. Just skip it so that it can be deleted.
+                                 * But, more typically, We get here when this is an unallocated
+                                 * chunk and his means that either the block is empty or
+                                 * this is the one being allocated from
+                                 */
+
+                                if (found_chunks) {
+                                        /* This is a chunk that was skipped due to failing the erased check */
+                                } else if (c == 0) {
+                                        /* We're looking at the first chunk in the block so the block is unused */
+                                        state = YAFFS_BLOCK_STATE_EMPTY;
+                                        dev->n_erased_blocks++;
+                                } else {
+                                        if (state ==
+                                            YAFFS_BLOCK_STATE_NEEDS_SCANNING
+                                            || state ==
+                                            YAFFS_BLOCK_STATE_ALLOCATING) {
+                                                if (dev->seq_number ==
+                                                    bi->seq_number) {
+                                                        /* this is the block being allocated from */
+
+                                                        yaffs_trace(YAFFS_TRACE_SCAN,
+                                                                " Allocating from %d %d",
+                                                                blk, c);
+
+                                                        state =
+                                                            YAFFS_BLOCK_STATE_ALLOCATING;
+                                                        dev->alloc_block = blk;
+                                                        dev->alloc_page = c;
+                                                        dev->
+                                                            alloc_block_finder =
+                                                            blk;
+                                                } else {
+                                                        /* This is a partially written block that is not
+                                                         * the current allocation block.
+                                                         */
+
+                                                        yaffs_trace(YAFFS_TRACE_SCAN,
+                                                                "Partially written block %d detected",
+                                                                blk);
+                                                }
+                                        }
+                                }
+
+                                dev->n_free_chunks++;
+
+                        } else if (tags.ecc_result == YAFFS_ECC_RESULT_UNFIXED) {
+                                yaffs_trace(YAFFS_TRACE_SCAN,
+                                        " Unfixed ECC in chunk(%d:%d), chunk ignored",
+                                        blk, c);
+
+                                dev->n_free_chunks++;
+
+                        } else if (tags.obj_id > YAFFS_MAX_OBJECT_ID ||
+                                   tags.chunk_id > YAFFS_MAX_CHUNK_ID ||
+                                   (tags.chunk_id > 0
+                                    && tags.n_bytes > dev->data_bytes_per_chunk)
+                                   || tags.seq_number != bi->seq_number) {
+                                yaffs_trace(YAFFS_TRACE_SCAN,
+                                        "Chunk (%d:%d) with bad tags:obj = %d, chunk_id = %d, n_bytes = %d, ignored",
+                                        blk, c, tags.obj_id,
+                                        tags.chunk_id, tags.n_bytes);
+
+                                dev->n_free_chunks++;
+
+                        } else if (tags.chunk_id > 0) {
+                                /* chunk_id > 0 so it is a data chunk... */
+                                unsigned int endpos;
+                                u32 chunk_base =
+                                    (tags.chunk_id -
+                                     1) * dev->data_bytes_per_chunk;
+
+                                found_chunks = 1;
+
+                                yaffs_set_chunk_bit(dev, blk, c);
+                                bi->pages_in_use++;
+
+                                in = yaffs_find_or_create_by_number(dev,
+                                                                    tags.obj_id,
+                                                                    YAFFS_OBJECT_TYPE_FILE);
+                                if (!in) {
+                                        /* Out of memory */
+                                        alloc_failed = 1;
+                                }
+
+                                if (in &&
+                                    in->variant_type == YAFFS_OBJECT_TYPE_FILE
+                                    && chunk_base <
+                                    in->variant.file_variant.shrink_size) {
+                                        /* This has not been invalidated by a resize */
+                                        if (!yaffs_put_chunk_in_file
+                                            (in, tags.chunk_id, chunk, -1)) {
+                                                alloc_failed = 1;
+                                        }
+
+                                        /* File size is calculated by looking at the data chunks if we have not
+                                         * seen an object header yet. Stop this practice once we find an object header.
+                                         */
+                                        endpos = chunk_base + tags.n_bytes;
+
+                                        if (!in->valid &&       /* have not got an object header yet */
+                                            in->variant.file_variant.
+                                            scanned_size < endpos) {
+                                                in->variant.file_variant.
+                                                    scanned_size = endpos;
+                                                in->variant.file_variant.
+                                                    file_size = endpos;
+                                        }
+
+                                } else if (in) {
+                                        /* This chunk has been invalidated by a resize, or a past file deletion
+                                         * so delete the chunk*/
+                                        yaffs_chunk_del(dev, chunk, 1,
+                                                        __LINE__);
+
+                                }
+                        } else {
+                                /* chunk_id == 0, so it is an ObjectHeader.
+                                 * Thus, we read in the object header and make the object
+                                 */
+                                found_chunks = 1;
+
+                                yaffs_set_chunk_bit(dev, blk, c);
+                                bi->pages_in_use++;
+
+                                oh = NULL;
+                                in = NULL;
+
+                                if (tags.extra_available) {
+                                        in = yaffs_find_or_create_by_number(dev,
+                                                                            tags.
+                                                                            obj_id,
+                                                                            tags.
+                                                                            extra_obj_type);
+                                        if (!in)
+                                                alloc_failed = 1;
+                                }
+
+                                if (!in ||
+                                    (!in->valid && dev->param.disable_lazy_load)
+                                    || tags.extra_shadows || (!in->valid
+                                                              && (tags.obj_id ==
+                                                                  YAFFS_OBJECTID_ROOT
+                                                                  || tags.
+                                                                  obj_id ==
+                                                                  YAFFS_OBJECTID_LOSTNFOUND)))
+                                {
+
+                                        /* If we don't have  valid info then we need to read the chunk
+                                         * TODO In future we can probably defer reading the chunk and
+                                         * living with invalid data until needed.
+                                         */
+
+                                        result = yaffs_rd_chunk_tags_nand(dev,
+                                                                          chunk,
+                                                                          chunk_data,
+                                                                          NULL);
+
+                                        oh = (struct yaffs_obj_hdr *)chunk_data;
+
+                                        if (dev->param.inband_tags) {
+                                                /* Fix up the header if they got corrupted by inband tags */
+                                                oh->shadows_obj =
+                                                    oh->inband_shadowed_obj_id;
+                                                oh->is_shrink =
+                                                    oh->inband_is_shrink;
+                                        }
+
+                                        if (!in) {
+                                                in = yaffs_find_or_create_by_number(dev, tags.obj_id, oh->type);
+                                                if (!in)
+                                                        alloc_failed = 1;
+                                        }
+
+                                }
+
+                                if (!in) {
+                                        /* TODO Hoosterman we have a problem! */
+                                        yaffs_trace(YAFFS_TRACE_ERROR,
+                                                "yaffs tragedy: Could not make object for object  %d at chunk %d during scan",
+                                                tags.obj_id, chunk);
+                                        continue;
+                                }
+
+                                if (in->valid) {
+                                        /* We have already filled this one.
+                                         * We have a duplicate that will be discarded, but
+                                         * we first have to suck out resize info if it is a file.
+                                         */
+
+                                        if ((in->variant_type ==
+                                             YAFFS_OBJECT_TYPE_FILE) && ((oh
+                                                                          &&
+                                                                          oh->
+                                                                          type
+                                                                          ==
+                                                                          YAFFS_OBJECT_TYPE_FILE)
+                                                                         ||
+                                                                         (tags.
+                                                                          extra_available
+                                                                          &&
+                                                                          tags.
+                                                                          extra_obj_type
+                                                                          ==
+                                                                          YAFFS_OBJECT_TYPE_FILE)))
+                                        {
+                                                u32 this_size =
+                                                    (oh) ? oh->
+                                                    file_size :
+                                                    tags.extra_length;
+                                                u32 parent_obj_id =
+                                                    (oh) ? oh->parent_obj_id :
+                                                    tags.extra_parent_id;
+
+                                                is_shrink =
+                                                    (oh) ? oh->
+                                                    is_shrink :
+                                                    tags.extra_is_shrink;
+
+                                                /* If it is deleted (unlinked at start also means deleted)
+                                                 * we treat the file size as being zeroed at this point.
+                                                 */
+                                                if (parent_obj_id ==
+                                                    YAFFS_OBJECTID_DELETED
+                                                    || parent_obj_id ==
+                                                    YAFFS_OBJECTID_UNLINKED) {
+                                                        this_size = 0;
+                                                        is_shrink = 1;
+                                                }
+
+                                                if (is_shrink
+                                                    && in->variant.file_variant.
+                                                    shrink_size > this_size)
+                                                        in->variant.
+                                                            file_variant.
+                                                            shrink_size =
+                                                            this_size;
+
+                                                if (is_shrink)
+                                                        bi->has_shrink_hdr = 1;
+
+                                        }
+                                        /* Use existing - destroy this one. */
+                                        yaffs_chunk_del(dev, chunk, 1,
+                                                        __LINE__);
+
+                                }
+
+                                if (!in->valid && in->variant_type !=
+                                    (oh ? oh->type : tags.extra_obj_type))
+                                        yaffs_trace(YAFFS_TRACE_ERROR,
+                                                "yaffs tragedy: Bad object type, %d != %d, for object %d at chunk %d during scan",
+                                                oh ?
+                                                oh->type : tags.extra_obj_type,
+                                                in->variant_type, tags.obj_id,
+                                                chunk);
+
+                                if (!in->valid &&
+                                    (tags.obj_id == YAFFS_OBJECTID_ROOT ||
+                                     tags.obj_id ==
+                                     YAFFS_OBJECTID_LOSTNFOUND)) {
+                                        /* We only load some info, don't fiddle with directory structure */
+                                        in->valid = 1;
+
+                                        if (oh) {
+
+                                                in->yst_mode = oh->yst_mode;
+                                                yaffs_load_attribs(in, oh);
+                                                in->lazy_loaded = 0;
+                                        } else {
+                                                in->lazy_loaded = 1;
+                                        }
+                                        in->hdr_chunk = chunk;
+
+                                } else if (!in->valid) {
+                                        /* we need to load this info */
+
+                                        in->valid = 1;
+                                        in->hdr_chunk = chunk;
+
+                                        if (oh) {
+                                                in->variant_type = oh->type;
+
+                                                in->yst_mode = oh->yst_mode;
+                                                yaffs_load_attribs(in, oh);
+
+                                                if (oh->shadows_obj > 0)
+                                                        yaffs_handle_shadowed_obj
+                                                            (dev,
+                                                             oh->shadows_obj,
+                                                             1);
+
+                                                yaffs_set_obj_name_from_oh(in,
+                                                                           oh);
+                                                parent =
+                                                    yaffs_find_or_create_by_number
+                                                    (dev, oh->parent_obj_id,
+                                                     YAFFS_OBJECT_TYPE_DIRECTORY);
+
+                                                file_size = oh->file_size;
+                                                is_shrink = oh->is_shrink;
+                                                equiv_id = oh->equiv_id;
+
+                                        } else {
+                                                in->variant_type =
+                                                    tags.extra_obj_type;
+                                                parent =
+                                                    yaffs_find_or_create_by_number
+                                                    (dev, tags.extra_parent_id,
+                                                     YAFFS_OBJECT_TYPE_DIRECTORY);
+                                                file_size = tags.extra_length;
+                                                is_shrink =
+                                                    tags.extra_is_shrink;
+                                                equiv_id = tags.extra_equiv_id;
+                                                in->lazy_loaded = 1;
+
+                                        }
+                                        in->dirty = 0;
+
+                                        if (!parent)
+                                                alloc_failed = 1;
+
+                                        /* directory stuff...
+                                         * hook up to parent
+                                         */
+
+                                        if (parent && parent->variant_type ==
+                                            YAFFS_OBJECT_TYPE_UNKNOWN) {
+                                                /* Set up as a directory */
+                                                parent->variant_type =
+                                                    YAFFS_OBJECT_TYPE_DIRECTORY;
+                                                INIT_LIST_HEAD(&parent->
+                                                               variant.dir_variant.children);
+                                        } else if (!parent
+                                                   || parent->variant_type !=
+                                                   YAFFS_OBJECT_TYPE_DIRECTORY) {
+                                                /* Hoosterman, another problem....
+                                                 * We're trying to use a non-directory as a directory
+                                                 */
+
+                                                yaffs_trace(YAFFS_TRACE_ERROR,
+                                                        "yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found."
+                                                        );
+                                                parent = dev->lost_n_found;
+                                        }
+
+                                        yaffs_add_obj_to_dir(parent, in);
+
+                                        is_unlinked = (parent == dev->del_dir)
+                                            || (parent == dev->unlinked_dir);
+
+                                        if (is_shrink) {
+                                                /* Mark the block as having a shrink header */
+                                                bi->has_shrink_hdr = 1;
+                                        }
+
+                                        /* Note re hardlinks.
+                                         * Since we might scan a hardlink before its equivalent object is scanned
+                                         * we put them all in a list.
+                                         * After scanning is complete, we should have all the objects, so we run
+                                         * through this list and fix up all the chains.
+                                         */
+
+                                        switch (in->variant_type) {
+                                        case YAFFS_OBJECT_TYPE_UNKNOWN:
+                                                /* Todo got a problem */
+                                                break;
+                                        case YAFFS_OBJECT_TYPE_FILE:
+
+                                                if (in->variant.
+                                                    file_variant.scanned_size <
+                                                    file_size) {
+                                                        /* This covers the case where the file size is greater
+                                                         * than where the data is
+                                                         * This will happen if the file is resized to be larger
+                                                         * than its current data extents.
+                                                         */
+                                                        in->variant.
+                                                            file_variant.
+                                                            file_size =
+                                                            file_size;
+                                                        in->variant.
+                                                            file_variant.
+                                                            scanned_size =
+                                                            file_size;
+                                                }
+
+                                                if (in->variant.file_variant.
+                                                    shrink_size > file_size)
+                                                        in->variant.
+                                                            file_variant.
+                                                            shrink_size =
+                                                            file_size;
+
+                                                break;
+                                        case YAFFS_OBJECT_TYPE_HARDLINK:
+                                                if (!is_unlinked) {
+                                                        in->variant.
+                                                            hardlink_variant.
+                                                            equiv_id = equiv_id;
+                                                        in->hard_links.next =
+                                                            (struct list_head *)
+                                                            hard_list;
+                                                        hard_list = in;
+                                                }
+                                                break;
+                                        case YAFFS_OBJECT_TYPE_DIRECTORY:
+                                                /* Do nothing */
+                                                break;
+                                        case YAFFS_OBJECT_TYPE_SPECIAL:
+                                                /* Do nothing */
+                                                break;
+                                        case YAFFS_OBJECT_TYPE_SYMLINK:
+                                                if (oh) {
+                                                        in->variant.
+                                                            symlink_variant.
+                                                            alias =
+                                                            yaffs_clone_str(oh->
+                                                                            alias);
+                                                        if (!in->variant.
+                                                            symlink_variant.
+                                                            alias)
+                                                                alloc_failed =
+                                                                    1;
+                                                }
+                                                break;
+                                        }
+
+                                }
+
+                        }
+
+                }               /* End of scanning for each chunk */
+
+                if (state == YAFFS_BLOCK_STATE_NEEDS_SCANNING) {
+                        /* If we got this far while scanning, then the block is fully allocated. */
+                        state = YAFFS_BLOCK_STATE_FULL;
+                }
+
+                bi->block_state = state;
+
+                /* Now let's see if it was dirty */
+                if (bi->pages_in_use == 0 &&
+                    !bi->has_shrink_hdr &&
+                    bi->block_state == YAFFS_BLOCK_STATE_FULL) {
+                        yaffs_block_became_dirty(dev, blk);
+                }
+
+        }
+
+        yaffs_skip_rest_of_block(dev);
+
+        if (alt_block_index)
+                vfree(block_index);
+        else
+                kfree(block_index);
+
+        /* Ok, we've done all the scanning.
+         * Fix up the hard link chains.
+         * We should now have scanned all the objects, now it's time to add these
+         * hardlinks.
+         */
+        yaffs_link_fixup(dev, hard_list);
+
+        yaffs_release_temp_buffer(dev, chunk_data, __LINE__);
+
+        if (alloc_failed)
+                return YAFFS_FAIL;
+
+        yaffs_trace(YAFFS_TRACE_SCAN, "yaffs2_scan_backwards ends");
+
+        return YAFFS_OK;
+}
diff --git a/fs/yaffs2/yaffs_yaffs2.h b/fs/yaffs2/yaffs_yaffs2.h
new file mode 100644
index 00000000000..e1a9287fc50
--- /dev/null
+++ b/fs/yaffs2/yaffs_yaffs2.h
@@ -0,0 +1,39 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YAFFS_YAFFS2_H__
+#define __YAFFS_YAFFS2_H__
+
+#include "yaffs_guts.h"
+
+void yaffs_calc_oldest_dirty_seq(struct yaffs_dev *dev);
+void yaffs2_find_oldest_dirty_seq(struct yaffs_dev *dev);
+void yaffs2_clear_oldest_dirty_seq(struct yaffs_dev *dev,
+                                   struct yaffs_block_info *bi);
+void yaffs2_update_oldest_dirty_seq(struct yaffs_dev *dev, unsigned block_no,
+                                    struct yaffs_block_info *bi);
+int yaffs_block_ok_for_gc(struct yaffs_dev *dev, struct yaffs_block_info *bi);
+u32 yaffs2_find_refresh_block(struct yaffs_dev *dev);
+int yaffs2_checkpt_required(struct yaffs_dev *dev);
+int yaffs_calc_checkpt_blocks_required(struct yaffs_dev *dev);
+
+void yaffs2_checkpt_invalidate(struct yaffs_dev *dev);
+int yaffs2_checkpt_save(struct yaffs_dev *dev);
+int yaffs2_checkpt_restore(struct yaffs_dev *dev);
+
+int yaffs2_handle_hole(struct yaffs_obj *obj, loff_t new_size);
+int yaffs2_scan_backwards(struct yaffs_dev *dev);
+
+#endif
diff --git a/fs/yaffs2/yportenv.h b/fs/yaffs2/yportenv.h
new file mode 100644
index 00000000000..8183425448c
--- /dev/null
+++ b/fs/yaffs2/yportenv.h
@@ -0,0 +1,70 @@
+/*
+ * YAFFS: Yet another Flash File System . A NAND-flash specific file system.
+ *
+ * Copyright (C) 2002-2010 Aleph One Ltd.
+ *   for Toby Churchill Ltd and Brightstar Engineering
+ *
+ * Created by Charles Manning <charles@aleph1.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1 as
+ * published by the Free Software Foundation.
+ *
+ * Note: Only YAFFS headers are LGPL, YAFFS C code is covered by GPL.
+ */
+
+#ifndef __YPORTENV_LINUX_H__
+#define __YPORTENV_LINUX_H__
+
+#include <linux/version.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/xattr.h>
+#include <linux/list.h>
+#include <linux/types.h>
+#include <linux/fs.h>
+#include <linux/stat.h>
+#include <linux/sort.h>
+#include <linux/bitops.h>
+
+#define YCHAR char
+#define YUCHAR unsigned char
+#define _Y(x)     x
+
+#define YAFFS_LOSTNFOUND_NAME           "lost+found"
+#define YAFFS_LOSTNFOUND_PREFIX         "obj"
+
+
+#define YAFFS_ROOT_MODE                 0755
+#define YAFFS_LOSTNFOUND_MODE           0700
+
+#define Y_CURRENT_TIME CURRENT_TIME.tv_sec
+#define Y_TIME_CONVERT(x) (x).tv_sec
+
+#define compile_time_assertion(assertion) \
+        ({ int x = __builtin_choose_expr(assertion, 0, (void)0); (void) x; })
+
+
+#ifndef Y_DUMP_STACK
+#define Y_DUMP_STACK() dump_stack()
+#endif
+
+#define yaffs_trace(msk, fmt, ...) do { \
+        if(yaffs_trace_mask & (msk)) \
+                printk(KERN_DEBUG "yaffs: " fmt "\n", ##__VA_ARGS__); \
+} while(0)
+
+#ifndef YBUG
+#define YBUG() do {\
+        yaffs_trace(YAFFS_TRACE_BUG,\
+                "bug " __FILE__ " %d",\
+                __LINE__);\
+        Y_DUMP_STACK();\
+} while (0)
+#endif
+
+#endif